ML18176A051

APR1400 Chapter 15, Accident and Transient Analyses, Final Safety Evaluation Report

ML18176A051
Person / Time
Site:	05200046
Issue date:	09/28/2018
From:	Carolyn Lauron NRC/NRO/DNRL/LB2
To:
Lauron C /NRO/ 415-2736
Shared Package
ML18087A364	List: ML18043A887 ML18044A185 ML18067A292 ML18078A016 ML18081A505 ML18082A298 ML18173A101 ML18176A051 ML18180A327 ML18197A219 ML18199A332 ML18199A333 ML18211A569 ML18212A092 ML18215A239 ML18215A240 ML18215A241 ML18215A242 ML18227A061 ML18261A161 ML18264A141 ML18269A174 ML18269A241 ML18269A242 ML18270A072 ML18270A394 ML18270A452 ML18271A121 ML18271A132
References
APR1400 Chapter 15
Download: ML18176A051 (238)

Text

15 TRANSIENT AND ACCIDENT ANALYSES Transient and Accident Analyses Chapter 15, Transient and Accident Analyses, of this safety evaluation report (SER) describes the results of the review by the staff of the U.S. Nuclear Regulatory Commission (NRC or Commission), hereinafter referred to as the staff, of Chapter 15 of the Design Control Document (DCD), for the design certification (DC) of the Advanced Power Reactor 1400 (APR1400),

submitted by Korea Electric Power Corporation (KEPCO) and Korea Hydro & Nuclear Power Co., Ltd (KHNP), hereinafter referred to as the applicant.

In DCD Tier 2 Chapter 15, the applicant described the analysis of the APR1400 nuclear steam supply system (NSSS) to postulated transients in connection with its request to the NRC or Commission for design certification. This chapter describes the evaluation of the applicants DCD analyses of the APR1400 responses to postulated equipment failures or malfunctions found in Chapter 15 of the APR1400 DCD. These analyses are used to determine the limiting conditions for operation (LCO), limiting safety system settings (LSSS), and design specifications for safety-related structures, systems, and components (SSCs).

This section addresses DCD Tier 2 Sections 15.0.0, General Information for Safety Analyses, through 15.0.0.3, Reactor Trip System and Engineered Safety Feature Systems Analytical Limit and Delay Times, which include the classifications of transients and postulated accidents (PAs), accident analysis acceptance criteria, plant characteristics considered in the safety analysis and conformance with the applicable Three Mile Island (TMI) related requirements, unresolved safety issues (USI) and generic safety issues (GSI) documented in NUREG-0800, Standard Review Plan for the Review of Safety Analysis Reports for Nuclear Power Plants:

LWR Edition (hereafter also referred to as SRP). SRP Section 15.0.1, Radiological Consequence Analyses Using Alternative Source Terms, is related to radiological consequence analysis. SRP Section 15.0.2, Review of Transient and Accident Analysis Method, addresses the transient and accident analysis methods.

DCD Tier 1: The Tier 1 information associated with this section is found in Tier 1 Sections 2.2.1, 2.2.3, 2.2.4 and 2.8.2.

DCD Tier 2: The applicant provided a Tier 2 system description in Subsections 15.0.0.1 15.0.0.3, and Sections 15.0.1 and 15.0.2, which is summarized here in part, as follows:

15-1

Classification of Transients and Accidents The DCD Tier 2, Subsection 15.0.0.1, states that the plant transient and accident analyses provided in Chapter 15, Transient and Accident Analyses, represent a broad spectrum of initiating events that are categorized according to type and frequency. Each initiating event is categorized as an anticipated operational occurrence (AOO) or a PA. AOOs and PAs for the APR1400 fall into one of the following event types:

Increase in heat removal by the secondary system Decrease in heat removal by the secondary system Decrease in reactor coolant system (RCS) flow rate Reactivity and power distribution anomaly Increase in RCS inventory Decrease in RCS inventory Radioactive release from a subsystem or component The DCD further states that the range of events considered in the APR1400 safety analysis are determined by considering potential failures in plant systems or operator errors for each initiating event type. DCD Tier 2, Table 15.0-5 lists the APR1400 initiating events and their assigned frequency types (AOO or PA). The categorization according to frequency of occurrence, and categorization according to type conform to the guidance in SRP Section 15.0.

Plant Characteristics and Initial Conditions Assumed in the Accident Analysis The DCD Tier 2 Subsection 15.0.0.2 considers the complete operating domain, from power operation to cold shutdown. DCD Tier 2 Table 15.0-3 provides the range of values of each principle process variables utilized in the Chapter 15 DCD analysis for AOOs and PAs.

Additional important plant equipment, systems, core reactivity coefficients, power level, control rod parameters, and assumptions used in the safety analysis are provided in DCD Tier 2 Table 15.0-6. The plant systems evaluated in the accident analysis are provided in DCD Tier 2 Table 15.0-7.

Reactor Trip System and Engineered Safety Feature Systems Analytical Limit and Delay Times The reactor trip system and the relevant trip set points and response time are considered in DCD Tier 2 Subsection 15.0.0.3. DCD Tier 2 Table 15.0-2 lists the reactor protection system trips and response time credited in the event analysis of Chapter 15. The operation of the engineering safety features actuation system, electrical, instrumentation, and control systems required for safe shutdown are addressed in the description of each event. The operator actions credited to operate these systems are also described in each event description.

15-2

Component Failures, Nonsafety-Related Systems, and Operator Actions Considered in the Safety Analysis The DCD Tier 2 Subsections 15.0.0.4, Component Failures, through 15.0.0.6, Operator Action, consider component failures, including both active and passive failures. Nonsafety-related systems are not required to mitigate the consequences of events. Operator actions are required following some design basis events. The analysis of these operator actions are described in each event description.

Loss of Offsite Power, Long-Term Cooling, and Thermal Conductivity Degradation The DCD Tier 2 Subsections 15.0.0.7, Loss of Offsite Alternating Current (AC) Power, through 15.0.0.10, Thermal Conductivity Degradation, present the analyses of loss of offsite power, long-term cooling, and thermal conductivity degradation. The detailed application of thermal conductivity degradation is also documented in the event descriptions.

The relevant requirements of NRC regulations for this area of review, and the associated acceptance criteria, are in NUREG-0800, Sections 15.0, Introduction - Transient and Accident Analyses, and 15.0.2, Review of Transient and Accident Analysis Method. Review interfaces with other SRP sections also can be found in NUREG-0800, Sections 15.0 and 15.0.2. The relevant requirements are summarized below.

Title 10 of the Code of the Federal Regulations, (10 CFR), Part 20, Standards for Protection Against Radiation.

10 CFR Part 50, Domestic Licensing of Production and Utilization Facilities, (especially 10 CFR 50.46, Acceptance criteria for emergency core cooling systems for light-water nuclear power reactors, and Appendix A, General Design Criteria for Nuclear Power Plants.)

10 CFR Part 52, Licenses, Certifications, and Approvals for Nuclear Power Plants.

10 CFR Part 100, Reactor Site Criteria.

The following General Design Criteria (GDC) from 10 CFR Part 50, Appendix A are relevant to SRP Section 15.0:

GDC 2, Design bases for protection against natural phenomena, as it relates to the seismic design of SSCs whose failure could cause an unacceptable reduction in the capability of the residual heat removal system.

GDC 4, Environmental and dynamic effects design bases, as it relates to the requirement that SSCs important to safety be designed to accommodate the effects of and be compatible with the environmental conditions associated with normal operation, maintenance, testing, and postulated accident conditions, including such effects as pipe whip and jet impingement.

15-3

GDC 5, Sharing of structures, systems, and components, as it relates to the requirement that any sharing among nuclear power units of SSCs important to safety will not significantly impair their safety function.

GDC 10, Reactor design, as it relates to the RCS being designed with appropriate margin to ensure that specified acceptable fuel design limits (SAFDLs) are not exceeded during normal operations, including AOOs.

GDC 13, Instrumentation and control, as it relates to instrumentation and controls provided to monitor variables over anticipated ranges for normal operations, for AOOs, and for accident conditions.

GDC 15, Reactor coolant system design, as it relates to the RCS and its associated auxiliaries being designed with appropriate margin to ensure that the pressure boundary will not be breached during normal operations, including AOOs.

GDC 17, Electric power systems, as it relates to the requirement that an onsite and offsite electric power system be provided to permit the functioning of SSCs important to safety. The safety function for each system (assuming the other system is not working) shall be to provide sufficient capacity and capability to ensure that the acceptable fuel design limits and the design conditions of the reactor coolant pressure boundary are not exceeded during an AOO and that core cooling, containment integrity, and other vital functions are maintained in the event of an accident.

GDC 19, Control room, as it relates to the requirement that a control room be provided from which personnel can operate the nuclear power unit during both normal operating and accident conditions, including a loss of coolant accident (LOCA).

GDC 20, Protection system functions, as it relates to the reactor protection system being designed to initiate automatically the operation of appropriate systems, including the reactivity control systems, to ensure that the plant does not exceed SAFDLs during any condition of normal operation, including AOOs.

GDC 25, Protection system requirements for reactivity control malfunctions, as it relates to the requirement that the reactor protection system be designed to ensure that specified acceptable fuel design limits are not exceeded for any single malfunction of the reactivity control system, such as accidental withdrawal of control rods.

GDC 26, Reactivity control system redundancy and capability, as it relates to the reliable control of reactivity changes to ensure that specified acceptable fuel design limits are not exceeded even during AOOs. This is accomplished by ensuring that the applicant has allowed an appropriate margin for malfunctions such as stuck rods.

GDC 27, Combined reactivity control systems capability, and GDC 28, Reactivity limits, as they relate to the RCS being designed with an appropriate margin to ensure that acceptable fuel design limits are not exceeded and that the capability to cool the core is maintained.

15-4

GDC 29, Protection against anticipated operational occurrences, as it relates to the design of the protection and reactivity control systems and their performance (i.e., to accomplish their intended safety functions) during AOOs.

GDC 31, Fracture prevention of reactor coolant pressure boundary, as it relates to the RCS being designed with sufficient margin to ensure that the boundary behaves in a nonbrittle manner and that the probability of propagating fracture is minimized.

GDC 34, Residual heat removal, as it relates to the capability to transfer decay heat and other residual heat from the reactor so that fuel and pressure boundary design limits are not exceeded.

GDC 35, Emergency core cooling, as it relates to the RCS and associated auxiliaries being designed to provide abundant emergency core cooling.

GDC 55, Reactor coolant pressure boundary penetrating containment, as it relates to the isolation requirements of small-diameter lines connected to the primary system.

GDC 60, Control of releases of radioactive materials to the environment, as it relates to the radioactive waste management systems being designed to control releases of radioactive materials to the environment.

GDC 61, Fuel storage and handling and radioactivity control, as it relates to the requirement that the fuel storage and handling, radioactive waste, and other systems that may contain radioactivity be designed to ensure adequate safety under normal and postulated accident conditions.

Acceptance criteria adequate to meet the above requirements include:

1. For AOOs:

Pressure in the reactor coolant and main steam systems should be maintained below 110 percent of the design values in accordance with the American Society of Mechanical Engineers (ASME) Boiler and Pressure Vessel (B&PV) Code.

Fuel cladding integrity shall be maintained by ensuring that the minimum departure from nucleate boiling ratio (MDNBR) remains above the 95 percent probability, with 95 percent confidence (95/95) DNBR limit for pressurized water reactors (PWRs).

An AOO should not generate a postulated accident without other faults occurring independently or result in a consequential loss of function of the RCS or reactor containment barriers.

2. For PAs:

Pressure in the RCS and main steam system should be maintained below acceptable design limits, considering potential brittle as well as ductile failures.

15-5

Fuel cladding integrity will be maintained if the MDNBR remains above the 95/95 DNBR limit for PWRs.

The release of radioactive material shall not result in offsite doses in excess of the guidelines of 10 CFR Part 100.

A postulated accident shall not, by itself, cause a consequential loss of required functions of systems needed to cope with the fault, including those of the RCS and the reactor containment system.

3. For LOCAs:

The calculated maximum fuel element cladding temperature shall not exceed 1,200 degrees Celsius (°C) (2,200 degrees Fahrenheit [°F]).

The calculated total oxidation of the cladding shall nowhere exceed 0.17 times the total cladding thickness before oxidation.

The calculated total amount of hydrogen generated from the chemical reaction of the cladding with water or steam shall not exceed 0.01 times the hypothetical amount that would be generated if all of the metal in the cladding cylinders surrounding the fuel, excluding the cladding surrounding the plenum volume, were to react.

Calculated changes in core geometry shall be such that the core remains amenable to cooling.

After any calculated successful initial operation of the emergency core cooling system (ECCS), the calculated core temperature shall be maintained at an acceptably low value and decay heat shall be removed for the extended period of time required by the long-lived radioactivity remaining in the core.

The staff reviewed the categorization and classification of events that are analyzed along with the corresponding acceptance criteria. The staff noted that the categorization and classification of events corresponds to the guidance in Regulatory Guide (RG) 1.206, Combined License Applications for Nuclear Power Plants (LWR Edition), June 2007, and SRP Section 15.0, and therefore ensures that a broad spectrum of events has been considered and that the events are appropriately classified as AOOs or accidents with the proper associated acceptance criteria.

These are listed below:

Increase in heat removal by the secondary system.

Decrease in heat removal by the secondary system.

Decrease in RCS flow rate.

15-6

Reactivity and power distribution anomaly.

Increase in RCS inventory.

Decrease in RCS inventory.

Radioactive release from a subsystem or component.

Because the APR1400 categorization has been made consistent with RG 1.206, the staff concludes that the event categories for APR1400 are complete and acceptable.

Because AOOs and PAs can occur over a range of initial plant operating conditions, the APR1400 DCD Tier 2, Tables 15.0-3 and 15.0-6 list the range of values of each principal process variable considered in the event analyses and the major initial conditions for the relevant event analyses. The parameter range listed in DCD Tier 2 Table 15.0-3 is identical to that of the CE System 80+ design except for the lower bound of pressurizer water level and a slightly different core inlet temperature. Therefore, the staff considers the range of these major initial conditions acceptable. The nominal core power level, core flow rate, Doppler coefficients, and moderator temperature coefficients (MTCs) are listed in DCD Tier 2 Table 15.0-6 for each event, bounding the reactor responses during each event discussed in Chapter 15. Based on the analyses documented in all sections using the values listed in Table 15.0-6 the staff considers these values acceptable.

The control element assembly (CEA) drop time is identified in DCD Tier 2 Table 15.0-3 and is used as the input to all Chapter 15 event analyses which require control rod insertion. The insertion time is required as part of the LCO under APR1400 technical specification (TS) 3.1.5, CEA Alignment. Surveillance requirement 3.1.5.5 verifies each full-strength CEA drop time at 90 percent inserted position to be less than or equal to 4 seconds. The technical basis for the specified drop time is discussed in the TS Bases B 3.1.5.

The staff considers the shutdown CEA reactivity value 8.0 % and 5.5 % used for hot full power and hot zero power acceptable because these are conservative with respect to the values in DCD Tier 2 Sections 4.3, Nuclear Design, and 15.1.5, System Piping Failure Inside and Outside the Containment. The decay heat model is based on American Nuclear Society (ANS) 5.1-1979, Decay Heat Power in Light Water Reactors, for both large and small break LOCA events. Because it is in compliance with 10 CFR 50.46 and the requirements of 10 CFR Part 50, Appendix K, ECCS Evaluation Models, the staff concludes that the decay heat model is acceptable.

The reactor protection system (RPS) protects the fuel design and reactor coolant pressure boundary (RCPB). Specifically, the DNBR in the limiting coolant channel in the core shall be maintained not less than the DNBR safety limit of 1.29, the peak linear heat rate (LHR) shall be maintained less than 656 watts per centimeter (W/cm) (20 kilowatts per foot (kW/ft)) and reactor coolant system pressure shall be maintained less than 110 percent of design pressure. The staffs review of each event analyzed, and the submitted critical heat flux topical report confirms, 15-7

that the 1.29 DNBR safety limit is acceptable because the LHR limit of 656 W/cm (20 KW/ft) is supported by fuel design documented in DCD Section 4.2, Fuel System Design, while the pressure boundary limit meets the ASME code requirement and is identical to the approved limit of the CE System 80+ design. DCD Tier 2 Table 15.0-2 lists the RPS trips for which credit is taken in the analyses of Chapter 15. For these reasons, the staff concludes that these RPS trips and their delay time are designed properly to support the Chapter 15 analyses.

Component failures, including both active and passive failures, are considered as leading causes for many AOOs and PAs described in Chapter 15. The event categorization has covered many events caused by these potential component failures. The limiting single failure caused by component failures is selected from the list in DCD Tier 2, Table 15.0-4. The operator error, in the context of a single failure criterion, is a single incorrect action or omitted action by an operator in response to an initiating occurrence. Therefore, the staff treated all operator action errors as potential single failures. The applicant evaluated all these component failures and potential single failures for each event. Based on the evaluation results documented throughout Chapter 15, the staff concludes that these potential component failures are properly categorized and evaluated to satisfy the requirements for each type of event.

Loss of Offsite Power All Chapter 15 event analyses assume either loss of offsite power (LOOP) or a non-LOOP exists, whichever is more limiting.

Non-safety Related Systems Assumed in the Analysis Non-safety related systems are not required to mitigate the consequences of events. All event analyses of this chapter do not take the credit for non-safety related systems operation. The staff considers this approach conservative because taking no credit for non-safety related systems operation results in the most limiting scenarios for each event analyzed throughout this chapter.

Long-Term Cooling via Auxiliary Feedwater Injection Besides the long-term core cooling established by the ECCS as part of the LOCA analysis, the APR1400 design allows the operator to initiate a controlled system cooldown by using the auxiliary feedwater system in conjunction with the atmospheric dump valves. In the absence of a forced reactor coolant flow, RCS heat is removed by natural circulation along with the steam generators (SG). This provision has been credited in several event analyses, and the staff considers it acceptable because the event analyses show that there is sufficient core flow to remove the decay heat.

Thermal Conductivity Degradation Thermal conductivity of the fuel decreases with burnup of the fuel. The impact and modeling of this thermal conductivity degradation (TCD) is addressed in the NRC staffs review of the Fuel 15-8

System Design in Section 4.2 of the SER. NRC staff issued RAI 5-7954 during the review of the TCD analysis methodology to address concerns with the development of a TCD penalty and the application of this penalty to the transient and accident analyses.

The applicants response, provided in letter dated August 11, 2017 (ML17223B382), provided updates to the DCD that addressed the impact of TCD on transient and accident analyses. The update to Section 15.0.0 stated that analyses conducted in CESEC-III are not impacted by TCD because these analyses use conservative values for gap conductance that bound any increase in fuel temperature associated with TCD, and that large uncertainty accounted for in the fuel temperature coefficient bounds the TCD impact on the reactivity feedback during a transient.

Additionally, the applicant stated that thermal margin calculations performed in CETOP/TORC are not impacted by TCD because these codes do not consider conduction heat transfer within the fuel rods, but instead use dummy rods to define a heat flux boundary. Based on the use of bounding values in CESEC analyses and the use of dummy rods in CETOP/TORC, the staff finds the applicants updates acceptable because TCD is treated conservatively in CESEC-III and has no impact on CETOP/TORC calculations. The staff confirmed that this update was incorporated into the DCD. The impact of TCD on the CEA ejection and LOCA events is evaluated in Sections 15.4.8 and 15.6.5 of this SER, respectively.

Three Mile Island and Generic Issues The RG 1.206, Section C.I.15, Transient and Accident Analyses, provides a list of items to be addressed and guidance to combined license (COL) applicants on addressing TMI and Generic Issues and Bulletins. Chapter 15 of the APR1400 DCD has not systematically addressed these issues or provided a cross-reference to where resolution of each issue is described. However, DCD Tier 2, Section 1.9, summarizes the resolution of these issues. DCD Tier 2, Table 1.9-3 provides the evaluation results for each issue with cross-references to the related DCD sections. DCD Tier 2, Tables 15.0-11, 15.0-12, and 15.0-13 show how the APR1400 conforms with the applicable TMI-related requirements, USIs and GSIs, and the operating experience insights in Generic Letters and Bulletins, respectively. However, in DCD Tier 2 Table 15.0-12, the applicant stated, GSI-185 is related to post-LOCA boron dilution accidents, which are beyond design basis accidents. In addition, this issue is satisfied by NUREG-0933, Resolution of Generic Safety Issues. Therefore, it is not necessary to perform an evaluation to address this issue for APR1400. However, the staff disagrees with this statement because GSI-185, Control of Recriticality Following SBLOCAs, addresses those small-break loss-of-coolant accident (SBLOCA) scenarios in PWRs that involve steam generation in the core and condensation in the SGs, causing deborated water to accumulate in part of the RCS. Restart of RCS circulation may cause a recriticality event (reactivity excursion) by moving this deborated water into the core. Therefore, it is not a beyond design basis accident and needs to be properly addressed through analysis or testing to ensure no criticality during those SBLOCA scenarios. The staff issued RAI 430-8455, Question 15.06.05-22, requesting the applicant to address this issue in DCD Tier 2 Section 15.6.5. In its response to RAI 430-8455, Question 15.06.05-22 (ML16363A035), the applicant stated that the closure of Generic Issue No. 185, Control of recriticality following small-break LOCAs in PWRs, concluded that, boron dilution with restart of natural circulation is not a significant event in all Westinghouse, Combustion Engineering, and Framatome B&W reactors. Since the APR1400 has a geometry nearly identical to the System 80+ in terms of boron mixing phenomena, the applicant stated that the closure of GSI-185 for the System 80+ also applies to the APR1400. In addition, the applicant provided calculations of both a restart of a single RCP and a restart of natural 15-9

circulation simultaneously in all reactor loops. This is a conservative assumption based upon PKL tests, which showed the resumption of natural circulation in various loops is staggered in time. The applicants response also enumerated several conservative assumptions in its calculations of minimum boron concentrations. The staff agrees with the applicants assertion that the calculations are conservative and result in minimum concentrations that are well above the boron concentration associated with recriticality of the core. The staff finds the applicants response to RAI 430-8455, Question 15.06.05-22, to be acceptable. Therefore, the staff considers RAI 430-8455, Question 15.06.05-22, resolved and closed.

The applicant adopted the analysis acceptance criteria recommended by SRP Section 15.0, and applied the following specific acceptance criteria for fuel design and reactor coolant pressure boundary limits for APR1400.

1. The DNBR in the limiting coolant channel in the core is not less than the DNBR safety limit of 1.29 (95 percent probability with 95 percent confidence).

2. The hot fuel pellet in the core does not undergo centerline melting. Maintaining the peak LHR less than 656 W/cm (20 kW/ft) provides reasonable assurance that fuel centerline melt will not occur during an AOO.

3. The RCS pressure does not exceed the established pressure boundary limits (110 percent of design pressure).

The following basic acceptance criteria apply for APR1400 PAs.

1. Pressures in the reactor coolant and main steam systems are maintained below the acceptable design limits.

2. Fuel cladding integrity is maintained by providing reasonable assurance that the MDNBR remains above the 95/95 DNBR limit. If the MDNBR does not meet this limit, the fuel is assumed to have failed.

3. The release of radioactive material does not result in offsite doses in excess of the guidelines in 10 CFR 50.34, Contents of applications; technical information.

Any event-specific accident limits for allowable radiological releases are described in the appropriate sections.

4. The PA does not by itself result in a consequential loss of required functions of systems needed to cope with the fault, including those of the RCS and the reactor containment system.

The following additional acceptance criteria regarding core coolability are considered an extension of criteria 2 to 4 above for APR1400 reactivity-initiated accidents.

1. Peak radial average fuel enthalpy remains below 230 calories per gram (cal/g).

2. Peak fuel temperature remains below incipient fuel melting conditions.

15-10

3. Mechanical energy generated as a result of non-molten fuel-to-coolant interaction and fuel rod burst is addressed with respect to pressure boundary, reactor internals, and fuel assembly structural integrity.

4. No loss of coolable geometry occurs from fuel pellet or cladding fragmentation or dispersal or from fuel rod ballooning.

The staff reviewed the acceptance criteria of AOO and PA events and found the applicants criteria conform to the guidance in Section C.I.15.1 of RG 1.206, SRP Section 15.0, and SRP Section 4.2, Appendix B, Interim Acceptance Criteria and Guidance for the Reactivity Initiated Accidents. Therefore, the staff concludes that the applicant considered a broad spectrum of events and that the events are appropriately classified as AOOs or PAs with the proper associated acceptance criteria.

There are no COL Information Items associated with Section 15.0 of the APR1400 DCD.

The conclusion applicable to each transient and accident analysis are provided in their respective sections of this SER below.

Although the APR1400 design utilizes the alternative source term (AST) methodology, SRP Section 15.0.1 is focused on the application of AST to operating reactors and is not applicable to the APR1400 new reactor design review. See Section 15.0.3 of this SER for the details of the radiological consequence analyses for the APR1400.

The DCD Tier 2 Section 15.0.2 summarizes the analysis methods and computer codes used in non-LOCA safety analysis, large break LOCA (LBLOCA) evaluation, SBLOCA evaluation, and post LOCA long term cooling (LTC) evaluation. In addition, DCD Tier 2, Table 15.0-6, Summary of Computer Codes and Initial Conditions, lists the computer codes used and major initial conditions for each AOO and PA. The following section summarizes the methodology and computer codes used for relevant events.

DCD Tier 1: There are no DCD Tier 1 entries for this area of review.

DCD Tier 2: DCD Tier 2, Subsection 15.0.2.1 describes the methodology relevant to transient and accident analyses for non-LOCA, LBLOCA, SBLOCA and post-LOCA LTC events. Safety analyses for non-LOCA events are described in DCD Tier 2, Sections 15.1 through 15.6.

DCD Tier 2, Subsections 15.6.5.2.1, 15.6.5.2.2, and 15.6.5.2.3, further describe the safety analysis for LBLOCA, SBLOCA and post-LOCA LTC events, respectively.

15-11

The DCD Tier 2, Section 15.0.2.2, describes computer codes used for transient and accident analyses. DCD Tier 2, Table 15.0.2-1, and the following sections summarize the computer codes.

Inspection, Test, Analysis, and Acceptance Criteria (ITAAC): There are no ITAAC items for this area of review.

TS: TS associated with DCD Tier 2, Section 15.0.2, related to analytical methods used to determine core operating limits are described in documents referenced in DCD Tier 2, Chapter 16, Section 5.6.3.

In APR1400 DCD Section 15.0.2, the applicant described the computer programs and analytical methods used in non-LOCA safety analysis, LBLOCA evaluation, SBLOCA evaluation, and post LOCA LTC evaluation as detailed further below.

CESEC-III CESEC-III is the latest version of a computer code developed and modified by Combustion Engineering Inc. (CE). CESEC-III is designed to calculate the thermal-hydraulics of a two-by-four loop NSSS designed by CE. The applicant used CESEC-III to simulate APR1400 NSSS behavior during AOOs and PAs. Dynamic functions in the NSSS simulation include, in part, point kinetics neutron behavior, Doppler and moderator reactivity feedback, boron and CEA reactivity effects, multi-node average thermal hydraulics, reactor coolant pressurization and mass transport, RCS safety valve behavior, steam generation, SG water level, turbine bypass, main steam safety and turbine admission valve behavior, as well as alarm, control, protection, and engineered safety system features. Although most of the dynamic functions of the NSSS are simulated, steam turbines, condensers, and associated controls are not included as part of the simulation.

CESEC-III is a fixed node program. The primary system components modeled include the reactor vessel, reactor core, primary coolant hot and cold legs, pressurizer, SGs, and reactor coolant pumps (RCP). The secondary system components modeled include the shell of the SGs, the feedwater system, the main steam system, and control valves. The reactor vessel is symmetrically split with nodes representing the downcomer, inlet plenum, core, outlet plenum, and vessel upper head. The upper vessel head is common to both loops. Junctions in the inlet plenum and outlet plenum transfer a user-specified fraction (i.e., mixing factors) of flow between the parallel vessel components. The applicant modeled each hot and cold leg of the primary system as a single node. Each SG is modeled as four nodes (i.e., one node for the inlet plenum, one node for the outlet plenum, and two nodes representing the tube region). The code solves the thermal-hydraulic mass, momentum (limited), and energy equations using homogeneous equilibrium assumptions except in the pressurizer which is modeled as one node with two regions to simulate non-equilibrium conditions. The surge line, which connects the pressurizer to the hot leg of the RCS is not separately modeled as a node. Surge into and out of the pressurizer is calculated as a separate routine in the pressurizer model. The shell of each SG is modeled as a single node and a junction between the primary and secondary sides of the SG exists to simulate a SG tube rupture. CESEC-III can model the stored energy in the RCS piping and reactor vessel upper head, approximate the heat transfer through the SG tubes for each SG node rather than for a SG as a whole, and model the energy generated in the core.

15-12

The applicant used CESEC-III for all events that challenge the design pressure limits for the RCS and main steam system. CESEC-III calculates RCS and SG pressure for comparison to peak pressure limits. The applicant also used CESEC-III in sequence with TORC/CETOP to analyze most of the non-LOCA transients at full-flow conditions within the capabilities of the simplified TORC/CETOP DNBR model. CESEC-III calculates the time of reactor trip and time-varying temperature, pressure, flow, and power for TORC/CETOP DNBR calculations. The applicant also used CESEC-III in sequence with STRIKIN-II to analyze non-LOCA transients at full-flow conditions that challenge fuel temperature limits. CESEC-III calculates the time of reactor trip and time-varying temperature, pressure, flow, and power for STRIKIN-II peak fuel temperature calculations.

TORC TORC is a computer code developed and modified by CE. TORC is designed to calculate core thermal margin for steady state operation. TORC solves conservation equations for a three-dimensional (3-D) representation of the open-lattice core that is divided into control volumes to determine the local coolant conditions at all points within the core. The TORC models were generated by using a series of sub-channel arrangements, radial and axial power distributions, and spacer grid locations of each test section. Lateral transfer of mass, momentum, and energy between neighboring flow channels (open-core effects) are accounted for in the calculation of local coolant conditions. The open-core method is more precise and the detailed modeling in this approach reduces the necessity for adding conservatism to compensate for simplifications in the model. The applicant used the local coolant conditions in conjunction with the CHF correlation to determine the minimum value of the DNBR for the reactor core.

The TORC computer code is an adaptation of the COBRA-IIIC computer code. These adaptations include non-zero lateral boundary conditions, simplified transverse momentum, and the addition of correlations and subroutines for calculating fluid properties, two-phase friction factors, void fraction, cross flow resistance and CHF. The conservation equations for mass, momentum, and energy are derived on a control volume basis and assume steady-state, 1-D, single phase or homogeneous two-phase flow. The determination of hot channel coolant conditions and MDNBR are performed through three sequential steps (i.e., core-wide, hot fuel assembly, and hot subchannel). Results from the TORC computer code include the core radial distribution of the relative channeled axial flow rate that is used to calibrate CETOP.

A simplified TORC (S-TORC) design modeling method was developed that uses only two sequential calculations (i.e., core-wide analysis determining lateral boundary conditions for the hot assembly, and a hot assembly analysis determining hot subchannel coolant conditions and MDNBR). However, S-TORC has not been used to calculate APR1400 DNBRs since S-TORC has been superseded by CETOP.

Conservation equations are solved using core inlet flow and enthalpy calculated by CESEC-III.

TORC and HERMITE are used in combination for transients that challenge the DNB design limits under reduced flow conditions such as loss-of-flow, seized RCP rotor, or RCP shaft shear.

CETOP CETOP is a computer code developed and modified by CE and, like TORC, is designed to calculate core thermal margin for steady state operation. CETOP is an open-lattice thermal hydraulic code that solves the same conservation equations and uses the same constitutive 15-13

equations as TORC. CETOP is a faster running computer code than TORC or S-TORC because it uses a one-step calculation for the core thermal margin in the hot sub-channel.

CETOP modeling uses a four-channel core representation with a lumped-channel technique and transport coefficients for crossflow and turbulent mixing between adjoining channels.

CETOP also uses a prediction-correction method to solve the conservation equations compared to an iterative method used in TORC. CETOP is benchmarked against TORC to ensure a conservative DNBR calculation. Conservatism is achieved in CETOP by applying an adjusted hot assembly flow factor. The hot assembly flow factor accounts for the deviations in MDNBR due to CETOP model simplifications relative to TORC.

CETOP is used in sequence with CESEC-III to analyze most of the non-LOCA transients at full-flow conditions within the capabilities of the simplified CETOP DNBR model. CESEC-III calculates the time of reactor trip and time-varying temperature, pressure, flow, and power for CETOP DNBR calculations.

COAST The COAST computer code is used to calculate the reactor coolant flow coastdown transient.

The COAST model is divided into seven flow paths and four nodal points. The four nodal points are located at the junction of the loop flow paths where a common nodal pressure exists in the reactor vessel inlet and outlet plenums and in the outlet plenum of each of the two SGs. The seven flow paths include a core region, two hot legs, and four cold legs with RCPs. COAST can calculate the flow coastdown for any combination of active and inactive RCPs including forward and reverse flow in any path. Conservation of mass is applied at each of the four node points and conservation of momentum is applied to each of the seven flow paths assuming unsteady, 1-D flow of an incompressible fluid.

The COAST model uses the inputs for pressure loss coefficients, fluid densities, momentum average fluid weights, pump characteristic curve, pump inertia, and operating conditions.

Pressure losses due to friction, bends, and shock losses are assumed to be proportional to the flow velocity squared. Pump dynamics are modeled with the aid of a traditional head-flow characteristic curve for fully operable pumps and with a 4-Quadrant diagram (homologous curves of pump head and torque on coordinates of speed versus flow) for pumps at other than rated speed. The traditional head-flow curve (i.e., quadrant 1) is obtained from the manufacturer since each pump undergoes head-flow testing to determine its characteristics.

Model test data (i.e., a hydraulically similar pump of the same specific speed) is used to provide data in quadrant 2 (positive head, negative flow).

The pump dynamic equations are different in form depending on whether the pump is coasting down (inactive) or supplied with electrical power (active). For an active pump, it is assumed that the electrical torque provided by the pump motor is sufficient to maintain constant pump speed.

For an inactive pump, an equation expressing the conservation of angular momentum is written in terms of pump-motor inertia and torque exerted on the pump impeller by the coolant. The coolant momentum equation and pump momentum equation are coupled through the pump 4-Quadrant diagram. The governing conservation equations of fluid mass and loop momentum are solved simultaneously with the pump dynamics equations using conventional numerical integration techniques to obtain the transient flow coastdown. COAST is used to calculate the reactor coolant flow coastdown for any combination of active and inactive pumps and forward or reverse flow in the hot or cold legs. COAST is used to calculate time-variant 15-14

core flow rate that is input into HERMITE as part of the analysis process for a single RCP rotor seizure event.

STRIKIN-II STRIKIN-II is a computer code developed and modified by CE used to simulate the heat conduction in the reactor fuel rods and associated surface heat transfer. STRIKIN-II is used to calculate the transient DNBR, coolant enthalpy, and fuel temperatures in the hot rod in the hot assembly. The STRIKIN-II code solves conservation equations at the specified inlet flow to calculate mass flow rate. It also solves the one-dimensional (axial) conservation of energy equation and the equations of state for the fluid with provisions for local fluid expansion.

STRIKIN contains a full range of heat transfer correlations and provides a single- or dual-closed channel model of a core flow channel to calculate the clad and fuel temperatures for an average or hot fuel rod and the extent of the zirconium water reaction for a cylindrical geometry fuel rod.

In a fuel rod the STRIKIN-II code solves (radially) the one-dimensional radial cylindrical heat conduction equation for up to 20 axial regions along the fuel rod. The conduction model explicitly represents the gas region and dynamically calculates the gap conductance in each axial region. The STRIKIN-II model incorporates all major reactivity feedback mechanisms, a maximum of six delayed neutron groups, both axial and radial segmentation of the fuel element, and control rod scram initiation on high neutron power. The STRIKIN-II code solves the equations of conservation of mass and energy and the equation of state in the fluid channel adjacent to the rod at each of the axial locations used for the conduction solution.

The STRIKIN-II dual-closed channel model can represent two parallel channels. In the first channel (i.e., average rod in hot assembly) the code performs a fluid energy balance to get the enthalpy distribution along the entire channel. The axially dependent dynamically calculated enthalpy in the first channel is transferred and used in the second channel (i.e., hot rod). The basic assumption in the calculation is that of perfect radial mixing of the fluid within the assembly.

STRIKIN-II is used for both LOCA and non-LOCA events. STRIKIN-II is used in sequence with CESEC-III to calculate the cladding and fuel temperatures for the CEA ejection accident that challenges the departure from nucleate boiling (DNB) design limit and the enthalpy design limit for the reactivity induced accident. STRIKIN-II is used to determine the hot channel or hot spot fuel response including MDNBR, fuel temperatures, and cladding temperature. STRIKIN-II is also used in sequence with CESEC-III to calculate fuel centerline and cladding temperatures in response to a SLB. The NSSS thermal hydraulic response to the SLB outside containment is simulated using the CESEC-III computer program and the CESEC-III results are used as input to STRIKIN-II to calculate fuel centerline and cladding temperatures. STRIKIN-II also calculates the peak cladding temperature and maximum cladding oxidation to evaluate the fuel rod thermal response up until the initial reversal of the coolant flow at the core inlet during an SBLOCA. The PARCH computer code calculates the cladding and fuel temperature after the flow reversal time (PARCH code is further explained below).

HERMITE HERMITE is a 1-D computer code model used to determine the short-term response of the reactor core for some events based on the approved FIESTA code [Reference 1]. HERMITE solves the few-group space- and time-dependent neutron diffusion equation including the 15-15

feedback effects of fuel temperature, coolant temperature, coolant density, and control rod motion. The neutronics equations are solved by a nodal expansion method or a finite difference method. The fuel temperature model explicitly represents the pellet, gap and clad. Heat conduction equations are solved by a finite difference method.

HERMITE can perform steady-state, depletion, and transient calculations in 1-D, 2-D, and 3-D geometries. It models control rod motion in both depletion and transient modes. It can solve for 1 to 4 neutron energy groups and 1 to 6 delayed neutron groups, and can solve for both equilibrium and transient xenon concentration. It can solve neutronic only, thermal-hydraulic only, or coupled neutronic and thermal-hydraulic calculations. The cross section model provides few group cross sections tabulated as a function of burnup, temperature, density, and boron concentration. Albedos are used to model the boundary condition in the reflector region.

These albedos come from either 2-D DOT IV transport theory code or 1-D ANISN transport code.

HERMITE uses a closed-channel model or an open-channel model in the TORC program as the thermal-hydraulic model to calculate the feedback effects of fuel temperature, coolant temperature, coolant density, xenon distributions, and control rod motion. The core is modeled as a collection of closed, parallel flow channels with a user-defined axial nodalization. Bottom and top reflectors can be modeled as a separate axial node for each channel. Within each flow channel, the fuel pins are modeled uniformly, and at each axial level, they are assumed to use the same average linear heat rate. Axial expansion of the coolant and two phase slip flow are modeled in the flow channels. For water properties, the code can model subcooled, saturated, superheated, or supercritical water based on ASME steam tables. Core pressure, channel inlet temperatures, and channel inlet flow rates are user-specified. The surface heat flux is calculated using either the Dittus-Boelter correlation for forced convection or the Jens-Lottes correlation for nuclear boiling.

HERMITE is used in combination with COAST to analyze the reactor core response to total loss of reactor coolant flow, RCP rotor seizure, and RCP shaft break.

RELAP5/MOD3.3K RELAP5/MOD3.3 is an NRC supported computer code developed jointly by the NRC and a consortium consisting of several countries and domestic organizations. RELAP5/MOD3.3 is a highly generic code that, in addition to calculating the coupled behavior of a RCS and a core during a transient, can be used for simulation of a wide variety of hydraulic and thermal transients in both nuclear and non-nuclear systems involving mixtures of steam, water, noncondensable, and solute. Specific applications have included simulations of LBLOCAs, SBLOCAs, and operational transients, such as anticipated transient without scram (ATWS),

LOOP, loss of feedwater, and loss of flow.

The RELAP5/MOD3.3 code is based on a non-homogeneous, non-equilibrium model for the two-phase system that is solved by a fast, partially implicit numerical scheme to permit economical calculation of system transients.

The applicant uses a generic component modeling approach that permits simulating a variety of thermal hydraulic systems. Component models include pumps, valves, pipes, heat releasing or absorbing structures, reactor point kinetics, electric heaters, jet pumps, separators, accumulators, and control system components. Control system and secondary system 15-16

components are included to permit modeling of plant controls, turbines, condensers, and secondary feedwater systems. In addition, special process models are included for effects such as form loss, flow at an abrupt area change, branching, choked flow, boron tracking, and noncondensable gas transport.

RELAP/MOD3.3K, a modified version of RELAP5/MOD3.3, is used in combination with CONTEMP4/MOD5 to evaluate system thermal-hydraulics and containment back pressure response during a LBLOCA.

CONTEMPT4/MOD5 CONTEMPT series of computer codes have been developed by Edgerton, Germeshausen, and Grier, Incorporated (EG&G), Idaho, and later by Brookhaven National Laboratory (BNL) to calculate the thermal-hydraulic response of multi-compartment PWR and boiling water reactor (BWR) containment systems to a postulated LOCA. Development of the code was sponsored by the NRC. CONTEMPT4/MOD5 calculates compartment pressures, temperatures, and mass and energy inventories as a function of time due to the LOCA mass and energy transfer and the effect of the active and passive safety systems. CONTEMPT4/MOD5 is modified to incorporate passive containment cooling models and includes water pool pressure suppression system modeling, hydrogen tracking and burn capability, a gas radiation heat transfer model, a user-specified junction (leakage) area as a function of pressure or time, an alternative containment spray model, and containment spray carryover capability.

CONTEMPT4/MOD5 is used to calculate the minimum containment pressure and temperature in the realistic LBLOCA analysis for core response. A different containment code, GOTHIC, is used for calculations of peak containment pressure and temperature for the LBLOCA analysis.

Containment pressure is affected by the mass and energy release rate, and thermal-hydraulic phenomena are dependent on the containment back pressure. Therefore, RELAP5/MOD3.3K and CONTEMPT4/MOD5 are integrated to provide back pressure to RELAP5/MOD3.3K as the boundary condition at the break to calculate the break flow rate into the containment at every time step.

CEFLASH-4AS The CEFLASH-4A computer code simulates the thermal-hydraulic behavior of the blowdown during a LOCA. The CEFLASH-4AS code, used for APR1400 SBLOCA analysis, was modified from CEFLASH-4A to enable the program to handle phase separation during a SBLOCA. Many of the modifications to handle phase separation involved translating the basic applicability from a homogeneous to a heterogeneous treatment of the primary system coolant. Major modifications included the development of a new flow path representation, core heat transfer method, and bubble rise model.

The CEFLASH-4AS code is a multi-node, multi-flow-path code with which the NSSS is described as a series of volume nodes connected by flow paths that contain no volume. The equations of conservation of mass and energy are solved for the volume nodes at each time step. The static pressure in each node is determined at each time step using an equation of state and assuming that the fluid within each node is in thermodynamic equilibrium. The flowpaths connect the volume nodes at specified elevations. The conservation of momentum 15-17

equation is solved for each flow path assuming that the fluid within each flowpath is homogeneous and at thermodynamic equilibrium.

The complete SBLOCA transient is modeled by CEFLASH-4AS. CEFLASH-4AS transfers data to either STRIKIN-II or PARCH which calculate the thermal response of the fuel rods. STRIKIN is used to calculate fuel rod response until the time of core flow reversal during the SBLOCA.

PARCH is used to calculate fuel rod response after the time of core flow reversal.

CEFLASH-4AS calculated reactor vessel pressure and core conditions are transferred to COMPERC-II for calculating the hydraulic response of the reactor plant during the reflood period of a SBLOCA (i.e., if the safety injection tanks (SIT) actuate and COMPERC-II calculations of hydraulics in the reactor vessel are necessary).

COMPERC-II COMPERC-II is a computer code developed and designed specifically by CE to describe the hydraulics in the reactor vessel during the reflooding of the reactor core by emergency core cooling (ECC) water when the core contains a pool of boiling water. COMPERC-II models the fluid within the reactor vessel as five variable volume regions and one fixed volume region. The application of COMPERC-II analysis of an SBLOCA is distinguished by the high pressures occurring in the system during the reflood phase. The pressure varies down from that required for actuation of the ECC injection from the SITs.

CEFLASH-4AS calculates the hydraulic response of APR1400 during the blowdown phase and COMPERC-II calculates the hydraulic response of APR1400 during the reflood period of a SBLOCA. COMPERC-II is initialized after the SITs are actuated and after reversal of the coolant flow at the core inlet with reactor vessel pressure and core conditions obtained from CEFLASH-4AS. COMPERC-II calculates reactor vessel refill and reflood and obtains the appropriate heat transfer coefficient for the hot channel. Together, CEFLASH-4AS and COMPERC-II completely describe the fluid hydraulics and thermodynamics of both the blowdown and the refill-reflood processes. The hydraulic conditions calculated by COMPERC-II are transferred to PARCH, which calculates the thermal response of the fuel rods.

PARCH PARCH is a pool boiling axial rod and coolant heatup code developed at CE for use in the SBLOCA analysis. PARCH is used for analysis of conditions that occur during SBLOCA following initial reversal of the coolant flow at the core inlet. Although PARCH was designed specifically for the SBLOCA analysis, it is more generally applicable to any fuel rod heatup problem defined by pool boiling heat transfer and a time varying two-phase level.

PARCH calculates fuel rod temperatures during periods of pool boiling by evaluating the removal of heat from a fuel rod that is surrounded by a quasi-static fluid partially or totally covering the length of the fuel rod. Thus, the mechanisms for convective heat transfer are pool boiling below the two-phase fluid surface and forced convection to steam above the two-phase fluid surface. PARCH contains heat transfer correlations for pool boiling transfer, transition pool boiling, pool film boiling, and convection to vapor. PARCH solves the one-dimensional radial conduction equation at up to 21 axial positions along the fuel rod. It solves the conservation of energy equation in both the two-phase and steam regions. The mass flow rate of steam in the steam region is determined from the boiloff and flashing rates computed for the two-phase region and is spatially uniform.

15-18

PARCH is used sequentially with STRIKIN-II and in combination with COMPERC-II in the analysis of SBLOCAs. STRIKIN, a forced convection code, is used to calculate fuel rod response during the early blowdown period when the flow rates are high until the time of core flow reversal. The later portion of the small break blowdown and the refill periods are characteristically quiescent. The core behaves as a boiling pot with a time-varying two-phase level. PARCH, which utilizes the core two-phase level and pool boiling heat transfer correlations, is used in the fuel rod temperature calculations during this quiescent period. The hydraulics of the SBLOCA are treated by CEFLASH-4AS during the blowdown period and COMPERC-II during refill. The hydraulic conditions calculated by COMPERC-II are transferred to PARCH, which calculates the thermal response of the fuel rods.

CELDA CELDA is a computer code developed by CE for use in calculating the long-term primary system depressurization and refill following a SBLOCA to determine whether the refilling of the RCS is achieved. The CELDA model is applicable to analysis of the entire spectrum of small breaks for assessing the performance of the ECCS. CELDA is a one-node blowdown code. A bubble rise model and a hydrostatic balance are used to establish the flow condition from the small breaks. CELDA models core heat generation from fission product decay, SG heat transfer, wall heat transfer, phase separation, and critical flow. Break flow is calculated using the Henry-Fauske model for subcooled flow and the Moody model for saturated flow.

CELDA is used sequentially with CEFLASH-4AS and in combination with CEPAC for the analysis of SBLOCAs. The analysis of the later stages of a SBLOCA use CELDA. CELDA is initialized from the CEFLASH-4AS analysis that is performed for the early part of the accident.

The SG secondary temperature as a function of time is input from the CEPAC analysis because CELDA does not contain an independent SG model. CELDA also runs the BORON code as a subroutine to calculate post-LOCA decay heat fractions.

BORON BORON is a computer code developed by CE to compute the boric acid concentration in the core and determines whether the core flow is sufficient to prevent the solubility limit of boric acid from being exceeded. Steam removed from the core is calculated using decay heat curves. As water boils off in the core, boric acid is deposited in the vessel. The high initial core decay heat power causes a high initial rate of accumulation of boric acid that decreases with time as core power decays.

BORON is run as a subroutine of CELDA for small breaks and as a separate code for large breaks. The BORON code for APR1400 was modified to model the in-containment refueling water storage tank (IRWST). The BORON code is applied to calculate the boric acid concentration following double-ended guillotine breaks.

CEPAC CEPAC is a computer code developed by CE as a NSSS transient simulation code based on CE's digital simulation code CESEC. CEPAC was designed to be a best estimate thermal-hydraulic tool and not intended to be used for licensing analysis even though results were benchmarked against other full scope simulator codes.

15-19

CEPAC is used to calculate the secondary system temperature versus time. CEPAC models the SGs, including the operation of SG atmospheric dump valves, and provides the secondary system temperature as a function of time to be used as input for the NATFLOW and CELDA codes. NATFLOW and CELDA codes do not contain independent SG models. CEPAC also determines the quantity of SG auxiliary feedwater consumed.

NATFLOW NATFLOW is a computer code developed by CE to calculate the steady state RCS, core, and loop natural circulation flow rates and temperatures after the RCS has been refilled following a SBLOCA and the SGs function as heat sinks. NATFLOW assumes the RCS is filled and maintained at a pressure above the saturation pressure corresponding to the hot leg temperature. NATFLOW solves conservation of mass and energy equations using a six region model. Fluid properties are determined for each region based on pressure and enthalpy.

Natural circulation flow rate is calculated at discrete points in time for input-specified RCS pressure, SG temperature, and decay heat power fraction.

NATFLOW does not contain an independent SG model; therefore, NATFLOW is run in an iterative sequence with the CEPAC code which provides the secondary system temperature as a function of time.

Title 10 CFR Part 52, Section 47, Contents of applications; technical information, and Section 79, Contents of applications; technical information in final safety analysis report, require a final safety analysis report (FSAR) to analyze the design and performance of the structures, systems, and components (SSCs). Safety evaluations, performed to support the FSAR, include the transient and accident analyses. Approved transient and accident analysis methodologies are used to establish a partial basis for establishing compliance with the Commissions regulations identified in Section 15.0.0.3 of this SER, and for demonstrating that the relevant acceptance criteria are met.

The application of computer codes to the APR1400 safety analysis is described in DCD Tier 2, Section 15.0.2.

CESEC-III CESEC-III is documented in CENPD-107 [Reference 2] and LD-82-001 [Reference 3]. The NRC has previously reviewed and accepted CESEC-III in a letter from C.O. Thomas (NRC) to A.E. Scherer (CE) [Reference 4] as an acceptable computer code to perform the accident analysis described in DCD Tier 2, Chapter 15, excluding ATWS, for St. Lucie-2, Waterford-3, and Arkansas-2 nuclear power plants (NPPs). CESEC-III was also approved as an acceptable method for CE System 80+ non-LOCA analysis in NUREG-1462, Final Safety Evaluation Report Related to the Certification of the System 80+ Design Docket No.52-002.

[Reference 5]

15-20

CESEC-III has been verified by the applicant through comparison to results of calculations from other thermal-hydraulic computer codes and to experimental data. As part of the CESEC-III approval [Reference 1] the staff audited CESEC-III and the relevant calculations. These calculations were for a System 80+ reactor plant SLB and feedwater line break events. The results of the comparison showed good agreement between the two codes and confirmed the acceptability of CESEC-III to model severe SLB depressurization events and severe feedwater line break pressurization events. The staff concluded that conservative calculations can be obtained by using conservative boundary and initial conditions in CESEC-III. CESEC-III verification also consisted of a direct comparison of CESEC-III to COAST for a four pump coastdown. Volumetric core flow rate from CESEC-III and COAST during the four pump coastdown was in excellent agreement. CESEC-III verification also consisted of a direct comparison of CESEC-III to CEFLASH-4AS for a cold leg leak. Although CEFLASH-4AS is a heterogeneous code with nodal fluid conditions evaluated at local pressures and CESEC-III is a homogeneous code with nodal fluid conditions evaluated at a single RCS pressure, the comparison of key parameters showed generally good agreement. Qualification of CESEC-III consisted of a comparison of CESEC-III calculations to experimental results from a hot zero power four pump coastdown, a turbine trip, and a natural circulation cooldown. Key parameters calculated by CESEC-III for these three tests were generally in good agreement with the test data.

The acceptability of CESEC-III for ATWS events was not reviewed since CESEC-III was not used in the analysis of APR1400 ATWS events.

The previously approved version of CESEC-III was modified by the applicant to implement models of APR1400 advanced design features including a pilot operated safety relief valve (POSRV) instead of a safety relief valve (SRV) and a centrifugal charging pump (CCP) instead of a positive displacement pump for the chemical and volume control system.

KHNP document 00000-SS-VV-030 [Reference 6] is a verification and validation (V&V) report of the changes to CESEC-III related to the POSRV and CCP models. The staff determined that the modeling of the POSRVs and the CCP is acceptable as part of the evaluation of the chemical and volume control system malfunction that increases the reactor coolant inventory event, provided in Section 15.5.2 of this SER. Based upon the previous approval of the CESEC-III code, the verification performed by the applicant, and the acceptable modeling of the POSRVs and CCPs (as documented in Section 15.5.2.4.2 of this SER), the staff finds the use of CESEC-III acceptable for non-LOCA analyses of the nuclear steam supply system for the APR1400.

TORC TORC is documented in CENPD-161-P [Reference 7] and CENPD-206-P-A [Reference 8]. The staff approved TORC for Chapter 15 non-LOCA safety analysis in an SER [Reference 9].

TORC was also approved as an acceptable method for CE System 80+ non-LOCA thermal analysis in NUREG-1462.

TORC is verified by the applicant through comparison to data for three operating PWRs (i.e.,

Maine Yankee, Zion-1, and Biblis-A), single phase flow data from a 1/5 scale open-core reactor flow model, a Westinghouse Electric Corporation (Westinghouse) flow blockage test assembly, 15-21

and two-phase flow data obtained from the European two-phase flow group exercise

[Reference 8].

Subsequent to the staffs approval of TORC, a new TORC CHF correlation (KCE-1) was incorporated to characterize APR1400 PLUS7 fuel performance. The KCE-1 CHF correlation is the same as the Westinghouse CE-1 CHF correlation; however, a new set of coefficients for KCE-1 were determined by a non-linear multiple-regression analysis for the measured CHF data applicable to PLUS7 fuel. The staff previously reviewed the topical report for the KCE-1 CHF correlation, APR1400-F-C-TR-12002 [Reference 10], and accepted the use of KCE-1 CHF correlation for PLUS7 fuel thermal-hydraulic performance and plant safety analyses done with the TORC computer code. The staff evaluation of this topical report is documented in the staffs SER on KCE-1 CHF correlation topical report [Reference 11].

TORC is limited to steady-state calculations of reactor core thermal-hydraulic performance involving unblocked flow channels or subchannels and with conditions of single-phase flow or homogeneous two-phase flow in the channels or subchannels. The boundary conditions for TORC calculations are obtained as a function of time from a transient analysis code (typically CESEC-III). Conditional upon the prior imposed limitations, the staff reviewed the acceptability of TORC for calculating DNBR for DCD Tier 2 Chapter 15 non-LOCA events and concludes that TORC is an acceptable computer program for use in APR1400 licensing applications. This approval is based on the prior approval of TORC for calculating DNBR for reactor cores of similar geometry to the APR1400 design and acceptance of the KCE-1 CHF correlation.

CETOP CETOP is documented in CEN-214(A)-P [Reference 12] and was previously approved by the staff for the Chapter 15 non-LOCA safety analysis for the ANO-2 CE plant in an amendment to the facility operating license for ANO-2 [Reference 13]. The staff also approved CETOP as an acceptable method for CE System 80+ non-LOCA thermal analysis in NUREG-1462. CETOP is benchmarked to TORC as a means of V&V [References 14 and 15].

Subsequent to the approval of CETOP for CE System 80+ non-LOCA analysis, a new CETOP CHF correlation (KCE-1) was incorporated to characterize APR1400 PLUS7 fuel performance.

The KCE-1 CHF correlation is the same as the Westinghouse CE-1 CHF correlation; however, a new set of coefficients for KCE-1 were determined by a non-linear multiple-regression analysis for the measured CHF data applicable to PLUS7 fuel. The staff previously reviewed the topical report for the KCE-1 CHF correlation, APR1400-F-C-TR-12002 [Reference 10], and accepted the use of KCE-1 CHF correlation for PLUS7 fuel thermal-hydraulic performance and plant safety analyses done with TORC computer code. CE document CCVR-TH-02-02 [Reference 16] is a verification report of the changes to CETOP related to the KCE-1 correlation. The staff reviewed this verification report and finds the new KCE-1 correlation in CETOP acceptable because the newly developed KCE-1 correlation was correctly incorporated into CETOP computer code.

CETOP is limited to steady-state calculations of reactor core thermal-hydraulic performance involving unblocked flow channels or subchannels and with conditions of single-phase flow or homogeneous two-phase flow in the channels or subchannels. The boundary conditions for CETOP calculations are obtained as a function of time from a transient analysis code (typically CESEC-III). Conditional upon the prior imposed limitations, the staff reviewed the acceptability 15-22

of CETOP for calculating DNBR for Chapter 15 non-LOCA events and concludes that CETOP is an acceptable computer program for use in APR1400 licensing applications. This approval is prior approval of CETOP for calculating DNBR for reactor cores of similar geometry to the APR1400 design and the acceptability of the changes to CETOP described in the verification report [Reference 16] since CETOP was previously approved.

COAST COAST is documented in CENPD-98-A [Reference 17] and approved in an NRC SER to the COAST topical report [Reference 18]. In the SER, the staff concluded that the COAST flow coastdown calculations for partial pump power outages are satisfactory. For a complete outage, the staff further concluded that COAST flow transient calculations are satisfactory up to the time of scram and for DNB calculations early in the thermal-hydraulic analysis. However, the staff concluded that complete pump outage calculations are non-conservative in the latter part of the coastdown and it can only be used up to the time of scram. COAST was also approved as an acceptable method for CE System 80+ non-LOCA analysis in NUREG-1462.

The COAST verification performed by the applicant consists of a comparison to experimental data obtained from flow coastdown tests conducted at the Palisades Nuclear Plant in 1971 and 1972. All experimental data was obtained at isothermal conditions. Based on a lack of experimental data with typical operating temperature distributions, the accuracy of COAST calculations was questioned by the staff for more than a few seconds after the pump failure.

For a four pump coastdown, COAST calculates a more rapid flow decrease during the first five seconds of the transient. For a two pump coastdown, COAST calculates a lower core flow for the first 10 seconds of the transient. For a one pump coastdown, COAST calculates a slightly lower core flow but overall better agreement over the entire transient. For two coastdown tests initiated from less than four pump operation, COAST calculates a slightly lower core flow over the transient. The results of the verification confirms the fundamental mathematical model and demonstrates that COAST is conservative (i.e., lower core flow) during the first five to ten seconds. Since the reactor trip occurs within this time frame, the staff concludes that the flow model is conservative.

Subsequent to the staffs approval of COAST, a new COAST initialization process was incorporated to improve numerical convergence prior to the transient calculation. The modified flow initialization process does not impact the transient solution of the code and only helps the code converge to the proper initial conditions at a pump flowrate and head consistent with the RCS resistance characteristics. Therefore, the staff concludes that the modified version of COAST is an acceptable computer program for use in APR1400 licensing applications for calculating Chapter 15 events that cause a partial reduction in RCS flowrate and for the early portion of a complete RCP outage up to the time of scram.

HRISE HRISE is documented in CE-CES-159 [Reference 19]. The staff previously reviewed and accepted HRISE in a letter from C.B. Brinkman (NRC) to A.E. Scherer (CE) [Reference 20] as an acceptable computer code to calculate post-trip SLB analysis. HRISE is used to calculate the MDNBR in case of a RTP for SLBs at low pressure and low flow conditions inside of the reactor that are beyond the range of the KCE-1 correlation in TORC and CETOP. HRISE contains various CHF correlations including the MacBeth CHF correlation that are appropriate at 15-23

the low pressure and low flow following a RTP. The licensed applicable ranges of the MacBeth correlation are described in Section 3.6.2, Limitations, of technical report APR1400-Z-A-NR-14006 [Reference 21] and in the NRC HRISE approval letter [Reference 20].

However, HRISE has not been reviewed for post-trip SLB analysis because the APR1400 analysis of a SLB does not use HRISE since a RTP does not occur during the post-trip SLB event for APR1400.

STRIKIN-II STRIKIN-II is documented in CENPD-135P [Reference 22], CENPD-135P Supplement 2

[Reference 23], CENPD-135 Supplement 4-P [Reference 24], and CENPD-135 Supplement 5-P

[Reference 25]. STRIKIN-II was originally developed and designed for the analysis of LOCAs.

However, a non-LOCA version of STRIKIN-II was derived from the LOCA analysis version and has been maintained independently with various modifications since 1975. The following discussion of STRIKIN-II documentation applies to the LOCA version.

The documentation of the LOCA version of STRIKIN-II is extensive. The August 1974 version of CENPD-135P [Reference 22] was the third version of the document. An initial version of CENPD-135P was issued in April 1974. This initial STRIKIN-II documentation stated that STRIKIN-II was used to calculate the core hot spot transient clad temperature during the blowdown, refill, and reflood regimes of a LOCA using tabular time-dependent functions of flow rate, channel pressure, fluid enthalpy, normalized heat generation rate, and reflood heat transfer coefficients. The reflood heat transfer coefficients were obtained from COMPERC-II while all other input was obtained from CEFLASH-4A. The second version of CENPD-135P was issued as Revision 1 in June 1974. This revision incorporated changes to the assumptions used in the calculation of gap conductance in the HGAP routine and added input values for maximum gap conductance and steady-state minimum gap conductance. Revision 1 also changed the calculation of the mechanical interface pressure between the fuel and clad when the fuel and clad are in contact. Revision 1 also changed the fuel pellet dimension calculation to account for radial cracks forming in the fuel below 1,400 °C (2,550 °F), a restrained thermal expansion formulation for regions having temperature above 1,400 °C (2,550 °F), and a free thermal expansion formulation for regions with temperature below 1,400 °C (2,550 °F). An additional Appendix K was added that discussed the treatment of the HGAP routine in the ruptured node that is filled with fission gas or steam. The third version of CENPD-135P was a reissue of Revision 1 in August 1974 after making changes to STRIKIN-II to include a the rod-to-rod radiation model documented in a new Appendix L.

CENPD-135P Supplement 2 [Reference 23], changed the rod-to-rod radiation model described in Appendix L, added a plastic strain model in the dynamic calculation of the cladding dimension, and improved the treatment in the solution of the heat conduction equation at the fuel-gap and gap-clad interfaces in Appendix D. The rod-to-rod radiation model can be selectively used in the refill, early reflood, and less than 1 inch per second reflood portions of the LOCA transient. Also, the determination of the STRIKIN-II hot rod environment for the radiation model is now treated in a more conservative manner in compliance with recommendations made by staff. Pre-rupture cladding plastic strain can be accounted for by two strain models, one of which is dependent on the rupture plastic strain. The strain resulting from either model is used in the calculation of the hot clad dimension to determine fuel rod gap conductance.

15-24

STRIKIN-II, as documented in CENPD-135P [Reference 22] and CENPD-135P Supplement 2

[Reference 23], was accepted in a letter from Olan D. Parr (NRC) to F.M. Stern (CE)

[Reference 26] for use as part of the ECCS EM for ECCS performance analysis for all plants satisfying the following plant classifications:

1. Typical current CE three and four-loop plants,

2. Dry containments (including sub-atmospheric),

3. Power ratings up to 3,800 megawatts-thermal (MWt), and

4. Plants utilizing only bottom flooding ECCS.

CENPD-135 Supplement 4-P [Reference 24] was the second version of the supplement. An initial version of CENPD-135 Supplement 4-P was issued in June 1976. This initial STRIKIN-II supplement included changes to STRIKIN-II based on an internal audit. Changes included correction of coding errors, elimination of double run requirements (pre-rupture and post-rupture), and improvement of the code performance. Sensitivity studies on System 80+

and Calvert Cliffs Unit 1 LBLOCA events (six break spectrum analysis) were performed to determine the effects from the findings of the internal audit on peak clad temperature and peak local clad oxidation percentage. The findings whose effects on peak clad temperature and peak local oxidation percentage are not negligible were as follows:

1. The source term in the energy balance performed in the clad region of the fuel rod was incorrectly calculated;

2. The zircaloy guide tube in the rod-to-rod radiation model was being represented as a solid rod rather than as a tube; and

3. The calculation of the heat flux in the rod-to-rod radiation model ignored the reduction in surface area seen by the surroundings for the case of touching surfaces.

Changes were also made to STRIKIN-II to eliminate the necessity of running the code twice, once to determine clad rupture conditions and again to input those conditions to complete the analysis. The internal audit revealed that sections of the code could be significantly optimized.

Thus, as a result of the internal audit, changes were made to increase the code efficiency thereby reducing computer costs.

The final version of CENPD-135 Supplement 4-P [Reference 24] replaced the previous Supplement 4 and made additional changes to STRIKIN-II based on a NRC review of the models. The first change is in the blowdown heat transfer logic that prevents nucleate boiling from recurring during blowdown once CHF is first predicted to occur. A second change is a new option regarding the time at which the steam is allowed to enter the gap for a blowdown rupture.

The return to nucleate boiling prevention is the same as in CENPD-135P [Reference 22] except that once CHF is predicted to occur the model uses the film boiling correlation if the surface temperature is greater than the cross-over temperature or less than the DNB temperature. The effect of this change was determined by reanalyzing the CE System 80+ and Calvert Cliffs 15-25

Unit 1 limiting cases. Results did not significantly change. The second change added optional models having the following features:

1. The fission gas remains in the gap until after the peak clad temperature during blowdown has been reached.

2. Ten time-steps after the blowdown peak clad temperature is reached the gap is then assumed to fill with steam at the channel temperature.

This new model will yield a higher blowdown peak clad temperature because the heat that went into the steam in the gap now goes into heating up the clad and the capacitance of the steam is better than that of the fission gas. This gap model is used if the blowdown peak clad temperature is limiting or within 10 °C (50 °F) of being limited; otherwise the model is optional.

The staff accepted STRIKIN-II, as documented in CENPD-135 Supplement 4-P [Reference 24],

in a letter from K. Kniel (NRC) to A.E. Scherer (CE) [Reference 27].

CENPD-135 Supplement 5-P [Reference 25] makes changes to STRIKIN-II to eliminate numerical instabilities. A previous fix to STRIKIN-II to prohibit return to nucleate boiling resulted in oscillations that were sometimes unstable. Several corrections were applied to STRIKIN-II to eliminate the unstable oscillations. The changes involved:

1. Modification of the time derivative for predicting the forward solution,

2. Preventing large changes in time steps, and

3. Including derivative terms in calculating the amount of heat transferred to the fluid.

CE verified the modified numerical solution technique by comparing results of calculations with the new and old numerics for four different plant types. Peak cladding temperatures changed by a maximum of 1.6 °C (3 °F) and the maximum oxidation by a maximum of 0.01 percent.

Since the changes to the numerical solution technique resulted in improved numerical stability and only very small changes in calculated performance, the NRC concluded that the changes to STRIKIN-II were acceptable for use in the CE ECCS EM as documented in a letter from R. L. Baer (NRC) to A.E. Scherer (CE) on September 6, 1978 [Reference 28]. The NRC further stated that the previous version of STRIKIN-II documented in CENPD-135P, CENPD-135P Supplement 2, and CENPD-135 Supplement 4-P was still an approved ECCS EM; however, the new model should be used for all future LOCA analyses.

The staff also approved STRIKIN-II as an acceptable method for CE System 80+ non-LOCA, SBLOCA, and LBLOCA fuel thermal analysis in NUREG-1462. The following discussion of STRIKIN-II documentation applies to the LOCA and non-LOCA versions as used in the APR1400 Chapter 15 safety analysis.

The validity and conservatism of the synthesis method used in STRIKIN-II for analyzing a CEA ejection transient was assessed by comparing the synthesis method with three-dimensional space-time calculations for both full and zero power initial conditions. The three-dimensional space-time analysis was made using the HERMITE computer code. More detailed verification for the use of the CE synthesis method in STRIKIN-II for CEA ejection events is presented in CENPD-190-A [Reference 29].

15-26

Subsequent to the last staff approval of STRIKIN-II, a new CHF correlation (KCE-1) was incorporated to characterize APR1400 PLUS7 fuel performance. The KCE-1 CHF correlation is the same as the Westinghouse CE-1 CHF correlation; however, a new set of coefficients for KCE-1 were determined by a non-linear multiple-regression analysis for the measured CHF data applicable to PLUS7 fuel. The staff previously reviewed the topical report for the KCE-1 CHF correlation, APR1400-F-C-TR-12002 [Reference 10], and accepted the use of KCE-1 CHF correlation for PLUS7 fuel thermal-hydraulic performance and plant safety analyses. The staffs evaluation of this topical report is documented in the SER on KCE-1 CHF correlation topical report [Reference 11].

STRIKIN-II was also changed for APR1400 to add the properties of ZIRLOTM and M5TM to the properties of OPTINTM, which are already included in STRIKIN-II. These properties used in STRIKIN-II are the temperature dependent thermal conductivity, specific heat, emissivity, Poisson's ratio, and Young's modulus. STRIKIN-II has a capability of selecting one cladding material for analyzing transient and accident events for the APR1400. The addition of these material properties have been reviewed by the staff and are considered acceptable because the correct material properties of ZIRLOTM and M5TM were added.

Based on the acceptability of the changes to STRIKIN-II and confirmation of prior STRIKIN-II approval for reactor cores of similar material and geometry as the APR1400 design, the staff concludes that STRIKIN-II is acceptable to perform licensing calculations for APR1400 Chapter 15 non-LOCA and LOCA events.

HERMITE HERMITE is documented in CENPD-188-A [Reference 30] and approved in the SER to the HERMITE topical report [Reference 31]. In the SER, the staff reviewed the mathematical models and analytical procedures and methods. HERMITE was verified by comparing numerical results from HERMITE to those from existing computer codes at that time which utilized accepted calculational methodology, such as PDQ and TWIGL. The SER

[Reference 31] stated that:

At present, only transients initiated by control rod motion are treated. It is anticipated that future modifications to the code will allow other transients of interest to be analyzed in three-dimensions.

The SER concluded that:

The subject report describes an acceptable neutron kinetics computer code for solving the few-group transient diffusion equations in one, two and three dimensions. It has been used to support the CE Control Element Assembly Ejection Analysis Topical Report (CENPD-190, January 1976) and may be referenced in future license applications and topical reports.

HERMITE was also approved as an acceptable method for CE System 80+ non-LOCA analysis in NUREG-1462. However, HERMITE was only an approved code for the total loss of forced reactor coolant flow and RCP rotor seizure events. The pump shaft break event was bounded by the rotor seizure event. For APR1400, HERMITE is being applied for the same events.

15-27

HERMITE is a 1-D computer code model based on the approved FIESTA code [Reference 1].

Several improvements to the HERMITE code were approved in the Amendment No. 61 of NPF-41 [Reference 32]. These include the addition of the TORC open-channel flow model, the nodal expansion method (NEM) neutronics, and the FIESTA 1-D neutronics solution.

The staff reviewed the cross sections that are used in the 1-D HERMITE solution. For the 1-D HERMITE solution described in Section 3.5.2.1 of technical report APR1400-Z-A-NR-14006

[Reference 21], cross sections are used that incorporate all reactivity feedback mechanisms including Xenon. These cross sections are stated to have been derived from the 3-D ROCS solution at each axial level. However, it is not clear what flux or reaction weightings were used in collapsing the cross sections from 3-D to 1-D. The staff was therefore concerned that the EM had not been adequately described in this regard. Therefore, on February 1, 2016, the staff issued RAI 387-8485, Question 15.00.02-2, to address this issue. In the response dated March 8, 2016 (ML16068A284), the applicant responded by quoting the details of the calculation of 1-D macroscopic cross sections and representation of radial neutron leakage used for HERMITE from the details in CE-CES-048 [Reference 33]. The staff considers the applicants response acceptable; the information provided was precisely what was needed to confirm that reaction rates are being preserved when collapsing from 3-D to 1-D cross sections.

The applicant has confirmed that the total planar reaction rate, along with the total core reaction rate, is being preserved; this is consistent with standard industry practice. Therefore, the staff considers RAI 387-8485, Question 15.00.02-2, resolved and closed.

The staff also reviewed the ROCS/DIT code system documented in CENPD-266-P-A

[Reference 34] and the MCXSEC code used to generate macroscopic cross sections for ROCS.

The original ROCS code used a modified one-group diffusion theory model with the higher order difference (HOD) method. The latest ROCS code has an alternative neutronics formulation, the NEM. The ROCS embedded calculation uses a macroscopic cross-section model based on interpolation of multi-dimensional tables created by MCXSEC, which processes DIT results for all assembly types. These additional physics codes are described in Section 4.3 and evaluated in Section 15.0.2 for completeness. Based on the staffs review of CENPD-266-P-A

[Reference 34] and APR1400 DCD Tier 2 Subsection 4.3.3.1.1.3, the staff was concerned with the verification of ROCS-NEM and whether equivalent calculational biases and uncertainties are obtained as compared to ROCS-HOD. The staff was also concerned with the documentation of the MCXSEC code as is used to generate macroscopic cross sections for ROCS based on results from DIT. Therefore, on February 1, 2016, the staff issued RAI 387-8485, Questions 15.00.02-3 and 15.00.02-4, to address ROCS verification and MCXSEC documentation. RAI 387-8485, Questions 15.00.02-3 and 15.00.02-4 are discussed in Section 4.3 of this SER.

Section 3.7.4 of technical report APR1400-Z-A-NR-14006 [Reference 21] indicates that more accurate methods and additional features were added to HERMITE through the following statement:

HERMITE code was initially approved by NRC in 1976 and the CE-Methodology with several improvements was approved in 1992 in the Amendment No. 61 of NPF-41 [Reference 32]. The HERMITE code version in 1992 was 1.5 while the current version is 1.6 with an added transient pressure option. There is no significant methodology change for this code after the last approval by NRC in 15-28

1992, thus this code is applicable to the transient and accident events for the DCD Tier 2 Chapter 15.

The HERMITE Users Manual, CE-CES-091-P [Reference 35] confirms this code change. CE document VV-FE-0416 [Reference 36] provides the software V&V of HERMITE 1.6. Section 3.0 of VV-FE-0416 [Reference 36] describes the code changes necessary to implement the transient pressure option. Section 5.0 of VV-FE-0416 [Reference 36] describes eleven test cases used to verify this new feature, and the results indicate that the transient pressure option is working as expected. The results of the independent software review were included in Appendix A to VV-FE-0416 [Reference 36].

The staff reviewed the transient pressure option added to HERMITE. There are two transient pressure options available in HERMITE 1.6 for inputting pressure versus time tables. The first is an input of pressure ratios relative to the input system pressure, and the second is an input of pressure differences relative to the input system pressure. Based on a detailed review of the HERMITE code changes, the staff finds the transient pressure option in HERMITE acceptable; however, during the staffs review of the transient pressure option in HERMITE 1.6, the staff could not confirm that the applicant used these new code options in the analysis of Section 15.3 events. The staff was therefore concerned that EMs for these events had not been adequately described. Therefore, on February 1, 2016, the staff issued RAI 387-8485, Question 15.00.02-1, to address this issue. In its response dated March 8, 2016 (ML16068A284), the applicant responded that the transient pressure options in HERMITE 1.6 were not used in the analysis of DCD Tier 2 Section 15.3 events and that the use of the initial pressure is conservative for MDNBR calculations because the RCS pressure continuously increases until a reactor trip occurs and the RCS pressure is much higher than its initial value at the time of MDNBR. The staff considers the applicants response acceptable because it completely addresses the use of the transient pressure options in HERMITE 1.6 and because the use of a fixed, initial RCS pressure for the minimum flux-based DNBR calculation for Section 15.3 events where pressure continuously increases throughout the event is conservative. Therefore, the staff considers RAI 387-8485, Question 15.00.02-1, resolved and closed.

The staff reviewed the acceptability of HERMITE to determine the short-term response of the reactor core for Chapter 15 non-LOCA events and concludes that HERMITE is an acceptable computer program for use in APR1400 licensing applications for the loss of forced reactor coolant flow events. The staffs approval is based on the prior approval of HERMITE for the analysis of reactor cores of similar material and geometry to the APR1400 design, and acceptability of the changes in HERMITE Version 1.6.

CEFLASH-4AS CEFLASH-4AS is documented in CENPD-133P, Supplement 1 [Reference 37] and CENPD-133, Supplement 3-P [Reference 38]. CEFLASH-4AS is a version of CEFLASH-4A specifically modified to be applied to the analysis of the blowdown hydraulics during SBLOCAs that are characterized by phase separation. Many of the modifications involved translating the basic applicability from a homogenous to a heterogeneous treatment of the primary system coolant. Major modifications include the development of a new flow path representation, core heat transfer method, and bubble rise model. Specific changes made to CEFLASH-4AS for applicability to SBLOCA analysis include:

15-29

1. The phase separation description which applies only to the pressurizer and secondary side of the SGs in CEFLASH-4A has been extended to include any designated primary system control volume.

2. A new flow path representation has been formulated which accounts for the concurrent separated flow of steam and two-phase fluid.

3. A variable area control volume has been incorporated into the description of the inner vessel node geometry to account for area discontinuities.

4. The bubble distribution within the inner vessel during transient conditions is described by a quasi-steady state balance.

5. The steam mass disengagement rate in the inner vessel is based on the surface void fraction which depends on the bubble gradient in the two-phase mixture.

6. The enthalpy of two-phase fluid exiting the inner vessel to the hot legs is set equal to the average enthalpy of the two-phase fluid in the upper plenum region determined from the bubble gradient. Similarly, the enthalpy of two-phase fluid exiting the inner vessel to the annulus during reverse flow is set equal to the average two-phase fluid enthalpy in the lower plenum.

7. A detailed level-dependent heat transfer model describes the energy exchanged between the fuel and coolant after the initial flow reversal at the core inlet. The core is divided into eleven axial regions each with its respective axial power peaking factor.

8. Superheating of the steam in the inner vessel is accounted for when the two-phase level recedes below the top of the core. The heat transferred to the steam is added to the hot legs weighted by the flow exiting the inner vessel through each leg.

9. An entrainment model is employed in the suction legs to model the steam venting phenomenon in this region.

The staff reviewed and accepted CEFLASH-4AS in a letter from O. D. Parr (NRC) to A. E. Scherer (CE) [Reference 26] as an acceptable computer code for use as part of an ECCS EM.

Development work on CEFLASH-4AS continued after the initial issue of the code in CENPD-133P, Supplement 1 [Reference 37] leading to several changes documented in CENPD-133, Supplement 3-P [Reference 38]. These changes provide for a more realistic evaluation of the SBLOCA and include:

1. A SG heat transfer model that considers heat transfer in the steam region,

2. A new variable drift velocity model,

3. An improved inner vessel geometry model, and

4. An option to prohibit the return to nucleate boiling during blowdown.

15-30

The staff reviewed these changes and concluded that the changes to CEFLASH-4AS were acceptable for use in the CE ECCS EM as documented in a letter from K. Kniel (NRC) to A.E.

Scherer (CE) [Reference 39]. CEFLASH-4AS was also approved as an acceptable method for CE System 80+ SBLOCA safety analysis in NUREG-1462.

The staff reviewed the acceptability of CEFLASH-4AS to determine the thermal-hydraulic response of the primary system during the blowdown phase of a SBLOCA and concludes that CEFLASH-4AS is an acceptable computer program for use in APR1400 licensing applications for the SBLOCA events. The staffs approval is based on the prior approval of CEFLASH-4AS for the analysis of plants similar in geometry and material to the APR1400 design.

COMPERC-II COMPERC-II is documented in CENPD-134P [Reference 40]; CENPD-134P, Supplement 1

[Reference 41]; and CENPD-134P, Supplement 2 [Reference 42]. The COMPERC-II computer code is an assembly of several computer codes used to calculate various aspects of the reflood period. The principal subcode is the PERC code which is used to calculate the heat transfer and hydraulic characteristics within the reactor vessel. Peripheral subcodes are used to calculate the rate of discharge of the SITs, the initial core temperature distribution, the resistance to venting of the reflood-generated steam, the average reflood rates, and the heat transfer coefficients based on full-length emergency cooling heat transfer (FLECHT) and the fluid properties.

Development work on COMPERC-II continued after the initial issue of the code in CENPD-134P

[Reference 40], leading to several changes documented in CENPD-134P, Supplement 1

[Reference 41]. These changes were the result of changes requested by the staff, changes to improve the reflood model, and changes to correct errors. The change made at the request of the staff involved the pressure drop across the injection section during the portion of the reflood transient when the SITs are discharging water. Other changes made allow the code to analyze any single component failure and uses the upper plenum to determine the water properties in the core and lower plenum. The one error that was corrected was in the coding of the FLECHT correlation that had a minor effect on the reflood heat transfer coefficient.

The staff reviewed and accepted COMPERC-II in a letter from O. D. Parr (NRC) to A. E.

Scherer (CE) [Reference 26] as an acceptable computer code for use as part of an ECCS EM.

An additional change to COMPERC-II, as documented in CENPD-134P, Supplement 2

[Reference 42], was made subsequent to the initial NRC acceptance to allow modeling of the delivery of ECCS water injected by the SI pumps prior to the time the SITs empty. The staff found this change to be acceptable as documented in a letter from D. M. Crutchfield (NRC) to A. E. Scherer (CE) [Reference 43]. COMPERC-II was also approved as an acceptable method for CE System 80+ SBLOCA safety analysis in NUREG-1462.

The staff reviewed the acceptability of COMPERC-II to determine the thermal-hydraulic response of the primary system during the reflood phase of a SBLOCA and concludes that COMPERC-II is an acceptable computer program for use in APR1400 licensing applications for the SBLOCA events. The staffs approval is based on the prior approval of COMPERC-II for the analysis of plants similar in geometry and material to the APR1400 design.

15-31

PARCH PARCH is documented in CENPD-138P [Reference 44], CENPD-138P Supplement 1

[Reference 45], and CENPD-138 Supplement 2-P [Reference 46], Although the PARCH computer code was designed specifically for the SBLOCA analysis, PARCH is more generally applicable to any fuel rod heatup problem defined by pool boiling heat transfer and a time varying two-phase level. The prominent features incorporated into the initial version of PARCH documented in CENPD-138P [Reference 44] include pool boiling heat transfer and heat transfer logic restrictions, level dependent fuel rod heatup, variable gap conductance, clad rupture and swelling, zirconium-water reaction, and time-varying material properties.

Development work on PARCH continued after the initial issue of the code in CENPD-138P

[Reference 44], leading to a change to the channel hydraulic methodology documented in CENPD-138P Supplement 1 [Reference 45]. This change made PARCH more versatile in the treatment of core-wide steaming rate. The time-dependent inner vessel liquid mass is a required input to PARCH and is used in the calculation of the flashing steam rate per fuel rod.

The flashing steam rate per fuel rod is added to the adjusted single rod steam boiloff rate to get the total steaming rate for a single rod. The change to PARCH allowed the core-wide steaming rate to be input directly and converted to a per rod steam flow rate by dividing the core-wide steaming rate by the number of fuel rods in the core.

The staff reviewed and accepted PARCH in a letter from O. D. Parr (NRC) to A. E. Scherer (CE) [Reference 26] as an acceptable computer code for use as part of an ECCS EM.

Additional changes to PARCH were documented in CENPD-138 Supplement 2-P

[Reference 46] that were made for consistency with the updated SBLOCA EM documented in CENPD-137, Supplement 1-P [Reference 47]. The NRC accepted the updated SBLOCA EM in a letter from K. Kniel (NRC) to A.E. Scherer (CE) [Reference 39].

The staff reviewed the acceptability of PARCH to calculate cladding and fuel temperature after the flow reversal time following a SBLOCA and concludes that PARCH is an acceptable computer program for use in APR1400 licensing applications for the SBLOCA events. The staffs approval is based prior approval of PARCH for the analysis of plants similar in geometry and material to the APR1400 design.

RELAP5/MOD3.3 The applicant uses RELAP5/MOD3.3 as part of the Code-Accuracy-based Realistic Evaluation Methodology (CAREM) [Reference 48]. The staffs review of this methodology is documented in their SER on the Realistic Evaluation Methodology for Large-Break Loss-of-Coolant Accident (LOCA) of the APR1400 topical report [Reference 49].

CONTEMPT4/MOD5 The applicant uses CONTEMPT4/MOD5 as part of the Code-Accuracy-based Realistic Evaluation Methodology (CAREM) [Reference 48]. The staffs review of this methodology is documented in their SER on the Realistic Evaluation Methodology for Large-Break Loss-of-Coolant Accident (LOCA) of the APR1400 topical report [Reference 49].

15-32

CELDA CELDA is documented in Appendix A of CENPD-254-P [Reference 50]. The staff previously reviewed and accepted CELDA as part of the LTC EM [Reference 51] as an acceptable computer code to calculate RCS pressure and RCS two-phase level during LTC of the RCS following a SBLOCA. The CELDA code has not been modified so this code remains approved.

The CELDA code was verified by comparing calculated RCS pressure and reactor vessel fluid volume to CEFLASH-4AS for a period of one hour after a SBLOCA for two break sizes (e.g., 0.1 ft2 and 0.05 ft2 cold leg breaks in the pump discharge). Since the CELDA code is not applicable to the initial high flow portion of the LOCA, the CELDA code was initialized at the time in the transient following the coastdown of the main coolant pumps. The primary system pressure, core decay heat power, and primary fluid inventory from CEFLASH-4AS for these selected breaks were used to initialize the CELDA code. CELDA calculations of pressure and two-phase level are in good agreement with CEFLASH-4AS. The good agreement between the codes verifies the CELDA assumptions that the primary system pressure is uniform and the fluid is governed by the hydrostatic forces that develop in the primary system as a result of the manometer configuration of a PWR.

The CELDA code was also compared to blowdown data from three of the Containment System Experiments (CSE) blowdown experiments described in BNWL-1411 [Reference 52] and BNWL-1463 [Reference 53]. Close agreement was observed between measured and calculated values of pressure and two-phase fluid level. The good comparisons with experiment provide justification for the assumption of spatially uniform pressure and quasi-steady state bubble distribution during long term thermal hydraulic blowdowns.

Based on the prior CELDA approval for the analysis of plants similar in geometry and material to the APR1400 design, the staff concludes that CELDA is acceptable to perform APR1400 licensing calculations of RCS pressure and RCS two-phase level during LTC of the RCS following a SBLOCA.

BORON BORON is documented in Appendix C of CENPD-254-P [Reference 50]. The NRC previously reviewed and accepted BORON as part of the LTC EM [Reference 51] as an acceptable computer code to calculate the transient boric acid concentration during LTC of the RCS following a SBLOCA.

The boric acid available to accumulate in the vessel can come from several sources all of which can have different initial boric acid concentrations. Greater initial concentrations of boric acid in each of the sources results in a faster rate of accumulation of boric acid in the vessel and a shorter time until build-up of boric acid reaches the inner vessel liquid solubility limit. Several BORON assumptions result in a conservative (i.e., high) boric acid concentration in the vessel.

BORON conservatively switches between different boric acid sources starting with the source with the highest concentration and then switching to sources with lower initial concentrations.

BORON conservatively maximizes the boric acid concentration by maximizing the core steam rate by assuming that only steam leaves the core and sensible heat removal is neglected.

BORON assumes that the boric acid concentration in the sump is constant over the time interval used in the calculation even though actual boric acid concentration in the sump depletes with time. The core liquid flush rate is input in tabular form based on CELDA calculations. BORON 15-33

also uses a 1.2 multiplier on the nominal decay heat power fraction to meet NRC requirements.

Higher decay heat power boils off more steam and increases the boric acid concentration in the vessel.

The applicant modified the BORON code by eliminating the switchover from the refueling water tank to sump recirculation since the IRWST serves as the sump for the APR1400 and hence there is no switchover. The staff reviewed the modifications to the BORON code and considers the use of BORON acceptable for LTC analysis for the reasons discussed above.

Based on the prior BORON approval for the analysis of plants similar in geometry and material to the APR1400 design, the acceptable modifications to the BORON code, and the conservative assumptions built into the BORON code, the staff concludes that BORON is acceptable to perform APR1400 licensing calculations of steady state natural circulation flow during LTC of the RCS following a SBLOCA.

CEPAC CEPAC is documented in Appendix D of CENPD-254-P [Reference 50]. The NRC previously reviewed and accepted CEPAC as part of the LTC EM [Reference 51] as an acceptable computer code to calculate SG temperature versus time during LTC of the RCS following a SBLOCA when the SGs function as heat sinks. The CEPAC code has not been modified so this code remains approved.

CEPAC models the SGs, including the operation of SG atmospheric dump valves, and provides the secondary system temperature as a function of time to be used as input for the NATFLOW and CELDA codes. The CELDA model is based on a conservative approach to SG cooldown behavior and uses several conservative assumptions in the evaluation. CELDA conservatively assumes that the metal walls cool down at the same rate as the primary fluid. The model is conservative because it maximizes the heat removed from the wall and imposes the largest heat load on the SG steam relief system. This conservative assumption also results in the RCS and SG cooling down at the same rate. The uncertainties on decay heat power are 1.2 for time less than 1,000 seconds and 1.1 thereafter to maximize core heat generation. The Moody critical flow model is used to determine the steam flow rate through the SG relief valves and the flow is conservatively held constant over each time step.

Based on the prior CEPAC approval for the analysis of plants similar in geometry and material to the APR1400 design, and the conservative assumptions built into the CEPAC code, the staff concludes that CEPAC is acceptable to perform APR1400 licensing calculations of SG temperature versus time during LTC of the RCS following a SBLOCA.

NATFLOW NATFLOW is documented in Appendix B of CENPD-254-P [Reference 50]. The NRC previously reviewed and accepted NATFLOW as part of the LTC EM [Reference 51] as an acceptable computer code to calculate steady state natural circulation flow that exists in the RCS during LTC of the RCS following a SBLOCA when the SGs function as heat sinks. The NATFLOW code has not been modified so this code remains approved.

NATFLOW is based on solution of conservation of momentum and energy equations using a one-node, one-flow path system segmented into six regions for the purpose of evaluating heat 15-34

transfer and fluid properties. Each of the six regions is assumed to have a uniform average enthalpy that determines the fluid properties for a given pressure. The six regions are selected so the regional densities result in a conservative determination of overall driving head for natural circulation flow.

Based on the prior NATFLOW approval for the analysis of plants similar in geometry and material to the APR1400 design, the staff concludes that NATFLOW is acceptable to perform APR1400 licensing calculations of steady state natural circulation flow during LTC of the RCS following a SBLOCA.

There are no COL information items associated with Section 15.0.2 of the APR1400 DCD.

The staff established findings above in regards to the specific codes and evaluation models used by the applicant in the analysis of the APR1400 transient and accident analysis.

Additionally, the staff established findings in regards to the acceptability of evaluation models for specific events in the respective sections. Based on these findings, the staff concludes that the transient and accident analyses conducted by the applicant were performed with methods acceptable for the analysis of the APR1400.

1. CEN-133(B), FIESTA: A One Dimensional, Two Group Space-Time Neutronics Code for Calculating PWR Scram Reactivities, CE, November 1970. Approval: Letter, R.A. Clark (NRC) to A.E. Lundvall, Jr. (BG&E), Docket Nos. 50-317 and 50-318, Approval of CEN-133(B), March 13, 1981.

2. CENPD-107, CESEC - Digital Simulation of a Combustion Engineering Nuclear Steam Supply System, CE, April 1974.

3. LD-82-001 (dated 1/6/82), CESEC - Digital Simulation of a Combustion Engineering Nuclear Steam Supply System, Enclosure 1-P to letter from A.E. Scherer to D.G.

Eisenhut, CE, December 1981.

4. TAC No. 01142, Safety Evaluation Report, CESEC Digital Simulation of a Combustion Engineering Nuclear Steam Supply System, Enclosure to Letter from C.O. Thomas (NRC) to A.E. Scherer (CE), NRC, April 3, 1984.

5. NUREG-1462, Final Safety Evaluation Report Related to the Certification of the System 80+ Design Docket No.52-002, NRC, August 1994.

6. 00000-SS-VV-030, Software Verification and Validation Report of CESEC-III 89300 MOD5CS, Revision 00, KHNP, June 14, 2013.

7. CENPD-161-P, TORC Code - A Computer Code for Determining the Thermal Margin of a Reactor Core, CE, July 1975.

15-35

8. CENPD-206-P-A, TORC Code-Verification and Simplified Modeling Methods, CE, June 1981.

9. Letter from R.L. Tedesco (NRC) to A.E. Scherer (CE), Acceptance for Referencing of Topical Report CENPD-206(P), TORC Code Verification and Simplified Modeling Methods, NRC, December 11, 1980.

10. APR1400-F-C-TR-12002-P, Revision 0, KCE-1 Critical Heat Flux Correlation for PLUS7 Thermal Design Topical Report, KHNP and KEPCO, November 2012 (ML130180119).

11. Safety Evaluation Report for APR1400-F-C-TR-12002-P, KCE-1 Critical Heat Flux Correlation for PLUS7 Thermal Design Topical Report, (ML17348A152).

12. CEN-214(A)-P, CETOP-D Code Structure and Modeling Methods for Arkansas Nuclear One-Unit 2, CE, July 1982.

13. Letter from R.A. Clark (NRC) to W. Cavanaugh III (AP&L), Operation of ANO-2 During Cycle 2, NRC, July 21, 1981 (Safety Evaluation and Amendment No. 26 to Facility Operating License No. NPF-6 for ANO-2).

14. APR1400-F-C-NR-12001-P, Thermal Design Methodology Technical Report, KHNP and KEPCO, September 2012.

15. APR1400-F-C-NR-12001-P, Thermal Design Methodology, Revision 1, KHNP and KEPCO, November 2014.

16. CCVR-TH-02-02, CETOP Version 1 Mod4_kce1a Computer Code Verification Report, Revision 00, KHNP, January 30, 2002 (Audit Report).

17. CENPD-98-A COAST Code Description, CE, April 1973.

18. Letter from Olan D. Parr (NRC) to F.M. Stern (CE), NRC, December 4, 1974.

19. CE-CES-159, Revision 0-P, HRISE Users Manual, December 1992.

20. LD-WO-3900, Letter from C.B. Brinkman (NRC) to A.E. Scherer (CE), Macbeth CHF Correlation Approval, NRC, August 2, 1983.

21. APR1400-Z-A-NR-14006-P, Non-LOCA Safety Analysis Methodology, Revision 0, KHNP, September 2014 (ML15012A027 (Proprietary), ML15009A204 (Non-Proprietary).

22. CENPD-135P, STRIKIN-II, A Cylindrical Geometry Fuel Rod Heat Transfer Program, CE, August 1974.

23. CENPD-135P, Supplement 2, STRIKIN-II, A Cylindrical Geometry Fuel Rod Heat Transfer Program (Modifications), CE, February 1975.

24. CENPD-135, Supplement 4-P, STRIKIN-II, A Cylindrical Geometry Fuel Rod Heat Transfer Program, CE, August 1976.

15-36

25. CENPD-135, Supplement 5-P, STRIKIN-II, A Cylindrical Geometry Fuel Rod Heat Transfer Program, CE, April 1977.

26. Letter from Olan D. Parr (NRC) to F.M. Stern (CE), NRC, June 13, 1975.

27. Letter from K. Kniel (NRC) to A.E. Scherer (CE) dated November 12, 1976.

28. Letter from R.L. Baer (NRC) to A.E. Scherer (CE) dated September 6, 1978.

29. CENPD-190-A, CE Method for Control Element Assembly Ejection Analysis, CE, January 1976, (ML15240A186 (Proprietary)).

30. CENPD-188-A, HERMITE A Multi-Dimensional Space-Time Kinetics Code for PWR Transients, CE, Reprinted July 1976.

31. Letter from Olan D. Parr (NRC) to A.E. Scherer (CE), NRC, June 10, 1976.

32. Safety Evaluation by the Office of Nuclear Reactor Regulation Related to Amendment No. 61 to Facility Operating License No. NPF-41. Arizona Public Service, et al., Palo Verde Nuclear Generating Station, Unit No. 1, Docket No. STN 50-528, NRC, April 3, 1992, (ML021700246).

33. CE-CES-048, Users Manual for CEKLAPS, Revision 3-P, August 1994.

34. CENPD-266-P-A, The ROCS and DIT Computer Codes for Nuclear Design, April 1983.

35. CE-CES-091-P, Users Manual for HERMITE - Space-Time Neutronics and Thermal Hydraulics Code, Revision 4, Westinghouse Electric Co., September 2001.

36. VV-FE-0416, Software Verification and Validation Report - HERMITE Rev 1.6 Mod 0, Revision 0, CE, February 2, 1998 (Audit Report).

37. CENPD-133P, Supplement 1, CEFLASH-4AS, A Computer Program for Reactor Blowdown Analysis of the Small Break Loss-of-Coolant Accident, CE, August 1974 (ML15267A400 (Proprietary)).

38. CENPD-133, Supplement 3-P, CEFLASH-4AS, A Computer Program for the Reactor Blowdown Analysis of the Small Break Loss-of-Coolant Accident, CE, January 1977.

39. Letter from K. Kniel (NRC) to A.E. Scherer (CE) dated September 27, 1977.

40. CENPD-134P, COMPERC-II, A Program for Emergency Refill-Reflood of the Core, CE, August 1974.

41. CENPD-134P, Supplement 1, COMPERC-II, A Program for Emergency Refill-Reflood of the Core (Modifications), CE, February 1975.

42. CENPD-134P, Supplement 2, COMPERC-II, A Program for Emergency Refill-Reflood of the Core, CE, June 1985.

43. Letter from Dennis M. Crutchfield (NRC) to A.E. Scherer (CE) dated July 31, 1986.

15-37

44. CENPD-138P, PARCH, A FORTRAN-IV Digital Program to Evaluate Pool Boiling, Axial Rod and Coolant Heatup, CE, August 1974.

45. CENPD-138P, Supplement 1, PARCH, A FORTRAN-IV Digital Program to Evaluate Pool Boiling, Axial Rod and Coolant Heatup (Modifications), CE, February 1975.

46. CENPD-138, Supplement 2-P, PARCH, A FORTRAN-IV Digital Program to Evaluate Pool Boiling, Axial Rod and Coolant Heatup, CE, January 1977.

47. CENPD-137, Supplement 1-P, Calculative Methods for the CE Small Break LOCA Evaluation Model, CE Power Systems, January 1977.

48. APR1400-F-A-TR-12004-P, Realistic Evaluation Methodology for Large-Break LOCA of the APR1400, Revision 0, KHNP, December 2012 (ML130230128).

49. Safety Evaluation for Topical Report APR1400-F-A-TR-12004-P/NP, Revision 1, Realistic Evaluation Methodology for Large-Break LOCA of the APR1400 for Safety Evaluation, June 5, 2018. (ML18156A042).

50. CENPD-254-P-A, Post-LOCA LTC Evaluation Model, June 1980 (ML15358A220).

51. Letter from Robert L. Baer (NRC) to A.E. Scherer (CE), NRC, July 30, 1979.

52. BNWL-1411, Experimental High Enthalpy Water Blowdown from a Simple Vessel through a Bottom Outlet, R.T. Allemann, et al., June, 1970.

53. BNWL-1463, Coolant Blowdown Studies of a Reactor Simulator Vessel Containing a Perforated Sieve Plate Separator, R.T. Allemann, et al., February 1971.

The evaluation of those design basis accidents (DBA) that have radiological consequences are discussed in this section and compared to the applicable regulatory acceptance criteria.

DCD Tier 1: The DCD Tier 1 information associated with this section is found in DCD Tier 1, Section 2.1, Site Parameters.

DCD Tier 2: In DCD Tier 2, Chapter 15, the applicant performed radiological consequence assessments for eight reactor design basis accidents, using hypothetical site parameter atmospheric relative concentration (dispersion) values (/Q values) for accidents. Because all other aspects of the design are fixed, these /Q values help determine the required minimum distances to the exclusion area boundary (EAB) and the low-population zone (LPZ) for a given site in order to provide reasonable assurance that the radiological consequences of a DBA will be within the siting dose criteria given in regulation, as identified below.

15-38

The APR1400 DCD Tier 2, Sections 15.0.3, 15.1.5, 15.2.8, 15.3.3, 15.3.4, 15.4.8, 15.6.2, 15.6.3, 15.6.5.5, 15.7.4, 15.7.5, and 15A, provide discussion of the DBA radiological consequences analyses. The DBAs analyzed for radiological consequences include:

Steam system piping failures outside the containment (main steam line break (MSLB))

(DCD Tier 2, Section 15.1.5)

Feedwater system pipe break (DCD Tier 2, Section 15.2.8)

Reactor coolant pump (RCP) rotor seizure (DCD Tier 2, Section 15.3.3)

Control element assembly ejection (CEAE) (DCD Tier 2, Section 15.4.8)

Failure of small lines carrying primary coolant break outside containment (DCD Tier 2, Section 15.6.2)

Steam generator tube rupture (SGTR) (DCD Tier 2, Section 15.6.3)

Loss-of-coolant accident (LOCA) (DCD Tier 2, Section 15.6.5.5)

Fuel handling accident (FHA) (DCD Tier 2, Section 15.7.4)

The applicant provided information on the radiological consequences analysis methodology, assumptions, and results for the potential doses at the EAB, at the LPZ outer boundary, and in the control room. The applicant also provided information on the radiological habitability in the APR1400 design technical support center (TSC) to show compliance with the on-site emergency response facility regulatory requirements.

In DCD Tier 2, Chapter 15, the applicant concluded that the APR1400 design will provide reasonable assurance that the radiological consequences resulting from any of the above DBAs will fall within the offsite dose criterion of 0.25 Sievert (Sv) (25 roentgen equivalent man [rem])

total effective dose equivalent (TEDE), as given in 10 CFR 52.47(a)(2), Contents of applications; technical information, and the control room operator dose criterion of 0.05 Sv (5 rem), as given in 10 CFR Part 50, Appendix A, GDC 19, Control Room, as incorporated by reference in 10 CFR 52.47(a)(3). The applicant reached this conclusion by performing the DBA radiological consequences analyses by:

Using reactor accident source terms based on NUREG-1465, Accident Source Terms for Light-Water Nuclear Power Plants, and Regulatory Guide (RG) 1.183, Alternative Radiological Source Terms for Evaluating Design Basis Accidents at Nuclear Power Reactors, Crediting control of the pH of the water in the containment to prevent iodine evolution, and Using a set of hypothetical atmospheric dispersion factor (/Q) values.

The /Q values are the relative atmospheric concentrations of radiological releases at the receptor point in terms of the rate of radioactivity release. In lieu of site-specific meteorological data, the applicant provided a reference set of site parameter short-term (accident) /Q values 15-39

for the APR1400 design using meteorological data that is expected to bound many U.S. operating nuclear power plant sites for offsite dispersion. APR1400 DCD Tier 1, Table 2.1-1, Site Parameters, under the heading of Meteorology provides the reference set of /Q values for the APR1400 design. Accident-specific /Q values used in the DBA dose analyses for the EAB, LPZ, and main control room (MCR) and TSC receptors are also given in APR1400 DCD Tier 2, Tables 2.3-1 through 2.3-12.

The DCD Tier 2, Table 15.0-12, Results of Radiological Consequences of APR1400 Design Basis Accidents, summarizes the offsite dose results from the DBA radiological consequence evaluations and compares these results to the applicable dose acceptance criteria. DCD Tier 2, Table 6.4-2, MCR and TSC Doses from Design Basis Accidents, provides similar information for the estimated doses in the control room and TSC from DBAs. Accident-specific dose results are reported in tables within the associated DCD Tier 2, Chapter 15 subsection.

ITAAC: There are no ITAAC specific to this area of review.

TS: There are no TS for this area of review.

The relevant requirements of NRC regulations for this area of review, and the associated acceptance criteria, are given in NUREG-0800, Section 15.0.3, Design Basis Accident Radiological Consequence Analyses for Advanced Light Water Reactors, and are summarized below:

10 CFR 52.47, Subparagraph (a)(2), as it relates to the evaluation and analysis of the offsite radiological consequences of postulated accidents with fission product release.

10 CFR Part 52.47(a)(2)(iv), as it relates to ability of plant systems to mitigate the radiological consequences of plant accidents.

GDC 19, as it relates to maintaining the control room in a safe condition under accident conditions by providing adequate protection against radiation.

10 CFR Part 50, Appendix E, Emergency Planning and Preparedness for Production and Utilization Facilities, Paragraph IV.E.8, as it relates to adequate provisions for an onsite technical support center from which effective direction can be given and effective control can be exercised during an emergency.

Review interfaces with other SRP sections also can be found in NUREG-0800, Section 15.0.3.

The staff also referred to NUREG/CR-5950, Iodine Evolution and pH Control, in this area of review.

The related acceptance criteria adequate to meet the above requirements and guidance on analysis methods that are acceptable to the staff in this area of review are contained in RG 1.183.

15-40

The staff evaluated the applicants calculated radiological consequences of DBAs against the dose criteria, given in 10 CFR 52.47(a)(2)(iv), of 0.25 Sv (25 rem) TEDE at the EAB for any 2-hour period following the onset of the postulated fission product release, and 0.25 Sv (25 rem) TEDE at the outer boundary of the LPZ for the duration of exposure to the radioactive release cloud. The staff used a criterion of 0.05 Sv (5 rem) TEDE for evaluating the radiological consequences from DBAs in the control room of the APR1400 design, pursuant to GDC 19. The staff used guidance in SRP Section 15.0.3, and RG 1.183, in its review of the APR1400 DBA radiological consequence analyses. Although RG 1.183 was written to apply to the currently operating power reactors, its guidance on radiological acceptance criteria, formulation of the source term, and DBA modeling is useful in the review of the APR1400 design, which is a large light water reactor design with many similarities to currently operating power reactors.

The staff evaluated the DBA radiological habitability analysis for the APR1400 design TSC against the onsite emergency response facility regulatory requirements in 10 CFR Part 50, Appendix E, Paragraph IV.E.8, and 10 CFR 50.47(b)(8) and (b)(11), Emergency Plans. The staffs complete review of the emergency response facilities is discussed in Section 13.3, Emergency Planning, of this SER.

The staff reviewed the radiological consequence analyses performed by the applicant using the hypothetical site parameter accident release /Q values given in DCD Tier 2, Tables 2.3-1 through 2.3-12. The staff finds that the radiological consequences calculated by the applicant meet the relevant dose acceptance criteria stated above. To evaluate the applicants analyses, the staff performed independent radiological calculations for the above DBAs using the site parameter /Q values provided by the applicant and the RADionuclide, Transport, Removal and Dose Estimation (RADTRAD) computer code, run within the Symbolic Nuclear Analysis Package (SNAP) suite of integrated applications for engineering analysis, developed for the NRC. Information on the SNAP/RADTRAD code is available from the NRCs Radiological Protection Computer Code Analysis and Maintenance Program (RAMP) at https://www.usnrc-ramp.com/content/snapradtrad-overview. The following sections describe the staffs findings.

The applicant followed the accident analysis guidance in RG 1.183, and SRP Section 15.0.3.

The APR1400 DBA radiological consequences analyses credit safety-related structures, systems, and components to mitigate the radiological consequences of a DBA. If the assumption resulted in a more limiting radiological consequence, non-safety-related SSCs were assumed operational. Any credited operator actions from the MCR were assumed to take place 30 minutes or later after the start of the accident, unless an earlier operator action results in more adverse conditions. The analyses evaluated the DBAs considering a single, active failure that maximizes the radiological consequences and additionally assume a loss of offsite power either coincident with the event or with a reactor trip, whichever is limiting. Each analysis assumed the loss of one train of the two redundant charcoal filtration systems in the MCR ventilation system for the duration of the accident.

The APR1400 is an evolutionary PWR design. The primary system design and main components design are similar to those of currently operating reactors, and the plant design 15-41

includes active engineered safety features (ESF) to mitigate accidents. In SECY-94-302, Source Term-Related Technical and Licensing Issues Relating to Evolutionary and Passive Light-Water-Reactor Designs, dated December 19, 1994, the staff proposed to use only the coolant, gap, and early in-vessel releases from NUREG-1465 for the radiological consequence assessments of DBAs for evolutionary and passive light-water reactor designs. These source terms encompass a broad range of accident scenarios, including significant levels of core damage with the core remaining in the vessel. These scenarios define the most severe accidents from which the plant could be expected to return to a safe-shutdown condition. The revised source terms in NUREG-1465 must be applied conservatively in evaluating DBAs in conjunction with conservative assumptions in calculating doses, such as adverse meteorology.

Application to severe accidents may use more realistic assumptions.

The staff considered the inclusion of the ex-vessel and the late in-vessel source terms to be unduly conservative for DBA purposes. Such releases would only result from core damage accidents with vessel failure and core-concrete interactions. For evolutionary and passive light-water reactors, the estimated frequencies of such scenarios are low enough that they do not have to be considered credible for the purpose of meeting 10 CFR 52.47. In the Staff Requirements Memorandum (SRM) related to SECY-94-302, the Commission approved the staff-recommended technical positions to use only the coolant, gap, and early in-vessel releases in NUREG-1465 for the radiological consequence assessments of DBAs for evolutionary and passive light-water reactor designs.

The NRC issued RG 1.183 in July 2000 to provide guidance to licensees of operating power reactors on acceptable applications of alternative source terms pursuant to 10 CFR 50.67, Accident source term. This RG provides guidance based on insights from NUREG-1465 and significant attributes of other alternative source terms that the staff may find acceptable for operating light-water reactors (LWRs). It also identifies acceptable radiological analysis assumptions for use in conjunction with the accepted alternative source term for operating power reactors. Although 10 CFR 50.67 is not applicable to new reactor design certification review, the guidance in RG 1.183 may be applicable to LWR designs. In SRP Section 15.0.3, the staffs review procedures direct the use of RG 1.183 regulatory positions, as far as applicable to the plant design under review. The applicant followed the relevant guidance in RG 1.183 for PWRs.

For DBAs other than the LOCA and the FHA, the sources of radioactive materials available for release are the primary and secondary coolant. The staffs review of the coolant source terms is discussed in Section 11.1, Source Term, of this SER.

The APR1400 DBA radiological consequences analyses are based on 102 percent of rated core thermal power. The 2 percent power uncertainty assumption is consistent with the guidance in RG 1.183 on accounting for power uncertainty in the core fission product inventory.

Accordingly, the applicant calculated the core fission product isotopic inventory at 102 percent of the core rated thermal power of 3,983 MWt, which is 4,062.66 MWt. The applicant used the ORIGEN-S isotope generation and depletion computer code (NUREG/CR-0200, SCALE Ver 4.4: A Modular Code System for Performing Standardized Computer Analyses for Licensing Evaluation, Revision 6, September 1998) to calculate the core isotopic inventory.

ORIGEN-S is part of the SCALE code suite which is a comprehensive modeling and simulation suite for nuclear safety analysis and design developed and maintained by Oak Ridge National Laboratory (ORNL) under contract with the NRC, U.S. Department of Energy, and the National 15-42

Nuclear Security Administration to perform reactor physics, criticality safety, radiation shielding, and spent fuel characterization for nuclear facilities and transportation/storage package designs (reference website, https://ornl.gov/scale/overview). ORIGEN-S is widely used in the nuclear industry to calculate fission product production and depletion. RG 1.183 guidance includes use of an appropriate code for calculation of the core fission product inventory and cites versions of the ORIGEN code (ORIGEN 2 and ORIGEN-ARP) as being appropriate. ORIGEN-S is the most up-to-date version of the ORIGEN code while ORIGEN 2 is no longer supported by ORNL, and ORIGEN-ARP is a fast version of the code sequence to perform point-irradiation calculations with the ORIGEN-S code using problem-dependent cross sections for fuel characterization. The staff performed a confirmatory calculation of the core inventory using the latest version of the ORIGEN-ARP code, which is part of SCALE 6.1. The staffs calculations used information from DCD Tier 2, Sections 4.2, 4.3 and 15A.1.1 on the APR1400 core and fuel assembly design, including uranium (U)-235 loading, fuel maximum burnup and irradiation cycle length, and obtained similar results as reported in DCD Tier 2, Table 15A-1, Maximum Core Fission Product Inventories (Core Power: 4,062.66 MWt, Burnup: 56.4 GWD/MTU [gigawatt-days per metric ton of uranium]).

In RAI 108-7973, issued on July 23, 2015 (ML15206A005), the staff asked several questions about the applicants DBA dose analyses. Those questions that are applicable to more than one DBA are discussed directly below, while those that are related to a specific DBA are discussed in the related subsection discussing that DBA.

In RAI 108-7973, Question 15.00.03-1, the staff requested additional information on the details of the applicants core fission product inventory calculation. The staff noted that DCD Tier 2, Section 4.2.1 and Table 4.3-1, indicate that the APR1400 design is based on a maximum fuel rod average burnup of 60 GWD/MTU, which is higher than the burnup listed in DCD Tier 2, Section 15A.1.1, as the basis for the core fission product inventory, and asked the applicant to explain the discrepancy. The staff also asked for clarification on the following topics: core power history assumptions used in the core fission product inventory calculation; whether the core inventory listed is for beginning of core life, end of core life, or some other time and if it is the same time basis for all nuclides; and how the gadolinia-urania burnable absorber rods were addressed. In the response to RAI 108-7973, Question 15.00.03-1 (ML15344A121), the applicant stated that the fuel rod design for the APR1400 maintains rod integrity up to the target rod average burnup of 60 GWD/MTU based on thermal performance and mechanical integrity evaluation results, as described in DCD Tier 2, Section 4.2.1. The applicant clarified that the core inventory calculations were based on the expected 3-batch, 18-month fuel cycle, with the listed core inventory consisting of the resulting maximum activity data for each nuclide throughout all burnup stages during the three cycles. The total burnup was calculated to be 56.353 GWD/MTU after the end of the third cycle, given the data provided for the APR1400 fuel and core loading. The gadolinia-urania burnable absorber rods were not considered in the applicants calculation of core inventory. Based on its evaluation of the information provided by the applicant, the staff finds the response clarifies the burnup basis for the core inventory calculation, and considers RAI 108-7973, Question 15.00.03-1, resolved and closed.

In RAI 108-7973, Question 15.00.03-2, the staff requested additional information on the primary coolant concentration calculations. Specifically, the staff asked:

a. Why are the DCD Tier 2, Table 15A-3, iodine concentrations and Table 15A-8 noble gas concentrations for 1 percent fuel defect not the same as those in Table 11.1-2?

15-43

b. DCD Tier 2, Tables 15A-4 through 15A-7, list information on the accident-specific iodine appearance rates and iodine spiking. Explain the following differences:

i. Column 2 values for total coolant activity per isotope are not the same between the four accident-specific tables. Clarify how the total isotopic activity was calculated for each accident.

ii. Column 4 values for the letdown purification removal rate are not the same between tables. Provide the basis for letdown purification removal rate values used for each accident.

c. DCD Tier 2, Section 15A.1.2.4, states that alkali metal activities in the primary coolant are ignored because they have a low partition coefficient from the liquid to steam phase and the dose contribution is negligible. Guidance on particulate radionuclide transport from the reactor coolant system (RCS) through the secondary system is given in RG 1.183, Appendix E, Position 5.5.4, which states that the retention in the steam generators is limited by moisture carryover from the steam generators. This moisture carryover is applied to the steam release from the steam generators to give the alkali release fraction for those DBAs that model the secondary system release pathway.

DCD Tier 2, Table 5.4.2-1, Steam Generator Design Parameters, gives the maximum weight percent moisture carryover as 0.25 percent.

i. Provide a justification for this difference from RG 1.183 guidance, including the statement that the dose contribution from alkali metals in the RCS (primary coolant) is negligible.

ii. Alternatively, revise the analyses that include primary-to-secondary leakage through the steam generators (SGs) as a release pathway to include the transport of alkali metals.

d. In TS 3.4.12 the RCS primary-to-secondary leakage is limited to 0.39 liters per minute (L/min) (150 gallons per day (gpd)) through any one SG. The bases for TS 3.4.12 state that the initial condition in the dose analyses assumes 0.39 L/min (150 gpd) per SG primary-to-secondary leakage. In the DBA dose analyses, contrary to this, DCD Tier 2 Tables 15.1.5-12, 15.2.8-3, 15.3.3-3, 15.4.8-4, 15.6.2-4, and 15.6.3-5 list the primary-to-secondary leakage as 2.27 L/min (0.6 gallons per minute (gpm)) total for two SGs.

RG 1.183 guidance states that the primary-to-secondary leak rate in the steam generators should be assumed to be the leak rate limiting condition for operation specified in the TS. What is the basis for this dose analysis assumption which greatly exceeds the technical specification limit?

In the revised response to RAI 108-7973, Question 15.00.03-2, dated July 19, 2016 (ML16201A274), the applicant provided clarifying information, and justification for what appeared to be discrepancies in analysis assumptions between DBAs. The applicant also provided information related to revised calculations for all of the DBAs in DCD Tier 2, Chapter 15, including proposed changes to multiple tables giving the radiological consequence analysis parameters, inputs and assumptions and the dose results at the EAB, LPZ, control room, and technical support center, for each of the eight DBAs. The DBA radiological consequence analyses in response to RAI 108-7973, Question 15.00.03-2, also included additional information responses that address issues raised by other questions in RAI 108-7973, 15-44

correct errors, and address issues raised within related review areas, such as the modeling of atmospheric dispersion for accident conditions under SRP 2.3.4, and control room habitability system design under SRP 6.4.

The applicant made revisions to the DBA radiological consequence analyses to include revised short-term atmospheric dispersion factors for the MCR and TSC, as provided in the Revision 2 of the response to RAI 20-7912, Question 02.03.04-1, dated June 1, 2016 (ML16159A246).

Details of the staffs review of the short-term atmospheric dispersion, including review of the response to RAI 20-7912, are given in Section 2.3.4 of this SER.

The applicants response to RAI 108-7973, Question 15.00.03-2, also included a change in the design-assumed control room envelope unfiltered inleakage from 8.50 cubic meters per minute (m3/min) (300 cubic feet per minute [cfm]) to 2.83 m3/min (100 cfm), and included proposed edits to DCD Tier 2, Chapter 15 tables to reflect the revised unfiltered inleakage assumption.

The applicant also proposed changes to DCD Tier 2, Section 6.4, to reflect this design assumption change, including conforming changes to the control room envelope integrity testing requirements. Details of the staffs review of the proposed change to the DCD Tier 2, Section 6.4, related to the control room envelope unfiltered inleakage are given in Section 6.4 of this SER.

In the response to RAI 108-7973, Question 15.00.03-2.a, the applicant stated that the DCD Tier 2, Table 11.1-2, design basis primary coolant fission product source term, which is based on 1.0 percent fuel defect and assumes continuous gas stripping operation to clean up fission products, was not the basis for the DBA radiological analysis assumption on initial RCS activity concentrations. Instead, to maximize the initial RCS activity concentrations, the DCD Tier 2, Table 15A-3, values are calculated by multiplying by a factor of four the primary coolant fission product source term given in DCD Tier 2, Table 12.2-5, which is based on assumed 0.25 percent fuel defect without gas stripping operation. The multiplication factor of four was applied to equate the DBA radiological consequence analysis primary coolant initial activity concentration to a one percent fuel defect basis for design basis analysis. The applicants DBA radiological consequence analyses RCS coolant activity concentration based on 1 percent fuel defect is then further adjusted to the technical specification RCS equilibrium activity concentration or maximum activity concentration, depending on the analysis case, consistent with guidance in RG 1.183. The applicants RAI response also provided proposed edits to DCD Tier 2, Table 15A-3, to clarify the basis for the reported values. The reviewed the information provided by the applicant and staff finds the RAI response sufficiently clarifies the basis for the primary coolant source term used in the DBA radiological consequence analyses and resolves and closes RAI 108-7973, Question 15.00.03-2.a.

In the response to RAI 108-7973, Question 15.00.03-2.b, on the differences between DBAs with respect to the modeling of iodine spiking, the applicant provided clarifying information to show that the radiological consequence analysis assumptions are based on thermal hydraulic analyses which have different assumed initial conditions to maximize the radiological consequences for that specific accident. Because the applicants calculation of initial RCS mass is different for each DBA scenario, and since the RCS activity concentrations are given as amount of radioactivity per mass unit, therefore the total amount of iodine in the RCS is different for each accident, even though the RCS iodine activity concentration is an assumed constant.

Similarly, the iodine appearance rate (i.e., the amount of activity of each iodine isotope per unit time that enters the RCS from the fuel to replace the amount that is removed through letdown 15-45

clean-up, leakage or radioactive decay to result in the equilibrium coolant activity concentration) would be different for each accident because of the differing initial RCS mass assumptions. The applicants modeling of event-generated iodine spiking is based on a multiplication factor on the iodine appearance rate, in conformance with RG 1.183 guidance. Based on its review of the provided information, the staff finds that the RAI response clarifies, resolves and closes RAI 108-7973, Question 15.00.03-2.b, on the iodine appearance rate and iodine spiking modeling.

In the response to RAI 108-7973, Question 15.00.03-2.c, on the alkali metal transport from the primary coolant, the applicant performed an evaluation to determine the contribution to dose from alkali metal releases, and determined that the DBA radiological consequences analyses should be revised to include alkali metal transport. The staff determined that the applicants DBA radiological consequences analyses were revised to include modeling of alkali metal transport in accordance with the guidance in RG 1.183. Revisions 2, 3, and 4 of the response to RAI 108-7973, Question 15.00.03-2, dated April 24, 2017 (ML17144A512), August 22, 2017 (ML17234A540), and November 9, 2017 (ML17313B063), provided further changes to DCD Tier 2, Tables 6.4-2, 15.0-10, 15.1.5-13, and 15.6.3-6 to reflect revised dose results that reflect correction of errors in the SGTR and MSLB dose calculation which the applicant found through an internal review. In addition, some of the dose results for the CEA ejection accident were revised as a result of the applicants internal review, and the changes were incorporated into the DCD. The staff reviewed the provided information and notes that these changes have a minor effect on the reported doses and are acceptable because they correct errors to the dose analyses. Therefore, the staff finds that the RAI response resolves and closes RAI 108-7973, Question 15.00.03-2.c.

In the revised response to RAI 108-7973, Question 15.00.03-2.d, on the modeling of primary-to-secondary leakage through the SGs, the applicant provided information to clarify that the DBA radiological consequence analyses assume total primary-to-secondary leakage of 2.27 L/min (0.6 gpm), which includes both SGs, as the initial condition. The applicant stated that this assumption was made to maximize calculated doses and be conservative compared to the TS 3.4.12 RCS operational leakage limit of 0.39 L/min (150 gallons per day [gpd]) per any one SG, but also to be consistent with the TS 5.5.9, Steam Generator (SG) Program, which gives an accident-induced leakage limit of 1.13 L/min (0.3 gpm) for any one SG. In addition, TS Basis 3.4.12 also refers to the safety analysis initial condition assumption of total primary-to-secondary leakage equal to 2.27 L/min (0.6 gpm) as being conservative. The reviewed the RAI response and staff finds this response clarifies that the applicants analysis assumption on primary-to-secondary leakage conforms to the bases for the TS 5.5.9 SG Program, and is consistent with guidance in RG 1.183. Therefore, the staff finds that the RAI response resolves and closes RAI 108-7973, Question 15.00.03-2.d.

Revision 4 of the response to RAI 108-7973 Question 15.00.03-2, dated November 9, 2017, also provided further changes to DCD Tier 2, Tables 6.4-2, 15.0-10, 15.1.5-13, 15.6.3-6, and 15.7.4-2, to reflect revised dose results that reflect correction of errors in the SGTR, MSLB and FHA dose calculations which the applicant found through an internal review. The staff finds that these changes have a minor effect on the reported doses and are acceptable because they correct errors to the dose analyses. Based on the review of the DCD, the staff has confirmed incorporation of the proposed changes to DCD Tier 2 Tables 6.4-2, 15.0-10, 15.1.5-13, 15.6.3-6, and 15.7.4-2 with respect to the SGTR, MSLB, and FHA dose results, as provided in Revision 4 of the applicants RAI response to RAI 108-7973, Question 15.00.03-2. Therefore, the staff considers RAI 108-7973, Question 15.00.03-2, resolved and closed.

15-46

In RAI 108-7973, Questions 15.00.03-3, and -4, the staff requested the applicant to explain why the value used for the RCS mass is not consistent among all the DBA dose analyses; and why the value for the initial secondary liquid mass in the SGs is not consistent among all the DBA dose analyses, respectively. In the response to these questions dated February 24, 2016 (ML16055A086), the applicant stated that the initial RCS mass and secondary coolant liquid mass was determined by the CESEC-III thermal-hydraulic accident analysis computer code for each DBA by using the thermal and hydraulic initial conditions which were determined to maximize the radiological consequences for that DBA. As discussed in Section 15.0.2 of this SER, the staff finds the use of CESEC-III for thermal-hydraulic analysis of non-LOCA events acceptable. Therefore, based on its review of the RAI response, the staff finds that the RAI response clarifies, resolves and closes RAI 108-7973, Questions 15.00.03-3, and 15.00.03-4.

In RAI 108-7973, Questions 15.00.03-8, -13, -15, -17, -19, -25, and -28, the staff asked the applicant to specify which set of paired source to receptor control room and TSC accident /Qs from DCD Tier 2, Tables 2.3-2 through 2.3-12, were used for the related DBA dose analysis. In the responses to the above questions dated December 18, 2015 (ML15352A056) and January 28, 2016 (ML16028A402), the applicant provided clarifying information which referenced the response to RAI 174-8211, Question 02.03.04-05, for further justification. The applicants response to RAI 108-7973, Question 15.00.03-8, included a markup of DCD Tier 2, Table 2.3-12, to clarify the MCR and TSC accident /Q values used in the DBA radiological consequence analyses. However, the staff notes that the Revision 2 response to RAI 20-7912, Question 02.03.04-1 (ML16159A246), provides updated MCR and TSC accident /Q values, including revisions to DCD Tier 2, Table 2.3-12, that supersede the information provided in response to RAI 108-7973, Question 15.00.03-8. As discussed above in response to RAI 108-7973, Question 15.00.03-2, the applicant revised all DBA radiological consequence analyses to include use of the revised MCR and TSC accident /Q values from RAI 20-7912, Question 02.03.04-1. Therefore, based on its review of the information provided in the response to the RAIs noted above, the staff finds that questions about identification of which control room and TSC accident /Q values were used in the DBA radiological consequence analyses are resolved.

Because no specific site is associated with the APR1400 plant, the applicant defined the offsite boundaries only in terms of hypothetical atmospheric relative concentration (/Q) values at fixed EAB and LPZ distances. The applicant also provided hypothetical /Q values for each pairing of accident release point and receptor for the MCR and TSC, both for the ventilation system intakes and the assumed control room envelope inleakage location. DCD Tier 2, Tables 2.3-1 through 2.3-12, list the hypothetical reference accident /Q values used in the radiological consequence analyses for the APR1400 design. DCD Tier 1, Table 2.1-1 also lists these accident /Q values as site parameters for the design. Section 2.3.4 of this SER provides discussion of the staffs review of the hypothetical atmospheric dispersion factors. The staff will perform an independent assessment of short-term (less than or equal to 30 days) atmospheric dispersion factors for potential accident consequence analyses on a site-specific basis for a COL application that references the APR1400 design If the site characteristic atmospheric dispersion factors exceed the site parameter values used in this evaluation (i.e., poorer dispersion characteristics), a COL applicant may have to consider compensatory measures, such as increasing the size of the site or providing additional ESF 15-47

systems to meet the relevant dose limits set forth in 10 CFR 52.79 and GDC 19. The APR1400 DCD includes a COL information item to address this possibility.

COL 15.0(1) states:

The COL applicant is to perform the radiological consequence analysis using site-specific /Q values, unless the /Q values used in the DCD envelop the site-specific short-term or long-term /Q values of the DCD, and to show that the resultant doses are within the guideline values of 10 CFR 50.34 for EAB and LPZ and that of 10 CFR Part 50, Appendix A, GDC 19 for the MCR and TSC.

The staff notes that the COL information item refers to 10 CFR 50.34, which is referenced in 10 CFR 100.21 as giving the non-seismic siting dose criteria, and is applicable to COL applicants. In addition, COL applicants must show compliance with 10 CFR 52.79(a)(1)(vi),

which includes the same requirements as given in 10 CFR 50.34(a)(1)(ii)(D), including the dose criteria of 0.25 Sv (25 rem) TEDE at the EAB for any 2-hour period following the onset of the postulated fission product release, and 0.25 Sv (25 rem) TEDE at the outer boundary of the LPZ for the duration of exposure to the release cloud.

The staff has determined that COL 15.0(1) clarifies expectations on the COL applicants use of the APR1400 DCD analyses of the radiological consequences of DBAs in order to show compliance with the related regulatory requirements for COL. The staff has determined that the COL information item is consistent with the staffs guidance in SRP Section 15.0.3 related to the incorporation by reference of certified design information in the COL FSAR with respect to the DBA dose analysis, and is therefore acceptable.

DCD Tier 2, Section 15.0.3, identifies the LOCA as one of the eight DBAs that will result in a radiological consequence outside the confines of the plant containment building. RG 1.183, Appendix A, Assumptions for Evaluating the Radiological Consequences of a LWR Loss-of-Coolant Accident, Item 2 identifies the need for the containment sump pH to be greater than 7.0. Design requirements for the plant undergoing design certification, including the mitigating features such as the containment, are found in 10 CFR 52.47, which identifies that the fission product release for a major accident is the source term for determining adequacy of design.

In order to manage the pH of the containment sump, the mass of trisodium phosphate (TSP) dodecahydrate is identified in DCD Tier 2, Table 6.5-4, as 36,471 kg. However, the applicant did not provide any details as to how the pH will be maintained at about 7.0 for 30 days considering the formation of nitric and hydrochloric acids in containment resulting from degradation of cable jacketing materials. In addition, the applicant did not demonstrate that the pH of the recirculating water from the in-containment refueling water storage tank (IRWST) to the core remains above 7.0 for the duration of the accident. The applicant only provided assurance that the pH will reach 7.0. Therefore, in RAI 362-8445, Question 15.00.03-31, the staff requested that the applicant provide the estimated containment sump pH for the 30-day period following a LOCA and the data used to make these estimates for the duration of the accident.

15-48

In the response to RAI 362-8445, Question 15.00.03-31, dated August 22, 2016 (ML16236A043), the applicant provided additional information on the containment sump pH analysis. The applicant stated that the 30-day containment sump pH analysis takes into consideration the lower IRWST water temperature, the severe radiation condition in the containment building, the strong acids (e.g., HCl, HNO3, HI) generated during the LOCA event, the TSP available for recirculating water in the IRWST and the maximum boron concentration.

The applicant analyzed different IRWST water temperatures and used the lowest temperature, as this would give the most conservative approach and produce the lowest pH. Severe radiation conditions were considered (maximum values of the time-dependent total integrated doses of gamma and beta rays), as it would yield the most acid through irradiation of water and air. To calculate the acids generated in containment, the applicant used the guidance in RG 1.183, which provides acceptable methods. For the amount of water volume, boron oxides, and TSP, the applicant indicated that they used the values previously calculated in the IRWST pH calculation (1-035-N387-008, Revision 2) that was reviewed by the staff in Section 6.5.2 of this SER. The pH values were calculated using an equilibrium constant method for short term values, and a computer code for the full 30-day period.

In a letter dated July 10, 2017 (ML17191A981), the applicant submitted a revised response to incorporate an updated total integrated dose and updated cable jacket mass in the 30-day pH calculation. The new calculation (1-035-N387-009) used the same computer code as the previous calculations reviewed by the staff in Section 6.5.2 of this SER and in this section. The revised 30-day pH values are slightly lower than in the previous calculation but still above 7.

The revised response includes proposed revisions to DCD Tier 2 Section 6.5.2. Based on its review of the revised RAI response, staff finds the revisions acceptable because they clarify the description of the 30-day pH calculation.

Based on these considerations, the staff evaluated the results of the applicants 30-day containment sump pH analysis from both calculation methods used by the applicant. The staff found the analysis acceptable because the design will maintain the containment sump pH above 7.0 for the 30-day period following a LOCA, consistent with the guidance in RG 1.183.

Based on its review of the DCD, the staff confirmed incorporation of the changes described above; therefore, the staff considers RAI 362-8445, Question 15.00.03-31, resolved and closed.

The applicant has evaluated the radiological consequences of a postulated MSLB accident occurring outside of the containment. The applicant submitted a radiological analysis for the MSLB accident in DCD Tier 2 Section 15.1.5, which discusses the nuclear steam supply system (NSSS) response analysis for a spectrum of steam system piping failures inside and outside of containment. Two scenarios were evaluated for radiological consequences, both in combination with a single failure and the TS steam generator primary-to-secondary tube leakage:

MSLB outside the containment upstream of the main steam isolation valve (MSIV) during full power operation with a LOOP coincident with turbine trip following a reactor trip, with a single control element assembly (CEA) stuck out of the core (SLBFPDLOOP).

15-49

MSLB outside the containment upstream of the MSIV during zero power operation with a LOOP coincident with the initiation of the event and modeling iodine spiking in the primary coolant, with a single CEA stuck out of the core (SLBZPLOOPD)

The applicant chose the two analyzed scenarios to bound other credible DBA MSLB scenarios with respect to the amount of fuel damage and radioactive releases to the environment from the event, therefore maximizing the resulting estimated doses at the EAB, LPZ, and in the MCR and TSC.

For the purposes of the radiological consequence analysis, the limiting MSLB is a double-ended guillotine break of a main steam line, upstream of the MSIV, limited by an integral flow restrictor in the SG outlet nozzle. The assumption of failure of one MSIV in the unaffected SG (i.e., the SG that has an intact main steam line) does not change the calculated radiological releases to the environment, nor are there any additional single failures that increase the estimated fuel damage or resulting doses.

The radiological consequence analysis assumes that after the steam line break, the affected SG (i.e., the SG with the broken steam line) is isolated from the secondary system and allowed to steam dry, which occurs within 30 minutes. This release includes primary-to-secondary leakage through the affected SGs tubes at a total rate of 2.27 L/min (0.6 gpm) for 2 SGs, which is far in excess of the APR1400 TS 3.4.12 limit of 0.39 L/min (150 gpd) per SG. Iodine released through primary-to-secondary leakage in the affected SG is assumed to be released directly to the environment without mitigation. After the steaming from the affected SG ends, the reactor is cooled by releasing steam from the unaffected SG through the atmospheric dump valves (ADVs). Iodine released through primary-to-secondary leakage in the unaffected SG is assumed to mix in the secondary coolant and be partitioned between liquid and steam phases before being released to the environment. Noble gases entering the secondary coolant are assumed to be released directly to the environment. The steam releases through the unaffected SG end in eight hours.

In RAI 108-7973, Question 15.00.03-6, the staff requested that the applicant provide clarification on the timing of the break flow and steaming from the affected SG and the steaming from the unaffected SG. In the response to RAI 108-7973, Question 15.00.03-6, dated February 24, 2016 (ML16055A086), the applicant clarified the release timing and provided proposed revisions to DCD Tier 2, Table 15.1.5-12, to fix errors in the parameter information. RAI 108-7973, Question 15.00.03-7, requested the applicant provide additional information on the modeling of iodine releases during periods of steam generator dryout, including the application of the SG iodine partition coefficient of 100. In the response to RAI 108-7973, Question 15.00.03-7, dated December 18, 2015 (ML15352A056), the applicant clarified that no retention of iodine was assumed within the affected SG during the period when the affected SG tubes are uncovered, and therefore, the affected SG iodine partition coefficient is equal to 1.0. Although the affected SG was calculated to steam dry at approximately 287 seconds, the MSLB radiological consequence analysis assumed that dryout occurs at the initiation of the accident. For the unaffected SG, the applicant conservatively assumed an iodine partition coefficient of 1.0 even though the SG tubes are submerged for the duration of the release. The applicants response to RAI 108-7973, Question 15.00.03-7, provided proposed revisions to DCD Tier 2 Section 15.1.5.5.1, Evaluation Model, and Table 15.1.5-12, Parameters Used in Evaluating the Radiological Consequences of the Steam Line Break Outside Containment, to clarify the parameter information. Based on its review of the provided information, the staff finds the RAI 15-50

responses sufficiently address the MSLB analysis assumptions related to releases through the SGs, and resolve and close RAI 108-7973, Questions 15.00.03-6, and -7.

The APR1400 SG is designed for a maximum moisture carryover of 0.25 percent, as described in DCD Tier 2, Table 5.4.2-1, Steam Generator Design Parameters. In accordance with Section 5.5.4 in Appendix E of RG 1.183, the analysis should assume particulate retention on the SGs based on the design moisture carryover. Noble gas and iodine transport through the SGs is considered separately. The APR1400 MSLB dose analysis does not model transport of the alkali metals from the RCS through the SGs to the environment, instead it states that the alkali metal concentrations in the primary coolant are ignored because the dose contribution was judged to be negligible. As stated above, in RAI 108-7973, Question 15.00.03-2.c, the staff requested further information on this difference from the applicable guidance. In the revised response dated July 19, 2016 (ML16201A274), the applicant provided information on an evaluation of the dose contribution of alkali metals, which was shown to be significant.

Therefore, the DBA radiological consequence analyses were revised to include modeling of the transport of alkali metals, and related changes were proposed to the DCD. Based on its review of the RAI response, the staff finds the RAI response provides information showing that the DBA radiological consequence analyses were revised to be consistent with the guidance in RG 1.183.

The applicants analysis also evaluated the potential for the release of primary coolant from the RCS to the IRWST during the MSLB accident. The loss of primary fluid and decrease in RCS pressure from the rapid cooling from the MSLB results in a safety injection actuation signal on low pressurizer pressure and consequential containment isolation signal. Therefore, based on the timing of containment isolation in the event of the MSLB, there is no modeling of release of radioactivity to the environment through containment leakage in the applicants analysis of the radiological consequences of the MSLB.

The APR1400 MSLB radiological consequences analyses assume maximized pre-trip degradation in fuel performance, due to a potential for violating the transient DNBR limit during the pre-trip period. For the full power MSLB scenario (SLBFPDLOOP), the applicant postulated cladding failure in 1 percent of the fuel in the core, which is bounding for fuel damage predicted by the core response and thermal-hydraulic analyses.

The core response analysis precludes fuel damage from occurring as a result of a steam line break at zero power operation (SLBZPLOOPD); therefore, the source of radioactive material for release is the reactor coolant. The applicant analyzed this hypothetical accident for two coolant source term cases.

For the accident-induced iodine spiking case at zero power operation, the analysis assumed that a temporary increase in the primary coolant iodine concentration (iodine spike) occurred as a result of the power/pressure transient caused by the MSLB. Before the postulated accident, the APR1400 reactor was assumed to operate at 37 kilobecquerels per gram (kBq/gm)

(1.0 microCuries/gram [Ci/gm]) for dose equivalent (DE) iodine-131 (I-131) and 21.5 MBq/gm (580 Ci/gm) for DE xenon-133 (Xe-133) in the primary coolant. The iodine concentration is consistent with the TS 3.4.15 equilibrium iodine concentration limit, while the noble gas concentration exceeds the TS 3.4.15 equilibrium noble gas concentration limit of 11.1 MBq/gm (300 Ci/gm) for DE Xe-133. The iodine spike generated during the accident is assumed to increase the release rate of iodine from the fuel by a factor of 500, resulting in a 15-51

rising iodine concentration in the primary coolant for a period of 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> during the course of the accident.

For the pre-accident iodine spiking case at zero power operation, the analysis assumed that previous reactor operation had resulted in a primary coolant concentration equal to the maximum instantaneous concentration limit of 2.22 MBq/gm (60 Ci/gm) for DE I-131, specified in TS 3.4.15. The concentrations of radionuclides in the primary coolant other than the iodine radionuclides are assumed to be the same as in the accident-induced iodine spiking case.

The staffs review of the applicants analysis determined that the methods used for the radiological consequence assessment conform to RG 1.183 guidance, and the radiological consequences calculated by the applicant meet the relevant dose acceptance criteria. To verify the applicants assessment, the staff performed independent radiological consequence calculations for the two coolant activity scenarios for the MSLB accident. The staffs analyses followed the guidance in RG 1.183 and used the applicants assumptions on accident progression, fission product source terms and transport, and design reference atmospheric dispersion factors. The staffs analysis results are consistent with those calculated by the applicant and confirm that the doses calculated by the applicant are within the dose acceptance criteria given in SRP Section 15.0.3 for the MSLB.

Revision 4 of the response to RAI 108-7973, Question 15.00.03-2, provided changes to DCD Tier 2, Tables 6.4-2, 15.0-10 and 15.1.5-13, to reflect revised dose results that reflect correction of errors in the MSLB dose calculation which the applicant found through an internal review. Based on its review of the response to the RAI, the staff finds that these changes have a minor effect on the reported doses and are acceptable because they correct errors to the dose analyses. Based on its review of the DCD, the staff has confirmed incorporation of the changes described above and finds that the applicants analysis of the design basis MSLB is acceptable based on the comparison of the applicants analysis methodology to the guidance in RG 1.183 and the staffs confirmatory analysis; therefore, the staff considers RAI 108-7973, Question 15.00.03-2, resolved and closed.

The staff finds that the APR1400 design, as bounded by the atmospheric relative concentrations proposed by the applicant, will provide reasonable assurance that the offsite radiological consequences of a postulated MSLB accident with accident-induced iodine spiking will not exceed a small fraction (i.e., 10 percent or 0.025 Sv [2.5 rem] TEDE) of the dose criterion set forth in 10 CFR 52.47(a)(2).

The staff also finds that the APR1400 design, as bounded by the atmospheric relative concentrations proposed by the applicant, will provide reasonable assurance that the offsite radiological consequences of a postulated MSLB accident with fuel damage or with pre-accident iodine spiking in the coolant will not exceed the dose criterion set forth in 10 CFR 52.47(a)(2)

(i.e., 0.25 Sv (25 rem) TEDE).

The staff has determined that the APR1400 design, as bounded by the atmospheric relative concentrations proposed by the applicant, will provide reasonable assurance that the estimated doses in the MCR and TSC are less than 0.05 Sv (5 rem) TEDE for each of the MSLB scenarios and iodine spiking cases. Therefore, the staff finds there is reasonable assurance that the radiological consequences in the MCR and TSC following a design basis MSLB meet the dose criterion given in GDC 19 and the TSC habitability regulatory requirements, respectively.

15-52

The applicant has evaluated the radiological consequences of a postulated feedwater system pipe break (feedwater line break, FWLB). The applicant submitted a radiological analysis for the FWLB accident in DCD Tier 2, Section 15.2.8, which discusses the NSSS response analysis for a spectrum of feedwater system pipe break sizes, either upstream or downstream from the feedwater line reverse flow check valves. For the purposes of the radiological consequence analysis, the limiting FWLB is a double-ended guillotine break of a feedwater line downstream of the check valves, with a LOOP coincident with a turbine trip following a reactor trip. The FWLB accident also assumes inoperability of the main feedwater system during the event.

The radiological consequences analysis assumes that the secondary coolant from the affected SG, which includes one-half of the total primary-to-secondary coolant leakage, based on a rate of 2.27 L/min (0.6 gpm) for two SGs, is released into the containment from the FWLB for the first 30 minutes of the event until RCS cooldown by steaming through the unaffected SG is initiated. The radioactive materials in the break flow are assumed to be released directly from the containment to the environment, without credit for dilution, holdup or mitigation in the containment. In addition, secondary coolant steam, which includes the remaining one-half of the total primary-to-secondary coolant leakage, is released directly to the environment without dilution or mitigation from the affected SG through the main steam safety valves (MSSVs) for the first 20 seconds until the affected SG is isolated.

The release from the unaffected SG includes primary-to-secondary leakage which is assumed to mix in the secondary coolant and be partitioned between liquid and steam phases before being released through the MSSVs for the first 30 minutes of the accident. At 30 minutes, operator action is taken to open the unaffected SG ADV to cool down the RCS. Noble gases entering the secondary coolant are assumed to be released directly to the environment. The steam releases through the unaffected SG end in 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> when the shutdown cooling system is aligned to cool the RCS.

The applicants core response analysis shows that fuel damage is precluded from occurring as a result of a FWLB; therefore, the source of radioactive material for release is the reactor coolant. The applicant analyzed this hypothetical accident for two coolant source term cases, similar to the MSLB at zero power operation.

To model accident-induced iodine spiking in the primary coolant, the FWLB analysis assumed that an iodine spike occurred as a result of the power/pressure transient caused by the FWLB.

Before the postulated accident, the APR1400 reactor was assumed to operate at 37 kBq/gm (1.0 Ci/gm) for DE I-131 and 21.5 MBq/gm (580 Ci/gm) for DE Xe-133 in the primary coolant. The iodine spike generated during the accident is assumed to increase the release rate of iodine from the fuel by a factor of 500, resulting in a rising iodine concentration in the primary coolant for a period of eight hours.

For the pre-accident iodine spiking case, the analysis assumed that previous reactor operation had resulted in a primary coolant concentration equal to the maximum instantaneous concentration limit of 2.22 MBq/gm (60 Ci/gm) for DE I-131, specified in TS 3.4.15. The concentrations of radionuclides in the primary coolant other than the iodine radionuclides are assumed to be the same as in the accident-induced iodine spiking case. However, the applicant did not report the results of the pre-accident iodine spiking case, because the iodine 15-53

release from the accident-induced iodine spiking case is larger than that for the pre-accident iodine spiking case, and the regulatory dose criteria for the accident-initiated iodine spiking case are limiting in comparison to the pre-accident iodine spiking case (i.e., 2.5 rem vs. 25 rem TEDE).

In RAI 108-7973, Questions 15.00.03-9, -10, -11 and -12, the staff requested that the applicant provide additional clarifying information on the modeling of the FWLB release within the containment volume, the assumption used for the containment leak rate to the environment, and the analysis assumptions on primary-to-secondary leakage for the FWLB analysis, including the basis for an apparent difference from RG 1.183 guidance on flashing to vapor of the release through SGs during periods of SG dryout. In the response to these questions dated December 18, 2015 (ML15352A056), the applicant provided information on the FWLB analysis assumptions related to the modeling of release to the containment and release through the primary-to-secondary leakage, including flashing. Based on its review of the RAI response, the staff finds the information to be conservative and consistent with guidance in RG 1.183 for non-LOCA DBAs that include either a release to containment and subsequent release to the environment through containment leakage, or a release through primary-to-secondary leakage (e.g., guidance in RG 1.183, Appendices E and H). Therefore, the staff finds RAI 108-7973, Questions 15.00.03-9 through -12, resolved and closed.

The staffs review of the applicants analysis determined that the methods used for the radiological consequence assessment conform to applicable RG 1.183 guidance, and the radiological consequences calculated by the applicant meet the relevant dose acceptance criteria. To verify the applicants assessment, the staff performed independent radiological consequence calculations for the two coolant activity scenarios for the FWLB accident. The staffs analyses followed the guidance in RG 1.183 and the SRP and used the applicants assumptions on accident progression, fission product source terms and transport, and design reference atmospheric dispersion factors. The radiological consequences calculated by the staff are consistent with those calculated by the applicant, and confirm that the doses calculated by the applicant are within the dose criteria given in SRP Section 15.0.3 for accidents such as the FWLB.

Based on the comparison of the applicants analysis methodology to the guidance in RG 1.183 and the staffs confirmatory analysis, the staff has determined that the applicants analysis of the design basis FWLB is acceptable. The staff finds that the APR1400 design, as bounded by the atmospheric relative concentrations proposed by the applicant, will provide reasonable assurance that the offsite radiological consequences of a postulated FWLB accident with accident-induced iodine spiking will not exceed a small fraction (i.e., 10 percent or 0.025 Sv [2.5 rem] TEDE) of the dose criterion set forth in 10 CFR 52.47(a)(2).

The staff finds that the APR1400 design, as bounded by the atmospheric relative concentrations proposed by the applicant, will provide reasonable assurance that the offsite radiological consequences of a postulated FWLB accident with pre-accident iodine spiking in the coolant will not exceed the dose criterion set forth in 10 CFR 52.47(a)(2) (i.e., 0.25 Sv (25 rem) TEDE).

The staff determined that the APR1400 design, as bounded by the atmospheric relative concentrations proposed by the applicant, will provide reasonable assurance that the estimated doses in the MCR and TSC are less than 0.05 Sv (5 rem) TEDE for each of the FWLB iodine spiking cases. Therefore, the staff finds there is reasonable assurance that the radiological 15-54

consequences in the MCR and TSC following a design basis FWLB meet the dose criterion given in GDC 19 and the TSC habitability regulatory requirements, respectively.

The applicant submitted a radiological analysis for the RCP rotor seizure in DCD Tier 2, Section 15.3.3. The RCP rotor seizure is also referred to as the locked rotor accident (LRA).

The LRA assumes instantaneous seizure of an RCP rotor, which leads to a reactor trip. The radiological consequences analysis assumes that offsite power is unavailable. The source of the radioactive material is the reactor coolant and any release from damaged fuel rods in the core to the primary coolant. The LRA dose analysis is bounding for the radiological consequences of a postulated RCP shaft break, as noted in DCD Tier 2, Section 15.3.4.

The applicant analyzed this hypothetical accident assuming that 7 percent of the fuel rods in the core will experience local clad temperatures that exceed limits and fail, releasing the entire fission product inventory in the fuel-cladding gap of these rods to the reactor coolant. The fission product inventory in the gap is based on the assumptions in RG 1.183, Table 3, multiplied by a radial peaking factor of 1.80 to bound power differences among assemblies in the core. No fuel is assumed to melt. These fuel-failure assumptions bound the number of rods predicted to fail in the departure from nucleate boiling (DNB) analysis and the core performance analysis. The primary coolant concentration is assumed to be at 37 kBq/gm (1.0 Ci/gm) for DE I-131 and 21.5 MBq/gm (580 Ci/gm) for DE Xe-133 in the primary coolant. The activity in the primary coolant is transferred to the secondary coolant through primary-to-secondary leakage, with iodine portioning between the liquid and steam in the SG secondary side with a flashing fraction of 0.15 for 30 minutes after the onset of the accident and an iodine partitioning coefficient of 100. Primary-to-secondary leakage is modeled as 1.14 L/min (0.3 gpm) per SG.

The activity is released to the environment through the affected loop SG for two hours and through the unaffected loop SG until eight hours after the RCP rotor seizure.

In RAI 108-7973, Question 15.00.03-14, the staff requested that the applicant provide a basis for a difference in the LRA dose analysis from RG 1.183 guidance on flashing to vapor of the release through SGs during periods of SG dryout. In the response to this question dated February 24, 2016 (ML16055A086), the applicant stated that although tubes are expected to be uncovered, dryout of both SGs is not calculated to occur during the LRA. The applicant also states that the flashing fraction for the primary-to-secondary leakage was calculated based on the estimated thermodynamic conditions in the reactor and secondary coolant, consistent with guidance in Appendix E to RG 1.183. Therefore, based on its review of the RAI response, the staff finds RAI 108-7973, Question 15.00.03-14, resolved and closed.

The staffs review of the applicants analysis determined that the methods used for the radiological consequence assessment conform to RG 1.183 guidance, and the radiological consequences calculated by the applicant meet the relevant dose acceptance criteria. To verify the applicants assessment, the staff performed independent radiological consequence calculations for the LRA. The staffs analyses followed the guidance in RG 1.183 and used the applicants assumptions on accident progression, fission product source terms and transport, and design reference atmospheric dispersion factors. The radiological consequences calculated by the staff are consistent with those calculated by the applicant, and confirm that the doses calculated by the applicant are within the dose criteria given in SRP Section 15.0.3 for the LRA.

15-55

Based on the comparison of the applicants analysis methodology to the guidance in RG 1.183 and the staffs confirmatory analysis, the staff has determined that the applicants analysis of the design basis LRA is acceptable. The staff assessment finds that the APR1400 design, as bounded by the atmospheric relative concentrations proposed by the applicant, will provide reasonable assurance that the offsite radiological consequences of a postulated reactor primary coolant pump seizure accident will not exceed a small fraction (i.e., 10 percent or 0.025 Sv [2.5 rem] TEDE) of the dose criterion set forth in 10 CFR 52.47(a)(2).

The staff has determined that the APR1400 design, as bounded by the atmospheric relative concentrations proposed by the applicant, will provide reasonable assurance that the estimated doses in the MCR and TSC are less than 0.05 Sv (5 rem) TEDE for the LRA. Therefore, the staff finds there is reasonable assurance that the radiological consequences in the MCR and TSC following a design basis LRA meet the dose criterion given in GDC 19 and the TSC habitability regulatory requirements, respectively.

The applicant submitted a radiological consequence analysis for the CEAE in DCD Tier 2, Section 15.4.8. The mechanical failure of a CEA mechanism pressure housing is postulated to result in the ejection of a CEA and drive shaft. Because of the resultant opening in the pressure vessel, primary coolant is lost to the containment with concurrent rapid depressurization of the reactor pressure vessel. This mechanical failure causes a rapid positive reactivity insertion, together with an adverse core power distribution, possibly leading to localized fuel rod damage.

The analysis assumes a LOOP coincident with the turbine trip after the reactor trip.

In accordance with the guidance in RG 1.183, the applicant evaluated the following two release cases separately:

Primary containment leakage pathway, assuming that the entire activity released from the fuel becomes instantaneously and homogeneously airborne in the primary containment and available for release through containment leakage.

Secondary side leakage pathway, assuming that the entire activity released from the fuel is retained in the RCS and is available for release through SG tube leakage from the primary coolant to the secondary coolant and secondary side steaming to the environment.

The applicant assumed that 10 percent of the fuel rods experience DNB, with release of all the activity in the fuel-cladding gap into the primary coolant. No fuel in the core is assumed to melt.

The radioactivity release from fuel clad failure assumed that the fuel rods have been operating at a radial peaking factor of 1.80. Ten percent of the fuel rod noble gas and halogen inventory and 12 percent of the alkali metal inventory are assumed to be in the fuel-cladding gap and released initially, which is consistent with the guidance in RG 1.183.

In RAI 108-7973, Question 15.00.03-16, the staff requested that the applicant provide a basis for a difference in the CEAE dose analysis from RG 1.183 guidance on flashing to vapor of the release through SGs during periods of SG dryout. In the response to this question dated February 24, 2016 (ML16055A086), the applicant stated that although SG tubes are expected to be uncovered, dryout of both SGs is not calculated to occur during the CEAE. The applicant 15-56

also states that the flashing fraction for the primary-to-secondary leakage was calculated based on the estimated thermodynamic conditions in the reactor and secondary coolant, consistent with guidance in Appendix E to RG 1.183. Therefore, based on its review of the RAI response, the staff finds RAI 108-7973, Question 15.00.03-16, resolved and closed.

The applicant assumed that the release of fission products to the environment may occur via either of two pathways. The containment leakage pathway involves a release of primary coolant to the containment, which is assumed to leak into the environment at the design leak rate of the containment. The applicants analysis took credit for aerosol and iodine removal by natural deposition in the containment, using the same assumptions as in the LOCA analysis. The staffs review of the containment aerosol deposition and iodine removal is discussed below as part of the review of the LOCA analysis in Section 15.0.3.4.10 of this SER. In the secondary-side leakage pathway, fission products would reach the secondary coolant via the SGs by 1.14 L/min (0.3 gpm) of primary-to-secondary leakage through each SG. For both pathways, the applicant assumed that the APR1400 reactor operated at its 37 kBq/gm (1 Ci/gm) for DE I-131 and 21.5 MBq/gm (580 Ci/gm) for DE Xe-133.

The staff reviewed the applicants analysis and determined that the methods used for the radiological consequence assessment conform to RG 1.183, and the radiological consequences calculated by the applicant meet the relevant dose acceptance criteria. To verify the applicants assessment, the staff performed independent radiological consequence calculations for the CEAE. The staffs analyses followed the guidance in RG 1.183 and used the applicants assumptions on accident progression, fission product source terms, and design reference atmospheric dispersion factors. The radiological consequences calculated by the staff are consistent with those calculated by the applicant, and confirm that the doses calculated by the applicant are within the dose criteria given in SRP Section 15.0.3 for the PWR rod ejection accident.

The staff finds that the applicants analysis of the design basis CEAE is acceptable based on the comparison of the applicants analysis methodology to the guidance in RG 1.183 and the staffs confirmatory analysis. The staff finds that the APR1400 design, as bounded by the atmospheric relative concentrations proposed by the applicant, will provide reasonable assurance that the offsite radiological consequences of a postulated control element assembly ejection accident will fall well within the dose criterion set forth in 10 CFR 52.47(a)(2)

(i.e., 25 percent or 0.063 Sv [6.3 rem] TEDE).

The staff has determined that the APR1400 design, as bounded by the atmospheric relative concentrations proposed by the applicant, will provide reasonable assurance that the estimated doses in the MCR and TSC are less than 0.05 Sv (5 rem) TEDE for each of the CEAE release cases. Therefore, the staff finds there is reasonable assurance that the radiological consequences in the MCR and TSC following a design basis CEAE meet the dose criterion given in GDC 19 and the TSC habitability regulatory requirements, respectively.

The GDC 55 contains a provision to ensure isolation of all pipes that are part of the reactor coolant pressure boundary and penetrate the containment building. GDC 55 also provides that small-diameter pipes that must be continuously connected to the primary coolant system to 15-57

perform necessary functions may be acceptable based on some other defined bases. For these lines, methods of mitigating the consequences of a rupture are necessary, because the lines cannot be isolated automatically. For the APR1400 design, the applicant determined that the bounding small line break in this category for the purposes of evaluating radiological release and resulting doses is a double-ended guillotine break of the letdown line outside the containment upstream of the letdown isolation vale.

Single failure of an isolation valve is not considered because the letdown line has three isolation valves in series inside the containment. The applicant followed guidance in RG 1.183, SRP 15.0.3, and SRP 15.6.2.

The flow from the letdown line is passively restricted by the size of the line itself, and the break is isolated by manual action at 30 minutes. In RAI 108-7973, Question 15.00.03-18, the staff noted that the letdown line break was analyzed as being conservative. The letdown line has three isolation valves in series inside containment; therefore the break was modeled as manually isolated at 30 minutes. The staff asked the applicant if there are other small lines penetrating containment that carry primary coolant and are not able to isolate a break outside containment and also may result in larger integrated releases. In the response to RAI 108-7973, Question 15.00.03-18 dated December 10, 2015 (ML15344A121), the applicant verified that there are no other small lines which penetrate containment of a greater size than the letdown line. The staff also reviewed additional information in the DCD pertaining to small lines that carry primary coolant and is satisfied that the letdown line break is the appropriate evaluation for radiological consequences. Therefore, the staff finds RAI 108-7973, Question 15.00.03-18, resolved and closed.

Fuel damage is not assumed, because the loss of primary coolant is relatively small and is compensated by make up from the safety injection system. The primary coolant activity concentrations are assumed to be initially at 37 kBq/gm (1 Ci/gm) for DE I-131 and 21.5 MBq/gm (580 Ci/gm) for DE Xe-133. The applicant assumed an accident-initiated iodine spike in the primary coolant is caused by the postulated reactor shutdown or depressurization. The iodine spike raises the equilibrium iodine appearance rate by a factor of 500 in accordance with the guidance in RG 1.183.

The fraction of the iodine in the released coolant that becomes airborne and available for release to the atmosphere is assumed to be equal to the fraction of the coolant that flashes to steam, as determined by assuming a constant enthalpy process. Noble gases released from the RCS are assumed to be released directly to the environment without mitigation.

To verify the applicants assessment, the staff performed independent radiological consequence calculations for a postulated small line break accident using the applicants assumptions on accident progression, fission product transport, and design reference atmospheric dispersion factors, and the guidance in SRP Sections 15.0.3 and 15.6.2, and RG 1.183, applicable to the small line break accident. The radiological consequences calculated by the staff are consistent with those calculated by the applicant. The staff has determined that the small line break doses calculated by the applicant are within the dose criteria given in SRP Section 15.0.3 for the small line break.

Based on comparison of the applicants analysis methodology to guidance in SRP Sections 15.0.3 and 6.5.2, and RG 1.183, and on the results of the staffs confirmatory 15-58

dose analysis, the staff has determined that the applicants analyses of the radiological consequences of the design basis small line break are acceptable. The staff finds that, the APR1400 design, as bounded by the atmospheric relative concentrations proposed by the applicant, provides reasonable assurance that the offsite radiological consequences of a postulated small line break will not exceed a small fraction (i.e., 10 percent or 0.025 Sv [2.5 rem] TEDE) of the dose criterion set forth in 10 CFR 52.47(a)(2).

The staff has determined that the APR1400 design, as bounded by the atmospheric relative concentrations proposed by the applicant, will provide reasonable assurance that the estimated doses in the MCR and TSC are less than 0.05 Sv (5 rem) TEDE for failure of small lines.

Therefore, the staff finds there is reasonable assurance that the radiological consequences in the MCR and TSC following a design basis small line break meet the dose criterion given in GDC 19 and the TSC habitability regulatory requirements, respectively.

The applicant has evaluated the radiological consequences of a postulated SGTR accident and provided a radiological consequence analysis for the accident in DCD Tier 2 Section 15.6.3.

This DBA assumes that a single tube in one SG fails, releasing primary coolant to the secondary side of the affected SG. The analysis assumes a LOOP after the turbine trip and reactor trip. Adequate core cooling precludes fuel failure. Following the guidance in RG 1.183, the applicant considered two coolant activity concentration cases.

For the accident-induced iodine spiking case, the analysis assumed that a primary coolant iodine concentration iodine spike occurred as a result of the power/pressure transient caused by the SGTR. Before the postulated accident, the APR1400 reactor was assumed to operate at an equilibrium iodine concentration limit of 37 kBq/gm (1.0 Ci/gm) for DE I-131 and 21.5 MBq/gm (580 Ci/gm) for DE Xe-133 in the primary coolant. The iodine spike generated during the accident is assumed to increase the release rate of iodine from the fuel by a factor of 335, resulting in a rising iodine concentration in the primary coolant during the course of the accident.

In RAI 108-7973, Question 15.00.03-21, the staff requested that the applicant clarify the alkali metal partition rate used in the applicants SGTR dose analysis and compare it to the steam generator moisture carryover for the APR1400 SGs. In the response to RAI 108-7973, Question 15.00.03-21, dated May 12, 2016 (ML16133A572), the applicant stated that the alkali metal partition coefficient in the SGTR analysis was conservatively assumed to be 200, which is much less than the value would be if using the SG moisture carryover as a basis consistent with RG 1.183 guidance. DCD Tier 2, Table 5.4.2-1, reports the maximum weight percent moisture carryover as 0.25 percent, which would be equivalent to a partition coefficient of 400. The applicants response also stated that revisions to DCD Tier 2, Section 15.6.3, and Table 15.6.3-5, to clarify the analysis assumptions would be integrated into the response to RAI 108-7973 Question 15.00.03-21. Therefore, based on its review of the RAI response, the staff finds RAI 108-7973, Question 15.00.03-21, resolved and closed.

For the pre-accident iodine spiking case, the analysis assumed that previous reactor operation had resulted in a primary coolant concentration equal to the maximum instantaneous concentration limit of 2.22 MBq/gm (60 Ci/gm) for DE I-131, as specified in APR1400 TS 3.4.15.

15-59

Revision 4 of the response to RAI 108-7973, Question 15.00.03-2, provided changes to DCD Tier 2, Tables 6.4-2, 15.0-10, and 15.6.3-6, to reflect revised dose results that reflect correction of errors in the SGTR dose calculation which the applicant found through an internal review.

The staff finds that these changes have a minor effect on the reported doses and are acceptable because they correct errors to the dose analyses. Based on the its review of the DCD, the staff has confirmed incorporation of the changes described above; therefore, the staff considers RAI 108-7973, Question 15.00.03-2, resolved and closed.

The staffs review of the applicants analysis has determined that the methods used for the radiological consequence assessment conform to RG 1.183 guidance, and the radiological consequences calculated by the applicant meet the relevant dose acceptance criteria. To verify the applicants assessment, the staff performed independent radiological consequence calculations for the two coolant activity scenarios for the SGTR accident. The staffs analyses followed the guidance in RG 1.183 and used the applicants assumptions on accident progression, fission product source terms and transport, and design reference atmospheric dispersion factors. The radiological consequences calculated by the staff are consistent with those calculated by the applicant as reported in Revision 4 of the response to RAI 108-7973, Question 15.00.03-2, and confirm that the doses calculated by the applicant are within the dose criteria given in SRP Section 15.0.3 for the SGTR.

Based on the comparison of the applicants analysis methodology to the guidance in RG 1.183 and the staffs confirmatory analysis, the staff has determined that the applicants analysis of the design basis SGTR is acceptable. The staff finds that the APR1400 design, as bounded by the atmospheric relative concentrations proposed by the applicant, will provide reasonable assurance that the offsite radiological consequences of a postulated SGTR accident with accident-induced iodine spiking will not exceed a small fraction (i.e., 10 percent or 0.025 Sv [2.5 rem] TEDE) of the dose criterion set forth in 10 CFR 52.47(a)(2).

The staff finds that the APR1400 design, as bounded by the atmospheric relative concentrations proposed by the applicant, will provide reasonable assurance that the offsite radiological consequences of a postulated SGTR accident with pre-accident iodine spiking in the coolant will not exceed the dose criterion set forth in 10 CFR 52.47(a)(2) (i.e., 0.25 Sv [25 rem] TEDE).

The staff has determined that the APR1400 design, as bounded by the atmospheric relative concentrations proposed by the applicant, will provide reasonable assurance that the estimated doses in the MCR and TSC are less than 0.05 Sv (5 rem) TEDE for each of the SGTR iodine spiking cases. Therefore, the staff finds there is reasonable assurance that the radiological consequences in the MCR and TSC following a design basis SGTR meet the dose criterion given in GDC 19 and the TSC habitability regulatory requirements, respectively.

In DCD Tier 2, Section 15.6.5, the applicant analyzed a hypothetical design-basis LOCA for radiological consequences. Additional description of the large break LOCA was given in DCD Tier 2, Section 15.6.5, Loss-of-Coolant Accidents Resulting from the Spectrum of Postulated Piping Breaks within the Reactor Coolant Pressure Boundary. The applicant concluded that certain bounding sets of atmospheric relative concentration values (/Qs) given in DCD Tier 2, Section 2.3, in conjunction with the use of containment sprays, the control of the pH of the water in the containment to prevent iodine evolution, and accounting for natural 15-60

deposition of fission product aerosol within the containment are sufficient to provide reasonable assurance that the calculated radiological consequences of a postulated design-basis LOCA will fall within the relevant dose criteria established in 10 CFR 52.47(a)(2) and in GDC 19.

The design-basis LOCA analyzed for radiological consequences is a postulated accident that results from primary coolant loss in excess of the makeup capacity to the RCS, thereby leading to meltdown of the core. The DBA LOCA radiological consequences are bounding for the range of RCS break sizes, including small break LOCAs. The DBA LOCA is analyzed to determine if the primary containment is sufficiently capable to prevent release of fission products to the outside environment and also determine if the fission product mitigation systems and features are sufficient. The applicant followed the guidance in RG 1.183 in performing the LOCA radiological consequences analysis.

The APR1400 is applying to be licensed with leak-before-break methodology; however, the applicants analysis did not take credit for a 10-minute delay in the gap release phase onset time, which would be allowable per RG 1.183 for plants licensed with leak-before-break. The LOCA analysis assumed a coincident LOOP.

The applicant used the core radionuclide inventory discussed above in Section 15.0.3.4.1 of this SER, which assumes operation at 102 percent of rated thermal power or 4062.66 MWt. In conformance with the guidance in RG 1.183, the analysis considered releases through the following pathways; low volume purge release, primary containment leakage and ESF component leakage, as discussed below.

Low Volume Purge Pathway In accordance with guidance in RG 1.183, because primary containment may be routinely purged during power operations, releases through the containment low volume purge system (CLVPS) prior to containment isolation during the LOCA are evaluated and the resulting doses are added to those from other release pathways. The CLVPS is assumed to be in operation exhausting to the environment when the LOCA, coincident with LOOP, occurs. The isolation valves are closed by the containment isolation actuation signal within 5 seconds. The applicants analysis conservatively assumes that 100 percent of the total RCS radionuclide inventory is instantaneously released to the containment and homogenously mixed in the containment atmosphere. Because RG 1.183 guidance is that onset of fuel gap activity release to containment is at 30 seconds, additional radiological releases from fuel damage do not occur before the CLVPS is isolated, and so are not included in the evaluation of the purge pathway.

The APR1400 primary coolant activity was assumed to be at the TS equilibrium iodine concentration limit of 37 kBq/gm (1.0 Ci/gm) for DE I-131 and the noble gas concentrations were based on failed fuel fraction of 1 percent. No iodine spiking was assumed, in accordance with RG 1.183. The assumed release flow rate is 11 m3/sec (2.34 x 104 cfm), which is much higher than the nominal CLVPS exhaust rate of 2,550 cubic meters per hour (m3/hr) (1,500 cfm) per 100 percent exhaust fan as listed in DCD Tier 2, Table 9.4.6-1. The release is assumed to be directly to the environment without credit for the filters in the non-safety-related air cleaning units. The resulting doses are orders of magnitude less than the total LOCA doses, both offsite and in the MCR and TSC. This relative result is expected because the duration of the release is very short, and the radiological source includes only the coolant activity and not the larger amounts of fission products due to core damage and melting.

15-61

Containment Leakage Pathway All releases from the core and RCS are assumed to mix homogenously in the primary containment atmosphere. After isolation, release of the containment atmosphere to the outside environment is through containment leakage based on the TS 5.5.16, Containment Leakage Rate Testing Program, limit of 0.1 percent of containment air weight per day. In accordance with RG 1.183 guidance, the containment leakage is assumed to be 0.1 percent volume per day for the first 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> and half that value afterward, until the end of the accident at 30 days.

There is no secondary containment for additional mitigation of the containment release.

The APR1400 LOCA analysis models fission product removal processes in the containment through ESF systems and also by natural processes applicable to the design. Additional discussion of the staffs review of the fission product removal aspects of the modeled ESF systems and structures may be found in Section 6.5 of this SER.

The applicants analysis takes credit for aerosol natural deposition in the containment based on the correlation model described in NUREG/CR-6189, A Simplified Model of Aerosol Removal by Natural Processes in Reactor Containments, incorporated into RADTRAD as the Powers model for containment aerosol natural deposition. The applicant used the 10th percentile removal coefficients in the Powers natural deposition correlation, in accordance with the DBA analysis guidance in RG 1.183 for currently operating reactors. In RAI 60-7972, Question 06.05.03-1, the staff requested that the applicant demonstrate that the Powers natural deposition model is appropriate for use in the APR1400, considering that the Powers natural deposition model was developed using design information from currently operating PWRs and BWRs. In the response to this question dated September 2, 2015 (ML15245A326), the applicant provided information to show that the APR1400 design parameters are within the applicability range for NUREG/CR-6189. SER Section 6.5.3 provides additional information on the staffs review and resolution of RAI 60-7972, Question 06.05.03-1.

The applicant also modeled aerosol removal by the containment spray system (CSS). The CSS is an ESF system intended for use in mitigating a design basis accident for heat and fission product removal. The CSS consists of two 100-percent-capacity trains, of which only one is assumed to be operating for the DBA LOCA dose analysis. Review of the CSS design and function is discussed in Sections 6.2.2 and 6.5.2 of this SER. Aerosol removal by the CSS is assumed to occur in 75 percent of the containment volume, which is the percentage of the containment free volume that is sprayed. In accordance with the guidance in SRP Section 6.5.2, the applicant modeled the natural convection flow between the sprayed and unsprayed regions of the containment volume by the conservative assumption of flow between the regions equivalent to two times the volume of the unsprayed region per hour. The CSS initiates operation 110 seconds after the onset of the LOCA and, is assumed to operate continuously for four hours, even though the CSS is designed to operate throughout the duration of the accident. The applicants analysis used spray removal coefficients calculated using the method in SRP Section 6.5.2 for aerosol removal by sprays. In accordance with the guidance in SRP Section 6.5.2, the aerosol spray removal coefficient was decreased by a factor of 10 after the aerosol decontamination factor reached a value of 50 at 2.4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> and the elemental iodine removal is assumed to end at 2.25 hours2.893519e-4 days <br />0.00694 hours <br />4.133598e-5 weeks <br />9.5125e-6 months <br />, when the maximum elemental iodine decontamination factor reaches a value of 200. Organic iodine is not depleted by spray removal processes.

15-62

Because the IRWST water is pH-controlled, as discussed above in SER Section 15.0.3.4.3, the iodine that has been removed from the containment atmosphere through either spray or natural processes is not assumed to re-evolve from the IRWST. This modeling of iodine transport in the containment is in accordance with RG 1.183 guidance on iodine removal and pH control in containment.

ESF component leakage pathway ESF systems that recirculate sump water outside of the primary containment are assumed to leak during their intended operation. The APR1400 LOCA analysis follows RG 1.183, Appendix A, guidance on the source term assumptions for the ESF system leakage, which states that, with exception of noble gases, the same source term that was released to the containment in calculating the release through the containment leakage pathway should be assumed to be instantaneously and homogeneously mixed in the sump water as it is released from the fuel.

The ESF components that are assumed to leak are the containment spray, safety injection and component cooling water pumps, all of which are located in the auxiliary building. The applicants analysis assumed that the ESF component total leakage is 37.8 L/hr (10 gallons per hour), which is twice the expected leakage, in accordance with the guidance in RG 1.183. A 10 percent flashing fraction was applied to model the amount of iodine in the leaked fluid that becomes airborne and released to the environment for the first 3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br />. As the temperature of the fluid changes, assuming constant enthalpy flashing fractions for later time periods are calculated to be 2 percent (3 hr through 16.67 hr) and 10 percent (> 16.67 hr).

During the time that it takes the auxiliary building controlled area emergency exhaust system to become operational, 300 seconds after onset of the accident, 100 percent of the airborne release from the ESF systems was assumed to be released directly to the environment as a ground-level release. Following the completion of drawdown, the ESF component leakage is filtered at 95 percent efficiency for elemental and organic iodine species and released through the plant stack as a ground-level release. No credit for mixing in the auxiliary building volume was taken.

In the responses to RAI 108-7973, Question 15.00.03-24 (ML15352A056), and RAI 173-8213, Questions 15.00.03-29, and -30, (ML15301A901), the applicant provided information that confirms that the dose analysis model did not assume mixing or holdup in the auxiliary building ESF areas, and clarified the amount of ESF leakage assumed in the dose analysis, and additional information on the ESF area ventilation system, including the time after onset of the LOCA when filtration is credited. These clarifications also included proposed changes to DCD Tier 2 Section 15.6.5.5.1.2, and Table 15.6.5-13, to be incorporated in a future revision of the DCD. Based on the its review of the DCD, the staff has confirmed incorporation of the changes described above; therefore, the staff considers RAI 108-7973, Question 15.00.03-24, and RAI 173-8213, Questions 15.00.03-29 and 15.00.03-30, resolved and closed.

The staffs review of the applicants analysis has determined that the methods used for the radiological consequence assessment conform to RG 1.183, and the radiological consequences calculated by the applicant meet the relevant dose acceptance criteria. To verify the applicants assessment, the staff performed independent radiological consequence calculations for the LOCA. The staffs analyses followed the guidance in RG 1.183 and used the applicants assumptions on accident progression, fission product source terms, and design reference 15-63

atmospheric dispersion factors. The offsite radiological consequences calculated by the staff are consistent with those calculated by the applicant, and have determined that the doses calculated by the applicant are within the dose criteria given in SRP Section 15.0.3 for the LOCA.

The staff finds that the applicants analysis of the design basis LOCA is acceptable based on the comparison of the applicants analysis methodology to the guidance in RG 1.183 and the staffs confirmatory analysis. The staff finds that the APR1400 design, as bounded by the atmospheric relative concentrations proposed by the applicant, will provide reasonable assurance that the offsite radiological consequences of a postulated LOCA will not exceed the dose criterion set forth in 10 CFR 52.47(a)(2) (i.e., 0.25 Sv [25 rem] TEDE).

The applicant reported the results of its radiological consequence analysis for personnel in the MCR and TSC during a design-basis LOCA, which relies on the control room emergency makeup air cleaning system (CREACS) to limit the radioactivity to which the personnel may be exposed. To verify the applicants assessment, the staff performed an independent radiological consequence calculation for the LOCA, using the applicants assumptions on MCR and TSC design, design reference atmospheric dispersion factors for the MCR and TSC receptors, and the same accident assumptions as for the offsite dose analysis. The MCR and TSC radiological consequences calculated by the staff are consistent with those calculated by the applicant. The staff has determined that the LOCA doses calculated in the main control room and TSC by the applicant are less than 0.05 Sv (5 rem) TEDE. Therefore, the staff finds there is reasonable assurance that the CREACS can mitigate the dose in the main control room and TSC following a design basis LOCA to meet the dose criterion given in GDC 19 and the TSC habitability regulatory requirements, respectively.

In DCD Tier 2, Section 15.7.4, the applicant presented the analysis of the radiological consequences of a postulated FHA. For the APR1400 design, an FHA can be postulated to occur either inside the containment or in the fuel handling area of the auxiliary building.

Because APR1400 TS 3.9.3, Containment Penetrations, requires that the containment penetrations be ensured closed during movement of irradiated fuel inside containment, no release to the environment is credible and no dose results were reported. For the FHA in the fuel handling area, the applicant assumed, in accordance with guidance in RG 1.183, that fission products are released directly to the environment within a 2-hour period without credit for mixing or hold-up in the auxiliary building or any iodine removal processes, except for iodine retention in overlying fuel pool water.

Other FHAs such as a spent fuel cask falling or tipping onto the spent fuel pool (SFP) are prevented by the design of the spent fuel handling equipment. DCD Tier 2, Section 15.7.5, states that the fuel handling system and spent fuel cask crane are located so that a cask is prevented from being in the SFP area. The overhead heavy load system is designed with a single-failure-proof crane, precluding the need to perform heavy load drop evaluations.

Therefore, the applicant did not provide an analysis of the cask drop event. SRP 15.7.5 guidance is that no accident analysis for a spent fuel cask drop is necessary if spent fuel cask handling design and procedures prevent the cask from falling or tipping onto irradiated fuel in the SFP. Therefore, based on the design prevention of spent fuel cask falling or tipping onto the SFP, the staff finds the applicants discussion of the cask drop is acceptable.

15-64

For the FHA, the applicant assumed that a single fuel assembly that has undergone 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> of decay time is dropped, such that the activity in the gap of every rod in the dropped assembly is released. The kinetic energy of the falling fuel assembly is assumed to break open the maximum possible number of fuel rods. Instantaneous release of noble gases and radioiodine vapor from the gaps of the broken rods (8 percent of I-131, 10 percent of krypton-85 [Kr-85],

and 5 percent of other iodine and noble gas inventories in the fuel rod) is assumed to occur, with the released gases bubbling up through the fuel pool water. These gap fractions conform to RG 1.183 guidance, and are acceptable for use in the FHA analysis because the fuel burnup and linear heat generation rate limitations in the footnote to RG 1.183, Table 3, are met for the APR1400 fuel. The applicant assumed an effective decontamination factor of 200 for total iodine as it rises through the fuel pool water. The fuel pool water depth above the fuel is at minimum 7 m (23 ft); therefore, in accordance with the guidance in RG 1.183, the decontamination factor of 200 is acceptable. The applicant assumed that iodine in the particulate form is not volatile and; therefore, is not released.

In RAI 108-7973, Question 15.00.03-26, the staff noted that the TS do not include a TS for decay time, and requested that the applicant clarify how the 72 hour8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> decay time assumed in the FHA dose analysis is ensured, and give a basis for not providing such a TS. In the response dated December 18, 2015 (ML15352A056), the applicant stated that in response to RAI 146-8152 Question 12.02-14 the bases for refueling operations TS 3.9.3, Containment Penetrations, and TS 3.9.6, Refueling Water Level, were updated to state that the FHA analysis is based on a minimum decay time of 100 hours0.00116 days <br />0.0278 hours <br />1.653439e-4 weeks <br />3.805e-5 months <br />, even though the FHA radiological analysis continues to conservatively assume 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> of decay time. In addition, in response to RAI 133-7978, Question 16-31.15 (ML16036A378), the applicant proposed to add TS 3.9.8, Decay Time, to preclude fuel movement before 100 hours0.00116 days <br />0.0278 hours <br />1.653439e-4 weeks <br />3.805e-5 months <br /> of decay time. Therefore, based on its review of the RAI response, the staff finds RAI 108-7973, Question 15.00.03-26, resolved and closed.

The APR1400 TS 3.7.14, Spent Fuel Pool Water Level (SFPWL), states that the SFP water shall be maintained at least 7 m (23 ft) above the top of irradiated fuel assemblies in the storage racks. The FHA dose analysis assumes scrubbing of the fission product release using decontamination factors from RG 1.183, which states that the decontamination factor is applicable if the water above the damaged fuel is 23 feet or greater.

In RAI 108-7973, Question 15.00.03-27, the staff requested that the applicant provide additional information on how the depth of water is maintained above the SFP racks to ensure that the FHA dose analysis assumptions are appropriate. Specifically, the staff asked the following:

a. The FHA dose analysis in DCD Tier 2, Section 15.7.4, states that the water level is 7 m (23 ft.) from the top of the SFP racks to the SFP surface. Compare this dose analysis assumption to the water depth assured by TS 3.7.14. Is there additional water above the top of the fuel and below the top of the storage racks; therefore making the assumption used in the FHA dose analysis not bounded by the TS?

b. For the FHA, the fuel assembly that is dropped is assumed to be damaged resulting in release of fission products. This dropped fuel assembly would not be seated in the storage racks, but instead may come to rest lying atop the storage racks in a horizontal position. If this is the case, is the depth of water above the damaged fuel assembly, as 15-65

controlled by TS 3.7.14, less than 7 m (23 ft.), thereby not meeting the conditions for use of the pool decontamination factors from RG 1.183?

In the response dated December 18, 2015 (ML15352A056), the applicant stated that DCD Tier 2, Section 15.7.4.1, will be updated to be consistent with TS 3.7.14 to resolve RAI 108-7973, Question 15.00.03-27, sub-question a. With respect to sub-question b, the applicants response provided information to show that potential non-conservatism in the assumption of iodine decontamination related to pool depth above a fuel assembly lying on top of the spent fuel racks is offset by the conservatism of the FHA analysis assumption of damage to one entire fuel assembly. Therefore, based on its review of the RAI response, the staff finds RAI 108-7973, Question 15.00.03-27, resolved and closed.

Revision 4 of the response to RAI 108-7973, Question 15.00.03-2, provided changes to DCD Tier 2, Tables 6.4-2 and 15.7.4-2, to reflect revised dose results that reflect correction of errors in the FHA dose calculation which the applicant found through an internal review. The staff finds that these changes have a minor effect on the reported doses and are acceptable because they correct errors to the dose analyses. Based on its review of DCD, the staff has confirmed incorporation of the changes described above; therefore, the staff considers RAI 108-7973, Question 15.00.03-2, resolved and closed.

The staffs review of the applicants analysis has determined that the methods used for the radiological consequence assessment conform to RG 1.183, and the radiological consequences calculated by the applicant meet the relevant dose acceptance criteria. To verify the applicants assessment, the staff performed independent radiological consequence calculations for the FHA. The staffs analyses followed the guidance in RG 1.183 and used the applicants assumptions on accident progression, fission product source terms, and design reference atmospheric dispersion factors. The offsite radiological consequences calculated by the staff are consistent with those calculated by the applicant, and the staff have confirmed that the doses calculated by the applicant are within the dose criteria given in SRP Section 15.0.3 for the FHA.

Based on the comparison of the applicants analysis methodology to the guidance in RG 1.183 and the staffs confirmatory analysis, the staff has determined that the applicants analysis of the design basis FHA is acceptable. The staff finds that the APR1400 design, as bounded by the atmospheric relative concentrations proposed by the applicant, will provide reasonable assurance that the offsite radiological consequences of a postulated FHA will fall well within the dose criterion set forth in 10 CFR 52.47(a)(2) (i.e., 25 percent or 0.063 Sv [6.3 rem] TEDE).

The staff has determined that the APR1400 design, as bounded by the atmospheric relative concentrations proposed by the applicant, will provide reasonable assurance that the estimated doses in the MCR and TSC are less than 0.05 Sv (5 rem) TEDE for the FHA. Therefore, the staff finds there is reasonable assurance that the radiological consequences in the MCR and TSC following a design basis FHA meet the dose criterion given in GDC 19 and the TSC habitability regulatory requirements, respectively.

The control room envelope includes the MCR and the TSC and is served by the CREACS.

Additional information on the MCR envelope and CREACS design is given in DCD Tier 2, 15-66

Section 6.4, Habitability Systems, and Section 9.4, Heating, Ventilation and Air Conditioning Systems. The staffs review of the control room habitability and the control room ventilation systems is discussed in Section 6.4 and 9.4 of this SER, respectively. The APR1400 TS include a control room envelope habitability program to maintain the systems and control room envelope.

The DBA control room radiological consequences analyses are bounding for the TSC, because the TSC is located within the MCR pressure boundary and is served by the CREACS in the event of a DBA with radiological release. The CREACS provides a slight positive pressure with the MCR area with respect to adjacent areas during normal and accident conditions. For an accident with release of radioactivity, the outside air supply is automatically diverted through the control room charcoal and high-efficiency particulate air (HEPA) filter trains. The system is actuated by receipt of an engineered safety feature actuation system - safety injection actuation signal (ESFAS-SIAS) or by receipt of the engineered safety feature actuation system - control room emergency ventilation actuation signal (ESFAS-CREVAS), which is a result of high radiation sensed by the MCR air intake airborne radiation monitors or by manual activation.

Filtered recirculation is initiated when the control room is isolated in emergency operation. The outside air intake having the lower radioactive contamination level is automatically selected.

Each DBA radiological consequence analysis assumed the loss of one train of the two redundant charcoal filtrations systems of the MCR for the duration of the accident. A conservative assumption of an unfiltered inleakage rate of 2.83 m3/min (100 cfm) is used in the DBA radiological consequences analyses, which includes 17 m3/hr (10 cfm) for ingress/egress through the MCR doors. In the control room dose analyses, the applicant adjusted the dose to the control room personnel due to external gamma radiation from airborne activity within the main control room by applying finite-cloud correction, in conformance with the guidance in RG 1.183.

The applicants control room radiological consequences analyses also considered external dose from the following sources:

Radiation shine from the external radioactive plumes.

Radiation shine from radioactive material in the reactor containment.

Radiation shine from radioactive material in systems and components inside or outside the MCR envelope (e.g., MCR heating, ventilation, and air conditioning (HVAC) filters).

Because of the massive concrete structures surrounding the containment and MCR, the applicant stated that the only potential source of direct shine radiation to the MCR personnel is the radioactive buildup in the MCR charcoal filtration system. The applicants calculation of the filter shine dose used the control room design dimensions and selected the assumed receptor location to maximize the filter shine dose. The filter shine dose was calculated at a point 1.8 m (6 ft.) above the operating floor of the control room, directly below the filter. The filter was assumed to be a point source located 15.24 cm (6 in.) above the approximately 0.5 m (20 in.) thick concrete floor, therefore making the filter source 3.2 m (10.5 ft.) above the receptor location, with the concrete floor providing shielding.

The filter source was based on the iodine loading for the LOCA. The filter shine doses are included in the calculated control room TEDE for each of the DBAs. There is no specific guidance on performing direct dose analyses in RG 1.183. However, the staff finds that the 15-67

applicant has used direct dose analysis best practices to model the control room dimensions, source and receptor locations, and used a bounding filter radioactive material source.

Therefore, the staff finds that the control room direct dose analysis is acceptable.

During the emergency mode of operation for the control room ventilation system, there are two assumed locations for air intake to the control room envelope: the intake flow through the ventilation system and the unfiltered in-leakage flow. The applicant has calculated a set of reference /Q values for each intake location for the control room envelope. The control room and TSC /Q values given in DCD Tier 2, Tables 2.3-2 through 2.3-12, are the values the staff used in its independent calculations and are part of site design envelope.

In the response to RAI 368-8470, Question 14.03.08-14, sub-question 6.b. (ML16113A303), the applicant identified that the control room HVAC system has a control logic that automatically reopens the closed isolation dampers at a preset interval (to be chosen by the COL applicant) so that the radioactivity at both air intakes can be measured to ensure that the control room personnel are only exposed to the lowest dose possible by choosing the intake location with the lower air radioactivity concentration level. The control room HVAC system automatically repeats the reopening of the isolation dampers for the duration of the accident. During clarification teleconferences on July 21, August 10, and August 24, 2016, the applicant stated that the automatic selection of the HVAC intake with the lower radioactivity concentration forms the basis for application of a reduction factor on the calculation of control room HVAC intake receptor /Q values used in the control room habitability analyses, in accordance with guidance in RG 1.194, Atmospheric Relative Concentrations for Control Room Radiological Habitability Assessments at Nuclear Power Plants. The applicant also stated that because the control room HVAC intake receptor /Q values assumed a reduction factor of 8 instead of the factor of 10 allowed by the RG 1.194 guidance, the DBA radiological consequences analyses in DCD Tier 2, Chapter 15, are conservative by a factor of about 20 percent which is expected to compensate for any additional dose that would be calculated if the periodic re-opening of the closed isolation dampers was explicitly modeled in the DBA radiological consequence analyses.

A lower value for the reduction factor on the /Q values results in a higher estimate of the radioactivity concentration in the air at the control room HVAC intake, which then results in a higher estimate of dose to the control room operators. During the period when the closed isolation dampers are open, both control room HVAC air intakes are taking in outside air, which may be at differing radioactivity concentrations and may potentially result in more radioactive material entering the control room HVAC system than would be the case if the isolation dampers for the air intake that was initially isolated remained closed. During the clarification call on July 21, 2016, the staff noted that the guidance in RG 1.194 does not appear to specifically address the case when the intakes are periodically reopened after the initial automatic selection of the cleanest HVAC intake. Furthermore, to evaluate the applicants claim that the modeling of control room HVAC system operation in the DBA radiological consequence analyses is conservative, the staff requires additional information to show that the application of a reduction factor of 8 and the resulting increase in dose as compared to what would be if one uses a factor of 10 consistent with the RG 1.194 guidance and would this selection compensate for any increase in the dose that would be a result of the explicit modeling of both air intakes being open periodically for the duration of the accident. The staff asked the applicant how the DCD Tier 2, Chapter 15, DBA dose analyses account for the automatic periodic reopening of the control room HVAC outside air intakes over the course of the accident, and asked for clarifying information on the system operation including the time interval that both intakes are open, the 15-68

time interval between openings, and the basis for these assumptions. Additionally, the staff asked the applicant how the periodic reopening of the control room HVAC outside air intakes is documented in the DCD.

Revision 3 of the response to RAI 368-8470, Question 14.03.08-14, sub-question 6.b, dated September 14, 2017 (ML17257A542), discussed the conservative assumptions in the DBA radiological consequence analyses, particularly with respect to the automatic operation of the control room HVAC system outside air intake dampers. The revised RAI response also discussed how analysis margin compensates for any additional intake of contaminated outside air through periodic re-opening of the dampers that is not modeled explicitly in the control room radiological habitability analyses.

Specifically, the revised RAI response indicated that the total time to open the closed damper, detect the radiation level, process the signal, and close the damper on the intake with the higher radioactivity would take approximately 45 seconds. The staff determined that the applicants discussion included the appropriate consideration of all steps needed to re-open the intake dampers, then detect, select and close the intake with higher radiation concentration, and therefore appears reasonable. The applicant also provided information to show that if a one-hour interval between opening of the closed intake for 60 seconds (instead of 45 seconds) is assumed, the result is an approximately 8.3-percent increase in dose due to potentially higher intake of radionuclides during the times when both control room HVAC intakes are open. The RAI response also provided a discussion of the approximately 20-percent margin in the dose analyses afforded by the applicants control room and TSC radiological consequence analysis assumptions on atmospheric dispersion consistent with the discussion during the clarification teleconferences on July 21, August 10, and August 24, 2016, as described above. As discussed above, although RG 1.194 allows for a reduction factor of 10 for intakes with an auto-select function, the applicant used a reduction factor of 8 in their calculations. This 20-percent conservatism in the estimated dose more than accounts for the 8.3-percent increase in dose for the period when both dampers are open. The staff finds that the applicants assessment of the margin in the DCD DBA dose analyses due to the assumption of a factor of 8 reduction in the MCR and TSC accident /Q values accommodates the lack of explicit modeling of additional intake of radioactive materials during the times when both outside air intakes are open for the duration of the accident.

The applicant also proposed to update DCD Tier 2, Section 15.0.3, to provide information on re-opening the closed intake dampers, including specifying that the interval time of 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> is assumed between re-openings. In addition, the applicant also proposed to provide COL information items stating that the COL applicant will provide the interval of re-opening the closed damper based on site-specific meteorology and other information (See COLs 9.4(2), 15.0(2),

and 15.0(3), in the response). Specifically, the COL applicant has to re-evaluate the radiological consequence analysis for the main control room if: 1) the interval time for reopening the intake dampers exceeds the 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> time assumed; 2) the time period for re-opening and closing the dampers exceeds 60 seconds; or 3) if there are any other aspects of the design of the dampers that are non-conservative compared to what is described in DCD Tier 2, Section 15.0.3.5. The staff finds that the revision to COL 9.4(2), and the addition of COL 15.0(2) and COL 15.0(3),

provide for sufficient information to the COL applicant about the limitations of the DBA radiological consequence analyses with respect to the evaluation of the periodic re-opening of the closed outside air intakes as related to the assessment of MCR and TSC radiological habitability.

15-69

Finally, in the response, the applicant proposed to update Tier 1, Table 2.7.3.1-3, ITAAC 9.b, to clarify that the ITAAC is to test that the closed outside air intake dampers are automatically opened after an interval and then the intake dampers with the higher radiation level are closed.

The staff finds this ITAAC to be acceptable.

In summary, the staff finds the justification and the proposed DCD revisions consistent with the intent of RG 1.194. In addition, the proposed COL items assures that the COL applicant will be required to address any non-conservatisms in the site-specific damper design, based on site meteorology, etc. Therefore, the staff finds that the revised RAI response resolves RAI 368-8470, Question 14.03.08-14, sub-question 6.b, with respect to the post-accident operation of the control room dampers and potential impacts on MCR and TSC dose and radiological habitability. Based on its review of the DCD, the staff has confirmed incorporation of the changes described above; therefore, the staff considers RAI 368-8470, Question 14.03.08-14, resolved and closed.

The staff has determined, based on the comparison of the applicants analysis methodology to the guidance in RG 1.183 and the staffs confirmatory analysis the applicants modeling of the control room and TSC is acceptable, as used in the DBA radiological consequences analyses.

Therefore, the staff finds there is reasonable assurance that the main control room design and CREACS can mitigate the dose in the main control room following a design basis accident to meet the dose criterion given in GDC 19.

The 10 CFR Part 50, Appendix E, Paragraph IV.E.8, requires that an onsite TSC be provided from which effective direction can be given and effective control can be exercised during an emergency. The radiation protection design of the TSC is acceptable if the total calculated radiological consequences for the postulated fission product release fall within the exposure acceptance criteria given for the control room of 0.05 Sv (5 rem) TEDE for the duration of the accident. Based on its review of the applicants analysis of dose to TSC occupants due to a DBA as discussed in SER section 15.0.3.4.12, the staff finds there is reasonable assurance that the TSC design and CRACS can mitigate the dose in the TSC following a design basis accident to within 0.05 Sv (5 rem) TEDE.

The APR1400 DCD Tier 2, Table 1.8-2, contains three COL information items pertaining to the evaluation of the radiological consequences of design basis accidents. The acceptability of the COL items are evaluated above in this SER section. The staff concluded that no additional COL information items were needed.

15-70

Table 15.0.3-1 Combined License Items Identified in the DCD Item No. Description Section COL 15.0(1) The COL applicant is to perform the radiological consequence 15.0.3 analysis using site-specific /Q values, unless the /Q values used in the DCD envelop the site-specific short-term or long-term /Q values of the DCD, and to show that the resultant doses are within the guideline values of 10 CFR 50.34 for EAB and LPZ and that of 10 CFR Part 50, Appendix A, GDC 19 for the MCR and TSC.

COL 15.0(2) The COL applicant is to perform the radiological consequence 15.0.3 analysis and demonstrate that the related dose limits specified in 10 CFR Part 50, Appendix A GDC 19 are not exceeded, if the interval value of re-opening the closed outside air intake isolation dampers is less than that specified in Subsection 15.0.3.5.

COL 15.0(3) COL applicant is to perform the radiological consequence 15.0.3 analysis and demonstrate that the related dose limits specified in 10 CFR Part 50, Appendix A GDC 19 are not exceeded, if the intake damper re-opening and closing time exceeds that specified in Subsection 15.0.3.5 or there are any other aspects of the design of the dampers that are non-conservative compared to what is used in Subsection 15.0.3.5.

The staff concludes that the information contained in the DCD Tier 2, Chapter 15, conforms to the guidance of RG 1.183 regarding control of the radioiodine isotopes in the post-LOCA environment as related to the iodine source term assumptions for use in DBA radiological consequences analyses.

The staff has reviewed the radiological consequences analyses of the DBAs described in DCD Tier 2, Chapter 15, for the APR1400 design. Based on the evaluation discussed above, the staff concludes that the APR1400 design meets 10 CFR 52.47(a)(2)(iv) dose criteria and the accident-specific offsite dose acceptance criteria, given in RG 1.183, and SRP Section 15.0.3.

Based on the evaluation discussed above, the staff finds reasonable assurance that the main control room habitability systems, as described in DCD Tier 2, Section 6.4, can mitigate the dose in the main control room following DBAs to meet the dose criterion specified in GDC 19.

In addition, the staff finds there is reasonable assurance that the main control room habitability systems can mitigate the dose in the TSC following DBAs to be within 0.05 Sv (5 rem) TEDE, to meet the TSC habitability requirements in Paragraph IV.E.8 of Appendix E to 10 CFR Part 50, and 10 CFR 50.47(b)(8) and (b)(11).

15-71

Increase in Heat Removal by the Secondary System Both AOOs and PAs can result from an increase in heat removal by the secondary system. In these events, a decrease in reactor coolant temperature causes an increase in core reactivity that leads to an increase in core power. These events are described in the following DCD Tier 2, Section 15.1, Increase in Heat Removal by the Secondary System, subsections:

DCD Tier 2 Section 15.1.1, Decrease in Feedwater Temperature, (AOO).

DCD Tier 2 Section 15.1.2, Increase in Feedwater Flow, (AOO).

DCD Tier 2 Section 15.1.3, Increase in Steam Flow, (AOO).

DCD Tier 2 Section 15.1.4, Inadvertent Opening of a Steam Generator Relief or Safety Valve, (AOO).

DCD Tier 2, Section 15.1.5, Steam System Piping Failure Inside and Outside Containment, (PA).

The DCD Tier 2 Section 15.1.1 discusses the effects of an anticipated operational occurrence of a decrease in feedwater temperature on the APR1400 design. A decrease in feedwater temperature causes an increase in heat transfer from the primary to the secondary system. The negative MTC and the cooldown of the reactor system causes an increase in core reactivity.

DCD Tier 1: There are no DCD Tier 1 entries for this area of review.

DCD Tier 2: The applicant provided DCD Tier 2 information, summarized here, as follows:

The applicant identified the loss of feedwater heaters as the scenario which results in a decrease in feedwater temperature. A qualitative description of this event and its evaluation is provided which highlights the key results. The applicant evaluated this event using CESEC-III to obtain the NSSS response, and CETOP to determine the time-dependent DNBR. The CETOP DNBR calculations utilize the KCE-1 CHF correlation. The applicant concluded that the results of this evaluation are less limiting than the inadvertent opening of steam generator relief or safety valve event described in DCD Tier 2 Section 15.1.4.

ITAAC: There are no ITAAC items for this area of review.

TS: The following TS are applicable to this area of review:

SL 2.1, Safety Limits, is applicable to the acceptance criteria for the event.

LCO 3.4.1, RCS Pressure, Temperature, and Flow Limits, is applicable to the initial conditions used in the evaluation of the scenario.

15-72

The relevant requirements of NRC regulations for this area of review, and the associated acceptance criteria, are in NUREG-0800, Sections 15.1.1-15.1.4, Decrease in Feedwater Temperature, Increase in Feedwater Flow, Increase in Steam Flow, and Inadvertent Opening of a Steam Generator Relief or Safety Valve, and are summarized below. Review interfaces with other SRP sections also can be found in NUREG-0800, Sections 15.1.1-15.1.4.

GDC 10, as it relates to the RCS being designed with appropriate margin to ensure that SAFDLs are not exceeded during normal operations including AOOs.

GDC 13, as it relates to the availability of instrumentation to monitor variables and systems over their anticipated ranges to assure adequate safety and of appropriate controls to maintain these variables and systems within prescribed operating ranges.

GDC 15, as it relates to the RCS and its associated auxiliaries being designed with appropriate margin to ensure that the pressure boundary will not be breached during normal operations including AOOs.

GDC 20, as it relates to the reactor protection system being designed to initiate automatically the operation of appropriate systems, including the reactivity control systems, to ensure that SAFDLs are not exceeded during any condition of normal operation, including AOOs.

GDC 26, as it relates to the reliable control of reactivity changes to ensure that SAFDLs are not exceeded, including AOOs. This is accomplished by ensuring that the analysis accounts for appropriate margin for malfunctions such as stuck rods.

Acceptance criteria adequate to meet the above requirements include:

1. The most limiting moderate frequency initiating event that results in increased heat removal is identified.

2. Predicted plant response for the most limiting event satisfies the specific criteria for fuel damage and system pressure.

3. Pressure in the reactor coolant and main steam systems should be maintained below 110 percent of the design values.

4. Fuel cladding integrity shall be maintained by ensuring that the MDNBR remains above the 95/95 DNBR limit for PWRs based on acceptable correlations (see NUREG-0800, Section 4.4, Thermal and Hydraulic Design).

5. To meet the requirements of GDC 10, GDC 13, GDC 15, GDC 20, and GDC 26, the positions of RG 1.105, Instrument Spans and Setpoints, are used with regard to their impact on the plant response to the type of transient addressed in NUREG-0800.

6. The most limiting plant systems single failure, as defined in the Definitions and Explanations of 10 CFR Part 50, Appendix A shall be identified and assumed in 15-73

the analysis and shall satisfy the positions of RG 1.53, Application of the Single-Failure Criterion to Nuclear Power Plant Protection Systems.

7. The analyses of transients caused by excessive heat removal are performed using an acceptable analytical model, and approved methodologies and computer codes. The values of the parameters used in the analytical model should be suitably conservative.

The staffs technical evaluation of the evaluation model for this event is presented in Section 15.1.4.4 of this SER.

The input parameters and initial conditions described in Section 15.1.4.4 are applicable to this section. Additionally, the applicant stated that the maximum decrease in feedwater temperature due to a failure in the main feedwater system is stated to be less than 55.6 °C (100 °F). The basis for this value was not provided, which caused the staff to question whether this value was bounding. On October 13, 2015, the staff issued RAI 240-8318, Question 15.01.01-1, to establish the basis for the assumed decrease in feedwater temperature. The applicants response, provided by letter dated December 21, 2015 (ML15355A424), stated that the feedwater temperature decrease was evaluated to be less than 55.6 °C (100 °F), but no additional details were provided. The staff conducted a confirmatory analysis in order to verify that the assumed temperature decrease was suitably conservative. This analysis evaluated two scenarios (1) the loss of a train of high pressure feedwater heaters, and (2) the loss of two trains of low pressure feedwater heaters. The staffs confirmatory analysis showed that the resulting decrease in feedwater temperature is bounded by the 55.6 °C (100 °F) value assumed in the applicants analysis. Based on information contained in this paragraph, the staff finds the input parameters and initial conditions used in the decrease in feedwater temperature event to be suitably conservative. The applicants response to RAI 240-8318, Question 15.01.01-1, contained a DCD update to correct an error in the conversion from Fahrenheit to Celsius in DCD Tier 2 Section 15.1.1.1. Based on its review of the DCD, the staff confirmed that the correction discussed above; therefore, RAI 240-8318, Question 15.01.01-1, is resolved and closed.

The applicant concluded that the results of this evaluation are less limiting than the inadvertent opening of a steam generator relief or safety valve event described in DCD Tier 2 Section 15.1.4. The staff performed confirmatory analyses for AOOs that increase heat transfer to the secondary side. The results of the staffs confirmatory analysis were consistent with the applicants statement that the analysis, described in Section 15.1.4 of Tier 2 of the DCD, is bounding. Based on the applicants conclusion, and the results of the staffs confirmatory analysis, the staff agrees that the applicants analysis presented in Section 15.1.4 of Tier 2 of the DCD is a bounding AOO that increases the heat removal by the secondary system.

15-74

The staffs evaluation of the barrier performance for the bounding AOO that increases the heat removal by the secondary system is presented in Section 15.1.4.4.4 of this SER.

The staffs evaluation of the radiological consequences for the bounding AOO that increases the heat removal by the secondary system is presented in Section 15.1.4.4.5 of this SER.

There are no COL information items associated with Section 15.1.1 of the APR1400 DCD.

The conclusions for the bounding AOO causing an increase in the heat removal of the secondary system are contained in Subsection 15.1.4.6 of this SER.

The DCD Tier 2 Section 15.1.2 discussed the effects of an anticipated operational occurrence of an increase in feedwater flow in the APR1400 design. An increase in feedwater flow causes an increase in heat transfer from the primary to the secondary system. The negative MTC and the cooldown of the reactor system causes an increase in core reactivity.

DCD Tier 1: There are no DCD Tier 1 entries for this area of review.

DCD Tier 2: The applicant provided DCD Tier 2 information, summarized here, as follows:

The applicant identified the scenarios which result in an increase in main feedwater flow as the further opening of a feedwater control valve, an increase in the feedwater pump speed, and the inadvertent actuation of an auxiliary feedwater pump. A qualitative description of this event and its evaluation is provided which highlights the key results. This event was evaluated using CESEC-III to obtain the NSSS response, and CETOP to determine the time-dependent DNBR.

The CETOP DNBR calculations utilize the KCE-1 CHF correlation. The applicant concluded that the results of this evaluation are less limiting than the inadvertent opening of steam generator relief or safety valve event described in Section 15.1.4.

ITAAC: There are no ITAAC items for this area of review.

TS: The following TS are applicable to this area of review:

SL 2.1, Safety Limits, is applicable to the acceptance criteria for the event.

LCO 3.4.1, RCS Pressure, Temperature, and Flow Limits, is applicable to the initial conditions used in the evaluation of this event.

15-75

The regulatory basis described in Section 15.1.1.3 is also applicable to DCD Tier 2 Section 15.1.2.

The staffs technical evaluation of the evaluation model for this event is presented in Section 15.1.4.4 of this SER.

The input parameters and initial conditions described in Section 15.1.4.4 are applicable to this section. The applicant did not describe the modeling of the increase in feedwater flow, or the basis for the increase, which caused the staff to question whether the input parameters were suitably conservative. Therefore, on October 13, 2015, the staff issued RAI 240-8318, Question 15.01.01-3, requesting the applicant to explain how the input parameters were suitably conservative. The applicants response, provided in a letter dated December 21, 2015 (ML15355A424), confirmed that a 100 percent increase in feedwater flow was assumed, but provided no additional justification. The staff conducted a confirmatory analysis in order to verify that the assumed increase in feedwater flow was suitably conservative. The staff was able to confirm that that the maximum flow that can be provided by all feedwater booster pumps and feedwater pumps running is 165 percent, which is bounded by the assumption of a 100 percent increase in feedwater flow. Based on information contained in this paragraph, the staff finds the input parameters and initial conditions used in the increase in feedwater flow event to be suitably conservative. Therefore, the staff considers RAI 240-8318, Question 15.01.01-3, resolved and closed.

The applicant concluded that the results of this evaluation are less limiting than the inadvertent opening of a steam generator relief or safety valve event described in Section 15.1.4. The staff performed confirmatory analyses for AOOs that increase heat transfer to the secondary side.

The results of the staffs confirmatory analysis were consistent with the applicants statement that the analysis, described in Section 15.1.4 of Tier 2 of the DCD, is bounding. Based on the applicants conclusion, and the results of the staffs confirmatory analysis, the staff agrees that the applicants analysis presented in Section 15.1.4 of Tier 2 of the DCD is a bounding AOO that increases the heat removal by the secondary system.

The staffs evaluation of the barrier performance for the bounding AOO that increases the heat removal by the secondary system is presented in Section 15.1.4.4.4 of this SER.

The staffs evaluation of the radiological consequences for the bounding AOO that increases the heat removal by the secondary system is presented in Section 15.1.4.4.5 of this SER.

15-76

There are no COL information items associated with Section 15.1.2 of the APR1400 DCD.

The conclusions for the bounding AOO causing an increase in the heat removal of the secondary system are contained in Section 15.1.4.6 of this SER.

The DCD Tier 2 Section 15.1.3 discussed the effects of an anticipated operational occurrence of an increase in steam flow in the APR1400 design. An increase in steam flow causes an increase in heat transfer from the primary to the secondary system. The negative MTC and the cooldown of the reactor system causes an increase in core reactivity.

DCD Tier 1: There are no DCD Tier 1 entries for this area of review.

DCD Tier 2: The applicant provided DCD Tier 2 information, summarized here, as follows:

The applicant identified the scenario which results in an increase in steam flow as the inadvertent opening of a turbine admission valve by operator error or turbine load limit malfunction. A qualitative description of this event and its evaluation is provided which highlights the key results. The applicant evaluated this event using CESEC-III to obtain the NSSS response, and CETOP to determine the time-dependent DNBR. The CETOP DNBR calculations utilize the KCE-1 CHF correlation. The applicant concluded that the results of this evaluation are less limiting than the inadvertent opening of a steam generator relief or safety valve event described in Section 15.1.4.

ITAAC: There are no ITAAC items for this area of review.

TS: The following TS are applicable to this area of review:

SL 2.1, Safety Limits, is applicable to the acceptance criteria for the event.

LCO 3.4.1, RCS Pressure, Temperature, and Flow Limits, is applicable to the initial conditions used in the evaluation of this event.

The regulatory basis described in Section 15.1.1.3 is applicable to this section.

The evaluation model described in Section 15.1.4.4.1 is applicable to this section.

15-77

The input parameters and initial conditions described in DCD Tier 2 Section 15.1.4.4 are applicable to this section. Additionally, the applicant stated that inadvertent opening of a turbine admission valve results in no more than an 11 percent increase over the nominal full power flow rate. The basis for the 11 percent increase over nominal flow rate was not provided, which caused the staff to question if this input parameter represented a suitably conservative input for the analysis. Therefore, on October 13, 2015, the staff issued RAI 240-8318, Question 15.01.01-4, requesting the applicant to explain why 11 percent is a bounding increase in steam flow for the inadvertent opening of a turbine admission valve. The applicants response, provided in letter dated December 21, 2015 (ML15355A424), stated that the turbine admission valves are sized to admit a total of 110 percent of full power steam when the valves are wide open. The applicant stated, and the staff has confirmed, that an 11 percent increase over nominal full power flow rate is consistent with the assumed increase in steam flow resulting from an inadvertent opening of a steam generator relief or safety valve. Thus, the staff finds the evaluation provided in Section 15.1.4 is applicable to the increase in steam flow event and considers RAI 240-8318, Question 15.01.01-4, resolved and closed.

The staffs evaluation of these results is provided in Section 15.1.4.4 of this SER.

The staffs evaluation of the barrier performance for an increase is steam flow is provided in Section 15.1.4.4 of this SER.

The staffs evaluation of radiological consequences for an increase in steam flow is provided in Section 15.1.4.4 of this SER.

There are no COL information items associated with Section 15.1.3 of the APR1400 DCD.

The conclusion for the bounding AOO causing an increase in the heat removal of the secondary system are contained in Section 15.1.4.6 of this SER.

The DCD Tier 2 Section 15.1.3 discussed the effects of an anticipated operational occurrence of an inadvertent opening of a steam generator atmospheric dump valve (IOSGADV).

DCD Tier 1: There are no DCD Tier 1 entries for this area of review.

15-78

DCD Tier 2: The applicant has provided DCD Tier 2 information, summarized here, as follows:

The inadvertent opening of an ADV, turbine bypass valve, or steam generator relief valve produce similar consequences because all of these valves have the same maximum flow rate.

The inadvertent opening of any of these valves results in an increase in steam flow which causes an increase in heat transfer from the primary to the secondary system. The negative MTC and the cooldown of the reactor system causes an increase in core reactivity.

The applicant identified the applicable scenarios as the IOSGADV or turbine bypass valve by an operator or due to a failure of the control system that operates the valve. A steam generator safety valve would only remain open as a result of a valve failure and the results would be similar to the IOSGADV event. The applicant presented an analysis is for an IOSGADV coincident with a LOOP. Two cases were presented: (1) IOSGADV coincident with LOOP and (2) IOSGADV coincident with LOOP and feedwater control system malfunction.

The applicant evaluated this event using CESEC-III to obtain the NSSS response, and CETOP to determine the time-dependent DNBR. The CETOP DNBR calculations utilize the KCE-CHF correlation. The applicant credited operator action beginning 30 minutes into the event to (1) manually trip the reactor, (2) manually close the ADV, and (3) initiate a plant cooldown. The results of the analyses for both cases resulted in the same minimum DNBR value of 1.336, which is above the SAFDL value of 1.29. The applicant identified the inadvertent opening of a steam generator relief or safety valve as the most limiting AOO in DCD Tier 2 Section 15.1.

An inadvertent opening of an ADV, turbine bypass valve, or steam generator relief valve produce similar consequences because all of these valves have the same maximum flow rate (11 percent of full-power turbine flow rate).

The resulting increase in main steam flow causes a decrease in temperature of reactor coolant, an increase in reactor power due to negative MTC, and a decrease in the RCS and SG pressure.

ITAAC: There are no ITAAC items for this area of review.

TS: The following TS are applicable to this area of review:

SL 2.1, Safety Limits, is applicable to the acceptance criteria for the event.

LCO 3.4.1, RCS Pressure, Temperature, and Flow Limits, is applicable to the initial conditions used in the evaluation of this event.

The regulatory basis described in Section 15.1.1.3 of this SER is applicable to this section.

The applicant evaluated the inadvertent opening of a steam generator relief or safety valve using CESEC-III to determine the NSSS response and CETOP to determine the time-15-79

dependent thermal margin. The CETOP calculation utilizes the KCE-1 CHF correction. In Section 15.0.2 of this SER the staff concluded that CESEC-III, CETOP, and KCE-1 correlation are acceptable for performing safety analyses of the APR1400.

The applicant determined the initial plant conditions for the transient by performing a parametric study in order to determine the set of initial conditions that produces the limiting minimum departure from nucleate boiling ratio (MDNBR). The staff conducted an audit of the applicants calculations (ML17013A130, July 16, 2016). The staff verified in the audit that the parametric study varied input parameters over a sufficient range. Based on results of the parametric study and the use of conservative inputs, the staff finds that a sufficient range of plant initial conditions has been considered in the analysis of the IOSGADV event.

Table 15.1.4-1. Limiting Set of Initial Conditions for the Analysis of the IOSGADV Parameter Value Basis Initial core power 4,062.66 MWt (102 Maximize core power to minimize percent) DNBR Initial core inlet temperature 296.1 °C (565 °F) Parametric study Initial core mass flow rate 85.03x106 kg/hr Parametric study (187.46x106 lbm/hr)

Initial pressurizer pressure 16.03 MPa Parametric study (2,325 psia)

Initial pressurizer water volume 13.56 m3 Parametric study (478.80 ft3)

Initial steam generator inventory 127,131 kg High initial SG mass. Results of (280,276 lbm) transient insensitive to this parameter.

CEA worth on trip -8.0 percent DCD Tier 2 Section 15.0.0.2.

Moderator temperature -5.4 x 10-4 /°C Most negative (EOC) to maximize coefficient (-3.0 x 10-4 /°F power increase and minimize DNBR Doppler reactivity Least negative Maximize power increase and minimize DNBR Axial shape index (ASI) +0.3 Top peaked power shape to minimize DNBR The applicants analysis of the IOSGADV event is initiated by the opening of a main steam atmospheric dump valve (MSADV) on the main steam line associated with the affected SG.

The applicant assumed the capacity of the MSADV is 11 percent of the full-power flow rate.

Table 10.1-1 of Tier 2 of the DCD provides the full-power main steam flow rate (FPSFR) of 8.14x106 kg/hr (17.95x106 lb/hr). Relief capacity of the bypass and relief valves associated 15-80

with the main steam system are provided in DCD Tier 2 Table 15.1.4-2 and demonstrate that no single valve is capable of relieving more than 11 percent of the full-power steam flow rate.

Based on the applicants analysis assuming the MSADV relief capacity is equal to the largest capacity valve associated with the main steam system, the staff finds the modeling of the initiating event to be acceptable.

Table 15.1.4-2. Relief Capacity of Valves Associated with the Main Steam System Valve Max Capacity Reference TBV 9.07x105 kg/hr DCD Tier 2 Section (2.0 x 106 lb/hr) 10.4.4.2.2.1 11 percent FPSFR ADV 498,952 kg/hr DCD Tier 2 Table 10.3.2-1 (1.1 x 106 lb/hr) 6 percent FPSFR MSSV 9.07x105 kg/hr DCD Tier 2 Table 10.3.2-1 (2.0 x 106 lb/hr) 11 percent FPSFR The applicants analysis credits RPS actuation and operator action for mitigation of the IOSGADV event. If reactor power were to increase above 115 percent, the CPC variable overpower trip would initiate a RPS trip signal. The staff has verified that crediting the CPC variable overpower trip is consistent with the description in DCD Tier 2 Section 15.0.0.3.

Operator action to trip the reactor and initiate a cooldown 30 minutes into the event is credited for the mitigation of this event, which is consistent with the description in DCD Tier 2 Section 15.0.0.6.

Additional considerations for the analysis of the IOSGADV event include LOOP and single failure. The applicant assumes a LOOP is postulated to occur concurrent with the turbine trip.

The staff agrees that this assumption is conservative because it results in a decrease in coolant flow which will decrease DNBR. The IOSGADV event is presented with and without the single failure of the feedwater reactor trip override (RTO). There was no explanation of the RTO logic in either DCD Tier 2 Section 15.1.4 or DCD Tier 2 Section 7.7, which caused the staff to question the impact of the RTO failure on the IOSGADV event. Therefore, on October 13, 2015, the staff issued RAI 240-8318, Question 15.01.01-5, requesting that the applicant describe the RTO logic and explain how it was determined to be the limiting single failure. The applicants response, provided in a letter dated December 21, 2015 (ML15355A424), updated DCD Tier 2 Section 15.1.4.2 to describe RTO function and the impact on the transient. The staff found the applicants response acceptable because the DCD update provided a suitable description of the RTO and the impact of assuming its failure. Based on its review of the DCD, the staff confirmed the update discussed above; therefore, RAI 240-8318, Question 15.01.01-5, is resolved and closed.

15-81

The applicants analysis showed that the initiation of the IOSGADV event increases the steam flow rate in the affected SG, which decreases the RCS temperature and inserts positive reactivity, resulting in a power increase. Power stabilizes, due to Doppler feedback, at 113 percent reactor power (below the CPC Variable Overpower trip). The applicant calculated a MDNBR of 1.336, which occurs shortly after reactor trip (within 2 seconds), and is above the SAFDL limit of 1.29. The maximum steam generator pressure, calculated by the applicant, occurs coincident with the turbine trip and is far below 110 percent of the system design pressure or 9.101 MPa (1,320 psia). RCS pressure remains below nominal pressure for the duration of the IOSGADV event.

The applicants analysis shows that after the operator action to initiate a manual trip, the RCS continues to cool down and depressurize which results in (1) the formation of a void in the reactor vessel upper head, and (2) the initiation of safety injection. As the steam generator pressure continues to decrease, both steam generators receive an isolation signal which closes both MSIVs and main feedwater isolation valves (MFIVs). Fifty minutes after initiation of the event, the applicant credited operator action taken to manually close the stuck open ADV followed by the initiation of a plant cooldown. The staff notes that the additional events discussed in this paragraph do not impact the acceptance criteria for the IOSGADV. The applicants analysis demonstrated that the consideration of a single failure of the feedwater reactor trip override has no impact on the acceptance criteria for the IOSGADV.

The DCD Tier 2 Tables 15.1.4-1 and 15.1.4-2 provide the sequence of events for the analyses of the IOSGADV event. The staff observed that these tables were missing significant system behavior that occur during the transient. On October 13, 2015, the staff issued RAI 240-8318, Question 15.01.01-6, requesting the applicant update the DCD to describe the observed behavior. The applicants response, provided in letter dated December 21, 2015 (ML15355A424), described the behavior and updated DCD Tier 2 Table 15.1.4-2. Based on its review of the DCD, the staff confirmed the update discussed above; therefore, RAI 240-8318, Question 15.01.01-6, is resolved and closed with respect to this update.

The staff observed that the applicants analysis assumes that the main feedwater enthalpy is not impacted as a result of the IOSGADV event. This caused the staff to question if the treatment is suitably conservative. Accordingly, on October 13, 2015, the staff issued RAI 240-8318, Question 15.01.01-6, requesting the applicant explain the physical behavior of the feedwater enthalpy during the IOSGADV event (ML15296A009). The applicants response, provided in letter dated December 21, 2015 (ML15355A424), did not resolve the staffs concerns. The staff conducted a sensitivity analysis to investigate the impact of a reduced feedwater temperature, which is expected to occur during the IOSGADV event. The staffs analysis demonstrated that a higher peak reactor power level is reached during an IOSGADV event if the expected feedwater temperature reduction is modeled. The staffs analysis, however, resulted in a peak reactor power level that is lower than that predicted in the applicants analysis. The staff, therefore, finds that the applicants treatment of the IOSGADV event is suitably conservative.

The applicant concluded that the IOSGADV bounds the results of decrease in feedwater temperature, increase in feedwater flow, and increase in steam flow events in terms of MDNBR.

The staff performed confirmatory analysis for the AOOs that increase heat transfer to the secondary side. The applicants results for the IOSGADV event bound the results of the staffs 15-82

calculations in terms of peak reactor power obtained during the event. Therefore, the staff agrees that the applicants analysis of the IOSGADV event represents the bounding AOO that increases heat transfer to the secondary side in terms of the MDNBR. Based on the results of its confirmatory analysis, the staff considers RAI 240-8318, Question 15.01.01-6, resolved and closed.

The applicants analysis showed that the pressure in the reactor coolant and main steam systems is maintained below 110 percent of the design values for this event, and the minimum DNBR remains above the 95/95 limit. Based on the results of this analysis, the applicant concluded, and the staff agrees, that there is no challenge to any of the fission product barriers for this AOO.

Based on the results of the analysis and barrier performance, the applicant concluded, and staff agrees, that there are no radiological consequences associated with the IOSGADV event.

There are no COL Information Items associated with Section 15.1.4 of the APR1400 DCD.

A number of plant transients can result in an unplanned increase in heat removal by the secondary system. Those that might be expected to occur with moderate frequency can be caused by feedwater system malfunctions or the inadvertent opening of a steam generator safety or relief valve. All of these postulated transients have been reviewed. It was found that the most limiting transient in regard to core thermal margin is the inadvertent opening of a steam generator relief valve. Pressure in the reactor coolant and main steam systems are maintained below 110 percent of the design values for all of the anticipated operational occurrences.

The staff concludes that the analysis of transients resulting in an unplanned increase in heat removal by the secondary system that are expected to occur with moderate frequency is acceptable and meets the requirements of GDC 10, 13, 15, 20, and 26. This conclusion is based on the following:

1. In meeting GDC 10, 13, 15, 20, and 26, the staff determined that the applicants analysis was performed using a mathematical model that had been previously reviewed and found acceptable by the staff. The parameters used as input to this model were reviewed and found to be suitably conservative and consistent with the plant design.

2. The applicant met the requirements of GDC 10, 20, and 26 with respect to demonstrating that resultant fuel integrity is maintained since the specified acceptable fuel design limits were not exceeded for this event.

3. The applicant met GDC 13 requirements by demonstrating that all credited instrumentation was available, and that actuations of protection systems, 15-83

automatic and manual, occurred at values of monitored parameters that were within the instruments prescribed operating ranges.

4. The applicant met the requirements of GDC 15 with respect to demonstrating that the reactor coolant pressure boundary limits have not been exceeded by this event and that resultant leakage will be within acceptable limits. This requirement has been met since the maximum pressure within the reactor coolant and main steam systems did not exceed 110 percent of the design pressures.

5. The applicant met the requirements of GDC 20 and 26 with respect to the capability of the reactivity control system to provide adequate control of reactivity during this event while including appropriate margins for stuck rods since the specified acceptable fuel design limits were not exceeded.

The DCD Tier 2, Section 15.1.5 discusses the effects of a postulated accident of a steam release resulting from a rupture of a main steam pipe. Such an event will cause an increase in steam flow which decreases with time as the steam pressure decreases. The increased steam flow causes increased energy removal from the reactor coolant system and results in a reduction of coolant temperature and pressure. The negative MTC and the cooldown of the reactor system causes an increase in core reactivity. The core reactivity increase may cause a loss of reactor core shutdown margin and a resulting post reactor trip return to power (RTP). If the plant is at power, the reactor is automatically tripped and the MSIVs and MFIVs are automatically closed on a main steam isolation signal (MSIS). Decay heat is removed as necessary through the unaffected SGs by venting steam from the secondary system. The auxiliary feedwater system (AFWS) supplies makeup water to the unaffected SG.

DCD Tier 1: There are no DCD Tier 1 entries for this area of review.

DCD Tier 2: The applicant provided DCD Tier 2 information, summarized here, as follows:

The applicant analyzed six SLB scenarios that were divided into two categories, shown in Table 15.1.5-1.

15-84

Table 15.1.5-1 Steam Line Break Cases Loss of Off-site Case Initial Power Break Location Power (LOOP)

Cases chosen to maximize the potential for post-trip return to power 1 Full Power Yes Inside Containment 2 Full Power No Inside Containment 3 Zero Power Yes Inside Containment 4 Zero Power No Inside Containment Cases chosen to maximize the potential for pre-trip fuel degradation and doses at the Exclusion Area Boundary (EAB) and Low Population Zone (LPZ) 5 Full Power Yes Outside Containment 6 Zero Power Yes Outside Containment The applicant evaluated the SLB event using CESEC-III to obtain the NSSS response and calculated the pre-trip transient DNBR using CETOP with the KCE-1 CHF correlation. The applicant selected plant initial conditions and reactor physics parameters to produce a bounding plant response. The analyses credit operator action, 30 minutes into the event, to initiate a plant cooldown. The applicants results demonstrate that all cases resulted in the reactor remaining subcritical post-trip with Case 2 resulting in the maximum post-trip reactivity.

Additionally, none of the cases are predicted to violate DNBR limits. The applicant assumed that 1 percent of the fuel rods fail in order to calculate dose consequences.

ITAAC: There are no ITAAC items for this area of review.

TS: The following TS are applicable to this area of review:

SL 2.1, Safety Limits, is applicable to the acceptance criteria for the event.

LCO 3.4.1, RCS Pressure, Temperature, and Flow Limits, is applicable to the initial conditions used in the evaluation of this event.

LCO 3.4.12, RCS Operational Leakage, is applicable to the amount of allowed primary to secondary leakage.

15-85

The regulatory basis for this review is based on the following regulations:

GDC 13, as it relates to the availability of instrumentation to monitor variables and systems over their anticipated ranges to assure adequate safety, and of appropriate controls to maintain these variables and systems within prescribed operating ranges.

GDC 17, as it relates to the requirement that an onsite and offsite electric power system be provided to permit the functioning of SSCs important to safety. The safety function for each system (assuming the other system is not functioning) shall be to provide sufficient capacity and capability to ensure that the acceptable fuel design limits and the design conditions of the reactor coolant pressure boundary are not exceeded during an AOO and that core cooling, containment integrity, and other vital functions are maintained in the event of an accident.

GDC 27 and GDC 28, as they relate to the RCS being designed with appropriate margin to ensure that acceptable fuel design limits are not exceeded and that the capability to cool the core is maintained.

GDC 31, as it relates to the RCS being designed with sufficient margin to ensure that the boundary behaves in a non-brittle manner and that the probability of propagating fracture is minimized.

GDC 35, as it relates to the reactor cooling system and associated auxiliaries being designed to provide abundant emergency core cooling.

Acceptance criteria adequate to meet the above requirements include:

1. Pressure in the reactor coolant and main steam systems should be maintained below acceptable design limits, considering potential brittle as well as ductile failures.

2. The potential for core damage is evaluated on the basis that it is acceptable if the minimum DNBR remains above the 95/95 DNBR limit for PWRs based on acceptable correlations (see NUREG-0800, Section 4.4). If the DNBR falls below these values, fuel failure (rod perforation) must be assumed for all rods that do not meet these criteria unless it can be shown, based on an acceptable fuel damage model (see NUREG-0800, Section 4.2), which includes the potential adverse effects of hydraulic instabilities, that fewer failures occur. Any fuel damage calculated to occur must be of sufficiently limited extent that the core will remain in place and intact with no loss of core cooling capability.

3. The radiological criteria used in the evaluation of steam system pipe break accidents (PWRs only) are in NUREG-0800, Section 15.0.3.

15-86

The SLB event results in the largest increase in heat removal by the secondary system.

Potential consequences of the SLB event include:

1. A reactor core post-trip RTP due to reduction in moderator temperature combined with a negative MTC.

2. Violation of SAFDLs due to DNB caused by the rapid reduction in pressure in the RCS, and exceeding the maximum linear heat generator rate (LHGR) due to the increase in reactor power.

3. Violation of brittle fracture limits due to the rapid cooldown of the RCS.

The evaluation of the SLB event is performed using CESEC-III to determine the NSSS response and CETOP to determine the time-dependent thermal margin. The CETOP calculation utilizes the KCE-1 CHF correction. In Section 15.0.2 of this SER the staff concluded that CESEC-III, CETOP, and KCE-1 correlation are acceptable for performing safety analyses of the APR1400.

Additional considerations for the SLB event are the effective moderator temperature used in CESEC-III to determine the neutronic feedback and the determination of mixing parameters in CESEC-III. As discussed in APR1400-Z-A-NR-14006, Non-LOCA Safety Analysis Methodology, the SLB event utilizes the cold edge temperature which is defined as the temperature of the fluid from the cold legs of the loop with the ruptured steam generator, with the addition of heat up to the core axial midplane. The staff questioned if the mixing parameters used in CESEC-III could impact the effective moderator temperature. Therefore, on December 17, 2015, the staff issued RAI 339-8415, Question 15.01.05-1, requesting the applicant explain how the mixing parameters were obtained and describe how the values provide a suitably conservative estimate of mixing during the SLB. The applicants response, provided in a letter dated February 3, 2016 (ML16034A096), described the flow mixing tests and clarified that the cold edge temperature provides the conservatism for determining the moderator feedback. During a quality assurance inspection (ADAMS ML16081A081), the staff evaluated the derivation of the cold-edge temperature and the source code implementing the cold-edge temperature into CESEC-III and found that the implementation was consistent with the description provided in APR1400-Z-A-NR-14006-P. Based on the description of the cold edge temperature, and the accurate implementation of the model into CESEC-III, the staff finds the modeling of the effective moderator temperature to be suitably conservative for evaluating the SLB event. Based on the considerations discussed in this paragraph, the staff finds the evaluation model acceptable; therefore, RAI 339-8415, Question 15.01.05-1 is resolved and closed.

The applicant performed analyses for both post-reactor trip RTP and pre-reactor trip DNBR.

Input parameters are chosen to produce the most adverse consequences. Input parameters are provided in Table 15.1.5-2 and Table 15.1.5-3 of this SER for post-reactor trip RTP analysis and pre-reactor trip DNBR analysis, respectively.

15-87

Table 15.1.5-2 Initial conditions and input parameters for the post-reactor trip RTP analysis for the SLB event Parameter Value Basis Core power 4,062.66 MWt (Hot full power Results in largest change in

= 102 percent of Rated RCS temperature, thus Thermal Power) largest reactivity feedback.

10 MWt Minimizes CEA worth for reactor trip.

Initial core inlet temperature 295 °C (563 °F) High initial core inlet temperature maximizes cooldown, thus maximizes reactivity feedback.

Supported by parametric study.

RCS flow rate 95 percent of nominal Low RCS flow increases cooldown in the effected RCS loop, increasing reactivity feedback. Supported by parametric study.

Pressurizer pressure 16.03 MPa (2,325 psia) High initial pressure extends the time to SI injection.

Supported by parametric study.

PZR level 60 percent Level High PZR level extends time to SI injection. Supported by parametric study.

Axial power shape Bottom peaked Delays insertion of CEA reactivity.

CEA worth on trip -9.3 percent at Hot full Conservative with respect to power DCD Tier 2 Tables 4.3-8 and

-5.5 percent at Hot zero 4.3-9.

power Fuel temperature coefficient Most negative Maximize reactivity feedback Moderator temperature Moderator reactivity vs DCD Tier 2 Figure 15.1.5-0 coefficient feedback curve Initial SG liquid inventory 124,113 kg (273,623 lbm) Maximize SG inventory to maximize cooldown of RCS, maximize insertion of 190,331 kg (419,608 lbm) reactivity.

15-88

Parameter Value Basis Neutron kinetics parameters EOC, = 0.00412 Consistent with maximizing MTC. Maximizes power rise if RTP occurs.

Auxiliary feedwater 3,596 L/min (950 gpm) flow Bounding value for maximum auxiliary feedwater flow.

Cavitating venturi designed to limit flow to 900 gpm (DCD Tier 2 Table 10.4.9-1).

Initiate with reactor trip Occurs before aux feed actuation setpoint. Early actuation increases RCS cooldown, which increases reactivity insertion.

Steam line break Double ended break Maximize cooldown. Break flow limited by choking at SG nozzle.

Located upstream of MSIV Prohibits isolation of SG which increases cooldown of RCS.

Safety injection 10.72 MPa (1,555 psia) Conservative with respect to actuation setpoint nominal setpoint of 1810 psia (DCD Tier 2 Table 7.3-5A).

40 second delay DCD Tier 2 Section 6.3.1.5 Modeling of injection capacity DCD Tier 2 Table 6.3.2-4 as a function of RCS minimum pump flow pressure Boron worth End of cycle, most reactive rod fully withdrawn 15-89

Parameter Value Basis MSIV/MFIV MSIS setpoint = 5.17 MPa Conservative with respect to (750 psia) nominal setpoint of 855 psia (DCD Tier 2 Table 7.3-5A).

MSIV closure time = 6.35 sec Conservative with respect to 5 sec closure time in DCD Tier 2 Table 6.2.4-1.

MFIV closure time = 11.35 Conservative with respect to sec 5 sec closure time in DCD Tier 2 Table 6.2.4-1.

RCS pressure-temperature Variable DCD Tier 2 Figure 5.3-7 limit SI pump shutoff head 13.98 MPa (2,027 psig) DCD Tier 2 Table 6.3.2-4 15-90

Table 15.1.5-3 Initial conditions and input parameters for the pre-reactor trip DNBR analysis for the SLB event Parameter Value Basis Core power 4,062.66 MWt (Hot full power Largest initial power

= 102 percent of Rated minimizes DNBR.

Thermal Power)

Initial core inlet temperature 296.1 °C (565 °F) Results in limiting case as determined by parametric studies.

RCS flow rate 116 percent of nominal Results in limiting case as determined by parametric studies.

Pressurizer pressure 16.03 MPa (2,325 psia) High initial pressure extends the time to SI injection.

Supported by parametric study.

PZR level 60 percent level Analysis not sensitive to this parameter.

Axial power shape Bottom peaked Results in limiting case as determined by parametric studies.

CEA worth on trip -9.3 % at Hot full power Conservative with respect to

-5.5 % at Hot zero power DCD Tier 2 Tables 4.3-8 and 4.3-9.

Fuel temperature coefficient Least negative Minimize feedback to produce limiting DNBR.

Moderator temperature Moderator reactivity vs DCD Tier 2 Figure 15.1.5-0 coefficient feedback curve Initial SG liquid inventory 53,738 kg (125,968 lbm) Lower initial inventory leads to a more rapid SG depressurization and resulting RCS cooldown.

Neutron kinetics parameters EOC, = 0.00412 Consistent with maximizing MTC. Maximizes power rise if RTP occurs.

Auxiliary feedwater 3,596 L/min (950 gpm) flow Bounding value for maximum auxiliary feedwater flow.

Cavitating venturi designed to limit flow to 900 gpm (DCD Tier 2 Table 10.4.9-1).

15-91

Parameter Value Basis Initiate with reactor trip Occurs before aux feed actuation setpoint. Early actuation increases RCS cooldown, which increases reactivity insertion.

Steam line break Double ended break Maximize cooldown. Break flow limited by choking at SG nozzle.

Located outside containment, Results in limiting dose upstream of MSIV consequences.

Safety Injection 10.72 MPa (1,555 psia) Conservative with respect to nominal setpoint of 1810 psia (DCD Tier 2 Table 7.3-5A).

40 second delay DCD Tier 2 Section 6.3.1.5 Modeling of injection capacity DCD Tier 2 Table 6.3.2-4 as a function of RCS minimum pump flow pressure Boron worth End of cycle, most reactive rod fully withdrawn MSIV/MFIV MSIS setpoint = 5.17 MPa Conservative with respect to (750 psia) nominal setpoint of 855 psia.

(DCD Tier 2 Table 7.3-5A).

MSIV closure time = 6.35 sec Conservative with respect to 5 sec closure time in DCD Tier 2 Table 6.2.4-1.

MFIV closure time = 11.35 Conservative with respect to sec 5 sec closure time in DCD Tier 2 Table 6.2.4-1.

SG tube leakage 0.39 L/min (150 gpd) LCO 3.4.12 Results in limiting dose consequences.

The applicant credited reactor protection system actuation, safety injection, main steam isolation, and operator action to mitigate the SLB event. The applicant identified several trips that could cause a reactor trip as a consequence of a SLB including steam generator low pressure, steam generator low water level, high reactor power, low DNBR as calculated by the core protection calculator, and potentially a high containment pressure. Low RCP shaft speed 15-92

is credited for producing a reactor trip signal for cases that consider a coincident LOOP. For SLB events where offsite power is available, the variable overpower trip (VOPT) is credited for producing the reactor trip signal.

The limiting case for the RTP analysis of the SLB event utilizes a VOPT setpoint of 103.5 percent. However, DCD Tier 2 Table 7.2-4 provides a nominal VOPT trip setpoint of 109.6 percent and DCD Tier 2 Table 15.0-2 provides a safety analysis VOPT setpoint of 116.5 percent. This caused the staff to question whether the VOPT setpoint used in the RTP analysis was suitably conservative. Therefore, on December 17, 2015, the staff issued RAI 339-8415, Question 15.01.05-5, requesting the applicant explain the basis for the 103.5 percent VOPT setpoint and to describe how this analysis setpoint adequately accounts for instrument uncertainty event (ML15351A298). The applicants response, provided in letter dated February 3, 2016 (ML16034A096), explained that the VOPT nominal setpoint is 109.6 percent with an associated channel uncertainty of -6.1 percent and +6.9 percent. Therefore, a low VOPT setpoint that accounts for channel uncertainty is 103.5 percent. The staff agrees that a low VOPT setpoint results in more overcooling which is conservative for the RTP analysis.

The applicants response includes a proposed update to DCD Tier 2 Table 15.0-2 to reflect this setpoint in the safety analysis. The staff finds the update acceptable and confirmed that this update was incorporated into the DCD; therefore, RAI 339-8415, Question 15.01.05-5, is resolved and closed.

The applicant input the moderator reactivity as a function of moderator temperature, which is provided in DCD Tier 2 Figure 15.1.5-0. The applicant described this function as corresponding to an end-of-cycle state with the most negative MTC, and all rods in except for the most reactive CEA left in the fully withdrawn position. Additionally, the applicant credited the safety injection system during the SLB event to inject borated water which provides negative reactivity to ensure that the core remains subcritical. However, the staff determined that significant information regarding the modeling of the safety system in CESEC-III is not contained within the APR1400 DCD or the supporting technical reports. This caused the staff to question the modeling of the safety injection system and the associated impact on reactivity during the SLB event.

Therefore, on December 17, 2015, the staff issued RAI 339-8415, Question 15.01.05-2, requesting the applicant describe the modeling of the safety injection system and to describe how the boron injection reactivity vs concentration is determined for use in the CESEC-III analysis of the SLB event (ML15351A298). The applicants response, provided in letter dated February 3, 2016 (ML16034A096), clarified that the safety injection flow rate is obtained as a function of pressure which is consistent with the minimum pump flow provided in DCD Tier 2 Table 6.3.2-4. Additionally, the applicant stated that the inverse boron worth is obtained as a function of core average coolant temperature which assumes the most reactive rod is stuck out.

Based on the conservative use of the minimum flow curves for the safety injection, conservative modeling of the moderator temperature feedback, and the physically accurate modeling of the boron reactivity, the staff finds the modeling of the reactivity feedback associated with the moderator temperature and boron concentration during the SLB event to be suitably conservative; therefore, RAI 339-8415, Question 15.01.05-2, is resolved and closed The staff verified that the modeling of the low RCP shaft speed and VOPT trips are consistent with DCD Tier 2 Table 15.0-2, and conservative with respect to the setpoints and delay times provided in DCD Tier 2 Table 7.2-4 and DCD Tier 2 Table 7.2-5. The basis for the modeling of the safety injection and main steam isolation is discussed in Tables 15.1.5-2 and 15.1.5-3 of this SER. Operator action to initiate a cooldown 30 minutes into the event is credited for the 15-93

mitigation of the SLB event, which is consistent with the description in DCD Tier 2 Section 15.0.0.6.

Additional considerations for the analysis of the SLB event include LOOP and single failure.

The applicant assumed a LOOP occurs coincident with the break for the RTP analysis and coincident with the turbine trip for the DNBR analysis. The staff agrees that assuming a LOOP coincident with the break results in an earlier reactor trip and more overcooling, which is conservative for the RTP analysis. However, the staff questioned whether a LOOP coincident with the break would result in a lower reactor coolant system flow at the time of minimum DNBR and thus a result in a bounding result for the DNBR analysis. Therefore, on December 17, 2015, the staff issued RAI 339-8415, Question 15.01.05-4, requesting the applicant evaluate the impacts of a LOOP coincident with the break on the DNBR analysis ML15351A298). The applicants response, provided in letter dated March 2, 2016 (ML16062A129), provided the results of an analysis that showed the treatment of the LOOP in the DNBR analysis presented in the DCD produced bounding consequences.

The single failures considered by the applicant include the loss of a safety injection pump, failure of an MSIV to close, and, in the case of a LOOP, failure of an emergency diesel generator to start. The failure of an emergency diesel generator to start results in the consequent loss of two safety injection pumps. The applicant determined the limiting single failure by performing a sensitivity study. For RTP analysis, the limiting single failure is the failure of a MSIV to close. The DNBR analysis was not sensitive to single failure consideration as the minimum DNBR occurs before the single failures can have a significant effect. Based on the input parameters assumed in the analyses having a suitable basis, conservative modeling of the protection systems, and the consideration of LOOP and single failure in the analysis, the staff finds the applicants selection of input parameters and initial conditions to be suitably conservative; therefore, RAI 339-8415, Question 15.01.05-4, is resolved and closed.

The following describes the applicants limiting case for RTP analysis. Offsite power availability produces the limiting case for RTP analysis since the reactor coolant pumps increase the amount of heat removed from the RCS. After initiation of the break, the main steam line depressurizes and choked flow occurs at the SG outlet nozzles, resulting in a symmetric blowdown between both SGs. The reactor is tripped on a VOPT signal at approximately 5 seconds, which brings the reactor to a subcritical condition. Post reactor trip, the SGs continue to lose inventory and remove energy from the RCS, which introduces positive reactivity. At approximately 30 seconds the MSIVs and MFIVs are closed on a MSIS signal. In this limiting RTP case, an MSIV associated with the unaffected SG fails to close. The RCS pressure decreases until the safety injection setpoint is reached at approximately 2 minutes into the event. The safety injection system provides emergency makeup and boration of the RCS. After initiation of safety injection, the RCS continues to cool, but the negative reactivity insertion attributed to the increased boron concentration is larger than the positive insertion resulting from the continued cooldown. The maximum post trip reactivity occurs approximately 100 seconds after initiation of safety injection. The maximum post-trip reactivity for all cases remains negative. Therefore, the applicants analyses show that post-trip RTP does not occur during the SLB event for the APR1400. The applicant terminated the SLB event at 30 minutes by crediting operator action to initiate a plant cooldown.

15-94

The following describes the applicants limiting DNBR analysis for the SLB event which includes a LOOP. After initiation of the break and the resulting RCS cooldown and positive reactivity insertion, the reactor is tripped on a VOPT signal at approximately 7 seconds into the event.

The reactor trip is accompanied by a turbine trip and LOOP. A minimum DNBR of 1.3229 occurs within 2 seconds of the reactor trip. DNBR increases rapidly after the minimum DNBR occurs. The applicant determined that no fuel failure occurs because the minimum DNBR is greater than the safety limit of 1.29.

The applicants analysis demonstrates that the RCS pressure decreases for the duration of the SLB event. However, the applicants analysis did not address the acceptance criteria associated with GDC 31 as specified in the SRP. In particular, the applicants analysis presented in DCD Tier 2 Section 15.1.5 did not extend long enough for staff to determine that the RCS temperature remains above the temperature limit corresponding to the safety injection shutoff head on the cooldown pressure-temperature limit curve provided in DCD Tier 2 Figure 5.3-7. Therefore, on December 17, 2015, the staff issued RAI 339-8415, Question 15.01.05-6, requesting the applicant extend the analysis to the point where operator action can be credited and demonstrate that the pressure-temperature cooldown limits are not violated for the SLB event (ML15351A298). The applicants response, provided in letter dated March 2, 2016 (ML16062A129), included the results of analyses that extend out to 30 minutes and demonstrate that the cooldown pressure-temperature limits are not violated during the SLB event.

The applicants analyses demonstrate that the minimum DNBR remains above the 95/95 limit for the limiting SLB event. Thus, no failure of the fuel cladding is predicted to occur. Based on the results of the applicants analyses, performed using an acceptable evaluation model and utilizing suitably conservative inputs, the staff finds that the safety limit for the DNBR safety limit is not violated and the primary system pressure boundary design limits are not violated. Based upon these findings, and the staffs findings associated with containment performance for the SLB event in Section 6.2 of this SER, the staff finds reasonable assurance that all fission product barriers remain intact during an SLB event for the APR1400. Therefore, the staff considers RAI 339-8415, Question 15.01.05-6, resolved and closed. The applicant, however, assumed one percent of the fuel rods undergo experience cladding failure for the purposes of calculating the dose consequences.

The radiological consequences for the SLB event are presented in DCD Tier 2 Table 15.1.5-13.

The staffs evaluation of the dose calculation and their acceptability is documented in Section 15.0.3 of this SER.

There are no COL information items associated with Section 15.1.5 of the APR1400 DCD.

15-95

The staff concludes that the consequences of postulated steam line breaks meet the relevant requirements set forth in the GDC 13, 17, 27, 28, 31, and 35. This conclusion is based upon the following:

1. The applicant met GDC 13 requirements by demonstrating that all credited instrumentation was available, and that actuations of protection systems, automatic and manual, occurred at values of monitored parameters that were within the instruments prescribed operating ranges.

2. The applicant met the requirements of GDC 27 and 28 by demonstrating that the resultant fuel damage was limited such that the ability to insert control rods would be maintained and that no loss of core cooling capability resulted. The calculated results showed no fuel failures.

3. The applicant met the requirements of GDC 31 with respect to demonstrating the integrity of the primary system boundary to withstand the postulated accident.

4. The applicant met the requirements of GDC 35 with respect to demonstrating the adequacy of the ECCS to provide core cooling and reactivity control.

5. The analyses and effect of SLB accidents inside and outside containment, during various modes of operation with and without offsite power (as required by GDC 17), have been reviewed and were evaluated using a mathematical model that has been previously reviewed and found acceptable by the staff.

6. The parameters used as input to the evaluation model were reviewed and found to be suitably conservative.

Decrease in Heat Removal by the Secondary System This section documents the staffs review of DCD Tier 2, Sections 15.2.1 through 15.2.4. These events are discussed together, since they all involve a loss of normal heat removal by the secondary side power conversion system. These events also share a common NUREG-0800 section and common acceptance criteria.

The loss of external load (LOEL) event is an AOO initiated by an electrical disturbance that causes the loss of a significant portion of the turbine generator load resulting in a decrease in heat removal by the secondary system and a corresponding temperature and pressure increase of the RCS. In a turbine trip event, a malfunction in a turbine or reactor system causes the turbine to trip off line by rapidly stopping steam flow to the turbine resulting in a decrease in heat removal by the secondary systems and a corresponding temperature and pressure increase in the RCS. A loss of condenser vacuum (LOCV) event is a malfunction that can result in a turbine trip event with a corresponding decrease in heat removal by the secondary system and 15-96

a corresponding temperature and pressure increase of the RCS. In addition, due to system interaction, the LOCV event also causes the loss of main feedwater to the secondary side of the SGs.

The inadvertent closure of a MSIV is an AOO resulting from a steamline or reactor system malfunction or inadvertent operator actions.

DCD Tier 1: There are no DCD Tier 1 entries for this area of review.

DCD Tier 2: The applicant provided a DCD Tier 2 system description in Section 15.2.1, summarized here, in part, as follows:

The LOEL is caused by the disconnection of the turbine generator from the electrical distribution grid. A LOEL generates a turbine trip that results in isolating the steam flow from the SGs to the turbine due to the closure of the turbine stop valves. The steam bypass control system (SBCS) and reactor power cutback system (RPCS) are able to accommodate the load rejection without necessitating a reactor trip or the opening of the MSSVs. If these systems are in manual (and no immediate operator actions are taken), the MSSVs will open to limit system pressure.

A LOCV concurrent with LOOP results in a complete reduction in steam flow to the turbine and feedwater flow to the SGs. The complete steam flow reduction and termination of feedwater flow cause a reactor trip on high pressurizer pressure due to reduced RCS cooling and a reactor trip on RCP low speed due to LOOP. Further, the POSRVs open to limit the primary system pressure increase. The LOCV concurrent with a turbine trip results in a main steam system pressure increase, and the MSSVs open to limit the main steam system pressure increase.

Auxiliary feed water recovers the decreased SG water level.

The closure of all MSIVs results in the termination of all main steam flow. The decreased heat removal results in increased primary and secondary temperatures and pressure. A reactor trip occurs on high pressurizer pressure.

The applicant stated that the steam pressure regulator failure is not an applicable event for the APR1400.

ITAAC: There are no ITAAC items for this area of review.

TS: There are no TS for this area of review The relevant requirements of NRC regulations for this area of review, and the associated acceptance criteria, are in NUREG-0800, Sections 15.2.1, Loss of External Load, 15.2.2, Turbine Trip, 15.2.3, Loss of Condenser Vacuum, 15.2.4, Closure of Main Steam Isolation Valve (BWR), and 15.2.5, Steam Pressure Regulator Failure (Closed), and are summarized below. Review interfaces with other SRP sections also can be found in NUREG-0800, Sections 15.2.1-15.2.5.

15-97

1. GDC 10, as it relates to the RCS design with appropriate margin so SAFDLs are not exceeded during normal operations, including AOOs.

2. GDC 13, as it relates to the availability of instrumentation to monitor variables and systems over their anticipated ranges to assure adequate safety and of appropriate controls to maintain these variables and systems within prescribed operating ranges.

3. GDC 15, as it relates to design of the RCS and its auxiliaries with appropriate margin so the pressure boundary is not breached during normal operations, including AOOs.

4. GDC 17, as it relates to onsite and offsite electric power systems, to ensure that safety-related SSCs function during normal operation, including AOOs. The safety function for each power system (assuming the other system is not functioning) is to provide sufficient capacity and capability so SAFDLs and reactor coolant pressure boundary (RCPB) design conditions are not exceeded during AOOs.

5. GDC 26, as it relates to the control of reactivity changes so SAFDLs are not exceeded during AOOs. This control is accomplished by provisions for appropriate margin for malfunctions (e.g., stuck rods).

Acceptance criteria adequate to meet the above requirements include:

1. The most limiting case for moderate-frequency events is identified.

2. Predicted plant response for the most limiting event satisfies the specific criteria for fuel damage and system pressure.

3. Pressure in the reactor coolant and main steam systems is maintained below 110 percent of the design values.

4. Fuel cladding integrity is maintained by the minimum departure from nuclear boiling ratio remaining above the 95/95 DNBR limit for PWRs based on acceptable correlations (see DCD Tier 2, Section 4.4) and by satisfaction of any other SAFDL applicable to the particular reactor design.

5. Plant protection systems setpoints assumed in the transients analyses are selected with adequate allowance for measurement inaccuracies as described in RG 1.105.

6. Event evaluations consider single failures, operator errors, and performance of non-safety-related systems as described in RG 1.206.

In DCD Tier 2 Section 15.2, the applicant described the sequence of events related to LOEL, the turbine trip, and the closure of MSIV events and the applicant concluded that the consequences of these events are bounded by the consequences of the LOCV. The staffs 15-98

evaluation of the applicants conclusion is evaluated further below. In DCD Tier 2 Section 15.0, the applicant described the computer codes used to model the NSSS response to the LOCV event. The staffs evaluation of the modeling codes credited is discussed in Section 15.0 of this SER.

The LOEL is caused by the disconnection of the turbine generator from the electrical distribution grid, this generates a turbine trip that results in isolating the steam flow from the SGs to the turbine due to the closure of the turbine stop valves. The non-safety related SBCS and RPCS are capable of handling a turbine trip without having to trip the reactor. Without crediting these non-safety systems, and without crediting prompt operator action, a turbine trip will cause high pressurizer pressure which causes isolation of main steam flow and reactor trip. Then the MSSVs would open to limit the main steam system pressure increase. The operator can initiate a controlled system cooldown using the SBCS or the SG ADVs any time after the reactor trip occurs.

The applicant stated that a LOCV also results in a turbine trip; however, the feedwater flow instantaneously terminates following an LOCV whereas the flow ramps down following the LOEL. This larger reduction in heat removal capability results in a higher peak RCS pressure and lower minimum DNBRs for the LOCV. Therefore, the results of the loss of load event are bounded by the LOCV event.

The staffs evaluation of the LOCV event is discussed later in this section.

The staff noted that the applicant did not discuss the radiological consequences of this event.

DCD Tier 2 Section 15.2.1.5, Radiological Consequences, states that the radiological consequences of this event are bounded by the feedwater system piping failure event described in DCD Tier 2 Section 15.2.8. However the staff determined that the applicant did not provide a justification that demonstrates that the results of the feedwater system piping failure event bound the radiological consequences of a LOEL event. Accordingly, on September 22, 2015, the staff issued RAI 220-8269 Question 15.02.01-1 requesting the applicant to provide a justification that demonstrates that the results of the feedwater system piping failure event bound the radiological consequences of a LOEL event (ML15295A512).

In its response to the staffs RAI dated February 19, 2016 (ML16050A015), the applicant stated that the feedwater line break (FLB) event bounds the release calculated from a LOCV event, because the LOCV is the limiting event (of the events discussed in this section of the report). A LOCV event would instantly terminate feedwater flow, limiting the release to the environment. A FLB would result in a ramp down following the LOEL and the turbine trip signal, therefore this event would bound the radiological consequences of the LOEL.

The staff evaluated the applicants response and determined that the applicant has adequately evaluated the sequence of events that concludes that the FLB event bounds the radiological consequences of the LOEL event. The staff also identifies that a LOEL is part of the sequence of events that results from a FLB. Therefore, the staff finds that the concerns identified in RAI 220-8269, Question 15.02.01-1, are addressed and considers the RAI resolved and closed.

15-99

A turbine trip event can be caused by a number of events and conditions that cause the turbine generator control system to initiate a turbine trip signal. As discussed below, in the loss of load event, a turbine trip could lead to a reactor trip and actuation of the MSSVs. However, the LOCV event progression causes a turbine trip (with more limiting initial conditions); therefore, the evaluation of the LOCV bounds the results of a turbine trip.

A LOCV could occur due to the loss of cooling water, failure of the main condenser evacuation system to remove non-condensable gases, or excessive inleakage of air. The APR1400 includes the non-safety related systems RPCS, capable of reducing the pressure of the SG and the RCS following a LOCV. The analysis presented by the applicant does not take credit for this system. In DCD Tier 2 Section 15.2.3.2, the applicant described the sequence of events following a LOCV.

The applicant stated that if the LOCV is concurrent with a LOOP, the event will result in the loss of steam flow to the turbine and feedwater to the SGs. The reactor will trip on a high pressurizer pressure signal or a reactor trip due to RCP low speed, due to the LOOP. The POSRVs would open to lower pressurizer pressure, and the MSSVs would open to limit main steam system pressure.

After 30 minutes, operator action is credited to initiate a controlled system cooldown using the ADVs. If offsite power is available, the RCPs and SGs are used to remove decay heat, if there is no offsite power available, the applicant credited the natural circulation along with the SGs.

In DCD Tier 2 Section 15-2.3.4.2, Input Parameters and Initial Conditions, the applicant discussed the scenario of the LOCV with offsite power available (without LOOP). In this scenario, the RCP is available and improves the heat transfer between the primary and secondary systems, therefore limiting RCS peak pressure. However, the staff found that the applicant has not addressed how this scenario impacts the peak pressure on the secondary system. Accordingly, on September 22, 2015, the staff issued RAI 220-8269, Question 15.02.01-2, requesting the applicant discuss the consequences of a LOCV with offsite power available on the secondary side (peak SG pressure).

In its response dated December 2, 2015 (ML15336B009), the applicant evaluated the prescribed scenario and submitted the results. Crediting the same initial condition and assumptions (without LOOP), the applicants analysis resulted on a peak SG pressure of 90.97 kg/cm2A (1,293.93 psia), which is below the peak pressure calculated with a coincident LOOP.

The staff evaluated the applicants response and finds that a LOCV will cause an increase in SG pressure, but the peak calculated pressure will remain below the design maximum pressure of 92.83 kg/cm2A (1,320 psia). Therefore, the staff finds its concerns identified in RAI 220-8269 Question 15.02.01-2, addressed and considers the RAI resolved and closed.

The DCD Tier 2 Section 15.0.0.4.3, Limiting Single Failure or Operator Errors, states that analyses do take into consideration single failures and operator errors. In DCD Tier 2, Section 15.2.3.4.2, the applicant also stated that the analysis determined that there were no 15-100

single failures that, when combined with the event, resulted in a more severe peak pressure or minimum DNBR than the LOCV by itself. In DCD Tier 2 Table 15.0-4, Single Failures, the applicant identified the individual single failures evaluated. However, the staff determined that additional information was needed. Accordingly, on September 22, 2015, the staff issued RAI 220-8269, Question 15.02.01-3, requesting the applicant discuss the single active failures of a POSRV or a MSSV and how they impact the event progression.

On December 2, 2015 (ML15336B009), the applicant provided a response to RAI 220-8269, Question 15.02.01-3, stating that the APR1400 POSRVs are designed in accordance with American Society of Mechanical Engineers (ASME) Code Article NB-7511.1 and operated by system pressure and passive springs, therefore failures (fail to open and fail to close) can be exempted from single failure consideration. The applicant also stated that since the MSSVs are also spring-loaded safety valves they are also exempt from single failure consideration.

The staff evaluated the applicants response and confirms that SRP Section 5.2.2.II.2.C allows for full credit for spring-loaded safety valves designed in accordance with the requirements of ASME Code Article NB-7511.1. The staff finds that since the POSRVs and the MSSVs are safety related spring-loaded valves, that the applicant is not required to postulate failure of these valves. Therefore, the staff finds the concerns identified in RAI 220-8269, Question 15.02.01-3, are addressed and the RAI is resolved and closed.

The input parameters and initial conditions used to analyze the NSSS response are described in DCD Tier 2 Table 15.0-3, Initial Conditions. In DCD Tier 2 Section 15.2.3.4.2 the applicant described how it selected the principal process variables in order to obtain the most limiting initial conditions that would produce the most adverse consequences following an LOCV.

DCD Tier 2, Table 15.2.3-2, Initial Conditions for an LOCV, shows the initial conditions and assumptions used for the limiting event with respect to RCS peak pressure.

The staff evaluated the applicants description of the methods used to obtain the most limiting initial conditions and determined that these conditions ensure that the event analysis results are conservative and therefore, the staff finds these assumptions acceptable.

The LOCV event (assuming initial conditions to minimize the DNBR) results in a minimum DNBR of 1.43 (as shown in DCD Tier 2 Figure 15.2.3-13, Loss of Condenser Vacuum:

Minimum DNBR vs. Time). The minimum DNBR remains above the minimum limit of 1.29.

The staff finds that these assumptions and the results are acceptable.

The DCD, Tier 2, Section 15.0.0.2, Plant Characteristics and Initial Conditions Assumed in the Accident Analysis, discusses the initial conditions and assumptions used in the AOOs event evaluations. One of these assumptions is that the most reactive CEA stays withdrawn. This assumption is in accordance with the guidance in SRP Section 15.2.1-15.2.5, and therefore the staff finds it acceptable.

The staff identified that the applicant did not discuss the radiological consequences of this event. DCD, Tier 2, Section 15.2.3.5, Radiological Consequences, states that the radiological consequences of this event are bounded by the feedwater system piping failure event described in DCD Tier 2, Section 15.2.8. However, the staff determined that the applicant did not provide a justification that demonstrates that the results of the feedwater system piping failure event bound the radiological consequences of a LOCV event. Accordingly, on September 22, 2015,15-101

the staff issued RAI 220-8269, Question 15.02.01-1, requesting the applicant provide a justification that demonstrates that the results of the feedwater system piping failure event bound the radiological consequences of a LOCV event. On February 19, 2016, the applicant provided a response to RAI 220-8269 Question 15.02.01-1 (ML16050A015). As discussed above, the applicants response demonstrated the radiological consequences of a LOCV event are bounded by the calculated releases from a FLB and considers RAI 220-8269, Question 15.02.01-1, resolved and closed. The staffs evaluation of the FLB event is discussed in Section 15.2.8 of this SER.

The applicants analysis results in a RCS maximum pressure of 193.0 kg/cm2A (2,745 psia) and a maximum SG pressure of 91.0 kg/cm2A (1,294 psia). The staff finds the evaluation results acceptable because the maximum RCS pressure remains below the design limit of 193.34 kg/cm2A (2,750 psia), and the maximum SG pressure remains below the design limit of 92.83 kg/cm2A (1,320 psia).

The main steam isolation valve closure event is initiated by the closure of all MSIVs due to a spurious closure signal. The closure of all MSIVs results in an increase of primary and secondary temperatures and pressure. A reactor trip occurs on high pressurizer pressure and the pressurizer POSRVs and the MSSVs open to relieve the pressure. The operator can initiate a system cooldown using the SG ADVs after the reactor trip occurs.

The LOCV event also terminates all the steam flow, however, the closure time for the turbine stop valves is shorter (faster closure time) than the closure time of the MSIVs. Therefore, the staff agrees with the applicants assessment that the LOCV event bounds the consequences of the MSIV closure event.

The DCD states that the steam pressure regulator failure event is not applicable to the APR1400 design. The staff noted that the applicant did not provide a justification that describes why this scenario is not applicable for the APR1400 design. Accordingly, on September 22, 2015, the staff issued RAI 220-8269, Question 15.02.01-4, requesting the applicant include a justification in the DCD that discusses why the steam pressure regulator failure is not an applicable scenario to the APR1400 design.

In its response dated December 2, 2015 (ML15336B009), the applicant indicated that this event is not applicable because the APR1400 design does not include a steam pressure regulator valve. The staff evaluated the applicants response and the system descriptions and diagrams provided in the DCD and confirmed that this accident scenario is not applicable to the APR1400 design. Therefore, the staff finds the concerns identified in RAI 220-8269, Question 15.02.01-4, are addressed and the RAI is resolved. The staff evaluated the applicants proposed DCD changes, which clearly indicate that the APR1400 design does not include a steam pressure regulator or a turbine power regulator, and found them to be adequate. Based on its review of the DCD, the staff has confirmed incorporation of the changes described above; therefore, the staff considers RAI 220-8269, Question 15.02.01-4, resolved and closed.15-102

There are no COL information items associated with Section 15.2.1 of the APR1400 DCD.

Based on the evaluation discussed above, the staff concludes that the predicted plant response for the most limiting event satisfies the specific criteria for fuel damage and system pressure in that the analysis demonstrates that the maximum RCS pressure of 193.0 kg/cm2A (2,745 psia) remains below 110 percent of the RCS design pressure of 193.34 kg/cm2A (2,750 psia),

therefore satisfying overpressure acceptance criteria for the RCS.

The staff concludes that the analyses show that the opening setpoints and capacity of the MSSVs are adequate to limit peak secondary pressure to 91.0 kg/cm2A (1,294 psia), which is less than the acceptance criterion of 110 percent of the secondary system design pressure of 92.83 kg/cm2A (1,320 psia).

The staff concludes that the analyses assume single failures, operator errors, and performance of non-safety related systems in conformance with RG 1.206.

The staff concludes that the event evaluation considers single failures in accordance with RG 1.53.

The staff concludes that RG 1.105 is satisfied in that the plant protection systems setpoints assumed in the transients analyses are selected with allowance for measurement inaccuracies, due to harsh environment effects as delineated in RG 1.105.

The staff concludes that DNBR SAFDL is not challenged.

Therefore, the staff finds that:

GDC 10 is met in that the safety analyses show that SAFDLs are not exceeded during normal operations, including AOOs.

GDC 13 is met in that the safety analyses include safety related instrumentation to monitor variables and systems over their anticipated ranges to assure adequate safety.

GDC 15 is met as it relates to the analyses to demonstrate that the pressure boundary is not breached during normal operations, including AOOs.

GDC 17 is met as it relates to onsite and offsite electric power systems, in that the safety analyses show that with and without off site power SAFDLs and RCPB design conditions are not exceeded.

GDC 26 is met in that the analysis shows that reactivity control is accomplished with timely rod insertion and margin for malfunctions (e.g., stuck rods).

Review of this section of the DCD is documented under Section 15.2.1.4.2 of this SER.15-103

Review of this section of the DCD is documented under Section 15.2.1.4.3 of this SER.

Review of this section of the DCD is documented under Section 15.2.1.4.4 of this SER.

Review of this section of the DCD is documented under Section 15.2.1.4.5 of this SER.

A loss of nonemergency ac power to the station auxiliaries (LOAC) is an Anticipated Operational Occurrence (AOO) initiated by a complete loss of either the external (offsite) grid or the onsite ac distribution system.

DCD Tier 1: There are no DCD Tier 1 entries for this area of review.

DCD Tier 2: The applicant provided a DCD Tier 2 system description in Section 15.2.6, summarized here as follows: In the LOAC transient, all the reactor coolant pump motors are de-energized simultaneously by the initiating event, resulting in a flow coast-down as well as a decrease in heat removal by the secondary system. A reactor trip is caused due to low shaft speed. The standby diesel generators automatically start on loss of normal ac power. The DCD states that the consequences of the LOAC event are bounded by the loss of flow (LOF),

and loss of condenser vacuum (LOCV) events described in DCD Tier 2, Section 15.3.1 and 15.2.3, respectively.

ITAAC: There are no ITAAC items for this area of review.

TS: There are no TS for this area of review.

The relevant requirements of NRC regulations for this area of review, and the associated acceptance criteria, are given in NUREG-0800, Section 15.2.6, Loss of Nonemergency AC Power to the Station Auxiliaries, and are summarized below. Review interfaces with other SRP sections also can be found in NUREG-0800, Section 15.2.6.

GDC 10, as it relates to the reactor coolant system (RCS) design with appropriate margin so specified acceptable fuel design limits (SAFDLs) are not exceeded during normal operations, including AOOs.

GDC 13, as it relates to the availability of instrumentation to monitor variables and systems over their anticipated ranges to assure adequate safety, and of appropriate controls to maintain these variables and systems within prescribed operating ranges.15-104

GDC 15, as it relates to design of the RCS and its auxiliaries with appropriate margin so the pressure boundary is not breached during normal operations, including AOOs.

GDC 26, as it relates to the control of reactivity changes so SAFDLs are not exceeded during AOOs. This control is accomplished by provisions for appropriate margin for malfunctions (e.g., stuck rods).

Acceptance criteria adequate to meet the above requirements include:

1. Pressure in the reactor coolant and main steam systems is maintained below 110 percent of the design values.

2. Fuel cladding integrity is maintained by keeping the minimum departure from nucleate boiling (DNBR) above the 95/95 DNBR limit for PWRs based on acceptable correlations.

3. Plant protection systems setpoints assumed in the transients analyses are selected with adequate allowance for measurement inaccuracies as described in RG 1.105.

4. The most limiting plant systems single failure in the analysis is identified and assumed, as defined in the Definitions and Explanations of 10 CFR Part 50, Appendix A and discussed in RG 1.53.

5. Incident of moderate frequency does not generate a more serious plant condition without other faults occurring independently.

Loss of nonemergency power to the station auxiliaries is initiated by either a complete loss of external grid or loss of the ac distribution system and will cause loss of power to all the reactor coolant pumps (RCPs) causing a reactor trip on low RCP shaft speed resulting in low flow. The applicant stated that diesel generators are started and provide electric power to engineered safety feature systems. The applicant also stated that the decay heat will be removed by opening the MSSVs, with SG inventory maintained by the auxiliary feedwater system.

The analysis of the LOAC uses the analytical methodology described in DCD Tier 2, Section 15.0.2, Review of Transient and Accident Analysis Methods, and Technical Report APR1400-Z-A-NR-14006, Non-LOCA Safety Analysis Methodology. The applicant considered the LOAC event the initiating event and is bounded by the LOF transient for minimum DNBR.

With respect to RCS and main steam pressurization, the LOAC event is bounded by the LOCV transient. In these analyses, the applicant simulated the loss of reactor coolant flow transient using CESEC-III and calculated the DNBR using HERMITE and CETOP computer codes to simulate the APR1400 reactor system-level response.

DCD Tier 2, Section, 15.2.6.3.3 states that the loss of forced reactor coolant flow results in an earlier reactor trip for the LOAC event compared to the reactor trip for the LOCV event.

Therefore, the applicant concluded that the earlier trip promotes a less severe heat imbalance and results in a lower RCS peak pressure for the LOAC event compared to the LOCV event. In addition, because the LOAC is the initiating event for the LOF event, the applicant determined 15-105

that the fuel performance results of the LOF are directly applicable to the LOAC, and the RCS pressurization is no more limiting for the LOAC event. DCD Tier 2, Table 15.2.3-1 and Table 15.3.1-1 show the sequence of events for the LOCV and LOF events, respectively.

The applicant provided DCD Tier 2, Table 15.0-4, Single Failures, for analysis and modelling AOOs. This table includes single failures such as loss of an auxiliary feedpump, and failure of a main steam isolation valve or atmospheric dump valve. The applicant stated that none of the single failures listed in Table 15.0-4 when combined with the LOCV or LOF events results in a more severe DNBR, or primary and secondary system pressures.

The staff reviewed the information provided by the applicant as discussed above and compared it to the acceptance criteria. The staff verified that the sequence of events for the LOF event in DCD Tier 2, Table 15.3.1-1 identifies the LOAC as the initiating event, and confirmed that the reactor trip signal for the LOAC initiating event occurs before the reactor trip signal for the LOCV sequence of events in DCD Tier 2, Table 15.2.3-1. Therefore, the staff concludes that the LOAC event is bounded by the LOF event and LOCV event. The staffs evaluation of the LOF and LOCV events are in Sections 15.3.1 and 15.2.3, respectively, of this SER.

There are no COL information items associated with Section 15.2.6 in the APR1400 DCD.

The staff concludes that the bounding analyses show that SAFDLs are not violated and that primary and secondary pressures are maintained at less than 110 percent of design limits assuming the most limiting single failure. The staff concludes that the transient is bounded by the LOF, which results in the minimum DNBR and the LOCV, which results in greater primary and secondary system pressures.

The staff concludes that the bounding analyses consider single failures in conformance with RG 1.53.

The staff finds that conformance with RG 1.105 has been satisfied in that the bounding analyses consider protection systems setpoints with allowance for measurement inaccuracies.

Therefore, with respect to transients expected to occur with moderate frequency and result in a loss of nonemergency ac power to station auxiliaries the staff finds:

GDC 10 is met in that the safety analyses show that SAFDLs are not exceeded during normal operations, including AOOs.

GDC 13 is met in that the safety analyses include safety-related instrumentation to monitor variables and systems over their anticipated ranges to assure adequate safety.

GDC 15 is met as it relates to the analyses to demonstrate that the pressure boundary is not breached during normal operations, including AOOs.

GDC 26 is met in that the analysis shows that reactivity control is accomplished with timely rod insertion and margin for malfunctions (e.g., stuck rods).15-106

A loss of normal feedwater flow event (LFW) is an AOO that could result from pump failures, valve malfunctions, or a LOOP. The LFW results in a reduction of the secondary systems ability to remove heat generated by the reactor core. As a result, the reactor coolant temperature and pressure rise eventually requiring a reactor trip to prevent the SAFDLs from being violated during this AOO.

DCD Tier 1: There were no DCD Tier 1 entries for this area of review.

DCD Tier 2: The applicant provided a DCD Tier 2 system description in DCD Tier 2, Section 15.2.7 that is summarized as follows:

The applicant stated that the LFW occurs when two or more of the three operating main feedwater pumps are lost or by closure of the feedwater control valves caused by a spurious signal. The loss of main feedwater causes the SG level to decrease as the existing water inventory is boiled off. With the loss of heat sink, the applicant noted that the RCS pressure and temperature would rise until a reactor trip on low SG level or high pressurizer pressure is reached. After the reactor trip, decay heat removal is accomplished by auxiliary feedwater and the opening of MSSVs until a new steady-state condition is reached. Cooldown to shutdown cooling conditions is reached by operator control of the SBCS and condenser.

ITAAC: The ITAAC associated with DCD Tier 2, Section 15.2.7 are in DCD Tier 1, Sections 2.4.1 and 2.7.1.

TS: The TS associated with DCD Tier 2, Section 15.2.7 are in DCD Tier 2, Chapter 16, Technical Specifications, 3.4.10 Pressurizer Pilot Operated Safety Relief Valves, 3.7.1 Main Steam Safety Valves (MSSV), 3.7.2, Main Steam Isolation Valves (MSIVs), 3.7.5, Auxiliary Feedwater System (AFWS), and 3.4.1, RCS Pressure, Temperature and Flow Limits.

The relevant requirements of NRC regulations for this area of review, and the associated acceptance criteria, are in NUREG-0800, SRP, Sections 15.2.7, Loss of Normal Feedwater Flow, and are summarized below. Review interfaces with other SRP sections also can be found in NUREG-0800, Section 15.2.7.

GDC10, as it relates to the RCS design with appropriate margin so SAFDLs are not exceeded during normal operations, including AOOs.

GDC 13, as to the availability of instrumentation to monitor variables and systems over their anticipated ranges to assure adequate safety, and of appropriate controls to maintain these variables and systems within prescribed operating ranges.

GDC 15, as it relates to design of the RCS and its auxiliaries with appropriate margin so the pressure boundary is not breached during normal operations, including AOOs.15-107

GDC 17, as it relates to onsite and offsite electric power systems, to ensure that safety-related SSCs function during normal operation, including AOOs. The safety function for each power system (assuming the other system is not functioning) is to provide sufficient capacity and capability so SAFDLs and RCPB design conditions are not exceeded during AOOs.

GDC 26, as it relates to the control of reactivity changes so SAFDLs are not exceeded during AOOs. This control is accomplished by provisions for appropriate margin for malfunctions (e.g., stuck rods).

Title 10 CFR 50.34(f)(1)(ii)1 and 10 CFR 50.34(f)(2)(xii), as they relate to the performance requirements of the auxiliary feedwater system for the loss of normal feedwater flow event.

The applicant stated that the LFW event is bounded by the LOCV event discussed in DCD Tier 2, Section 15.2.3, because that event results in immediate termination of steam flow, due to a turbine trip without assuming the control grade reactor trip, and a complete loss of feedwater flow. The staff agrees that the LOCV bounds the LFW event as the concurrent termination of steam flow and the complete loss of feedwater flow results in a greater degradation of primary-to-secondary heat transfer causing a larger RCS and SG pressure increase in the LOCV event.

The maximum RCS and SG pressures for the LOCV were less than 110 percent of their respective design pressures. For heat up events such as a LFW the core power level remains relatively constant due to negative or zero Doppler and moderator reactivity coefficients. RCS pressure and temperature increase but largely offset each other hence the change in DNBR is relatively minor for heat up events. As shown in DCD Tier 2 Figure 15.2.3-13, Loss of Condenser Vacuum: Minimum DNBR vs. Time, the DNBR decreases to 1.43 but remains well above the limit of 1.29. A similar or less benign decrease in DNBR would be expected for the loss of normal feedwater. Therefore, the staff has reasonable assurance that the LFW minimum DNBR will also remain above the limit.

Loss of normal feedwater flow events are mitigated, assuming the setpoints are met, by the POSRVs on the primary side, the MSSVs on the secondary side and a reactor trip. These mitigation systems are the same as the LOCV accident and the staff did not identify any other single failures for the LFW event which would cause event consequences more severe than the LOCV.

There are no COL information items associated with Section 15.2.7 of the APR1400 DCD.

The staff concludes that the plant design is acceptable with regard to transients resulting from LFW and that the predicted response meets the requirements of GDC 10, 13, 15, 17, and 26.

This conclusion is based on the following:

The applicant has met the requirements of GDC 10, 17, and 26 with respect to demonstrating that the resultant fuel integrity is maintained, since the SAFDLs were not 15-108

exceeded for this event, including that the minimum DNBR is greater than the 95/95 limit.

The applicant meets GDC 13 requirements by demonstrating that all credited instrumentation was available, and that actuations of automatic protection systems occurred at values of monitored parameters that were within the instruments prescribed operating ranges. No manual protection systems are credited.

The applicant has met the requirements of GDC 15 with respect to demonstrating that the RCPB limits have not been exceeded by these events. This requirement has been met since the maximum pressure within the reactor coolant and main steam systems did not exceed 110 percent of the design pressures.

The applicant has met the requirements of GDC 17 and 26 with respect to the capability of the reactivity control system to provide adequate control of reactivity during this event while including appropriate margins for stuck rods since the SAFDLs were not exceeded.

A feedwater system pipe break causes a loss of inventory from the saturated liquid mass in the SG, resulting in RCS heatup and pressurization. Minor or small feedwater system pipe breaks are classified as AOOs. Major or large feedwater pipe breaks, which are defined as those large enough to prevent the addition of sufficient feedwater to maintain the steam generator inventory, are classified as PAs.

DCD Tier 1: There were no DCD Tier 1 entries for this area of review.

DCD Tier 2: The applicant provided a DCD Tier 2 system description in DCD Tier 2, Section 15.2.8 that is summarized as follows:

The consequences of a feedline break are dependent on the break size and location. For small breaks, the excess capability of the feedwater system is sufficient to maintain SG level. For large breaks, the reduced flow is insufficient to maintain SG level. Large breaks upstream of the check valve are bounded by the LFW event as discussed in DCD Tier 2 Section 15.2.7. For breaks that occur downstream of the check valve, the RCS may either heat up or cool down, depending on the break size, location and plant operating conditions. The potential cooldown caused by a break downstream of the check valve is bounded by the cooldown caused by a main steamline break as discussed in DCD Tier 2 Section 15.1.5; hence this analysis focuses on the RCS heatup caused by the loss of steam generator inventory.

The feedline break is classified as a PA, and in conformance with GDC 17 is evaluated with and without a loss of offsite power (LOOP).

ITAAC: The ITAAC associated with DCD Tier 2, Section 15.2.8 are in DCD Tier 1, Sections 2.4.1 and 2.7.1.15-109

TS: The TS associated with DCD Tier 2, Section 15.2.8 are in DCD Tier 2, Chapter 16, Technical Specifications, 3.4.10, Pressurizer Pilot Operated Safety Relief Valves, 3.7.1, Main Steam Safety Valves (MSSV), 3.7.2, Main Steam Isolation Valves (MSIVs), 3.7.5, Auxiliary Feedwater System (AFWS), and 3.4.1, RCS Pressure, Temperature and Flow Limits.

The relevant requirements of NRC regulations for this area of review, and the associated acceptance criteria, are in NUREG-0800, Section 15.2.8, Feedwater System Pipe Break Inside and Outside Containment (PWR), and are summarized below. Review interfaces with other SRP sections also can be found in NUREG-0800, Section 15.2.8.

GDC 13, as it relates to the availability of instrumentation to monitor variables and systems over their anticipated ranges to assure adequate safety, and of appropriate controls to maintain these variables and systems within prescribed operating ranges.

GDC 17, as it relates to onsite and offsite electric power systems, to ensure that safety-related SSCs function during normal operation, including AOOs. The safety function for each power system (assuming the other system is not functioning) is to provide sufficient capacity and capability so Specified Acceptable Fuel Design Limits and reactor coolant pressure boundary design conditions are not exceeded during AOOs.

GDC 27 and GDC 28, as they relate to the RCS design with appropriate margin so acceptable fuel design limits are not exceeded and core cooling capability is maintained.

GDC 31, as it relates to RCS design with sufficient margin so the boundary is nonbrittle and the probability of fracture propagation is minimized.

GDC 35, as it relates to design of the RCS and its auxiliaries for abundant emergency core cooling.

10 CFR Part 100, as it relates to calculated doses at the site boundary.

Requirements for maintenance of adequate decay heat removal by the AFWS are in 10 CFR 50.34(f)(1)(ii), (TMI issue II E 1.1) and 10 CFR 50.34(f)(2)(xii),

(TMI issue II E 1.2.)

Requirements for reactor coolant pump (RCP) operation are in 10 CFR 50.34(f)(1)(iii),

(TMI issue 2 K 2).

DCD Tier 2 Section 15.2.8 evaluates a rupture in a feedwater line pipe between the feedwater line check valve and the SG. The break is large enough to lose all feedwater to both steam generators; and the steam generator closest to the break, referred to as the affected steam generator, experiences reverse flow out the break (i.e., blowdown) leading to a rapid loss of inventory in the affected generator. The applicant stated that the combination of feedwater loss and blowdown from the affected generator results in a loss of heat sink which heats up and pressurizes the RCS. Plant protection features to prevent overpressurization of the RCS and 15-110

main steam system include: pressurizer POSVRs, MSSVs, main feedwater check values, MSIVs, the RPS, and actuation of the AFWS to establish long term heat removal capability.

The applicant performed the feedwater line break analysis using the approved version of CESEC-III, as described in DCD Tier 2 ,Subsection 15.0.2, Review of Transient and Accident Analysis Methods, with the break critical flow calculated by the Henry-Fauske/Moody correlation assuming that only saturated liquid is discharged out the break until no liquid remains in the affected generator. The staff agrees that discharging saturated liquid is conservative as the high mass flow decreases the liquid mass available for cooling while minimizing the energy lost out the break. Due to the CESEC-III simplified SG model, the effective heat transfer area in the affected SG is reduced as SG mass decreases from the design value. The applicant stated that it conservatively applied a SG water mass difference of zero, which implies the affected SG heat transfer capability is lost almost immediately. The staff noted in its review of DCD Tier 2 Table 15.2.8-2, Sequence for Events for the Limiting Case Feedwater Line Break, that loss of all heat transfer to the affected generator occurs at 27.50 seconds following the break, however, a mass change of zero implies the affected generator heat area would also become zero almost instantaneously following the event. On October 27, 2015, the staff issued RAI 273-8365, Question 15.02.08-1, to address this issue.

The applicant responded to RAI 273-8365, Question 15.02.08-1 (ML15356A194) with a figure showing the affected steam generators mass and heat transfer rate as a function of time. The figure shows that the heat transfer rate decreases only slightly from its initial value over the 27 seconds that it takes the SG to empty, but the heat transfer area is ramped from its initial nominal value to zero when the mass in the steam generator is no longer changing, which is when the SG is empty. The staff notes that the figure showing heat transfer rate versus SG inventory is similar to that observed in the Semiscale tests documented in NUREG/CR-4945, Section 4.3.3.1, which indicates that SG heat transfer capability remains relatively unchanged until the liquid inventory is nearly depleted (i.e., a large mass loss). This nearly constant heat transfer rate up until the SG empties occurs because, even though heat transfer area is decreasing, the delta-T across the tubes is increasing as the SG pressure decreases. The staff finds this method of decreasing affected SG heat transfer rate based on decreasing effective heat transfer area acceptable based on the Semiscale test data results. Therefore, the staff considers RAI 273-8365, Question 15.02.08-1, resolved and closed.

The applicant calculated the DNBR using the approved CETOP computer code using the KCE-1 CHF correlation. Because the applicant used an approved computer code, as reviewed in Section 15.0.2 of this SER, the staff concludes that the calculation of the DNBR is acceptable.

DCD Tier 2, Section 15.2.8.4.1, Barrier Performance, evaluates the peak RCS and SG pressures using the CESEC-III model described above. The range of initial conditions considered is given in DCD Tier 2, Table 15.0-3, Initial Conditions, and the initial conditions used for the spectrum of break sizes analyzed with LOOP are given in DCD Tier 2, Table 15.2.8-1, Initial Conditions for Limiting Case Feedwater Line Break. The staff reviewed the initial conditions given in DCD Tier 2 Table 15.2.8-1 against the ranges provided to DCD Tier 2 Table 15.0-3 in order to assess if the applicant selected conservative initial conditions.

Parameters of importance which maximize RCS pressure include quality of the break flow,15-111

discussed earlier, initial reactor power, initial SG level, affected SG level at the time of reactor trip, initial pressurizer pressure, and the reactivity coefficients. The applicant used an initial reactor power of 102 percent of rate thermal power which the staff agrees is conservative as it maximizes the energy needed to be removed by the secondary side thereby increasing RCS temperature and hence pressure. The initial SG level affects the heat removal capability of the unaffected generator as well as the timing at which the affected SG loses heat removal capability. However, the applicant did not provide basis for the initial steam generator inventory value. Therefore, on October 27, 2015, the staff issued RAI 273-8365, Question 15.02.08-2, to address this issue. The applicant responded to RAI 273-8375, Question 15.02.08-2 (ML15334A447) with a sensitivity analysis showing the peak RCS pressure calculated assuming a low steam generator level, a nominal level, and a high level. The case with the nominal level (97,046 kg mass) had the highest RCP pressure. The applicants response is acceptable; it provides the basis for the initial SG inventory value. Therefore, the staff considers RAI 273-8365, Question 15.02.08-2, resolved and closed.

The applicant assumed the reactor trip occurs when the affected SG has zero liquid mass and hence minimizes secondary side inventory at the time of reactor trip. The staff agrees that delaying reactor trip below the wide range, low SG trip setpoint is conservative as it will increase RCS heatup and hence peak pressure. The applicant further increased the RCS peak pressure by setting the initial pressurizer pressure within the range specified in DCD Tier 2, Table 15.0-3, to achieve a high pressurizer pressure trip coincident with the loss of liquid in the affected SG.

The staff agrees that setting the high pressurizer pressure trip coincident with loss of affected SG inventory maximizes RCS pressure as a higher initial value would lead to an earlier reactor trip with corresponding higher SG liquid levels. The applicant assumed the least negative Doppler coefficient and zero MTC, which the staff agrees is conservative as these would minimize the power decrease associated with the rise in RCS temperature.

The applicant evaluated the single failures identified in DCD Tier 2, Table 15.0-4 for their effects on the feedwater line break analysis. The applicant stated that no single failures identified in DCD Tier 2 Table 15.0-4 were found to negatively affect the consequences associated with the feedwater line break event.

The applicant stated that the only methods to mitigate the RCS pressurization are the pressurizer POSVRs primary to secondary heat transfer, and the MSSVs. The applicant concluded, and the staff agrees, that there are no credible single failures of the POSVR and MSSVs that would degrade their performance. Primary to secondary heat transfer is a function of RCS flow and unaffected SG flow to the affected SG. The applicant stated that no single failures listed in DCD Tier 2, Table 15.0-4, would affect primary to secondary heat transfer due to coastdown of RCS flow caused by the LOOP or reduce the steam flow to the affected generator. The staff agrees that the single failures identified in DCD Tier 2, Table 15.0-4, will not affect primary to secondary heat transfer as long as saturation conditions do not exist in the hot leg; however, the applicant did not evaluate saturation conditions in the hot leg. Therefore, on October 27, 2015, the staff issued RAI 273-8365, Question 15.02.08-3, to address this issue.

The applicant responded to RAI 273-8365, Question 15.02.08-3 (ML15334A447) with a table showing the hot leg temperature and the saturation temperature at various times during the transient. The table shows the hot leg temperature is always more than 14 C (25 F) below the saturation temperature. The staff concluded that the response is acceptable because it demonstrates that saturation conditions never occur in the hot leg during the transient and 15-112

primary to secondary heat transfer remains. Therefore, RAI 273-8365, Question 15.02.08-3, is resolved and closed.

Long term RCS pressure is maintained by auxiliary feedwater supplied to the unaffected steam generator. The applicant assumed a single failure of one of the two auxiliary feedwater pumps feeding the affected generator, which the staff agrees is an appropriate single failure.

In DCD Tier 2, Section 15.2.8.3.2, the applicant considered fuel integrity by evaluating the DNBR using the lowest peak RCS pressure from the spectrum of break sizes analyzed in DCD Tier 2, Figure 15.2.8-1, Main Feedwater Line Break with Concurrent LOOP: Maximum RCS Pressure vs. Break Area. The initial conditions are the same as those given in DCD Tier 2, Table 15.2.8-1, for the LOOP RCS peak pressure evaluation, except the initial pressurizer pressure is set to 163.46 kg/cm2 (2,325 psia) which is above the minimum pressure range given in DCD Tier 2, Table 15.0-3. Since a lower initial pressure could yield a lower peak pressure, and hence a lower DNBR, on October 27, 2015, the staff issued RAI 273-8365, Question 15.02.08-4 to address this issue. The applicant responded to RAI 273-8365, Question 15.02.08-4 (ML15334A447) with a table showing MDNBR versus initial pressurizer pressure showing that the higher pressurizer pressure resulted in a lower MDNBR. The higher initial pressure resulted in an earlier opening of the pressurizer POSRVs which lead to a rapid pressure decrease. The staff finds the applicants response to be acceptable justification of the initial pressurizer pressure condition. Therefore, the staff considers RAI 273-8365, Question 15.02.08-4, resolved and closed.

Examining DCD Tier 2, Figure 15.2.8-1, the staff noted that no peak pressure was plotted for a 0.0093 m2 (0.10 ft2) break and hence was not able to determine based on the plot trend if the lowest peak RCS pressure case was used to evaluate DNBR. Therefore, October 27, 2015, the staff issued RAI 273-8365, Question 15.02.08-5, to address this issue. The applicant responded to RAI 273-8365, Question 15.02.08-5 (ML15356A194) with a table showing the peak RCS pressure for the 0.0093 m2 break was lower than the 0.0185 m2 break; therefore, using the 0.0093 m2 break size for the DNBR calculation is acceptable. The applicant committed to revising DCD Tier 2, Figure 15.2.8-1 (page 15.2-51) to include the pressure for the 0.0093 m2 break. Based on its review of the DCD, the staff confirmed incorporation of the update discussed above; therefore, RAI 273-8365, Question 15.02.08-5, is resolved and closed.

The applicant performed a spectrum of feedwater line break sizes up to and including a double-ended guillotine break of the largest feedwater line in conjunction with a LOOP in conformance with GDC 17. Based on the RCS pressure response provided in DCD Tier 2, Figure 15.2.8-1, the staff agrees that the break size sampling provides reasonable assurance that the applicant evaluated the limiting break size for RCS overpressurization. The resulting peak RCS pressure was slightly above 110 percent, but remained below 120 percent of design acceptance criteria for the very low probability event of a complete loss of feedwater flow in conjunction with a LOOP. The SG pressure remained below 110 percent, thereby also meeting the 120 percent of design pressure acceptance criteria of a very low probability event. Based on the results of this analysis, NRC staff finds that the peak RCS and SG pressures remain below the 120 percent design pressure acceptance criterion specified in Section 15.2.8 of the SRP.15-113

The applicant evaluated the peak RCS and SG pressure assuming available offsite power using the limiting break size from the LOOP case. In this case, the applicant credited the wide range, low SG level RPS setpoint. The effect of crediting the low SG level reactor trip, with the corresponding higher affected SG liquid mass and the continued forced circulation of the RCPs, increases heat transfer to the secondary side, lowering peak RCS pressure but increasing the peak SG pressure. On October 27, 2015, the staff issued RAI 273-8365, Question 15.02.08-6, to address this issue. The applicant responded to RAI 273-8365, Question 15.02.08-6 (ML15356A194) by providing a table of maximum SG pressure versus break size. This figure showed that there was little variation of the maximum pressure over the 0.009 to 0.055 m2 range; peak pressure ranged from 91 to 91.03 kg/cm2 A (1319.84 to 1320.28 psia), which is below the acceptance criterion of 92.8 kg/cm2 A (1345.95 psia). The staff found that the response is acceptable, as it demonstrates the maximum steam generator pressure stays below 110 percent of the design pressure. Therefore, the staff considers RAI 273-8365, Question 15.02.08-6, resolved and closed.

The staff noted that with offsite power available, the maximum RCS and SG pressure remained below 110 percent of the design pressure thereby meeting the acceptance criteria for a low probability event.

The applicant presented the radiological consequences in DCD Tier 2, Table 15.2.8-4, Radiological Consequences of Feedwater Line Break. The staffs evaluation of the dose calculations and their acceptability is documented in Section 15.0.3 of this SER.

There are no COL information items associated with Section 15.2.8 of the APR1400 DCD.

The staff concludes that the applicants analysis of consequences of postulated feedwater line breaks meets the requirements of GDC 13, 17, 27, 28, 31, and 35 and the applicable TMI Action Plan Items. The radiological consequences are discussed in Section 15.0.3 of this SER. The staffs finding of acceptability is based on the following findings:

The applicant meets GDC 13 requirements by demonstrating that all credited instrumentation was available, and that actuations of automatic protection systems occurred at values of monitored parameters that were within the instruments prescribed operating ranges. No credit is taken for actuation of manual protection systems.

The applicant meets GDC 17 requirements by demonstrating that minimum DNBR remains above the 95/95 limit, and maximum RCS and SG pressure remain below 120 percent of the design pressure for the limiting break sizes with and without offsite power.

The applicant meets GDCs 27 and 28 requirements by demonstrating that the minimum DNBR remains above the 95/95 limit. Hence, no fuel failures are predicted, demonstrating maintained ability to insert the control rod and no loss of core cooling capability.15-114

The applicant meets GDC 31 requirements for demonstrating primary system boundary capability to withstand the PA. The maximum RCS pressure remains below 120 percent of the design pressure for the limiting break size coincident with a LOOP which is considered a very low probability event. Maximum RCS pressure and SG pressure remain below the acceptance criteria of 110 percent of design pressure for the limiting break size with offsite power available which is considered a low probability event.

The applicant meets GDC 35 requirements for demonstrating emergency cooling system adequacy for abundant core cooling and reactivity control (via boron injection).

The analyses of effects of feedwater line break accidents inside and outside containment during various modes of operation with and without offsite power have been reviewed and evaluated by a mathematical model as discussed in Sections 15.0.2.2 of this SER.

The input parameters for this model were reviewed and found suitably conservative.

The applicant meets 10 CFR 50.34(f)(1)(ii) and 10 CFR 50.34(f)(2)(xii) requirements for demonstrating the adequacy of the auxiliary feedwater system design to remove decay heat following feedwater piping failures.

Section 15.6.5 of this SER describes how the applicant meets 10 CFR 50.34(f)(1)(iii) requirements for demonstrating RCP seal capability to withstand the PA.

Decrease in Reactor Coolant System Flow Rate Both AOOs and PAs can result from a decrease in RCS flow. These events are described in the following DCD Tier 2, Section 15.3, Decrease in Reactor Coolant System Flow Rate, subsections:

DCD Tier 2 Section 15.3.1, Loss of Forced Reactor Coolant Flow (AOO).

DCD Tier 2 Section 15.3.2, Flow Controller Malfunctions (AOO).

DCD Tier 2 Section 15.3.3, Reactor Coolant Pump Rotor Seizure (PA).

DCD Tier 2 Section 15.3.4, Reactor Coolant Pump Shaft Break (PA).

This section documents the staffs review of DCD Tier 2, Sections 15.3.1 and 15.3.2.

A partial loss of forced reactor coolant flow is an AOO that may be caused by a mechanical or electrical failure in an RCS pump motor or its power supply. A complete loss of forced reactor coolant flow is an AOO resulting in the simultaneous fault of the RCPs that may be caused by an electrical power system fault. In either event, the resulting decrease in reactor coolant flow, while the reactor is at power, degrades the core heat transfer and reduces the DNB margin.

These events have similar system behavior, are addressed in the same SRP section, and have the same acceptance criteria. Therefore, they are discussed together.15-115

DCD Tier 1: There are no DCD Tier 1 entries for this area of review.

DCD Tier 2: The applicant provided a DCD Tier 2 system description in Section 15.3.1, summarized here, in part, as follows:

In DCD Tier 2 Section 15.3.1, the applicant analyzed the complete loss of coolant flow event.

Loss of offsite power is identified as the only credible failure that would result in a simultaneous loss of power. The applicant identified the complete loss of forced reactor coolant flow as more limiting than any partial loss in terms of minimum DNBR.

The sequence of events and systems operation is presented in Section 15.3.1.2 and Table 15.3.1-1 of the DCD. POSRVs and MSSVs are identified as plant systems used in the accident analysis and the timing of their use is identified in the sequence of events in Table 15.3.1-1.

The applicant identified four factors that cause a decrease in local DNBR:

1. Increasing coolant temperature.

2. Decreasing coolant pressure.

3. Increasing local heat flux.

4. Decreasing coolant flow.

The applicant used the above causes along with the single failures listed in DCD Tier 2, Table 15.0-4 to evaluate the effect of any single failure mechanisms on the analysis. The applicant concluded that none of the single failures would have any effect on the transient in the time necessary to impact the minimum DNBR evaluation. The applicant further stated that none of the single failures from DCD Tier 2, Table 15.0-4 has any effect on the peak primary system pressure, as the loss of offsite power makes unavailable any systems whose failure could affect the calculated peak pressure.

Core and System Performance In DCD Tier 2, Section 15.3.1.3, the applicant provides the core and system performance analysis for the loss of forced flow event. The evaluation is based on the use of the CESEC-III computer program for the NSSS response, and the HERMITE and CETOP computer programs for the minimum DNBR calculation.

The input and initial parameters used in the core and system performance analysis are provided in DCD Tier 2, Table 15.3.1-2. The principal process variables that determine thermal margin to DNB in the core are monitored by the core operating limit supervisory system (COLSS).

COLSS is addressed in DCD Tier 2, Section 7.7.1.4 and the staffs evaluation is in the corresponding SER section. The applicant used parametric studies to determine the most adverse combinations of initial conditions. The analysis assumed the least negative Doppler coefficient and MTC.15-116

The results of the core and system performance analysis are provided in DCD Tier 2, Section 15.3.1.3.3, and Figures 15.3.1-1 through 15.3.1-8. The applicant stated that since there is no power excursion during the transient, the complete loss of forced reactor coolant event does not challenge the LHGR limit and consequently, the fuel temperature remains below the fuel melting temperature. The minimum DNBR is shown to be greater than the DNBR SAFDL.

Barrier Performance In DCD Tier 2, Section 15.3.1.4, the applicant provides the barrier performance analysis for the loss of forced flow event. The applicant based the analysis on the use of the NSSS response code, CESEC-III.

The ranges of initial conditions considered are given in DCD Tier 2, Table 15.0-3. The applicant modified the input parameters and initial conditions to maximize the primary and secondary system pressure. DCD Tier 2, Section 15.3.1.4.2 provides the initial core inlet temperature and initial steam generator pressure and all other initial condition parameter values are listed in DCD Tier 2, Table 15.3.1-2.

The results of the barrier performance analysis are in DCD Tier 2, Section 15.3.1.4.3, and Figures 15.3.1-9 through 15.3.1-12. The applicant states that the maximum RCS pressure and maximum secondary system pressure limits are not violated.

Radiological Consequences The applicant stated that the loss of forced reactor flow event is bounded by the reactor coolant pump rotor seizure event described in Section 15.3.3 of this SER for the radiological consequences.

ITAAC: There are no ITAAC items for this area of review.

TS: The TS associated with DCD Tier 2, Section 15.3.1, are given in DCD Tier 2, Chapter 16; Section 3.4.1; and Sections 3.4.4, RCS Loops - MODES 1 and 2, through 3.4.7, RCS Loops

- MODE 5, Loops Filled.

The relevant requirements of NRC regulations for this area of review, and the associated acceptance criteria, are in NUREG-0800, Sections 15.3.1-15.3.2, Loss of Forced Reactor Coolant Flow Including Trip of Pump Motor and Flow Controller Malfunctions. Review interfaces with other SRP sections also can be found in NUREG-0800, Sections 15.3.1-15.3.2.

The relevant requirements are summarized below:

GDC 10 and 20, as they relate to the RCS being designed with appropriate margin to ensure that SAFDLs are not exceeded during normal operations including AOOs.

GDC 13, as it relates to the availability of instrumentation to monitor variables and systems over their anticipated ranges to assure adequate safety and of appropriate controls to maintain these variables and systems within prescribed operating ranges.15-117

GDC 15, as it relates to the RCS and its associated auxiliaries being designed with appropriate margin to ensure that the pressure boundary will not be breached during normal operations including AOOs.

GDC 17, as it relates to onsite and offsite electric power systems, to ensure that safety-related SSCs function during normal operation, including AOOs. The safety function for each power system (assuming the other system is not functioning) is to provide sufficient capacity and capability so SAFDLs and RCPB design conditions are not exceeded during AOOs.

GDC 26, as it relates to the reliable control of reactivity changes to ensure that SAFDLs are not exceeded, including AOOs. This is accomplished by ensuring that appropriate margin for malfunctions such as stuck rods are accounted for.

The staff reviewed the loss of forced reactor coolant flow analysis described in DCD Tier 2, Section 15.3.1 against the requirements of the rules and regulations using the review guidance provided in SRP Section 15.3.1. The staff reviewed the identification of causes and frequency classification, methodology, and input assumptions.

In DCD Tier 2, Section 15.3.1, the applicant identified the complete loss of offsite power as the only credible failure that can result in a simultaneous loss of power to all RCPs. This complete loss of forced reactor coolant flow is stated to produce a minimum DNBR more adverse than any partial loss of forced reactor coolant flow event. DCD Tier 2, Section 15.0.0.1 identifies this event as an AOO. This classification is consistent with the guidance provided in SRP Section 15.3.3, and therefore the staff finds it acceptable.

Loss of Offsite Power The DCD states that both LOOP and offsite power-available conditions are considered for each event. LOOP is not considered the limiting single failure, and the applicant postulated an additional failure in the transient and accident analysis. The worst single failure for the loss of flow events is the failure of one protective system division, which conforms to the guidance in RG 1.206 and NUREG-0800. Only the worst condition is shown in the DCD. The staff finds this acceptable since this is based on NRC guidance.

Core and System Performance DCD Tier 2, Section 15.3.1.3, presents the APR1400 core and system performance analysis in relation to the loss of forced flow event. The analysis model is based on the use of the CESEC-III, HERMITE, and CETOP computer programs. The staff reviewed the use of these codes and determined that they are being used in accordance with their approved topical reports and are therefore acceptable.

DCD Tier 2, Table 15.3.1-2, lists assumptions and initial conditions used for the core and system performance analysis for the loss of forced reactor coolant flow event. The staff reviewed these values against the respective TS values and the non-LOCA safety analysis methodology technical report (APR1400-Z-A-NR-14006-P, Revision 0). During the review, the staff noted that the core mass flow rate listed in DCD Tier 2, Table 15.3.1-2, does not 15-118

correspond to the TS minimum RCS total flow rate. The core mass flow rate affects the minimum DNBR calculation and therefore, the limiting value is necessary for this analysis.

Therefore, on August 7, 2015, the staff issued RAI 139-8084, Question 15.03.01-1, to address this issue (ML15221A002).

In response to RAI 139-8084, Question 15.03.01-1 (ML15244B481) the applicant clarified the methodology used to analyze the loss of flow for APR1400, and stated that the methodology was summarized in technical report APR1400-Z-A-NR-14006. This methodology is based on preserving the required overpower margin to ensure that AOOs do not violate SAFDLs. This margin is monitored during operation by COLSS which sets the power operating limit based on multiple principal process variables. As part of the response, the applicant provided a table of parametric study results used to calculate minimum DNBR and identify the limiting initial conditions. The staff reviewed the information provided and determined that the applicant correctly applies the methodology and reports the conditions associated with the limiting minimum calculated DNBR. Therefore, the staff considers RAI 139-8084, Question 15.03.01-1, resolved and closed.

The results from the core and system performance analysis for the loss of feedwater flow event are presented in DCD Tier 2, Figures 15.3.1-1 through 15.3.1-8. The applicant noted that the results demonstrate that the loss of forced reactor coolant event does not violate the peak linear heat generation limit or the DNBR SAFDL.

The staff concludes that based on the use of approved codes, methods, and the calculation results, the applicant demonstrates compliance with the applicable rules and regulations, as identified in SRP Section 15.3.1, in regards to designing the reactor coolant system with appropriate margin so that SAFDLs are not exceeded.

Barrier Performance The APR1400 barrier performance analysis in relation to the loss of forced flow event is presented in DCD Tier 2 Section 15.3.1.4. The applicant based the analysis model, and the core and system performance analysis, on the use of the CESEC-III computer program. The staff confirmed that CESEC-III was approved for this purpose and is therefore acceptable.

The assumptions and initial conditions used for the barrier performance analysis for the loss of forced reactor coolant flow event are found in DCD Tier 2, Section 15.3.1.4.2 and Table 15.3.1-2. The staff reviewed these values against the respective TS values and the non-LOCA safety analysis methodology technical report (APR1400-Z-A-NR-14006). In its response to RAI 139-8084, Question 15.03.01-1 (ML15244B481), the applicant described the parametric studies used to determine the limiting minimum DNBR calculations and the respective inputs also applicable to the barrier performance analysis. As discussed above, the staff found the response acceptable.

The results from the barrier performance analysis for the loss of feedwater flow event are presented in DCD Tier 2, Figures 15.3.1-9 through 15.3.1-12. The applicant stated that the maximum RCS pressure and maximum secondary system pressure results are less than the limits (i.e., 110 percent of the design values).

Based on the use of approved codes and the calculated results, the staff concludes that the applicant demonstrates compliance with the applicable rules and regulations identified in SRP 15-119

Section 15.3.1 in regards to designing the RCS and its auxiliaries so that the pressure boundary is not breached during normal operations and AOOs.

Radiological Consequences Since no fuel failures are predicted for the loss of flow accidents, the staff agrees that the radiological consequences of the loss of forced reactor flow event is bounded by the RCP rotor seizure event described in Section 15.3.3. The staffs review of that event can be found in Section 15.3.3 of this SER.

There are no COL information items associated with Sections 15.3.1 and 15.3.2 of the APR1400 DCD.

Based on the above technical evaluation, the staff concludes that the applicant demonstrated compliance with the rules and regulations applicable to the loss of forced flow event analysis per the guidance in SRP Section 15.3.1.

This section is not applicable to the APR1400.

This section documents the staffs review of DCD Tier 2 Sections 15.3.3 and 15.3.4.

The RCP rotor seizure (referred to as a locked rotor) event is a postulated accident resulting in an instantaneous seizure of an RCP rotor. The RCP shaft break event is a postulated accident resulting in a rapid reduction in RCS flow. The sudden decrease in core coolant flow while the reactor is at power degrades core heat transfer and can lead to fuel damage. These events have similar system behavior, are addressed in the same SRP section, and have the same acceptance criteria. Therefore, the staff evaluated these sections together.

DCD Tier 1: There are no DCD Tier 1 entries for this area of review.

DCD Tier 2: The applicant provided a DCD Tier 2 system description in Sections 15.3.3 and 15.3.4 summarized here, in part, as follows:

Reactor Coolant Pump Rotor Seizure The applicant classified the RCP shaft seizure and shaft break as limiting-fault events. In accordance with GDC 17, these events are analyzed assuming a LOOP throughout the events and the worst single failure of an active component.15-120

In DCD Tier 2 Sections 15.3.3 and 15.3.4, the applicant analyzed the RCP shaft seizure and shaft break events with a LOOP and single-failure consideration. The DCD states that the RCP shaft-seizure event with a LOOP bounds the RCP shaft-break event with a LOOP since the RCP flow coastdown for the shaft-seizure event with a LOOP is faster, resulting in a lower minimum DNBR and more radiological release than those of the shaft-break event with a LOOP.

The applicant submitted a detailed analysis of the bounding case of the RCP shaft seizure in DCD Tier 2 Section 15.3.3.

A single RCP shaft seizure can be caused by seizure of the upper or lower thrust-journal bearings. A LOOP will cause a simultaneous loss of feedwater flow, condenser inoperability, and coastdown of all reactor coolant pumps. In the analysis, the applicant took no credit for restoring offsite power before initiating shutdown cooling.

For the single RCP shaft-seizure event, the reactor was tripped on low reactor coolant flow, and the resulting minimum DNBR occurred during the first few seconds of the event. The applicant evaluated the single-failure events in DCD Tier 2 Table 15.0.4. The applicant stated that an ADV failing to close 1,800 seconds after initiation of the event is the most limiting single failure.

The stuck-open ADV causes excessive steam to be released to the environment from the SGs.

Thus, this failure in combination with the LOOP maximizes the radiological consequences of the event.

The applicant analyzed the RCP shaft seizure with a LOOP using the CESEC-III code for calculating the system response; the HERMITE code for calculating reactor core neutronic parameters; the TORC code for conducting the core thermal-hydraulic analyses; and the CE-1 correlation for determining the DNBR.

The applicant calculated that less than 7 percent of the fuel pins undergo DNB for this event. All fuel pins that undergo DNB are assumed to fail. The fuel rod failures do not propagate to the surrounding rods. The applicant concluded that the fuel rod failures are sufficiently limited to maintain core-cooling capability.

Reactor Coolant Pump Shaft Break The applicant stated that the sequence of events and system operations for the reactor coolant pump shaft break analysis are similar to that for the reactor coolant rotor seizure event. For both events, the reactor is tripped by the RPS on a low reactor coolant flow condition. The LOOP is assumed to occur due to grid instability. Due to the slower flow coast down curve, the RCP seizure event bounds the reactor coolant pump shaft break event.

ITAAC: There are no ITAAC items for this area of review.

TS: The TS associated with DCD Tier 2, Section 15.3.3 are found in DCD Tier 2, Chapter 16, Section 3.4.1. The staff confirmed that these values were appropriate and reflected in the analysis presented in DCD Tier 2, Section 15.3.3.

The relevant requirements of NRC regulations for this area of review and the associated acceptance criteria, are in NUREG-0800 Sections 15.3.3 -15.3.4, Reactor Coolant Pump Rotor 15-121

Seizure and Reactor Coolant Pump Shaft Break, and are summarized below. Review interfaces with other SRP sections also can be found in NUREG-0800, Sections 15.3.3 -15.3.4.

GDC 17, as it relates to providing onsite and offsite electric power systems to ensure that structures, systems, and components important to safety will function. The safety function for each system (assuming the other system is not functioning) shall be to provide sufficient capacity and capability to ensure that design conditions of the RCPB are not exceeded and the core is cooled in the event of postulated accidents.

GDC 27 and GDC 28, as they relate to the RCS being designed with appropriate margin to ensure that the capability to cool the core is maintained.

GDC 31, as it relates to the RCS being designed with sufficient margin to ensure that the boundary behaves in a non-brittle manner and that the probability of propagating fracture is minimized.

10 CFR Part 100, as it relates to the calculated doses at the site boundary.

Reactor Coolant Pump Rotor Seizure The applicant identified the RCP rotor seizure event as a postulated accident caused by the seizure of either the upper or lower RCP thrust-journal bearings. The staff noted that this classification is consistent with the guidance provided in SRP Section 15.3.3 and is, therefore, acceptable.

In DCD Tier 2 Section 15.3.3.2 and Table 15.3.3-1, the applicant identified the system actions and corresponding times following the RCP rotor seizure event based on the initial conditions.

A separate case is analyzed in DCD Tier 2 Section 15.3.3.3.4 to determine the maximum pressure transient. The staff reviewed the sequence of events provided and determined that they are consistent with the APR1400 plant and safety system design as well as with similar PWR plant designs.

Core and System Performance The APR1400 core and system performance analysis in relation to the RCP rotor seizure event is analyzed in DCD Tier 2 Section 15.3.3.3. The evaluation model is based on the use of CESEC-III for the NSSS response, HERMITE to determine the short-term response of the core during the event, and TORC and CETOP for the DNBR calculations. The staff reviewed the use of these codes and determined that the applicant used these codes in accordance with the approved topical reports and SRP Section 15.3.3. Therefore, the staff concludes that the use of these codes is acceptable for this analysis.

Table 15.3.3-2 of DCD Tier 2 Section 15.3.3.3.2 lists assumptions and initial conditions used for the core and system performance analysis for the loss of RCP rotor seizure event. The staff reviewed these values against the respective TS values and the methodology presented in Non-LOCA Safety Analysis Methodology, technical report (APR1400-Z-A-NR-14006) and Loss of Flow: CE Methods for Loss of Flow Analysis topical report (CENPD-183-A). The 15-122

staffs review found that the applicant used inputs and assumptions for the RCP rotor seizure event analysis consistent with the technical report and the approved methodology topical report.

The results from the core and system performance analysis for the RCP rotor seizure event analysis are presented in Section 15.3.3.3.3 and Figures 15.3.3-1 through 15.3.3-12 of Tier 2 of the DCD. The staff reviewed the results and finds that the core and system responses presented are consistent with expectations based on similar plant designs. The DNB analysis results demonstrate that less than 7 percent of the fuel pins are calculated to undergo DNB and none of these failures are calculated to propagate to the surrounding rods. The staff finds that the limited number of fuel failures would not challenge core coolability and is therefore acceptable in regards to core and system performance.

The staff concludes that based on the use of approved codes and the calculated results, the applicant demonstrated compliance with the rules and regulations identified by SRP Section 15.3.3 in regards to designing the reactor coolant system with appropriate margin so that SAFDLs are not exceeded.

Barrier Performance The APR1400 barrier performance analysis in relation to the RCP rotor seizure event is presented in DCD Tier 2 Section 15.3.3.4. The evaluation model is based on the use of CESEC-III. The staff reviewed the use of this code and determined that it is being used in accordance with its approved topical report and SRP Section 15.3.3. Therefore, the staff finds the use of this code to be acceptable for this analysis.

The assumptions and initial conditions used for the barrier performance analysis for the RCP rotor seizure event are found in DCD Tier 2 Section 15.3.3.4.2 and Table 15.3.3-2. The staff reviewed these values against the respective TS values and the Non-LOCA Safety Analysis Methodology technical report (APR1400-Z-A-NR-14006) and Loss of Flow: CE Methods for Loss of Flow Analysis topical report (CENPD-183-A). The staffs review found that the applicant used conservative inputs and assumptions for the RCP rotor seizure event analysis consistent with the technical report and approved methodology topical report.

The results from the barrier performance analysis for the RCP rotor seizure event are in DCD Tier 2 Section 15.3.3.4.3 and Figures 15.3.3-13 through 15.3.3-16. The calculated RCS and steam system pressure remain below the limits. The staff reviewed system dynamic responses presented in the figures and finds that the responses meet the staffs expectations based on the APR1400 plant design and the results of similar plant designs. The resultant peak RCS and steam system pressure remain below 110 percent of the design RCS and steam system pressure.

Based on the use of approved codes and the calculated results, the staff concludes that the applicant demonstrates compliance with the applicable rules and regulations identified in SRP Section 15.3.3 in regards to designing the reactor coolant system and its auxiliaries so that the pressure boundary is not breached.

Radiological Performance The staffs evaluation of the radiological performance for the RCP rotor seizure and RCP shaft break analysis is documented in SER Section 15.0.3.4.6.15-123

Reactor Coolant Pump Shaft Break The applicant identified the RCP shaft break event as a postulated accident caused by the seizure of either the upper or lower RCP thrust-journal bearings. This classification is consistent with the guidance provided in SRP Section 15.3.4 and the staff therefore finds it acceptable.

In DCD Tier 2, Section 15.3.4.2, the applicant stated that the system operations and corresponding time following the RCP shaft break event is similar to that for the RCP rotor seizure event in Section 15.3.3 of Tier 2 of the DCD. The applicant stated that the RCP shaft break event is less severe than the RCP seizure event. The staff agrees with this conclusion since the RCP shaft break event would allow for the shaft to continue rotating. For this reason, the staff concludes that the RCP shaft break event is bounded by the RCP rotor seizure event.

There are no COL information items associated with Sections 15.3.3 or 15.3.4 of the APR1400 DCD.

Based on the guidance provided in SRP Section 15.3.3 - 15.3.4, the staff determined that the applicant demonstrated compliance with the rules and regulations, as detailed in SRP Sections 15.3.3 - 15.3.4, for the RCP seizure and shaft break events. Per the discussion provided above in Section 15.3.3.4 of this SER, the staff confirmed that the applicant correctly defined and met all applicable limits in relation to core and system performance, barrier performance, and radiological consequences. Therefore, the applicants evaluation of the RCP rotor seizure and shaft break is acceptable.

Reactivity and Power Distribution Anomalies An uncontrolled withdrawal of CEAs is an AOO. This event assumes the withdrawal occurs as a result of a single failure in the control element drive mechanism (CEDM), the control element drive mechanism control system (CEDMCS), or the reactor regulating system (RRS), or as a result of operator error. The event is analyzed with and without a LOOP to ensure that the RPS is sufficient to prevent SAFDLs from being exceeded.

DCD Tier 1: There are no DCD Tier 1 entries for this area of review.

DCD Tier 2: The applicant provided a DCD Tier 2 system description in Section 15.4.1 summarized here, as follows:

An uncontrolled withdrawal of CEAs occurs as a result of a single failure in the CEDM, CEDMCS, RRS, or as a result of operator error. This withdrawal results in a positive 15-124

reactivity insertion causing an increase in reactor power and core heat flux, and subsequently, an increase in the reactor coolant temperature and pressure. This event results in an approach to the SAFDLs, eventually requiring action from the RPS.

ITAAC: There are no ITAAC items for this area of review.

TS: The TS associated with DCD Tier 2, Section 15.4.1 are in DCD Tier 2, Chapter 16, Technical Specifications, 3.1.4, Moderator Temperature Coefficient (MTC), 3.1.5, Control Element Assembly (CEA) Alignment, and 3.4.1, Reactor Coolant System (RCS) Pressure, Temperature and Flow Limits.

The relevant requirements of NRC regulations for this area of review, and the associated acceptance criteria, are in NUREG-0800, Section 15.4.1, Uncontrolled Control Rod Assembly Withdrawal from a Subcritical or Low Power Startup Condition, and are summarized below.

Review interfaces with other SRP sections also can be found in NUREG-0800, Section 15.4.1.

GDC 10, which requires that SAFDLs are not to be exceeded during normal operation, including the effects of AOOs.

GDC 13, which requires that the availability of instrumentation to monitor variables and systems over their anticipated ranges to assure adequate safety, and of appropriate controls to maintain these variables and systems within prescribed operating ranges.

GDC 17, which requires provision of an onsite electric power system and an offsite electric power system to permit functioning of structures, systems, and components important to safety.

GDC 20, which requires that the protection system initiate automatically appropriate systems to assure that SAFDLs are not exceeded as a result of AOOs.

GDC 25, which requires that the reactor protection system be designed to assure that SAFDLs are not exceeded in the event of a single malfunction of the reactivity control system.

The applicant assumed an uncontrolled CEA withdrawal to occur at the low power condition (0.001 percent of rated thermal power, or 0.3983 MWt) rather than the subcritical condition since the total energy generation is higher thus resulting in the closest approach to the SAFDLs. The low power condition of 1.0e-3 percent rated thermal power was chosen because at powers above this level, the CPC VOPT terminates the event sooner, resulting in less limiting consequences. The staff reviewed the reactor trip system (RTS) and the reactivity control system as documented in Chapter 7 of this SER. Therefore, the staff finds that the applicants design meets GDC 13 in that the safety analysis shows that all credited instrumentation was available, and that actuations of protection systems, automatic and manual, occurred at values of monitored parameters that were within the instruments prescribed operating ranges.15-125

A LOOP coincident with a turbine trip was assumed as this was more limiting than the case without a LOOP. The staff therefore finds that the applicants design meets GDC 17 in that the safety analysis shows that with and without off site power, SAFDLs are not exceeded.

A maximum core inlet of 295 °C (563 °F), a minimum RCS pressure of 152.91 kg/cm2 (2,175 psia), and a minimum core flow of 95 percent of design (69.64x106 kg/hr [1.54x108 lb/hr])

results in the closest approach to the SAFDLs.

Based on the maximum CEA withdrawal rate of 76.2 cm/min (0.5 in/s), the applicant obtained a maximum reactivity insertion rate of 1.175x10-4 /s. The CEA bank withdrawal is based on the calculated differential control CEA bank worth (0.00925 %/cm).

The applicant analyzed this event using reactivity feedback coefficients for fuel temperature and moderator temperature in combination with kinetics parameters that include effective delayed neutron fractions, neutron lifetimes, and decay constants for delayed neutron precursors.

However, the applied kinetics parameters are not described in the DCD section, nor does the DCD incorporate or cite references that details the calculations for this event. Therefore, the staff audited the related calculation note (ML17013A130, July 16, 2016). During the audit, the staff reviewed the kinetics parameters and confirmed that the total delayed neutron fraction used in the calculation is less than the cycle average delayed neutron fraction. The staff also confirmed that the neutron lifetime used in the calculation is less than the neutron lifetime listed in DCD Tier 2 Table 4.3-1.

The staff determined that the DCD and the audited calculation note do not adequately describe the assumed kinetics parameters and their bases and do not provide supporting information to show that the applied parameters yield appropriately conservative analysis predictions.

Therefore, on December 22, 2015, the staff issued RAI 345-8433, Question 15.04.01-1, asking the applicant to adequately describe and justify the kinetics parameters used in analyzing this event (ML15356A019). On January 14, 2016 (ML16014A761), the applicant responded to this RAI, and indicated that for the peak linear heat generation rate (PLHGR) case, a lower delayed neutron fraction, which is present at end-of-cycle (EOC) conditions, maximizes the power increase during the event, and thus leads to a higher PLHGR (ML16014A761). In addition, the least negative fuel temperature coefficient (FTC) and the most positive MTC taken from beginning-of-cycle (BOC) conditions were used for the PLHGR case. For the DNBR case, a slower rate of increase resulting from BOC kinetics parameters leads to a lower minimum DNBR. The staff reviewed and confirmed that the applicants assumptions are conservative, and therefore, finds this response acceptable. The staff considers RAI 345-8433, Question 15.04.01-1, resolved and closed.

The limiting three-dimensional heat flux peaking factor (F ) of 2.43 is determined at full-power conditions as indicated in DCD Tier 2 Section 4.3.2.2.2, which notes that a higher F is allowed for reduced core power levels. For this analysis, a peaking factor of 5.94 was used that includes uncertainties. The staff considers this to be conservative.

The most positive MTC and least negative FTC values are used for analyzing this event, which satisfies SRP Section 15.4.1. The most positive MTC shown in DCD Tier 2 Table 4.3-3 and Figure 4.3-31 is +0.9x10-4 /°C (+0.5x10-4 /°F). This is well above the nominal MTC values calculated for BOC and EOC hot full power conditions, which the staff finds to be bounding.

The staff reviewed the MTC values as documented in Section 4.3 of this SER. The input 15-126

description included in the audited calculation note (ML17013A130, July 16, 2016) shows that

+0.5x10-4 /°F (+0.9x10-4 /°C) is used, which the staff finds to be consistent with the value reported in DCD Tier 2 Table 4.3-3 and DCD Tier 2 Section 15.4.1.3.2.

The applicant used the least negative FTC and according to DCD Tier 2 Table 4.3-3, applied a multiplier of 0.819 to the values at BOC in DCD Tier 2 Figure 4.3-30 to obtain the FTC values for this event. The staff reviewed the FTC values as documented in Section 4.3 of this SER.

The input description included in the audited calculation note (ML17013A130, July 16, 2016) shows values that are roughly consistent with this figure. For example, at roughly 400 °C (752

°F), the BOC FTC is -3.0x10-5 /°C (1.667 x10-5 /°F), and 0.819 times this value is -1.365 x10-5 /°F (-2.457 x10-5 /°C). The input model lists the reactivity at 371 °C and 427 °C (700

°F and 800 °F) as -0.0101 and -0.0115, respectively. This results in an FTC of -1.4 x10-5 /°F

(-2.52 x10-5 /°C), which the staff concludes is consistent with the values in DCD Tier 2 Figure 4.3-30.

A bottom peaked axial power shape is used for the scram reactivity (+0.6 axial shape index

[ASI]); however there was no difference in the results using +0.3 ASI. This information was confirmed by the staff in the audited calculation note for this event (ML17013A130, July 16, 2016).

The reactivity for the withdrawn bank is inserted over a period of 0.71 seconds. The staff confirmed this rate in the audited calculation note for this event (ML17013A130, July 16, 2016).

Following this reactivity insertion, DCD Tier 2 Figure 15.4.1-1 shows that the power peaks shortly after 30 seconds. The staff concludes that this is consistent with DCD Tier 2 Table 15.4.1-1, which lists peak power as occurring at 30.25 seconds, which follows the initiation of reactor scram at 29.74 seconds. DCD Tier 2 Table 15.4.1-1 indicates that the RPS VOPT setpoint is reached at 29.19 seconds. DCD Tier 2 Table 15.0-2 lists the RPS VOPT setpoint as 116.5 percent (ceiling) with a 0.0 second sensor response time and a 0.55 second trip delay.

The staff noted in the audited calculation note for this event that the step setpoint is used, but assumed to be 25 percent, rather than 14 percent, in order to account for power measurement uncertainty (ML17013A130, July 16, 2016). Thus, the time to scram is delayed, resulting in a lower minimum DNBR. The staff finds this to be conservative.

A trip delay of 0.55 seconds is shown in DCD Tier 2 Table 15.4.1-1 (trip breakers open at 29.74 seconds). DCD Tier 2 Table 7.2-5 lists the response time as less than or equal to 0.55 seconds, and DCD Tier 2 Table 15.0-2 lists the reactor trip delay time as 550 milliseconds (ms). The staff reviewed these values as documented in Section 7.2 and Section 15.0 of this SER, and found these values to be consistent with DCD Tier 2 Table 15.4.1-1. A scram worth of -5.5 percent minimum worth at low power. The staff confirmed the value in the audited calculation note for this event (ML17013A130, July 16, 2016), and determined it to be conservative.

Once the CEA reinsertion begins as a result of the reactor scram, the reactivity for the withdrawn bank is removed over a period of 0.71 seconds, similar to its insertion rate. The staff confirmed this rate in the audited calculation note for this event (ML17013A130, July 16, 2016).

The scram curve indicates that 89.35 percent insertion occurs at 4.18 seconds. The staff reviewed the designed scram curve as documented in Chapter 4 of this SER, and noted that DCD Tier 2 Figure 4.2-14 shows that 90 percent insertion is limited to less than 4.0 seconds (also shown in DCD Tier 2 Subsection 15.0.0.2.4). The scram curve used for this event is15-127

slightly outside this limit, but the staff finds this to be conservative. The staff finds that the applicants design meets GDC 20 in that the safety analysis shows that the reactivity control systems are automatically initiated so that SAFDLs are not exceeded.

The maximum core power for this event is listed in DCD Tier 2 Table 15.4.1-1 as 43 percent rated thermal power at 30.25 seconds, which is consistent with DCD Tier 2 Figure 15.4.1-1.

The PLHGR is computed as follows:

PLHGR F P LHGR Using this equation, the staff audited calculations supporting the applicants conclusion about the final PLHGR being bounded by the limit of 20 kW/ft (ML17013A130). The staffs audit confirmed that the applicants PLHGR is below the limit. Thus, the staff concludes that the applicant meets incipient fuel centerline melt limits for AOOs.

The staff audited calculations supporting the applicants conclusion that the peak pressure for this event was below the safety limit (ML17013A130). The staff noted in the audited calculation note that the position of highest pressure in the RCS is at the RCP discharge. As such, the peak pressure is calculated by adding the RCS pressure (pressurizer) and the pressure drop for the pump (between cold leg at safety injection and surge line). Based on this, the staff confirms that the applicants peak pressure is below the limit of 110 percent of design pressure, and therefore concludes that the acceptance criterion on peak pressure has been met.

The core coolant temperature is shown in DCD Tier 2 Figure 15.4.1-5 where the peak temperature is seen to be roughly 302 °C (575 °F), which is 7 °C (12 °F) above the initial temperature. The peak core average heat flux is observed in DCD Tier 2 Figure 15.4.1-2 to be roughly 21 percent of the core average heat flux at full power.

The DCD Tier 2 Section 15.0.0 provides the design limits on minimum DNBR and PLHGR. The SAFDL on DNBR is 1.29 [DCD Tier 2 Section 4.3.2.2.2; DCD Tier 2 Section 15.0] using the KCE-1 CHF correlation. The SAFDL on PLHGR is 20 kW/ft as reported in DCD Tier 2 Section 15.0. In addition, the input and initial conditions, including reactivity coefficients, are provided.

DCD Tier 2 Section 15.0.0.10 indicates that the effects of TCD are negligible for everything except CEA ejection and LBLOCA. The staffs review of the DNBR limit is documented in Chapter 4.4 of this SER. The staffs review of the PLHGR limit is called out in Chapter 4.2 of this SER. The staff reviewed the input, initial conditions, and assumptions as part of this section of this SER and determined they were adequate due to their conservative nature.

The DCD Tier 2 Section 15.0.2 provides information on the non-LOCA methodology (Technical Report APR1400-Z-A-NR-14006) and computer codes used, including CESEC-III and CETOP.

The staffs review of the event methodology is documented in Section 15.0.2 of this SER.

In summary, given the peak transient conditions, the staff determined the response of the fuel to be within the SAFDLs. The analysis reaches a minimum DNBR of 3.34 at 30.45 seconds, which is well above the low DNBR SAFDL. The analysis reaches a maximum PLHGR of 14.3 kW/ft at 30.45 seconds, which is well below the limit. Accordingly, the staff confirmed that no fuel damage is anticipated from this event. Therefore, the staff finds that the applicants design meets GDC 10 in that the safety analysis shows that SAFDLs are not exceeded during normal operations, including AOOs. The staff also finds that the applicants design meets GDC 25 in 15-128

that the safety analysis shows that single malfunctions in the reactivity control system did not cause the SAFDLs to be exceeded.

There are no COL information items associated with Section 15.4.1 of the APR1400 DCD.

The staff reviewed possibilities for single failures of the reactor control system that could result in uncontrolled withdrawal of control rods under low power startup conditions. An uncontrolled withdrawal of CEAs is assumed to occur as a result of a single failure in the CEDM, the CEDMCS, or the RRS, or as a result of operator error.

The scope of the review included investigations of initial conditions and control rod reactivity worths, the course of the resulting transients or steady-state conditions, and the instrument responses to the transient or power maldistribution. The staff finds the initial conditions and reactivity worths to be conservative, and finds the sequence of events, including RPS response, to be acceptable.

The staff examined the methods used to determine the peak fuel rod response, and the input into that analysis, such as power distributions and reactivity feedback effects due to moderator and fuel temperature changes. The CESEC-III code is used to simulate the NSSS response.

The CETOP code, which includes the KCE-1 CHF correlation, is used to simulate the thermal margin on DNBR. The staff finds this methodology acceptable. The staff also finds the power distribution, reactivity feedback coefficients, and kinetics parameters used for this analysis to be conservative.

The staff concludes that the requirements of GDC 10, 13, 17, 20, and 25 have been met. This conclusion is based on the following:

In meeting GDC 10, 13, 17, 20, and 25, the staff determined that the applicants analysis was performed using a mathematical model that had been previously reviewed and found acceptable by the staff. The parameters used as input to this model were reviewed and found to be suitably conservative and consistent with the plant design.

The applicant met the requirements of GDC 10, 20, and 25 with respect to demonstrating that resultant fuel integrity is maintained since the specified acceptable fuel design limits were not exceeded for this event.

The applicant meets GDC 13 requirements by demonstrating that all credited instrumentation was available, and that actuations of protection systems, automatic and manual, occurred at values of monitored parameters that were within the instruments prescribed operating ranges.

The applicant meets GDC 17 requirements by performing the analysis with and without offsite electrical power availability.15-129

An uncontrolled sequential withdrawal of CEAs could occur as a result of a single failure in the CEDMCS, RRS, or as a result of operator error. The withdrawal of the CEAs could result in unbalanced power generation in the core, which could result in the core safety limits being exceeded. This event is classified as an AOO.

DCD Tier 1: There are no DCD Tier 1 entries for this area of review.

DCD Tier 2: The applicant provided a DCD Tier 2 system description in Sections 15.4.2 summarized here, as follows:

The uncontrolled withdrawal of a CEA at power is caused by a failure in the rod drive control system, the rod regulating system, or by operator error. Withdrawal of a rod at power adds reactivity to the core, which causes the power to shift toward the newly un-rodded area, resulting in increases in core power level and heat flux. The increases in power and heat flux cause corresponding increases in reactor coolant temperature and pressure. The transient variations in core thermal parameters may result in an approach to the SAFDLs on DNBR and fuel centerline melt temperatures. The approach to safety limits may require action by the reactor protection system (RPS).

ITAAC: There are no ITAAC items for this area of review.

TS: The TS associated with DCD Tier 2, Section 15.4.2 are given in DCD Tier 2, Chapter 16, Technical Specifications, 3.1.4, Moderator Temperature Coefficient (MTC), 3.1.5, Control Element Assembly (CEA) Alignment, 3.2.1, Linear Heat Rate (LHR), 3.2.4, Departure from Nucleate Boiling Ratio, 3.3.1 Reactor Protection System (RPS) Instrumentation -

Operating, 3.3.4, Reactor Protection System (RPS) Logic and Trip Initiation, and 3.4.1, Reactor Coolant System (RCS) Pressure, Temperature and Flow Limits.

The relevant requirements of NRC regulations for this area of review, and the associated acceptance criteria, are in NUREG-0800 Section 15.4.2, Uncontrolled Control Rod Assembly Withdrawal at Power, and are summarized below. Review interfaces with other SRP sections also can be found in SRP Section 15.4.2.

GDC 10, as it relates to the RCS design with appropriate margin so SAFDLs are not exceeded during normal operations, including AOOs.

GDC 13, as to the availability of instrumentation to monitor variables and systems over their anticipated ranges to assure adequate safety, and of appropriate controls to maintain these variables and systems within prescribed operating ranges.

GDC 17, as it relates to onsite and offsite electric power systems, to ensure that safety-related structures, systems, and components function during normal operation, including 15-130

AOOs. The safety function for each power system (assuming the other system is not functioning) is to provide sufficient capacity and capability so SAFDLs and RCPB design conditions are not exceeded during AOOs.

GDC 20, as it relates to the automatic initiation of systems that will ensure that the SAFDLs are not exceeded as a result of AOOs.

GDC 25, as it relates to the reactor protection system design such that the SAFDLs are not exceeded for any single malfunction of the reactivity control systems (e.g. accidental withdrawal but not ejection or dropout of control rods).

The initial power level is assumed to be 102 percent of core thermal power (4,062.66 MWt).

SRP Section 15.4.2 guides the reviewer to evaluate the rod withdrawal at a range of initial power levels. However, the application does not address a range of lower initial power levels.

Therefore, on December 22, 2015, the staff issued RAI 346-8434, Question 15.04.02-1, asking the applicant to provide this information (ML15356A021). On May 3, 2016, the applicant responded to this RAI, and indicated that credit was taken for the core protection calculator system (CPCS) which is designed to prevent the violation of the SAFDL on DNBR and local power density (ML16124B201). The applicant then provided analysis of the event at 102 percent and 50 percent rated thermal power in order to show that the CPCS can adequately prevent the violation of the SAFDLs at various power levels. The staff reviewed the results provided by the applicant and confirmed that the compensated heat flux computed by the CPCS is higher than the real heat flux computed with the CESEC code. The staff finds that the applicants analysis was conservative, and therefore, finds this response acceptable. The staff considers RAI 346-8434, Question 15.04.02-1, resolved and closed.

The applicant assumed a LOOP coincident with the reactor trip. The applicant determined that a CEA withdrawal at power with a LOOP is the limiting event compared to a withdrawal without a concurrent LOOP. The staff confirmed that this assumption is valid. The staff reviewed the applicants analysis and confirmed that for this limiting event, no SAFDLs were exceeded. The staff therefore finds that the applicants design meets GDC 17 in that the safety analysis shows that with and without off site power, SAFDLs are not exceeded.

The initial coolant conditions are selected to minimize the DNBR value. The coolant inlet temperature is 287.8 °C (550 °F), the pressure is 163.5 kg/cm2 (2,325 psia), and the core mass flow rate is 69.64 x 106 kg/hr (1.54 x 108 lb/hr), which is 95 percent of design flow.

The reactivity insertion rate is maximized by assuming the fastest rod withdrawal rate (76.2 cm/min or 0.5 in/s) and the calculated differential CEA worth (0.00248 %/cm), giving a maximum expected reactivity insertion rate of 0.315x10-4 /s. The staff audited the calculation note related to this event (ML17013A130, July 16, 2016). The staff noted that the calculation note confirms that a bank withdrawal was analyzed. However, the SRP Section 15.4.2 directs the reviewer to evaluate a range of reactivity insertion rates, and this information was not provided in the DCD or the audited calculation note. Therefore, on December 22, 2015, the staff issued RAI 346-8434, Question 15.04.02-1, asking the applicant to provide this information (ML15356A021). On May 3, 2016, the applicant responded to this RAI, and provided analysis results of minimum DNBR for a range of reactivity insertion rates (ML16124B201). These 15-131

results were generated at both 102 percent rated thermal power and 50 percent rated thermal power. For transients with a rapid power increase, the staff observed that the CPCS prevented the violation of the SAFDLs with the variable overpower trip. For transients with a slower power increase, the staff observed that the CPCS prevented the violation of the SAFDLs with the DNBR trip. The staff agrees with these results, and therefore, finds this response acceptable.

The staff considers RAI 346-8434, Question 15.04.02-1, resolved and closed.

The staff reviewed the total delayed neutron fraction, neutron lifetime, and average decay constant from the CESEC-III code input description included in the audited calculation note (ML17013A130, July 16, 2016). The staff confirmed that the total delayed neutron fraction used in the calculation is less than the cycle average delayed neutron fraction, and also confirmed that the neutron lifetime used in the calculation is less than the neutron lifetime listed in DCD Tier 2 Table 4.3-1.

However, the staff determined that the DCD and the audited calculation note do not adequately describe the assumed kinetics parameters and their bases and do not provide supporting information to show that the applied parameters yield appropriately conservative analysis predictions. Therefore, on December 22, 2015, the staff issued RAI 345-8433, Question 15.04.01-1, asking the applicant to adequately describe and justify the kinetics parameters used in analyzing this event (ML15356A019). On January 14, 2016, the applicant responded to this RAI, and indicated that for the PLHGR case, a lower delayed neutron fraction, which is present at EOC conditions, maximizes the power increase during the event, and thus leads to a higher PLHGR (ML16014A763). In addition, the least negative FTC and the most positive MTC taken from BOC conditions were used for the PLHGR case. For the DNBR case, a slower rate of increase resulting from BOC kinetics parameters leads to a lower minimum DNBR. The staff reviewed and confirmed that the applicants assumptions are conservative, and therefore, finds this response acceptable. The staff considers RAI 345-8433, Question 15.04.01-1 resolved and closed.

The staff notes that the most positive MTC value is used for analyzing this event, which satisfies SRP Section 15.4.2. The most positive MTC for this event is shown in DCD Tier 2 Table 4.3-3 as +0.0 /°C (+0.0 /°F). The staff concludes that this is well above the nominal MTC values calculated for BOC and EOC hot full power conditions shown in DCD Tier 2 Figure 4.3-31, which the staff finds to be bounding. The staff reviewed the MTC values as documented in Section 4.3 of this SER. The input description included in the audited calculation note (ML17013A130, July 16, 2016) shows that +0.0 /°F (+0.0 /°C) is used, which the staff confirmed to be consistent with the value reported in DCD Tier 2 Table 4.3-3.

The staff notes that the applicant used the least negative FTC value for analyzing this event, which satisfies SRP Section 15.4.2. In addition, the staff notes that according to DCD Tier 2 Table 4.3-3, the applicant applies a multiplier of 0.819 to the values at BOC in DCD Tier 2 Figure 4.3-30 to obtain the Doppler coefficients for this event. The staff reviewed the FTC values as documented in Section 4.3 of this SER. The input description included in the audited calculation note (ML17013A130, July 16, 2016) shows a table of temperature, reactivity pairs.

The input model listing gives the reactivity at 700 °F (371 °C) and 800 °F (427 °C) as -0.0101 and -0.0115, respectively. The slope between those points yields an FTC of -1.4x10-5 /°F (-

2.5 x10-5 /°C). At roughly 400 °C (752 °F), the BOC FTC from Figure 4.3-30 is -3.0 x10-5

/°C (-1.667 x10-5 /°F), and 0.819 times this value is -2.46 x10-5 /°C (-1.365 x10-5 /°F).15-132

Therefore, the staff confirmed that the audited calculation note is consistent with DCD Tier 2 Figure 4.3-30.

The staff noted that the initial core power distribution has an axial shape index (ASI) of -0.3.

The scram reactivity insertion uses a bottom-peaked axial power shape of 0.3. The ASI is limited to be between -0.3 and +0.3 for power levels greater than 20 percent, which the staff confirmed in DCD Tier 2 Table 15.0-3. The staff finds the use of a bottom-peaked axial power shape to be conservative for this event.

The maximum core power for this event is listed in DCD Tier 2 Table 15.4.2-1 as 115.56 percent rated thermal power at 24.15 seconds, which the staff finds to be consistent with DCD Tier 2 Figure 15.4.2-1. PLHGR is computed as follows:

PLHGR F P LHGR Using this equation, the staff audited calculations supporting the applicants conclusion about the final PLHGR being bounded by the limit of 20 kW/ft (ML17013A130, July 16, 2016). The staffs audit confirmed that the applicants PLHGR is below the limit. Thus, the staff concludes that the applicant meets incipient fuel centerline melt limits for AOOs.

The staff audited calculations supporting the applicants conclusion that the peak pressure for this event was below the safety limit (ML17013A130, July 16, 2016). The staff noted in the audited calculation note that the highest pressure position in the RCS is at the RCP discharge.

As such, the applicant calculated the peak pressure by adding the RCS pressure (pressurizer) and the pressure drop for the pump (between cold leg at safety injection and surge line). Based on this, the staff confirms that the applicants peak pressure is below the limit of 110 percent of design pressure, and therefore concludes that the acceptance criterion on peak pressure has been met.

The core coolant temperature is shown in DCD Tier 2 Figure 15.4.2-5, and the peak temperature is roughly 628 °F (331 °C). This is 78 °F (26 °C) above initial conditions. The peak core average heat flux as a percentage of full power is provided in DCD Tier 2 Table 15.4.2-1 as 113.8 percent.

The DCD Tier 2 Section 15.0.0 provides the design limits on minimum DNBR and PLHGR. The SAFDL on DNBR is 1.29 [DCD Tier 2 Section 4.3.2.2.2; DCD Tier 2 Section 15.0] using the KCE-1 CHF correlation. The SAFDL on PLHGR is 20 kW/ft as reported in DCD Tier 2 Section 15.0. In addition, the input and initial conditions, including reactivity coefficients, are provided in DCD Tier 2 Section 15.0.0. DCD Tier 2 Section 15.0.0.10 indicates that the effects of TCD are negligible for everything except CEA ejection and LOCA. The staffs review of the DNBR limit is documented in Chapter 4.4 of this SER. The staffs review of the PLHGR limit is called out in Chapter 4.2 of this SER. The staff reviewed the input, initial conditions, and assumptions as part of this section of this SER and determined they were adequate due to their conservative nature.

The DCD Tier 2 Section 15.0.2 provides information on the non-LOCA methodology (Technical Report APR1400-Z-A-NR-14006) and computer codes used, including CESEC-III and CETOP.

The staffs review of the event methodology is documented in Section 15.0.2 of this SER.15-133

During this event analysis, the protection system was automatically activated by a variable overpower trip signal at 115 percent power. A reactor scram was then initiated in response to this trip signal following a 0.65 second delay. The automatic protective action was sufficient to return the reactor to a safe condition without exceeding fuel design limits or challenging the fuel cladding integrity. The staff reviewed the RTS and the reactivity control system as documented in Chapter 7 of this SER. Therefore, the staff finds that the applicants design meets GDC 13 in that the safety analysis shows that all credited instrumentation was available, and that actuations of protection systems, automatic and manual, occurred at values of monitored parameters that were within the instruments prescribed operating ranges. In addition, the staff finds that the applicants design meets GDC 20 in that the safety analysis shows that the reactivity control systems are automatically initiated so that SAFDLs are not exceeded.

In summary, given the peak transient conditions, the staff determined the response of the fuel to be within the SAFDLs. The analysis reaches a minimum DNBR of 1.31, which is above the low DNBR SAFDL. The analysis reaches a maximum PLHGR of 19.27 kW/ft, which is below the limit. Accordingly, the staff confirms that no fuel damage is anticipated from this event.

Therefore, the staff finds that the applicants design meets GDC 10 in that the safety analysis shows that SAFDLs are not exceeded during normal operations, including AOOs. The staff also finds that the applicants design meets GDC 25 in that the safety analysis shows that single malfunctions in the reactivity control system did not cause the SAFDLs to be exceeded.

There are no COL information items associated with Section 15.4.2 of the APR1400 DCD.

The staff has reviewed possibilities for single failures of the reactor control system that could result in uncontrolled withdrawal of control rods at power. An uncontrolled withdrawal of CEAs is assumed to occur as a result of a single failure in the CEDM, the CEDMCS, or the RRS, or as a result of operator error.

The scope of the review has included investigations of initial conditions and control rod reactivity worths, the course of the resulting transients or steady-state conditions, and the instrument responses to the transient or power maldistribution. The staff finds the initial conditions and reactivity worths to be conservative, and finds the sequence of events, including RPS response, to be acceptable.

The staff examined the methods used to determine the peak fuel rod response, and the input into that analysis, such as power distributions and reactivity feedback effects due to moderator and fuel temperature changes. The CESEC-III code is used to simulate the NSSS response.

The CETOP code, which includes the KCE-1 CHF correlation, is used to simulate the thermal margin on DNBR. The staff finds the applicants use of this methodology acceptable as documented in Chapter 15.0.2 of this SER. The staff also finds the power distribution, reactivity feedback coefficients, and kinetics parameters used for this analysis to be conservative.

The staff concludes that the requirements of GDC 10, 13, 17, 20, and 25 have been met. This conclusion is based on the following:

15-134

In meeting GDC 10, 13, 17, 20, and 25, the staff determined that the applicants analysis was performed using a mathematical model that had been previously reviewed and found acceptable by the staff. The parameters used as input to this model were reviewed and found to be suitably conservative and consistent with the plant design.

The applicant met the requirements of GDC 10, 20, and 25 with respect to demonstrating that resultant fuel integrity is maintained since the specified acceptable fuel design limits were not exceeded for this event.

The applicant meets GDC 13 requirements by demonstrating that all credited instrumentation was available, and that actuations of protection systems, automatic and manual, occurred at values of monitored parameters that were within the instruments prescribed operating ranges.

The applicant meets GDC 17 requirements by demonstrating that acceptance criteria are met with and without offsite electrical power availability.

A control rod misoperation, such as a dropped CEA or CEA group, a statically misaligned CEA, or a single CEA withdrawal is an AOO. The CPCS provides penalty factors for the respective trips on low DNBR and high local power density (LPD). Exceptions are made for the three aforementioned control rod misoperations. For these events, the TS LCOs provide reasonable assurance that the initial thermal margin is preserved.

DCD Tier 1: There are no DCD Tier 1 entries for this area of review.

DCD Tier 2: The applicant provided a DCD Tier 2 system description in Sections 15.4.3, summarized here, as follows The DCD states that the four-finger single CEA drop event is the limiting control rod misoperation event and presents a summary of the analysis performed to show that SAFDLs are not exceeded. A single CEA drop results from an interruption of electrical power to the control element drive mechanism holding coil. This event does not cause a reactor trip and results in an approach to the SAFDL on DNBR. The four-finger CEA drop is not affected by a LOOP following a turbine trip because of an implemented delay time in the RPS design that the turbine trip signal occurs 3 seconds following a reactor trip.

The drop of the CEA causes an initial decrease in the reactor power. The primary-to-secondary imbalance then causes a cooldown of the reactor coolant, which introduces a positive reactivity feedback. The power then begins to increase, eventually returning to the initial power level.

The presence of the dropped rod, however, causes a shift in the radial power profile, which is amplified over time by the three-dimensional xenon redistribution. The increase in local heat flux results in a diminished DNBR that approaches the SAFDL for low DNBR.15-135

ITAAC: There are no ITAAC items for this area of review.

TS: The TS associated with DCD Tier 2, Section 15.4.3 are given in DCD Tier 2, Chapter 16, Technical Specifications, 3.1.4, Moderator Temperature Coefficient (MTC), 3.1.5, Control Element Assembly (CEA) Alignment, and 3.4.1, RCS Pressure, Temperature and Flow Limits.

The relevant requirements of NRC regulations for this area of review, and the associated acceptance criteria, are given SRP, Section 15.4.3, Control Rod Misoperation (System Malfunction or Operator Error), and are summarized below. Review interfaces with other SRP sections also can be found in SRP Section 15.4.3.

GDC 10, which requires that the reactor core and associated coolant, control and protection systems be designed with appropriate margin to assure that SAFDLs are not to be exceeded during any condition of normal operation, including the effects of AOOs.

GDC 13, which requires that the availability of instrumentation to monitor variables and systems over their anticipated ranges to assure adequate safety, and of appropriate controls to maintain these variables and systems within prescribed operating ranges.

GDC 20, which requires, in part, that the protection system shall be designed to initiate automatically the operation of appropriate systems to ensure that SAFDLs are not exceeded as a result of AOOs.

GDC 25, which requires that the RPS be designed to assure that SAFDLs are not exceeded for any single malfunction of the reactivity control systems, such as accidental withdrawal (not ejection or dropout) of control rods.

The four-finger single CEA drop is the limiting event analyzed in DCD Tier 2 Section 15.4.3. As analyzed, this event does not cause a reactor trip but results in an approach to the SAFDL on DNBR. The staff reviewed the RTS and the reactivity control system as documented in Chapter 7 of this SER. Therefore, the staff finds that the applicants design meets GDC 13 in that the safety analysis shows that all credited instrumentation was available, and that actuations of protection systems, automatic and manual, occurred at values of monitored parameters that were within the instruments prescribed operating ranges. In addition, the staff finds that the applicants design meets GDC 20 in that the safety analysis shows that the reactivity control systems are automatically initiated so that SAFDLs are not exceeded.

The DCD Tier 2 Section 4.3.2.5 indicates that the full-strength CEA drop incident is analyzed by selecting the dropped CEA that maximizes the increase in the radial peaking factor, and a conservatively small negative reactivity insertion is used in the accident analysis. However, the applicant did not provide supporting information such as an examination of the range of CEA worths and locations. As such, it was not clear to the staff that a CEA drop into both a high flux and low flux region has been considered or that cases with a part-strength CEA drop was examined by the applicant.15-136

Therefore, the staff audited the related calculation note for DCD Tier 2 Section 15.4.3 (ML17013A130). The staff noted that as of August 2012, the 12-finger CEA drop analysis is to be included in future design analyses for the COLSS and the CPCS. The staff further noted from the audited calculation note that if a 12-finger CEA drops, the CPCS will appropriately generate a trip if it is necessary because the CPCS conservatively calculates DNBR every 0.05 seconds. However, the applicant provided no information on its analyses for the 12-finger CEA drop. Therefore, the staff could not evaluate the applicants analyses for a range of 12-finger CEA drop events nor verify their implications, if any, for determining the limiting CEA drop event.

Accordingly, on December 22, 2015, the staff issued RAI 347-8435, Question 15.04.03-1, asking the applicant to provide further information on its supporting analyses of four-finger and 12-finger CEA drops to demonstrate that the analyzed CEA drop is limiting (ML15356A022).

On May 3, 2016 (ML16124B191), the applicant responded to this RAI, and provided the results of the 12-finger CEA drop case. The staff noted that the DNBR initially decreases due to the radial distortion, but then begins to increase after 1.0 second due to the CPC trip. The staff observed that the minimum DNBR reached by this case was above that reached by the 4-finger CEA drop. Therefore, the staff finds the applicants response acceptable and considers RAI 347-8435, Question 15.04.03-1 resolved and closed.

The applicant assumed the CEA drop occurs at 102 percent rated thermal power, consistent with the requirement in SRP Section 15.4.3. A maximum core inlet of 295 °C (563 °F), a minimum RCS pressure of 152.91 kg/cm2 (2,175 psia), and a minimum core flow of 95 percent of design (69.64e6 kg/hr, 1.54e8 lb/hr) results in the closest approach to SAFDLs. The applicant used a top-peaked axial power shape for the initial core average power distribution (-0.3 ASI). The staff finds that since this is a CEA drop event, a top-peaked axial power shape will be the more limiting configuration.

The most negative MTC and most negative FTC are used for this analysis, consistent with EOC core conditions. These coefficients are calculated as reported in DCD Tier 2 Section 4.3, which the staff reviewed as documented in Section 4.3 of this SER. The staff confirmed in the audit report for this event that the most negative MTC is -3.0x10-4 /°F (-5.4 x10-4 /°C), which maximizes the return to power (ML17013A130, July 16, 2016). The staff finds this to be consistent with the minimum MTC value reported in DCD Tier 2 Table 4.3-3, and bounds the minimum value as shown in DCD Tier 2 Figure 4.3-32.

According to DCD Tier 2 Table 4.3-3, a multiplier of 1.181 is applied to the FTC values in DCD Tier 2 Figure 4.3-30 to obtain the fuel temperature feedback reactivity for this event. The staff reviewed the FTC values as documented in Section 4.3 of this SER. The input description included in the audited calculation note (ML17013A130, July 16, 2016) shows values lower than those plotted in DCD Tier 2 Figure 4.3-30. For example, at roughly 400 °C (752 °F), the EOC FTC is -3.2x10-5 /°C (-1.778 x10-5 /°F), and 1.181 times this value is -3.78 x10-5 /°C (-2.1 x10-5 /°F). The input model listed the reactivity at 700 °F and 800 °F as -0.0186 and 0.0212, respectively. This results in an FTC of -4.68 x10-5 /°C (-2.6 x10-5 °F), which is a factor of 1.238 lower than that in DCD Tier 2 Figure 4.3-30. This will result in larger feedback reactivity insertion following the CEA drop and thus a quicker return to power, which the staff finds to be conservative.

The staff confirmed in the audited calculation note for this event that EOC kinetics parameters, including the minimum delayed neutron fraction, are used to maximize the heat flux increase 15-137

(ML17013A130, July 16, 2016). In the calculation notes CESEC-III input model listing, the staff observed that the average delayed neutron fraction sums to 0.00412, the neutron lifetime is 1.5 x10-5 seconds, and the average decay constant is computed as 0.084814. The staff compared these values with DCD Tier 2 Table 4.3-1, which lists the cycle average delayed neutron fraction as 0.0058 and the neutron lifetime as 2.75x10-5 seconds, and confirmed that the CESEC-III kinetics parameter inputs are qualitatively consistent with the effects of plutonium buildup at EOC. The staff, however, was concerned that the submittal and audited calculation note did not adequately describe the assumed kinetics parameters and do not provide supporting information to show that the applied parameters yield appropriately conservative analysis predictions for the limiting CEA drop event. Therefore, on December 22, 2015, the staff issued RAI 345-8433, Question 15.04.01-1, asking the applicant to adequately describe and justify the kinetics parameters used in analyzing this event (ML15356A019).

On January 14, 2016 (ML16014A761), the applicant responded to this RAI, and indicated that a lower delayed neutron fraction, which is present at EOC conditions, gives a faster response for core fission power since the delayed neutron precursor concentration is lower. The applicant added that the impact of the delayed neutron fraction on the transient results for this event is negligible since a PLHGR and a minimum DNBR occur in the quasi-steady state condition. The applicants response shows that the applied parameters yield appropriately conservative analysis predictions; therefore, the staff finds this response acceptable and considers RAI 345-8433, Question 15.04.01-1 resolved and closed.

DCD Tier 2 Table 15.4.3-2 lists the dropped CEA worth as -0.0013 and the staff confirmed in the audited calculation note for this event (ML17013A130, July 16, 2016) that the rod was inserted over 2 seconds instead of 4 seconds. This will result in a faster radial power distortion, which when coupled with a return to power, will yield a minimum DNBR that the staff finds to be conservative.

The applicant assumed the maximum radial peak distortion factor following a four-finger CEA drop is 1.205. However, the DCD does not describe the basis for this value of the distortion factor or the associated uncertainties. According to the audited calculation note related to this event (ML17013A130, July 16, 2016), the distortion factor of 1.205 is a multiplier on the initial integrated radial peaking factor. DCD Tier 2 Table 15.4.3-2 lists the integrated radial peaking factor as 1.37. According to DCD Tier 2 Table 4.3-10, this roughly corresponds to a P (part-strength) rodded core configuration at EOC conditions. Consequently, the integrated radial peaking factor following the CEA drop is 1.205*1.37, which is 1.651. However, absent necessary supporting information, the staff could neither confirm which rodded configuration yields the largest peaking factor nor assess the basis for the assumed maximum radial peak distortion factor of 1.205.

Accordingly, on December 22, 2015, the staff issued RAI 347-8435, Question 15.04.03-1, asking the applicant to provide further information on the basis for the maximum radial peak distortion factor (ML15356A022). On May 3, 2016 (ML16124B191), the applicant responded to this RAI, and provided a discussion of the basis for the peak distortion factor. The staff reviewed a table which presented the peak distortion factors for a variety of CEA configurations and dropped CEA locations. From this table, the staff confirmed that the maximum peak distortion factor of 1.2047 (1.205) was obtained for the CEA configuration which included bank 5 inserted and occurred for full core box number 50. In addition, the staff confirmed that distortion factor included both the static radial power distortion and the xenon redistribution effect. The 15-138

staff finds the applicants response acceptable and therefore considers RAI 347-8435, Question 15.04.03-1 resolved and closed.

The applicant analyzed this event using the CESEC-III code described in DCD Tier 2 Section 15.0.2.2.1. The CESEC-III model includes a 3D reactivity feedback model, which is important for incorporating local changes in the thermal-hydraulic condition. However, the applicant used a point kinetics solver to determine the neutron behavior in the core. Since the single CEA drop produces an asymmetric flux shape, the point kinetics solution will not yield an accurate flux solution for determining the local peaking factor. In addition, xenon redistribution following the CEA drop increases the power distortion over time.

DCD Tier 2 Section 15.0.2.2.1 indicates that a detailed thermal-hydraulic model simulates the mixing in the lower plenum from asymmetric transients. The applicant concluded that this, in combination with the use of the CETOP code for computing 3-D fluid conditions in the core, should give a reasonable estimate of the local flow conditions, and thus the thermal margin on DNBR. However, since mixing in the lower plenum will have an impact on core parameters, the staff needed more detail for the conditions in the lower plenum.

In view of the gaps noted in the preceding paragraphs, on December 22, 2015, the staff issued RAI 347-8435, Question 15.04.03-2, asking the applicant to provide supporting information on the respective 3-D effects for this event (ML15356A022). On January 25, 2016 (ML16025A237), the applicant responded to this RAI, and provided detail on how the 3-D effects were captured in the radial distortion factors. The staff noted that 3-D reactivity feedback effects were treated in the point kinetics model by using conservative MTC and FTC parameters. As such, the staff finds that any 3-D thermal-hydraulic effects are adequately covered by the conservative point kinetics parameters. In addition, the staff noted that the rod drop penalty factor, which includes the static distortion factor along with xenon redistribution, was calculated by the 3-D ROCS nodal code, and that a 1.4 percent upper tolerance limit was applied to the distortion factors to account for uncertainty. The staff finds the applicants response acceptable and therefore considers RAI 347-8435, Question 15.04.03-2 resolved and closed.

The DCD Tier 2 Figure 15.4.3-1 shows that when the CEA drops, the power drops from 102 percent to roughly 88.5 percent rated thermal power in a just a few seconds. A primary-to-secondary load mismatch results in a reduction in the RCS temperature. This cooldown introduces a positive reactivity effect causing a return to power in roughly 75 seconds.

Although the total power returns to 102 percent, the CEA drop yields a distortion in the radial power shape. In addition, the xenon redistribution works to amplify this distortion over time. For this event, a reactor trip does not occur. As such, the DNBR approaches its low limit of 1.29, but stays above it by 5.4 percent as shown in DCD Tier 2 Figure 15.4.3-4. The staff finds that the acceptance criterion on minimum DNBR is therefore met.

The final PLHGR is calculated by taking the initial PLHGR and multiplying it by a distortion factor. This was confirmed by the staff in the audited calculation note for this event (ML17013A130, July 16, 2016). The staffs audit confirmed that the applicants PLHGR is below the limit. Thus, the staff concludes that the APR1400 design meets incipient fuel centerline melt limits for AOOs.15-139

DCD Tier 2 Section 15.0.0 provides the design limits on minimum DNBR and PLHGR. The SAFDL on DNBR is 1.29 [DCD Tier 2 Section 4.3.2.2.2; DCD Tier 2 Section 15.0] using the KCE-1 CHF correlation. DCD Tier 2 Section 15.0.0.1.1 states that the SAFDL on PLHGR is 20 kW/ft. In addition, the input and initial conditions, including reactivity coefficients, are provided.

DCD Tier 2 Section 15.0.0.10 indicates that the effects of TCD are negligible for everything except CEA ejection and large-break LOCA. The staffs review of these limits and parameters are documented in Chapter 15 of this SER.

DCD Tier 2 Section 15.0.2 provides information on the non-LOCA methodology (Technical Report APR1400-Z-A-NR-14006) and computer codes used, including CESEC-III and CETOP.

The staffs review of the event methodology is documented in Section 15.0.2 of this SER.

In summary, given the peak transient conditions, the staff determines the response of the fuel to be within the SAFDLs. The analysis reaches a minimum DNBR of 1.36 at 382.5 seconds, which is within 5.4 percent of the low DNBR SAFDL. The analysis reaches a maximum PLHGR of 16.384 kW/ft at approximately 50 seconds, which is well below the limit. Accordingly, the staff confirms that the response of the fuel is within the SAFDLs, and thus no fuel damage is anticipated from this event. Therefore, the staff finds that the applicants design meets GDC 10 in that the safety analysis shows that SAFDLs are not exceeded during normal operations, including AOOs. The staff also finds that the applicants design meets GDC 25 in that the safety analysis shows that single malfunctions in the reactivity control system did not cause the SAFDLs to be exceeded.

There are no COL information items associated with Section 15.4.3 of the APR1400 DCD.

The staff reviewed possibilities for single failures of the reactor control system which could result in a movement or misposition of control rods beyond normal limits. The staff finds the drop of a single four-finger CEA is determined to be the most limiting case with regard to approaching the SAFDLs.

The scope of the review has included investigations of possible rod misposition configurations, the course of the resulting AOOs or steady-state conditions, and the instrumentation response to the AOO or power maldistribution. The staff finds the initial conditions and reactivity worths to be conservative, and finds the sequence of events to be acceptable. In addition, the staff finds the methods used to determine the peak fuel rod response to be adequate.

The staff concludes that the requirements of GDC 10, 13, 20, and 25 have been met. This conclusion is based on the following:

In meeting GDC 10, 13, 20, and 25, the staff determined that the applicants analysis was performed using a mathematical model that had been previously reviewed and found acceptable by the staff. The parameters used as input to this model were reviewed and found to be suitably conservative and consistent with the plant design.15-140

The applicant met the requirements of GDC 10, 20, and 25 with respect to demonstrating that resultant fuel integrity is maintained since the specified acceptable fuel design limits were not exceeded for this event.

Startup of an inactive reactor coolant pump (SIRCP) can result in an increase in core reactivity.

Operation with an inactive RCP is not permitted in Modes 1 and 2 by LCO 3.4.4 in TS.

Therefore, this event is analyzed, with respect to potential loss of required shutdown margin, for Modes 3 through 6. This event is classified as an AOO in Table 15.0-5 of Tier 2 of the DCD.

This classification is consistent with the SRP.

DCD Tier 1: There are no DCD Tier 1 entries for this area of review.

DCD Tier 2: The applicant provided DCD Tier 2 information, summarized here, as follows:

KHNP provided a qualitative analysis for the startup of the SIRCP event in DCD Tier 2 Section 15.4.4. The applicant assumed that all of the RCPs were initially off. Upon SIRCP, the RCS average temperature is assumed to either drop to the coldest SG temperature or increase to the hottest SG temperature. The heatup and cooldown events are analyzed using the most positive and negative isothermal temperature coefficients, respectively. The applicant determined that a return to criticality cannot occur under all possible scenarios. The applicant noted that this event is not a limiting transient with respect to RCS pressure and fuel performance criteria among the events in the same category which will result in an increase in core reactivity.

ITAAC: There are no ITAAC items for this area of review.

TS: The following TS are applicable to this event:

LCO 3.1.1 and 3.1.2, Shutdown Margin.

LCO 3.4.4, RCS Loops - MODES 1 and 2.

LCO 3.4.10, Pressurizer Pilot Operated Safety Relief Valves.

LCO 3.4.11, Low Temperature Overpressure Protection.

The relevant requirements of NRC regulations for this area of review, and the associated acceptance criteria, are in NUREG-0800, Section 15.4.4-15.4.5, Startup of an Inactive Loop or Recirculation Loop at an Incorrect Temperature, and Flow Controller Malfunction Causing an Increase in BWR Core Flow Rate. Applicable requirements are summarized below. Review interfaces with other SRP sections also can be found in NUREG-0800, Sections 15.4.4-15.4.5.15-141

GDC 10, as it relates to the RCS being designed with appropriate margin to ensure that SAFDLs are not exceeded during normal operations and AOOs.

GDC 15 and GDC 28, as they relate to the RCS and its associated auxiliaries being designed with appropriate margin to ensure that the pressure boundary will not be breached during normal operations and AOOs.

GDC 26, as it relates to the reliable control of reactivity changes to ensure that SAFDLs are not exceeded during AOOs. This is accomplished by ensuring that the analysis accounts for appropriate margins for malfunctions, such as stuck rods.

Acceptance criteria adequate to meet the above requirements include:

1. Pressure in the reactor coolant and main steam systems should be maintained below 110 percent of the design values.

2. Fuel-cladding integrity shall be maintained by ensuring that the MDNBR remains above the 95 percent probability/95 percent confidence DNBR limit for PWRs.

3. An incident of moderate frequency should not generate a more serious plant condition without other faults occurring independently.

4. The requirements stated in RG 1.105 are used with regard to their impact on the plant response to the type of AOOs addressed in NUREG-0800.

5. RG 1.53, as it relates to identifying and assuming in the analysis the most limiting plant systems single failure, as defined in the Definitions and Explanations in Appendix A of 10 CFR Part 50.

6. The guidance provided in SECY-77-439, Single Failure Criterion, August 17, 1977; SECY 94-084, Policy and Technical Issues Associated with the Regulatory Treatment of Non-Safety Systems in Passive Plant Designs, March 28, 1994; and RG 1.206 with respect to the consideration of the performance of non-safety-related systems during transients and accidents, as well as the consideration of single failures of active and passive systems (especially as they relate to the performance of check valves in passive systems), must be evaluated and verified.

Operation with an inactive RCP is not permitted in Modes 1 and 2 by LCO 3.4.4 in TS.

Operation in Modes 1 and 2 is further precluded by the low RCP speed CPC auxiliary trip.

Therefore, the SIRCP event is analyzed with respect to potential loss of required shutdown margin for Modes 3 through 6.

The applicant evaluated the SIRCP event by calculating a bounding change in reactivity and comparing this value to the shutdown margin specified by TS. The bounding change in reactivity is determined by utilizing conservative isothermal temperature coefficients, discussed 15-142

in DCD Tier 2 Section 4.3.3.1.2.2.1, and the maximum possible change in RCS temperature.

The staff noted that this is a conservative method of calculating the bounding reactivity insertion, and is, therefore, acceptable.

A quantitative analysis of the SIRCP event is not provided in the DCD. However, the calculation that is the basis for the qualitative description provided in the DCD for the SIRCP event was viewed by staff during an audit (ML17013A130, July 16, 2016). The staff noted the input values assumed for the isothermal temperature coefficients, compared these values to the information in Section 4.3 of Tier 2 of the DCD, and found the assumed values to be suitably conservative.

The staff noted that although the audited calculation that evaluates the SIRCP event states that the values used for shutdown margin are obtained from TSs; the TSs reference the Core Operating Limits Report (COLR). Additionally, the calculation does not provide justification for the maximum temperature differences between the primary and secondary sides. Accordingly, on September 19, 2015, the staff issued RAI 217-8217, Question 15.04.04-1, to establish the basis for the assumed shutdown margin and primary-to-secondary temperature differences (ML15295A510). The applicants response, provided by letter dated November 23, 2015 (ML15327A150), described the basis for the shutdown margin values and verified that these values are checked prior to loading fuel. Additionally, the applicant described the basis for the assumed temperature differences, which were based on physically bounding values. Based on the bounding input assumptions and verification of shutdown margin, the staff finds the input parameters used in the applicants analysis of the SIRCP event to be suitably conservative.

The staff concludes that the analysis described in DCD Tier 2 Section 15.4.4 conservatively shows that subcriticality is maintained for the startup of an inactive RCP in Modes 3 through 6.

Based upon the results of the analysis, the staff finds that SAFDLs are not exceeded for this AOO.

Since the reactor remains subcritical for this event, the applicant attributed the only increase in pressure to the energy added to the RCS due the RCP startup and potential heat transfer to the RCS from the SGs. The applicant identified startup of one RCP when a positive temperature difference between the SG secondary side and the reactor coolant exists as a limiting transient for the low temperature overpressure protection system (LTOP) in DCD Tier 2 Section 5.2.2.2.2.1. The adequacy of LTOP to mitigate this event is evaluated by the staff in Section 5.2.2 of this SER. When the RCS is at a pressure and temperature above the conditions requiring LTOP, overpressure protection is provided by the POSRVs and MSSVs.

The POSRVs and MSSVs, in conjunction with the reactor protection system, are designed to maintain the RCS below 110 percent of design pressure. Based upon the discussion in this paragraph, staff finds that the design conditions of the reactor coolant pressure boundary are not exceeded for this AOO.

There are no radiological consequences for this AOO.15-143

There are no COL information items associated with Section 15.4.4 of the APR1400 DCD.

Staff concludes that the plant design with regard to the SIRCP event is acceptable and meets the relevant requirements of GDCs 10, 15, 20, 26, and 28. This conclusion is based on the following:

1. The applicant met the requirement of GDCs 10, 20, and 26 with respect to demonstrating that SAFDLs are not exceeded for this event.

2. The applicant met the requirements of GDCs 15 and 28 with respect to ensuring that the design conditions of the reactor coolant pressure boundary are not exceeded.

This section is not applicable to the APR1400.

The boron dilution event is the result of a malfunction of the chemical and volume control system (CVCS) that causes the inadvertent addition of water with low boron concentration into the RCS and the failure of the operator to respond to indicators. This results in a positive reactivity addition to the core. The event is considered an AOO and needs to be considered for each mode of operation.

DCD Tier 1: There were no DCD Tier 1 entries for this area of review.

DCD Tier 2: The applicant has provided a DCD Tier 2 system description in DCD Tier 2, Section 15.4.6 that is summarized as follows:

The inadvertent decrease in reactor coolant boron concentration can be caused by an improper operator action or failure in the boric acid makeup flow path in which the boron concentration is less than the RCS concentration. Depending on the initial core state, the decrease in boron concentration can lead to a slow core power and RCS temperature increase or loss of shutdown margin leading to criticality. The operator can identify a boron dilution through an increase in average RCS temperature, a neutron flux alarm on the startup channel, reactor makeup flow rate, sampling or boric acid flow rate.

In the APR1400 design, boron dilution events are terminated by operator action. As given in SRP 15.4.6, the minimum time between the alarm time and loss of shutdown margin is 30 minutes for refueling and 15 minutes for all other operational modes. For this analysis, the applicant used a 30 minute alarm time for all operational modes.15-144

The applicant stated that transients initiated at power are terminated either by high power or high pressurizer pressure. Following the trip, more than 30 minutes is available before post-trip criticality is reached.

For Mode 3-5, the applicant calculated the minimum time to eliminate the COLR required shutdown margin and subtracted 30 minutes to set the alarm. DCD Tier 2 Table 15.4.6-1, Assumption and Results for Inadvertent Deboration Analysis, provides the operating parameters and conditions associated with each mode of operation. For Mode 6 boron dilution is not analyzed as the applicant stated that administrative controls are in place, including CVCS valve lockout, to isolate potential unborated water sources.

The applicant concluded that for cases where reactor power does not increase during the transient, barrier performance is bounded by the results of the inadvertent CVCS operation event documented in DCD Tier 2 Section 15.5.2, Increase in Reactor Coolant Inventory. For cases where the transient is initiated at power and reactor power increases, the applicant further stated that barrier performance is bounded by the results for the CEA withdrawal at power event documented in DCD Tier 2 Section 15.4.2, Uncontrolled Control Rod Assembly Withdrawal at Power.

For transients initiated at power, the applicant stated that the minimum DNBR is bounded by the CEA withdrawal at power event and remains above the 95/95 DNBR limit thereby maintaining fuel integrity. As reactor coolant system pressure remains below 110 percent of its system design pressure for all cases, the integrity of the RCPB is maintained. For all cases with the reactor shut down (or tripped), sufficient indications are available to alert the operator to the uncontrolled reactivity addition and sufficient time is available for the operators to diagnose the situation and take corrective action before criticality or post-trip return to criticality occurs.

ITAAC: The ITAAC associated with DCD Tier 2, Section 15.4.6 are given in DCD Tier 1, Sections 2.4.1, 2.4.5, and 2.4.6.

TS: The TS which affect boron mixing assumptions are in DCD Tier 2, Chapter 16, Technical Specifications, Sections 3.4.6, RCS Loops - Mode 4, 3.4.7, RCS Loops - Mode 5 (Loops Filled), and 3.4.8 (Loops Not Filled). Technical Specification 3.1.12, Unborated Water Source Isolation Valve - MODES 4 and 5, Technical Specification 3.9.7, Unborated Water Source Isolation Valves.

The relevant requirements of the NRC regulations for this area of review, and the associated acceptance criteria, are in NUREG-0800 Section 15.4.6, Inadvertent Decrease in Boron Concentration in the Reactor Coolant System (PWR), and are summarized below. Review interfaces with other SRP sections also can be found in NUREG-0800, Section 15.4.6.

GDC 10, as it relates to the reactor core and its coolant control and protection systems with appropriate design margin to assure that SAFDLs are not exceeded during any condition of normal operation, including the effects of AOOs.

GDC 13, as it relates to the availability of instrumentation to monitor variables and systems over their anticipated ranges to assure adequate safety and of appropriate controls to maintain these variables and systems within prescribed operating ranges.15-145

GDC 15, as it relates to the RCS and its auxiliary, control, and protection systems with sufficient design margin to assure that the design conditions of the RCPB are not exceeded during any condition of normal operation, including AOOs.

GDC 26, as it relates to the capability of control rods to reliably control reactivity changes to assure that under conditions of normal operation, including AOOs, and with appropriate margin for malfunctions like stuck rods, SAFDLs are not exceeded.

The applicant evaluated the boron dilution event for MODES 1-5 to ensure that operator action to terminate the transient within 30 minutes after receipt of an alarm is sufficient to preserve shutdown margin. The applicant did not evaluate the boron dilution event in Mode 6 because administrative controls lock out the portions of the CVCS system that would dilute the RCS.

In RAI 216-8221, Question 15.04.06-7, the staff asked for the basis for using administrative controls to prohibit Mode 6 dilution instead of an explicit TS note in LCO 3.9.1, Boron Concentration. In its response (ML15345A378), the applicant stated that TS 3.9.7, Unborated Water Source Isolation Valves, would be added under TS 3.9, Refueling Operations, which requires valves leading to unborated water sources to be secured in the closed position. The applicant provided revised TSs and TS Bases pages. The staff found the addition of Technical Specification 3.9.7 provides adequate controls to prevent an unanticipated Mode 6, refueling boron dilution event and hence is acceptable. The staff confirmed that this update was incorporated into the DCD; therefore, RAI 216-8221, Question 15.04.06-7, is resolved and closed. Additionally, in response to RAI 17-7917, Question 15.04.06-1, discussed below, the applicant provided TS 3.1.12, Unborated Water Source Isolation Valve-MODES 4 and 5, to isolate unborated water sources when the RCPs are idle. For MODES 1-5, the applicant used a conservative time to criticality, meeting the acceptance criteria of 30 minutes.

Modes 1 and 2 If the reactor is at power (Mode 1) under automatic rod control when the dilution begins, rods will be automatically inserted into the core in order to maintain the programmed RCS temperature. The applicant did not provide any discussion of control rods in automatic in DCD Tier 2, Section 15.4.6, Inadvertent Decrease in Boron Concentration in the Reactor Coolant System, so the staff issued RAI 216-8221, Question 15.04.06-2, requesting the applicant add a discussion describing the system response for control rods in automatic, what operator alarms or indicators are available, whether the initial boron concentration assumption corresponds to the start of the dilution or the time of reactor trip, and the calculated time to re-criticality. In response to RAI 216-8221, Question 15.04.06-2, dated December 11, 2016 (ML15345A378), the applicant stated that with control rods in automatic, the rods will insert during a boron dilution at power. When the control rods reach the power dependent insertion limit (PDIL), the operators will be alerted by the PDIL alarm. Continued insertion will lead to reactor trip and the core will have a minimum shutdown margin consistent with that used in Mode 3. Therefore, the Mode 1 required time to achieve re-criticality is greater than or equal to the Model 3 value. The staff agrees that the Mode 1 time to reach re-criticality is greater than or equal to the Mode 3 time as the same minimum shutdown margin is used in both analyses. As the Mode 3 time is greater than the 15 minutes given in SRP 15.4.6, the staff finds the Mode 1, control rods in automatic, evaluation acceptable.15-146

If the reactor is at power (Mode 1) under manual rod control when the dilution begins, reactor power and RCS average temperature will increase. The resulting transient is similar to a CEA bank withdrawal and results in a reactor trip if no action is taken to mitigate the dilution. If the unplanned dilution continues after the reactor is tripped, the reactor may return to criticality under hot zero power (HZP) conditions if no operator action is taken. In RAI 216-8221, Question 15.04.06-3, the staff asked if the initial boron concentration, and hence time to criticality, is based on the boron concentration at the start of the dilution or at the time of reactor trip and to provide the time to re-criticality. If the boron concentration at the start of the dilution is used, provide an explanation why it is conservative. In response to Question 15.04.06-3 dated December 11, 2015 (ML15345A378), the applicant responded that with control rods in manual, reactor power will increase and a reactor trip will occur. Following the reactor trip, the minimum shutdown margin is the same as Mode 3, hence the time to re-criticality is greater than or equal to the Mode 3 calculated time. As the Mode 3 time is greater than the 15 minutes given in SRP 15.4.6, the staff finds the Mode 1, control rods in manual, evaluation acceptable.

Therefore, RAI 216-8221, Question 15.04.06-3, is resolved and closed.

If the reactor is in a normal startup operation (Mode 2), reactivity is added by manual (planned) dilution or manual control rod withdrawal. An inadvertent dilution during this operation could result in a power escalation which is terminated by the high logarithmic power level trip.

Modes 3 through 5 In Modes 3-5, the minimum time to criticality is determined using Equation 15.4-3 in DCD Tier 2, Section 15.4.6.3.1, Evaluation Model, where the critical boron concentration for each mode is calculated assuming all rods inserted minus the worst stuck rod, accounting for calculation uncertainties. The initial boron concentration for Equation 15.4-3 is determined by assuming the mode dependent, minimum COLR shutdown margin and the inverse boron worth. From the time to criticality determined using Equation 15.4-3, 30 minutes is subtracted to set the source range monitoring ratio setpoint, thereby providing at least 30 minutes of operator warning time prior to criticality.

Evaluation Model No transient analysis model is used in this analysis. The approved ROCS reactor physics code, described in Sections 15.0.2 and 4.3 of this SER, is used to determine the mode dependent critical boron concentration and inverse boron worths. The time to criticality is determined by solving an ordinary differential equation which relates the time dependent change in RCS boron concentration to the initial RCS mass and charging rate of unborated water. The staff noted that Equation 15.4-1 of DCD Tier 2 Section 15.4.6.3.1, Evaluation Model, is missing an equal sign and issued RAI 216-8221, Question 15.04.06-4, to have the applicant correct the equation by updating the DCD (ML15259A829). The applicant responded (ML15345A378) by revising DCD Tier 2 Section 15.4.6.3.1, page 15.4-19 correcting equation 15.4-1. The staff finds the corrected Equation 15.4-1 acceptable and confirmed that this change was incorporated into the DCD; therefore, RAI 216-8221, Question 15.04.06-4, is resolved and closed. The initial RCS mass and charging rate can be combined into a boron dilution time constant which is minimized when the charging rate is maximized and the RCS volume minimized. The ordinary differential equation which describes the change in RCS boron concentration versus time assumes complete mixing of the RCS volume. The staff finds this assumption acceptable when at least one RCP is running in Modes 3, 4, and 5. The staff questioned whether complete mixing of the 15-147

RCS when on SDC with the RCPs idle (in Mode 4 and 5) was an appropriate assumption.

Accordingly, on May 26, 2015, the staff issued RAI 17-7917, Question 15.04.06-1 (ML15146A260), requesting the applicant to provide justification that the complete mixing model yields conservative times to criticality for Modes 4 and 5 without an RCP in service. The applicants final response, provided in letter dated September 1, 2017 (ML17244A657),

provided updates to the DCD and TS that (1) describe the addition of valve CV-1 to the reactor makeup water line to isolate the unborated water source, (2) add an LCO to ensure isolation of the unborated water source in MODES 4 and 5 when the RCPs are idle, and (3) modify the Section 15.4.6 of the DCD to reflect these changes. The staff finds this response acceptable because the proposed changes preclude the scenario where the perfecting mixing model was questioned. Based on its review of the DCD, the staff has confirmed incorporation of the changes described above; therefore, the staff considers RAI 17-7917, Question 15.04.06-1, resolved and closed.

Indications In Mode 1 with the control rods in automatic, rods will move to maintain Tavg within its set range.

RAI 216-8221, Question 15.04.06-2, given above, requested the applicant provide what indicators or alarms indicate a boron dilution. With control rods in automatic, the applicant responded that the operator is alerted by the PDIL alarm. For Mode 1 with rods in manual, indications include a high RCS temperature (Tavg) deviation alarm, pre-trip alarms on high power or under certain conditions, a high pressurizer pressure pre-trip. For Mode 2, pre-trip alarms include a high power or high logarithmic power, and for Modes 3, 4, and 5 when at least one RCP is running, the neutron flux alarm on the startup flux channel provides indication of a dilution event. The potential boron dilution issue is resolved for Modes 4 and 5 without an RCIP in service, as discussed above.

Assumptions The minimum time to criticality is a function of the unborated charging flow rate and the initial RCS mass. The unborated charging rate is maximized by aligning the charging pump suction to the reactor makeup water tank with a reactor makeup pump on and a failure of a valve in the boric acid makeup flow path isolating the borated water flow path to the charging pump. To minimize RCS mass the cold RCS volume and highest temperature allowed by TS for each operating mode was assumed. In Modes 4 and 5 with the RCS full and no RCP in service, the RCS volume is further reduced to account for possible flow stagnation above the upper guide structure support plate caused by the lower SDC pump flow rates. In Mode 5 with the RCS partially drained for maintenance the RCS volume is further reduced to account for mid-loop conditions. The staff reviewed DCD Revision 0, Tier 1 Table 2.4.6-4 (6 of 6), Chemical and Volume Control System ITAAC, ITAAC Item 9.a noting that a minimum charging pump flow rate is established but no maximum value is given. Since the dilution rate is a function of the maximum charging pump flow rate, the staff issued RAI 216-8221, Question 15.04.06-6, asking why a maximum acceptable ITAAC charging flow rate is not established. In response to Question 15.04.06-6, dated December 11, 2015 (ML15345A378), the applicant stated that ITAAC Item 9.d will be added to DCD, Tier 1 Table 2.4.6-4 (6 of 6), which limits the maximum charging capability to less than or equal to 567.8 L/min (150 gpm) with two charging flow restricting valves closed and 681.4 L/min (180 gpm) with one charging flow restricting valve closed. The staff finds the addition of ITAAC Item 9.d in Table 2.4.6-4 (6 of 6) acceptable as the maximum allowed charging flow rates correspond to the maximum dilution rates supported by 15-148

the applicants boron dilution analyses. The staff confirmed that this update was incorporated into the DCD; therefore, RAI 216-822, Question 15.04.06-6, is resolved and closed. The staff agrees that the applicant has assumed conservative values for the unborated charging mass flow rate and the minimal RCS mass for the Modes 3, 4, and 5 cases with the RCS full and at least one RCP. For Modes 4 and 5 with only one SDC pump in operation, the staff is unable to evaluate if the applicants assumptions of reduced mixing volumes are conservative based on the potential of incomplete mixing discussed in RAI 17-7917, Question 15.04.06-1.

Results Minimum Time to criticality The time to criticality for Modes 3-5 is given in DCD Tier 2, Table 15.4.6-1. As shown in this table, the applicant calculated a minimum time to criticality of 72.8 minutes for Mode 4 with all RCPs idle. The staff finds that the applicants results are well in excess of the minimum time required to satisfy SRP acceptance criteria.

Barrier Performance In DCD Tier 2, Section 15.4.6.4, Barrier Performance, the applicant states the pressure increase caused by the boron dilution event is bounded by the results for the inadvertent operation of the CVCS described in DCD Tier 2 Section 15.5.2 for cases where power does not increase. The staff agrees that inadvertent operation of the CVCS, which assumes a single failure of the pressurizer level control system (controller fails low or level setpoint fails high),

maximizes charging while minimizing letdown, thereby maximizing the pressure increase.

For at power cases, the applicant stated that the uncontrolled CEA withdrawal analysis evaluates a greater positive reactivity insertion rate than that achieved by the maximum boron dilution. Therefore, the uncontrolled CEA withdrawal will reach a higher power and hence a higher pressure. The staff notes that the uncontrolled CEA withdrawal events, as discussed in DCD Tier 2 Sections 15.4.1 and 15.4.2, are terminated by the VOPT which may not mitigate a slow reactivity event like an at power boron dilution, hence the CEA withdrawal events may not bound the at power boron dilution maximum pressure. Because the at-power boron dilution is a slow event, the high pressurizer pressure reactor trip will provide adequate over pressure protection such that the 110 percent of the design valve is not violated.

Fuel Integrity In DCD Tier 2, Section 15.4.6.6, Conclusions, the applicant states that the minimum DNBR is equal to or greater than the 1.29 limit. The staff could find no discussion for the basis of this conclusion, therefore the staff requested in RAI 216-8221, Question 15.04.06-5, that the applicant add information to the DCD which would support this conclusion. In the response to Question 216-8221, Question 15.04.06-5, dated December 11, 2015, (ML15345A378), the applicant stated that the reactivity insertion rate caused by a boron dilution at power is significantly less than those analyzed in the hot full power (HFP) and HZP CEA withdrawal events, as discussed in DCD Tier 2 Sections 15.4.2 and 15.4.1, respectively. The staff agrees that the reactivity insertion rate is significantly less than that assumed in the CEA withdrawal analyses but it is not clear the VOPT credited in mitigating the CEA withdrawal would mitigate a slow reactivity insertion event such as an at power boron dilution. Therefore, on August 1, 2016, the staff asked follow-up RAI 511-8668, Question 15.04.06-1 (ML16214A308) which 15-149

requested the applicant describe which reactor trip and the technical basis why that reactor trip would prevent violating the minimum DNBR under conditions of an at power boron dilution. The applicants response, provided by letter dated August 19, 2016 (ML16232A625), clarified that the CPC DNBR trip provides DNBR protection for slow reactivity insertion rates and the VOPT DNBR trip provides DNBR protection for more rapid reactivity insertion rates. Additionally, the applicant referenced analyses associated with the CEA withdrawal event, evaluated in Section 15.4.2 of this SER, which showed the minimum DNBR as a function of reactivity insertion rates and highlighted the corresponding RPS trip. Based on the analysis presented by the applicant that demonstrates adequate DNBR protection over the entire range of reactivity insertion rates achievable by the reactivity control system during an AOO, the staff finds the response acceptable.

There are no COL information items associated with Section 15.4.6 of the APR1400 DCD.

The applicant has demonstrated that the reactor coolant boundary pressure remains below 110 percent of the design value, fuel cladding integrity is maintained as the minimum DNBR remains above the limit and operator action times to prevent the loss of shutdown margin are greater than 30 minutes during refueling and 15 minutes in the other operating modes.

Therefore, based on the evaluation discussed above, the staff concludes that analysis for the decrease in the reactor coolant boron concentration event is acceptable and meets GDC 10, 13, 15, and 26 requirements.

Analysis of the inadvertent loading and operation of a fuel assembly in an improper position requires consideration of a spectrum of misloading events. The applicant must identify the limiting misloading event that is undetectable by in-core instrumentation. The kinds of errors that should be considered include loading of one or more fuel assemblies into improper locations and, where physically possible, with incorrect orientation. If burnable poison or fuel rods are added to or removed from fuel assemblies at the plant, errors in these processes must also be considered.

The applicant is also responsible for identifying changes in the power distribution in addition to increased local power density that may result from an inadvertent loading and operation of a fuel assembly in an improper position. There should also be provisions made to search for loading errors at the beginning of each fuel cycle.

Finally, the applicant considered the effect of misloaded fuel on nuclear design parameters, the detection of fuel-loading errors, and any operational restrictions that would assist in staying within fuel rod failure limits.

DCD Tier 1: There were no DCD Tier 1 entries for this area of review.15-150

DCD Tier 2: The applicant provided a DCD Tier 2 description in Section 15.4.7, summarized here as follows:

The barriers in place to mitigate the inadvertent loading and operation of a fuel assembly in an improper position are discussed, citing checks that take place when loading the fuel assemblies. The applicant identified each assembly has a unique serial number on the fuel assembly top plate, which is verified upon completion of fuel assembly loading.

For loading errors involving assemblies with significantly different reactivities, multiple means are available to detect the misloading. During BOC low power physics testing, the reactivity worths of symmetric CEAs are checked. The applicant noted that the misloading of assemblies with significantly different reactivities would affect the octant symmetric power distribution and lead to significant deviations in individual CEA worths. The other means to detect misloadings includes the use of in-core instrumentation during power ascension testing and the periodic measurements performed during the cycle.

The applicant conservatively analyzed the event as an AOO even though the acceptance criterion in SRP Section 15.4.7 considers the event to be a PA. The misloaded assembly only affects the core power distribution, therefore the applicant did not use a transient code in this analysis. DCD Tier 2 Section 4.3.3.1 describes the ROCS reactor physics code used to evaluate changes in the core power distribution. Changes in core power distribution do not affect total core power, flow or RCS pressure, hence RCPB integrity is not challenged. The applicant noted that changes in core power distribution affect local heat fluxes and hence affect the DNBR. The analysis demonstrated that the increase in peaking factor from the worst postulated undetectable misloading would not increase more than that assumed in the CEA drop analysis in DCD Tier 2 Section 15.4.3. Therefore, the applicant concluded that the DNBR value for this event is greater than the 95/95 DNBR limit given in DCD Tier 2 Section 4.4 and no fuel rod failures are predicted for this event.

ITAAC: There are no ITAAC associated with a misloading of an assembly.

TS: There are no TS associated with the misloading of an assembly.

The relevant requirements of NRC regulations for this area of review, and the associated acceptance criteria, are given in NUREG-0800 Section 15.4.7, Inadvertent Loading and Operation of a Fuel Assembly in an Improper Position, and are summarized below. Review interfaces with other SRP sections also can be found in NUREG-0800, Section 15.4.7.

GDC 13, as it relates to providing instrumentation to monitor variables over anticipated ranges for normal operations, AOOs, and accident conditions.

10 CFR 52.47(a)(2)(iv)(A) and (B), as they relate to the evaluation and analysis of the radiological consequences of postulated accidents such as resulting from reactor operations with an undetected fuel assembly into improper position.15-151

The applicant described the inadvertent loading of an assembly in an improper location as a very unlikely event due to the procedural controls used during core loading, and the verification, by assembly serial number, once core loading is complete. Though inadvertent loading and operation of a fuel assembly in an improper position is considered a PA, the applicant conservatively used the AOO acceptance criteria given in DCD Tier 2 Section 15.0.0.1.1, Normal Operation and Anticipated Operational Occurrences.

If a misloading does occur, the consequence depends on the reactivity difference between the interchanged assemblies, with large differences potentially degrading core thermal margins.

The applicant stated for large reactivity differences there are multiple means of detecting a misloading, such as symmetric CEA worth comparisons performed during low power physics testing, excore detectors measuring quadrant flux differences, and incore measurements performed at low powers following plant startup and throughout the remainder of the cycle. The staff agrees these methods would detect the majority of misloaded assemblies which have large reactivity differences.

The applicant noted that there are some misloadings which cannot be detected by the aforementioned means, and hence are analyzed for their effect on thermal margins.

DCD Tier 2 Section 15.4.7.2, Sequence of Events and Systems Operation, states that the worst case undetectable misloading at BOC would be the interchange of a shimmed with an unshimmed assembly at the core center. DCD Tier 2 Section 15.4.7.3.2, Input Parameters and Initial Conditions, states the worst undetectable misloading at startup (i.e., BOC) is the interchange of Assemblies 12 and 24. The staff notes that assembly locations 12 and 24 are near the core periphery as shown in DCD Tier 2 Figure 15.4.7-1, Location of the Worst-Case Misloading. This apparent discrepancy led the staff to ask RAI 388-8502, Question 15.04.07-1, to clarify the worst location of the misloaded assemblies. In response to RAI 388-8502, Question 15.04.07-1 (ML16055A014), the applicant provided a revised DCD Tier 2, page 15.4-24 which deleted the words at the core center and clarified the worse undetectable BOC misloading is the interchange of Assemblies 12 and 24. The staff finds this response acceptable and confirmed the incorporation of the revised Tier 2 DCD text in the DCD; therefore, RAI 388-8502, Question 15.04.07-1, is resolved and closed.

Though not detectable at BOC, the misloaded assembly, either the BOC shimmed/unshimmed, or the swapping of Assemblies 12 and 24, would be detected by measuring the planar radial peaking factors once every 31 effective full-power days per TS 3.2.2, Planar Radial Peaking Factors. If the measured peaking factor were larger than the installed COLSS and CPC values, the measured values would be installed and the plant operating margins reduced.

Therefore, the applicant stated that only the change in maximum planar peaking factors between incore measurements needs to be evaluated. The staff agrees with the applicant, as misloading of assemblies with significant differences in measured powers from the planned loading pattern would be detected by the required surveillance associated with TS 3.2.2, Planar Radial Peaking Factors.15-152

No transient codes are used in this analysis as only local peaking factors are affected. The approved ROCS physics code, as discussed in Section 4.3 of this SER, is used to calculate the change in peaking factors for the misloadings evaluated.

In DCD Tier 2 Section 15.4.7.3.3, Results, the applicant states that maximum increase in planer peaking factor due to misloading is less than 15 percent, including measurement uncertainties. It is unclear to the staff if the 15 percent increase is between incore measurements or the maximum change during the cycle between the as-designed and misloaded loading patterns. The staffs concern is that consecutive differences of 15 percent between incore measurements could eventually lead to a total percentage difference greater than the 20.5 percent analyzed in the DCD Tier 2, Section 15.4.3, Control Element Assembly Misoperation. Therefore, the staff asked in RAI 388-8502, Question 15.04.07-2, for the applicant to clarify what the 15 percent change is in relation to. In the response to RAI 388-8502, Question 15.04.07-2 (ML16055A014), the applicant stated that the 15 percent is the maximum change of Fxy during the cycle between the as-designed core and the misloaded loading pattern. Furthermore, the applicant provided revised DCD Tier 2 Section 15.4.7.3.3 text (page 15.4-25) which clarifies that 15 percent is the total allowed difference between the measured and as-designed core peaking factor. The staff finds the 15 percent total allowed difference acceptable as it is bounded by the Fxy peaking factor increase analyzed in the CEA drop analysis in DCD, Tier 2, Section 15.4.3. The staff confirmed that the proposed revision to DCD Tier 2 Section 15.4.7.3.3 was incorporated into the DCD. Therefore, RAI 388-8502, Question 15.04.07-2, is resolved and closed.

The applicant compared a 15 percent increase in peaking factor due to the misloaded assemblies with the 20.5 percent increase caused by a CEA drop. The CEA drop analysis, given in DCD Tier 2, Section 15.4.3 demonstrates the DNBR is greater than the 95/95 limit and hence bounds the DNBR results of the inadvertent loading of a fuel assembly.

Barrier performance The applicant noted that this event only causes a local change in heat flux; RCS power, temperature and flow are unchanged and hence the there is no change in RCS pressure. The staff agrees that RCS pressure does not change and only local peaking factors are affected by the misloaded assembly; therefore, pressure boundary integrity is not challenged.

Fuel Integrity As previously stated in this SER, the CEA drop analysis assumes a 20.5 percent increase in peaking factor, which bounds the 15 percent change from the worst misloaded assembly. The CEA drop analysis demonstrates that the DNBR remains above the 1.29 limit and hence the staff agrees that fuel integrity for worst misloaded assembly is not challenged.

There are no COL information items associated with Section 15.4.7 of the APR1400 DCD.15-153

The staff has evaluated the consequences of a postulated fuel loading error. The staff concludes that the applicant meets GDC 13 by providing acceptable procedures and design features that will minimize the likelihood of loading fuel in a location other than its designated place. Additionally, a misloading of an assembly is detectable using available instrumentation and TS required surveillances, and mitigating actions are possible prior to exceeding the peaking factor increase analyzed in the CEA drop analysis of DCD Tier 2, Section 15.4.3. The DCD Tier 2 Section 15.4.3, CEA drop analysis used AOO acceptance criteria (DNBR above limit, no centerline melt and RCS pressure below 110 percent of design), hence the staff has reasonable assurance that no fuel failures will occur and the offsite doses will be a small fraction of 10 CFR 52.47(a)(2)(iv)(A) and 10 CFR 52.47(a)(2)(iv)(B). The radiological consequences of this event are bounded by the rod ejection accidents evaluated in DCD Tier 2 Section 15.4.8.5, Radiological Consequence.

The applicant postulated the ejection of a CEA as a result of a mechanical failure that causes an instantaneous circumferential rupture of the CEDM. The CEA ejection (CEAE) adds positive reactivity to the core which results in a rapid power increase for a short period of time. The power rise is limited by the Doppler feedback. Reactor shutdown is initiated by the RPS upon receipt of a VOPT shortly after the CEA ejection. This event is classified as a PA in DCD Tier 2 Table 15.0-5. This classification is consistent with the SRP.

DCD Tier 1: There are no DCD Tier 1 entries for this area of review.

DCD Tier 2: The applicant provided DCD Tier 2 information, summarized here, as follows:

The applicant analyzed the CEAE event using 4 different initial powers: HFP, 50 percent power, 20 percent power, and HZP. A LOOP is assumed to occur coincident with the turbine trip. The applicant evaluated the event using several codes, including the ROCS code to determine the peaking factors and limiting CEA worth during the CEAE event. The applicant obtained the NSSS response using CESEC-III, and used CETOP and STRIKIN-II to perform the DNBR calculation. STRIKIN-II was also used to calculate the fuel rod enthalpy during the CEA ejection event. DNBR calculations utilized the KCE-1 CHF correlation. The applicant used a statistical convolution method to determine the number of fuel rods that experience a DNB. No fuel failures were attributed to high fuel enthalpy or pellet clad mechanical interaction (PCMI).

The applicant noted that the total number of predicted fuel failures, all associated with DNB, is bounded by the assumed value of 10 percent which is used in the evaluation of radiological consequences for the CEA ejection event.

ITAAC: There are no ITAAC items for this area of review.

TS: The following TS are applicable to this event:

LCO 3.1.5, Control Element Assembly Alignment.15-154

LCO 3.1.6, Shutdown Control Element Assembly Insertion Limits.

LCO 3.1.7, Regulation Control Element Assembly Insertion Limits.

LCO 3.4.1, Pressure, Temperature, and Flow Limits.

The relevant requirements of NRC regulations for this area of review, and the associated acceptance criteria, are in NUREG-0800 Section 15.4.8, Spectrum of Rod Ejection Accidents (PWR). Applicable regulations are summarized below.

GDC 13, as it relates to the availability of instrumentation to monitor variables and systems over their anticipated ranges to assure adequate safety, and of appropriate controls to maintain these variables and systems within prescribed operating ranges.

GDC 28, as it relates to the effects of postulated reactivity accidents that result in neither damage to the reactor coolant pressure boundary greater than limited local yielding nor sufficient damage to impair significantly core cooling capacity.

10 CFR 52.47(a)(2)(iv)(A), 10 CFR 52.47(a)(2)(iv)(B), and GDC 19, as they relate to the evaluation and analysis of the radiological consequences of postulated accidents.

The applicant proposed the following acceptance criteria for the CEA ejection event:

1. The maximum reactor pressure during any portion of the assumed excursion is less than the value that result in stresses that exceed the Service Limit C as defined in the ASME Code.

2. The total number of failed fuel rods that are considered in the radiological assessment is equal to the sum of all the fuel rods failing each of the criteria below:

a. The high cladding temperature failure criterion for zero-power conditions is a peak radial average fuel enthalpy greater than 711.8 kJ/kg (170 cal/g) for fuel rods with an internal rod pressure at or below system pressure, or 628.0 kJ/kg (150 cal/g) for fuel rods with an internal rod pressure exceeding system pressure. For intermediate and full-power conditions, fuel cladding failure is presumed if local heat flux exceeds thermal design limits.

b. The PCMI failure criterion is a change in radial average fuel enthalpy greater than the corrosion-dependent limit depicted in the SRP, Section 4.2, Appendix B, Figure B-1.

3. Peak radial average enthalpy remains below 963.0 kJ/kg (230 cal/g).

4. Peak fuel temperature remains below incipient melting conditions.15-155

5. Mechanical energy generated as a result of non-molten fuel-to-coolant interaction and fuel rod burst must be addressed with respect to reactor pressure boundary, reactor internals, and fuel assembly structural integrity.

6. There is no loss of coolable geometry due to fuel pellet and cladding fragmentation and dispersal or fuel rod ballooning.

The staff reviewed the applicants proposed acceptance criteria and found them to be acceptable based on them being consistent with the acceptance criteria identified in the SRP.

The following clarifies the conformance between the applicants proposed acceptance criteria and the acceptance criteria identified in the SRP. The applicants proposed acceptance criterion 1 is consistent with SRP Section 15.4.8.II acceptance criterion 2. The applicants proposed acceptance criterion 2 is consistent with the fuel cladding failure criteria specified in SRP Section 4.2 Appendix B. The applicants acceptance criteria 3-6 are consistent with the core coolability criteria specified in SRP Section 4.2 Appendix B.

The evaluation model is shown in Technical Report APR1400-Z-A-NR-14006, Non-LOCA Safety Analysis Methodology, referenced in DCD Tier 2 Section 15.0.2. The non-LOCA technical report references the Combustion Engineering CEAE evaluation model which was previously reviewed and approved by the staff in CENPD-190-A, CE Method for Control Element Assembly Ejection Analysis (non-public). The applicant used several codes in the evaluation model for the CEAE event including CESEC-III, ROCS, CETOP, and STRIKIN-II.

Additionally, the statistical convolution method is used to determine the number of fuel pins that experience DNB.

ROCS The applicants methodology uses a core design code, ROCS, to determine the reactivity worth of the ejected CEA, and the pre and post ejected radial peaking factors. The staffs review and evaluation of the applicability of the ROCS code to the APR1400 core design is in Section 4.3 of this SER.

CESEC-III The applicant used CESEC-III to calculate the peak pressure in the RCS and SGs. Leakage through the ejected CEA nozzle is not credited in the evaluation of the CEAE event which produces a conservatively high value for the peak RCS pressure. The staffs review and evaluation of the applicability of CESEC-III to the APR1400 is in Section 15.0.2 of this SER.

CETOP The applicant used CETOP, along with the KCE-1 CHF correlation, to determine the minimum DNBR. For the purposes of the CEAE event, CETOP is used to adjust the hot channel flow factor in the STRIKIN-II such that the MDNBR calculated by STRIKIN-II is conservative. The staffs review and evaluation of the applicability of CETOP to the APR1400 is in Section 15.0.2 of this SER.15-156

STRIKIN-II The applicant used STRIKIN-II, along with the KCE-1 CHF correlation, to evaluate DNBR and calculate the fuel enthalpy during the CEAE event. To ensure a conservative DNBR calculation by STRIKIN-II, the hot channel flow factor is reduced until the MDNBR produced by STRIKIN-II is conservative with respect to CETOP. Additionally, the increase in RCS pressure resulting from the CEAE event is not credited which produces a conservatively low value for DNBR. The staffs review and evaluation of the applicability of STRIKIN-II to the APR1400 is in Section 15.0.2 of this SER.

Statistical Convolution The applicant uses the statistical convolution method to calculate the number of fuel rods that will experience DNB. The staff approved this method as part its review of CENPD-183-A, CE Methods for Loss of Flow Analysis. The approval letter for CENPD-183-A states the condition that if a CHF correlation other than CE-1 is used for DNBR calculations, the applicant is required to submit a fuel damage probability distribution for the staffs approval. However, the applicant did not provide either a fuel damage probability distribution for use with KCE-1 CHF correlation or the data used to develop the damage probability distribution. Therefore, on December 17, 2015, the staff issued RAI 340-8395, Question 15.04.08-1, requesting the applicant submit the fuel damage probability distribution and the data used to develop the damage probability distribution (ML15351A301). The applicants response, provided in letter dated January 12, 2016 (ML16012A534) provided the fuel damage probability distribution and input parameters used in the development of the fuel damage probability distribution. The staff reviewed the distribution by comparing the inputs with the data provided in topical report APR1400-F-C-TR-12002, KCE-1 Critical Heat Flux Correlation for PLUS7 Thermal Design, comparing the fuel damage probability distribution to the previously approved distribution for CE-1 fuel, and performing confirmatory analysis. The distribution developed by the applicant used the measured-to-predicted KCE-1 CHF data from APR1400-F-C-TR-12002 and included additional conservatism to account for uncertainties associated with the calculation of local fluid conditions and heat flux. The distribution developed by the applicant was shown to be more limiting than the distribution developed for CE-1 fuel and conservative with respect to the staffs independently calculated distribution. Based on the information discussed above, the staff finds the fuel damage failure probability distribution provided by the applicant to be suitably conservative and considers RAI 340-8395, Question 15.04.08-1, resolved and closed.

Based upon the use of codes that have been found to be applicable to the APR1400 design and the use of a synthesis method which has been previously reviewed and approved, the staff finds the evaluation model for the APR1400 CEAE event to be suitably conservative.

The applicant analyzed peak RCS pressure, fuel rod DNB, and fuel rod temperature and enthalpy. The reactivity insertions associated with a CEAE event initiating at HZP, 20 percent power, 50 percent power, and HFP are provided in Table 15.4.8-1. The staff performed confirmatory analyses as part of the review, which included the calculation of ejected CEA worth. The ejected CEA worth obtained from the staffs calculations were smaller (i.e. less reactive CEA) than the values obtained by the applicant. Based on the conservative values used for the reactivity insertion and the spectrum of initial powers evaluated, the staff finds the reactivity insertion values and spectrum acceptable.15-157

The applicant applied a CEAE ejection time of 0.05 seconds which is based on an analysis that assumes a 17.24 MPa (2,500 psi) differential pressure across the pressure boundary and no viscous or drag forces on the ejected CEA. The staff agrees that this approach produces a conservatively low estimate for the CEA ejection time. However, parametric studies conducted in CENPD-170-A demonstrate that for full power initial conditions a longer ejection time results in a larger net energy rise. Accordingly, on December 17, 2015, the staff issued RAI 340--8395, Question 15.04.08-2, requesting the applicant explain how the use of a 0.05 second ejection time is suitably conservative for all cases of the CEA ejection event. The applicants response, provided in letter dated January 12, 2016 (ML16012A534) contained a sensitivity analysis that demonstrated a longer CEA ejection time had a negligible impact on the analysis acceptance criteria. Therefore, the staff considers RAI 340-8395, Question 15.04.08-2, resolved and closed.

The applicant selected input parameters to produce the most adverse consequences.

SER Tables 15.4.8-2, 15.4.8-3, and 15.4.8-4 provide these input parameters for RCS peak pressure, fuel rod DNB analysis, and fuel rod temperature and enthalpy analysis, respectively.

The staffs evaluation of the input parameters is provided in the referenced tables and in the paragraphs below.

During an audit, the staff observed that the applicant did not perform the DNBR analysis at HFP conditions, but at 95 percent of rated thermal power (ML17013A130, July 16, 2016).

Accordingly, on December 17, 2015, the staff issued RAI 340--8395, Question 15.04.08-3, requesting the applicant to explain why DNBR analysis was not performed above 95 percent rated thermal power for the CEA ejection event (ML15351A301). The applicants response, provided in letter dated January 12, 2016 (ML16012A534) clarified that the 95 percent power case is limiting because the required overpower margin (ROPM) is the same for all powers above 95 percent rated thermal power, but the power dependent insertion limit is deeper at 95 percent rated thermal power than at 100 percent rated thermal power causing a greater reactivity insertion. Additionally, the applicant clarified that the MTC is slightly positive at 95 percent rated thermal power. The staff finds the applicants justification acceptable because a greater reactivity insertion at the same ROPM will result in a limiting DNBR. Therefore, the staff considers RAI 340-8395, Question 15.04.08-3, resolved and closed.

Additionally, during the audit, the staff observed that the DNBR and fuel enthalpy analyses for the CEAE event treat the post-ejected axial power shape in the hot channel differently (ML17013A130, July 16, 2016). Accordingly, on December 17, 2015, the staff issued RAI 340-8395, Question 15.04.08-4, requesting the applicant explain how the treatment of the axial power shape is suitably conservative for each analysis (ML15351A301). The applicants response, provided in letter dated January 12, 2016 (ML16012A534) clarified that using the pre-ejected axial power shape in the average channel minimizes the Doppler feedback, which the staff agrees is conservative. The applicant further clarified that both the DNBR and fuel enthalpy analyses capture the change in axial power shape, but in different ways. The DNBR analysis uses the post-ejected axial power shape to directly capture the axial power variation in the hot channel, but this affect is captured in the fuel enthalpy analysis by using a 3-D power peaking factor. The staff finds this response acceptable as both methods adequately account for the impact of the axial power shape change in the hot channel. Therefore, the staff considers RAI 340-8395, Question 15.04.08-4, resolved and closed.15-158

Table 15.4.8-1 Ejected CEA worths for the initial powers considered for the CEAE event.

Initial Power Ejected CEA Worth Basis HFP 0.1459 % Max rod worth at HFP

($0.3541) considering power dependent insertion limit (PDIL) 50% power 0.2578 % Max rod worth at 50% power

($0.6257) considering PDIL 20% power 0.3711 % Max rod worth at 20% power

($0.9007) considering PDIL HZP 0.4469 % Max rod worth at HZP is

($1.0847) 0.3724 %. This value is conservatively increased by 20% to induce a prompt critical transient.15-159

Table 15.4.8-2 Initial conditions and input parameters for the peak pressure analysis of the CEAE event Parameter Value Basis Core power 4,062.66 (HFP = 102% of Sensitivity studies performed Rated Thermal Power) at HZP, 20%, and 50% initial power conditions resulted in lower peak pressures.

Fuel gap conductance Max conductance from Increases heat transfer from FATES fuel. Conservatism of approach for peak pressure analysis verified via sensitivity study.

Pressurizer pressure 16.03 MPa (2,325 psia) Large initial pressure maximizes peak pressure during event.

RCS flow rate 95% of nominal Low initial RCS flow minimizes heat transfer to secondary, which increases RCS pressure Pressurizer pressure control Heaters full on, no credit for Maximizes primary and spray secondary pressures Initial core inlet temperature 295 ºC (563 ºF) Maximizes primary and secondary pressures Neutron kinetics parameters End of Cycle, = 0.00412 Small delayed neutron fraction results in a larger power increase which maximizes the peak pressure and fuel enthalpy, minimizes DNBR Moderator temperature Most positive (0 at Hot Full Maximize power increase coefficient Power) and peak pressure Fuel temperature coefficient Least negative (Beginning of Minimize negative reactivity Cycle) feedback.

Scram worth -5.0 % Minimum scram worth assuming two CEAs do not enter the core (i.e., one ejected and one stuck)15-160

Table 15.4.8-3 Initial conditions and input parameters for DNBR analysis of the CEAE event Parameter Value Basis Initial core power 95%, 50%, 20%, and HZP Spectrum includes zero, intermediate, and full power.

Consistent with SRP and previously approved CEA ejection analyses.

Pressurizer pressure 15.00 - 16.03 MPa Limiting results obtained via (2,175 - 2,325 psia) sensitivity studies Core inlet temperature 295 ºC (563 ºF) High temperature minimizes DNBR Pre and post ejected radial Obtained from steady-state Methodology consistent with peaking factors spatial kinetics code (ROCS) CENPD-190-A.

with a multiplier to account Uncertainty obtained from for code uncertainty physics biases and uncertainties report.

Axial power shape Most top peaked Minimizes DNBR Post ejected axial power Accounts for power shape shape used in hot channel shift.

Pre-ejected axial power Use of pre-ejected axial shape used in average power shape in average channel channel decreases Doppler feedback Scram worth See Table 15.4.8-2 See Table 15.4.8-2 Fuel gap conductance Max conductance from Maximizes heat flux, FATES minimizes DNBR Neutron kinetics parameters See Table 15.4.8-2 See Table 15.4.8-2 Moderator temperature Most positive Maximize positive reactivity coefficient 0.45 pcm/ºC (0.25 pcm/ºF) feedback at 95 Percent power 4.5 pcm/ºC (2.5 pcm/ºF) at 50 Percent power 7.2 pcm/ºC (4.0 pcm/ºF) at 20 Percent power 9.0 pcm/ºC (5.0 pcm/ºF) at HZP 15-161

Parameter Value Basis Fuel temperature coefficient Least negative Minimize Doppler feedback RCS flow rate 50% Power set by ROPM Low initial RCS flow minimizes DBNR

< 50% Power, minimum Tech. Spec. flow 15-162

Table 15.4.8-4 Initial conditions and input parameters for fuel enthalpy analysis of the CEAE event Parameter Value Basis Core power HFP, 50%, 20%, and HZP Spectrum includes zero, intermediate, and full power.

Consistent with SRP and previously approved CEA ejection analyses.

Pressurizer pressure 15.00 MPa (2,175 psia) Fuel enthalpy calculation not sensitive to this parameter Core inlet temperature 295 ºC (563 ºF) High temperature increases fuel rod temperature RCS flow rate 69.635 x 106 kg/hr 95% of Minimum core design (153.52 x 106 lbm/hr) flow from DCD Tier 2 Table 4.4-7 Minimize flow to impede heat transfer from fuel Moderator temperature Most positive Maximize positive reactivity coefficient 0.0 pcm/F at HFP feedback 2.5 pcm/F at 50% Power 4.0 pcm/F at 20% Power 5.0 pcm/F at HZP Fuel temperature coefficient See Table 15.4.8-3 Minimize Doppler feedback Neutron kinetics parameters See Table 15.4.8-2 See Table 15.4.8-2 Fuel gap conductance Max conductance from Minimizes Doppler feedback FATES for average fuel rod Min conductance from Maximizes fuel enthalpy in FATES for hot fuel rod hot rod Pre and post ejected radial Maximum post ejected radial Maximizes fuel enthalpy peaking factors peaking factor is used.

Pre ejected radial peaking Maximizes fuel enthalpy rise factor is calculated by for PCMI considerations.

combining the max post-ejected radial peaking factor with max pre-post radial peaking factor ratio.15-163

Parameter Value Basis Axial power shape Most top peaked Maximize energy content in the hottest fuel pellet.

Pre-ejected axial power Accounts for power shape shape used in average and shift.

hot channel. 3-D power peaking factor is used to capture axial variation in hot channel.

Scram worth See Table 15.4.8-2 See Table 15.4.8-2 The applicant credited RPS actuation on VOPT and operator action for the mitigation of the CEAE event. The VOPT setpoint is given by the equation below. During an audit, the staff observed that the applicants input values for the VOPT safety analysis setpoint includes additional margin over the values provided in DCD Tier 2 Table 7.2-4 (ML17013A130, July 16, 2016). In addition, the applicant applies an [EXCORE PENALTY] value to account for potential deficiencies in the excore detector response during the CEAE event. A description of how these values were obtained was not provided in the APR1400 DCD. Accordingly, on December 17, 2015, the staff issued RAI 340-8395, Question 15.04.08-5, requesting the applicant explain how the values for [CEILING] and [STEP] that are used in the safety analysis sufficiently account for uncertainty, and to explain how the value for [EXCORE PENALTY] is suitably conservative (ML15351A301). The applicants response, provided in letter dated January 12, 2016 (ML16034A074), states that the [CEILING] value used in the safety analysis includes the total channel uncertainty and the [STEP] value used in the safety analysis includes the periodic test error. Additionally, the applicant clarified that the value for [EXCORE PENALTY] is obtained by performing ROCS calculations to determine the detector signals. The applicant selected the limiting detector to be the detector reading the lowest power and used it to calculate a decalibration factor, which represents the error in reactor power as determined by the excore neutron detectors. The applicants analysis showed the decalibration factor is bounded by the

[EXCORE PENALTY] value used in the safety analysis. The staff finds the applicants response acceptable because it describes a conservative method for modeling the VOPT response.15-164

CEILING EXCORE PENALTY

, Power 95%

INITIAL POWER LEVEL setpoint INITIAL POWER LEVEL STEP EXCORE PENALTY

, Power 95%

INITIAL POWER LEVEL

with, CEILING 116.5%

STEP 14%

EXCORE PENALTY 11%

The applicant credited operator action to initiate a cooldown 30 minutes into the event for the mitigation of the CEAE event. Crediting operator action 30 minutes into the event is consistent with the description in DCD Tier 2 Section 15.0.0.6.

Additional considerations for the analysis of the CEAE event include LOOP, single failure, and the impact of TCD. The applicant assumes a LOOP occurs in the analysis of the CEAE event.

The staff agrees that this assumption is conservative because heat removal from the fuel and heat transfer to the SG will decrease due to the lower RCS flow rate. The applicant assumes a single failure for the CEAE event to be one train of RPS. Additionally, the applicant assumes the pressurizer pressure control system to fail in the most adverse way in the peak pressure analysis. The staff finds the single failure treatment acceptable because the conservative modeling of the VOPT setpoint bounds the impact of a single failure associated with an excore detector and the failure of the pressurizer pressure control system will result in a bounding peak pressure analysis.

Evaluation of the CEAE event consists of separate analyses that analyze peak pressure, DNBR, and fuel rod enthalpy. The applicant evaluated the impact of TCD on the CEAE event and determined that the effect of TCD increases Doppler feedback which decreases heat flux from the fuel. Therefore, the applicant concluded, and the staff agrees, that neglecting the impact of TCD on the peak pressure and DNBR analyses is conservative. The applicant determined that TCD does have a significant effect on the fuel enthalpy analysis. In letter dated August 11, 2017 (ML17223B382), the applicant provided updates to the DCD that addressed the impact of TCD on the fuel rod enthalpy analysis for the CEA ejection event. To account for TCD, the applicant applies a penalty to the FATES3B calculated fuel centerline temperature as described in APR1400-F-M-TR-13001. Then the applicant adjusts the pellet thermal-conductivity multiplier in STRIKIN-II to increase the fuel temperature to be consistent with the penalized value from FATES3B. Based on the application of an acceptable penalty, as described in the staffs SER for the PLUS7 fuel topical report (ML17348A156), in the STRIKIN-II analysis, NRC finds this approach acceptable.15-165

The applicants analysis shows that maximum core power is reached within a second from initiation of the CEAE event and is limited by Doppler feedback. Additionally, the applicants analysis shows control rods begin to drop into the core at approximately 1 second, and within 4 seconds the control rods have inserted sufficient negative reactivity to bring the reactor to a subcritical condition. Post reactor trip, the applicant credited steam relief through the MSSVs to remove decay heat until operator action is initiated 30 minutes into the event to initiate a reactor cooldown.

Peak Pressure The staff observed in an audit that the applicant performed sensitivity studies that showed the HFP case resulted in the largest peak pressures in the RCS and SGs (ML17013A130, July 16, 2016). The applicant calculated peak pressures in the RCS and main steam system to be 17.41 MPa (2,525 psia) and 8.84 MPa (1,283 psia), respectively. The staff notes that the calculated peak pressures in the RCS and main steam system are both under 110 percent of their respective design pressures and are well below Service Limit C stresses. Based on the results of the applicants analysis, the staff finds the analysis of the CEAE event for the APR1400 meets the peak pressure acceptance criteria.

DNBR The applicant performed the DNBR calculations at initial conditions corresponding to HZP, 20 percent power, 50 percent power, and 95 percent power. The applicant stated that 10.0 percent of the fuel is calculated to undergo DNB. During an audit, the staff verified that the calculated percentage of fuel failure due to DNB is less than 10.0 percent for all cases (ML17013A130, July 16, 2016). The staff finds that assuming 10.0 percent of the fuel fails due to DNB is conservative because 10.0 percent bounds the values calculated by the applicant for all initial conditions.

Fuel Rod Enthalpy In a letter dated August 11, 2017 (ML17223B382), the applicant provided updates to the DCD that addressed the impact of TCD on the fuel rod enthalpy analysis for the CEA ejection event.

The applicants updated analyses were performed at initial conditions corresponding to HZP, 20 percent power, 50 percent power, and HFP. The applicants analysis at HZP demonstrated the radial average fuel enthalpy is well below 150 cal/g, which corresponds to the zero power high cladding temperature failure criterion with internal rod pressure greater than system pressure.

Additionally, the applicants analyses for all cases exhibit a prompt enthalpy rise less than 60 cal/g, which corresponds to the lowest PWR PCMI fuel cladding failure criteria of SRP 4.2 Appendix B. Furthermore, staff compared the applicants results to the acceptance criteria provided in Draft Regulatory Guide DG-1327 (ML16124A200) and determined that the applicants analysis shows that the peak radial average fuel enthalpy and peak radial average fuel enthalpy rise criteria remain below cladding failure criteria.

Acceptance criteria related to core coolability include peak fuel enthalpy, incipient melting, fuel pellet and cladding fragmentation, and fuel rod ballooning. The peak fuel enthalpy calculated by the applicant was found by the staff to be well below the 230 cal/g acceptance criteria for all cases of the CEAE event, and the peak fuel temperature calculated by the applicant was found 15-166

by the staff to be well below incipient melting for all cases. Experimental data in Technical and Regulatory Basis: Interim Acceptance Criteria and Guidance for the Reactivity-Initiated Accident, (ML070220400) demonstrates no fuel dispersal in UO2 fuel for a pulse width above 10 ms. Because the smallest pulse width calculated by the applicant, approximately 200 ms for the HZP case, is an order of magnitude larger than when fuel dispersal is observed, the staff concludes that that there is no concern of fuel dispersal due to the CEAE event for the APR1400. Additionally, the applicant stated that fuel temperature does not increase to cause fuel rupture or significant rod ballooning. In an audit, the staff observed the results of the applicants calculations and observed that the fuel enthalpy analysis for the CEAE event showed that peak rod internal pressure remained below system pressure during the time period that DNB occurs. Therefore, the staff concludes that the potential for rod ballooning and the associated DNB propagation is precluded.

The applicant calculated peak pressures in the RCS and main steam system are both under 110 percent of their respective design pressures and are well below Service Limit C stresses. Additionally, the applicant concluded and the staff agrees that all fuel failures associated with the CEAE event are attributed to DNB. Based on the applicants analysis and the staffs evaluation above, the staff finds that the pressure surge associated with the CEAE event remains below Service Limit C stresses, and assuming 10 percent of the fuel fails during the CEAE event conservatively bounds the number of fuel failures.

The radiological consequences for the CEAE event are in DCD Tier 2 Table 15.4.8-5. The evaluation of the dose calculations and their acceptability with respect to 10 CFR 52.47(a)(2)(iv)(A), 10 CFR 52.47(a)(2)(iv)(B), and GDC 19 is documented in Section 15.0.3 of this SER.

There are no COL information items associated with Section 15.4.8 of the APR1400 DCD.

The staff concludes that the analysis for the spectrum of CEA ejection accidents is acceptable and meets GDC 13 and 28 requirements. This conclusion is based on the following findings:

The applicant met GDC 13 requirements by demonstrating that all credited instrumentation is available, and that actuation of protection systems occurred at values of monitored parameters that were within the operating ranges of the prescribed instruments.

The applicant met GDC 28 requirements for prevention of postulated reactivity accidents that could result in damage to the reactor coolant pressure boundary greater than limited local yielding or result in sufficient damage to impair the core cooling capability significantly. The requirements are met by a demonstration of compliance with the regulatory positions of RG 1.77, Assumptions Used for Evaluating a Control Rod Ejection Accident for Pressurized Water Reactors.15-167

The staff evaluated the applicants analysis of the assumed CEA ejection accident and finds the assumptions, calculation techniques, and consequences acceptable. As the calculations demonstrate peak fuel temperatures below melting conditions, prompt fuel rupture with consequent rapid heat transfer to the coolant from finely dispersed molten UO2 presumably did not occur. The pressure surge results in a pressure increase below Service Limit C (as defined in Section III, Nuclear Power Plant Components, of the ASME Boiler and Pressure Vessel Code) for the maximum control rod worths assumed.

The staff finds the calculations to be sufficiently conservative, both in initial assumptions and analytical model, to maintain primary system integrity. Section 15.0.3 of this SER discusses the staffs evaluation and conclusions regarding the radiological consequences for the CEAE event.

Increase in Reactor Coolant Inventory The DCD Tier 2 Section 15.5, Increase in Reactor Coolant Inventory, describes the following AOOs that increase RCS inventory during power operation:

DCD Tier 2 Section 15.5.1, Inadvertent Operation of the Emergency Core Cooling System that Increases Reactor Coolant Inventory.

DCD Tier 2 Section 15.5.2, Chemical and Volume Control System Malfunction that Increases Reactor Coolant Inventory.

A spurious safety injection system (SIS) signal or operator error are identified as the scenarios that would result in an inadvertent operation of the ECCS. The applicant stated that plant operation above safety injection (SI) pump shutoff head pressure is not impacted by inadvertent actuation of SIS. If the RCS pressure is below SI pump shutoff head pressure, then inadvertent SIS actuation will result in an increase in RCS inventory and pressure. If the RCS is at low temperatures, inadvertent SIS actuation will cause the reactor pressure vessel to approach brittle fracture limits. Inadvertent SIS actuation while in shutdown cooling is mitigated by the shutdown cooling relief valves. DCD Tier 2 Table 15.0-5 classifies this event as an AOO consistent with the SRP.

DCD Tier 1: There are no DCD Tier 1 entries for this area of review.

DCD Tier 2: The applicant provided DCD Tier 2 information, summarized here, as follows:

The applicant performed a qualitative evaluation of the event and identified three cases for evaluation: SIS injection with RCS pressure above SI injection pump shutoff head, SIS injection with RCS pressure below SI pump shutoff head, and SIS injection while plant is on SDC. For these cases, the applicant determined that peak pressure is well below design limits, pressure-temperature limits for brittle fracture of the RCS are not violated, and SDC relief valves mitigate the pressure increase while on shutdown cooling.15-168

ITAAC: There are no ITAAC items for this area of review.

TS: The following TS are applicable to this area of review:

SL 2.1, Safety Limits, is applicable to the acceptance criteria for the event.

LCO 3.4.1, RCS Pressure, Temperature, and Flow Limits, is applicable to the initial conditions used in the evaluation of the event.

LCO 3.4.11, Low Temperature Overpressure Protection (LTOP) System, is applicable to the initial plant configuration used in the evaluation of this event.

The relevant requirements of NRC regulations for this area of review, and the associated acceptance criteria, are in NUREG-0800 Sections 15.5.1-15.5.2, Inadvertent Operation of ECCS and Chemical and Volume Control System Malfunction that Increases Reactor Coolant Inventory, and are summarized below. Review interfaces with other SRP sections also can be found in NUREG-0800, Sections 15.1-15.2.

GDC 10, which requires that the reactor core and associated coolant control, and protection systems be designed with appropriate margin to assure that specified acceptable fuel design limits are not exceeded during any condition of normal operation, including the effects of AOOs.

GDC 13, which requires, in part, that the effect of instrumentation shall be provided to monitor variables and systems over their anticipated ranges for AOOs to assure adequate safety. Appropriate controls shall be provided to maintain these variables and systems within prescribed operating ranges.

GDC 15, which requires that the RCS and its associated auxiliary control and protection systems be designed with sufficient margin to assure that the design conditions of the reactor coolant pressure boundary are not exceeded during any condition of normal operations, including AOOs.

GDC 26, which requires, in part, the reliable control of reactivity changes to assure that SAFDLs are not exceeded under conditions of normal operation, including AOOs, with appropriate margin for malfunctions, such as stuck rods.

Acceptance criteria adequate to meet the above requirements include:

1. Pressure in the reactor coolant and main steam systems should be maintained below 110 percent of the design values in accordance with the ASME Boiler and Pressure Vessel Code.

2. Fuel cladding integrity should be maintained by ensuring that the MDNBR remains above the 95/95 DNBR limit for PWRs based on acceptable correlations (see NUREG-0800, Section 4.4, Thermal and Hydraulic Design).15-169

3. An AOO should not generate a more serious plant condition without other faults occurring independently.

The applicants analysis of three separate cases covers the possible ranges of RCS pressures where the inadvertent SIS actuation event can occur, including: RCS pressure above SI pump shutoff head in Mode 1 and Mode 2; RCS pressure below SI pump shutoff head, and shutdown cooling system (SCS) isolated in Mode 3 and Mode 4; and plant is on shutdown cooling in Mode 4, Mode 5, and Mode 6.

The applicant stated that, because the evaluation is qualitative, it requires no evaluation model.

The applicant stated that there are no input parameters and initial conditions for this event because this event is not applicable for thermal hydraulic analysis. However, to evaluate the applicants qualitative analysis of the event, the staff considered the input parameters in Table 15.5.1-1 of this SER.

Table 15.5.1-1 Input parameters for evaluation of the inadvertent SIS actuation event Parameter Value Reference SI Pump Shutoff Head 13.98 MPa (2027 psig) DCD Tier 2 Table 6.3.2-4 RCS Pressure-Temperature Variable DCD Tier 2 Figure 5.3-7 Limit Low Temperature 29,337 L/min (7,750) gpm DCD Tier 2 Table 5.2-3 Overpressure Protection at 10% accumulation (LTOP) Relief Capacity LTOP Enable Temperature 101.67 °C (215 °F) APR1400-Z-M-NR-14008 Table 6-1 LTOP Disable Temperature 136.11 °C (277 °F) APR1400-Z-M-NR-14008 Table 6-1 For the case where RCS pressure is above the shutoff head of the SI pump in MODE 1 and MODE 2, no injection to the RCS occurs and thus there is no perturbation to the RCS.

Therefore, the applicant concluded, and the staff agrees, that an inadvertent SIS actuation has no impact on RCS conditions when the RCS pressure is above SI pump shutoff head.15-170

The case where RCS pressure is below the SI pump shutoff head but the SCS is isolated, is identified by the staff as pertaining to Mode 3 and Mode 4. As described in DCD Tier 2 Section 5.2.2.1.2, LTOP provided via relief valves located on the suction lines of SCS is not available with SCS isolated. For this case, the applicant explained that the RCS inventory can increase until the RCS pressure reaches the SI pump shutoff head. Considering an RCS cooldown and the parameters identified in Table 15.5.1-1 of this SER, the staff finds the RCS pressure limit at the LTOP enable temperature is above the SI pump shutoff head. Considering an RCS heatup and the parameters identified in Table 15.5.1-1 of this SER, the staff finds the RCS pressure limit at the LTOP disable temperature is above the SI pump shutoff head. Based on these findings, the staff finds reasonable assurance that an inadvertent SIS actuation cannot result in a violation of pressure limits in Mode 3 or Mode 4 while SCS is isolated.

The case where the plant is on SDC is identified by the staff as pertaining to Mode 4, Mode 5, and Mode 6. As described in DCD Tier 2 Section 5.2.2.1.2, overpressure protection for this case is provided by LTOP. The staff observes that the relief capacity for LTOP is significantly larger than the injection capacity of the four SI pumps. Therefore, the staff finds there is no challenge to RCS pressure limits in Mode 4, Mode 5, or Mode 6.

Inadvertent SIS actuation has no impact on RCS conditions when the RCS pressure is above SI pump shutoff head. Therefore, there is no impact on DNBR. The other cases considered occur in a Mode where the reactor is shutdown. The addition of cooler water via SI pumps does not adversely impact DNBR. As discussed in Section 15.5.1.4.3, the staff has found that an inadvertent SIS actuation does not violate RCS pressure limits for all cases.

Thus, the staff finds there is no challenge to any of the fission product barriers for this AOO.

There are no radiological consequences for this AOO.

There are no COL information items associated with Section 15.5.1 of the APR1400 DCD.

The staffs conclusions for DCD Tier 2 Section 15.5.1 are included in Section 15.5.2.6 of this SER.

A CVCS malfunction can result in an increase in the inventory and pressure of the RCS. The lower temperature of the charging water combined with a negative MTC can result in an increase in core reactivity. For limiting scenarios, the RCS pressure increase results in a reactor trip. DCD Tier 2 Table 15.0-5 classifies this event as an AOO, which is consistent with the SRP.15-171

DCD Tier 1: There are no DCD Tier 1 entries for this area of review.

DCD Tier 2: The applicant provided DCD Tier 2 information in Section 15.5.2, summarized here, as follows:

The applicant identified a pressurizer level control system (PLCS) malfunction that maximizes charging flow and minimizes letdown flow as the limiting scenario for a CVCS malfunction that increases RCS inventory. The applicant evaluated this event using CESEC-III to obtain the NSSS response and CETOP to determine the time-dependent DNBR. The CETOP DNBR calculations use the KCE-1 CHF correlation. The limiting case assumed a coincident LOOP.

The applicants analysis resulted in a peak RCS pressure of 18.33 MPa (2,659 psia), a peak SG pressure of 8.924 MPa (1,294.34 psia), and a minimum DNBR of 1.5177.

ITAAC: There are no ITAAC items for this area of review.

TS: The following TS are applicable to this area of review:

SL 2.1, Safety Limits, is applicable to the acceptance criteria for the event.

LCO 3.4.1, RCS Pressure, Temperature, and Flow Limits, is applicable to the initial conditions used in the evaluation of the event.

LCO 3.4.10, Pressurizer Pilot Operated Safety Relief Valves (POSRVs), is applicable to the modeling of the POSRVs in the evaluation model.

LCO 3.7.1, Main Steam Safety Valves (MSSVs), is applicable the modeling of the MSSVs in the evaluation model.

The regulatory basis described in Section 15.5.1.3 of this SER is also applicable to this section.

The applicant stated that an increase in RCS inventory due to a CVCS malfunction causes an increase in the pressure of the RCS. The case of a CVCS malfunction resulting in a boron dilution event is evaluated in Section 15.4.6 of this SER.

The applicant evaluated this event using CESEC-III to determine the NSSS response and CETOP to determine the time-dependent thermal margin. The CETOP calculation uses the KCE-1 CHF correction. Section 15.0.2 of this SER evaluated the applicability of these codes and the KCE-1 correlation to the APR1400.

Due to the relatively small capacity of the CVCS, in relation to the flow of the RCS, the applicant noted that there is not a noticeable impact on the RCS temperature and that the only noticeable 15-172

impact from the increased charging flow is an increase in RCS inventory and pressure.

Therefore, the applicant selected initial plant conditions to maximize the RCS pressure during this event. Input parameters for this analysis are provided in Table 15.5.2-1 below.

Design parameters for the POSRVs and MSSVs are available in DCD Tier 2 Table 5.4.14-1 and DCD Tier 2 Table 10.3.2-1, respectively. However, it is not clear that the applicants modeling of these valves, in their evaluation model, is suitably conservative with respect to the design parameters. Therefore, on November 10, 2015, the staff issued RAI 302-8341, Question 15.05.01-1, requesting the applicant provide the open and close pressures, open and close dead times, and relief capacity for the POSRVs and MSSVs as assumed in the safety analyses (ML15314A592). The applicants response, provided in a letter dated December 23, 2016 (ML15357A067), provided the requested information and described the basis for the values. The staff evaluated this information, along with other initial conditions and input parameters, in Table 15.5.2-1 of this SER. The staff determined that the inputs were suitably conservative based on the rationale provided in Table 15.5.2-1 of this SER, and therefore, the applicants response is acceptable and RAI 302-8341, Question 15.05.01-1 is resolved and closed.

Table 15.5.2-1 Initial conditions and input parameters for the analysis of the CVCS malfunction that increases reactor coolant inventory Parameter Value Basis Initial Core Power 4,062.66 MWt (102%) Maximize core power to minimize DNBR and increase RCS pressure.

Initial core inlet temperature 296.1 °C (565 °F) Parametric study.

Initial core mass flow rate 73.3 x106 kg/hr Parametric study.

(161.6x106 lbm/hr)

Initial pressurizer pressure 15.0 MPa (2175 psia) Low initial pressure maximizes the time to reactor trip and maximizes the increase in RCS inventory. Supported by parametric studies.

Initial pressurizer water 39.91 m3 (1409.44 ft3) High initial volume to minimize volume margin to PZR overfill.

CEA worth on trip -8.0 % DCD Tier 2 Section 15.0.0.2.

Moderator temperature -5.4 x 10-4 /°C Most negative (EOC) to coefficient (3.0 x 10-4 /°F) maximize power increase.

Doppler reactivity Least negative Maximize power increase.15-173

Parameter Value Basis Max charging flow 681.4 L/min (180 gpm) DCD Tier 2 Table 9.3.4-2 (Sheet 16), Rated flow at 2000 psi-differential (psid).

Min letdown flow 151.4 L/min (40 gpm) DCD Tier 2 Table 9.3.4-2 (Sheet 15), minimum rated flow.

Minimum primary coolant 1,689,000 L/min DCD Tier 2 Table 4.4-1.

flow rate (446,300 gpm)

POSRV open setpoint 17.37 MPa (2,519.4 psia) Set pressure + 2%, Uncertainty bounds value in DCD Tier 2 Table 5.4.14-1.

POSRV close setpoint 15.62 MPa (2,266 psia) 87% of opening pressure from DCD Tier 2 Table 5.4.14-1, plus an additional 3%

uncertainty.

POSRV relief capacity 244,900 kg/hr Minimum value from DCD Tier (540,000 lbm/hr) 2 Table 5.4.14-1 PORSV open/close dead 0.25/0.45 sec Bounds value in DCD Tier 2 time Table 5.4.14-1.

MSSV open setpoint First/Second/Third Bank Set pressure from DCD Tier 2 8.52/8.74/8.92 MPa Table 10.3.2-1 plus 4%

(1,235.66/1,267.9/1,293.9 uncertainty. (3% tolerance is psia) allowed for operability).

MSSV close setpoint First/Second/Third Bank 10% Blowdown from RAI 7.67/7.87/8.03 MPa 302-8341, (1,112.09/1,141.11/1,164.51 Question 15.05.01-1. Analysis psia) not sensitive to this parameter.

MSSV capacity 8.62x106 kg/hr Minimum capacity in DCD Tier (19x106 lb/hr combined) 2 Table 10.3.2-1.

The applicant credited the RPS actuation and operator action for the mitigation of the CVCS malfunction that increases the reactor coolant inventory event. An RPS trip is actuated when the pressurizer pressure reaches 2,414 psia (16.645 MPa). The staff observed that the credit of this trip is consistent with DCD Tier 2 Table 15.0-2 and conservative with respect to the nominal setpoint provided in DCD Tier 2 Table 7.2-4. The applicant credited operator action to initiate a cooldown after 30 minutes for the mitigation of this event, which is consistent with the description in DCD Tier 2 Section 15.0.0.6.15-174

Additional considerations for the analysis of the CVCS malfunction event that increases the reactor coolant inventory include LOOP and single failure. The applicant postulated that the LOOP occurs concurrent with the turbine trip and clarified that the LOOP is followed by failures in the condenser pumps, PLCS, pressurizer pressure control system (PPCS), feedwater control system (FWCS), and SBCS. The staff agrees that this assumption is conservative because it decreases RCS coolant flow and heat removal through the steam generators resulting in increased RCS pressure and a lower DNBR. Based on the information contained in Section 15.5.2 of the DCD, it was not clear if the pressurizer heaters were considered in the analysis. Therefore, on November 10, 2015, the staff issued RAI 302-8341, Question 15.05.01-2, requesting the applicant describe the behavior of the pressurizer heaters during the event and to explain how the assumed behavior is suitably conservative (ML15314A592). The applicants response, provided in a letter dated December 23, 2016 (ML15357A067), explained that all pressurizer heaters are assumed to be off due to the PLCS malfunction. The applicant stated that this assumption is conservative because it delays reactor trip, which maximizes RCS inventory. The staff finds this response acceptable because maximizing the pressurizer volume does not have a significant impact on DNBR, but may result in a higher RCS pressure. Based on the evaluation of the input parameters discussed in this section, the staff finds the applicants input parameters for the CVCS malfunction event to be suitably conservative and considers RAI 302-8341, Question 15.05.01-2, resolved and closed.

The following describes the staffs observations of the applicants analysis. The CVCS malfunction increases the charging flow and minimizes the letdown flow.

The 180 gpm (681.4 L/min) of charging flow entering the cold leg is a very small fraction, approximately 0.05 percent, of the minimum primary coolant flow. Therefore, the relatively cool charging flow does not produce an appreciable temperature decrease of the coolant entering the core and, thus, results in no changes to core reactivity. The increase in RCS inventory increases the pressurizer level and RCS pressure until the RPS high pressure setpoint is reached. The RPS initiates a reactor trip, resulting in a turbine trip and coincident LOOP. The MDNBR of 1.5177 occurs after initiation of the reactor trip and consequent LOOP. The reduced coolant flow and increased SG pressure due to the turbine trip results in an increase in RCS pressure, causing the pressurizer POSRVs to open. The maximum RCS pressure of 2,649 psia (18.265 MPa) occurs shortly after the POSRV open setpoint is reached. The maximum steam generator pressure of 1,294.34 psia (8.925 MPa) occurs shortly after the MSSV open setpoint is reached. The MSSVs continue to cycle after initially reaching their open setpoint, reducing the SG inventory until the auxiliary feedwater flow is initiated on low wide range SG level. The event is terminated at 30 minutes, when operator action is credited for the initiation of a plant cooldown.

The applicants analysis did not discuss the potential for the CVCS to overfill the pressurizer.

Overfilling the pressurizer would cause liquid to pass through the POSRVs, which could potentially damage these valves and cause a leak. This caused the staff to question whether the CVCS malfunction AOO could lead to an event with more severe consequences. Therefore, on November 10, 2015, the staff issued RAI 302-8341, Question 15.05.01-3, requesting the applicant demonstrate that a CVCS malfunction AOO cannot escalate into an event with more severe consequences without other incidents occurring independently (ML15314A592). The applicants response, provided in a letter dated December 23, 2016 (ML15357A067), stated that, in scenarios where the pressurizer can overfill, there is no safety concern because the 15-175

POSRVs are qualified for water and a two-phase mixture passage. During a quality assurance inspection, the staff reviewed the design specification for the POSRVs and verified that the POSRVs are qualified to open, remain open, and close when passing saturated liquid water (ML16081A081). Based on the applicants response and the staffs verification of the POSRV qualification, the staff finds a CVCS malfunction does not lead to an event with more serious consequences and considers RAI 302-8341, Question 15.05.01-3, resolved and closed.

The applicants analysis demonstrates that pressures in the reactor coolant and main steam systems remain below 110 percent of the design values for this event, and that the minimum DNBR remains above the 95/95 limit. As discussed in the previous section, the staff verified that the POSRVs are qualified to pass liquid water and therefore pressurizer overfill does not lead to an event with more serious consequences for the APR1400. Thus, the staff finds there is no challenge to any of the fission product barriers for this AOO.

There are no radiological consequences for this AOO.

There are no COL information items associated with Section 15.5.52 of the APR1400 DCD.

The staff concludes that the analyses of the transients resulting in an increase in reactor coolant inventory are acceptable and meet the requirements of GDC 10, 13, 15, and 26. This conclusion is based on the following:

In meeting GDC 10, 13, 15, and 26, the staff determined that the applicants quantitative analysis was performed using a mathematical model that has been previously reviewed and found acceptable by the staff. The parameters used as input to this model were reviewed and found to be suitably conservative.

The applicant met the requirements of GDC 10 and 26 with respect to demonstrating that fuel integrity is not challenged because the specified acceptable fuel design limited were not exceeded for this event.

The applicant met the GDC 13 requirements by demonstrating that all credited instrumentation was available and that actuations of protection systems, both automatic and manual, occurred at values of monitored parameters that were within the instruments prescribed ranges.

The applicant met the requirements of GDC 15 with respect to demonstrating that the RCPB limits have not been exceeded by these events. This requirement has been met because RCS pressure limits are not exceeded during heatup/cooldown and the maximum pressure within the reactor coolant and main steam systems did not exceed 110 percent of the design pressures.15-176

The applicant met the requirements of GDC 26 with respect to the capability of the reactivity control system to provide adequate control of reactivity during this event while including appropriate margins for malfunctions because the specified acceptable fuel design limits were not exceeded.

The applicant satisfied the criteria that prohibits the escalation of an AOO to a more serious incident without other incidents occurring independently.

Decrease in Reactor Coolant Inventory Several AOOs and PAs result in a decrease in reactor coolant inventory and are included in the following DCD Tier 2 Section 15.6, Decrease in Reactor Coolant Inventory, subsections:

DCD Tier 2 Section 15.6.1, Inadvertent Opening of a PWR Pressurizer Pressure Relief Valve.

DCD Tier 2 Section 15.6.2, Failure of Small Lines Carrying Primary Coolant Outside Containment.

DCD Tier 2 Section 15.6.3, Steam Generator Tube Rupture.

DCD Tier 2 Section 15.6.4, Radiological Consequences of Main Steam Line Failure Outside Containment (Boiling Water Reactor) (Not applicable to APR1400).

DCD Tier 2 Section 15.6.5, Loss-of-Coolant Accidents Resulting from the Spectrum of Postulated Piping Breaks within the Reactor Coolant Pressure Boundary.

Section 15.6.1 of the DCD states that the inadvertent opening of a POSRV is evaluated as part of SBLOCA in Section 15.6.5 of the DCD.

DCD Tier 1: There are no DCD Tier 1 entries for this area of review.

DCD Tier 2: The applicant provided DCD Tier 2 information, summarized here, as follows:

The applicant categorized the inadvertent opening of a POSRV as a PA that is evaluated as part of SBLOCA in Section 15.6.5 of the DCD.

ITAAC: There are no ITAAC items for this area of review.

TS: The following TS is applicable to this area of review:

LCO 3.4.10, Pressurizer Pilot Operated Safety Relief Valves.15-177

The relevant requirements of NRC regulations for this area of review, and the associated acceptance criteria, are in NUREG-0800, Section 15.6.5, Loss-of-Coolant Accidents Resulting From Spectrum of Postulated Piping Breaks Within the Reactor Coolant Pressure Boundary, and are summarized below. Review interfaces with other SRP sections also can be found in NUREG-0800, Section 15.6.5.

10 CFR 50.46, as it relates to ECCS equipment being provided that refills the vessel in a timely manner for a loss-of-coolant accident resulting from a spectrum of postulated piping breaks within the reactor coolant pressure boundary.

GDC 13, as it relates to the availability of instrumentation to monitor variables and systems over their anticipated ranges to assure adequate safety, and of appropriate controls to maintain these variables and systems within prescribed operating ranges.

GDC 35, as it relates to demonstrating that the ECCS would provide abundant emergency core cooling to satisfy the ECCS safety function of transferring heat from the reactor core following any loss of reactor coolant at a rate that (1) fuel and clad damage that could interfere with continued effective core cooling would be prevented, and (2) clad metal-water reaction would be limited to negligible amounts. The analyses should reflect that the ECCS has suitable redundancy in components and features; and suitable interconnections, leak detection, isolation, and containment capabilities available such that the safety functions could be accomplished assuming a single failure. In addition, consideration should be given to the availability of onsite power (assuming offsite electric power is not available with onsite electric power available; or assuming onsite electric power is not available with offsite electric power available).

10 CFR 52.47(a)(2)(iv)(A), 10 CFR 52.47(a)(2)(iv)(B), and GDC 19, as they relate to the evaluation and analysis of the radiological consequences of postulated accidents.

Specific criteria necessary to meet the relevant requirements of the regulations identified above and necessary to meet the TMI Action Plan requirements are as follows:

1. An evaluation of ECCS performance has been performed by the applicant in accordance with an evaluation model that satisfies the requirements of 10 CFR 50.46. RG 1.157, Best-Estimate Calculations of Emergency Core Cooling System Performance, and Section I of Appendix K to 10 CFR Part 50 provide guidance on acceptable evaluation models. For the full spectrum of reactor coolant pipe breaks, and taking into consideration requirements for RCP operation during a small break LOCA, the results of the evaluation must show that the specific requirements of the acceptance criteria for ECCS are satisfied as given below. This also includes analyses of a spectrum of large break and small break LOCAs to assure boric acid precipitation or dilution is precluded for all break sizes and locations. The analyses should be performed in accordance with 10 CFR 50.46, including methods referred to in 10 CFR 50.46(a)(1) or (2).

The analyses must demonstrate sufficient redundancy in components and features, and suitable interconnections, leak detection, isolation, and containment capabilities, such that the safety functions could be accomplished 15-178

assuming a single failure in conjunction with the availability of onsite power (assuming offsite electric power is not available, with onsite electric power available; or assuming onsite electric power is not available with offsite electric power available). Additionally, the LOCA methodology used and the LOCA analyses should be shown to apply to the individual plant by satisfying 10 CFR 50.46(c)(2), and the analysis results should meet the performance criteria in 10 CFR 50.46(b):

A. The calculated maximum fuel element cladding temperature does not exceed 1,200 °C (2,200 °F).

B. The calculated total local oxidation of the cladding does not exceed 17 percent of the total cladding thickness before oxidation. Total local oxidation includes pre-accident oxidation as well as oxidation that occurs during the course of the accident.

C. The calculated total amount of hydrogen generated from the chemical reaction of the cladding with water or steam does not exceed 1 percent of the hypothetical amount that would be generated if all of the metal in the cladding cylinders surrounding the fuel, excluding the cladding surrounding the plenum volume, were to react.

D. Calculated changes in core geometry are such that the core remains amenable to cooling.

E. After any calculated successful initial operation of the ECCS, the calculated core temperature is maintained at an acceptably low value and decay heat is removed for the extended period of time required by the long-lived radioactivity.

2. The radiological consequences of the most severe LOCA are within the guidelines of 10 CFR 100 or 10 CFR 50.67.

3. The TMI Action Plan requirements for II.E.2.3, II.K.2.8, II.K.3.5, II.K.3.25, II.K.3.30, II.K.3.31, and II.K.3.40 have been met.

The applicant categorized the inadvertent opening of a POSRV as a PA. The staff identified this categorization as a departure from SRP Section 15.6.1 where this event is identified as an AOO with more stringent acceptance criteria. Accordingly, on August 25, 2015, the staff issued RAI 170-8163, Question 15.06.01-1, requesting the applicant resolve or justify the treatment of the inadvertent opening of a POSRV as a PA (ML15237A457). The applicants responses, provided by letters dated October 30, 2015 (ML15303A053) and March 17, 2016 (ML16077A366), clarified that POSRV opening, due to a spurious electrical signal or operator error, is prevented by disconnecting electrical power from the upstream motor operated pilot valve. Additionally, the applicants response included updates to the DCD to provide justification for departing from the SRP. The staff finds the applicants response acceptable because the electrical isolation of one motor operated pilot valve prevents the scenarios identified in Section 15.6.1 of the SRP from occurring. The staff confirmed that this update was15-179

incorporated into the DCD; therefore RAI 170-8163, Question 15.06.01-1, is resolved and closed.

There are no COL information items associated with Section 15.6.1 of the APR1400 DCD.

The staff concludes that the scenarios identified in the SRP as producing an inadvertent opening of a POSRV are not applicable to the APR1400 because the electrical isolation of the upstream motor operated pilot valve prevents the identified scenario. Therefore, it is acceptable to evaluate this event as a SBLOCA. The staffs conclusions regarding SBLOCA analyses are provided in Section 15.6.5.6 of this SER.

A direct release of reactor coolant outside containment can be caused by a break or leak from a line connected to the RCS that penetrates the containment. Failure of a small line outside containment would be indicated by several alarms in the MCR but is not expected to result in actuation of engineering safeguards or the reactor protection system. This event is classified as an AOO in Table 15.0-5 of Tier 2 of the DCD.

DCD Tier 1: There are no DCD Tier 1 entries for this area of review.

DCD Tier 2: The applicant provided DCD Tier 2 information, summarized here, as follows:

The applicant identified the double ended-break of the letdown line outside the containment, upstream of the letdown isolation valve, as the limiting break for this event. The letdown line isolation valves are arranged such that no single failures would prevent isolation of the letdown line rupture. The applicant evaluated this event using CESEC-III, which accounts for critical flow through the letdown line break, letdown line losses, and operation of the pressurizer pressure control system (PPCS). The applicant noted that operator action is taken to isolate the break 30 minutes into the event and the DNBR remains well above the safety limit for the duration of this event.

ITAAC: There are no ITAAC items for this area of review.

TS: The following TS are applicable to this area of review:

SL 2.1, Safety Limits, is applicable to the acceptance criteria for the event.

LCO 3.4.1, RCS Pressure, Temperature, and Flow Limits, is applicable to the initial conditions used in the evaluation of the event.

LCO 3.4.12, RCS Operational Leakage, is applicable to the primary to secondary leakage assumed in the evaluation of the event.15-180

The relevant requirements of NRC regulations for this area of review, and the associated acceptance criteria, are in NUREG-0800, Section 15.0.3, Design Basis Accident Radiological Consequence Analyses for Advanced Light Water Reactors. Applicable regulations are summarized below.

10 CFR 52.47(a)(2)(iv)(A) and 10 CFR 52.47(a)(2)(iv)(B) as they relate to the radiological consequences of a small line break carrying primary coolant outside containment.

The applicant evaluated this event using CESEC-III to determine the response of the NSSS and CETOP to determine the time-dependent thermal margin. The CETOP calculation utilizes the KCE-1 CHF correction. The applicability of these codes and the KCE-1 correlation to the APR1400 is evaluated in Section 15.0.2 of this SER.

The applicant identified the double ended-break of the letdown line outside the containment, upstream of the letdown isolation valve as the limiting break for this event. The staff reviewed the containment penetrations, provided in Table 6.2.4-1 of the DCD, and verified that the letdown line is larger than any instrument or sample line. The applicant selected initial plant conditions for the transient to produce the largest radiological release. The applicant determined the parameters by performing parametric studies. The staffs evaluation of the initial conditions and input parameters for the letdown line break (LDLB) event is provided in Table 15.6.2-1, below.

The applicant credited operator action, taken 30 minutes after an alarm is received, to isolate the break, shut down the reactor, and initiate a plant cooldown. The applicant identified several alarms, in DCD Tier 2 Table 15.6.2-1, that would alert the operator of a LDLB event.

Additionally, the staff review of Type A variables that provide the primary information required to permit control room operating staff to take planned manual action is in Section 7.5 of this SER.

Operator action starting at 30 minutes is consistent with the description in DCD Tier 2 Section 15.0.0.6. Additional considerations for the analysis of the LDLB event include LOOP and single failure. The applicants analysis assumes a LOOP occurs concurrent with the reactor trip. The applicant stated, and the staff verified, that closure of any one of three isolation valves located within containment (CV-515, CV-516, or CV-522) would terminate the leak. Therefore, the applicant concluded, and the staff agrees, that a single failure of any one isolation valve has no impact on the analysis. Based on the selection of the limiting break and selection of input parameters to produce the largest radiological release, the staff finds that the input parameters and initial conditions are suitably conservative.15-181

Table 15.6.2-1 Initial conditions and input parameters for LDLB event Parameter Value Basis Core Power 4,062.66 MWt (102% of Maximize energy input to Rated Thermal Power) reactor coolant which maximizes break flow.

Initial core inlet temperature 296.1 °C (565 °F) High initial core inlet temperature increases enthalpy at the break which maximizes flashing fraction and radiological consequences. Supported by parametric study.

RCS flow rate 95% of nominal Produced larger flashing fraction. Supported by parametric study.

Pressurizer Pressure 16.03 MPa (2,325 psia) High pressurizer pressure increases break flow.

Pressurizer level 60% Level Maximize initial pressurizer level to minimize possibility of pressurizer heater shutoff due to low level.

CEA worth on trip -8.0 % DCD Tier 2 Section 15.0.0.2 Break size 0.001446 m2 (0.01556 ft2) Consistent with 2-inch, schedule 160 pipe.

PPCS Operable Maintains RCS pressure at operating conditions which maximizes flow out the break.

The applicants analysis of the LDLB event shows that the leak associated with the letdown line break does not significantly impact the behavior of the NSSS. The leak out of the break reduces the pressurizer level, but the level remains high enough to prevent the pressurizer heaters from shutting off during the event. The applicants analysis shows that pressurizer pressure reduction, due to the loss of inventory, is compensated for by the backup heaters cycling throughout the event. The plant operates for 30 minutes with no significant changes to plant parameters until operator action is taken to isolate the break and trip the reactor 30 minutes into the event. The applicants analysis showed that minimum DNBR occurs immediately after the reactor is tripped and is well above the safety limit of 1.29. The applicant determined that 20,276 kg (44,700 lbm) of reactor coolant leaks out of the break for the LDLB event.15-182

The applicants analysis shows that the pressures in the reactor coolant and main steam systems do not increase during the LDLB event. The minimum DNBR calculated by the applicant remains above the safety limit. Therefore, the staff concludes that the LDLB event produces no additional challenges to the fission product barriers.

The radiological consequences for the LDLB event are presented in DCD Tier 2 Table 15.6.2-5.

The evaluation of the dose calculation and their acceptability is documented in Section 15.0.3 of this SER.

There are no COL information items associated with Section 15.6.2 of the APR1400 DCD.

The staff concludes that the applicants analysis of the failure of small lines carrying primary coolant outside the containment produces a bounding estimate for the radiological release for this event. This conclusion is based upon:

1. The analysis of the event has been reviewed and was evaluated using a mathematical model that has been found acceptable by the staff.

2. The analysis of the failure of small lines carrying primary coolant outside containment was performed for a limiting break. The staff reviewed the applicable breaks and found the selection of the letdown line break acceptable.

3. The parameters used in the evaluation model were reviewed and found to be suitably conservative.

Section 15.0.3 of this SER discusses the staffs evaluation and conclusions regarding the radiological consequences for the LDLB event.

The complete severance of a single SG tube leads to an increase in contamination of the secondary system due to leakage of radioactive coolant from the RCS. The SGTR produces a reactor trip on either (1) high SG level, (2) a hot leg saturation temperature trip from the CPC, or (3) low DNBR trip due to the decrease in RCS pressure. The RCS pressure decreases rapidly post trip, which actuates the SIS. High SG level results in closure of the MSIVs and isolation of main feedwater. The MSSVs open to limit secondary system pressure and remove residual heat from the core and RCS. This event is terminated by cooling the plant to SDC entry conditions using the unaffected SG. DCD Tier 2 Table 15.0-5 classifies this event as a PA.15-183

DCD Tier 1: There are no DCD Tier 1 entries for this area of review.

DCD Tier 2: The applicant provided DCD Tier 2 information, summarized here, as follows:

The applicant analyzed the SGTR event in terms of margin to fuel thermal design limits and radiological consequences. Analyses were performed for scenarios with and without a coincident LOOP. The applicant evaluated this event using CESEC-III to obtain the NSSS response and CETOP to determine the time-dependent DNBR. The CETOP DNBR calculations utilize the KCE-1 CHF correlation. The applicant determined the SGTR coincident with LOOP to be limiting in terms of DNBR and radiological consequences. The applicant determined the minimum DNBR is 1.3022, which is above the safety limit, hence no fuel failure is predicted to occur.

ITAAC: There are no ITAAC items for this area of review.

TS: The following TS are applicable to this area of review:

SL 2.1, Safety Limits, are applicable to the acceptance criteria for the event.

LCO 3.2.2, Planar Radial Peaking Factors, are applicable to the initial conditions used in the evaluation of the event.

LCO 3.4.1, RCS Pressure, Temperature, and Flow Limits, are applicable to the initial conditions used in the evaluation of the event.

LCO 3.4.12, RCS Operational Leakage, is applicable to the primary to secondary leakage assumed in the evaluation of the event.

LCO 3.4.15, RCS Specific Activity, is applicable to the activity in the RCS coolant that is assumed in the evaluation of the events.

LCO 3.7.1, Main Steam Safety Valves (MSSVs), is applicable to the MSSV lift setpoint being assumed in the evaluation of the event.

LCO 3.7.4, Main Steam Atmospheric Dump Valves (MSADVs), is applicable to the availability of the MSADVs to cool the RCS through the unaffected steam generator.

The relevant requirements of NRC regulations for this area of review, and the associated acceptance criteria, are in NUREG-0800, Section 15.0.3, Design Basis Accident Radiological Consequence Analyses for Advanced Light Water Reactors. Applicable regulations are summarized below:

GDC 13, as it relates to the availability of instrumentation to monitor variables and systems over their anticipated ranges to assure adequate safety, and of appropriate controls to maintain these variables and systems within prescribed operating ranges.15-184

10 CFR 52.47(a)(2)(iv)(A) and 10 CFR 52.47(a)(2)(iv)(B) as they relate to the evaluation and analysis of the radiological consequences of postulated accidents.

The applicant evaluated this event using CESEC-III to determine the NSSS response and CETOP to determine the time-dependent thermal margin. The CETOP calculation utilizes the KCE-1 CHF correction. The applicability of these codes and the KCE-1 correlation to the APR1400 is evaluated in Section 15.0.2 of this SER.

The applicant performed two analyses for the SGTR event. The first analysis is performed to investigate the thermal margin and utilizes input parameters to produce the minimum DNBR during the event. The second analysis is performed to investigate the radiological consequences and utilizes input parameters that maximize the potential for radiological release.

The applicants evaluation of the SGTR event credits use of several safety-related systems and components, including the RPS, MSIVs, MFIVs, the SIS, and the MSSVs. The MSIVs and MFIVs actuate on a main steam isolation signal (MSIS) and the SIS actuates on a safety injection actuation signal (SIAS). The staffs evaluation of the input parameters and initial plant conditions for evaluation of DNBR and radiological consequences are in Table 15.6.3-1 and Table 15.6.3-2 of this SER, respectively.

Table 15.6.3-1 Input parameters and initial conditions for limiting SGTR event in terms of DNBR Parameter Value Basis Initial Conditions Core power 4,062.66 MWt (102% of Rated Maximizes heat flux which Thermal Power) minimizes DNBR.

Initial core inlet temperature 287.78 ºC (550 ºF) Parametric study RCS flow rate 95% of nominal, Parametric study Pressurizer pressure 16.03 MPa (2325 psia) Parametric study PZR level 60% Level Parametric study SG level Nominal Parametric study 15-185

Parameter Value Basis Event Initiator Break size Double ended rupture of SG Largest possible break to tube produce bounding consequences.

Area = 2 x 253.99 mm2 DCD Tier 2 Table 5.4.2-1 (2 x 0.3484 in2)

Credited Systems and Components RPS High SG level trip = 95% Conservative with respect to narrow range level DCD Tier 2 Table 7.2-4.

Hot leg saturation CPC trip DCD Tier 2 Table 15.0-2,

= -7.2 ºC (-13 ºF) Conservative with respect to DCD Tier 2 Table 7.2-4 CEA worth on trip = -8.0 % DCD Tier 2 Section 15.0.0.2 SIS SIAS = 1,885 psia Conservatively high with respect to DCD Tier 2 Table 7.3-5A, resulting in earlier HPSI actuation.

40 second delay DCD Tier 2 Section 6.3.1.5 Injection capacity as a function DCD Tier 2 Table 6.3.2-4.

of RCS pressure Limiting performance determined by parametric study.

MSSVs Lift Setpoint = 1,141.74 psia 4% below lift setpoint in TS 3.7.1. DNBR not sensitive to this parameter.15-186

Table 15.6.3-2 Input parameters and initial conditions for limiting SGTR event in terms of radiological consequences Parameter Value Basis Initial Conditions Core power 4,062.66 MWt (102% of Rated Maximize energy input to Thermal Power) reactor coolant which maximizes break flow.

Initial core inlet temperature 295 ºC (563 ºF) High initial core inlet temperature increases enthalpy at the break which maximizes flashing fraction and radiological consequences. Supported by parametric study.

RCS flow rate 95% of nominal Increases enthalpy of fluid entering steam generator, which produces larger flashing fraction. Supported by parametric study.

Pressurizer pressure 16.03 MPa (2325 psia) High pressurizer pressure increases break flow.

PZR level 60% level High PZR level minimizes pressure reduction due to break, which maximizes break flow.

Maximize SG level to SG level 97.68%

produce earliest trip possible, which maximizes radiological consequences.

Event Initiator Break size Double ended rupture of SG Produces bounding tube radiological consequences.

Area = 2 x 0.3484 in2 DCD Tier 2 Table 5.4.2-1 15-187

Parameter Value Basis Credited Systems and Components RPS Trip on high SG level Maximizes the time of steam assumed to occur upon relief via MSSVs, which initiation of SGTR maximizes dose consequences.

CEA worth on trip = -8.0 % DCD Tier 2 Section 15.0.0.2 MSIV MSIS on high SG level occurs Maximizes relief via MSSVs, upon initiation of SGTR which maximizes dose consequences.

MSIV closure time = Maximizes relief via MSSVs, instantaneous which maximizes dose consequences SIS SIAS = 1,885 psia Conservatively high with respect to DCD Tier 2 Table 7.3-5A, resulting in earlier HPSI actuation.

40 second delay DCD Tier 2 Section 6.3.1.5 Injection capacity as a DCD Tier 2 Table 6.3.2-4.

function of RCS pressure Limiting performance determined by parametric study.

MSSV Lift Setpoint = 1,141.74 psia 4% below lift setpoint in TS 3.7.1. Produces bounding low lift setpoint which maximizes radiological consequences.

Additional considerations for the analysis of the SGTR event include LOOP and single failure.

The applicant performed analyses of the SGTR event with and without consideration of a LOOP, where a LOOP is assumed to occur coincident with a turbine trip. The scenarios involving a LOOP produced the limiting cases for both DNBR and radiological consequences.

The applicant performed a parametric study to determine the impact of single failure on radiological consequences, which included (1) failure of any auxiliary feedwater pump to start or 15-188

auxiliary feedwater valve to open, (2) failure of one SI pump, and (3) failure of one emergency diesel generator, which effects two SI pumps. The applicants results demonstrated that assuming no single failure produced bounding radiological consequences.

The applicant credits RPS actuation, ESF actuation, and operator action for the mitigation of the SGTR event. Operator action is credited at 30 minutes to (1) identify the affected SG, (2) confirm isolation, or isolate the affected SG, (3) establish cooldown of the RCS via operation of the AFWS and the ADVs of the unaffected SG, and (4) cool the RCS sufficiently to terminate break flow to the affected SG. The staff evaluated the assumed RPS and ESF actuation setpoints and performance in Table 15.6.3-1 and Table 15.6.3-2 of this SER and verified that the modeling of these protection systems is suitably conservative. Additionally, operator action credited at 30 minutes is consistent with the description in DCD Tier 2 Section 15.0.0.6. Based on the evaluation of the input parameters discussed in this section, the staff finds the applicants input parameters for the SGTR event to be suitably conservative.

The staff noted that the thermal margin analysis presented in DCD Tier 2 Section 15.6.3 does not contain figures or a chronological list of events that show dynamic behavior of important NSSS parameters. Therefore, on January 19, 2016, the staff issued RAI 370-8450, Question 15.06.03-1, requesting the applicant update the DCD with the appropriate figures and tables to describe the thermal analysis of the SGTR event (ML16019A276). The applicants response, provided in letter dated March 23, 2016 (ML16083A596), provided figures and a sequence of events table describing the NSSS response as calculated by CESEC-III.

Additionally, the applicants response included a DCD markup to update DCD Tier 2 Table 15.0-2 with the credited RPS trip used in the SGTR analysis. The staff found the response acceptable because the tables and figures provided by the applicant were consistent with the description and DNBR analysis described in the DCD. The staff confirmed that this update was incorporated into the DCD; therefore, RAI 370-8450, Question 15.06.03-1, is resolved and closed.

The applicants results from the DNBR analysis shows that DNBR decreases continuously as a result of the decrease in RCS pressure. A minimum DNBR of 1.3022, which is greater than the safety limit of 1.29, is encountered shortly after reactor trip and subsequent turbine trip with coincident LOOP.

The staff audited the calculations supporting the SGTR event description provided in DCD Tier 2 Section 15.6.3, Steam Generator Tube Failure, (ML17013A130). The staff observed that the minimum DNBR for the SGTR event resulted in a violation of the safety limit for a few cases. In particular, two cases that are initialized to preserve a ROPM of 18 percent resulted in a minimum DNBR less than 1.29. Because the limiting DNB analysis for SGTR presented in the DCD assumes 20 percent ROPM and shows no fuel failure, but additional analyses that assume 18 percent ROPM show violation of the safety limit, it was unclear to the staff if the case presented in the DCD represents a bounding case in terms of minimum DNBR and dose consequences. Accordingly, on January 19, 2016, the staff issued RAI 370-8450, Question 15.06.03-3, requesting the applicant explain why the DNBR analysis presented in DCD Tier 2 Section 15.6.3 represents the bounding case (ML16019A276). The applicants response, provided in letter dated March 23, 2016 (ML16083A596), resolved the staffs concerns by clarifying that the analysis presented in DCD Tier 2 Section 15.6.3 is bounding because 20 15-189

percent ROPM is maintained by the COLSS. Therefore, the staff considers RAI 370-8450, Question 15.06.03-3, resolved and closed.

The applicants analysis for the limiting radiological consequences evaluation assumes the turbine trip and coincident LOOP occur with the reactor trip on a high SG level. MSIVs are assumed to close instantaneously on high steam generator level, which causes the MSSVs in both SGs to begin to cycle open and closed. The following discusses the results of the applicants analysis. A peak SG pressure of 1,195.55 psia (8.243 MPa) occurs shortly after the MSSVs initially lift. At approximately 3.5 minutes into the event, the RCS pressure decreases to the SIAS setpoint. Inventory in the unaffected SG continues to decrease until the auxiliary feedwater actuation signal is reached approximately 20 minutes into the event.

The applicants analysis is terminated at 30 minutes with the initiation of operator action.

However, as shown in DCD Tier 2 Figures 15.6.3-19, 15.6.3-22, 15.6.3-23, and 15.6.3-29, flow through the break and the MSSVs of the affected SG remains significant 30 minutes into the event. Because the RCS pressure remains high and the break flow significant at 30 minutes, the staff was unable to determine if the analysis is a bounding case in terms of radiological consequences and steam generator overfill. Accordingly, on January 19, 2016, the staff issued RAI 370-8450, Question 15.06.03-2, requesting the applicant extend the analysis until break flow through the unaffected steam generator was terminated (ML16019A276). The applicants response, provided in letter dated May 18, 2016 (ML16139A903), presented the results of an analysis that extended past the point where break flow was terminated. The applicants response further clarified that results in the DCD assume that the break flow rate at 1800 seconds is maintained until primary and secondary pressures are equalized in the calculation of the flashed mass of break flow and that this flashed mass is assumed to be completely discharged to the environment. The staff verified the mass leaked through the break, provided in the applicants response, is consistent with the value used in the dose consequence analysis provided in DCD Tier 2 Table 15.6.3-5. Because some of the flashed mass is expected to be retained in the SG, the staff finds that the assumption that all of the flashed mass is released to the environment provides a suitably conservative estimate for calculating dose consequences.

Therefore, the staff considers RAI 370-8450, Question 15.06.03-2, resolved and closed.

The applicants analysis demonstrated that the pressure in the reactor coolant and main steam systems is maintained below 110 percent of the design values for this event. Additionally, the applicants analysis showed that SG overfill does not occur, and that the minimum DNBR remains above the 95/95 limit. Based on these results the staff finds that the SGTR event produces no additional challenges to the fission product barriers.

The radiological consequences for the SGTR event are presented in DCD Tier 2 Table 15.6.3-6.

Evaluation of the dose calculation and its acceptability is documented in Section 15.0.3 of this SER.

There are no COL information items associated with Section 15.6.3 of the APR1400 DCD.15-190

The staff concludes that the analysis of the SGTR event produces a bounding estimate for the radiological release associated with this event. This conclusion is based upon:

1. The applicant meets GDC 13 requirements by demonstrating that all credited instrumentation is available and that actuation of protection system occurred at values of monitored parameters that were within the operating ranges of the prescribed instruments.

2. The analysis of the event has been reviewed and was evaluated using a mathematical model that has been found acceptable by the staff.

3. The parameters used in the evaluation model were reviewed and found to be suitably conservative.

Section 15.0.3 of this SER discusses the staffs evaluation and conclusions regarding the radiological consequences for the SGTR event.

This section is not applicable to the APR1400.

LOCAs are postulated accidents that would result from the loss of reactor coolant, at a rate in excess of the capability of the normal reactor coolant makeup system, from piping breaks in the RCPB. The applicant postulated piping breaks of various sizes, types, and locations. The applicant credited actuation of the ECCS and operator action for mitigation of the LOCA.

DCD Tier 1: There are no DCD Tier 1 entries for this area of review.

DCD Tier 2: The applicant provided DCD Tier 2 information summarized as follows:

The applicants evaluation of LOCAs was divided into three categories: LBLOCA, SBLOCA, and post-LOCA LTC.

LBLOCA The applicant evaluated LBLOCA over a spectrum of break sizes, types, and locations. The applicants evaluation determined that a double ended cold leg break between the RCP outlet and reactor vessel inlet nozzle produced the limiting result in terms of peak cladding temperature (PCT). The applicant evaluated LBLOCA using the code-accuracy-based realistic evaluation methodology (CAREM) which utilizes coupled analysis codes RELAP5/MOD3.3 and CONTEMPT4/MOD5. The CAREM methodology is a non-parametric statistics based method 15-191

that provides values associated with ECCS acceptance criteria at the 95th percentile with 95 percent confidence (95/95). In letter dated August 11, 2017 (ML17223B382), the applicant updated the LBLOCA analysis to provide the results using the finalized calculation methodology. The applicants updates reported values of 1,029 ºC (1,885 ºF) for PCT, 6.30 percent maximum cladding oxidation, and less than 1 percent maximum hydrogen generation.

Based on its review of the DCD, the staff has confirmed incorporation of the changes described above.

SBLOCA The applicant evaluated SBLOCA over a spectrum of break sizes and locations using a methodology documented in APR1400-F-A-NR-14001, Small Break LOCA Evaluation Model, (ML17114A523). This methodology utilized several previously-approved codes, including CEFLASH-4AS to determine the primary system hydraulic parameters during the blowdown phase, COMPERC-II to determine the primary system hydraulic behavior during the reflood phase, and STRIKIN-II and PARCH to determine fuel performance during the SBLOCA event.

LTC The applicant evaluated several aspects of post-LOCA LTC including the LTC plan, boron precipitation, post-LOCA boron dilution (GSI-185), loop seal clearing, and the effects of debris generated during LOCA (GSI-191).

LTC Plan The APR1400 ECCS consists of Safety Injection Pumps (SIPs) that draw borated coolant from the IRWST and Safety Injection Tanks (SITs) that will inject borated coolant when the pressure drops below approximately 600 psig (4,137 MPa gauge). The APR1400 LTC plan credits operator action no sooner than 30 minutes after the event initiation. The SIPs are initially aligned to inject into the direct vessel injection nozzles. The LTC plan specifies that the operator realigns one or one half of the SIP flow to the hot legs, while the remaining flow continues Direct Vessel Injection (DVI) between two and three hours after any LOCA. For the APR1400, ECCS realignment to the containment sump is not necessary because the IRWST is inside containment and acts as the containment sump.

The APR1400 DCD Tier 2, Section 15.6.5.3, Core and System Performance, Subsection 15.6.5.3.3, Results, describes the basic LTC plan to maintain the core at safe temperature levels by avoiding the precipitation of boric acid. Details of the plan are provided in Technical Report, Post-LOCA Long Term Cooling Evaluation Model, [Reference 14].

Boron Precipitation The applicants analyses associated with LTC are documented in APR1400-F-A-NR-14003, Post-LOCA Long Term Cooling Evaluation Model, (ML17114A525) and APR1400-E-N-NR-14001, Design Features to Address GSI-191, (ML18057B530). The LTC evaluation model utilizes several codes including CEPAC to calculate the secondary side system temperature, NATFLOW to calculate RCS core and loop natural circulation flow rates and temperatures after RCS refill for small breaks, CELDA to calculate long term depressurization and refill of the RCS for small breaks, and BORON to calculate boric acid concentration in the core. The applicants evaluation determined that the double-ended cold leg break was limiting in terms of the boric 15-192

acid precipitation analysis. The applicants analysis showed that boron precipitation is prevented by operator action to establish core flushing flow within 3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br /> of event initiation.

In-Vessel Downstream Effects The applicant evaluated the effect of debris generated during LOCA on LTC in APR1400-E-N-NR-14001, Design Features to Address GSI-191. The applicants resolution of GSI-191 uses a multifaceted, defense-in-depth design for containment, IRWST, sump, and sump strainer. By using a reflective metallic insulation (RMI) for the RCS piping, the fibrous type insulation of particular concern is eliminated, and, by employing a unique design to trap most types of debris from entering the ECCS piping and pumps, the applicant substantially reduced debris transport to the IRWST. Finally, the applicant stated that by using a conservative methodology to address the issues in GSI-191, the analysis results demonstrate the extent of margin built into the sump strainer design. The applicant further stated that the APR1400 analysis methodology is based on the latest available regulatory guidelines regarding break locations, zone of influence (ZOI) for debris generation, debris types and transport, design features to trap debris, and the unique sump strainer design.

The applicants evaluation of various design and analysis aspects of the sump strainer performance is documented in Section 6.3 of this SER. For long term core cooling, the applicant performed bypass testing, core flow and available pressure drop, fuel bundle head loss testing, and the LOCA deposition model. Based on the testing and analysis, the applicant concluded that the temperature of fuel cladding remains below 427 °C (800 °F) during LTC as a result of the potential debris accumulation in the core.

Post-LOCA Boron Dilution The applicant stated in DCD Tier 2, Table 15.0-12 (Unresolved and Generic Safety Issues), that GSI-185 was resolved and, consequently, no analysis of boron dilution was performed for the APR1400. GSI-185 concerns the potential return to criticality following a small break LOCA due to insertion of unborated water in the core as a result of restoration of natural circulation or restart of a RCP. The unborated water results from condensed steam from the steam generator tubes collecting in the loop seal piping. When the accumulated fresh water slug is discharged due to the loop seal clearing, the applicant calculated that the core inlet Boron concentration is higher than the minimum required shutdown Boron concentration. Therefore the core remains sub-critical during SBLOCA long term cooling and the design satisfies the requirements imposed by GSI-185, as documented in Section 15.0.0.4.5.

Loop Seal Clearing The applicant considered the loop seal clearing phenomenon as one of five phases of SBLOCA (i.e., blowdown, natural circulation, loop seal clearing, core boil-off, and core recovery). A loop seal forms during the natural circulation cooling phase when steam is condensed in SG tubes and the condensate falls back to the intact piping above the reactor core. If natural circulation cooling is restored or a pump is started, the water seal can be cleared, resulting in an abrupt decrease in two-phase liquid level in the core. The applicants analyses showed that PCT remained below 905 °C (1660 °F) during loop seal clearing.

ITAAC: There are no ITAAC items for this area of review proposed by the applicant in this section of the DCD.15-193

TS: The following TS are applicable to this event:

LCO 3.3.11, Accident Monitoring Instrumentation (AMI).

LCO 3.4.1, Pressure Temperature, and Flow Limits.

LCO 3.5.1, Safety Injection Tanks (SITs).

LCO 3.5.4, In-Containment Refueling Water Storage Tank (IRWST).

The regulatory basis provided in Section 15.6.1.3 of this SER is applicable to this section.

The staff review of the applicants LBLOCA analysis methodology for Topical Report APR1400-F-A-TR-12004, Realistic Evaluation Methodology for Large-Break LOCA of the APR1400, is documented in a separate safety evaluation report (ML17265A104). The review of the application of the code-accuracy-based realistic evaluation methodology (CAREM) presented in DCD Tier 2 Section 15.6.5 is summarized briefly here. The detailed staff evaluation is described in the SER for the topical report.

Although CAREM is a best estimate plus uncertainty methodology, a number of conservatisms have been considered in the analyses. The applicant developed a modified version of the RELAP5/MOD3.3 thermal hydraulic analysis code, referred to as RELAP5/MOD3.3K, and coupled it to the CONTEMPT4/MOD5 containment analysis code for the LBLOCA analyses.

The modifications to both codes were necessary to address APR1400-specific features and to permit coupling of the systems analysis and containment computer codes.

The applicant identified several APR1400-specific issues that may challenge the use of RELAP5/MOD3.3K. These issues include the accurate modeling of the following:

The Safety Injection Tank with Fluidic Device, The DVI nozzles, The potential for ECC water bypass to the cold leg between the DVI nozzle and the vessel downcomer, The boiling of the ECC water in the downcomer, and The oscillation between the core and the steam generators during the reflood phase.

These unique issues, and the assessment of RELAP5/MOD3.3 to accurately model these phenomena, are discussed in the LBLOCA Methodology Topical Report, APR1400-F-A-TR-12004, Revision 0. The staff identified a significant number of technical issues associated with the codes and the best-estimate methodology. These issues were 15-194

discussed with the applicant during audits related to the review of the topical report on January 12 - 14, 2016, and June 14 - 16, 2016. The complete description of issues identified for discussion are provided in the Regulatory Audit Plan for Topical Report APR1400-F-A-TR-12004 (ML15208A199). The applicant prepared written responses to all issues and proposed revisions to the topical report as needed. The staff audit report documents the staff summary of the discussions and proposed resolutions. The staff issued RAIs related to the topical report review for any issues that were not satisfactorily resolved during the LBLOCA audit discussions and the written responses. These are documented in the staff SER for the topical report [Reference 39]. Questions that already were discussed at the audit, but relate to DCD Tier 2 Section 15.6.5, rather than to the methodology, were formally issued on February 3, 2016, in RAl 399-8510 (ML16034A056). The applicant updated the LBLOCA Methodology Topical Report, APR1400-F-A-TR-12004, Revision 1, to address these questions [Reference 41]. The staff evaluation of issues associated with the RELAP5 or CONTEMPT codes or the CAREM methodology are documented in the topical report SER [Reference 39].

In DCD Tier 2 Section 15.6.5, the applicant stated that LOOP is assumed at the beginning of the LBLOCA transient evaluation and that the RCPs are assumed to coast down. On February 3, 2016, the staff issued RAI 399-8510, Question 15.06.05-6 (ML16034A056),

requesting the applicant to: (1) clarify how the assumption of loss of RCP flow for each case has been demonstrated to be more limiting than the same transient with the RCPs assumed to be operating; (2) explain, with the assumption of LOOP, why no credit is taken for CEA insertion at the same time the power is lost to the RCPs; and (3) clarify if the stuck, or windmilling, flow resistance (both flow directions) for the pumps has been measured as part of a test program, and if so, are these data used to develop the homologous curves used in RELAP5/MOD/3.3K.

On March 3, 2016, the applicant responded (ML16063A045) by providing a comparison of peak clad temperature (PCT) results both with and without RCPs operating to address the first issue.

The PCT without operation of the RCPs is slightly higher than the PCT with operation of the RCPs. The PCT location without operation of the RCPs and with operation of RCPs occurred in adjacent heat structure nodes. Thus, the quench time difference is caused by the PCT elevation. Consequently, the loss of RCP flow case was determined to be the more limiting case based on the PCT results.

To address the second issue in RAI 399-8510, Question 15.06.05-6, related to CEA insertion, the applicant performed a plant calculation with and without CEA insertion. When CEA insertion is not included, core power from the fuel rods is higher than the CEA insertion included case.

The higher core power results in a higher PCT. The LBLOCA analysis model does not include the effects of CEA insertion and, therefore, can be considered the limiting case.

To address the third issue in RAI 399-8510, Question 15.06.05-6, the applicant responded that, in the homologous curves, zero pump speed data for forward and reverse flow are produced by considering stuck flow resistance or a locked rotor K-factor. Zero torque data are produced by considering windmilling flow resistance. Pump homologous curve data are obtained from the pump test and these curve data are used in LBLOCA analysis.

The staff considers the applicants response to RAI 399-8510, Question 15.06.05-6 acceptable because it demonstrates that conservative assumptions were used with respect to LOOP in the LBLOCA analyses. Therefore, RAI 399-8510, Question 15.06.05-6 is resolved and closed.15-195

The staff noted that the LBLOCA reactor power response in DCD Tier 2 Figure 15.6.5-13 (Normalized Core Power for a 0.6 Double-ended Guillotine Break in Pump Discharge Leg) shows the power increasing to 1.7 times the nominal power in the first 0.5 sec of the LBLOCA transient. This behavior is not as expected for a LWR design for this event since core depressurization and voiding usually result in the insertion of significant negative reactivity. The staff noted that this power spike is attributed to the applicants use of a moderator density feedback curve at hot zero power for the analyses in RELAP5. The staff questioned whether such a power spike is physically possible or was the result of conservative modelling.

Accordingly, on February 3, 2016, the staff issued RAI 399-8510, Question 15.06.05-7 (ML16034A056), requesting that the applicant provide the following:

1. A verification and an explanation for the shape and magnitude (positive reactivity at some densities) of the curve. In particular, the increase in reactivity with decreasing moderator density for densities above 500 kg/m3,

2. Justification for the use of the conservative curve in a best estimate plus uncertainty evaluation,

3. An explanation for the rapid increase in reactor power during the first 0.5 sec of the LBLOCA transient, and

4. An evaluation of fuel performance during this spike in power to determine if the fuel fails due to Pellet-Cladding Mechanical Interaction (PCMI) or fuel melt.

The applicants response, provided in a letter dated August 11, 2017 (ML17223A687), updated the LOCA evaluation model to use a moderator density feedback curve that was consistent with a moderator temperature coefficient (MTC) of 0 /°F. The staff finds this response acceptable because it is a conservative treatment of the reactivity feedback during LBLOCA. Therefore, the staff considers RAI 399-8510, Question 15.06.05-7, resolved and closed.

GDC 35 requires that the ECCS perform its safety functions in the presence of a single failure.

The single failure could occur prior to, or at any time during, the design basis event for which the safety system is required to function. The applicant did not address the potential for a mechanical check valve associated with a SIT to stick. Accordingly, on February 3, 2016, the staff issued RAI 399-8510, Question 15.06.05-8, requesting the applicant evaluate the impact of a stuck check valve associated with a SIT on ECCS performance during LBLOCA (ML16034A056). The applicants response, provided in letter dated March 3, 2016 (ML16063A045), clarified that the applicant believes a single failure of a passive component is not required to comply with GDC 35. The staff does not agree with the applicants position that a single failure of a check valve does not need to be considered. Additional consideration of passive failures is discussed in SECY-94-084 (ML003708068), which clarifies that check valves are to be treated as active components, subject to the single failure consideration, unless the proper function of the check valve can be demonstrated and documented. SECY-94-084 further discusses exceptions where the passive failure of a check valve does not need to be considered. These exceptions are when the reliability of the particular check valve is comparable to those of passive components. A failure probability on the order of 1x10-4 per year or less would be low enough to be considered a passive failure. SECY-94-084 provides a clarifying example exception of the accumulator check valve installed in applications identical to those for currently licensed plants where the accumulator pressure will eventually create a large pressure differential to force open the valves as reactor coolant system pressure falls. The staff 15-196

evaluated the single failure consideration by comparing the APR1400 with currently licensed plants and investigating the check valve reliability.

The staff compared the APR1400 with conventional PWR designs and determined that the APR1400 SIS design is similar to conventional designs in that the passive SITs are charged to 4137 kPa (600 psi) and that normally closed check valves in series are located between the SIT and the point of injection. Additionally, the applicant performed a Level 1 Probabilistic Risk Assessment, described in DCD Tier 2 Chapter 19, which provides the probability of a check valve failure to open as 1.1x10-5 per year. Also, the applicant includes the safety injection system check valves in the Inservice Inspection Program as described in DCD, Tier 2 Section 3.9. Check valve operability tests are performed 120 times during the 60-year plant design life.

Based on the similarity to existing licensed reactors, the high reliability determined for the check valves, and the inclusion of the SIT check valves in the inservice inspection program, the staff finds it acceptable to treat the SIT check valves as passive components, and RAI 399-8510, Question 15.06.05-8 is resolved and closed.

The staff evaluation of the radiological consequences of a large break LOCA are presented in Section 15.0.3 of this SER.

SBLOCA Methodology and Computer Codes GDC 35 mandates the requirements for the ECCS that need to be satisfied by conforming to the ECCS acceptance criteria for LWRs given in 10 CFR 50.46. 10 CFR 50.46(b)(1) identifies the PCT requirement; 10 CFR 50.46(b)(5) requires that after any calculated successful initial operation of the ECCS, the calculated core temperature shall be maintained at an acceptably low value and decay heat be removed for the extended period of time to prevent the core from being uncovered. These requirements, along with 10 CFR 50.46(a)(1), specify the need to calculate the ECCS cooling performance using an acceptable evaluation model (EM) for a number of postulated LOCAs of different sizes, locations, and other properties sufficient to provide assurance that the most severe LOCAs have been evaluated. In the SBLOCA technical report, Small Break LOCA Evaluation Model, the applicant stated that it conducted the SBLOCA analyses using the Supplement 1 Method (S1M) CE SBLOCA methodology that was approved by the NRC for the Combustion Engineering-Asea Brown Boveri (CE-ABB) design

[References 31 through 34]. The SBLOCA EM consists of four computer programs:

CEFLASH 4AS, COMPERC-II, STRIKIN-II, and PARCH. The CEFLASH-4AS computer program is used to determine the primary system response for the blowdown period, defined by the applicant as the period preceding emergency core cooling (ECC) injection by the SITs.

COMPERC-II is used to calculate the core hydraulic response after ECC injection by the SITs.

STRIKIN-II and PARCH calculate the fuel rod temperature response and cladding oxidation.

STRIKIN-II is a forced convection heat transfer code and is used during the initial blowdown period, when significant core flow exists. PARCH is a pool boiling heat transfer code that is used during the period of low core inlet flow.

In the SBLOCA technical report, the applicant describes the APR1400 SBLOCA EM in broad terms. It was not clear to the staff that the applicants SBLOCA EM would be able to predict all important physical phenomena determined to be necessary for the accident under consideration 15-197

reasonably well from both qualitative and quantitative points of view. The technical report states that the SBLOCA methodology used for the APR1400 is very similar to the conventional CE SBLOCA methodology used for currently operating U.S. CE-fleet of PWRs. However, the technical report did not provide a discussion of the differences between the KHNP methodology and the previously-approved CE-ABB methodology. The staff needed to understand any differences between the previously-approved methodology and the KHNP methodology to ensure that the changes do not invalidate the previous approval of the applicability or limitations of the methodology. Therefore, on March 8, 2016, the staff issued RAI 431-8504, Question 15.00.02-11 (ML16068A028), raising questions about the licensing-basis methodology and the computer codes used for the APR1400 SBLOCA thermal-hydraulics analysis. The staff requested that all such differences be documented, including the approved CE SBLOCA methodology revision upon which the KHNP SBLOCA methodology is based. The staff was particularly interested in the differences in reactor power level and the treatment of material properties for ZIRLO and M5 in the STRIKIN and PARCH codes. The staff needed to review all the modifications made in the mathematical modeling, computer codes (CEFLASH-4AS, COMPERC-II, STRIKIN-II, and PARCH) used to analyze the APR1400 SBLOCA, and any differences in data transfer between the codes since they were last approved.

In its response to RAI 431-8504, Question 15.00.02-11, dated July 20, 2016 (ML16202A513),

the applicant stated that the KHNP SBLOCA methodology is identical to the ABB-CE SBLOCA methodology approved by the NRC in 1977 except for the inclusion of new cladding material properties. The response also described how CE justified the approved model to address SBLOCA issues documented in NUREG-0737, Clarification of TMI Action Plan Requirements.

NUREG-0737 sought assurances that existing SBLOCA methodologies could adequately or conservatively treat a number of thermal-hydraulic phenomena. While the staff considered model revision as an appropriate method for upgrading analysis methods,Section II.K.3.30 of NUREG-0737 also stated that it was acceptable for a vendor to justify the continued acceptability of their present methodology by comparison to appropriate test data. This latter path was chosen by CE. The results of the CE demonstration of the appropriateness of the SBLOCA methodology are contained in CE reports CEN-203-P, Revision 1, and Supplements 1-4. The continued use of CE SBLOCA methodology was approved by the NRC in 1986. The relevant documents were reviewed by the staff at that time and were found to be a satisfactory demonstration of the validity of the CE SBLOCA methodology. Therefore, the staff concludes that the applicants response is acceptable due to the continued use of the NRC approved CE SBLOCA methodology for the APR1400 reactor design, and RAI 431-8504, Question 15.00.02-11 is resolved and closed.

Section 2 of the technical report gives a brief discussion of the computer codes (CEFLASH-4AS, STRIKIN-II, COMPERC-II, and PARCH) used in the SBLOCA methodology and an overview of the data transfer between the four computer codes used in the SBLOCA methodology. However, no explanation was given about exactly what data are transferred between the codes and how and when they are transferred, automatically or manually. There were not enough details for the staff to have a clear understanding of how the methodology works. Therefore, on March 8, 2016, the staff issued RAI 431-8504, Question 15.00.02-13, requesting the applicant to demonstrate the SBLOCA methodology showing the flow of data between all four computer codes (ML16068A028). The applicants response, dated April 26, 2016, described the automatic and manual transfer of data between the various computer codes (ML16117A591 (non-public)). Figure 1 of the response illustrates the data transfer flow chart for all four computer codes (CEFLASH-4AS, STRIKIN-II, COMPERC-II, and PARCH) involved in 15-198

the Apr1400 SBLOCA methodology. The response shows that COMPERC is used for SBLOCA and there is no data transfer from COMPERC to STRIKIN. It did not specifically address the staffs request regarding the time periods each code was used for a typical transient. However, the staff determined that this does not have any safety significance, as the events that cause one to switch from one code to another were provided and that adequately addresses the staffs question. The response provided the staff with the information requested and facilitated the staffs understanding of data flow between codes. Therefore, the staff concludes that the applicants response is acceptable, and RAI 431-8504, Question 15.00.02-13 is resolved because the applicant has provided sufficient information about the data transfer between the computer codes.

On March 8, 2016, the staff issued RAI 431-8504, Question 15.00.02-14, requesting additional information about the heat transfer correlations used in the licensing-basis computer codes and whether the correlations were within their prescribed limits of thermal-hydraulic conditions for the APR1400 SBLOCA analysis (ML16068A028). If they were being used outside of their prescribed limits, the staff stated that a justification for doing so should be provided. The staff was especially interested in the FLECHT heat transfer correlations used in COMPERC-II, as well as the various pool boiling, film boiling, and critical heat flux correlations used in the STRIKIN-II and PARCH codes. The applicants response to RAI 431-8504, Question 15.00.02-14, dated April 26, 2016, summarized the heat transfer (HT) correlations and their ranges of applicability used in STRIKIN and PARCH (ML16117A589). The response provided the information the staff requested and showed that the applicable pressure ranges of the HT correlations used in PARCH and STRIKIN covered the SBLOCA analyses used for the APR1400 design. The staff noted two editorial errors in the response: the discussion regarding COMPERC-II states that it is used only for large break LOCAs, whereas the response to RAI 431-8504, Question 15.00.02-13 shows that it is used beginning at the time of SIT actuation in the SBLOCA methodology. Also, the discussion of the use of FLECHT based heat transfer and the flow of information from COMPERC-II to STRIKIN is inconsistent with the data flow described in the response to RAI 431-8504, Question 15.00.02-13. However, the staff determined that these editorial errors have no safety significance and the response to RAI 8504, Question 15.00.02-14 is acceptable. Therefore, RAI 431-8504, Question 15.00.02-14 is resolved and closed because the applicant showed that the heat transfer correlations used in the licensing-basis computer codes were within their applicable ranges for the APR1400 SBLOCA thermal-hydraulic conditions.

The applicants methodology defines the beginning of the reflood phase of an SBLOCA as the time when SIT injection begins. Prior to the beginning of reflood, the reactors system response is calculated using the CEFLASH-4AS code, but the reflood phase is calculated using the COMPERC-II code. However, CEFLASH-4AS could be run for the entire transient to generate the hydraulic input parameters for PARCH and STRIKIN-II. The staff did not understand the need to use COMPERC just for the reflood phase. Therefore, on March 8, 2016, the staff issued RAI 431-8504, Question 15.00.02-15 requesting an explanation as to why two computer codes were necessary to compute the system response, when it seems that the entire transient could have been simulated by CEFLASH-4AS alone (ML16117A589). The response to RAI 431-8504, Question 15.00.02-15, dated April 26, 2016, did not discuss why COMPERC-II is used instead of CEFLASH-4AS for the time after SIT actuation, but it did clarify that CEFLASH-4AS is run for the entire transient and provides boundary conditions, such as pressure, to COMPERC-II (ML16117A589). The response emphasized that the two-phase level calculated by COMPERC-II is lower than that calculated by CEFLASH-4AS, adding additional 15-199

conservatism to the calculation. The staff concludes that the response is acceptable as it provides assurance that the usage of COMPERC-II instead of CEFLASH-4AS for the later part of the SBLOCA transient provides additional conservatism to the calculation. Therefore, RAI 431-8504, Question 15.00.02-15 is resolved and closed.

The applicant was also asked to describe how the two-phase level in the core is defined and calculated. On February 22, 2016, the staff issued RAI 415-8503, Question 15.06.05-15 requesting similar information regarding two-phase core water level calculations in the CEFLASH-4AS and COMPERC-II programs, including an explanation of how the interpolation between the two codes two-phase levels is done (ML16053A261 (non-publicly available)). The applicant was requested to provide a clear definition of the two-phase level, elaborate on any criteria or thresholds involved, document the assumptions involved in calculating the two-phase water level in the core, and justify combining CEFLASH-4AS and COMPERC-II reflood two-phase levels as a conservative approach. The applicant was also asked to provide a plot of CEFLASH-4AS and COMPERC-II two-phase levels for the 46.5 cm2 (0.05 ft2) cold leg break and relate this plot to the corresponding two-phase level plot shown in DCD Tier 2 Figure 15.6.5-27E. Additionally, the applicant was ask to identify the time period when interpolation between the CEFLASH-4AS and COMPERC-II 2-phase levels is occurring. RAI 415-8503, Question 15.06.05-15 was asked to help the staff understand the interaction between core two-phase level and fuel rod heat transfer. The April 8, 2016, response to RAI 415-8503, Question 15.06.05-15 (ML16099A033) included the equations CEFLASH-4AS uses to compute the two-phase level. It also presented a figure showing that the calculated two-phase level was in good agreement with the experimental two-phase levels determined in the Westinghouse boil-off tests. Finally, the response addressed the interaction of the two-phase levels calculated by CEFLASH-4AS and, after SIT actuation, COMPERC-II. The staff understood that, at the start of SIT actuation, the two-phase level and the collapsed liquid levels are taken from CEFLASH-4AS and are passed to COMPERC-II. COMPERC-II then calculates its own two-phase level, assuming the core is empty (two-phase level at the core entrance) at the SIT actuation. The two-phase level needed to be passed to PARCH is then determined by an interpolation between the CEFLASH-4AS values of two-phase level and collapsed level at SIT initiation. This process is continued until the calculated two-phase level in COMPERC-II becomes equal to the CEFLASH-4AS collapsed level. Thereafter, the two phase level from COMPERC-II is passed to PARCH. The applicant stated that this process results in a conservative value of two-phase level being used in PARCH because the level is considerably lower than the value calculated by CEFLASH-4AS. The staff agrees with the applicants conclusion. Therefore, the applicants response is acceptable, and RAI 415-8503, Question 15.06.05-15 is resolved and closed because of the conservatism described in the two-phase level calculations.

The APR1400 has a maximum reactor power level of 4,062.7 MWt that is equal to the 3,983 MWt licensed reactor power level plus the 2 percent uncertainty. On March 8, 2016, the staff issued RAI 415-8504, Question 15.00.02-16, requesting the applicant to provide justification for using the CE-ABB SBLOCA methodology for the APR1400 with a power level of 4,062.7 MWt (including uncertainty) that is greater than the 3,800 MWt limit on the approved methodology (ML16068A028). The applicants response dated June 1, 2016 (ML16153A491),

noted that the 3,800 MWt limit is not related to any small break LOCA modeling features, plant designs, and fuel type and was rather set in RG 1.49 in 1973 as an administrative limit until sufficient experience was gained with design, construction, and operation of large plants. Since that time, the NRC has additionally approved the use of Supplement 1 Method (S1M) SBLOCA methodology to license the CE System 80+ and the Palo Verde Nuclear Plants at power levels15-200

up to 4,070 MWt (including uncertainty). The APR1400 power level (4,062.7 MWt, including uncertainty) is within the range of power levels for which the S1M methodology has been approved by the NRC. In response to RAI 415-8504, Question 15.00.02-16, the applicant also documented that there are no known phenomenological departures or design differences that would invalidate the use of the S1M methodology for the APR1400 design. Further, S1M is an Appendix K method that uses a conservative 1.2 multiplier on the 1971 ANS decay heat curve.

Westinghouse revised the methodology from S1M to the Supplement 2 Method (S2M) in 1998, which the NRC approved. The response also documents that for the same plant conditions, S1M is more conservative than S2M. Therefore, because the staff concurs that the S1M SBLOCA methodology is acceptable for application to APR1400 licensing at 4,062.7 MWt (including uncertainty), the staff concludes that the applicants response is acceptable, and RAI 415-8504, Question 15.00.02-16 is resolved and closed. Additional discussion of the computer programs used in the SBLOCA methodology is addressed in Section 15.0.2 of this SER.

The CE-FLASH-4AS noding diagram presented in technical report APR1400-F-A-NR-14001indicates that safety injection is into the node directly below the cold leg nozzles. This way, the SIT and SIP flows are injected into the downcomer below the node where the cold legs are connected to the downcomer, which is confirmed by the technical report description that mentions that the ECCS is modeled by flow paths connected to the lower annulus. However, the DVI nozzles are actually located in the upper annulus of the APR1400 design, 2.1 m (6.89 ft) above the cold leg nozzles. Locating the DVI nozzles below the cold leg in the model may lead to a non-conservative retention of water in the Reactor Pressure Vessel (RPV) by reducing the amount of ECC bypass that will result in the model underestimating the amount of SI liquid being carried out of the break. The approved CE-ABB SBLOCA methodology specifies that CEFLASH-4AS is to be used until the SITs are activated. Thus, for smaller breaks in the cold leg, there is ample opportunity for the pumped safety injection to be bypassed to the break, an effect which is precluded with the nodalization being employed in the CEFLASH-4AS model. The applicants depicted methodology provides no mechanism for the ECCS injection water to be ejected out of the break, and thus the staff was concerned that it may be non-conservative in this regard. Therefore, on February 22, 2016, the staff issued RAI 415-8503, Question 15.06.05-17 requesting the applicant to justify that placing the DVI nozzles below the cold legs in the lower annulus instead of the upper annulus, where they are physically located, results in a conservative or realistic treatment of ECCS injection in the CEFLASH-4AS simulations for both the DVI line and cold leg breaks (ML16099A033).

By letter dated April 8, 2016, the applicant responded that location of the DVI injection ports in the model is necessary to prevent numerical instabilities in CEFLASH-4AS after ECC is injected into the steam region (ML16099A033). The actual port locations are about 2 m (6.56 ft) higher in the plant downcomer than they are in the model. To demonstrate that the model is acceptable for cold leg breaks at the upper end of the SBLOCA spectrum, three simulations of a 506 cm2 (0.5454 ft2) break were made, while there are two High Pressure Injection (HPI) systems available for cold leg breaks. The three simulations have ECCS flow equivalent to 2 HPIS, 1.5 HPIS, and 1 HPIS, respectively. The PCT for the 3 simulations was 610 °C (1,130

°F), 620 °C (1,148 °F), and 665 °C (1,229 °F), respectively. Thus, the simulations show that even if 50 percent of the HPIS flow were bypassed in the calculation, there would only be a minimal impact on the calculated PCT. The response demonstrated that, while the CEFLASH-4AS model may be under predicting the amount of ECC bypass, increasing its prediction to 50 percent of the HPIS flow, a fairly high degree of ECC bypass for a SBLOCA in a DVI plant, predicted the PCTs to be several hundred degrees below the acceptable limit. The staff 15-201

concludes that the CEFLASH-4AS model has sufficient conservatism for the ECC injection location and the response is acceptable. Therefore, RAI 415-8503, Question 15.06.05-17 is resolved and closed.

According to DCD Tier 2 Table 15.6.5-7, the low pressurizer pressure reactor trip setpoint used in the SBLOCA analyses is 109.3 kg/cm2 absolute (1,555 psia). A comparison of DCD Tier 2 Figures 15.6.5-27A and 15.6.5-27B suggests that the reactor tripped at a pressure of about 128 kg/cm2 absolute (1,821 psia). On February 22, 2016, the staff issued RAI 415-8503, Question 15.06.05-20, requesting the applicant to explain the apparent discrepancy between the low pressure reactor trip value given in DCD Tier 2 Table 15.6.5-7 and the value indicated from the normalized power and inner vessel pressure plots (ML16053A261 (a non-public proprietary RAI question)). The applicant responded on April 8, 2016, by explaining that the rapid decrease in pressure from 128 kg/cm2 (1,821 psia) at about 166 seconds was not due to reactor trip but due to steam release to hot leg (ML16099A033). The low pressurizer pressure trip setpoint (109.3 kg/cm2 (1,555 psia)) was reached approximately 50 seconds later. The response provides the requested clarification and is therefore acceptable. Therefore, RAI 415-8503, Question 15.06.05-20 is resolved and closed.

SBLOCA Analysis Input Assumptions Section 4 of the technical report, SBLOCA Analysis, states that it is conservatively assumed that the offsite power is lost (LOOP) upon reactor trip. The assumption of LOOP leads to loss of power to the RCPs when the reactor trips. The staff needed to understand why this is a conservative assumption. If offsite power is not lost, the RCPs would continue to run for an extended period, resulting in more liquid lost out of the break. Therefore, on February 22, 2016, the staff issued RAI 415-8503, Question 15.06.05-18, requesting the applicant to justify that the loss of offsite power upon reactor trip is a conservative assumption with respect to an SBLOCA and provide a supporting analysis (ML16053A261 (a non-public proprietary RAI question)). The applicants response, dated April 8, 2016, cited sensitivity studies performed by KHNP using CE and Westinghouse licensing basis methodologies that showed that leaving the RCPs running for several minutes after a reactor trip resulted in lower, or no, PCT relative to pumps tripped at the time of the reactor trip (ML16099A033). The applicant also presented a RELAP5 confirmatory study for a DVI line break, which showed a similar result. The study showed that, while the break flow was initially higher for the pumps-on case, the RCPs running also swept vapor around the loops, which resulted in early loop seal clearing and a rapid reduction in break flow due to vapor reaching the break. The staff finds that the applicant has provided sufficient justification in its response, based on the sensitivity studies using CE and Westinghouse approved methods for its LOOP assumption for the SBLOCA analysis. The staff notes that the assumption is also consistent with what is assumed for other plants. Based on these reasons, the staff finds the applicants response to be acceptable, and RAI 415-8503, Question 15.06.05-18 is resolved and closed.

The SBLOCA analyses assumed 102 percent of nominal power, with an axial power shape having the maximum allowed TS peaking factor, Fq, located 15 percent below the top of the core. The staff considers these assumptions to be appropriately conservative because the normal operation peaking factor is at least 20% less than the maximum value used in the safety analysis and is located near the center of the core. Having the maximum peaking near the top of the core is conservative because it increases the chance that the peak power spot will become uncovered during the SBLOCA. On February 22, 2016, the staff issued RAI 415-8503,15-202

Question 15.06.05-16, requesting the applicant to provide the axial power shape being used in the SBLOCA runs, both for the average core (CEFLASH-4AS input) and for the hot rod (STRIKIN and PARCH inputs). The applicant needed to provide the information showing how the hot spot peaking factor Fq, which is the peak-to-average power ratio, has a value of 2.6.

This information was needed so that the staff could confirm that conservative power shapes were used in the SBLOCA analysis. On April 8, 2016, the applicant responded by providing the requested power shapes, both for the average core and for the hot rod, which confirmed the conservative peaking for the hot rod at an Fq of 2.625 (ML16099A033). The applicants response is acceptable, and RAI 415-8503, Question 15.06.05-16 is resolved and closed.

All analyses have assumed that offsite power is lost upon reactor trip, so no pumped SI flow is allowed until 40 seconds after the SIAS setpoint is reached; 40 seconds is the time assumed for diesel startup and load sequencing. The assumption of 40 seconds as a conservative time period must be confirmed. This is identified as an ITAAC Item in DCD Tier 1, Chapter 2. The applicant is also required to demonstrate that the flows used in its analyses are indeed the minimum flows that can be provided by the SI pumps. This is identified as an ITAAC item 9.d in DCD Tier 1, Chapter 2, Table 2.4.3-4.

Initial Loop Seal Clearing The APR1400 Tier 2 DCD Section 15.6.5 and the referenced SBLOCA Technical Report APR1400-F-A-NR-14001 describe the analysis results of the SBLOCA evaluation and core cooling with a deep loop seal, at a high level. The staff was concerned that the modeling of the loop seal clearing phenomena may not be conservative. Therefore, on August 7, 2015, the staff issued RAI 143-8092, Question 15.06.05-1, (ML15221A006) asking the applicant to provide the technical basis to establish that the analysis methodology and applied computer codes conservatively characterize (1) the safety-significant phenomena of loop seal formation and clearing, and (2) PCT during a limiting SBLOCA for the initial phase of blowdown and reflood as well as LTC with potential core reheat and secondary cladding temperature rise. The information is needed to demonstrate that the APR1400 design with a deep loop seal geometry is capable of maintaining core cooling before and after the initial loop seal clearing. The information is also needed to demonstrate that the PCT remains within acceptable limits for the most challenging SBLOCA sizes and locations, including cold leg slot breaks. RAI 143-8092, Question 15.06.05-1 also requested the applicant to provide any analysis or calculation results that demonstrate meeting the acceptance criteria. The applicants response to RAI 143-8092, Question 15.06.05-1, dated September 3, 2015 (ML15246A531) provided a qualitative assessment of the loop seal phenomenon for APR1400. It noted that loop seal refilling due to back flow from the cold leg during long term cooling is precluded by the geometry of the RCP.

The exit of the RCP volute is almost at the top of the cold leg. Thus, the cold legs would have to be nearly full before back flow into the loop seals could occur. However, the applicant noted that this geometrical feature is not modeled in the CEFLASH-4AS code for APR1400 and stated that the SBLOCA simulations were therefore conservative because they would allow flow back into the loop seals even when it could not occur. The staff concurs with the applicants conclusion about the conservatism in the SBLOCA simulations because the modelling of the RCP/loop seal is conservative with respect to refilling of the loop seals due to back flow from the cold leg.

The applicants response to RAI 143-8092, Question 15.06.05-1, also noted that the CEFLASH-4AS model of the loop seal consists of two vertical control volumes that extend to the 15-203

bottom elevation of the loop seal. Hence, rather than the loop seal clearing when the loop SG side level reaches the top elevation of the loop seal horizontal segment, the level must be depressed an additional 0.76 m (30 in.) (i.e., the diameter of the loop seal horizontal section that is a part of the cold leg cross-over piping). Assuming a deeper loop seal results in delayed loop seal clearing and is conservative. The staff concurs with this assessment but notes that the timing of loop seal clearing is less important than the number of loop seals calculated to clear.

There is no obvious conservatism in the CEFLASH-4AS model in this regard. The lumping of two loop seals into a single loop seal for the intact leg could lead to a non-conservative result if it cleared instead of one of the other loop seals for a simulation in which only one loop seal is calculated to clear. For this reason, the staff issued several additional RAIs related to loop seal clearing (RAI 415-8503, Questions 15.06.05-13, 15.06.05-14, and 15.06.05-19). As discussed in the following paragraphs, the applicants responses to those RAIs have been found to be acceptable and have convinced the staff that the CEFLASH-4AS treatment of initial loop seal clearing is acceptable, given the overall conservatism in the SBLOCA methodology. The staffs concerns regarding loop seal modeling and loop seal clearing have been allayed; therefore these issues are closed with regard to the applicants SBLOCA EM. However, the issue remains open with regard to loop seal reformation and boron dilution during the LTC phase of a LOCA. The applicant proposed to submit a revised response to RAI 143-8092, Question 15.06.05-1 per the statements made in the June 16, 2016, public meeting. The supplemental response (ML16363A031) addressed the potential for loop seal reformation during the long term cooling phase of a LOCA. Long term (7200 s) CEFLASH-4AS calculations for several SBLOCAs showed that cladding temperatures remained below 343 °C (650 °F), thus meeting the long term cooling requirement that post-LOCA cladding temperatures remain less than the previously-accepted 427 °C (800 °F). The staff had accepted this temperature limit in the Final Safety Evaluation for the Pressurized Water Reactor Owners Group (PWROG) Topical Report WCAP-16793-NP, Revision 2, Evaluation of Long-Term Cooling Considering Particulate Fibrous and Chemical Debris in the Recirculating Fluid, (ML13084A154) . This temperature limit was selected by the PWROG based on autoclave test data that demonstrated oxidation and hydrogen pickup to be acceptable and not cause the fuel cladding to become brittle. The Advisory Committee for Reactor Safeguards (ACRS) has endorsed this acceptance criterion for long-term cooling [Reference 43].

It was not clear to the staff if the SBLOCA licensing basis codes used for the APR1400 have been qualified for core uncovery, PCT, and loop seal formation and clearing. Accordingly, on March 8, 2016, the staff issued RAI 431-8504, Question 15.00.02-12, requesting the applicant to provide the methods by which the codes were qualified for these phenomena in the APR1400, for both the direct vessel injection (DVI) line and cold leg breaks (ML16068A028).

The applicants response to RAI 431-8504, Question 15.00.02-12, dated April 26, 2016, stated that the SBLOCA methodology conservatively delays loop seal clearing because it models the loop seals as two vertical control volumes connected at the bottoms (ML16117A589). The response also noted that the CEFLASH-4AS model, which explicitly models two loop seals in the broken loop but combines the two loop seals in the intact loop, was approved by the NRC

[References31 and 32]. The staff recognizes this fact but notes that, since that time, the loop seal clearing phenomenon has been explored in detail with advanced computer programs. The staff was concerned that the lumped loop seal nodalization used in the CEFLASH-4AS model may not be conservative as it once was thought to be. However, after reviewing the break spectrum results presented in response to RAI 318-8337, Question 15.06.05-2, the staff concludes that the lumped loop seal approach is acceptable given the conservative modeling of the depth of the loop seals. The break spectrum showed that the lumped loop seal did not clear 15-204

until several hundred seconds after the two single loop seals for the limiting PCT case.

Therefore, the staff concludes that the applicants response is acceptable, and RAI 431-8504, Question 15.00.02-12 is resolved and closed because of the conservatism inherent in the loop seal modeling.

The CE-FLASH-4AS model nodalization combines two intact loop cold legs into a single equivalent cold leg. The staff was concerned that such lumped cold leg modeling of two loop seals as a single loop seal could lead to a non-conservative treatment of loop seal clearing for some breaks. Since there is a range of break sizes where only two or three loop seals will clear, the staff was concerned that the KHNP SBLOCA methodology would clear one too many loop seals if it clears the lumped loop seal and one other single loop seal instead of two single loop seals. On February 22, 2016, the staff issued RAI 415-8503, Question 15.06.05-13 requesting the applicant to address the staffs modeling concern about the 2-combined loop seal and to demonstrate that loop seal clearing is treated conservatively or reasonably well (ML16053A261 (a non-public, proprietary RAI question)). The staff needed to understand why it would be acceptable if the 2-combined loop seal clears and one of the single loop seals does not. The applicants response to RAI 415-8503, Question 15.06.05-13 dated July 20, 2016 (ML16202A531), asserted that the CEFLASH-4AS lumped loop seal nodalization was originally accepted by the staff based largely on the overall conservatism in the S1M SBLOCA methodology. The response to RAI 318-8337, Question 15.06.05-2 (break spectrum) shows that, for the 103 cm2 (0.1108 ft2) and 126 cm2 (0.1356 ft2) break cases, the lumped loop seal did not clear until several hundred seconds after the two other loop seals cleared. In the 153 cm2 (0.1647 ft2) case, all loop seals cleared simultaneously. In all cases, the PCT was 300 °C (540

°F) or more below the allowable limit of 1,204 °C (2,200 °F). These results have demonstrated to the staff that the applicants methodology does not clear the combined loop seal for the limiting case. Therefore, the staff finds the modeling of the loop seals in CEFLASH-4AS acceptable, and RAI 415-8503, Question 15.06.05-13 is resolved and closed because of the demonstrated conservatism in the modeling of two loop seals as a single loop seal, which is also in line with an NRC approved methodology.

On February 22, 2016, the staff also issued RAI 415-8503, Question 15.06.05-14 requesting the details of loop seal clearing (i.e., which loop seals clear and at what times) and the PCT to demonstrate that loop seal clearing is being treated conservatively or reasonably well by using the licensing basis codes in the SBLOCA analyses (ML16053A261 (a non-public proprietary RAI Question)). The applicant was asked to provide a comparison between the licensing basis calculations and RELAP5 SBLOCA simulations for the 18.6 cm2 (0.02 ft2) and 372 cm2 (0.4 ft2)

DVI line breaks and for 46.5 cm2 (0.05 ft2) and 465 cm2 (0.5 ft2) cold leg breaks. Details of the loop seals clearing for each break size analyzed and any core uncovery were also requested, to include the respective transient plots for the PCT, two-phase mixture levels in the core and the loop seals, average void fractions in the core and the cold legs, vapor mass flow rate through the loop seals, injection flow rate, core pressure, and break flowrate. The applicant was also asked in RAI 415-8503, Question 15.06.05-14, to provide the core void fraction distributions along the core height for the limiting DVI line break and cold leg break; document the reasons or assumptions behind multiple core uncoveries during the initial phase of SBLOCA analyzed; outline the conservatisms used in the analysis, such as the decay heat multiplier, etc.; and explain the criteria used to identify the most limiting SBLOCA.

On July 12, 2016, the applicant responded to RAI 415-8503, Question 15.06.05-14 by presenting the results of the requested simulations (ML16194A298). The comparison shows15-205

that the KHNP methodology predicts core heatup for all four breaks analyzed in the response.

Even when CEFLASH-4AS predicted more loop seals to clear than RELAP5 did, its core response model gave a PCT higher than RELAP5. Furthermore, the staff performed confirmatory analysis using TRACE, which demonstrated that the approved methodology from KHNP produces conservative results. The staff concludes that the response provides valuable confirmation of the conservatism of the CE-SBLOCA methodology. The staff also reviewed the SBLOCA break spectrum analyses submitted by the applicant in response to RAI 318-8337, Question 15.06.05-2. The review confirmed that the limiting break size showed two loop seals clearing. Nevertheless, the applicants CEFLASH-4AS calculated PCT was much higher than the one predicted by the staffs TRACE and the applicants RELAP5 confirmatory analyses.

This result is a sufficient demonstration that the loop seal modeling in CEFLASH-4AS is acceptable, given the overall conservatism in the SBLOCA methodology; therefore, the staff concludes that the applicants response is acceptable, and RAI 415-8503, Question 15.06.05-14, is resolved and closed.

According to CENPD-137P, Calculative Methods for the CE-Small Break LOCA Evaluation Model, a constant 50 percent quality value is assumed at the exit junction of the loop seal after the loop seal clears. This assumption could lead to removal of all the liquid from a loop seal when, in fact, some liquid may remain at the bottom of the crossover piping. Therefore, on February 22, 2016, the staff issued RAI 415-8503, Question 15.06.05-19, requesting the applicant to justify the assumption as realistic or conservative, as it is used to simulate the removal of the liquid retained in the pump side of the loop seals (ML16053A261 (a non-public proprietary RAI Question)). On July 20, 2016, the applicant responded (ML16202A531) that the numerical scheme of the CEFLASH model for loop seal clearing requires some non-zero value of quality to remove liquid from the loop seal once the two-phase level drops below the bottom of the cold leg. The response also stated that CEFLASH-4AS adequately predicted the loop seal clearing phenomena in Semiscale Test S-UT-8 using a 50 percent quality. The S-UT-8 test was designed to induce an extended core water level depression prior to loop seal clearing.

The staff notes that a value of 50 percent quality corresponds to a void fraction of about 95 percent at the pressure (~8.2 MPa (1,190 psia)) when the loop seals clear. Furthermore, any liquid remaining in the loop seals after loop seal clearing will eventually flash to steam as the RCS pressure declines. Further, the assumption of 50 percent quality within the loop seal as used in CEFLASH-4AS is a part of the NRC-approved S1M methodology that leads to overall conservative transient calculation results. Therefore, the staff finds that the post-loop seal clearing use of a 50 percent quality at the loop seal exit is a reasonable assumption and concludes that the applicants response is acceptable, and RAI 415-8503, Question 15.06.05-19 is resolved and closed.

Break Spectrum Analysis The applicants single failure analysis determined that the worst single failure is the failure of one SIP train, causing the loss of one of the four SIPs. Another SIP train is conservatively assumed unavailable due to maintenance. The applicants single failure analysis is reviewed in DCD Tier 2, Section 6.3. Two types of breaks were analyzed by the applicant: breaks in one of the cold legs and breaks in one of the DVI lines. Because of the assumed single failure (for the cold leg breaks the minimum flow from two SIPs was assumed; for the DVI line breaks the minimum flow from only one SIP was assumed), all SI for the broken DVI line was assumed to spill out the break.15-206

During the review of the SIPs design, the staff noted that the applicants SBLOCA analysis presented in DCD Tier 2, Section 15.6.5, evaluated break sizes down to 18.6 cm2 (0.02 ft2) and showed adequate SIP performance at the smallest break size. Breaks smaller than 18.6 cm2 (0.02 ft2) were not presented to the staff for review. SRP Section 6.3, review procedure 22.A, states that the lower limit of break size for which SIS operation is required needs to be established, which is also the maximum break size for which the CVCS can maintain RCS pressure and inventory. Based on the review of the CVCS (as documented in Section 9.3.4 of this SER), the staff was unable to determine if the SIS capability could cover break sizes down to the largest break size (i.e., maximum normal operational leakage) against which the CVCS is used for mitigation. Therefore, on February 22, 2016, the staff issued RAI 415-8503, Question 15.06.05-21 to request the applicant to provide confirmation that the smallest break analyzed is adequate, i.e., that breaks smaller than 18.6 cm2 (0.02 ft2) could be handled by normal CVCS with no core uncovery (ML16053A261 (a non-public proprietary RAI question)).

On June 8, 2016, the applicants response to RAI 415-8503, Question 15.06.05-21 (ML16160A332) confirmed that the smallest SBLOCA analyzed, as documented in DCD Tier 2, Section 15.6.5, for which the SIS performs adequately is 18.6 cm2 (0.02 ft2). The applicant also confirmed that the largest break size that can be handled by normal CVCS is 0.3 cm2 (0.00032 ft2). The staff noted a gap between the break sizes the CVCS and SIS are analyzed to handle.

However, through its review, the staff noted that no core uncovery occurs during a 1,500 second simulation of the 18.6 cm2 (0.02 ft2) SBLOCA. For breaks larger than 0.3 cm2 (0.00032 ft2),

inventory would be slowly lost from the RCS and the pressure will eventually fall to the low pressurizer pressure setpoint, initiating the SIS along with reactor trip. This will occur well before any core uncovery. Thus, for any break size smaller than 18.6 cm2 (0.02 ft2) and larger than maximum CVCS makeup capability, the design of the SIPs will allow RCS inventory to be safely controlled. Therefore, because there is adequate overlap between the APR1400 CVCS, which is the system used to control normal operational leakage, and the SIS, which is the safety-related system credited for RCS makeup during accidents, the staff finds the applicants response reasonable and acceptable. Therefore, RAI 415-8503, Question 15.06.05-21, is resolved and closed.

The applicant relied on a break size sensitivity study performed by CE in 1974 (Topical Report CENPD-137P) for justification for not considering break sizes between 464.5 cm2 (0.5 ft2) and 929 cm2 (1.0 ft2), which is the smallest LBLOCA considered in the CE LBLOCA methodology. The staff noted that there are many differences between the reactor used in the sensitivity study and the APR1400, including, but not limited to, ECCS pump characteristics, accumulator setpoints, and reactor power. Therefore, on February 10, 2016, the staff issued RAI 404-8488, Question 15.06.05-10, requesting the applicant to demonstrate that the 464.5 cm2 (0.5 ft2) break size remains the largest SBLOCA which must be considered, or provide a discussion of limiting break sizes between 464.5 cm2 (0.5 ft2) and 929 cm2 (1.0 ft2)

(ML16041A096). The applicant responded by letter dated July 19, 2016, stating that breaks larger than 464.5 cm2 (0.5 ft2) are treated by the current KHNP LBLOCA methodology (ML16201A284). In a public meeting held on June 16, 2016, the applicant presented results comparing the LBLOCA and SBLOCA PCTs. The PCT calculated by the LBLOCA methodology was greater than the PCT calculated by the SBLOCA methodology. This comparison demonstrates that limiting the break size spectrum in the SBLOCA methodology to the largest break size of 464.5 cm2 (0.5 ft2) is reasonable; therefore, RAI 404-8488, Question 15.06.05-10, is resolved and closed.15-207

Section 15.6.5 of the DCD presented figures illustrating the core two-phase mixture level, pressure, break flow, coolant, and cladding temperatures at the hot spot. Comparing the plots of coolant temperature and cladding temperature, the staff found that cladding temperatures for several of the break sizes shown in DCD Tier 2 Section 15.6.5 were between 60 °C (108 °F) and 150°C (270°F) greater than the saturation temperature when the calculation is terminated, even though the two-phase mixture level was calculated to be above the top of the core. SRP Section 15.6.5, specifies that calculations should be carried out until the top of the core has been recovered with a two-phase mixture and cladding temperature has been reduced to near saturation temperature. This guidance provides a method to ensure that the core would not be calculated to uncover again. On November 24, 2015, the staff issued RAI 318-8337, Question 15.06.05-4 requesting that the applicant carry out the calculations for all break sizes listed in RAI 318-8337, Question 15.06.05-2 until the NUREG-0800 cladding temperature criterion is satisfied, i.e., running out until the time when the cladding temperatures approach the saturation temperature, in order to address the staff concerns about potential core reheating (ML15328A005). By letter dated July 12, 2016, the applicant responded to RAI 318-8337, Question 15.06.05-4 (ML16194A269 (non-public)) by listing the following five criteria that were used to determine if a SBLOCA simulation could be terminated without the potential for subsequent core reheating:

1. The core mixture level should have recovered to a level above the active core.

2. The total SI flow should be greater than the total break flow.

3. The system pressure should be steadily decreasing or have leveled off to an acceptable value.

4. The hot rod cladding temperature should have reached a maximum value less than the licensing limit, be steadily decreasing or leveled off, and have reached a temperature low enough to preclude further oxidation.

5. The hot rod local oxidation at all axial elevation should have leveled off to a value less than 17 percent.

The staff reviewed the detailed break spectrum results in the applicants response to RAI 318-8337, Question 15.06.05-2, and confirmed that all the simulations met the above criteria when they were terminated. The staff concurs with the applicants approach as there is no potential for core heatup, had the simulations been continued further in time. Therefore, the staff concludes that the applicants response is acceptable, and RAI 318-8337, Question 15.06.05-4 is resolved and closed.

In the applicants initial SBLOCA analysis (Revision 0 of the APR1400 DCD) for breaks smaller than 95 cm2 (0.1 ft2), PCTs were calculated to occur when the calculated two-phase mixture level was about 2 m (6.6 ft) above the top of the core. For the 18.6 cm2 (0.02 ft2) DVI line break, the two-phase mixture level is shown to be about 2 meters (6.6 ft) above the top of the core when PCT occurs at approximately 1,200 seconds (DCD Tier 2 Figures 15.6.5-31E, 15.6.5-31F, and 15.6.5-31H). On November 24, 2015, the staff issued RAI 318-8337, Question 15.06.05-3 requesting the applicant to explain whether the calculations showing the core covered by the two-phase level are sufficient proof that the core will remain cooled and will not result in a PCT higher than the regulatory limit (ML15328A005). It also asked how the core could be covered with a two-phase mixture and yet the cladding temperature be more than 100 K higher than the 15-208

saturation temperature. The response to RAI 318-8337, Question 15.06.05-3 dated July 20, 2016 (ML16202A526), acknowledged that there was a mistake in the 18 cm2 (0.02 ft2) break analysis that resulted in switching from STRIKIN to PARCH at an incorrect time. The applicant committed to reperforming the calculation and revising the DCD figures. The revised analysis was submitted as part of the response to RAI 318-8337, Question 15.06.05-2. The revised analysis showed the expected behavior for all break sizes, i.e., no core heatup when the two-phase mixture level was above the top of the core. This response is acceptable to the staff as the error identified by the staff in the applicants SBLOCA analysis has been fixed. Based on its review of the DCD, the staff confirmed the changes described above; therefore, RAI 318-8337, Question 15.06.05-3 is resolved and closed.

The results of the SBLOCA break spectrum presented in Table 15.6.5-10 of Revision 0 of the DCD show a trend of increasing PCT for decreasing break size. It is therefore possible that a break smaller than the smallest break analyzed could be more limiting. SRP Section 15.6.5 notes that in the analysis of small breaks, evaluating integer diameter break sizes (i.e., 1, 2, 3, 4-inch, etc.) is considered insufficient to determine the worst break because the break areas associated with these integer diameters are too coarse to adequately identify the highest PCT. Therefore, the staff considered the number of break sizes analyzed to be insufficient to identify the limiting SBLOCA break size. DCD Tier 2 Revision 0, Table 15.6.5-10 also shows that the PCT for the DVI line break is nearly the same for the smallest break (616 °C [1,141 °F]) and the largest break (624 °C [1,156 °F]) analyzed. The largest break area corresponds to the complete severance of a DVI line, so a larger break need not be analyzed, but the staff was concerned that a cold leg break smaller than 46.5 cm2 (0.05 ft2) could be more limiting. Therefore, on November 24, 2015, the staff issued RAI 318-8337, Question 15.06.05-2 requesting the applicant to provide the results of a break spectrum similar to that specified in NUREG-0800, Section 15.6.5 (ML15328A005). The applicant was asked to provide the results of a finer break spectrum for both the DVI line and pump discharge (PD) line breaks to establish that the ECCS will function to meet acceptance criteria specified in 10 CFR 50.46. The results must include the PCT as well as the number of loop seals clearing for each SBLOCA break size analyzed.

The applicants response to RAI 318-8337, Question 15.06.05-2 dated July 12, 2016 (ML16194A269), provided the results of a break spectrum ranging from 3.8 cm (1.5 in.) to 21.6 cm (8.5 in.) diameters in 1.27 cm (1/2 in.) intervals. The results showed that a 12.7 cm (5 in.)

diameter break simulation reached the highest PCT of 918 °C (1,684 °F). The staff also conducted confirmatory analyses of the APR1400 SBLOCA using the TRACE code. The TRACE confirmatory analyses were performed for a spectrum of break sizes and locations to independently verify the SBLOCA licensing basis calculations results presented in Chapter 15 of the APR1400 DCD. Using the DCD assumptions, SBLOCA analyses were performed for pipe breaks in a PD cold leg and at a DVI line, for a fully open pressurizer safety valve at the top of the pressurizer, and for a fully severed core instrument tube rupture at the reactor bottom head.

All the analyses assumed failures of two of the four SI pumps. All four SITs were assumed available. Additionally, for a DVI line break, flows from the connected operational SIPs and the connected operational SIT spill out the break. By comparing the SBLOCA spectrum analysis results provided in RAI 318-8337, Question 15.06.05-2 response with the TRACE predictions, the staff determined that the applicants CEFLASH-4AS licensing basis results bound the staffs TRACE confirmatory calculation results and are, thus, more conservative. Therefore, staff concluded that the applicants response to RAI 318-8337, Question 15.06.05-2 has fulfilled the staff RAI request to conduct the detailed SBLOCA break spectrum analysis to identify the 15-209

limiting SBLOCA and present the results. Therefore, RAI 318-8337, Question 15.06.05-2 is resolved and closed.

The staff evaluation of the radiological consequences of a small break LOCA are presented in Section 15.0.3 of this SER.

Long Term Cooling Plan The staff reviewed APR1400 DCD Tier 2, Section 15.6.5.3, Core and System Performance, Subsection 15.6.5.3.3, Results, which describes the basic LTC plan to maintain the core at safe temperature levels by avoiding the precipitation of boric acid. The staff also reviewed the details of the plan, which are provided in Technical Report Post-LOCA Long Term Cooling Evaluation Model, [Reference 14].

The staff notes that the LTC plan recognizes the difference in behavior between large and small breaks. For small breaks, the system pressure will remain high, so cooldown will occur by heat removal through the SGs until the pressure and temperature are low enough for a switch to the shutdown cooling system. Refilling the RPV disperses boric acid, and for very small breaks, the system refills, and the boric acid concentration is limited due to mixing by natural circulation flow.

For large breaks, the staff notes that the core is adequately cooled by the injection flow during the initial phase of the LOCA event, which is sufficient to remove decay heat by boiling of the injected coolant. The system depressurizes due to steam flow out of the break in excess of the vapor generation rate. Boiling in the core will result in a buildup of boric acid. The applicant evaluated various break locations in Technical Report APR1400-F-A-NR-14003 and demonstrated that the large cold leg break is more limiting than the large hot leg break. The applicant also showed that there is a range of break sizes where boric acid precipitation is prevented by either flushing by SIP injection switch over from the cold leg side to the hot leg or by dispersal of natural circulation. The overlap range covers an order of magnitude in break sizes, from 3.7 cm2 (0.004 ft2) to 37.2 cm2 (0.04 ft2). The switch to simultaneous hot leg and DVI line injection is implemented by the operator regardless of the break size. The staff notes that, for any large hot leg break, the short-term ECCS injection flow through the DVI lines will fill the downcomer annulus and provide the elevation head necessary to force flow through the core and out of the hot leg break. Liquid flow in excess of the core boil-off will flush the core, and it will decrease and maintain the core boric acid concentration similar to that of the low levels at initial IRWST concentration. For large cold leg breaks, however, boric acid concentrates in the core as long as the cold leg injection is continued. The large cold leg break is then the limiting case in the sense that flushing of the core is necessary before the boric acid concentration reaches the solubility limit. The staff reviewed the bounding analysis performed by the applicant to determine the maximum time when operator action is required to switch to hot leg/DVI line injection, which flushes the core.

The plan for operator action uses the pressurizer pressure reading to determine whether the break is large or small. The staff notes that the LTC plan provides for maintaining core cooling and boric acid flushing by simultaneous hot-leg and DVI line injection between two and three 15-210

hours after event initiation. Further operator action is taken to switch to shutdown cooling mode should the pressure remain elevated between eight and nine hours following event initiation.

Figure 2-1 of Reference 12, a schematic that shows automatic system responses and manual operator actions, and related discussions on the LTC plan were reviewed by the staff. The plan indicates that the SIPs and the AFWS are actuated automatically following event initiation. The first operator action is taken within one hour of event initiation and is dependent on the availability of offsite power. If offsite power is available, the operator activates the turbine bypass system. If not, the operator activates the ADVs. Either system will dump steam and, together with the AFWS, initiate cooldown by the SGs. Whether or not offsite power is available, the safety function for each system (assuming the other system is not functioning) provides sufficient capacity and capability to assure that heat removal by the SGs occurs and the core can be cooled in the event of the postulated accident.

Between one and three hours post-LOCA, the operators isolate or vent the SITs to avoid injecting a large quantity of nitrogen (non-condensable) gas into the RCS. Between one and four hours post-LOCA, pressurizer cooldown is initiated. Between two and three hours after event initiation, the operators align SI flow to the hot legs and DVI nozzles. This action is performed for all break sizes and locations. As discussed later, the maximum time that can elapse is determined by the boron precipitation analysis. Inclusion in the LTC of a maximum time for the operators to switch the injection flow plan is necessary. Therefore, the staff finds this acceptable to eliminate the potential for boron precipitation because the hot leg injection switchover time has been determined based on the boron precipitation analysis.

Another operator action specified by the applicant is to initiate shutdown cooling if the system is operable and the pressure is above a specified value at eight hours after event initiation according to RG 1.97, Criteria for Accident Monitoring Instrumentation for Nuclear Power Plants. GDC 13 requires operating reactor licensees to provide instrumentation to monitor variables and systems over their anticipated ranges for accident conditions as appropriate to ensure adequate safety. According to DCD Tier 2, Section 7.1.1.5, the accident monitoring system provides the operator with information that is used to assess the state of the plant following anticipated operational occurrences and postulated accidents. Pressurizer pressure is the signal used to make a decision on entering shutdown cooling.

Based on the automatic and manual operations prescribed in the LTC plan and the staffs review of those operations, the staff concludes that the specified actions are acceptable for preventing boron precipitation given that the time for operator actions determined by the boron precipitation analysis is justified. Therefore, staff determined that the plan thus complies with GDC 13, 17, and RG 1.97.

Boron Precipitation Analysis To assure adequate core cooling sufficient to maintain the fuel rods at acceptably low temperatures, precipitation of boric acid post-LOCA must be avoided since the precipitated boron has the potential of blocking or partially blocking inlet flow to the core. Reduced flow will impair core cooling and could lead to temperature excursions that result in fuel damage. The LTC plan is designed to prevent boric acid precipitation by switching the high pressure safety injection (HPSI) flow from the initial cold-side alignment to a combined hot leg/DVI and cold leg injection scheme. A design-specific implementation of what is referred to as the interim, or 15-211

Waterford methodology [Reference 13], was used by the applicant to determine the concentration of boric acid in a mixing volume at various times after event initiation. The analysis defines a maximum time that can elapse before the switch to simultaneous injection must occur.

The interim methodology used by the applicant is based on the approach described in the CE Topical Report CENPD-254-P-A. As noted in the topical report, the NRC suspended approval of the boron precipitation methodology and listed areas that are non-conservative in the CENPD-254 methodology. In a follow-on letter [Reference 15], the NRC clarified that, while the staff no longer approves all aspects of CENPD-254-P-A, the staff does consider the overall framework and general approach to be valid. In addition to the concerns expressed in the letter suspending approval, the NRC noted the following specific non-conservatisms that must be addressed:

1. The mixing volume must be justified and the void fraction must be taken into account when computing the boric acid concentration.

2. The analysis to determine boric acid concentration needs to account for the time variation in the mixing region while considering the pressure drop in the loop.

3. The solubility limit must be justified.

4. The decay heat multiplier must be 1.2 for all times.

The APR1400 design certification application of the interim methodology has addressed these issues, as detailed further below.

The boron precipitation analysis presented by the applicant in Reference 12 uses the four computer codes that were approved in topical report CENPD-254-P-A [Reference 14]. This SER approved the use of these four computer codes because the overall framework and general approach remain valid for this particular application. The functions performed by the four codes are as follows:

1. The CELDA code is used to determine the long-term primary system depressurization and refill for small breaks.

2. The NATFLOW code calculates the natural circulation flow rate in the core, and it calculates the primary system pressure and temperature that occur in the absence of a primary system break.

3. The CEPAC code models the steam generators, including the operation of steam generator atmospheric dump valves and provides the secondary system temperature as a function of time that is used for input to the NATFLOW and CELDA codes.

4. The BORON code is used to compute the boric acid concentration in the core and determines whether the core flow is sufficient to prevent the solubility limit of boric acid from being exceeded. The buildup of boric acid concentration calculated by BORON is used to determine the time when the switch to simultaneous injection is necessary to prevent boron precipitation.15-212

The CELDA analysis is initialized from the CEFLASH-4AS analysis that is performed for the early part of SBLOCA accidents. CEFLASH-4AS is discussed in Section 15.0.2.4.1 of this SER.

All of the above codes are used for the small break LOCA analysis. The BORON code is used as a subroutine of CELDA for the large break analysis.

The CELDA, NATFLOW and CEPAC codes have not been modified by the applicant, so their approval status remains unchanged. The applicant modified the BORON code by eliminating the switchover from the refueling water storage tank to sump recirculation, since the IRWST serves as the sump for the APR1400, and hence there is no switchover.

The SER for CENPD-254-P-A states that a LTC analysis utilizing the methods of CENPD-254 must be submitted with each plant application referencing the report. The plant-specific analysis for the APR1400 complies with this limitation. The non-conservatisms identified in References 15 and 16 are also discussed below.

To address the first non-conservatism in the CENPD-254 methodology, the applicant calculated the void fraction in the mixing volume using the phase separation model from CEFLASH-4AS, an approved code. The void fraction was calculated for each 0.38 m (1.25 ft) axial level in the core region and for the upper plenum region. As with the interim methodology, the mixing volume included the portion of the upper plenum extending from the core outlet to the top of the hot leg elevation. One half of the lower plenum was also included in the mixing volume based on the BACCHUS test results [Reference 12], which is consistent with the interim methodology.

Thus, the staff concludes that the applicant adequately justified the void fraction utilized in the mixing volume when computing the boric acid concentration.

A time varying mixing volume was used by the applicant in the analysis, as shown in Table 3-5 of the technical report, thus addressing the second non-conservative item in the CENPD-254 methodology.

The third item was addressed by the applicant to take into account the temperature effect on the boron precipitation limit. The fourth non-conservative item requires use of a decay heat multiplier of 1.2 for all times. The applicant first calculated the decay heat using the formula from CENPD-254 and then multiplied it by a factor of 1.2/1.1. This implies that the CENPD-254 formula has a multiplier of 1.1 on the 1971 ANS draft decay heat standard specified in Appendix K to 10 CFR Part 50. The staff verified that the value of decay heat calculated by the applicant at one hour is conservative by performing an independent calculation using the formula for the period between 150 and 4 x 106 seconds specified in the 1971 ANS draft standard.

Although the specific CENPD-254 methodology application to APR1400 is considered acceptable, the actual implementation of this method was further reviewed by the staff, and many issues were raised by the staff to the applicant as they were documented in RAI 398-8457, Question 15.06.05 (ML16034A055) and issued to the applicant on February 3, 2016. This question captures the need for further detailed information in the following areas:

1. Assumptions about the potential non-condensables trapped in the primary system, the possible reduction of injection flow during the switchover, the system pressure when applying the CENPD-254 methodology, solubility and liquid temperature, RCS cooldown time, the in-vessel ECCS injection flow distribution and the liquid mixing volume above the core;15-213

2. The numerical number of axial nodes in the heated core region, the countercurrent flow limitation (CCFL) correlation used for this application and the BORON code convergence with different time step size.

On April 8, 2016, the applicant responded to RAI 398-8457, Question 15.06.05-5 (ML16107A038). The response was supplemented by a letter dated July 8, 2016 (ML16190A287). The staff interacted with the applicant about these responses and indicated that the mixing volume assumed by the applicant for the region above the core could be non-conservative and did not follow the interim methodology as currently applied in the industry. On August 17, 2016, during a public phone call, the applicant acknowledged that the assumed mixing volume was not conservative and the switch-over time would be reduced from 3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br /> to 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />. The final analysis and the relevant DCD changes were submitted to the staff for review on December 28, 2016 by Revision 2 of the applicants response to RAI 398-8457, Question 15.06.05-5 (ML16363A415). In this Supplemental Response, the applicant modified the extent of the mixing zone to be consistent with the other assumptions used in the analysis. With these modifications the staff found the revised boron precipitation analysis acceptable since it has demonstrated conservatism and is in line with current industry practice.

As a result of the reanalysis, changes were made to APR1400 DCD Tier 2 Sections 6.3.2 and 15.6.5, and also to Technical Reports APR1400-F-A-NR-14003, APR1400-E-N-NR-14001, and APR1400-K-A-NR-14001. The staff reviewed these changes and found them to be consistent with results of the revised boron precipitation analysis.

The earlier responses addressed the remaining items in RAI 398-8457, which requested a demonstration of time step size convergence, clarifications, corrections of inconsistencies, addition of a nomenclature, and a description of changes made to the BORON code. Hence the questions raised by RAI 398-8457 are resolved and closed.

Post-LOCA Boron Dilution Evaluation In DCD Tier 2, Table 15.0-12, the applicant stated that GSI-185 was resolved and, consequently, no analysis of boron dilution was performed for the APR1400. GSI-185, Control of Recriticality Following SBLOCAs, concerns the potential return to criticality following a small break LOCA due to insertion of unborated water into the core as a result of restoration of natural circulation or restart of a RCP. The unborated water results from condensed steam from the SG tubes collecting in the loop seal piping. As noted in DCD, Tier 2 Table 15.0-12, GSI-185 was resolved and, consequently, no analysis was performed for the APR1400.

As documented in NUREG-0933, the basis for closure of this generic issue by the staff was an analysis performed for an operating Babcock & Wilcox (B&W) plant that was determined to be bounding for Westinghouse and CE plants (including the System 80+) due to unique B&W plant loop seal arrangement relative to the core.

Because of the higher reactor power of the APR1400 compared with the System 80+, and larger heat transfer surface area, as well as differences in loop seal volume, the staff could not make the same qualitative conclusion for the APR1400 without an analysis. Therefore, on March 7, 2016, the staff issued RAI 430-8455, Question 15.06.05-22 (ML16067A023) requesting the applicant to demonstrate, by analysis, that a return to criticality cannot occur following a SBLOCA. In several public teleconferences and public meetings, the applicant 15-214

described its plans to respond to this RAI, and described an analysis it performed using a computational fluid dynamics (CFD) code. The applicant explained that a return to criticality was calculated to occur as a result of all fresh water slugs discharging at once. After the applicant used less conservative assumptions, the criticality was no longer expected. The supplemental response was docketed on December 27, 2016 (ML16363A035), and reviewed by the staff, and found acceptable because realistic, but conservative, mixing assumptions were used. Therefore, RAI 430-8455, Question 15.06.05-22, is resolved and closed.

Loop Seal Clearing In Section 15.6.5.4.3 of this SER, the applicants response to RAI 143-8092, Question 15.06.05-1, is described along with the discussion that the staff noted potential non-conservatisms in the CEFLASH-4AS model. The lumping of two loop seals into a single loop seal for the intact leg could lead to a non-conservative result if it cleared instead of one of the other loop seals for a simulation in which only one loop seal is calculated to clear. For this reason, the staff issued several additional RAIs related to loop seal clearing (RAI 415-8503, Questions 15.06.05-13, 15.06.05-14, and 15.06.05-19). As discussed in Section 15.6.5.4.3 of this SER, the issues with regard to SBLOCA have been resolved and closed. The applicant submitted a supplemental response to RAI 143-8092, Question 15.06.05-1 (ML16363A031),

which satisfactorily addressed the potential for loop seal reformation and subsequent core heat up during the long term cooling phase. Because the predicted peak cladding temperature during the second loop seal clearing is much lower than the 800 °F limit, the staff considers the response acceptable.

GSI-191 Evaluation Ex-Vessel Downstream Effects of Debris The staff review of ex-vessel downstream effects of debris is presented in Section 6.2.2 of this SER.

In-Vessel Downstream Effects of Debris This evaluation covers the topics for the in-vessel downstream effect evaluation. They include debris type and amount available to the core including bypass testing, core flow and available driving head evaluation, and LOCA deposition model.

Debris Type and Amount There are four types of potential debris sources in an APR1400 containment during a LOCA event: reflective metallic insulation (RMI), coating, chemical precipitates, and latent debris following a LOCA. Since the APR1400 uses RMI, the applicant did not consider any fibrous debris to be generated within the zone of influence (ZOI) except the latent fiber debris. All RMI debris and large coating chips would be blocked by the strainer or during the transport upstream of the strainer. Only a certain amount of latent fiber, chemical precipitate, and particulate, including small coating particles, could penetrate the strainer and reach the reactor core. The review of debris generation, characteristics, and transport analyses have been documented in SER Section 6.2.2. In [Reference 23], the applicant assumed that all particulates, including small coating debris particles and chemical precipitates, penetrate the strainer and reach the reactor core. In addition, although the chemical precipitates take a long time to form, the 15-215

applicant assumed that the total amount of the chemical precipitates formed during 30 days in the post LOCA environment is present at the beginning of the long term cooling phase. The staff considers this conservative and, therefore, acceptable.

The latent fibrous debris, however, can be blocked by the strainer and only a fraction of the latent fibrous debris may reach the reactor core. The applicant determined the latent fibrous debris amount of 6.8 kg (15 lbm) at the strainer is in accordance with the NEI 04-07, Pressurized Water Reactor Sump Performance Evaluation Methodology, May 2004 recommendations. The staff considers this acceptable and documented the review in Section 6.2.2 of this SER. The staff notes that, for the bypass debris fraction, the number of available sumps maximizes the total active surface flow area through all the strainers and also the amount of bypass debris (i.e., assumes four operating sumps). The APR1400 design has four ECCS-CS (Containment Spray) trains with an independent strainer for each train. The design requires a minimum of three trains in operation assuming that the fourth train has a single failure. For bypass fraction measurement, the applicant assumed all four trains are in operation and latent fibrous debris would be uniformly distributed on all four strainers for ECCS.

No credit is taken for debris settlement on the floor or entrapment in ineffective pool (i.e., a holdup volume that entraps return that will not contribute to recovering the IRWST water level, such as the reactor cavity).

Strainer bypass testing was performed to measure the fiber debris bypass fraction. For conservatism, in this test, the applicant used only fibrous debris since the use of particulates could have reduced the amount of bypass debris through clogging at the strainer. The test measured the bypass of the maximum fiber load of 6.8 kg (15 lbm) scaled to the prototype strainer area of 75.1 ft2. Batches were tested at a size distribution of 100 percent fines to maximize bypass. The prototype strainer test facility and its operating procedures were reviewed and accepted by the staff in SER Section 6.2.2 for strainer head loss testing. For bypass testing, a single bypass test was run with four batches of fines representing latent debris added. Filter bags had been installed downstream of the prototype strainer to collect bypassed fiber. Filters had also been installed downstream of the prototype strainer to collect bypassed fiber. No fiber was allowed to recirculate back into the tank and flow stream. A new filter bag was put in service and the old filter bag was removed for each batch or fiber addition. The test results showed a 25 percent fiber bypass fraction. Using this fraction, assuming no fiber debris settlement in the primary system except in the core, the applicant predicted that 0.015 lbm (6.8 g) /assembly fiber debris would be transported from IRWST to the core.

Because of the conservative assumptions built into the testing protocols and an acceptable prototype test facility, the staff considers the amount of fiber debris estimated by the applicant acceptable.

Debris Arrival Time In order to determine the core boil-off rate and the limiting decay heat level at the time the latent fiber debris reaches the reactor core after a LOCA, the applicant used the assumptions documented in technical report APR1400-E-N-NR-14001 [Reference 23] to estimate the arrival time when all the debris reaches the core. Based on the assumptions, the applicant estimated that it would take about 1,400 seconds for all the latent fiber debris to reach the reactor core. Furthermore, the applicant conservatively assumed only 700 seconds for all the debris to reach the reactor core, which consists of not only all the latent fiber bypassing the strainer, but also all the particulate and chemical precipitates. The staff considers this reasonable as not all 15-216

the latent debris would end up in the IRWST pool instantly after the initiation of the LOCA. Once the break flow reaches the IRWST pool, the latent fiber debris would be distributed in the IRWST pool. In order to transport all the latent fiber debris to the core, it would take several turn over times to get all the latent fiber debris to bypass the strainer and move into the core. Assuming only half of the IRWST pool turn over time as the arrival time of all latent fiber debris to the core is considered to be conservative by the staff.

Core Flow Rate The limiting core flow conditions are different for different break locations. In the case of a cold leg break LOCA, the required core flow rate to maintain the core covered is obtained from an energy balance for the core at the estimated time of debris arrival. In such a condition, the safety injection flow rate is equal to the boil-off rate. The latter, in turn, is obtained by dividing the decay heat by the differential enthalpy of saturated steam (hg) and injected water (hin). The applicant applied the decay heat level using the ANS 79 standard decay heat curve following the 10 CFR Part 50 Appendix K and determined the boil-off rate, which is considered the required minimum core flow rate for the cold leg break. This approach is acceptable to the staff because of the conservative approach described above.

For the hot leg break LOCA, safety injection flow enters the vessel through the DVI lines, flows down the downcomer and up through the reactor core, and flows out of the reactor vessel through the break. For the LTC phase of a hot leg break LOCA, the applicant determined the core flow rate assuming all four trains of ECCS safety injection is available. This approach is considered acceptable by the staff because of the most limiting conditions applied.

In order to prevent boron precipitation in the core, for the cold leg break LOCA case, the applicant decided to allow operators to switch over part of ECCS injection from the DVI lines to the hot legs and start simultaneous hot leg/DVI line injection during the long term cooling phase.

This is referred to as hot leg switchover. In the hot leg switchover injection mode, two SI pumps inject into the hot legs and two SI pumps are for DVI lines. The water injected into DVI lines spills out of the break location. However, the water that is injected in the hot legs flows down through the reactor core towards the break. The downward flow rate per assembly for this case is estimated to be much greater than the boil off rate. Since the downward flow would disturb the debris bed and develop a new debris bed on top of the core during a much later phase of LTC, the applicant considered this flow rate bounded by the boil off flow rate case and full ECCS injection case. The staff considers this acceptable as this is the most limiting condition.

Available Core Flow Driving Head To ensure fuel assemblies will not be deprived of coolant due to accumulation of debris during the LTC operation phase, the available core flow driving head must exceed the summation of debris-induced head loss, the frictional loss, and the two-phase acceleration pressure loss.

Debris accumulation may occur throughout the flow path, which consists of the downcomer, lower plenum, core, and loops. However, of special concern is the debris buildup at the core inlet and over the core inlet plate. The available core driving head depends on the break location. For both the cold and hot leg break cases, the applicant calculated the acceleration pressure drop and the frictional head loss, consisting of skin friction with the wall of the flow path and form losses. The form loss term included the pressure loss when flow encounters large flow areas, partial obstructions, fuel assembly, bends, entrances and exits throughout the 15-217

primary system. For a hot leg break LOCA case, the applicant conservatively uses the differential height between the SG tube sheet and the bottom of the hot leg nozzle, ignoring the head of water in SG tubes due to the voiding potential. Similar methods were used by the applicant for cold leg LOCAs with DVI injection and hot leg switchover. Therefore, the staff considers the method acceptable as it is consistent with the industrys standard practice.

Using this method, the applicant estimated the available driving head for a hot leg and a cold leg LOCA, respectively. The results showed that a cold leg LOCA with safety injection via DVI was the most severe. However, the applicant assumed saturated water density at atmospheric pressure for downcomer water density. As a result, the staff issued RAI 404-8488, Question 15.06.05-11, which questioned the validity of downcomer water density input to the analysis method. The staff noted that a peak RCS water temperature of 241 °F was given (and the corresponding pressure of about 47 psia) from Figure B-2D for LOCA Containment P/T Transients (DESLSB with Min. SI) (Long Term) of the LOCA Mass & Energy Release Methodology, APR1400-Z-A-NR-14007, Technical report. The corresponding graph is also shown in Figure 3.6-3 of Reference 24. In response, the applicant decided to use the water density based on the RCS. As a result, the available driving heads were altered slightly. Since the applicant has taken a more conservative approach to bound the most limiting coolant temperature and subsequently revised their technical report, their response to this RAI is acceptable. In conclusion, the staff finds that the applicant took a conservative approach to estimate the minimum available core driving head. The calculated available heads for both cold leg and hot leg break cases are acceptable.

In-Vessel, LOCA Deposition Model The purpose of the analysis for deposition of debris on the fuel rod cladding following a LOCA is to ensure that, despite the buildup of debris-induced fouling, which increases thermal resistance, the cladding temperature remains below the limit of 800 F (427 C) during the LTC phase. The applicant has used the NRC approved LOCADM software to determine the cladding temperature and debris thickness for 30 days after a LOCA. LOCADM is a Microsoft Excel spreadsheet developed by the PWR Owners Group (WCAP-16793-NP, Reference 25) to conservatively predict the cladding temperature and the build-up of crud on fuel cladding after a LOCA. The source of crud buildup on the fuel rod cladding is the fiber, particulate, and chemical precipitates due to the interaction of the fluid inventory in the IRWST with debris and other materials exposed to and submerged in the IRWST or containment spray fluid, which have bypassed the strainer and entered the reactor vessel. The LOCADM software accounts for the presence of various materials in the containment, including aluminum, concrete (calcium silicates), Nukon fiberglass (E-glass, calcium aluminum silicate), high density fiberglass (E-glass, calcium aluminum silicate), mineral Wool (magnesium, calcium, aluminum silicate with iron oxide), MIN-K (amorphous silica + E-glass), aluminum silicate, Interam (polymer filled aluminum silicate fiber with aluminum backing), carbon steel, and galvanized steel (zinc coated iron). The model uses an energy balance between the decay heat generation and the rate of heat removal to evaluate local core boiling and the subsequent deposition of dissolved solids on the surfaces of the fuel rods. The combination of deposit thickness, thermal conductivity, coolant temperature, and localized decay heat generation are used to determine cladding temperature throughout the duration of a LOCA. LOCADM conservatively assumes that the crud buildup in the core is due to the presence of debris and corrosion products. The containment materials corrode or dissolve, forming solvated molecules and ions. Some of the dissolved material precipitates, but the precipitates remain in solution as small particles that do 15-218

not settle. The dissolved material and suspended particles pass through the sump strainer and into the core during recirculation. It is conservatively assumed that none of the precipitates are retained by the sump strainer or any other non-fuel surfaces.

The LOCADM model was originally developed for operating PWRs, which use the refueling water storage tank, located outside containment. This model is also equally applicable to the APR1400 design using an IRWST, as the applicant has defined a debris arrival time of 700 seconds. Following a LOCA, four modes of operation are defined, namely, Mode 1 for blowdown and vessel refill from the IRWST, Mode 2 for after vessel refill but before recirculation begins, Mode 3 for recirculation from IRWST, and Mode 4 for hot leg injection. The applicant conservatively assumes that Mode 3 starts at 700 seconds and Mode 4 at 2 to 3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br />, respectively. Therefore, the method used by the applicant was previously reviewed and approved by the staff and found directly applicable to APR1400.

The prediction of both the deposit thickness and cladding surface temperature as a function of time was performed for various core locations and regions. The applicant has followed the LOCADM instructions and divided the core into three radial regions and three axial locations.

The three axial locations have relative power peaking factor of 0.95 for top and bottom and 1.10 for middle. Similarly, the three radial regions have relative powers of 1.65, 1.56, and 1 for the center, middle, and the edge regions respectively. This part of the core model is considered conservative by the staff.

Among the applicants other conservative assumptions, two are notable including: (a) all aluminum exposed to containment spray and submerged in the IRWST sumps is assumed to be pure unalloyed aluminum (i.e., Alloy 1100); and (b) 30 lbm of latent fiber is assumed to bypass the ECCS sump strainers and is entrained in the safety injection and recirculation flows. It should be noted that there is no fiber insulation inside the ZOI, only 15 lbm latent fiber is assumed to be inside the entire containment, yet 30 lbm of latent fiber is assumed to bypass the ECCS sump strainers for conservatism. In addition, the aluminum used in the plant is usually alloys, which are more corrosion resistant. Therefore, these two specific APR1400 assumptions are considered conservative.

The inputs required to run the LOCADM spreadsheet include: (a) volumes of different debris sources such as fiberglass and calcium silicate (cal-sil) insulation; (b) surface areas of uncoated concrete, aluminum submerged in the sump, and aluminum exposed to spray; (c) the sump and spray pH, which are specified as a function of time since these are the inputs of the buffer agents such as lithium hydroxide and boric acid; and (d) the SI into the RCS as a function of time. To identify whether the injection is pre- or post-recirculation, an integer between 1 and 4 is used to specify the mode of the four phases of a LOCA as discussed above. Other input data required to be specified as a function of time include break flow rate and temperatures of IRWST water, RCS coolant, and containment vapor. These input data are specified on three Excel worksheets, including the trend, the materials input, and the core data input worksheets.

The trend worksheet contains data such as sump pH, sump water, containment vapor, and the RCS inventory temperatures versus time; and safety injection, break, and recirculation flow rates versus time, among others. Most of the time dependent data are available from the containment response analysis. The material input worksheet contains the list of materials, which are present in the containment. Depending on the type of the materials, their amounts should be specified in units of area, volume, or weight. A material conversion worksheet 15-219

contains the default values for the densities of various materials for conversion of volume to mass.

The results obtained for cladding temperature and the maximum total deposit thickness are well below the limits of 800 °F and 50 mils, and are documented in technical report APR1400-E-N-NR-14001 [Reference 23].

However, while reviewing the applicants report, the staff noted several items related to the LOCADM model that required more clarification. The staff issued RAI 404-8488 with several items under Question No. 15.06.05-11 (ML16041A096). This question covers the additional information needed by the staff for the following items: RCS coolant temperature, latent fiber weight percent, concrete surface area, IRWST water volume and the applicability of LOCADM for low fiber plant. On July 20, 2016, the applicant provided the responses to RAI 404-8488, Question 15.06.05-11 (ML16202A506). For Question 1 of RAI 404-8488, the staff asked the applicant to explain the reason for using a logarithmic temperature drop for the containment air and IRWST temperatures in GSI-191 Report (APR1400-E-N-NR-14001, Revision 0) instead of using the GOTHIC code results from Technical Report APR1400-Z-A-NR-14007, Revision 0, LOCA Mass and Energy Release Methodology. The applicant responded that the temperature profile used for the chemical effects analysis in the technical report, APR1400-E-N-NR-14001, Revision 0 , Section 3.8 post-LOCA up to 30 days, is superseded by the GOTHIC code results.

On January 3, 2017, the applicant submitted the revised response to Question 15.06.05-11 and documented the analysis (ML17003A394). The revised response provided markups to two technical reports, APR1400-E-N-NR-14001, Revision 0, Design Features to Address GSI-191

[Reference 18] and APR1400-K-A-NR-14001, Revision 1, In-vessel Downstream Effect Tests for the APR1400, [Reference 24]. The applicant subsequently submitted Revision 1 to technical report APR1400-E-N-NR-14001 [Reference 23] and Revision 2 to technical report APR1400-K-A-NR-14001 [Reference 40]. The staff confirmed that the changes resulting from the response to Question 1 of RAI 404-8488, were appropriately incorporated in the two affected technical reports, and therefore considers Question 1, resolved and closed.

In response to Question 2 of RAI 404-8488, the applicant revised the technical report using the sentence The RV coolant temperature is assumed to be the saturation temperature of the RV pressure which is shown in DCD Tier 2, Table 6.2.1-7 Part B. The applicant also revised the evaluation of deposition on the fuel (LOCADM) to reflect the revised IRWST temperature, containment temperature, and RV pressure for 30 days post-LOCA, as indicated in the of the RAI response. Since the Technical Report document was revised and subsequently correct values were used in the LOCADM model, the response is satisfactory to the staff because higher temperature results in a conservative amount of deposition.

For Question 3 of RAI 404-8488 regarding the recirculation start time, the applicant responded that the assumption for the recirculation start time would be changed to 700 seconds. The revised evaluation of LOCADM also reflects the modified recirculation start time of 700 seconds.

Since the applicant has accepted the suggested change and has subsequently revised the technical report to reflect the change, which is more conservative, the response is acceptable to the staff.

Regarding the fiber amount assumed for the LOCADM calculation (Question 4 of RAI 404-8488), the applicant indicated that the total bypass debris for the APR1400 is 6.80 kg (15 lbm) of latent fiber is 1.67 kg (3.68 lbm). However, all the latent fiber 15-220

of 6.80 kg (15 lbm) is assumed to bypass the ECCS strainers, and 13.6 kg (30 lbm) of latent fiber is used for the LOCADM input applying a bump-up factor of 2, for conservatism in the calculation. The staff agrees with the conservatism used in the LOCADM analysis.

Responding to Question 5 of RAI 404-8488, about the concrete surface area, the applicant responded that the surface area of concrete structures is estimated from the civil structural drawings and three-dimensional computer-aided design (CAD). Although the amount of concrete in the containment is 2,087 ft2 submerged and 7,257 ft2 unsubmerged, in the LOCADM input data, 18,688 ft2 for concrete has been used by applying a bump-up factor of 2. The staff confirmed that the change had been implemented in the LOCADM analysis. The staff agrees with the use of the more conservative value.

Question 6 of RAI 404-8488, requested the Sump Pool Volume (ft3) specified on the Material Input worksheet of the LOCADM program. The applicant responded that they conservatively used the minimum IRWST water volume of 35,076 ft3 (262,388 gallons) for the LOCADM, input and they changed the typographical error in the initial IRWST water volume of Table 4.3-8, from 933.2 m3 to 993.2 m3. The staff agrees with this conservatism used in the LOCADM analysis.

Question 6 of RAI 404-8488, also requested justifications about the validity of the bumpup factor with the fiber levels in APR1400 being much less than in current operating plants. The applicant responded that they considered the bump-up factor for materials input of the LOCADM calculation. The applicant also considered the fibrous debris that may be transported into the core in the LOCADM calculation. The applicant accomplishes this through a bump-up factor which adds scale buildup on the fuel related to the amount of fiber transported into the core.

The bump-up factor in LOCADM is independent of the type, diameter, or length of the fiber. The application of the bump-up factor to the APR1400 LOCADM is consistent with other operating PWRs. The use of the bump-up factor in the APR1400 LOCADM calculation is appropriate because even though the amount of fibrous debris is small, all the latent fiber of 13.6 kg (30 lbm) is assumed to bypass the ECCS strainers. The fibrous debris per fuel assembly is about 56.5 grams, and it is not significantly smaller when compared to current operating plants. The staff agrees with the conservative assumption that all the latent fiber bypasses the ECCS passive strainer.

Based on the above mentioned RAI responses and staff evaluation, the updated LOCADM analysis results provided by the applicant includes multiple conservatisms and, therefore, all questions in RAI 404-8488, are resolved and closed.

Fuel Bundle Head Loss (Downstream Effects) Testing This section provides the staffs evaluation of the applicants fuel assembly head loss testing approach and results. As part of a resolution to the in-vessel downstream effects, the applicant conducted fuel assembly tests [Reference 24] to demonstrate that the amount of debris that can reach the RCS would not impede long-term core cooling. The measured head loss or flow blockage differential pressure drop is within the maximum allowable fuel assembly blockage, such that sufficient flow, which is more than the minimum required flow, enters the core for long-term decay heat removal.15-221

Testing Acceptance Criteria: Maximum Allowable Fuel Assembly Blockage Demonstration of sufficient, long-term core cooling depends on the break location and ECCS injection configuration postulated. As discussed in Section 4.3.3 of [Reference 18], the applicant developed core head loss acceptance criteria for different break locations and ECCS injection configurations. Based on the phenomena of interest, the applicant first calculated a minimum required core flow rate for each break and ECCS injection scenario. With the available driving head for each break and ECCS injection scenario, the applicant then calculated a maximum allowable core blockage differential pressure. Under the subtitle Available Core Flow Driving Head, of this section, staff evaluated the applicants derivation of the maximum allowable core blockage differential pressure for each combination of break location and ECCS injection configuration.

These maximum allowable differential pressure drops were used by the applicant as the acceptance criteria to demonstrate success of fuel assembly head loss testing, where the resulting fuel bundle pressure drop with the existence of debris must be less than the maximum allowable blockage pressure difference.

Debris Characterization: Fiber, Particulates, and Chemical Precipitates The applicant evaluated the quantity of debris generated following a LOCA for a number of break locations. The applicants discussion of post-LOCA debris characteristics is contained in Section 3 of Technical Report APR1400-E-N-NR-14001. The analyzed debris includes latent debris and chemical precipitants. The applicant assumed the maximum latent debris generated from all break locations to be 200 lbm in accordance with the approved NEI guidance, NEI 04-07. For fuel assembly testing, the applicant assumed 7.5 percent of latent debris is fiber (15 lbm) and 92.5 percent is particulates. This latent debris amount and distribution are the design basis latent debris, which provides the containment cleanliness program requirements that a COL applicant is required to meet. In DCD Tier 2 Section 6.8.4.5.10, the applicant imposed a COL action item to establish the requirements for containment cleanness program, which is also needed to satisfy the requirements of in-vessel downstream effects.

The applicant performed a strainer bypass test to determine the amount of fiber that passes through the strainers that might reach the RCS and the core. The results showed that the percentage of the fiber that passes through the sump strainer is 17.1 percent based on Table 4.1-2 of [Reference 23]. The predicted fiber loading for each fuel assembly is 6.93 g (0.01527 lbm). The staffs evaluation of the debris bypass testing is discussed above.

All particulate was assumed to pass through the sump screen and reach the reactor core.

When conducting fuel assembly testing, the applicant conservatively assumed that 15 g (0.033 lbm) of fiber reaches each assembly of the core at the first opportunity, which is more than the design basis fiber amount, and used NukonTM fiberglass as a surrogate for the fiber debris. As discussed in Section 6.2 of this SER, the staff finds the use of small fines from low-density fiberglass, such as NukonTM, as a surrogate debris for latent fiber in head loss analysis acceptable, because the hydraulic properties of latent fiber are similar to those of NukonTM fiber glass.

Following a LOCA, the chemistry of the fluid in the IRWST and the core could produce chemical precipitates, which could affect the pressure drop in a debris bed. The applicant described the specific compounds and quantities of materials that may precipitate within the reactor 15-222

containment pool following a LOCA in Section 3.8 of [Reference 18]. The chemical precipitates were predicted to include sodium aluminum silicate, calcium phosphate, and aluminum hydroxide. Table 3.8.2, Table 3.8.3, and Table 3.8.4 of [Reference 18] provide the total elements released and chemical precipitants formed. From these tables, the applicant identified the amount of chemical precipitate as 398.2 lbm of aluminum oxy-hydroxide (AlOOH), 9.5 lbm sodium aluminum silicate, and 1.5 lbm of calcium phosphate. The applicant used AlOOH to conservatively represent all precipitates, following the testing protocol [Reference 27], which staff previously approved. The staff finds this acceptable because of the agglomeration effect of this surrogate on head loss. The staffs detailed evaluation of the use of AlOOH as chemical debris surrogate and the amount of chemical debris in fuel assembly testing are described in Section 6.2.2 of this SER.

Testing Rigs The applicant described the fuel assembly head loss test facility [Reference 27]. The test loop consisted of a mixing tank, a pump, piping to deliver flow to a clear test column, a circulation system and a control and monitoring system. The test column consisted of a 2.5 m (8.2 ft) mock-up assembly with a top and bottom nozzle, a debris capturing plate, four spacer grids and the 16x16 PLUS7 fuel rod array. The enclosure around the fuel assembly was fabricated from transparent acryl. Pressure taps were installed to allow differential pressure (dP) measurements across the full assembly and any grid or combination of grids to be measured.

The pressure taps were installed on the walls, two to three inches below the spacer grids and centered between fuel rods. Each pressure tap had a valve installed on it to facilitate switching dP measurements.

The test loop was configured to be capable of simulating the flow rate ranging from a cold leg break to the hot leg break. For all testing cases, flow entered from the bottom of the chamber, passed through the fuel assembly, and exited out of the top of the chamber. A circulating pump pumped water and debris from the mixing tank through a flow meter and flow control valve and into the test chamber. The mixing tank allowed debris to be added to the system and was well agitated by the pump discharge flow and motor-driven stirrer to minimize settling and agglomeration.

Test Procedure The applicant used the test procedure in Section 4 of Reference 23 for the fuel assembly testing. Though the number of particulates, fiber, and chemical batches, size of chemical batches, flow configuration, and turnover time varied among the tests, a typical set of testing protocols was used to perform the test and to avoid unnecessary settlements. The staff considers these testing protocols practical and conservative.

The order of debris addition of the testing is particulates first, fiber second, and chemical precipitates last. The staff considers that this debris addition order would maximize the pressure drop of the debris bed by minimizing the porosity of the debris bed as it forms.

Particulates are small debris types that readily pass through the debris filters or fuel assemblies, and, therefore, do not catch in the core unless the debris is large enough to plug the opening.

Fibrous debris, however, is fairly porous and more readily trapped by the fuel assembly grids (snag on the leading edges of spacer grids) to form a debris bed that could potentially capture the smaller debris types. Particulates can fill the interstitial gaps among the fibers and decrease 15-223

the porosity of the debris bed and increase the pressure drop. The staff considers that the applicants procedure of having all of the particulates available in the test loop from the start of the test ensures that the openings in the fiber bed can be filled as the bed forms.

Since chemical precipitates do not form until well into the transient, they were added by the applicant during the test after the addition of particulates and fiber. Chemical precipitates are expected to form a layer on top of the established debris bed and could possibly compress the bed, further increasing the pressure drop of the bed. The applicants fuel assembly test results indicated that the amount of chemical precipitates have a limited effect on the overall pressure drop through the debris bed. The initial formation of the chemical precipitates causes an increase in the pressure drop, but the pressure drop stops increasing after a small quantity has been introduced.

The applicant kept debris in the mixing tank in suspension by agitation from the return flow from the loop and by a mechanical stirrer. This mixing prevented debris from settling, floating, and remaining in the mixing tank during the testing. The test loop continually recirculated debris, thus providing multiple opportunities to catch debris on an obstruction and restrict flow. The staff finds this method conservative because, depending on the break location and ECCS configuration, this is not likely to occur in the core. For example, following a hot leg break with cold leg injection, the fluid passes through the core and returns to containment, where it must be re-filtered by the strainers before it re-enters the RCS.

The applicant altered the flow rate for different test sets in order to capture the combination of different break locations and SI injection modes. For the hot leg break with safety injection into the downcomer, the flow rate is 77.6 liters per minute per fuel assembly (77.6 lpm/FA),

or 20.5 gallons per minute per fuel assembly (20.5 gpm/FA). The flow rate for the cold leg break with safety injection into the downcomer and spillage through the break is 16.6 lpm (4.38 gpm)/FA to meet the core boiloff requirement at the time of the start of recirculation. The cold leg break after hot leg SI injection switchover has a flow rate of 38.8 lpm (10.25 gpm)/FA to take into account the maximum flow rate of two safety injection train flow. A review of these flow rates is documented above. During the test, the applicant adjusted the flow rate through the test column to be equal to the above desired target values during the debris introduction process. The final stabilized differential pressure across the flow blockage and the entire fuel assembly was recorded with target flow rates.

The applicants test procedure was consistent with those approved for other designs, and therefore, the staff considers the testing procedures acceptable.

Test Results From July 2013 to August 2015, the applicant conducted four sets of tests to evaluate hot leg break conditions with a four SI flow rates, varying particle to fiber (P/F) ratios of [0.5, 1, 2, and 10], seven tests to evaluate cold leg break conditions with a core boiloff rate at 700 seconds after a LOCA with varying P/F ratios of [1, 10, 20, 30, 40, 50, and 60], two sets P/F tests under two SI flow conditions to evaluate a hot leg break with reduced SI condition and a cold leg break after a hot leg switchover operation condition.

In October 2014, staff performed an on-site inspection of the testing program and identified three issues associated with the testing program [Reference 29]. The first was the flow channel gap size. The second was the flowmeter calibration range, and the third issue was associated 15-224

with test column entrance design to avoid excessive settlement. Based on these findings, staff issued three Notice of Violations (NOV 99901453/2014-201-01(a),

NOV 99901453/2014-201-01(b), NOV 99901453/2014-201-03, and NOV 99901453/2014/201-04(b) [Appendix A of Reference 29]. In response, the applicant manufactured a new test column chamber and performed sensitivity tests to verify the accuracy of the most limiting test cases. The results of additional sensitivity tests showed that the increase in pressure differential due to these corrections did not cause a significant dP increase due to the fact that the debris bed with 15 g (0.033 lbm) of fiber may still be porous and insensitive to a larger channel gap size. Based on this response, the staff found that the information provided satisfy the inspection requirements.

For the hot leg break condition tests, the test acceptance criterion or the maximum allowable fuel assembly blockage pressure difference used by the applicant was 44.8 kPa (6.5 psi) and the measured maximum pressure drop was 19.4 kPa (2.8 psi), with a margin about 56 percent.

The maximum pressure drop measured by the applicant under the cold leg break condition was 3.85 kPa (0.56 psi), and it met the available head limit of (15.1 kPa (2.2 psi)) with a margin of approximately 74 percent. For the cold leg break case after the hot leg switchover operation, the maximum pressure drop measured by the applicant was 9.19 kPa (1.33 psi), which was less than the available head limit of (35.4 kPa (5.1 psi)) with a margin of approximately 74 percent.

All these limiting measured pressure difference values are not subject to change with all the testing program issues identified above. The maximum impact was only 1.6 percent increase, as the fiber loading is only 15 g/FA.

Overall, there were four sets of tests, which included 14 recorded tests. The applicant conduced these with the APR1400 design limit of 15 grams (0.53 oz) of fiber per fuel assembly.

The results of all the tests, including the sensitivity tests using the new test column and measurement apparatus, successfully met the maximum allowable blockage limits with significant margin. Therefore, the staff finds that the intended containment cleanness program and the selection of RMI as insulation material ensure an acceptable ECCS long term core cooling performance.

Summary Fuel assembly testing performed by the applicant at 15 g (0.53 oz)/FA of fiber resulted in fiber bed resistance and final flow rate that the staff agree have proved that the maximum pressure drop across the flow blockage meets the available head limit with significant margin. The updated LOCADM analysis results show that there is not enough debris and the subsequent deposition would raise the peak cladding temperature beyond 800 °F. Therefore, the staff concludes that the APR1400 design does not have sufficient post-LOCA in-vessel debris blockage to impede long-term core cooling during a postulated loss of coolant accident.

There are no COL information items associated with Section 15.6.5 of the DCD. In DCD Tier 2 Section 6.8.4.5.10, the applicant imposed a COL item to establish the requirements for containment cleanness program, which is also needed to satisfy the requirements of in-vessel downstream effects in this Section.15-225

The staff concludes that the loss-of-coolant analysis resulting from a spectrum of postulated piping breaks within the reactor coolant pressure boundary and the associated ECCS performance is acceptable and meets the relevant requirements of 10 CFR 50.46, GDC 13, and GDC 35. This conclusion is based on the following:

1. The applicant meets GDC 13 requirements by demonstrating that all credited instrumentation was available, and that actuations of protection systems, automatic and manual, occurred at values of monitored parameters that were within the instruments prescribed operating ranges.

2. The applicant has performed analyses of the performance of the ECCS in accordance with the Commissions regulations (10 CFR 50.46). The analyses considered a spectrum of postulated break sizes and locations and were performed with an evaluation model that follows the guidance contained in Regulatory Guide 1.157 and meets the requirements of 10 CFR 50.46. The results of the analyses shows that the ECCS satisfies the following criteria:

A. The calculated maximum fuel rod cladding temperature does not exceed 1200 °C (2200 °F).

B. The calculated total maximum local oxidation of the cladding does not exceed 17 percent of the total cladding thickness before oxidation.

C. The calculated total amount of hydrogen generated from the chemical reaction of the cladding with water or steam does not exceed 1 percent of the hypothetical amount that would be generated if all of the metal in the cladding cylinders surrounding the fuel, excluding the cladding surrounding the plenum volume, were to react.

D. Calculated changes in core geometry are such that the core remains amenable to cooling.

E. After any calculated successful initial operation of the ECCS, the calculated core temperature is maintained at an acceptably low value and decay heat is removed for the extended period of time required by long-lived radioactivity.

F. The applicant has met the requirements of TMI Action Plan items.

G. Boric acid precipitation can be prevented for all break sizes and locations during post-LOCA long term cooling.

The evaluation of the dose calculations and their acceptability with respect to 10 CFR 52.47(a)(2)(iv)(A), 10 CFR 52.47(a)(2)(iv)(B), and GDC 19 is documented in Section 15.0.3 of this SER.15-226

1. Topical Report APR1400-F-A-TR-12004-P/-NP, Revision 0, Realistic Evaluation Methodology for Large-Break LOCA of the APR1400, December 2012 (ML130230128).

2. Regulatory Guide 1.157, Best Estimate Calculations of Emergency Core Cooling System Performance.

3. Topical Report APR1400-Z-M-TR-12003-P/-NP, Revision 0, Fluidic Device Design for the APR1400, December 2012 (ML130180120).

4. Topical Report APR1400-F-M-TR-13001, Revision 1, PLUS7 Fuel Design for the APR1400, August 2017 (ML17223B416 (Proprietary), ML17237A023 (Non-Proprietary).

5. Topical Report APR1400-F-C-TR-12002-P/-NP, KCE-1 Critical Heat Flux Correlation for PLUS7 Thermal Design, Revision 0, November 2012 (ML130180119).

6. General Design Criteria for Nuclear Power Plants, Title 10, U.S. Code of Federal Regulations, 10 CFR Part 50, Appendix A.

7. NUREG-0800, Standard Review Plan for the Review of Safety Analysis Reports for Nuclear Power Plants: LWR Edition, Chapter 15, Transient and Accident Analyses, Section 15.6.5, Loss-of-Coolant Accidents Resulting from the Spectrum of Postulated Piping Breaks within the Reactor Coolant Pressure Boundary.

8. Regulatory Guide 1.206, Combined License Applications for Nuclear Power Plants.

9. Technical Report, APR1400-F-A-NR-14001-P, Revision 0, Small Break LOCA Evaluation Model, September 2014.

10. Combustion Engineering Topical Report, CENPD-137P, Calculative Methods for the CE Small Break LOCA Evaluation Model, August 1974.

11. Combustion Engineering Topical Report, CENPD-137, Supplement 1-P, Calculative Methods for the CE Small Break LOCA Evaluation Model, January 1977.

12. Technical Report, APR1400-F-A-NR-14003-P, Post-LOCA Long Term Cooling Evaluation Model, KHNP, September 2014.

13. Entergy Letter W3F1-2005-0012 from Timothy G. Mitchell to USNRC, Supplement to Amendment Request NPF-38-249 Extended Power Uprate, Waterford Steam Electric Station, Unit 3, February 16, 2005.

14. Westinghouse Topical Report, Post-LOCA Long Term Cooling Evaluation Model, CENPD-254-P-A, June 1980.

15. NRC letter from Robert A. Gramm to James A. Gresham, Westinghouse Electric Co.,

Suspension of NRC Approval for Use of Westinghouse Topical Report CENPD-254-P, Post-LOCA Long-Term Cooling Model, Due To Discovery Of Non-Conservative Modeling Assumptions During Calculations Audit, August 1, 2005.15-227

16. NRC letter from Daniel S. Collins to James A. Gresham, Westinghouse Electric Co.,

Clarification of NRC Letter Dated August 1, 2005, Suspension of NRC Approval for Use of Westinghouse Topical Report CENPD-254-P, Post-LOCA Long-Term Cooling Model, Due to Discovery of Non-Conservative Modeling Assumptions During Calculations Audit, November 23, 2005.

17. Westinghouse Electric Corp. Report, Review and Evaluation of MHI BACCHUS PWR Vessel Mixing Tests, WCAP-16317-P, November 2004.

18. Technical Report, APR1400-E-N-NR-14001-P/-NP, Revision 0, Design Features to Address GSI-191, December 2014 (ML15009A323 (Proprietary), ML15009A130 (Non-Proprietary).

19. Technical Report, APR1400-Z-A-NR-14007-P, Revision 0, LOCA Mass and Energy Release Methodology.

20. SECY-11-0014 - Enclosure 1, The Use Of Containment Accident Pressure In Reactor Safety Analysis, (ML102110167).

21. Design Control Document, Tier 1, APR1400-K-X-IT-14001-P, Revision 0, December 2014.

22. APR1400 Design Control Document Tier 2, Chapter 15, Transient And Accident Analyses, APR1400-K-X-FS-14002-NP, Revision 0, December 2014.

23. Technical Report, APR1400-E-N-NR-14001-P/-NP, Revision 1 Design Features to Address GSI-191, March 2017, (ML17094A172 (Proprietary), ML17094A122 (Non-Proprietary).

24. Technical Report, APR1400-K-A-NR-14001-P/-NP, Revision 1, In-vessel Downstream Effect Tests for the APR1400, July 2015, (ML15195A015 (Proprietary), ML15195A016 (Non-Proprietary).

25. WCAP-16793-NP, Revision 1, Evaluation of Long-Term Cooling Considering Particulate, Fibrous and Chemical Debris in the Recirculating Fluid, Westinghouse Electric Corporation, Revision 2, October 2011.

26. Nuclear Energy Institute (NEI) guidance, NEI 04-07, Pressurized Water Reactor Sump Performance Evaluation Methodology, May 2004.

27. Technical Report, APR1400-K-A-I(RA)-13001-P (R3), Test Plan for In-vessel Downstream Effect (IDE) of the APR1400, July, 2014.

28. NRC Regulatory Guide 1.54, Revision 2, Service Level I, II, and III Protective Coatings Applied to Nuclear Power Plants, U. S. Nuclear Regulatory Commission, October 2010.

29. NOV 99901453/2014-201-01(a), NOV 99901453/2014-201-01(b), NOV 99901453/2014-201-03, and NOV 99901453/2014-201-04(b) [ML14302A743].

30. NUREG/CR-5249, Quantifying Reactor Safety Margins, Application of Code Scaling, Applicability, and Uncertainty Evaluation Methodology to a Large-Break, Loss-of-Coolant 15-228

Accident, EGG-2552, Revision 4, Idaho National Engineering Laboratory and EG&G Idaho, Inc., December 1989 (ML030380503).

31. Letter, O.D. Parr (NRC) to F.M. Stern (CE), June 13, 1975.

32. Letter, O.D. Parr (NRC) to A.E. Scherer (CE), December 9, 1975.

33. Letter, Karl Kniel (NRC) to A.E. Scherer (CE), September 27, 1977.

34. Letter, D.M. Crutchfield (NRC) to A.E. Scherer (CE), July 31, 1986.

35. Combustion Engineering Topical Report CENPD-137P, Supplement 2-P-A, Calculative Methods for the CE Small Break LOCA Evaluation Model, April 1998.

36. Regulatory Audit Plan for Topical Report APR1400-F-A-TR-12004-P, Realistic Evaluation Methodology for Large Break LOCA of the APR1400, (ML15208A199).

37. Regulatory Guide 1.53, Application of the Single-Failure Criterion to Safety Systems, Revision 2, November 2003.

38. NUREG-0933, Resolution of Generic Safety Issues

39. Safety Evaluation for Topical Report APR1400-F-A-TR-12004-P/NP, Revision 1, Realistic Evaluation Methodology for Large-Break LOCA of the APR1400 for Safety Evaluation, June 5, 2018 (ML18156A042).

40. Technical Report, APR1400-K-A-NR-14001-P, Revision 2, In-vessel Downstream Effect Tests for the APR1400, July 2015 (ML17094A173 (Proprietary), ML17094A123 (Non-Proprietary).

41. Transmittal of Topical Report APR1400-F-A-TR-12004-P, Revision 1, Realistic Evaluation Methodology for Large Break LOCA of the APR1400, dated August 9, 2017, (ML17240A229).

42. Final Safety Evaluation for the Pressurized Water Reactor Owners Group (PWROG)

Topical Report WCAP-16793-NP, Revision 2, Evaluation of Long-Term Cooling Considering Particulate Fibrous and Chemical Debris in the Recirculating Fluid, (ML13084A154).

43. Task No. G20120810, Letter from J. Sam Armijo (ACRS) to R.W Borchardt, Executive Director of Operations, USNRC, Draft Safety Evaluation of WCAP-16793-NP, Revision 2, Evaluation of Long-Term Cooling Considering Particulate, Fibrous, and Chemical Debris in the Recirculating Fluid, October 18, 2012 (ML12293A217).

Radioactive Material Release from a Subsystem or Component This section is reviewed in Chapter 11, Section 11.3.3 of this SER.15-229

This section is reviewed in Chapter 11, Section 11.3.3 of this SER.

This section is reviewed in Chapter 11, Section 11.2.3 of this SER.

This section is reviewed in Section 15.0.3.4.11 of this SER.

This section is reviewed in Section 15.0.3.4.11 of this SER.

Anticipated Transients Without Scram An anticipated transient without scram (ATWS) is an AOO, as defined in Appendix A of 10 CFR Part 50, followed by the failure of the reactor trip portion of the protection system as specified in GDC 20.

The ATWS events have been evaluated since the early 1970s using analysis methods available at that time. The result of these evaluations was the development of NUREG-0460, Anticipated Transients Without Scram for Light Water Reactors, [Reference 1]. ATWS analyses were performed by CE for several classes of CE plant designs. The CE ATWS evaluations are presented in approved topical reports CENPD-158, Revision 1, Analysis of Anticipated Transients without Reactor Scram in Combustion Engineering NSSSs, [Reference 2] and CENPD-263-P, ATWS Early Verification, [Reference 3]. These reports were used by the NRC in the development of the ATWS rulemaking for the CE fleet plants. The APR1400 is based on the CE System 80+ design and, as such, will respond to ATWS events in a manner similar to that evaluated by CE.

The ATWS rule requires that each PWR have equipment, from sensor output to final actuation device, which is diverse from the reactor trip system to automatically initiate the AFWS and initiate turbine trip under the conditions indicative of an ATWS. In addition, CE fleet plants have been required to have a diverse scram system from the sensor output to interruption of power to the control rods.

DCD Tier 1: The application identifies no Tier 1 items explicitly associated with ATWS.

However, DCD Tier 1, Subsection 2.5.1, Reactor Trip System and Engineered Safety Features Initiation, and Subsection 2.5.2, Diverse Actuation System, describe design features that are credited in the evaluation of ATWS events.

DCD Tier 2: The applicant provided DCD Tier 2 information in DCD Tier 2, Section 15.8, which is summarized here, in part, as follows:

15-230

Because the APR1400 plant protection system (PPS) is designed to satisfy the single failure criterion, the applicant noted that multiple failures or a common cause failure must occur to cause the assumed failure of the reactor trip portion of the protection system. The applicant further noted that the occurrence frequency of an AOO, in coincidence with multiple failures or a common cause failure of the reactor trip, is much lower than the occurrence frequency of any of the other events that are evaluated in DCD Tier 2 Chapter 15. Therefore, the applicant noted that the ATWS event has historically been considered a beyond-design-basis event, rather than either an AOO or a design-basis accident.

In DCD Tier 2 Section 15.8.3, the applicant stated that the PPS performs the functions of the RPS and the engineered safety features-component control system (ESF-CCS). The RPS is the portion of the PPS that trips the reactor when required. A coincidence of two signals from the two-out-of-four trip logic is required to generate a reactor trip signal. This signal de-energizes the CEDM coils, allowing all CEAs to drop into the core. The ESF-CCS initiates auxiliary feedwater injection, a turbine trip, and SI on conditions indicative of ATWS. Details of the RPS and ESF-CCS are provided in DCD Tier 2 Section 7.2.

The diverse protection system (DPS), alternately referred to as the D3 system (Diversity and Defense-in-Depth), provides a diverse backup to the PPS. The DPS initiates a reactor trip signal on high pressurizer pressure to decrease the possibility of an ATWS and provides an AFW actuation signal (backup to the ESF-CCS of the PPS) to provide reasonable assurance that an ATWS event is mitigated if it occurs. The DPS also initiates a turbine trip and SI. The DPS is described in detail in Section 7.8.1 of Tier 2 of the DCD and in Technical Report APR1400-Z-J-NR-14002, Diversity and Defense-in-Depth, [Reference 4]. The applicant stated that the DPS for the APR1400 conforms to 10 CFR 50.62, Requirements for reduction of risk from anticipated transient without scram (ATWS) events for light-water-cooled nuclear power plants, and provides a method of initiating reactor trip and auxiliary feedwater that is diverse and independent from the RPS.

In order to demonstrate the applicability of the CE ATWS analyses results in Reference 2 to the APR1400 design, the applicant performed a similar evaluation using the best estimate RELAP5 thermal hydraulic transient analysis code. The RELAP5 code is described further in DCD Tier 2 Section 15.0.2.2.9 and in NUREG/CR-5535, RELAP5/MOD3 Code Manual, Volumes 1 through 7, [Reference 5]. The ATWS evaluation for the APR1400 is provided in Technical Report APR1400-Z-A-NR-14014, Revision 0, ATWS Evaluation [Reference 6]. The applicants analyses assumed a failure to scram due to mechanical failure of the CEDM, even though a trip signal is generated either by the RPS or the DPS. A similar assumption was made by CE in the original [Reference 2] analyses. First, a qualitative evaluation was performed to identify the limiting AOO with respect to RCS integrity. This RCS pressure boundary integrity ATWS acceptance criterion (as described in the Regulatory Evaluation below) was found to be the most limiting AOO for the CE design. The applicant determined that the limiting AOO for the APR1400 in terms of RCS integrity is the complete loss of normal feedwater (LONF) without turbine trip. The same conclusion was reached by CE [Reference 2]. In the CE ATWS analysis, methods approved for the CE System 80+ design were used.

The six AOOs considered by the applicant in Reference 6 all result in a decrease in heat removal from the RCS. Core power decreases because of RCS temperature increase and negative reactivity feedback. In each case, the expansion of heated reactor coolant produces an RCS pressure increase. Eventually, the pressurizer is filled with liquid, which is then 15-231

discharged through the primary system safety valves, and the RCS pressure reaches a peak value.

For the quantitative analyses, the applicant used the same assumptions and initial conditions that CE applied in the Reference 2 analyses. These include:

a. Mechanical failure of the reactor scram function (CEDM failure);

b. The RRS and the RPCS are assumed to be unavailable;

c. Non-safety grade NSSS control systems, such as the pressurizer pressure control system, the pressurizer level control system, and the SBCS, are assumed to be in automatic mode of operation;

d. ESF are assumed to actuate as designed;

e. The fuel cycle is assumed to be the initial cycle. MTCs, which influence ATWS response, are most adverse for the initial cycle, not for the equilibrium cycle;

f. No credit is taken for manual action by the operators for the first 30 minutes after event initiation;

g. AOOs are assumed to occur at nominal operating conditions; and

h. Nominal design data and setpoints are assumed.

The applicant analyzed each ATWS event for seventeen burnups, from the BOC to the EOC, to find the most unfavorable burnup. The limiting burnup was determined to be 2011 MWD/MTU.

For a LONF without turbine trip event, and assuming that the CEAs fail to insert into the core, the applicant calculated a peak RCS pressure of 301.88 kg/cm2 (4293.7 psia), which exceeds the ASME Service Level C limit of 22.06 MPa (3200 psia). A result of similar magnitude was calculated by CE in Reference 2, when also assuming the CEAs fail to insert. CE performed a finite element structural analysis, documented in Section 3.0 of CENPD-263-P [Reference 3], to demonstrate RCS structural integrity up to 4300 psia for operating CE plants, including the System 80+ design. To minimize the likelihood of this type of RCS overpressure event, the ATWS rule includes the requirement for CE plant designs to include a diverse scram system.

By implication, due to similarities in design, the requirement would apply to the APR1400 design as well.

The applicant considered this beyond design basis RCS overpressure event in the Level I Probabilistic Risk Assessment (PRA) described in DCD Tier 2 Chapter 19. The PRA includes consideration of a CEDM failure, which prevents CEA insertion into the core. A core damage frequency is calculated for this beyond design basis event. To mitigate the effects of RCS overpressure, the APR1400 design includes POSRVs, which discharge steam to the IRWST, the AFWS, which provides an independent means of supplying makeup water to the SGs for removal of decay heat from the reactor core during an accident, and the CVCS, which provides an independent means of supplying borated water to the RCS for reactivity control following an ATWS.15-232

The applicant concludes that the analysis results of CENPD-158, Revision 1 [Reference 2], can be applied to the APR1400 design. Additionally, in DCD Tier 2 Chapter 19, the applicant concludes that the risk of core damage resulting from ATWS is extremely small, and that no design changes would provide a positive cost-benefit if included in the APR1400 design.

ITAAC: The ITAAC associated with DCD Tier 2, Section 15.8 are given in DCD Tier 1, Table 2.5.1-5, Reactor Trip System and Engineered Safety Features, Table 2.5.2-5, Diverse Actuation System, and Table 2.5.4-4, ESF-CCS.

TS: The TS associated with DCD Tier 2, Section 15.8 are given in DCD Tier 2, Chapter 16, Technical Specifications, 3.3.1, Reactor Protection System (RPS) Instrumentation -

Operating, 13.3, Control Element Assembly Calculators (CEACs), 3.3.4, Reactor Protection System (RPS) Logic and Trip Initiation, 3.3.5, Engineered Safety Features Actuation System (ESFAS) Instrumentation, and 3.3.6, Instrumentation Engineered Safety Features Actuation System (ESFAS) Logic and Manual Trip.

The relevant requirements of NRC regulations for this area of review, and the associated acceptance criteria, are in NUREG-0800, Sections 15.8, Anticipated Transients without Scram,

[Reference 7], and are summarized below:

10 CFR 50.62 (the ATWS rule), as it relates to the acceptable reduction of risk from ATWS events via (a) inclusion of prescribed design features, and (b) demonstration of their adequacy. The ATWS rule requires that each pressurized water reactor have equipment, from sensor output to final actuation device, which is diverse from the reactor trip system, to automatically initiate the auxiliary feedwater system and initiate turbine trip under the conditions indicative of an ATWS. In addition, CE fleet plants have been required to have a diverse scram system from the sensor output to interruption of power to the control rods.

10 CFR 50.46, as it relates to maximum allowable peak cladding temperatures, maximum cladding oxidation, and coolable geometry.

GDC 12, as it relates to ensuring that oscillations are either not possible or can be reliably and readily detected and suppressed.

GDC 14, as it relates to ensuring an extremely low probability of failure of the coolant pressure boundary.

GDC 16, as it relates to ensuring that containment design conditions important to safety are not exceeded as a result of postulated accidents.

GDC 35, as it relates to ensuring that fuel and clad damage, should either occur, must not interfere with continued effective core cooling, and that clad metal-water reaction must be limited to negligible amounts.

GDC 38, as it relates to ensuring that the containment pressure and temperature are maintained at acceptably low levels following any accident that deposits reactor coolant in the containment.15-233

GDC 50, as it relates to ensuring that the containment does not exceed the design leakage rate when subjected to the calculated pressure and temperature conditions resulting from any accident that deposits reactor coolant in the containment.

Review interfaces with other SRP sections can be found in NUREG-0800, Section 15.8. These include SRP Section 4.3 for reactivity coefficients and control rod worths, SRP Sections 7.1 and 7.8 for determination that design and quality assurance criteria specified for instrumentation are consistent with criteria established in conjunction with the ATWS rule, and Section 7.2 for determination that the design and reliability of the RTS are acceptable and that required ATWS-related features are independent and diverse from the RTS where required by the rule.

The staff reviewed DCD Tier 2, Section 15.8 and the applicants referenced Technical Report

[Reference 6]. The staff followed the guidance in SRP Section 15.8 and evaluated the DCD Tier 2 information against GDC 12, 14, 16, 35, 38, and 50. The staff also reviewed applicable portions of the TS and ITAAC.

Previously-approved CE topical reports CENPD-158 and CENPD-263 [References 2 and 3]

were reviewed in detail by the staff to assess their applicability to the APR1400 design. Original NRC approval was obtained in 1976 and 1979, respectively. These references document a series of ATWS evaluations performed by CE to support the NRCs rules setting decisions for ATWS events. These evaluations used approved analysis methods that were available at that time, such as the ATWS version of the CESEC code or CESEC-ATWS [References 8 through 13]. CE evaluated AOOs and PAs usually evaluated in Chapter 15. Based on these evaluations, CE concluded, and the staff agreed, that the CE designs met all of the Chapter 15.8 acceptance criteria except challenges to the RCS pressure boundary. CE found that, for the following events, the pressure boundary was challenged, that is, RCS pressure exceeded the ASME Service Level C limit of 3,200 psia (22.06 MPa):

1. CEA ejection.

2. Loss of load.

3. Loss of normal feedwater

4. Partial loss of flow.

Of these, loss of normal feedwater was determined to be the most limiting.

The applicant reevaluated the limiting event for the APR1400 design with respect to RCS integrity in the ATWS Evaluation technical report, [Reference 6] using modern analyses methods (RELAP5). The applicant obtained results similar to those developed by CE using CENPD-158 methodology.

The applicability to the APR1400 design of previous staff approvals for either the certified CE System 80+ design or for CE System 80+ plants, such as Palo Verde, Units 1, 2, and 3, Arkansas Nuclear One (ANO), Unit 2, San Onofre, Units 2 and 3, and Waterford 3, has been addressed by the staff in other sections of this SER (such as Section 4.3 for core nuclear 15-234

design, Section 4.4 for core thermal hydraulic design, Section 7.2 for the reactor trip system, and Section 7.8 for the DPS). The small increase in reactor thermal power of the APR1400 compared to the System 80+ will have some effect on the transient response, but the applicant has accounted for that in the ATWS analyses. The staffs evaluation of the CE System 80+ is provided in NUREG-1462, Volumes 1, 2, and 3, Final Safety Evaluation Report Related to the Certification of the System 80+ Design, August 1994 [Reference 14]. The previous conclusions made by the staff regarding compliance with the ATWS rule are applicable to the APR1400 design.

Although the applicant stated in the ATWS Evaluation technical report that RCS pressure integrity was the limiting ATWS acceptance criterion, there was no description of the evaluation of other ATWS acceptance criteria. Therefore, in RAI 386-8515, Question 15.08-1, dated February 1, 2016 (ML16032A109) [Reference 15], the staff requested the applicant to provide an evaluation of consequences of ATWS with respect to each of the eight acceptance criteria identified in the Standard Review Plan for Section 15.8. The applicant provided a response dated March 8, 2016 (ML16068A303) [Reference 16], stating the following:

Criterion 1: APR1400 satisfies the ATWS rule for CE type PWR specified in 10 CFR 50.62 by providing a diverse scram system independent from the existing reactor protection (trip) system from sensor output to interruption of power to the control rods.

Criterion 2 and 6: There is no significant RCS inventory loss or fuel uncovery during AOOs without reactor trip up to 30 minutes after event initiation. So, the fuel integrity is maintained without any challenge of fuel heat-up and the long term coolability is ensured without metal-water reaction due to no fuel heat-up.

Criterion 3: There are no significant power and flow oscillations larger than those of Chapter 15 events such as a CEA withdrawal and a loss of reactor coolant flow, respectively, since the system reaches the new steady state without requiring the reactor trip.

Criterion 4: DPS (diverse protection system) for reactor trip on high pressurizer pressure and DPS for the auxiliary feedwater flow on low SG [Steam Generator] level will protect the RCS overpressurization as provided in the Technical Report, APR1400-Z-A-NR-14014.

Criterion 5, 7, and 8: As analyzed in CENPD-158, ATWS analyses: Analysis of Anticipated Transients without Reactor Scram in Combustion Engineering NSSSs (1976), the mass and energy release to the containment through pressurizer safety valves (POSRVs) is lower than that of Section 6.2.1.3, LOCA Mass and Energy Release. So, the containment pressure and temperature will be lower than the design values and thus the containment leakage rate will not exceed the design limits.

The staff considers the response to RAI 386-8515, Question 15.08-1, resolved and closed for the reasons discussed below and because it documents the applicants position on ATWS acceptance criteria other than RCS integrity. During ATWS rulemaking, CE responded to a staff RAI with the same question regarding ATWS acceptance criteria by submitting Topical Report CENPD-263-P [Reference 3]. Section 4.0 of this report, titled Assurance of Conformance to ATWS Criteria Other Than RCS Pressure, addresses each of the above acceptance criteria.15-235

CE referred to the results from CENPD-158, Revision 1 [Reference 2] to explain how the various ATWS acceptance criteria are met.

For fuel integrity, the calculated DNBR remained above the 95/95 (95 percent probability with 95 percent confidence) value for all transients except the partial loss of flow (POLF) for the 3,800 MWt plant class. This DNBR transient was recalculated using the CE-1 CHF correlation, and no fuel pins were calculated to have a DNBR below the 95/95 value. No clad collapse was predicted to occur for the fuel pin differential pressures calculated. The requirements of 10 CFR 50.46 and GDC 35 are therefore satisfied.

For containment pressure, CE conservatively calculated the pressure response assuming a stuck open safety valve discharging to the containment. The resulting pressure from an ATWS event was shown to be less than the design value. Additionally, the radiological consequences of a containment release were shown to be acceptable. Therefore, the requirements of GDCs 16, 38, and 50 are met.

CE did not specifically address GDC 12 with respect to system stability, but this subject has been addressed by the staff in Sections 4.3 and 4.4 of this SER. The staff concludes that only xenon-induced instabilities are plausible and can be detected and mitigated by operation of the reactivity control systems. Additionally, PWRs, such as the APR1400, have historically not been subject to instability due to the open channel design of PWR cores. Therefore, the requirements of GDC 12 are met.

Regarding RCS integrity, CE demonstrated by finite element analyses described in Section 3.0 of CENPD-263 [Reference 3] that the RCS piping and components can withstand pressures up to 4,300 psia (29.6 MPa). This pressure that the RCS piping and components can withstand is well above the ASME Service Level C limit of 3,200 psia (22.06 MPa) and is therefore acceptable. Because of the similarity of the APR1400 design to the CE System 80+ design analyzed by CE, the staff concludes that the APR1400 RCS integrity can be maintained during an ATWS event. Additionally, the applicant showed in DCD Tier 2 Chapter 19 that the probability of failure of the reactor coolant pressure boundary is extremely low.

Satisfaction of the requirements of 10 CFR 50.62 regarding independence and diversity of the Reactor Trip System (RTS) and Diverse Actuation System (DAS) is addressed by the staff in Sections 7.8.4.2.1 and 7.8.4.5 of this SER. The staff used the diversity analysis guidance in NUREG/CR-6303, Method for Performing Diversity and Defense-in-Depth Analyses of Reactor Protection Systems, [Reference 17] to evaluate the diversity of the DAS as compared to the PPS. The diversity categories considered in NUREG/CR-6303 include design diversity, equipment diversity, functional diversity, human diversity, signal diversity, and software diversity. The applicant provided the detailed analysis of these diversity attributes in Section 6.2.1 of Technical Report APR1400-Z-J-NR-14002 [Reference 4]. The staff reviewed these results and concludes that the applicant has met the intent of the ATWS rule with respect to diversity.

Section 7.8.4.5 of this SER addresses independence of the diverse actuation system (also referred to as the diverse protection system, or DPS) from the Reactor Trip System (RTS) and ESFAS. Electrical, physical, and communications isolations are maintained between the safety system (RTS) and the non-safety, but augmented quality, DAS. The DPS is electrically isolated and also physically separated from the protection system. Power is supplied to the DAS from 15-236

two redundant non-Class 1E vital buses, while RTS power is supplied by independent Class 1E vital buses. The staff concludes in Section 7.8.6 of this SER that the applicants design meets the intent of the ATWS rule regarding function, independence, and diversity.

The applicant did not seek staff approval for use of the RELAP5 code for future licensing applications involving ATWS transients. RELAP5 was only used for the purpose of demonstrating the similarity of the APR1400 ATWS responses to the same events evaluated previously by CE. The staff considers this an appropriate application of the code, particularly because the staff performed a detailed review of the RELAP5 code and its application for analyses of Large Break Loss of Coolant Accidents (LBLOCA) for the APR1400 design in Section 15.0.2 of this SER. This review included assessment of relevant physical phenomena, code methodology, physical dimensions, orientation, and control systems of the APR1400 design, as well as benchmark comparisons of results to experimental data. Additionally, the staff audited the applicants calculations during the Software Quality Assurance Inspection

[Reference 18]. Also, the staff approved other reactor vendors use of the RELAP5 code for evaluation of ATWS transients.

There are no COL items associated with Section 15.8 of the APR1400 DCD.

The staff concludes that the plant design adequately addresses ATWS events and meets the requirements of 10 CFR 50.62. This conclusion is based on the applicant providing an acceptable diverse actuation system.

1. NUREG-0460, Anticipated Transients Without Scram, Staff Report, Division of Systems Safety, Office of Nuclear Reactor Regulation, U.S. Nuclear Regulatory Commission, April 1978.

2. CENPD-158, Revision 01, Analysis of Anticipated Transients without Reactor Scram in Combustion Engineering NSSSs, May 1976.

3. CENPD-263-P, ATWS Early Verification, Combustion Engineering, Inc.,

November 1979.

4. APR1400-Z-J-NR-14002-P, Revision 0, Diversity and Defense-in-Depth, November 2014.

5. NUREG/CR-5535, Volumes 1 through 7, RELAP5/MOD3 Code Manual.

6. APR1400-Z-A-NR-14014-P, ATWS Evaluation, Revision 0, KHNP, November 2014.

7. NUREG-0800, Standard Review Plan for the Review of Safety Analysis Reports for Nuclear Power Plants: LWR Edition (SRP), Sections 15.8, Anticipated Transients without Scram.15-237

8. CENPD-107, CESEC Digital Simulation of a Combustion Engineering Nuclear Steam Supply System, April 1974.

9. CENPD-107, Supplement 1, ATWS Model Modifications to CESEC, September 1974.

10. CENPD-107, Supplement 1, Amendment 1-P, ATWS Model Modifications to CESEC, November 1975.

11. CENPD-107, Supplement 2, ATWS Models for Reactivity Feedback and Effect of Pressure on Fuel, September 1974.

12. CENPD-107, Supplement 3, ATWS Model Modifications to CESEC, August 1975.

13. CENPD-107, Supplement 4-P, ATWS Model Modifications to CESEC, December 1975.

14. NUREG-1462, Volumes 1, 2, and 3, Final Safety Evaluation Report Related to the Certification of the System 80+ Design, August 1994.

15. Request for Additional Information 386-8515, (ML16032A109).

16. Korea Hydro & Nuclear Power Co., Ltd - Transmittal of Response to RAI 386-8515 (ML16068A303).

17. NUREG/CR-6303, Method for Performing Diversity and Defense-in-Depth Analyses of Reactor Protection Systems, December 1994.

18. Nuclear Regulatory Commission Inspection of Korea Hydro & Nuclear Power, Ltd.,

Report No. 05200046/206-201, April 8, 2016 (ML16081A081).15-238