ML20106E946

1 to Updated Final Safety Analysis Report, Chapter 15, Accident Analysis

ML20106E946
Person / Time
Site:	Catawba
Issue date:	04/02/2020
From:	Duke Energy Carolinas
To:	Office of Nuclear Reactor Regulation
Shared Package
ML20106E897	List: ML20106E898 ML20106E899 ML20106E900 ML20106E901 ML20106E902 ML20106E904 ML20106E905 ML20106E907 ML20106E908 ML20106E909 ML20106E910 ML20106E911 ML20106E912 ML20106E913 ML20106E914 ML20106E916 ML20106E917 ML20106E918 ML20106E919 ML20106E920 ML20106E922 ML20106E923 ML20106E925 ML20106E926 ML20106E927 ML20106E928 ML20106E929 ML20106E932 ML20106E933 ML20106E935 ML20106E936 ML20106E937 ML20106E938 ML20106E939 ML20106E940 ML20106E941 ML20106E942 ML20106E943 ML20106E945 ML20106E946 ML20106E947 ML20106E948 ML20106E949 ML20106E950 RA-19-0423, 1 to Updated Final Safety Analysis Report, Report of Information Removed from Revision 21 of the Catawba Nuclear Station, Units 1 and 2 FSAR
References
RA-19-0423
Download: ML20106E946 (173)

Text

Catawba Nuclear Station UFSAR Chapter 15 Table of Contents 15.0 Accident Analysis 15.1 Increase in Heat Removal by the Secondary System 15.1.1 Feedwater System Malfunctions that Result in a Reduction in Feedwater Temperature 15.1.1.1 Identification of Causes and Accident Description 15.1.1.2 Analysis of Effects and Consequences 15.1.1.3 Conclusions 15.1.2 Feedwater System Malfunction Causing an Increase in Feedwater Flow 15.1.2.1 Identification of Causes and Accident Description 15.1.2.2 Analysis of Effects and Consequences 15.1.2.3 Conclusions 15.1.3 Excessive Increase in Secondary Steam Flow 15.1.3.1 Identification of Causes and Accident Description 15.1.3.2 Analysis of Effects and Consequences 15.1.3.3 Environmental Consequences 15.1.3.4 Conclusions 15.1.4 Inadvertent Opening of a Steam Generator Relief or Safety Valve 15.1.4.1 Identification of Causes and Accident Description 15.1.4.2 Analysis of Effects and Consequences 15.1.4.3 Environmental Consequences 15.1.4.4 Conclusions 15.1.5 Steam System Piping Failure 15.1.5.1 Identification of Causes and Accident Description 15.1.5.2 Analysis of Effects and Consequences 15.1.5.3 Environmental Consequences 15.1.6 References 15.2 Decrease in Heat Removal by the Secondary System 15.2.1 Steam Pressure Regulator Malfunction or Failure that Results in Decreasing Steam Flow 15.2.2 Loss of External Load 15.2.2.1 Identification of Causes and Accident Description 15.2.2.2 Analysis of Effects and Consequences 15.2.2.3 Environmental Consequences 15.2.2.4 Conclusions 15.2.3 Turbine Trip 15.2.3.1 Identification of Causes and Accident Description 15.2.3.2 Analysis of Effects and Consequences 15.2.3.3 Environmental Consequences 15.2.3.4 Conclusions 15.2.4 Inadvertent Closure of Main Steam Isolation Valves 15.2.5 Loss of Condenser Vacuum and Other Events Causing a Turbine Trip 15.2.6 Loss of Non-Emergency AC Power to the Station Auxiliaries 15.2.6.1 Identification of Causes and Accident Description 15.2.6.2 Analysis of Effects and Consequences 15.2.6.3 Environmental Consequences 15.2.6.4 Conclusions 15.2.7 Loss of Normal Feedwater Flow 15.2.7.1 Identification of Causes and Accident Description 15.2.7.2 Analysis of Effects and Consequences 15.2.7.3 Environmental Consequences 15.2.7.4 Conclusions (09 OCT 2019) 15 - i

Catawba Nuclear Station UFSAR Chapter 15 15.2.8 Feedwater System Pipe Break 15.2.8.1 Identification of Causes and Accident Description 15.2.8.2 Analysis of Effects and Consequences 15.2.8.3 Environmental Consequences 15.2.8.4 Conclusions 15.2.9 References 15.3 Decrease in Reactor Coolant System Flow Rate 15.3.1 Partial Loss of Forced Reactor Coolant Flow 15.3.1.1 Identification of Causes and Accident Description 15.3.1.2 Analysis of Effects and Consequences 15.3.1.3 Environmental Consequences 15.3.1.4 Conclusions 15.3.2 Complete Loss of Forced Reactor Coolant Flow 15.3.2.1 Identification of Causes and Accident Description 15.3.2.2 Analysis of Effects and Consequences 15.3.2.3 Environmental Consequences 15.3.2.4 Conclusions 15.3.3 Reactor Coolant Pump Shaft Seizure (Locked Rotor) 15.3.3.1 Identification of Causes and Accident Description 15.3.3.2 Analysis of Effects and Consequences 15.3.3.3 Environmental Consequences 15.3.3.4 Conclusions 15.3.4 Reactor Coolant Pump Shaft Break 15.3.4.1 Identification of Causes and Accident Description 15.3.4.2 Conclusions 15.3.5 References 15.4 Reactivity and Power Distribution Anomalies 15.4.1 Uncontrolled Rod Cluster Control Assembly Bank Withdrawal From a Subcritical or Low Power Startup Condition 15.4.1.1 Identification of Causes and Accident Description 15.4.1.2 Analysis of Effects and Consequences 15.4.1.3 Environmental Consequences 15.4.1.4 Conclusions 15.4.2 Uncontrolled Rod Cluster Control Assembly Bank Withdrawal at Power 15.4.2.1 Identification of Causes and Accident Description 15.4.2.2 Analysis of Effects and Consequences 15.4.2.3 Environmental Consequences 15.4.2.4 Conclusions 15.4.3 Rod Cluster Control Assembly Misoperation (System Malfunction or Operator Error) 15.4.3.1 Identification of Causes and Accident Description 15.4.3.2 Analysis of Effects and Consequences 15.4.3.3 Environmental Consequences 15.4.3.4 Conclusions 15.4.4 Startup of an Inactive Reactor Coolant Pump at an Incorrect Temperature 15.4.4.1 Identification of Causes and Accident Description 15.4.4.2 Analysis of Effects and Consequences 15.4.4.3 Environmental Consequences 15.4.4.4 Conclusions 15.4.5 A Malfunction or Failure of the Flow Controller in a BWR Loop that Results in an Increased Reactor Coolant Flow Rate 15.4.6 Chemical and Volume Control System Malfunction that Results in a Decrease in Boron Concentration in the Reactor Coolant 15.4.6.1 Identification of Causes and Accident Description 15.4.6.2 Analysis of Effects and Consequences (09 OCT 2019) 15 - ii

Catawba Nuclear Station UFSAR Chapter 15 15.4.6.3 Environmental Consequences 15.4.6.4 Conclusions 15.4.7 Inadvertent Loading and Operation of a Fuel Assembly in an Improper Position 15.4.7.1 Identification of Causes and Accident Description 15.4.7.2 Analysis of Effects and Consequences 15.4.7.3 Environmental Consequences 15.4.7.4 Conclusions 15.4.8 Spectrum of Rod Cluster Control Assembly Ejection Accidents 15.4.8.1 Identification of Causes and Accident Description 15.4.8.1.1 Design Precautions and Protection 15.4.8.1.2 Limiting Criteria 15.4.8.2 Analysis of Effects and Consequences 15.4.8.2.1 Stages of Analysis 15.4.8.2.2 Calculation of Basic Parameters 15.4.8.3 Environmental Consequences 15.4.8.4 Conclusions 15.4.9 Spectrum of Rod Drop Accidents (BWR) 15.4.10 References 15.5 Increase in Reactor Coolant Inventory 15.5.1 Inadvertent Operation of Emergency Core Cooling System During Power Operation 15.5.1.1 Identification of Causes and Accident Description 15.5.1.2 Analysis of Effects and Consequences 15.5.1.3 Environmental Consequences 15.5.1.4 Conclusions 15.5.2 Chemical and Volume Control System Malfunction that Increases Reactor Coolant Inventory 15.5.3 A Number of BWR Transients 15.5.4 References 15.6 Decrease in Reactor Coolant Inventory 15.6.1 Inadvertent Opening of a Pressurizer Safety or Relief Valve 15.6.1.1 Identification of Causes and Accident Description 15.6.1.2 Analysis of Effects and Consequences 15.6.1.3 Conclusions 15.6.2 Break in Instrument Line or Other Lines from Reactor Coolant Pressure Boundary that Penetrate Containment 15.6.2.1 Identification of Causes and Accident Description 15.6.2.2 Analysis of Effects and Consequences 15.6.2.3 Environmental Consequences 15.6.3 Steam Generator Tube Failure 15.6.3.1 Identification of Causes and Accident Description 15.6.3.2 Analysis of Effects and Consequences 15.6.3.3 Environmental Consequences 15.6.4 Spectrum of BWR Steam System Piping Failures Outside Containment 15.6.5 Loss-of-Coolant Accidents 15.6.5.1 Identification of Causes and Accident Description 15.6.5.2 Analysis of Effects and Consequences 15.6.5.3 Radiological Consequences 15.6.5.4 10 CFR 50.46 Reporting Summary 15.6.6 A Number of BWR Transients 15.6.7 References 15.7 Radioactive Release From a Subsystem or Component 15.7.1 Radioactive Gas Waste System Leak or Failure 15.7.1.1 Identification of Causes and Accident Description (09 OCT 2019) 15 - iii

Catawba Nuclear Station UFSAR Chapter 15 15.7.1.2 Analysis of Effects and Consequences 15.7.1.3 Environmental Consequences 15.7.2 Radioactive Liquid Waste System Leak or Failure 15.7.2.1 Identification of Causes and Accident Description 15.7.2.2 Analysis of Effects and Consequences 15.7.2.3 Environmental Consequences 15.7.3 Postulated Radioactive Releases due to Liquid Tank Failures 15.7.3.1 Identification of Causes and Accident Description 15.7.3.2 Analysis of Effects and Consequences 15.7.3.3 Environmental Consequences 15.7.4 Fuel Handling Accidents in the Containment and Spent Fuel Storage Buildings 15.7.4.1 Identification of Causes and Accident Description 15.7.4.2 Analysis of Effects and Consequences 15.7.4.2.1 Postulated Fuel Handling Accident Outside Containment 15.7.4.2.2 Postulated Fuel Handling Accident Inside Containment 15.7.4.2.3 Postulated Weir Gate Drop 15.7.4.3 Environmental Consequences 15.7.4.3.1 Postulated Fuel Handling Accident Outside Containment 15.7.4.3.2 Postulated Fuel Handling Accident Inside Containment 15.7.4.3.3 Postulated Weir Gate Drop 15.7.5 Spent Fuel Cask Drop Accident 15.7.6 References 15.8 Anticipated Transients Without Trip 15.8.1 References 15.9 Impact of Lead Test Assemblies on Post Accident Radiation Doses 15.9.1 Radioactive Source Terms 15.9.2 Radioactivity Transport 15.9.3 Post Accident Radiaition Doses (09 OCT 2019) 15 - iv

Catawba Nuclear Station UFSAR Chapter 15 List of Tables Table 15-1. Deleted Per 1992 Update Table 15-2. Summary of Accidents Analyzed With Computer Codes Table 15-3. Summary of Computer Codes and Methodologies Used in Accident Analyses Table 15-4. Summary of Input Parameters for Accident Analyses Using Computer Codes Table 15-5. Deleted Per 1992 Update Table 15-6. Rod Drop Times Used in FSAR Analyses Table 15-7. Trip Points and Time Delays to Trip Assumed in Accident Analyses Table 15-8. Deleted Per 1992 Update Table 15-9. Deleted Per 1992 Update Table 15-10. Deleted Per 1992 Update Table 15-11. Deleted Per 1992 Update Table 15-12. Fission Product Radioactivity Levels in the Reactor Core*

Table 15-13. Reactor Coolant Specific Activities for Iodine and Noble Gas Isotopes Table 15-14. Total Effective Dose Equivalents (TEDEs - Rem) Following Design Basis Events Table 15-15. Time Sequence of Events for Incidents Which Cause an Increase In Heat Removal By The Secondary System Table 15-16. Deleted Per 1992 Update Table 15-17. Parameters for Postulated Main Steam Line Break Offsite Dose Analysis Table 15-18. Time Sequence Of Events For Incidents Which Cause A Decrease In Heat Removal By The Secondary System Table 15-19. Deleted Per 2010 Update Table 15-20. Time Sequence of Events for Incidents Which Cause a Decrease in Reactor Coolant System Flow Table 15-21. Deleted Per 1992 Update Table 15-22. Deleted Per 2019 Update Table 15-23. Time Sequence of Events for Incidents which Cause Reactivity and Power Distribution Anomalies Table 15-24. Deleted Per 1992 Update (09 OCT 2019) 15 - v

Catawba Nuclear Station UFSAR Chapter 15 Table 15-25. Parameters Used in the Analysis of the Rod Cluster Control Assembly Ejection Accident Table 15-26. Parameters for the Postulated Rod Ejection Accident Table 15-27. Deleted Per 1995 Update Table 15-28. Time Sequence of Events For Inadvertent Opening of a Pressurizer Safety Valve Table 15-29. Parameters for Postulated Instrument Line Break Offsite Dose Analysis Table 15-30. Deleted Per 1990 Update Table 15-31. Parameters for Postulated Steam Generator Tube Rupture Dose Analysis Table 15-32. Input Parameters Used in the SBLOCA LOCA Analyses (Unit 2)

Table 15-33. Deleted Per 1994 Update Table 15-34. Deleted Per 1994 Update Table 15-35. Deleted Per 1995 Update Table 15-36. Deleted Per 1994 Update Table 15-37. Deleted Per 1995 Update Table 15-38. Small Break LOCA Time Sequence of Events (Unit 2)

Table 15-39. Small Break LOCA Results Fuel Cladding Data (Unit 2)

Table 15-40. Radiological Consequences of the Design Basis Loss of Coolant Accident - Data and Results Table 15-41. Data Pertaining to the Control Room and Control Room Area Ventilation (VC)

System.

Table 15-42. Parameters for Postulated Liquid Storage Tank Rupture Evaluation (UFSAR 15.7.2)

Table 15-43. Parameters for Postulated Refueling Water Storage Tank Rupture Accident Table 15-44. Activities for Postulated Refueling Water Storage Tank Rupture Accident Table 15-45. Activities in Highest Inventory Discharged Assembly for Postulated Fuel Handling Accidents Table 15-46. Parameters for Postulated Fuel Handling Accident (Note 1)

Table 15-47. Deleted Per 2004 Update Table 15-48. Parameters for Post-LOCA Subcriticality Analysis Table 15-49. Time Sequence of Events For Steam Generator Tube Rupture Table 15-50. Deleted Per 2001 Update (09 OCT 2019) 15 - vi

Catawba Nuclear Station UFSAR Chapter 15 Table 15-51. Deleted Per 2001 Update Table 15-52. Deleted Per 2001 Update Table 15-53. Deleted Per 2001 Update Table 15-54. Deleted Per 2001 Update Table 15-55. Deleted Per 2000 Update Table 15-56. Deleted Per 2000 Update Table 15-57. Minimum ECCS Flow Assumed in SBLOCA Analyses One Train Operational, Break Backpressure Equal to RCS Pressure Table 15-58. Parameters for Postulated Weir Gate Drop Table 15-59. Input Parameters Used in the SBLOCA LOCA Analyses (Unit 1)

Table 15-60. Small Break LOCA Time Sequence of Events (Unit 1)

Table 15-61. Small Break LOCA Results Fuel Cladding Data (Unit 1)

Table 15-62. Deleted Per 2001 Update Table 15-63. Deleted Per 2001 Update Table 15-64. Deleted Per 2001 Update Table 15-65. Minimum Injected ECCS Flows Assumed in LBLOCA Analyses - One Train Operational Table 15-66. Deleted Per 2001 Update Table 15-67. Deleted Per 2001 Update Table 15-68. Large Break LOCA - Time Sequence of Events for Reference Transient Table 15-69. Key Large Break LOCA Parameters and Initial Transient Assumptions.

Table 15-70. Best-Estimate Large Break LOCA - Overall Results Table 15-71. Plant Operating Range Allowed by the Best-Estimate Large Break LOCA Analysis Table 15-72. Rod Census Used in Best-Estimate Large Break LOCA Analysis Table 15-73. Fuel Assembly Isotopic Radioactivity Levels (Alternative Source Term Analysis of the Catawba Design Basis Locked Rotor and Rod Ejection Accidents)

Table 15-74. Parameters for the Steam Generator Tube Rupture Supplemental Offsite Dose Analysis Table 15-75. Fission Product Radioactivity Levels in a Mixed Oxide Lead Test Assembly Table 15-76. Fission Product Radioactivity Levels in a Mixed Oxide Lead Test Assembly (Fuel Handling Accident and Weir Gate Drop (09 OCT 2019) 15 - vii

Catawba Nuclear Station UFSAR Chapter 15 Table 15-77. LOCA Release Fractions Table 15-78. Non LOCA Gap Fractions Table 15-79. Iodine Partition Fractions for Post LOCA ESF Leakage in the Auxiliary Building Table 15-80. Iodine Partition Fractions for ESF Backleakage to the Refueling Water Storage Tank Following a Design Basis Rod Ejection Accident Table 15-81. Effect of Operation of Unit 1 with four MOX LTAs on Post Accident Radiation Doses Table 15-82. Summary of Licensing Basis LOCA PCT Results, Including PCT Assessments Table 15-83. Dose Equivalent Xenon-133 Noble Gas Specific Activities in the Reactor Coolant Table 15-84. Dose Equivalent Iodine-131 Noble Gas Specific Activities in the Reactor Coolant (09 OCT 2019) 15 - viii

Catawba Nuclear Station UFSAR Chapter 15 List of Figures Figure 15-1. Illustration of Overtemperature and Overpower T Protection Figure 15-2. Deleted Per 1997 Update Figure 15-3. Deleted Per 1997 Update Figure 15-4. Deleted Per 2000 Update Figure 15-5. Deleted Per 2000 Update Figure 15-6. Deleted Per 2000 Update Figure 15-7. Excessive Increase in Feedwater Flow Figure 15-8. Excessive Increase in Feedwater Flow Figure 15-9. Increase in Steam Flow Figure 15-10. Increase in Steam Flow Figure 15-11. Increase in Steam Flow Figure 15-12. Increase in Steam Flow Figure 15-13. Deleted Per 2006 Update Figure 15-14. Deleted Per 1997 Update Figure 15-15. Deleted Per 1997 Update Figure 15-16. Deleted Per 1997 Update Figure 15-17. Reactivity Versus Temperature Figure 15-18. Failure of a Steam Generator Safety or Dump Valve Figure 15-19. Failure of a Steam Generator Safety or Dump Valve Figure 15-20. Deleted Per 1997 Update Figure 15-21. Steamline Break, Offsite Power Maintained Figure 15-22. Steamline Break, Offsite Power Maintained Figure 15-23. Steamline Break, Offsite Power Maintained Figure 15-24. Steamline Break, Offsite Power Maintained Figure 15-25. Steamline Break, Offsite Power Maintained Figure 15-26. Steamline Break, Offsite Power Maintained (09 OCT 2019) 15 - ix

Catawba Nuclear Station UFSAR Chapter 15 Figure 15-27. Turbine Trip, Maximum Secondary Pressure Case Figure 15-28. Turbine Trip, Maximum Secondary Pressure Case Figure 15-29. Turbine Trip, Maximum Secondary Pressure Case Figure 15-30. Turbine Trip, Maximum Secondary Pressure Case Figure 15-31. Turbine Trip, Maximum Secondary Pressure Case Figure 15-32. Turbine Trip, Maximum Primary Pressure Case Figure 15-33. Feedwater System Pipe Break - Unit 2 Figure 15-34. Feedwater System Pipe Break - Unit 2 Figure 15-35. Deleted Per 2000 Update Figure 15-36. Loss of Offsite Power Figure 15-37. Loss of Offsite Power Figure 15-38. Loss of Offsite Power Figure 15-39. Loss of Offsite Power Figure 15-40. Loss of Offsite Power Figure 15-41. Unit 1 Loss of Normal Feedwater Long-Term Core Cooling Analysis Figure 15-42. Unit 1 Loss of Normal Feedwater Long-Term Core Cooling Analysis Figure 15-43. Unit 1 Loss of Normal Feedwater Long-Term Core Cooling Analysis Figure 15-44. Deleted Per 1997 Update Figure 15-45. Feedwater System Pipe Break - Unit 2 Figure 15-46. Feedwater System Pipe Break - Unit 2 Figure 15-47. Feedwater System Pipe Break - Unit 2 Figure 15-48. Feedwater System Pipe Break - Unit 2 Figure 15-49. Feedwater System Pipe Break - Unit 2 Figure 15-50. Deleted Per 2006 Update Figure 15-51. Deleted Per 2006 Update Figure 15-52. Deleted Per 1992 Update Figure 15-53. Deleted Per 1992 Update Figure 15-54. Reserved (09 OCT 2019) 15 - x

Catawba Nuclear Station UFSAR Chapter 15 Figure 15-55. Partial Loss of Forced Reactor Coolant Flow Figure 15-56. Partial Loss of Forced Reactor Coolant Flow Figure 15-57. Partial Loss of Forced Reactor Coolant Flow Figure 15-58. Partial Loss of Forced Reactor Coolant Flow Figure 15-59. Deleted Per 2006 Update Figure 15-60. Complete Loss of Forced Reactor Coolant Flow Figure 15-61. Complete Loss of Forced Reactor Coolant Flow Figure 15-62. Complete Loss of Forced Reactor Coolant Flow Figure 15-63. Complete Loss of Forced Reactor Coolant Flow Figure 15-64. Complete Loss of Forced Reactor Coolant Flow Figure 15-65. Deleted Per 2006 Update Figure 15-66. Locked Rotor - Offsite Power Lost Figure 15-67. Bank Withdrawal at HZP Figure 15-68. Bank Withdrawal at HZP Figure 15-69. Bank Withdrawal at HZP Figure 15-70. Bank Withdrawal at HZP Figure 15-71. Bank Withdrawal at HZP Figure 15-72. Bank Withdrawal at HZP Figure 15-73. Uncontrolled RCCA Bank Withdrawal from 10% Power Figure 15-74. Uncontrolled RCCA Bank Withdrawal from 10% Power Figure 15-75. Uncontrolled RCCA Bank Withdrawal from 10% Power Figure 15-76. Uncontrolled RCCA Bank Withdrawal from 10% Power Figure 15-77. Deleted Per 2004 Update Figure 15-78. Deleted Per 2004 Update Figure 15-79. Deleted Per 2004 Update Figure 15-80. Single RCCA Withdrawal Figure 15-81. Deleted Per 1992 Update Figure 15-82. Startup of a Reactor Coolant Pump at an Incorrect Temperature (09 OCT 2019) 15 - xi

Catawba Nuclear Station UFSAR Chapter 15 Figure 15-83. Startup of a Reactor Coolant Pump at an Incorrect Temperature Figure 15-84. Startup of a Reactor Coolant Pump at an Incorrect Temperature Figure 15-85. Startup of a Reactor Coolant Pump at an Incorrect Temperature Figure 15-86. Startup of a Reactor Coolant Pump at an Incorrect Temperature Figure 15-87. Interchange Between Region 1 and Region 3 Assembly Figure 15-88. Interchange Between Region 1 and Region 2 Assembly, Burnable Poison Rods Being Retained by the Region 2 Assembly Figure 15-89. Interchange Between Region 1 and Region 2 Assembly, Burnable Poison Rod Being Transferred to the Region 1 Assembly Figure 15-90. Enrichment Error: A Region 2 Assembly Loaded into the Core Central Position Figure 15-91. Loading A Region 2 Assembly into a Region 1 Position Near Core Periphery Figure 15-92. Single RCCA Withdrawal Figure 15-93. Single RCCA Withdrawal Figure 15-94. Single RCCA Withdrawal Figure 15-95. Dropped Rod Accident Figure 15-96. Deleted Per 1992 Update Figure 15-97. Deleted Per 1995 Update Figure 15-98. Deleted Per 1995 Update Figure 15.99. Deleted Per 1995 Update Figure 15-100. Inadvertent Opening of a Pressurizer Safety Valve Figure 15-101. Inadvertent Opening of a Pressurizer Safety Valve Figure 15-102. Deleted Per 1997 Update Figure 15-103. Steam Generator Tube Rupture Figure 15-104. Steam Generator Tube Rupture Figure 15-105. Steam Generator Tube Rupture Figure 15-106. Steam Generator Tube Rupture Figure 15-107. Steam Generator Tube Rupture Figure 15-108. Steam Generator Tube Rupture Figure 15-109. Deleted Per 2001 Update (09 OCT 2019) 15 - xii

Catawba Nuclear Station UFSAR Chapter 15 Figure 15-110. Deleted Per 1995 Update Figure 15-111. Deleted Per 2001 Update Figure 15-112. Deleted Per 1995 Update Figure 15-113. Deleted Per 1995 Update Figure 15-114. Deleted Per 1995 Update Figure 15-115. Deleted Per 1995 Update Figure 15-116. Deleted Per 1995 Update Figure 15-117. Deleted Per 1995 Update Figure 15-118. Deleted Per 1994 Update Figure 15-119. Deleted Per 1994 Update Figure 15-120. Deleted Per 1994 Update Figure 15-121. Deleted Per 1994 Update Figure 15-122. Deleted Per 1994 Update Figure 15-123. Deleted Per 1994 Update Figure 15-124. Deleted Per 1994 Update Figure 15-125. Deleted Per 1994 Update Figure 15-126. Deleted Per 1994 Update Figure 15-127. Deleted Per 1994 Update Figure 15-128. Deleted Per 1994 Update Figure 15-129. Deleted Per 1994 Update Figure 15-130. Deleted Per 1994 Update Figure 15-131. Deleted Per 1994 Update Figure 15-132. Deleted Per 1994 Update Figure 15-133. Deleted Per 1994 Update Figure 15-134. Deleted Per 1994 Update Figure 15-135. Deleted Per 1994 Update Figure 15-136. Deleted Per 1994 Update Figure 15-137. Deleted Per 1994 Update (09 OCT 2019) 15 - xiii

Catawba Nuclear Station UFSAR Chapter 15 Figure 15-138. Deleted Per 1994 Update Figure 15-139. Deleted Per 1994 Update Figure 15-140. Deleted Per 1994 Update Figure 15-141. Deleted Per 1994 Update Figure 15-142. Deleted Per 1994 Update Figure 15-143. Deleted Per 1994 Update Figure 15-144. Deleted Per 1994 Update Figure 15-145. Deleted Per 1994 Update Figure 15-146. Deleted Per 1994 Update Figure 15-147. Deleted Per 1994 Update Figure 15-148. Deleted Per 1994 Update Figure 15-149. Deleted Per 1994 Update Figure 15-150. Deleted Per 1994 Update Figure 15-151. Deleted Per 1994 Update Figure 15-152. Deleted Per 1994 Update Figure 15-153. Deleted Per 1994 Update Figure 15-154. Deleted Per 2000 Update Figure 15-155. Deleted Per 1995 Update Figure 15-156. Deleted Per 2000 Update Figure 15-157. Deleted Per 2000 Update Figure 15-158. Deleted Per 2000 Update Figure 15-159. Deleted Per 2000 Update Figure 15-160. Deleted Per 2000 Update Figure 15-161. Deleted Per 2000 Update Figure 15-162. Deleted Per 2000 Update Figure 15-163. Deleted Per 2000 Update Figure 15-164. Deleted Per 2000 Update Figure 15-165. Deleted Per 2000 Update (09 OCT 2019) 15 - xiv

Catawba Nuclear Station UFSAR Chapter 15 Figure 15-166. Deleted Per 2000 Update Figure 15-167. Deleted Per 2000 Update Figure 15-168. Deleted Per 2000 Update Figure 15-169. Deleted Per 2001 Update Figure 15-170. Deleted Per 2000 Update Figure 15-171. Deleted Per 2000 Update Figure 15-172. Deleted Per 2000 Update Figure 15-173. Deleted Per 2000 Update Figure 15-174. Deleted Per 2000 Update Figure 15-175. Deleted Per 2000 Update Figure 15-176. Deleted Per 2000 Update Figure 15-177. Deleted Per 2000 Update Figure 15-178. Deleted Per 2000 Update Figure 15-179. Deleted Per 2000 Update Figure 15-180. Deleted Per 2000 Update Figure 15-181. Deleted Per 2000 Update Figure 15-182. Deleted Per 1995 Update Figure 15-183. Deleted Per 1995 Update Figure 15-184. Deleted Per 1995 Update Figure 15-185. Deleted Per 1995 Update Figure 15-186. Deleted Per 1995 Update Figure 15-187. Deleted Per 1995 Update Figure 15-188. Deleted Per 2001 Update Figure 15-189. Deleted Per 2001 Update Figure 15-190. Deleted Per 2001 Update Figure 15-191. Deleted Per 2001 Update Figure 15-192. Locked Rotor - Offsite Power Lost Figure 15-193. Locked Rotor - Offsite Power Lost (09 OCT 2019) 15 - xv

Catawba Nuclear Station UFSAR Chapter 15 Figure 15-194. Locked Rotor - Offsite Power Lost Figure 15-195. Locked Rotor - Offsite Power Maintained Figure 15-196. Locked Rotor - Offsite Power Lost Figure 15-197. Dropped Rod Accident Figure 15-198. Dropped Rod Accident Figure 15-199. Dropped Rod Accident Figure 15-200. Dropped Rod Accident Figure 15-201. Rod Ejection Accident (BOC,HFP)

Figure 15-202. Rod Ejection Accident (EOC,HZP)

Figure 15-203. Bank Withdrawal at HZP - Peak RCS Pressure Figure 15-204. Uncontrolled RCCA Bank Withdrawal from 8% Power Figure 15-205. Steamline Break, Offsite Power Maintained Figure 15-206. Steamline Break, Offsite Power Maintained Figure 15-207. Steamline Break, Offsite Power Maintained Figure 15-208. Steamline Break, Offsite Power Maintained Figure 15-209. Steamline Break, Offsite Power Maintained Figure 15-210. Steamline Break, Offsite Power Lost Figure 15-211. Steamline Break, Offsite Power Lost Figure 15-212. Steamline Break, Offsite Power Lost Figure 15-213. Steamline Break, Offsite Power Lost Figure 15-214. Steamline Break, Offsite Power Lost Figure 15-215. Steamline Break, Offsite Power Lost Figure 15-216. Steamline Break, Offsite Power Lost Figure 15-217. Steamline Break, Offsite Power Lost Figure 15-218. Steamline Break, Offsite Power Lost Figure 15-219. Steamline Break, Offsite Power Lost Figure 15-220. Steamline Break, Offsite Power Lost Figure 15-221. Deleted Per 1997 Update (09 OCT 2019) 15 - xvi

Catawba Nuclear Station UFSAR Chapter 15 Figure 15-222. Feedwater System Pipe Break - Unit 1 Figure 15-223. Feedwater System Pipe Break - Unit 1 Figure 15-224. Feedwater System Pipe Break - Unit 1 Figure 15-225. Feedwater System Pipe Break - Unit 1 Figure 15-226. Feedwater System Pipe Break - Unit 1 Figure 15-227. Feedwater System Pipe Break - Unit 1 Figure 15-228. Feedwater System Pipe Break - Unit 1 Figure 15-229. Steam Generator Tube Rupture Figure 15-230. Deleted Per 2001 Update Figure 15-231. Deleted Per 2001 Update Figure 15-232. Deleted Per 2001 Update Figure 15-233. Deleted Per 2001 Update Figure 15-234. Deleted Per 2001 Update Figure 15-235. Deleted Per 2001 Update Figure 15-236. Deleted Per 2001 Update Figure 15-237. Deleted Per 2001 Update Figure 15-238. Deleted Per 2001 Update Figure 15-239. Deleted Per 2001 Update Figure 15-240. Deleted Per 2001 Update Figure 15-241. Deleted Per 2001 Update Figure 15-242. Deleted Per 2001 Update Figure 15-242. Deleted Per 2001 Update Figure 15-243. Deleted Per 2001 Update Figure 15-244. Deleted Per 2001 Update Figure 15-245. Deleted Per 2001 Update Figure 15-246. Deleted Per 2001 Update Figure 15-247. Deleted Per 2001 Update Figure 15-248. Deleted Per 2001 Update (09 OCT 2019) 15 - xvii

Catawba Nuclear Station UFSAR Chapter 15 Figure 15-249. Deleted Per 2001 Update Figure 15-250. Deleted Per 2001 Update Figure 15-251. Deleted Per 2000 Update Figure 15-252. Deleted Per 2000 Update Figure 15-252. Deleted Per 2000 Update Figure 15-253. Deleted Per 2000 Update Figure 15-254. RCCA Position Versus Time to Dashpot Figure 15-255. Normalized Rod Worth Versus Percent Inserted Figure 15-256. Normalized RCCA Bank Reactivity Worth Versus Normalized Drop Time Figure 15-257. Unit 1 Loss of Normal Feedwater Short-Term Core Cooling Analysis Figure 15-258. Unit 1 Loss of Normal Feedwater Short-Term Core Cooling Analysis Figure 15-259. Unit 1 Loss of Normal Feedwater Short-Term Core Cooling Analysis Figure 15-260. Unit 1 Loss of Normal Feedwater Short-Term Core Cooling Analysis Figure 15-261. Unit 1 Loss of Normal Feedwater Short-Term Core Cooling Analysis Figure 15-262. Unit 1 Loss of Normal Feedwater Short-Term Core Cooling Analysis Figure 15-263. Unit 1 Loss of Normal Feedwater Short-Term Core Cooling Analysis Figure 15-264. Unit 2 Loss of Normal Feedwater Long-Term Core Cooling Analysis Figure 15-265. Unit 2 Loss of Normal Feedwater Long-Term Core Cooling Analysis Figure 15-266. Unit 2 Loss of Normal Feedwater Long-Term Core Cooling Analysis Figure 15-267. Unit 2 Loss of Normal Feedwater Long-Term Core Cooling Analysis Figure 15-268. Unit 2 Loss of Normal Feedwater Long-Term Core Cooling Analysis Figure 15-269. Partial Loss of Forced Reactor Coolant Flow Figure 15-270. Complete Loss of Forced Reactor Coolant Flow Figure 15-271. Locked Rotor - Offsite Power Maintained Figure 15-272. Locked Rotor - Offsite Power Maintained Figure 15-273. Locked Rotor - Offsite Power Maintained Figure 15-274. Locked Rotor - Offsite Power Maintained Figure 15-275. Locked Rotor - Peak RCS Pressure (09 OCT 2019) 15 - xviii

Catawba Nuclear Station UFSAR Chapter 15 Figure 15-276. Deleted Per 2006 Update Figure 15-277. Uncontrolled RCCA Bank Withdrawal from 10% Power - Westinghouse Fuel Figure 15-278. Uncontrolled RCCA Bank Withdrawal from 50% Power - Westinghouse Fuel Figure 15-279. Uncontrolled RCCA Bank Withdrawal from 100% Power Figure 15-280. Deleted Per 2004 Update Figure 15-281. Uncontrolled RCCA Bank Withdrawal from 98% Power Figure 15-282. Power Distribution Assumed for Small Break LOCA Analyses Figure 15-283. Catawba - 2 SBLOCA 4-Inch Pressurizer Pressure Figure 15-284. Catawba - 2 SBLOCA 4-Inch Core Mixture Level Figure 15-285. Catawba - 2 SBLOCA 4-Inch Core Exit Vapor Temperature Figure 15-286. Deleted Per 2007 Update Figure 15-287. Catawba - 2 SBLOCA 4-Inch Break Liquid Flow and Total Safety Injection Flow Figure 15-288. Catawba - 2 SBLOCA 4-Inch Peak Clad Temperature and Maximum Transient Oxidation Figure 15-289. Catawba - 2 SBLOCA 4-Inch RCS Mass Figure 15-290. Catawba - 2 SBLOCA 2-Inch Pressurizer Pressure Figure 15-291. Catawba - 2 SBLOCA 2-Inch Core Mixture Level Figure 15-292. Catawba - 2 SBLOCA 2-Inch Core Exit Vapor Temperature Figure 15-293. Catawba - 2 SBLOCA 2-Inch Peak Clad Temperature and Maximum Transient Oxidation Figure 15-294. Catawba 2 - SBLOCA 3-Inch Pressurizer Pressure Figure 15-295. Catawba - 2 SBLOCA 3-Inch Core Mixture Level Figure 15-296. Catawba - 2 SBLOCA 3-Inch Core Exit Vapor Temperature Figure 15-297. Catawba - 2 SBLOCA 3-Inch Peak Clad Temperature and Maximum Transient Oxidation Figure 15-298. Catawba - 2 SBLOCA 1.5-Inch Pressurizer Pressure Figure 15-299. Catawba - 2 SBLOCA 1.5-Inch Core Mixture Level Figure 15-300. Catawba - 2 SBLOCA 1.5-Inch Core Exit Vapor Temperature Figure 15-301. Deleted Per 2007 Update Figure 15-302. Lower Bound Containment Pressure Used for Best-Estimate Large Break LOCA (09 OCT 2019) 15 - xix

Catawba Nuclear Station UFSAR Chapter 15 Figure 15-303. LBLOCA Peak Cladding Temperature (Reference Transient)

Figure 15-304. LBLOCA Liquid Mass Flowrate at Inlet to Hot Assembly Figure 15-305. LBLOCA Vapor Mass Flowrate at Blowdown PCT Location Figure 15-306. LBLOCA Entrained Liquid Mass Flowrate at Blowdown PCT Location Figure 15-307. LBLOCA Accumulator Discharge Flowrate Figure 15-308. LBLOCA Pumped Safety Injection Figure 15-309. LBLOCA Collapsed Liquid Level in the Lower Plenum Figure 15-310. LBLOCA Collapsed Liquid Level in Hot Assembly Figure 15-311. LBLOCA Collapsed Liquid Level in Downcomer Figure 15-312. Best-Estimate LBLOCA PBOT/PMID Operating Limits Figure 15-313. LBLOCA Axial Power Distribution for Reference Transient Figure 15-314. Catawba Unit 1 2-Inch Pressurizer Pressure Figure 15-315. Catawba Unit 1 2-inch Core Mixture Level Figure 15-316. Catawba Unit 1 2-inch Core Exit Vapor Temperature Figure 15-317. Catawba Unit 1 2-inch Break Vapor Flow and Upper Head Spray Nozzle Vapor Flow Figure 15-318. Catawba Unit 1 2-inch Break Liquid Flow and Total Safety Injection Flow Figure 15-319. Catawba Unit 1 2-inch Peak Clad Temperature and Maximum Transient Oxidation Figure 15-320. Catawba Unit 1 2-Inch RCS Mass Figure 15-321. Catawba Unit 1 3-Inch Pressurizer Pressure Figure 15-322. Catawba Unit 1 3-Inch Core Mixture Level Figure 15-323. Catawba Unit 1 3-Inch Peak Clad Temperature and Maximum Transient Oxidation Figure 15-324. Catawba Unit 1 1.5-Inch Pressurizer Pressure Figure 15-325. Catawba Unit 1 1.5-Inch Core Mixture Level Figure 15-326. Deleted Per 2007 Update Figure 15-327. Catawba Unit 1 4-Inch Pressurizer Pressure Figure 15-328. Catawba Unit 1 4-Inch Core Mixture Level Figure 15-329. Catawba Unit 1 4-Inch Peak Clad Temperature and Maximum Transient Oxidation (09 OCT 2019) 15 - xx

Catawba Nuclear Station UFSAR Chapter 15 Figure 15-330. Steamline Break Power at Power Figure 15-331. Steamline Break Power at Power Figure 15-332. Steamline Break Power at Power Figure 15-333. Steamline Break Power at Power Figure 15-334. Steamline Break Power at Power Figure 15-335. Steamline Break Power at Power Figure 15-336. Steamline Break Power at Power Figure 15-337. Steamline Break Power at Power Figure 15-338. Steamline Break Power at Power Figure 15-339. Steamline Break Power at Power (09 OCT 2019) 15 - xxi

Catawba Nuclear Station UFSAR Chapter 15 THIS PAGE LEFT BLANK INTENTIONALLY.

(09 OCT 2019) 15 - xxii

Catawba Nuclear Station UFSAR Chapter 15 15.0 Accident Analysis This chapter addresses the representative initiating events listed on pages 15-10, 15-11, and 15-12 of Regulatory Guide 1.70, Revision 3, as they apply to the Catawba Nuclear Station.

Certain items in the guide warrant comment, as follows:

Items 1.3 and 2.1 - There are no pressure regulators in the Nuclear Steam Supply System (NSSS) pressurized water reactor (PWR) design whose malfunction or failure could cause a steam flow transient.

Classification of Plant Conditions Since 1970, the American Nuclear Society (ANS) classification of plant conditions has been used which divides plant conditions into four categories in accordance with anticipated frequency of occurrence and potential radiological consequences to the public. The four categories are as follows:

1. Condition I: Normal Operation and Operational Transients.

2. Condition II: Faults of Moderate Frequency.

3. Condition III: Infrequent Faults.

4. Condition IV: Limiting Faults.

The basic principle applied in relating design requirements to each of the conditions is that the most probable occurrences should yield the least radiological risk to the public and those extreme situations having the potential for the greatest risk to the public shall be those least likely to occur. Where applicable, Reactor Trip System and Engineered Safeguards functioning is assumed, to the extent allowed by considerations such as the single failure criterion, in fulfilling this principle.

Condition I - Normal Operation and Operational Transients: Condition I occurrences are those which are expected frequently or regularly in the course of power operation, refueling, maintenance, or maneuvering of the plant. As such, Condition I occurrences are accommodated with margin between any plant parameter and the value of that parameter which would require either automatic or manual protective action. Inasmuch as Condition I occurrences occur frequently or regularly, they must be considered from the point of view of affecting the consequences of fault conditions (Conditions II, III and IV). In this regard, analysis of each fault condition described is generally based on a conservative set of initial conditions corresponding to adverse conditions which can occur during Condition I operation.

A typical list of Condition I events is listed below:

1. Steady state and shutdown operations

a. Power operation ( > 5 to 100 percent of rated thermal power)

b. Startup (Keff 0.99 to 5 percent of rated thermal power)

c. Hot standby (subcritical, temperature above the permissive for placing the Residual Heat Removal System in service)

d. Hot shutdown (subcritical, temperature between 200°F and 350°F)

e. Cold shutdown (subcritical, temperature 200°F)

f. Refueling (09 OCT 2019) 15.0 - 1

UFSAR Chapter 15 Catawba Nuclear Station

2. Operation with permissible deviations Various deviations which may occur during continued operation as permitted by the plant Technical Specifications must be considered in conjunction with other operational modes.

These include:

a. Operation with components or systems out of service

b. Radioactivity in the reactor coolant, due to leakage from fuel with clad defects

1) Fission products

2) Corrosion products

3) Tritium

c. Operation with steam generator leaks up to the maximum allowed by the Technical Specifications

d. Testing as allowed by Technical Specifications

3. Operational transients

a. Plant heatup and cooldown (up to 100°F/hour for the Reactor Coolant System during cooldown and 60°F/hr for the Reactor Coolant System during heatup; 200°F/hour for the pressurizer during cooldown and 100°F/ hour for the pressurizer during heatup)

b. Step load changes (up to +/-10 percent)

c. Ramp load changes (up to +/-5 percent/minute)

d. Load rejection up to and including design full load rejection transient Condition II - Faults of Moderate Frequency: These faults, at worst, result in the reactor trip with the plant being capable of returning to operation. By definition, these faults (or events) do not propagate to cause a more serious fault, i.e., Condition III or IV events. In addition, Condition II events are not expected to result in fuel rod failures or Reactor Coolant System or secondary system overpressurization. For the purposes of this report, the following faults are included in this category:

1. Feedwater system malfunctions that result in a decrease in feedwater temperature (Section 15.1.1).

2. Feedwater system malfunctions that result in an increase in feedwater flow (Section 15.1.2).

3. Excessive increase in secondary steam flow (Section 15.1.3).

4. Inadvertent opening of a steam generator relief or safety valve (Section 15.1.4).

5. Loss of external electrical load (Section 15.2.2).

6. Turbine trip (Section 15.2.3).

7. Inadvertent closure of main steam isolation valves (Section 15.2.4).

8. Loss of condenser vacuum and other events resulting in turbine trip (Section 15.2.5).

9. Loss of nonemergency AC power to the station auxiliaries (Section 15.2.6)

10. Loss of normal feedwater flow (Section 15.2.7).

11. Partial loss of forced reactor coolant flow (Section 15.3.1).

15.0 - 2 (09 OCT 2019)

Catawba Nuclear Station UFSAR Chapter 15

12. Uncontrolled rod cluster control assembly bank withdrawal from a subcritical or low power startup condition (Section 15.4.1).

13. Uncontrolled rod cluster control assembly bank withdrawal at power (Section 15.4.2).

14. Rod cluster control assembly misalignment (dropped full length assembly, dropped full length assembly bank, or statically misaligned full length assembly) (Section 15.4.3).

15. Startup of an inactive reactor coolant pump at an incorrect temperature (Section 15.4.4).

16. Chemical and Volume Control System malfunction that results in a decrease in the boron concentration in the reactor coolant (Section 15.4.6).

17. Inadvertent operation of the Emergency Core Cooling System during power operation (Section 15.5.1).

18. Chemical and Volume Control System malfunction that increases reactor coolant inventory (Section 15.5.2).

19. Inadvertent opening of a pressurizer safety or relief valve (Section 15.6.1).

20. Break in instrument line or other lines from reactor coolant pressure boundary that penetrate containment (Section 15.6.2).

Condition III - Infrequent Faults: By definition Condition III occurrences are faults which may occur very infrequently during the life of the plant. They will be accommodated with the failure of only a small fraction of the fuel rods although sufficient fuel damage might occur to preclude resumption of the operation for a considerable outage time. The release of radioactivity will not be sufficient to interrupt or restrict public use of those areas beyond the exclusion radius. A Condition III fault will not, by itself, generate a Condition IV fault or result in a consequential loss of function of the Reactor Coolant System or Containment barriers. For the purposes of this report the following faults are included in this category:

1. Steam system piping failure (minor) (Section 15.1.5).

2. Feedwater system pipe break (minor) (Section 15.2.8)

3. Complete loss of forced reactor coolant flow (Section 15.3.2).

4. Rod cluster control assembly misoperation (single rod cluster control assembly withdrawal at full power) (Section 15.4.3).

5. Inadvertent loading and operation of a fuel assembly in an improper position (Section 15.4.7).

6. Loss of coolant accidents resulting from a spectrum of postulated piping breaks within the reactor coolant pressure boundary (small break) (Section 15.6.5).

7. Radioactive gas waste system leak or failure (Section 15.7.1).

8. Radioactive liquid waste system leak or failure (Section 15.7.2).

9. Postulated radioactive releases due to liquid tank failures (Section 15.7.3).

10. Spent fuel cask drop accidents (Section 15.7.5).

Condition IV - Limiting Faults: Condition IV occurrences are faults which are not expected to take place, but are postulated because their consequences would include the potential for the release of significant amounts of radioactive material. They are the most drastic which must be designed against and represent limiting design cases. Condition IV faults are not to cause a fission product release to the environment resulting in an undue risk to public health and safety (09 OCT 2019) 15.0 - 3

UFSAR Chapter 15 Catawba Nuclear Station in excess of guideline values of 10CFR 100 or 10CFR50.67 for those design basis accidents evaluated pursuant to 10CFR50.67 and Regulatory Guide 1.183. A single Condition IV fault is not to cause a consequential loss of required functions of systems needed to cope with the fault including those of the Emergency Core Cooling System and the Containment. For the purposes of this report, the following faults have been classified in this category:

1. Steam system piping failure (major) (Section 15.1.5).

2. Feedwater system pipe break (major) (Section 15.2.8).

3. Reactor coolant pump shaft seizure (locked rotor) (Section 15.3.3).

4. Reactor coolant pump shaft break (Section 15.3.4).

5. Spectrum of rod cluster control assembly ejection accidents (Section 15.4.8).

6. Steam generator tube failure (Section 15.6.3).

7. Loss of coolant accidents resulting from the spectrum of postulated piping breaks within the reactor coolant pressure boundary (large break) (Section 15.6.5).

8. Design basis fuel handling accidents (Section 15.7.4).

Optimization of Control Systems A control system setpoint study (Reference 17) is performed in order to simulate performance of the reactor control and protection systems. In this study, emphasis is placed on the development of a control system which will automatically maintain prescribed conditions in the plant even under a conservative set of reactivity parameters with respect to both system stability and transient performance.

For each mode of plant operation, a group of optimum controller setpoints is determined. In areas where the resultant setpoints are different, compromises based on the optimum overall performance are made and verified. A consistent set of control system parameters is derived satisfying plant operational requirements throughout the core life and for various levels of power operation.

The study comprises an analysis of the following control systems: rod control, steam dump, steam generator level, feedwater pump speed, pressurizer pressure, pressurizer level, control rod insertion limits, rod stops and turbine runbacks.

Initial Conditions and Power Distributions Assumed in the Accident Analyses Initial Conditions: For most accidents which are DNB limited, nominal values of initial conditions are assumed. The allowances on power, temperature, and pressure are determined on a statistical basis and are included in the limit DNBR, as described in Reference 7. These procedures are discussed more fully in Section 4.4.

For accidents which are not DNB limited, or for which the Statistical Core Design Methodology is not employed, the initial conditions are obtained by adding the maximum steady state errors to rated values. The following conservative steady state errors were typically assumed in the analysis:

1. Core power +/-2 percent allowance for calorimetric error (see note)

2. Average Reactor Coolant System +/-4°F allowance for controller deadband and temperature measurement error 15.0 - 4 (09 OCT 2019)

Catawba Nuclear Station UFSAR Chapter 15

3. Pressurizer pressure +60, -42 pounds per square inch (psi) allowance for steady state fluctuations, measurement error, and pressure increases during boron mixing

4. Reactor Coolant Loop Flow -2.2% allowance for measurement error The control band allowances for pressurizer pressure include the effect of the observed thermal non-repeatability of ITT-Barton class 1E transmitters when used in this application at Catawba.

Class 1E transmitters supplied by different manufacturers, which do not experience thermal non-repeatability, can also be used if it is demonstrated that the control band allowances are not adversely impacted.

Table 15-3 summarizes the computer codes used in the accident analyses and shows which accidents employed a statistical DNB analysis.

Table 15-4 summarizes input parameters and initial conditions used in the accident analyses.

Measurement Uncertainty Recapture (MUR) Power Uprate Catawba Nuclear Station Unit 1 received NRC approval to uprate the licensed core power from 3411 MWt to 3469 MWt for a total uprate of 1.7% ([ML16081A333]). All of the transients and accidents described in UFSAR Chapter 15 are valid for the CNS Unit 1 MUR power uprate.

Many of the analyses were performed for 3479 MWt, which corresponds to a rated thermal power of 3411 MWt plus a 2% allowance for heat balance error. After the MUR power uprate, rated thermal power of 3469 MWt plus a 0.3% allowance for heat balance error, is still 3479 MWt. Consequently, the previous analyses remain applicable. Many references to power level in the text have been converted to MWt rather than percent power to avoid confusion about original rated power and post MUR rated power. Where percent power remains, it refers to percent of 3411 MWt, unless otherwise explained in the text.

Power Distribution: The transient response of the reactor system is dependent on the initial power distribution. The nuclear design of the reactor core minimizes adverse power distributions through operating instructions and the placement of control rods. Power distribution may be characterized by the radial factor (FH) and the total peaking factor (FQ). The peaking factor limits are given in the Core Operating Limits Report.

For transients which may be DNB limited, the radial peaking factor is of importance. The radial peaking factor increases with decreasing power level due to rod insertion. This increase in FH is included in the core limits illustrated in Figure 15-1. All transients that may be DNB limited are assumed to begin with a FH consistent with the limit defined in the Core Operating Limits Report, with the exception of those transients that involve changes in the core power distribution. For these events, cycle-specific core power distributions at the statepoint conditions are analyzed to ensure that the DNB design basis is met for each reload core. The axial power shapes used in the DNB calculation are discussed in Section 4.4. The radial and axial power distributions described above are input to a detailed thermal-hydraulics code as described in Section 4.4.

For transients which may be overpower limited, the total peaking factor (FQ) is of importance.

All transients that may be overpower limited are assumed to begin with plant conditions, including power distributions, which are consistent with reactor operation as defined in the Technical Specifications.

Some overpower transients are slow with respect to the fuel rod thermal time constant, for example, the Chemical and Volume Control System malfunction that results in a decrease in the (09 OCT 2019) 15.0 - 5

UFSAR Chapter 15 Catawba Nuclear Station boron concentration in the reactor coolant incident, which lasts many minutes, and the excessive increase in secondary steam flow incident, which may reach equilibrium without causing a reactor trip. For these transients the fuel rod thermal evaluations are performed as discussed in Section 4.4. Other overpower transients are fast with respect to the fuel rod thermal time constant, for example, the rod cluster control assembly ejection incident, which results in a large power rise over a few seconds. For these transients a detailed fuel heat transfer calculation must be performed.

Reactivity Coefficients Assumed in the Accident Analyses The transient response of the reactor system is dependent on reactivity feedback effects, in particular the moderator temperature coefficient and the fuel temperature coefficient. These reactivity coefficients and their values are discussed in detail in Chapter 4.

In the analysis of certain events, conservatism requires the use of large reactivity coefficient values, whereas in the analysis of other events, conservatism requires the use of small reactivity coefficient values. Some events, such as the loss of reactor coolant from steam generator tube ruptures, do not depend on reactivity feedback effects. The values assumed for these coefficients are given in Table 15-4. The justification for the use of conservatively large versus small reactivity coefficient values is treated on an event-by-event basis. In some cases conservative combinations of parameters are used to bound the effects of core life, although these combinations may not represent possible realistic situations.

Rod Cluster Control Assembly Insertion Characteristics The negative reactivity insertion following a reactor trip is a function of the position versus time characteristic of the rod cluster control assemblies and of the variation in rod worth as a function of rod position. With respect to accident analyses, the critical parameter is the time of insertion up to the dashpot entry, approximately 85 percent of the rod cluster travel. The rod cluster control assembly position versus time characteristic assumed in the accident analyses is shown in Figure 15-254. The rod cluster control assembly insertion time is referenced to dashpot entry.

To ensure a conservatively modeled position versus time, the normalized RCCA position versus normalized drop time curve is shifted to the right by 0.1 normalized time units. Thus, rod insertion begins at 0.1 normalized time units, dashpot entry begins at 1.1 normalized time units, and rod insertion is complete at 1.5 normalized time units. The conservatism of this shifting is demonstrated by the following example. If the assumed drop time to dashpot entry is 2.2 seconds, the modeled time to dashpot entry is 2.2 sec x 1.1 = 2.42 seconds, and the modeled time to complete insertion is 2.2 sec x 1.5 = 3.3 seconds. Table 15-6 gives the drop times assumed for each FSAR analysis.

Figure 15-255 shows the fraction of total negative reactivity insertion versus normalized rod position for a core where the axial distribution is skewed to the lower region of the core. An axial distribution which is skewed to the lower region of the core can arise from an unbalanced xenon distribution. This curve is used to compute the negative reactivity insertion versus time following a reactor trip, which is input to all point kinetics core models used in transient analyses. The bottom skewed power distribution itself is not input into the point kinetics core model.

There is inherent conservatism in the use of Figure 15-255 in that it is based on a skewed flux distribution which would exist relatively infrequently. For cases other than those associated with unbalanced xenon distributions, significant negative reactivity would have been inserted due to the more favorable axial distribution existing prior to trip.

The normalized rod cluster control assembly negative reactivity insertion versus shifted normalized rod drop time is shown in Figure 15-256. The curve shown in this figure was 15.0 - 6 (09 OCT 2019)

Catawba Nuclear Station UFSAR Chapter 15 obtained from Figure 15-254 and Figure 15-255. A maximum negative reactivity insertion of 4 percent k/k following a trip from full power is assumed in the transient analyses except where specifically noted otherwise. This assumption is conservative with respect to the calculated trip reactivity worth available as shown in Table 4-6. For Figure 15-256, the rod cluster control assembly drop time is normalized to the value used in the analyses, and shifted right 0.1 units.

The normalized rod cluster control assembly negative reactivity insertion versus shifted normalized rod drop time curve (Figure 15-256) for an axial power distribution skewed to the bottom is used in those transient analyses for which a point kinetics core model is used.

Transients analyzed with RETRAN-02 employ the RCCA insertion curves illustrated in Figure 15-254, Figure 15-255, and Figure 15-256.

Where special analyses require use of three dimensional core models, the negative reactivity insertion of the control rods is adjusted to match Figure 15-255.

Trip Points and Time Delays to Trip Assumed in Accident Analyses A reactor trip signal acts to open two trip breakers connected in series feeding power to the control rod drive mechanisms. The loss of power to the mechanism coils causes the mechanisms to release the rod cluster control assemblies which then fall by gravity into the core. There are various instrumentation delays associated with each trip function, including delays in signal actuation, in opening the trip breakers, and in the release of the rods by the mechanisms. The total delay to trip is defined as the time delay from the time that trip conditions are reached to the time the rods are free and begin to fall. Limiting trip setpoints assumed in accident analyses and the time delay assumed for each trip function are given in Table 15-7. Reference is made in that table to the overtemperature and overpower T trips shown in Figure 15-1.

This figure presents the allowable Reactor Coolant loop average temperature and T for the design flow and power distribution as a function of primary coolant pressure. The boundaries of operation defined by the overpower T trip and the overtemperature T trip are represented as protection lines on this diagram. The protection lines are drawn to include all adverse instrumentation and setpoint errors so that under nominal conditions trip would occur well within the area bounded by these lines. The utility of this diagram is in the fact that the limit imposed by any given DNBR can be represented as a line. The DNB lines represent the locus of conditions for which the DNBR equals the limit value. All points below and to the left of a DNB line for a given pressure have a DNBR greater than the limit value. The diagram shows that DNB is prevented for all cases if the area enclosed with the maximum protection lines is not traversed by the applicable DNBR line at any point.

The area of permissible operation (power, pressure and temperature) is bounded by the combination of reactor trips: high neutron flux (fixed setpoint), high pressure (fixed setpoint),

low pressure (fixed setpoint), overpower and overtemperature T (variable setpoints).

The limit value, which was used as the DNBR limit for all accidents analyzed with statistical design procedures (see Table 15-3), is conservative compared to the actual design DNBR value required to meet the DNB design basis.

The difference between the limiting trip point assumed for the analysis and the nominal trip point represents an allowance for instrumentation channel error and setpoint error. Nominal trip setpoints are specified in the plant Technical Specifications or Core Operating Limits Report.

During plant startup tests, it was demonstrated that actual instrument time delays are equal to or less than the assumed values. Additionally, protection system channels are calibrated and (09 OCT 2019) 15.0 - 7

UFSAR Chapter 15 Catawba Nuclear Station instrument response times are determined periodically in accordance with the Technical Specifications.

Environmental Consequences A summary of the offsite doses is presented in Table 15-14. A description of each accident analysis is given in the appropriate section.

Operability of Non-Safety Grade Equipment In general, the transient analyses presented in this chapter only assume non-safety grade systems and equipment are operable in the following situations:

1. When operation of the system will cause the transient to be more severe. If there is doubt about the system's effect, the transient is analyzed and presented with and without the system available.

2. When a loss of a non-safety grade system initiates a transient by itself, it is not superimposed upon other transients unless there is a credible reason that one would cause the other.

The following non-safety grade systems and equipment are assumed operable in some analyses presented in this chapter.

1. Automatic rod control.

2. Pressurizer pressure control (power operated relief valves, heaters and spray).

3. Main Feedwater System.

DNB limited transients are analyzed assuming that pressurizer pressure control is available to maintain pressure low since this is conservative. DNB transients which might cause RCS pressurization are also evaluated with pressurizer pressure control unavailable.

Since a late reactor trip generally reduces the margin to the acceptance criteria in any transient, the effect of operable pressurizer pressure control in delaying reactor trip is considered for those transients where it would occur.

Loss of offsite power is a Condition II occurrence by itself and is analyzed in Section 15.2.6.

There is no credible reason for any of the Condition II events listed above to cause a loss of offsite power. Therefore, a loss of offsite power is not considered coincidentally with those occurrences listed above which are Condition II.

The exceptions to the analysis philosophy on operability of non-safety grade systems and equipment are:

1. Rod Control System: Credit is taken for the withdrawal of control rods at a maximum speed of 45 in/min with normal overlap. Control rod bank and control rod assembly withdrawal events assume control rods are at the control rod insertion limits. The rod insertion limit alarm will alert the operator if the required core reactivity shutdown margin is not available due to excessive control rod insertion, e.g. in a boron dilution event during Mode 1 operation.

2. Main feedwater control and bypass control valves: Closure is assumed to provide redundancy in case either the upper or lower nozzle isolation valve fails.

3. Source range high-flux-at-shutdown alarm: This alarm alerts the operators to the possibility of a boron dilution event during Modes 3-5 operation. Credit is taken for this alarm to alert the operators so they can take the necessary steps to stop the dilution.

15.0 - 8 (09 OCT 2019)

Catawba Nuclear Station UFSAR Chapter 15

4. Turbine stop valve and actuation circuitry: Various transients credit this valve as closing to prevent overcooling after a reactor trip.

5. Electrical bus undervoltage/underfrequency: Safety system performance of pumps assumes minimum or maximum performance of pumps based on voltage or frequency. Voltage or frequency regulation is therefore assumed.

6. Manual reactor coolant pump trip: During a small-break LOCA, credit is taken for the controls and circuitry required to manually trip the reactor coolant pumps on an indicated loss of subcooling in the reactor coolant system.

7. Main feedwater overspeed trip: The increase in main feedwater flow transient credits the main feedwater overspeed trip by limiting the step increase in feedwater flow to a flow which is just below the trip setpoint.

Use of NGF and MOX Lead Test Assemblies Technical Specification 4.2.1 allows for a limited number of lead test assemblies (LTAs) to be included in the reactor core. As required in this technical specifications, LTAs are placed in non-limiting core locations. Currently neither Catawba core contains any LTAs. Catawba Unit 1 has operated with four mixed oxide (MOX) LTAs in its core, and these assemblies are currently in the spent fuel pool. These MOX LTAs may be reinserted for a third cycle of operation in the future. Due to differences in assembly design relative to the Westinghouse RFA fuel design, both types of LTAs have some differences in thermal-hydraulic parameters. These design differences are described in UFSAR Section 4.2.3.7.

The NGF and MOX LTAs were evaluated with respect to the transients and accidents contained in Chapter 15 of the UFSAR and appropriate analyses were performed. Chapter 15 of the UFSAR contains transients and accidents that are sensitive to global and local effects. Global analyses whose results are controlled by core average parameters are not affected by the presence of LTAs. The core analysis for any of the non-LOCA design basis transients that are sensitive to local effects for the Catawba Unit 1 mixed core were explicitly analyzed for the differences in hydraulic design and performance of the different fuel assembly types. An evaluation was also performed for the LOCA analysis.

The behavior of the minimum departure from nucleate boiling ratio (DNBR) was evaluated for the mixed core of LTAs and Westinghouse RFA fuel. The co-resident fuel types were analyzed, using approved Duke methods, with their respective critical heat flux correlations and limits, except the NGF LTAs. The NGF LTAs were analyzed with the WRB-2M correlation, which does not credit the improved DNB performance of the additional NGF grids. This generated DNBR results that were more conservative than an NGF fuel design specific DNB correlation would have yielded. The DNBR analyses for the other fuel types yielded specific values that included the effects of flow variations as well as fuel assembly feature performance for each fuel type.

The values derived from these calculations were compared to their respective DNB correlation limits for the LTAs and the RFA fuel to ensure DNBR criteria were met.

An analysis was performed for the control rod ejection accident with MOX LTAs. The hot zero and full power rod ejection cases were analyzed with a conservative provisional acceptance criterion of 100 calories/gram used for the MOX LTAs to ensure coolable geometry is maintained. Calculations were performed with SIMULATE-3K and confirmed with VIPRE-01.

Results for the MOX LTAs were less than the provisional 100 calorie/gram acceptance criterion for both zero and full power cases.

Centerline fuel melt (CFM) checks were performed for the NGF and MOX LTAs and the RFA fuel to ensure that the CFM criterion was met for all fuel types.

(09 OCT 2019) 15.0 - 9

UFSAR Chapter 15 Catawba Nuclear Station The LOCA analysis was also evaluated for both the NGF and MOX LTAs. For the NGF LTAs Westinghouse determined a peaking penalty to ensure the NGF fuel is non-limiting. The peaking penalty was determined from an analysis of a mixed core of RFA and NGF fuel. The NGF fuel was determined to be non-limiting. For the MOX LTAs Framatome performed a separate LOCA calculation to establish LOCA limits for the MOX LTAs. Using these LOCA limits the MOX LTA results are less limiting than the RFA fuel. Thus, the RFA fuel assemblies were demonstrated to remain the limiting fuel type with respect to the LOCA acceptance criteria.

The eight NGF LTAs and four Framatome Mark BW/MOX1 LTAs contained in the spent fuel pool were evaluated with respect to the transients and accidents contained in Chapter 15 of the UFSAR and found to meet all acceptance criteria.

Fission Product Inventoriees Analysis of radiological consequences of design basis accidents assume radioactive source terms. These may be limiting normal levels of radioactivity in the reactor coolant, release of gap activity due to postulated fuel gap failure, one releases of fission products from the fuel due to postulated core damage. The calculation of source terms for design basis accidents are, like calculations of post accident radiation doses, performed generally pursuant to the germane regulatory positions pertaining to the Alternative Source Term methodology (Reference 26).

Fission Product Radioactivity Levels in the Reactor Core: The analysis of radiological consequences of the maximum credible design basis accident (a loss of coolant accident) includes the deterministic assumption of damage to the affected reactor core. The fission products are assumed to be released from the fuel to the containment in two stages: a gap release phases is taken to begin at 30 seconds (after the initiating event) and end at 30 minutes. During this time, the fission products in the gap are assumed to be released to the containment as follows:

Chemical Group  % Core Inventory Noble gases (Kr, Xe) 5.00 Halogens (Br, I) 5.00 Alkali Metals (Rb, Cs) 5.00 This phase is followed by the early in-vessel release phase, taken to begin at 30 minutes and last until 1.8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br />. During this phase, the following fission products are taken to be released from the reactor core to the containment:

Chemical Group  % Core Inventory Noble gases (Kr, Xe) 95.00 Halogens (Br, I) 35.00 Alkali Metals (Rb, Cs) 25.00 Tellurium Group (Se, Sb. Te 5.00 Alkaline earth metals (Ba, Sr) 2.00 Noble metals (Mo, Tc, Ru, Rh, Pd) 0.25 Cerium Group (Ce, Np, Pu) 0.05 Lanthanides (Y, Zr, Nb, La, Nd, Pm, Sm, Eu, 0.02 Pr, Am, Cm) 15.0 - 10 (09 OCT 2019)

Catawba Nuclear Station UFSAR Chapter 15 The core inventory of fission products and actinides was calculated with the computer SCALE computer code system (Reference 24) and specifically, the SAS2H module.

The SAS2H module uses the BONAMI and NITAWL codes to perform resonance self-shielding corrections. (The NITAWL code uses the Nordheim Integral Treatment to process cross section data having resonance parameters.) SAS2H uses the XSDRNPM code to perform the transport calculations to develop cell-flux-weighted cross sections for use in the subsequent depletion calculations with ORIGEN-S. (The XSDRNPM code uses the method of discrete ordinates to perform neutron transport calculations through the pin-cell model.) The ORIGEN-S code is used by SAS2H to perform depletion calculations throughout the burnup period modeled by the input. The multigroup calculations performed with BONAMI, NITAWL, and XSDRNPM yield cross sections that are collapsed to a one-group library for use in ORIGIN-S (a point depletion code). In the calculation enveloping values are taken for burnup, enrichment, irradiation, and power level (102% rated power or 3479 MWth). The core isotopic inventories of fission products are presented in Table 15-12.

Inventory in the Fuel Pin Gap: For some design basis accidents, fuel damage as predicted in bounding analyses is limited to fuel clad failure. These include the design basis locked rotor accident, rod ejection accident, fuel handling accidents, and weir gate drop. For these design basis accidents, the radioactive source term is limited to the activity initially in the gap between the fuel pellets and fuel clad. The percentage of the core fission product inventory in the fuel pin gaps (gap fractions) for the non LOCA design basis accidents are as follows (Reference 26):

Gap Fraction for non LOCA DBAs (%)

Chemical Group Rod Ejection Other DBAs (Note 1)

I-131 10 8 Kr-85 10 10 Other noble gases (Kr, Xe) 10 5 Other halogens (Br, I) 10 5 Alkali metals (Rb, Cs) 12 12 Note 1: For the analyses of non-DNB accidents and for those fuel pins which are operated so as to exceed the rod power/ burnup criteria of Footnote 11 in RG 1.183, the gap fractions from RG 1.183 are increased by a factor of 3 for Kr-85, Xe-133, CS-134 and Cs-137, and increased by a factor of 2 for I-131, and other noble gases, halogens and alkali metals (References 27 & 28). A maximum of 25 fuel rods per fuel assembly shall be allowed to exceed rod power/ burnup criteria of Footnote 11 in RG (Regulatory Guide) 1.183 in accordance with the license amendment request submitted by letter dated July 15, 2015 [Reference 27]. The fuel cycle design ensures that none of these fuel pins experience DNB following any design basis accident.

The values for core inventory in the gap conform to the germane regulatory position except in the cases of bromine and alkali metals following a rod ejection accident. No values for these fission products for the rod ejection accident are given in the regulatory position. The gap fractions for bromine are assumed to be the same as for iodine. The gap fractions for alkali metals are taken to be the same for the rod ejection and locked rotor accidents.

The isotopic inventories for a fuel assembly used in the AST analysis of the design basis locked rotor and rod ejection accidents was calculated with the SCALE computer code suite. These calculations account for radial peaking, setting the radial peaking to limiting values. It also sets the burnup, enrichment, irradiation, and power level to enveloping values. The fuel assembly fission product inventories used in the analyses of the design basis locked rotor and rod ejection accidents are presented in Table 15-73. The fuel assembly fission product inventories used in (09 OCT 2019) 15.0 - 11

UFSAR Chapter 15 Catawba Nuclear Station the analyses of the design basis fuel handling accident and weir gate drop are presented in Table 15-45.

Residual Decay Heat Total Residual Heat: Residual heat in a subcritical core is calculated for the loss of coolant accident per the requirements of Appendix K of 10CFR 50. These requirements include assuming infinite irradiation time before the core goes subcritical to determine fission product decay energy. For transients analyzed with the RETRAN-02 code, fission product decay energy is also based on the core average exposure at the end of an equilibrium cycle. The model used in the RETRAN-02 analyses is based on Reference 10, with a two standard deviation uncertainty adjustment applied to the results in lieu of the 1.2 factor of 10CFR 50 Appendix K.

Distribution of Decay Heat Following Loss of Coolant Accident: During a loss of coolant accident, the core is rapidly shut down by void formation, rod cluster control assembly insertion, or both, and a large fraction of the heat generation to be considered comes from fission product decay gamma rays. This heat is not distributed in the same manner as steady state fission power. Local peaking effects which are important for the neutron dependent part of the heat generation do not apply to the gamma ray contribution. The steady state factor of 97.4 percent which represents the fraction of heat generated within the clad and pellet drops to 95 percent for the hot rod in a small break loss of coolant accident. The hot rod energy deposition for the large break loss of coolant accident (WCOBRA/TRAC analysis) is calculated based on the time-dependent fission and decay heat generation, the coolant density, and the radial power distribution. The hot rod energy deposition calculated for the large break loss of coolant accident is slightly less than that for the small break loss of coolant accident.

Computer Codes Utilized Summaries of some of the principal computer codes used in transient analyses are given below.

Other codes, in particular very specialized codes in which the modeling has been developed to simulate one particular accident, such as those used in the analysis of the Reactor Coolant System pipe rupture (Section 15.6.5), are summarized in their respective accident analyses sections. The codes used in the analyses of each transient have been listed in Table 15-3.

RETRAN-02 RETRAN-02 is a code capable of simulating most thermal-hydraulic transients of interest in both PWRs and BWRs. It has the flexibility to model any general fluid system by partitioning the system into a one-dimensional network of fluid volumes and connecting flowpaths or junctions.

The mass, momentum, and energy conservation equations are then solved by employing a semi-implicit solution technique. The time step selection logic is based on algorithms that detect rapid changes in physical processes and limit time steps to ensure accuracy and stability.

Although the equations describe homogeneous equilibrium fluid volumes, phase separation can be modeled by separated bubble rise volumes and by a dynamic slip model. The pressurizer and other regions can be modeled as non-equilibrium volumes when such phenomena are present. Reactor power generation can be represented by either explicit input as a function of time, a point kinetics model, or a one-dimensional kinetics model. Heat transfer across steam generator tubes and to or from structural components can be modeled. Special component models for centrifugal pumps, valves, trip logic, control systems, and other features useful for fluid system modeling are available. RETRAN-02 is further discussed in Reference 11.

Deleted per 1997 Revision VIPRE-01 15.0 - 12 (09 OCT 2019)

Catawba Nuclear Station UFSAR Chapter 15 VIPRE-01 is a subchannel thermal-hydraulic computer code. With a subchannel analysis approach, the nuclear fuel element is divided into a number of quasi one-dimensional channels that communicate laterally by diversion crossflow and turbulent mixing. However, VIPRE-01 is also capable of simulating single subchannel geometry. Given the geometry of the reactor core and coolant channel, and the boundary conditions for forcing functions, it calculates core flow distributions, coolant thermodynamic conditions, fuel rod temperatures, and the departure from nucleate boiling ratio (DNBR) for steady-state and transient conditions. VIPRE-01 accepts all necessary boundary conditions originating from a system transient simulation code or transient core neutronics simulation code. Included is the capability to impose different boundary conditions on different segments of the core model. For example, different transient inlet temperatures, flow rates, heat flux transients, and even different transient assembly and rod radial powers or axial flux shapes, can be modeled. VIPRE-01 is further discussed in Reference 12.

Deleted per 1997 Revision Deleted per 1997 Revision Deleted Per 2009 Update.

SIMULATE-3K SIMULATE-3K is a computer code, compatible with SIMULATE-3 and uses a three dimensional neutron kinetics model based on the QPANDA two group nodal model to calculate three dimensional power distributions, core reactivity, or a power level for both static and transient applications. Transient core power distributions and hot assembly peak pin power distributions predictions are enhanced, relative to SIMULATE-3, at bounding physics parameter conditions for input into fuel enthalpy, peak RCS pressure and DNB calculations. SIMULATE-3K is further discussed in Reference 25.

CASMO-4 CASMO-4 is a multigroup two-dimensional transport theory code for fuel assembly burnup calculations. It uses a library of 70 energy group cross sections based primarily on the ENDF/B-IV data base. This code produces two-group cross sections assembly discontinuity factors, fission product data, detector reaction rates, and pin power data. The data from CASMO-4 is reformatted, using a data processing linkage code, into two-or three-dimensional tables for input to the three-dimensional code SIMULATE-3 MOX. CASMO-4 is further discussed in Reference 16.

SIMULATE-3 MOX SIMULATE-3 MOX is a two-group three dimensional coarse mesh diffusion theory code based on the QPANDA neutronics model. SIMULATE-3 MOX includes enhancements to model the steep thermal flux gradient between MOX and LEU fuel and is applicable for analysis of all LEU or cores containing MOX LTA fuel. SIMULATE-3 MOX accounts for the effects on fuel and moderator feedback using its nodal thermal-hydraulics model. The model explicitly models the baffle and reflector region. The program uses data from CASMO-4 for each pin in the fuel assembly and uses inter-assembly and intra-assembly data obtained from the coarse mesh solution to reconstruct the power distribution of each pin. SIMULATE-3 MOX is further discussed in Reference 16.

Nuclear Design Methodology using CASMO-4/SIMULATE-3 MOX (Reference 16) is approved for modeling an LEU or mixed LEU plus four MOX LTA core.

References (09 OCT 2019) 15.0 - 13

UFSAR Chapter 15 Catawba Nuclear Station

1. Deleted Per 1997 Update

2. Deleted Per 1994 Update

3. Deleted Per 1994 Update

4. Deleted Per 1994 Update

5. Deleted Per 1994 Update

6. Deleted Per 1994 Update

7. "Thermal Hydraulic Statistical Core Design Methodology", DPC-NE-2005P-A, Revision 4a, December 2008.

8. Deleted Per 1997 Update

9. Deleted Per 1997 Update

10. American Nuclear Society, "Decay Heat Power in Light Water Reactors", ANSI/ANS 5.1, 1979.

11. EPRI, "RETRAN-02: A Program for Transient Thermal-Hydraulic Analysis of Complex Fluid Flow Systems", EPRI NP-1850-CCM, Revision 6, December 1995.

12. EPRI, "VIPRE-01: A Thermal-Hydraulic Code for Reactor Cores", EPRI NP-2511-CCM-A, Revision 3, August 1989.

13. Deleted Per 1994 Update

14. Deleted Per 1994 Update

15. Deleted Per 1994 Update

16. Nuclear Design Methodology using CASMO-4/SIMULATE-3 MOX, DPC-NE-1005-P-A, Revision 1, November 2008.

17. Calvo, R., "Setpoint Study: Duke Power Company Catawba Nuclear Plant Units 1 and 2",

WCAP-10041-P, March, 1984.

18. Deleted Per 2009 Update.

19. DiNunno, J. J., et al, "Calculation of Distance Factors for Power and Test Reactor Sites",

TID-14844, March, 1962.

20. Bell, M. J., "ORIGEN - The ORNL Isotope Generation and Depletion Code", ORNL-4628, May, 1973.

21. Radiation Shielding Information Center, Oak Ridge National Laboratory, "ORIGEN Yields and Cross Sections - Nuclear Transmutation and Decay Data from ENDF/B-IV", RSIC-DLC-38, September, 1975.

22. Deleted Per 2006 Update

23. Deleted Per 2006 Update

24. Oak Ridge National Laboratory, SCALE: A Modular Code System for Performing Standardized Analyses for Licensing Evaluation, NUREG/CR-0200, USNRC, March 1997.

25. Duke Power Company Westinghouse Fuel Transition Report, DPC-NE-2009P-A, Revision 2, December 18, 2002.

26. USNRC, Alternative Radiological Source Terms for Evaluating Design Basis Accidents at Nuclear Power Reactors, Regulatory Guide 1.183.

15.0 - 14 (09 OCT 2019)

Catawba Nuclear Station UFSAR Chapter 15

27. Regis T. Repko (Duke Energy Corporation) to U.S. Regulatory Commission, "Catawba Nuclear Station, Unit Nos. 1 and 2 Docket Nos. 50-413 and 50-414 Renewed License Nos.

NPF-35 and NPF-52 McGuire Nuclear Station, Unit Nos. 1 and 2 Docket Nos. 50-369 and 50-370 Renewed License Nos. NPF-9 and NPF-17 Oconee Nuclear Station, Unit Nos. 1, 2 and 3 Docket Nos. 50-269, 50-270, and 50-287 Renewed License Nos., DPR-38, DPR-47, and DPR-55 License Amendment Request Proposing a New Set of Fission Gas Gap Release Fractions for High Burnup Fuel Rods That Exceed the Linear Heat Generation Rate Limit Detailed in Regulatory 1.183, Table 3, Footnote 11," July 15, 2015.

28. James R. Hall (USNRC) to Regis T. Repko, "Catawba Nuclear Station, Units 1 and 2; McGuire Nuclear Station, Units 1, 2; and Oconee Nuclear Station, Units 1, 2, and 3 -

Issuance of Amendments Regarding Request to Use an Alternate Fission Gas Gap Release Fraction (CAC Nos., MF6480, MF6481, MF6482, MF6483, MF6484, MF6485, and MF6486)," July 19, 2016.

THIS IS THE LAST PAGE OF THE TEXT SECTION 15.0.

(09 OCT 2019) 15.0 - 15

UFSAR Chapter 15 Catawba Nuclear Station This Page Left Blank Intentionally 15.0 - 16 (09 OCT 2019)

Catawba Nuclear Station UFSAR Chapter 15 15.1 Increase in Heat Removal by the Secondary System A number of events have been postulated which could result in an increase in heat removal from the Reactor Coolant System by the Secondary System. Detailed analyses are presented for several such events which have been identified as limiting cases.

Discussions of the following events are presented in this section:

1. Feedwater System malfunction causing a reduction in feedwater temperature.

2. Feedwater System malfunction causing an increase in feedwater flow.

3. Excessive increase in secondary steam flow.

4. Inadvertent opening of a steam generator relief or safety valve.

5. Steam System piping failure.

The above are considered to be ANS Condition II events, with the exception of a major steam system pipe break, which is considered to be an ANS Condition IV event. Section 15.0 contains a discussion of ANS classifications and applicable acceptance criteria.

15.1.1 Feedwater System Malfunctions that Result in a Reduction in Feedwater Temperature 15.1.1.1 Identification of Causes and Accident Description Reductions in feedwater temperature will cause an increase in core power by decreasing reactor coolant temperature. Such transients are attenuated by the thermal capacity of the secondary plant and of the Reactor Coolant System (RCS). The overpower - overtemperature protection (neutron overpower, overtemperature and overpower T trips) prevents any power increase which could lead to a DNBR less than the limit value.

A reduction in feedwater temperature may be caused by the accidental opening of a feedwater bypass valve which diverts flow around a portion of the feedwater heaters. In the event of an accidental opening of the bypass valve, there could be a sudden reduction in feedwater inlet temperature to the steam generators. At power, this increased subcooling will create a greater load demand on the RCS.

With the plant at no-load conditions, the addition of cold feedwater may cause a decrease in RCS temperature and thus a reactivity insertion due to the effects of the negative moderator coefficient of reactivity. However, the rate of energy change is reduced as load and feedwater flow decrease, so the no-load transient is less severe than the full power case.

The net effect on the RCS due to a reduction in feedwater temperature would be similar to the effect of increasing secondary steam flow, i.e. the reactor will reach a new equilibrium condition at a power level corresponding to the new steam generator T.

A decrease in normal feedwater temperature is classified as an ANS Condition II event, a fault of moderate frequency. See Section 15.0 for a discussion of Condition II events.

15.1.1.2 Analysis of Effects and Consequences Method of Analysis This transient is analyzed by computing conditions at the feedwater pump inlet following opening of the heater bypass valve. These feedwater conditions are then used to recalculate a (09 OCT 2019) 15.1 - 1

UFSAR Chapter 15 Catawba Nuclear Station heat balance through the high pressure heaters. This heat balance gives the new feedwater conditions at the steam generator inlet.

The following assumptions are made:

1. Plant initial power level corresponding to guaranteed NSSS thermal power output.

2. High pressure heater bypass valve opens, resulting in condensate flow splitting between the bypass line and the high pressure heaters. The flow through each path is inversely proportional to the pressure drops.

Plant characteristics and initial conditions are further discussed in Section 15.0.

Results Opening of a high pressure heater bypass valve causes a reduction in feedwater temperature which increases the thermal load on the primary system. The calculated reduction in feedwater temperature is less than 60°F, resulting in an increase in heat load on the primary system. The increased thermal load, due to opening of the high pressure heater bypass valve, would thus result in a transient very similar (but of a reduced magnitude) to that presented in Section 15.1.3 for an Excessive Load Increase Incident, which evaluates the consequences of a 10 percent step load increase. Therefore, the transient results of this analysis are not presented.

15.1.1.3 Conclusions The decrease in feedwater temperature transient is less severe than the increase in feedwater flow event (Section 15.1.2) or the increase in secondary steam flow event (Section 15.1.3).

Based on results presented in Sections 15.1.2 and 15.1.3, the applicable acceptance criteria for the decrease in feedwater temperature event have been met.

15.1.2 Feedwater System Malfunction Causing an Increase in Feedwater Flow 15.1.2.1 Identification of Causes and Accident Description Addition of excessive feedwater will cause an increase in core power by decreasing reactor coolant temperature. Such transients are attenuated by the thermal capacity of the secondary plant and of the Reactor Coolant System (RCS). The overpower - overtemperature protection (neutron overpower, overtemperature and overpower T trips) prevents any power increase which could lead to a DNBR less than the limit value.

An example of excessive feedwater flow would be a full opening of a feedwater control valve due to a feedwater control system malfunction or an operator error. At power this excess flow causes a greater load demand on the RCS due to increased subcooling in the steam generator.

With the plant at no-load conditions the addition of cold feedwater may cause a decrease in RCS temperature and thus a reactivity insertion due to the effects of the negative moderator coefficient of reactivity.

Continuous addition of excessive feedwater is prevented by the steam generator high-high level trip, which closes the feedwater valves.

An increase in normal feedwater flow is classified as an ANS Condition II event, a fault of moderate frequency. See Section 15.0 for a discussion of Condition II events.

15.1.2.2 Analysis of Effects and Consequences Method of Analysis 15.1 - 2 (09 OCT 2019)

Catawba Nuclear Station UFSAR Chapter 15 The excessive heat removal due to a feedwater system malfunction transient is analyzed by using the detailed digital computer code RETRAN-02 (Reference 7). This code simulates a multi-loop system, neutron kinetics, the pressurizer, pressurizer relief and safety valves, pressurizer spray, steam generator, and steam generator safety valves. The code computes pertinent plant variables including temperatures, pressures, and power level.

The analysis utilizes a McGuire RETRAN-02 model with a feedring steam generator (FSG).

However, input assumptions are conservatively chosen such that the analysis results bound Catawba Unit 1. The Catawba model D steam generator is also analyzed. Due to the similarity in the system response between the analyses, only the FSG analysis that is representative of Catawba Unit 1 is presented.

The system is analyzed to demonstrate plant behavior in the event that excessive feedwater addition occurs due to a control system malfunction or operator error which allows the feedwater control valves to open fully. Two cases are analyzed as follows:

1. Accidental opening of all feedwater control valves with the reactor in manual control at full power.

2. Accidental opening of all feedwater control valves with the reactor just critical at zero load conditions (10-3 x Nominal Power) assuming a conservatively large negative moderator temperature coefficient.

The DNBR calculation for this accident is performed using the Statistical Core Design Methodology as described in References 8 and 10. Utilizing the WRB-2M critical heat flux correlation (Reference 12), the VIPRE-01 code calculates the DNBR during the transient based on the RETRAN-02 boundary conditions. The reactivity insertion rate following a feedwater system malfunction is calculated with the following assumptions:

1. Initial reactor power, pressure, flow, and RCS temperatures are assumed to be at their nominal values. Uncertainties in initial conditions are included in the limit DNBR as described in Reference 13.

2. No steam generator tube plugging was assumed to maximize the primary to secondary heat transfer.

3. The steam generator high-high water level trip setpoint was assumed to be at the nominal setpoint plus an 8% narrow range uncertainty.

4. The steam generator low-low water level setpoint was assumed to be at the nominal setpoint minus a 6% narrow range uncertainty.

5. For the feedwater control valve accident at full power, the initial steam generator water level was assumed to be at the nominal level minus an 8% narrow range uncertainty. This maximizes the time to the high-high water level setpoint.

6. For the feedwater control valve accident at full power, all feedwater control valves are assumed to fully open resulting in a step increase to approximately 142 percent of nominal feedwater mass flow to four steam generators.

7. For the feedwater control valve accident at zero load condition, a malfunction occurs which results in an increase in flow to four steam generators from zero to 152 percent of the nominal full load mass flow rate.

8. For the zero load condition, feedwater temperature is at a conservatively low value of 70°F.

Plant characteristics and initial conditions are further discussed in Section 15.0 (see Table 15-4).

(09 OCT 2019) 15.1 - 3

UFSAR Chapter 15 Catawba Nuclear Station Normal reactor control systems and Engineered Safety Systems are not required to function.

The Reactor Protection System may function to trip the reactor due to overpower or low-low steam generator level conditions. No single active failure will prevent operation of the Reactor Protection System. A discussion of ATWS considerations is presented in Reference 3.

Results In the case of an accidental full opening of all feedwater control valves with the reactor at zero power and the above mentioned assumptions, the maximum reactivity insertion rate is less than the maximum reactivity insertion rate analyzed in Section 15.4.1, and therefore the results of the analysis are not presented here. It should be noted that if the incident occurs with the unit just critical at no load, the reactor may be tripped by the power range high neutron flux trip (low setting) set at approximately 25 percent of nominal full power.

The full power case (maximum reactivity feedback coefficients, manual rod control) gives the largest reactivity feedback and results in the greatest power increase. Assuming the reactor to be in the automatic rod control mode results in a less severe transient. The rod control system is, therefore, not required to function for an excessive feedwater flow event.

For feedwater flow rates below 126 percent of nominal feedwater flow, when the steam generator water level in the faulted loop reaches the high-high level setpoint, all feedwater control valves and isolation valves are automatically closed and the main feedwater pumps are tripped. This prevents a continuous addition of feedwater. In addition, a turbine trip is initiated.

Following turbine trip, the reactor will be tripped on low-low steam generator water level signals in the unaffected steam generators. If the reactor were in the automatic control mode, the control rods would be inserted at the maximum rate following turbine trip, and the ensuing transient would then be similar to a loss of load (turbine trip event) as analyzed in Section 15.2.3. Feedwater flow rates above 126 percent of nominal feedwater flow provide enough overcooling to trip the reactor on OPT prior to the high-high level trip setpoint being reached and subsequent boil down to low-low level reactor trip.

Transient results (see Figures 15-7, 15-8, and 15-13) show the increase in nuclear power and T associated with the increased thermal load on the reactor. The maximum feedwater flow rate of approximately 142 percent of nominal feedwater flow results in the highest peak thermal power and thus results in the lowest DNB ratio. The DNB ratio does not decrease below the limit value. Following the reactor trip, the plant approaches a stabilized condition. Standard plant shutdown procedures may then be followed to further cool down the plant.

Since the power level rises during the excessive feedwater flow incident, the fuel temperatures will also rise until after reactor trip occurs. The core heat flux lags behind the neutron flux response due to the fuel rod thermal time constant, and the peak value does not exceed 118.5% of its nominal value. The peak fuel temperature will thus remain well below the fuel melting temperature.

The transient results show that DNB does not occur at any time during the excessive feedwater flow incident. Thus, the ability of the primary coolant to remove heat from the fuel rod is not reduced. The fuel cladding temperature, therefore, does not rise significantly above its initial value during the transient.

The calculated sequence of events for this accident is shown in Table 15-15.

A unit-specific analysis of this event is performed for Catawba Unit 2 utilizing the WRB-2M critical heat flux correlation. The transient results show that DNB does not occur at anytime during the excessive feedwater flow incident.

15.1 - 4 (09 OCT 2019)

Catawba Nuclear Station UFSAR Chapter 15 15.1.2.3 Conclusions The results of the analysis show that the DNB ratios encountered for an excessive feedwater addition at power are above the limiting value. Hence, no fuel or clad damage is predicted.

Additionally, it has been shown that the reactivity insertion rate which occurs at no load conditions following excessive feedwater addition is less than the maximum value considered in the rod withdrawal from a subcritical condition analysis.

15.1.3 Excessive Increase in Secondary Steam Flow 15.1.3.1 Identification of Causes and Accident Description An excessive increase in secondary system steam flow (excessive load increase incident) is defined as a rapid increase in steam flow that causes a power mismatch between the reactor core power and the steam generator load demand. The Reactor Control System is designed to accommodate a 10 percent step load increase or a 5 percent per minute ramp load increase in the range of 15 to 100 percent of full power. Any loading rate in excess of these values may cause a reactor trip actuated by the Reactor Protection System. Steam flow increases greater than 10 percent are analyzed in Sections 15.1.4 and 15.1.5.

This accident could result from either an administrative violation such as excessive loading by the operator or an equipment malfunction in the steam dump control or turbine speed control.

During power operation, steam dump to the condenser is controlled by reactor coolant condition signals, i.e. high reactor coolant temperature indicates a need for steam dump. A single controller malfunction does not cause steam dump. An interlock is provided which blocks the opening of the valves unless a large turbine load decrease or a turbine trip has occurred.

Protection against an excessive load increase accident is provided by the following Reactor Protection System signals:

1. Overpower T

2. Overtemperature T

3. Power range high neutron flux An excessive load increase incident is considered to be an ANS Condition II event, a fault of moderate frequency. See Section 15.0 for a discussion of Condition II events.

15.1.3.2 Analysis of Effects and Consequences Method of Analysis This accident is analyzed using the RETRAN-02 Code (Reference 7). The code simulates the neutron kinetics, Reactor Coolant System, pressurizer, pressurizer relief and safety valves, pressurizer spray, steam generator, steam generator safety valves, and feedwater system. The code computes pertinent plant variables including temperatures, pressures, and power level.

Both the feedring steam generators (FSG) and the Catawba model D5 steam generators are analyzed. Due to the similarity in the system response between the analyses, only the FSG analysis that is representative of Catawba Unit 1 is presented.

Two cases are analyzed to demonstrate the plant behavior following a 10 percent step load increase from rated load. These cases are as follows:

1. Reactor control in manual with a most negative moderator temperature coefficient.

2. Reactor control in automatic with a most negative moderator temperature coefficient.

(09 OCT 2019) 15.1 - 5

UFSAR Chapter 15 Catawba Nuclear Station The most negative moderator temperature coefficient results in the largest amount of reactivity feedback due to changes in coolant temperature.

All cases are analyzed without credit being taken for pressurizer heaters, which conservatively minimizes RCS pressure.

This accident is analyzed with the Statistical Core Design Methodology as described in References 8 and 10. Initial reactor power, pressure, flow, and RCS temperatures are assumed to be at their nominal values. Uncertainties in initial conditions are included in the DNBR limit as described in Reference 10.

Plant characteristics and initial conditions are further discussed in Section 15.0 (see Table 15-4).

Normal reactor control systems and Engineered Safety Systems are not required to function.

The Reactor Protection System is assumed to be operable. However, a reactor trip does not occur in either case.

The case which assumes automatic rod control is analyzed to ensure that the worst case is presented. The automatic function is not required.

Results Figure 15-9 through Figure 15-12 illustrate the transient assuming the reactor is in the manual control mode. This case shows that core power increases, thereby reducing the rate of decrease in coolant average temperature and pressurizer pressure. For this case, the minimum DNBR remains above the limit value.

The excessive load increase incident is an overpower transient for which the fuel temperatures will rise. Reactor trip does not occur for the cases analyzed, and the plant reaches a new equilibrium condition at a higher power level corresponding to the increase in steam flow.

Since DNB does not occur at any time during the excessive load increase transients, the ability of the primary coolant to remove heat from the fuel rod is not reduced. Thus, the fuel cladding temperature does not rise significantly above its initial value during the transient.

The calculated sequence of events for the excessive load increase incident is shown on Table 15-15.

15.1.3.3 Environmental Consequences There will be no radiological consequences associated with this event since activity is contained within the fuel rods and reactor coolant system within design limits.

15.1.3.4 Conclusions The analysis presented above shows that for a ten percent step load increase, the DNBR remains above the limit value thereby precluding fuel or clad damage. The plant reaches a stabilized condition rapidly following the load increase.

15.1.4 Inadvertent Opening of a Steam Generator Relief or Safety Valve 15.1.4.1 Identification of Causes and Accident Description The most severe core conditions resulting from an accidental depressurization of the Main Steam System are associated with an inadvertent opening of a single steam dump, relief, or safety valve. The analyses performed assuming a rupture of a main steam line are given in 15.1 - 6 (09 OCT 2019)

Catawba Nuclear Station UFSAR Chapter 15 Section 15.1.5. The main steam line break analysis bounds the inadvertent opening of a steam generator relief or safety valve analysis.

The steam release as a consequence of this accident results in an initial increase in steam flow which decreases during the accident as the steam pressure falls. The energy removal from the RCS causes a reduction of coolant temperature and pressure. In the presence of a negative moderator temperature coefficient, the cooldown results in an insertion of positive reactivity.

The analysis is performed to demonstrate that the following criterion is satisfied:

Assuming a stuck rod cluster control assembly, with offsite power available, and assuming a single failure in the Engineered Safety Features System, there will be no consequential damage to the core or Reactor Coolant System after reactor trip for a steam release equivalent to the spurious opening, with failure to close, of the largest of any single steam dump, relief, or safety valve.

The following systems provide the necessary protection against an accidental depressurization of the Main Steam System:

1. Safety Injection System actuation from any of the following:

a. Two-out-of-four low pressurizer pressure signals.

b. Two-out-of-three high containment pressure signals.

2. The overpower reactor trips (neutron flux and T) and the reactor trip occurring in conjunction with receipt of the safety injection signal.

3. Redundant isolation of the main feedwater lines.

Sustained high feedwater flow would cause additional cooldown. Therefore, in addition to the normal control action which will close the main feedwater valves following reactor trip, a safety injection signal would trip the main feedwater pumps and will generate a feedwater isolation signal which will rapidly close all main feedwater control valves and isolation valves.

4. Trip of the fast-acting main steam isolation valves (designed to close in less than 8 seconds following an isolation signal) on:

a. Two-out-of-three low steamline pressure signals in any one loop.

b. Two-out-of-four high-high containment pressure signals.

c. Two-out-of-three high negative steamline pressure rate signals in any one loop (used only during cooldown and heatup operations).

Accidental depressurization of the secondary system is classified as an ANS Condition II event, a fault of moderate frequency. See Section 15.0 for a discussion of Condition II events.

15.1.4.2 Analysis of Effects and Consequences Method of Analysis The following analyses of a secondary system steam release are performed for this section:

1. A full plant digital computer simulation using the RETRAN-02 Code (Reference 7) to determine RCS temperature and pressure during cooldown, and the effect of safety injection.

2. Analyses to determine that there is no damage to the core or reactor coolant system.

(09 OCT 2019) 15.1 - 7

UFSAR Chapter 15 Catawba Nuclear Station Both the Feedring Steam Generators (FSG) and the Catawba model D5 steam generators are analyzed. Due to the similarity in the system response between the analyses, only the FSG analysis that is representative of Catawba Unit 1 is presented. Table 15-4 summarizes input parameters and initial conditions used.

The following conditions are assumed to exist at the time of a secondary steam system release:

1. End-of-life shutdown margin at no-load, (10-9 x Nominal Power) equilibrium xenon conditions, and with the most reactive rod cluster control assembly stuck in its fully withdrawn position. Operation of rod cluster control assembly banks during core burnup is restricted in such a way that addition of positive reactivity in a secondary system steam release accident will not lead to a more adverse condition than the case analyzed.

2. A negative moderator coefficient corresponding to the end-of-life rodded core with the most reactive rod cluster control assembly in the fully withdrawn position. The variation of the coefficient with temperature is included. The reactivity versus temperature corresponding to the negative moderator coefficient used is shown in Figure 15-17.

3. Minimum capability for injection of high concentration boric acid solution corresponding to the most restrictive single failure in the Safety Injection System. This corresponds to the flow delivered by one safety injection train delivering its full contents to the cold leg header.

No credit is taken for the low concentration boric acid which must be swept from the safety injection lines downstream of the refueling water storage tank prior to the delivery of concentrated boric acid (2,395 ppm from the refueling water storage tank) to the reactor coolant loops.

4. The case studied is an initial steam flow of 280 pounds per second at approximately 1120 psig with offsite power available. This is the maximum capacity of any single steam dump, relief, or safety valve. Initial hot zero power conditions at time zero are assumed since this represents the most conservative initial condition. A penalty is taken for immediate operator action to trip the reactor. This is conservative with respect to reactor trip and is equivalent to initial hot standby operation. Should the reactor be operating at power at the time of a steam release, the reactor will be tripped by the normal overpower protection when power level reaches a trip point. Following a trip at power, the RCS contains more stored energy than at no-load, the average coolant temperature is higher than at no-load, and there is appreciable energy stored in the fuel. Thus, the additional stored energy is removed via the cooldown caused by the steam release before the no-load conditions of RCS temperature and shutdown margin assumed in the analyses are reached. After the additional stored energy has been removed, the cooldown and reactivity insertions proceed in the same manner as in the analysis which assumes no-load condition at time zero. However, since the initial steam generator water inventory is greatest at no-load, the magnitude and duration of the RCS cooldown are less for a steam line release occurring at power.

5. In computing the steam flow, the Moody critical flow model for saturated steam (Reference

4) is used.

6. Perfect moisture separation in the steam generator is assumed.

7. The auxiliary feedwater and RWST water temperatures are each 60°F.

8. The high-head safety injection (NV) single train unborated water purge volume is 75 ft3.

Results The calculated time sequence of events for this accident is listed in Table 15-15.

15.1 - 8 (09 OCT 2019)

Catawba Nuclear Station UFSAR Chapter 15 Figure 15-18 and Figure 15-19 show the transient results for the inadvertant opening of a steam generator relief or safety valve.

The assumed steam release is the maximum capacity of any single steam dump, relief, or safety valve. Safety injection is initiated automatically by low pressurizer pressure. Boron solution at 2,395 ppm enters the RCS from the refueling storage water tank (RWST), providing sufficient negative reactivity to prevent core damage. The cooldown results in a return-to-power of 14% RTP, which is bounded by the steam line break analysis.

15.1.4.3 Environmental Consequences The inadvertent opening of a single steam dump relief or safety valve can result in steam release from the secondary system. If steam generator leakage exists coincident with the failed fuel conditions, some activity will be released.

15.1.4.4 Conclusions Based on the DNB results presented for the steam system piping failure event in Section 15.1.5, the criteria stated earlier in this section are satisfied. For an accidental depressurization of the main steam system, the DNB design basis as stated in Section 4.4 is met and system design limits are not exceeded.

15.1.5 Steam System Piping Failure 15.1.5.1 Identification of Causes and Accident Description Identification of Causes The steam release arising from a rupture of a main steam line would result in an initial increase in steam flow which decreases during the accident as the steam pressure falls. The energy removal from the RCS causes a reduction of coolant temperature and pressure. In the presence of a negative moderator temperature coefficient, the cooldown results in an insertion of positive reactivity. Steam system piping failure is analyzed for two operating conditions: hot zero power and hot full power.

Accident Description for Steam System Piping Failure at Hot Zero Power If the most reactive rod cluster control assembly (RCCA) is assumed stuck in its fully withdrawn position after reactor trip, there is an increased possibility that the core will become critical and return to power. A return to power following a steam line rupture is a potential problem mainly because of the high power peaking factors which exist assuming the most reactive RCCA to be stuck in its fully withdrawn position. The core is ultimately shut down by the boric acid injection delivered by the Safety Injection System.

The following functions provide the protection for a steamline rupture:

1. Safety Injection System actuation from any of the following:

a. Two-out-of-four low pressurizer pressure signals.

b. Two-out-of-three high containment pressure signals.

2. The overpower reactor trips (neutron flux and T) and the reactor trip occurring in conjunction with receipt of the safety injection signal.

3. Redundant isolation of the main feedwater lines.

(09 OCT 2019) 15.1 - 9

UFSAR Chapter 15 Catawba Nuclear Station Sustained high feedwater flow would cause additional cooldown. Therefore, in addition to the normal control action which will close the main feedwater valves, the safety injection signal will trip the main feedwater pumps and will generate a feedwater isolation signal which will rapidly close all main feedwater control valves, and isolation valves.

4. Trip of the fast-acting main steam isolation valves (required to close in less than 8 seconds) on:

a. Two-out-of-three low steam line pressure signals in any one loop.

b. Two-out-of-four high-high containment pressure signals.

c. Two-out-of-three high negative steam line pressure rate signals in any one loop (used only during cooldown and heatup operations).

For breaks downsteam of the main steam isolation valves, closure of all valves would completely terminate the blowdown. For any break, in any location, no more than one steam generator would experience an uncontrolled blowdown even if one of the isolation valves fails to close. A description of steam line isolation is included in Section 10.3.2.

Steam flow is measured by monitoring dynamic head in nozzles located in the throat of the steam generator. The effective throat area of the nozzles is 1.4 square feet, which is considerably less than the main steam pipe area. Thus, the nozzles also serve to limit the maximum steam flow for a break at any location.

Accident Description for Steam System Piping Failure at Hot Full Power The increase in the core power could result in centerline fuel melt (CFM) and departure from nucleate boiling (DNB). The core is shut down by either the power range high neutron flux positive rate trip, the power range high neutron flux trip, or the overpower T (OPT) of the Reactor Trip System. The main steam and feedwater line isolation valves are automatically closed. The auxiliary feedwater system supplies makeup water to the steam generators. Decay heat is removed as necessary through the unaffected steam generators. After the reactor trip, the continuation of the pressure decrease in the secondary side would cause the RCS pressure and temperature to decrease further, and consequently a reactor core return-to-power can occur. This situation is similar to the break of a main steam line at zero power. However, the magnitude of return-to-power due to a main steam line break at zero power is higher.

Therefore, the steam line break at zero power analysis is applicable to the post-trip response following a main steam line break at hot full power when the limiting condition corresponding to the return-to-power occurs. The steam line break at hot full power analysis is applicable to the pre-trip power excursion following a main steam line break at power.

An analysis of the system transient is presented to show that CFM and DNB do not occur following a break of a main steam line at hot full power.

A major steamline rupture is classified as an ANS Condition IV event, a limiting fault. See Section 15.0 for a discussion of Condition IV events.

Effects of minor secondary system pipe breaks are bounded by the analysis presented in this section. Minor secondary system pipe breaks are classified as Condition III events, as described in Section 15.0.

15.1.5.2 Analysis of Effects and Consequences Method of Analysis for Steam Line Break at Hot Zero Power 15.1 - 10 (09 OCT 2019)

Catawba Nuclear Station UFSAR Chapter 15 The analysis of a main steamline rupture is performed to demonstrate that the following criteria are satisfied:

Assuming a stuck RCCA with or without offsite power, and assuming a single failure in the engineered safety features, the core remains in place and intact. Radiation doses do not exceed the guidelines of 10 CFR 100.

Although DNB and possible clad perforation following a steam pipe rupture are not necessarily unacceptable, the following analysis, in fact, shows that no DNB occurs for any rupture assuming the most reactive assembly stuck in its fully withdrawn position. The DNBR design basis is discussed in Section 4.4.

The major rupture of a steamline is the most limiting cooldown transient and is analyzed at zero power. A detailed analysis of this transient with the most limiting break size, 2.0 ft2, is presented here.

The analysis of the steam pipe rupture has been performed to determine:

1. The core heat flux and RCS temperature and pressure resulting from the cooldown following the steam line break. The RETRAN-02 Code (Reference 7) has been used.

2. The thermal and hydraulic behavior of the core following a steam line break. A detailed thermal and hydraulic digital-computer code, VIPRE-01 (Reference 8), has been used to determine if DNB occurs for the core conditions computed in item 1 above.

Both the feedring steam generators (FSG) and the Catawba model D5 steam generators are analyzed. Westinghouse RFA fuel is analyzed. Due to the similarity in the system response between the analyses, only the FSG analysis that is representative of Catawba Unit 1 with RFA fuel is presented. Table 15-4 summarizes input parameters and initial conditions used.

Studies have been performed to determine the sensitivity of steam line break results to various assumptions (Reference 5). Based upon this study, the following conditions were assumed to exist at the time of the main steam line break accident:

1. End-of-life shutdown margin at no-load, equilibrium xenon conditions, and the most reactive RCCA stuck in its fully withdrawn position. Operation of the control rod banks during core burnup is restricted in such a way that addition of positive reactivity in a steamline break accident will not lead to a more adverse condition than the case analyzed.

2. A negative moderator coefficient corresponding to an end-of-cycle (EOC) rodded core. The change in core reactivity during the cooldown considered the effects of temperature, pressure and the most reactive rod in its fully withdrawn position. The impact on reactivity due to the spatial redistribution of the flux resulting from a non-uniform cooldown were also considered. The reactivity versus temperature curve used in the analysis is shown in Figure 15-17. The effect of power generation in the core on overall reactivity is modeled by fuel temperature coefficient as described in Reference 5.

The core properties associated with the sector nearest the affected steam generator and those associated with the remaining sector were conservatively combined to obtain average core properties for reactivity feedback calculations. Further, it was conservatively assumed that the core energy deposition distribution from power generation was uniform. These two conditions cause underprediction of the reactivity feedback in the high power region near the stuck rod. To verify the conservatism of this method, the reactivity as well as the power distribution was checked for the limiting statepoints for the cases analyzed.

This core analysis considered the Doppler reactivity from the high fuel temperature near the stuck RCCA, moderator feedback from the high water enthalpy near the stuck RCCA, power (09 OCT 2019) 15.1 - 11

UFSAR Chapter 15 Catawba Nuclear Station redistribution and nonuniform core inlet temperature effects. It was determined that the reactivity employed in the system kinetics analysis was always larger than the reactivity calculated including the above local effects for the statepoints. These results verify conservatism; i.e., underprediction of negative reactivity feedback from power generation.

3. Minimum capability for injection of boric acid (2,395 ppm from the RWST) solution corresponding to the most restrictive single failure in the Safety Injection System. The Emergency Core Cooling System consists of four systems: 1) the passive accumulators, 2) the low head safety injection (LHSI) System, and 3) the intermediate head safety injection (IHSI) and 4) the high head safety injection (HHSI) system. Only the latter two actuate for the steam line break accident analysis.

The actual modeling of the HHSI and IHSI systems in RETRAN-02 is described in Reference 5. No credit has been taken for the low concentration borated water which must be swept from the lines downsteam of the RWST prior to the delivery of high concentration boric acid to the reactor coolant loops.

For the cases where offsite power is maintained, the sequence of events in the HHSI and IHSI systems is the following. After the generation of the safety injection signal (appropriate delays for instrumentation, logic, and signal transport included), the appropriate valves begin to operate and the safety injection pumps start. 17 seconds after the safety injection signal is generated, the valves are assumed to be in their final position and the pumps are assumed to be at full speed. The volume containing the unborated water is swept before the 2,395 ppm water reaches the core. This delay, described above, is inherently included in the modeling.

In cases where offsite power is lost, an additional 15 second delay is assumed to start the diesels and to load the necessary safety injection equipment onto them.

4. Zero steam generator tube plugging is assumed to maximize heat removal by the secondary system.

5. The steam generators are provided with integral flow restrictors with a 1.4 ft2 throat area.

Sensitivity studies conclude that a 2.0 ft2 break causes the most severe core transient with respect to DNB. This break size is the smallest of those analyzed that results in choked flow at the faulted steam generator outlet flow restrictor. The following cases are analyzed in this section:

a. A 2.0 ft2 split break with the plant at hot zero power with all four reactor coolant pumps running and offsite power maintained throughout the transient.

b. A 2.0 ft2 split break with loss of offsite power coincident with the safety injection signal.

Loss of offsite power results in reactor coolant pump coastdown.

6. Power peaking factors, corresponding to one stuck RCCA and non-uniform core inlet coolant temperatures, are determined for end of core life. The coldest core inlet temperatures are assumed to occur in the sector with the stuck rod. The effects of voids are indirectly accounted for in the analysis. The power peaking factors depend upon the core power, temperature, pressure, and flow, and thus are different for each case studied.

The core parameters used for each of the two cases correspond to values determined from the respective transient analysis.

Both cases above assume that the reactor is initially critical at 10-9 times nominal power. A penalty is taken for immediate operator action to trip the reactor. This is conservative with respect to reactor trip and is equivalent to initial hot standby operation. This is a conservative boundary condition for maximizing RCS cooldown and does not imply an 15.1 - 12 (09 OCT 2019)

Catawba Nuclear Station UFSAR Chapter 15 immediate operator action necessary to mitigate the consequences of the vent. Should the reactor be operating at power at the time of a steam line break, the reactor will be tripped by the normal overpower protection system when power level reaches a trip point. Following a trip at power, the RCS contains more stored energy than at no-load, the average coolant temperature is higher than at no-load, and there is appreciable energy stored in the fuel.

Thus, the additional stored energy is removed via the cooldown caused by the steam line break before the no-load conditions of RCS temperature and shutdown margin assumed in the analyses are reached. After the additional stored energy has been removed, the cooldown and reactivity insertions proceed in the same manner as in the analysis which assumes no-load condition at time zero.

7. In computing the steam flow during a steam line break, the Moody critical flow model for saturated steam (Reference 4) is used.

These assumptions are discussed more fully in Reference 5.

Method of Analysis for Steam Line Break at Hot Full Power The analysis of a main steam line break at power is performed to demonstrate that the following criteria are satisfied:

Assuming without offsite power and a single failure in the engineered safety features, the core remains in place and intact. Radiation doses do not exceed the guidelines of 10CFR 100.

Although DNB and possible clad perforation following a steam pipe break are not necessarily unacceptable, the following analysis in fact show that CFM and DNB do not occur for any break. The CFM and DNB design bases are discussed in Section 4.4.

The analysis of a main steam line break at power has been performed for the Westinghouse RFA fuel to determine:

1. The core transient heat flux, RCS temperature and pressure resulting from the cooldown follow the steam line break. The RETRAN-02 Code (Reference 7) and the Statistical Core Design Methodology (Reference 10) have been used. The peak local transient reactor power is used to evaluate CFM.

2. A detailed thermal and hydraulic digital-computer code, VIPRE-01 (Reference 8), and the Statistical Core Design Methodology have been used to determine if DNB occurs. The WRB-2M critical heat flux correlation (Reference 12) is used for the DNBR calculation for the RFA fuel.

Plant characteristics and initial conditions for this accident are discussed in Section 15.0. Both Unit 1 FSG and Unit 2 Model D5 steam generators are analyzed. Studies have been performed to determine conservative initial and boundary conditions assumed to exist for the main steam line break at power accident:

1. Double-end breaks and split breaks with a spectrum of break sizes at various locations outside the containment are analyzed. A break inside the containment is non-limiting due to an immediate reactor trip on high containment pressure safety injection. In computing the steam flow during a steam line break, the Moody critical flow model for saturated steam (Reference 4) is used.

2. Break size and break location and moderator temperature coefficient (MTC) determine simultaneously the magnitude of the pre-trip power increase. Therefore, for a given break, the maximum pre-trip power level is determined by analyzing a range of negative MTC (09 OCT 2019) 15.1 - 13

UFSAR Chapter 15 Catawba Nuclear Station values which bound the current core designs. The MTC is modeled as a density coefficient based on the core average coolant density.

3. An increase of fuel temperature is expected before reactor trip since there is a reactor power excursion. A least negative Doppler temperature coefficient (DTC) would therefore maximize the pre-trip power level, and is used in the analysis.

4. The reactor trip on high neutron flux is assumed to be actuated at a conservative value of 113.2% of nominal full power. The assumptions of 2 out of 4 detector channel output logic and a failed channel are applied in the analysis. The calculated neutron flux is conservatively modified to account for transient changes in the flux incident on the excore detectors as described below. The high flux positive rate trip and OPT trip include all adverse instrumentation and setpoint errors. The delays for trip actuation are assumed to be the maximum values.

5. As the steam generators depressurize, the saturation temperature decreases and causes excessive primary-to-secondary heat transfer. The resulting decrease in cold leg temperature upon entering the reactor vessel downcomer attenuates the neutron flux leakage exiting the reactor. This attenuation effect reduces the flux incident on the excore neutron detectors, thereby creating an error in the indicated flux value (indicated excore detector power less than true reactor power). A conservative attenuation factor is assumed as a function of the change in reactor vessel downcomer density.

6. A possible loss of offsite power coincident with the break or coincident with the turbine trip is considered. A loss of offsite power at the time of turbine trip has been shown to be limiting.

The main consequences of the loss of offsite power are that control rods insert and reactor coolant pumps coast down.

7. The Rod Control System is assumed to be in manual control to maximize the power increase.

8. The Main Feedwater System is modeled to include the increase in main feedwater flow as the steam generator pressure decreases to maximize cooldown. Main feedwater control valve position and pump speed are assumed to be in manual control.

9. The main turbine is modeled in automatic control mode with the control valves modulating to control to full power steam load to maximize the depressurization until the valve-wide-open position is reached. Thereafter the turbine flow is modeled as a critical flow junction and flow decreases as steam header pressure decreases. Turbine trip occurs on loss of offsite power or reactor trip.

10. In order to maximize the effects of the increased secondary system heat removal, no tube plugging is assumed.

Using the above assumptions, RETRAN system analyses are performed to determine a limiting CFM case and a limiting DNB case based on the combination of break size and break location and MTC. Results show that the Unit 2 Model D5 design yields the limiting CFM case and the Unit 1 FSG design yields the limiting DNB case. The limiting CFM case is a 5.4 ft2 split break downstream of the MSIV with an initial value -17 pcm/oF MTC and the limiting DNB case a 4.9 ft2 split break downstream of the MSIV with a -24 pcm/oF MTC.

Results of Steam Line Break at Hot Zero Power The calculated sequence of events for both cases analyzed is shown on Table 15-15.

Core Power and Reactor Coolant System Transient 15.1 - 14 (09 OCT 2019)

Catawba Nuclear Station UFSAR Chapter 15 Figure 15-21 through Figure 15-26 and Figure 15-205 through Figure 15-209 show the RCS and secondary system transient following a main steam line rupture at initial no-load condition (case 5a).

Offsite power is assumed available so that full reactor coolant flow exists. The transient shown assumes an uncontrolled steam release from only one steam generator. Should the core be critical at near zero power when the rupture occurs, the initiation of safety injection on low pressurizer pressure will shut down the reactor. Steam release from more than one steam generator will be prevented by automatic trip of the fast acting isolation valves in the steam lines by low steam line pressure signals, high-high containment pressure signals, or high negative steam line pressure rate signals. Even with the failure of one valve, release is ended for the other steam generators while the one generator blows down. The isolation valves are designed to be fully closed in less than 8 seconds from receipt of a closure signal.

As shown in Figure 15-26, the core attains criticality with the RCCAs inserted (with the design shutdown margin assuming one stuck RCCA) and the peak heat flux occurs before boron solution at 2,395 ppm enters the RCS. Doppler feedback mitigates the power excursion and power is decreasing when boron reaches the core. The continued addition of boron ensures in a peak core power significantly lower than the nominal full power value.

The calculation assumes the boric acid is mixed with, and diluted by, the water flowing in the RCS prior to entering the reactor core. The concentration after mixing depends upon the relative flow rates in the RCS and the Safety Injection System. The variation of mass flow rate in the RCS due to water density changes is included in the calculation, as is the variation of flow rate in the Safety Injection System due to changes in the RCS pressure. The Safety Injection System flow calculation includes the line losses in the system as well as the pump head curve.

Figure 15-210 through Figure 15-220 show the salient parameters for the case with the loss of offsite power at the time the safety injection signal is generated. Criticality is achieved later and the core power increase is slower than in the similar case with offsite power available. The ability of the emptying steam generator to extract heat from the RCS is reduced by the decreased flow in the RCS. The peak power remains well below the nominal full power value.

It should be noted that following a steam line break only one steam generator blows down completely. Thus, the remaining steam generators are still available for dissipation of decay heat after the initial transient is over. In the case of loss of offsite power this heat is removed to the atmosphere via the steam line safety valves.

Margin to Critical Heat Flux A DNB analysis was performed for both of these cases. It was found that both cases have a minimum DNBR greater than the limit value of the WLOP CHF correlation (Reference 14).

Effect of Continued Auxiliary Feedwater Addition An analysis was performed to determine the potential for unacceptable worsening of the reactor return-to-power as a result of continued addition of auxiliary feedwater following a main steam line break. The main steam line break transient as analyzed here should be insensitive to continued auxiliary feedwater addition, since the limiting core conditions, as described above, occur within the first few minutes due to the initial high cooldown rate. During this time the primary-to-secondary heat transfer rate from the blowdown of the initial steam generator water inventory is several orders of magnitude greater than the rate due to the additional auxiliary feedwater, even when runout flow is assumed. The supplementary analysis, assuming auxiliary feedwater at runout flow conditions as described in Section 6.2.1.1.3.3, was evaluated in (09 OCT 2019) 15.1 - 15

UFSAR Chapter 15 Catawba Nuclear Station Reference 6. This evaluation found that the transient was insensitive to continued auxiliary feedwater addition, and, therefore, that the main analysis above remained bounding.

Steam Line Break in Mode 3 when Safety Injection is Blocked A potentially more limiting steam line break accident could occur for a steam line break outside containment when in Mode 3 with the low pressurizer pressure signal for safety injection actuation blocked. In this scenario, feedwater would not automatically isolate, and return-to-power peak heat fluxes may increase to values significantly greater than the steam line break analysis intiating from no-load conditions. Therefore, when safety injection is blocked, administrative controls on boron concentration are required to prevent a return-to-power following a steam line break.

Results of Steam Line Break at Hot Full Power The calculated sequences of events for both CFM and DNB cases are shown in Table 15-15.

The reactor power increases due to the insertion of the positive reactivity resulted from the coolant temperature decrease. Eventually the reactor is tripped on high neutron flux for the CFM case and on OPT for the DNB case. The transient response for the limiting CFM case is shown in Figures15-330 through 15-338. The transient response for the limiting DNB case is not shown due to similarity. Loss of offsite power coincident with the turbine trip is assumed.

Figure 15-335 shows the substantial difference between the actual neutron power and the attenuated neutron flux, which is seen by the excore neutron detector, due to the decrease of the downcomer coolant temperature. The limiting CFM case yields a positive CFM margin.

A VIPRE analysis was performed for the limiting DNB case. The transient DNBR result (Figure 15-339) shows that the MDNBR is above the limit value of the WRB-2M CHF correlation (Reference 10).

Conclusions for Steam Line Break at Hot Full Power The results of the analyses show that both CFM and DNB have positive margin. Therefore, no fuel or clad damage is predicted during the steam line break at power.

15.1.5.3 Environmental Consequences The Main Steam Line Break may lead to releases of radioactivity to the environment through several pathways. One pathway involves release of radioactivity from the secondary side of the faulted steam generator via blowdown and from the secondary side of the other steam generators before closure of the Main Steam Isolation Valves. The other pathways involve primary to secondary leakage. Radioactivity entrained with primary-to-secondary leakage in the faulted steam generator may escape directly to the environment once it is dried out or when its tubes are uncovered. Radioactivity entrained with tube leakage in the intact steam generators mixes with the water in the secondary sides if their tubes are submerged. From there, the radioactivity is released to the environment with boiloff. If the tubes of an intact steam generator are uncovered for any time span, the radioactivity entrained with tube leakage may escape to the environment during that time span.

A conservative analysis of the potential offsite radiation doses following a main steam line break is presented assuming primary to secondary leakage. Two cases are postulated as follows:

Case There is a pre-existent iodine spike at accident initiation. The reactor coolant iodine 1: specific activities are the maximum permitted for full power operation at the Facility Operating License (FOL) 159/151 limit of 26 µCi/gm dose equivalent I-131-DEI.

15.1 - 16 (09 OCT 2019)

Catawba Nuclear Station UFSAR Chapter 15 Case There is a concurrent iodine spike at accident initiation. The initial reactor coolant 2: iodine specific activities correspond to the FOL 159/151 limit (0.46 µCi/gm dose equivalent I-131 - DEI). The transient iodine specific activities are found by increasing the equilibrium appearance rates by a factor of 500. A cutoff time for the appearance of iodine isotopes in the reactor coolant is assumed and set to 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> after the initiating event.

All steam line break scenarios include postulated failure of a main steam line in a steam generator doghouse and a Minimum Safeguards failure as the limiting single failure. With this failure one of the two Class 1E Residual Heat Removal trains is unavailable, prolonging the time to cool the affected nuclear unit to a temperature at which fission product releases end.

The following assumptions and parameters are used to calculate the activity release and offsite radiation doses for a postulated main steam line break:

1. The initial specific activities in the steam generator secondary sides are set to the limit listed in the plant Technical Specifications.

2. Releases from the secondary systems of the affected unit through the faulted steam generator end at 10 minutes.

3. The primary to secondary leakage in each steam generator is set to 150 gpd.

4. All noble gases entrained with primary to secondary leakage are released directly to the environment.

5. The faulted steam generator is assumed to dry out instantaneously and remain dried out for the duration of the accident. All fission products entrained with tube leakage in the faulted steam generator are released directly to the environment.

6. Beginning with accident initiation, tube bundle uncovery is assumed to occur in all intact steam generators. Limiting time spans of tube bundle uncovery for the intact steam generators are listed in Table 15-17. All fission products entrained with tube leakage in the intact steam generators are released directly to the environment during these time spans.

7. While their tubes are submerged, iodine entrained with tube leakage in the intact steam generators mix with the water in the secondary side and released only with steam releases.

The iodine partition fraction for steam releases from the intact steam generators is set to 0.01.

8. Offsite power is assumed to be lost.

9. All releases of radioactivity to the environment (tube leakage in the faulted steam generator and tube leakage and boiloff in the intact steam generators) end at 30 days post-accident.

Other assumptions are listed in Table 15-17.

Radiological consequences calculated for a main steam line break are listed in Table 15-14.

They are within the regulatory limits cited in Regulatory Guide 1.183 for a main steam line break.

15.1.6 References

1. Deleted Per 1997 Update

2. Deleted Per 1997 Update (09 OCT 2019) 15.1 - 17

UFSAR Chapter 15 Catawba Nuclear Station

3. Letter (NS-TMA-2182), T.M. Anderson (Westinghouse) to S.H. Hanaver (NRC) Dec. 30, 1979.

4. Moody, F. S., Maximum Flow Rate of a Single Component, Two Phase Mixture, J. Heat Transfer, 87, 134-142, 1965.

5. McGuire and Catawba Nuclear Stations Multidimensional Reactor Transients and Safety Analysis Physics Parameters Methodology, DPC-NE-3001-PA, Revision 1, Duke Power Company, March 2015.

6. Letter, T. M. Novak (NRC) to H. B. Tucker, October 14, 1982.

Enclosure:

Safety Evaluation Report of Duke Power Co. response to I. E. Bulletin 80-04.

7. RETRAN-02: A Program for Transient Thermal-Hydraulic Analysis of Complex Fluid Flow Systems, EPRI NP-1850-CCM, Revision 6.1, EPRI, June, 2007..

8. VIPRE-01: A Thermal-Hydraulic Code for Reactor Cores, EPRI NP-2511-CCM-A, Revision 4.2, EPRI, June, 2007.

9. Deleted Per 2000 Update.

10. "Duke Power Company Thermal-Hydraulic Statistical Core Design Methodology," DPC-NE-2005-PA, Revision 5, March 2016.

11. Deleted Per 2006 Update.

12. WCAP-15025-P, "Modified WRB-2 Correlation, WRB-2M, for Predicting Critical Heat Flux in 17x17 Rod Bundles with Modified LPD Mixing Vane Grids," Westinghouse, February 1998.

13. Duke Power Company Westinghouse Fuel Transition Report, DPC-NE-2009-PA, Revision 3, September, 2010.

14. WCAP-14565-P-A, Addendum 2 to WCAP-14565-P-A Extended Application of ABB-NV Correlation and Modified ABB-NV Correlation WLOP for PWR Low Pressure Applications, April 2008.

THIS IS THE LAST PAGE OF THE TEXT SECTION 15.1.

15.1 - 18 (09 OCT 2019)

Catawba Nuclear Station UFSAR Chapter 15 15.2 Decrease in Heat Removal by the Secondary System A number of transients and accidents have been postulated which could result in a reduction of the capacity of the secondary systems to remove heat generated in the Reactor Coolant System (RCS). Detailed analyses are presented for several such events which have been identified as limiting cases.

Discussions of the following events are presented in this section:

1. Steam pressure regulator malfunction

2. Loss of External Load

3. Turbine Trip

4. Inadvertent closure of main steam isolation valves

5. Loss of Condenser Vacuum and Other Events Resulting in Turbine Trip

6. Loss of Non-Emergency AC Power to the Station Auxiliaries

7. Loss of Normal Feedwater Flow

8. Feedwater System Pipe Break The above items are considered to be ANS Condition II events, with the exception of a Feedwater System Pipe Break, which is considered to be an ANS Condition IV event. Section 15.0 contains a discussion of ANS classifications and applicable acceptance criteria.

15.2.1 Steam Pressure Regulator Malfunction or Failure that Results in Decreasing Steam Flow There are no pressure regulators in the Catawba plant whose failure or malfunction could cause a steam flow transient.

15.2.2 Loss of External Load 15.2.2.1 Identification of Causes and Accident Description A major load loss on the plant can result from loss of external electrical load due to some electrical system disturbance. Offsite AC power remains available to operate plant components such as the reactor coolant pumps. As a result, the onsite emergency diesel generators are not required to function for this event. Following the loss of generator load, an immediate fast closure of the turbine control valves will occur. This will cause a sudden reduction in steam flow, resulting in an increase in pressure and temperature in the steam generator shell. As a result, the heat transfer rate in the steam generator is reduced, causing the reactor coolant temperature to rise, which in turn causes coolant expansion, pressurizer insurge, and RCS pressure rise.

For a loss of external electrical load without subsequent turbine trip, the plant would be expected to trip from the Reactor Protection System if a safety limit were approached. A continued steam load of approximately 5 percent would exist after total loss of external electrical load because of the steam demand of plant auxiliaries.

In the event that a safety limit is approached, protection would be provided by the high pressurizer pressure and overtemperature T trips. Power and frequency relays associated with the reactor coolant pump provide no additional safety function for this event. Following a (09 OCT 2019) 15.2 - 1

UFSAR Chapter 15 Catawba Nuclear Station complete loss of load, the maximum turbine overspeed would be approximately 8 to 9 percent, resulting in an overfrequency of less than 6 Hz. This resulting overfrequency is not expected to damage the sensors (non-NSSS) in any way. However, it is noted that frequency testing of this equipment is required by the Technical Specifications. Any degradation in their performance could be ascertained at that time. Any increased frequency to the reactor coolant pump motors will result in slightly increased flowrate and subsequent additional margin to safety limits. For postulated loss of load and subsequent turbine generator overspeed, any overfrequency condition is not seen by safety related pump motors, Reactor Protection System equipment, or other safeguards loads. Safeguards loads are supplied from offsite power or, alternatively, from emergency diesels. Reactor Protection System equipment is supplied from the inverters; the inverters are supplied from a DC bus energized from batteries or by a rectified AC voltage from safeguards buses.

In the event the steam dump valves fail to open following a large loss of load, the steam generator safety valves may lift and the reactor may be tripped by the high pressurizer pressure signal, the high pressurizer water level signal, or the overtemperature T signal. The steam generator shell side pressure and reactor coolant temperatures will increase rapidly. The pressurizer safety valves and steam generator safety valves are, however, sized to protect the Reactor Coolant System (RCS) and steam generator against overpressure for all load losses without assuming the operation of the steam dump system, pressurizer spray, pressurizer power-operated relief valves, or automatic rod cluster control assembly control.

The steam generator safety valve capacity is sized to remove the steam flow at the engineered safety features design rating (105 percent of steam flow at rated power) from the steam generator without exceeding 110 percent of the steam system design pressure. The pressurizer safety valve capacity is sized based on a complete loss of heat sink with the plant initially operating at the maximum calculated turbine load along with operation of the steam generator safety valves. The pressurizer safety valves are then able to relieve sufficient steam to maintain the RCS pressure within 110 percent of the RCS design pressure.

A more complete discussion of overpressure protection can be found in Reference 1.

A loss of external load event results in an NSSS transient that is less severe than a turbine trip event (see Section 15.2.3). Therefore, a detailed transient analysis is not presented for the loss of external load.

The primary-side transient is caused by a decrease in heat transfer capability from primary to secondary due to a rapid termination of steam flow to the turbine, accompanied by an automatic reduction of feedwater flow. (Should feed flow not be reduced, a larger heat sink would be available and the transient would be less severe). Termination of steam flow to the turbine following a loss of external load occurs due to automatic fast closure of the turbine control valves in approximately 0.3 seconds. Following a turbine trip event, termination of steam flow occurs via turbine stop valve closure, which occurs in approximately 0.1 seconds. Therefore, the transient in primary pressure, temperature, and water volume will be less severe for the loss of external load than for the turbine trip due to a slightly slower loss of heat transfer capability.

A loss of external load is classified as an ANS Condition II event, a fault of moderate frequency.

See Section 15.0 for a discussion of Condition II events.

15.2.2.2 Analysis of Effects and Consequences Method of Analysis 15.2 - 2 (09 OCT 2019)

Catawba Nuclear Station UFSAR Chapter 15 Refer to Section 15.2.3.2 for the method used to analyze the limiting transient (turbine trip) in this grouping of events. The results of the turbine trip event analysis are more severe than those expected for the loss of external load, as discussed in Section 15.2.2.1.

Normal reactor control systems and Engineered Safety Systems are not required to function.

The Auxiliary Feedwater System may, however, be automatically actuated following a loss of main feedwater. This will further mitigate the effects of the transient.

The Reactor Protection System may be required to function following a complete loss of external load to terminate core heat input and prevent DNB. Depending on the magnitude of the load loss, pressurizer safety valves and/or steam generator safety valves may be required to open to maintain system pressure below allowable limits. No single active failure will prevent operation of any system required to function. A discussion of ATWS considerations is presented in Reference 2.

15.2.2.3 Environmental Consequences Loss of external load from full power would result in the operation of the steam dump system.

This system keeps the main turbine generator operating to supply auxiliary electrical loads.

Operation of the steam dump system results in bypassing steam to the condenser. If steam dumps are not available, steam generator safety and relief valves relieve to the atmosphere.

Since no fuel damage is postulated for this transient the radiological releases will be less severe than those for the steamline break accident analyzed in Section 15.1.5.3.

15.2.2.4 Conclusions Based on results obtained for the turbine trip event (Section 15.2.3) and considerations described in Section 15.2.2.1, the applicable acceptance criteria for a loss of external load event are met.

15.2.3 Turbine Trip 15.2.3.1 Identification of Causes and Accident Description For a turbine trip event, the turbine stop valves close rapidly (typically 0.1 sec.) on loss of trip fluid pressure actuated by one of a number of possible turbine trip signals as described in Section 10.2.2.

Upon initiation of stop valve closure, steam flow to the turbine stops abruptly. Sensors on the stop valves detect the turbine trip and initiate steam dump. The loss of steam flow results in an almost immediate rise in secondary system temperature and pressure with a resultant primary system transient as described in Section 15.2.2.1 for the loss of external load event. A more severe transient occurs for the turbine trip event due to the more rapid loss of steam flow caused by the more rapid valve closure.

The automatic steam dump system would normally accommodate the excess steam generation.

Reactor coolant temperatures and pressure do not significantly increase if the steam dump system and pressurizer pressure control system are functioning properly. If the turbine condenser were not available, the excess steam generation would be dumped to the atmosphere and main feedwater flow would be lost. For this situation feedwater flow would be maintained by the Auxiliary Feedwater System to ensure adequate residual and decay heat removal capability. Should the steam dump system fail to operate, the steam generator safety valves may lift to provide pressure control. See Section 15.2.2.1 for a further discussion of the transient.

(09 OCT 2019) 15.2 - 3

UFSAR Chapter 15 Catawba Nuclear Station A turbine trip event is the most limiting of loss of external load, loss of condenser vacuum, and other turbine trip events. As such, this event has been analyzed in detail. Results and discussion of the analysis are presented in Section 15.2.3.2.

A turbine trip is classified as an ANS Condition II event, a fault of moderate frequency. See Section 15.0 for a discussion of Condition II events.

15.2.3.2 Analysis of Effects and Consequences Method of Analysis In this analysis, the behavior of the unit is evaluated for a complete loss of steam load from 3479 MWt (rated thermal power plus measurement uncertainty) to show the adequacy of the pressure relieving devices of both the primary and secondary systems. The reactor is not tripped until conditions in the RCS result in a trip. No credit is taken for steam dump. Main feedwater flow is terminated at the time of turbine trip, with no credit taken for auxiliary feedwater to mitigate the consequences of the transient.

Both the Feedring Steam Generators (FSG) and the Catawba model D steam generators are analyzed. The model D analysis is performed such that the results bound the current Catawba Unit 2 model D5 steam generators. Due to the similarity in the system response between the analyses, only the model D analysis that is representative of Catawba Unit 2 is presented.

The turbine trip transients are analyzed by employing the detailed digital computer program RETRAN-02 (Reference 6). The program simulates the neutron kinetics, RCS, pressurizer, pressurizer relief and safety valves, pressurizer spray, steam generator, and steam generator safety valves. The program computes pertinent plant variables including temperatures, pressures, and power level.

Major assumptions are summarized below:

1. Initial operating conditions are assumed to be at their full power values adjusted for uncertainties.

2. Moderator and Doppler Coefficients of Reactivity - the turbine trip is analyzed with most positive reactivity feedback. The analysis assumes a most negative moderator density coefficient and the least negative Doppler temperature coefficient corresponding to beginning of core life.

3. Reactor Control - from the standpoint of the maximum pressures attained it is conservative to assume that the reactor is in manual control. If the reactor were in automatic control, the control rod banks would move prior to trip and reduce the severity of the transient.

4. Steam Release - no credit is taken for the operation of the steam dump system or steam generator power-operated relief valves. The steam generator pressure rises to the safety valve setpoint where steam release through safety valves limits secondary steam pressure.

5. Pressurizer Spray and Power-Operated Relief Valves:

a. Full penalty is taken for the effect of pressurizer spray and power-operated relief valves in reducing or limiting the coolant pressure in the maximum secondary system pressure case. Pressurizer pressure control prevents early reactor trip on high pressurizer pressure. Pressurizer safety valves are also available.

b. No credit is taken for the effect of pressurizer spray and power operated relief valves in reducing or limiting the coolant pressure in the maximum primary system pressure case.

Pressurizer safety valves are available. The safety valves are assumed to be full open 15.2 - 4 (09 OCT 2019)

Catawba Nuclear Station UFSAR Chapter 15 at an accumulation pressure 3% above the adjusted lift setpoint which is, in turn, 3%

above the nominal lift setpoint.

6. Feedwater Flow - main feedwater flow to the steam generators is assumed to be lost at the time of turbine trip in the peak primary and secondary pressure analyses. No credit is taken for auxiliary feedwater flow since a stabilized plant condition will be reached before auxiliary feedwater initiation is normally assumed to occur. However, the auxiliary feedwater pumps would be expected to start on a trip of the main feedwater pumps. The auxiliary feedwater flow would remove core decay heat following plant stabilization.

7. Reactor trip is actuated by the first Reactor Protection System trip setpoint reached. Trip signals are expected due to high pressurizer pressure, overtemperature T, high pressurizer water level, and low-low steam generator water level. No credit is assumed in this analysis for a reactor trip due to a turbine trip.

8. The high pressurizer pressure trip is assumed to be at 2415 psig for the peak primary and secondary pressure cases.

Plant characteristics and initial conditions are further discussed in Section 15.0 (see Table 15-4).

Except as discussed above, normal reactor coolant system and Engineered Safety Systems are not required to function. The maximum secondary system pressure case is presented in which pressurizer spray and power operated relief valves are assumed, but this is to delay reactor trip on high pressurizer pressure.

The Reactor Protection System may be required to function following a turbine trip. Pressurizer safety valves and/or steam generator safety valves may be required to open to maintain system pressures below allowable limits. No single active failure will prevent operation of any system required to function. A discussion of ATWS considerations is presented in Reference 2.

Results The transient response for a turbine trip from 3479 MWt (rated thermal power plus measurement uncertainty) is presented for the maximum Main Steam System pressure case and the maximum primary system pressure case. Since the transient response is virtually identical, except for the difference in primary pressure response for the two cases, the system response is presented for the maximum Main Steam System pressure case, and only the primary pressure response of the maximum primary system pressure case is presented. The calculated sequence of events for the accident is shown in Table 15-18.

Figure 15-27 through Figure 15-31 show the transient response following a turbine trip for the maximum Main Steam System pressure case. Full credit is taken for the pressurizer sprays and pressurizer power-operated relief valves. No credit is taken for the steam dump. The reactor is tripped by the OTT trip channel. The steam generator safety valves limit the Main Steam System pressure below 110 percent of the design value.

The transient response following a turbine trip for the maximum primary system pressure case is virtually identical as that presented for the maximum Main Steam System pressure case in Figure 15-27 through Figure 15-30, except for the primary system pressure response provided in Figure 15-31. The primary system pressure response for the maximum primary system pressure case is presented in Figure 15-32. No credit is taken for the pressurizer sprays and pressurizer power-operated relief valves. No credit is taken for the steam dump. The reactor is tripped by the high pressurizer pressure trip function. The steam generator safety valves limit the Main System pressure below 110 percent of the design value. The pressurizer safety valves limit the primary system pressure below 110 percent of the design value.

(09 OCT 2019) 15.2 - 5

UFSAR Chapter 15 Catawba Nuclear Station Reference 1 presents additional results of an analysis for a complete loss of heat sink including loss of main feedwater. This analysis shows the overpressure protection that is afforded by the pressurizer and steam generator safety valves.

15.2.3.3 Environmental Consequences The radiological consequences resulting from atmospheric steam dump will be less severe than the steamline break event analyzed in Section 15.1.5.3 since no fuel damage is postulated to occur.

15.2.3.4 Conclusions Results of the analyses, including those in Reference 1, show that the plant design is such that a turbine trip presents no hazard to the integrity of the RCS or the main steam system.

Pressure relieving devices incorporated in the two systems are adequate to limit the maximum pressures to within the design limits.

15.2.4 Inadvertent Closure of Main Steam Isolation Valves Inadvertent closure of the main steam isolation valves (MSIV) would result in a transient response similar to that of a turbine trip. The closure of the MSIVs would isolate a smaller volume of steam piping than a turbine trip, which would tend to cause a transient more severe than a turbine trip event. However, the longer closing time of the MSIVs, relative to the turbine stop valve closure time, offsets the effects of the smaller steam piping volume, and therefore the MSIV closure event is less severe than a turbine trip event. Turbine trips are discussed in Section 15.2.3.

15.2.5 Loss of Condenser Vacuum and Other Events Causing a Turbine Trip Loss of condenser vacuum is one of the events that can cause a turbine trip. Turbine trip initiating events are described in Section 10.2.2. A loss of condenser vacuum would preclude the use of steam dump to the condenser. However, since steam dump is assumed not to be available in the turbine trip analysis, no additional adverse effects would result if the turbine trip were caused by loss of condenser vacuum. Therefore, the analysis results and conclusions contained in Section 15.2.3 apply to loss of condenser vacuum. In addition, analyses for the other possible causes of a turbine trip, as listed in Section 10.2.2 are covered by Section 15.2.3.

Possible overfrequency effects due to a turbine overspeed condition are discussed in Section 15.2.2.1 and are not a concern for this type of event.

15.2.6 Loss of Non-Emergency AC Power to the Station Auxiliaries 15.2.6.1 Identification of Causes and Accident Description A complete loss of non-emergency AC power may result in the loss of all power to the plant auxiliaries, i.e., the reactor coolant pumps, condensate pumps, etc. The loss of power may be caused by a complete loss of the offsite grid accompanied by a turbine generator trip at the station, or by a loss of the onsite AC distribution system.

The reactor will trip (1) upon reaching one of the trip setpoints in the primary and secondary systems as a result of the flow coastdown and decrease in secondary heat removal or (2) due to loss of power to the control rod drive mechanisms as a result of the loss of power to the plant.

15.2 - 6 (09 OCT 2019)

Catawba Nuclear Station UFSAR Chapter 15 Following a loss of AC power with turbine and reactor trips, the sequence described below will occur:

1. Plant vital instruments are supplied from emergency DC power sources.

2. As the steam system pressure rises following the trip, the steam generator power-operated relief valves may be automatically opened to the atmosphere. The condenser is assumed not to be available for steam dump. If the steam flow rate through the relief valves is not available, the steam generator safety valves may lift to dissipate the sensible heat of the fuel and coolant plus the residual decay heat produced in the reactor.

3. As the no load temperature is approached, the steam generator power-operated relief valves (or safety valves, if the relief valves are not available) are used to dissipate the residual decay heat and to maintain the plant at hot shutdown condition.

4. The standby diesel generators, started on loss of voltage on the plant emergency busses, begin to supply plant vital loads.

The Auxiliary Feedwater System is started automatically as discussed in Section 10.4.9.

Upon the loss of power to the reactor coolant pumps, coolant flow necessary for core cooling and the removal of residual heat is maintained by natural circulation in the reactor coolant loops.

A loss of AC power to the plant auxiliaries as postulated above could result in a loss of normal feedwater if the condensate pumps lose their power supply.

The loss of non-emergency AC power analysis has a loss of normal feedwater, RCS flow coastdown, and reactor trip signal from loss of power to the RCCA's or any of the primary coolant flow trips within 1.5 seconds of the initiating event.

The RCS flow coastdown subsequent to the loss of non-emergency AC power is computed using the same methodology as the loss of flow transients in Section 15.3. Figure 15-40 shows core flow predicted during the loss of non-emergency AC power transient.

Following the reactor coolant pump coastdown caused by the loss of AC power, the natural circulation capability of the RCS will remove residual and decay heat from the core, aided by auxiliary feedwater in the secondary system. The analysis shows that the natural circulation flow in the RCS following a loss of AC power event is sufficient to remove residual heat from the core.

A loss of non-emergency AC power to the station auxiliaries is classified as an ANS Condition II event, a fault of moderate frequency. See Section 15.0 for a discussion of Condition II events.

15.2.6.2 Analysis of Effects and Consequences Method of Analysis A detailed analysis using the RETRAN-02 Code (Reference 6) is performed to obtain the natural circulation flow following a loss of offsite power. The simulation describes the plant thermal kinetics, Reactor Coolant System (RCS) including natural circulation, the pressurizer, steam generators and feedwater system. The digital program computes pertinent variables including the steam generator level, pressurizer water level, and reactor coolant average temperature.

Both the Feedring Steam Generators (FSG) and the McGuire model D steam generators are analyzed. The model D analysis is performed such that the results bound the current Catawba Unit 2 model D5 steam generators. Due to the similarity in the system response between the two analyses, only the model D analysis that is representative of Catawba Unit 2 is presented.

(09 OCT 2019) 15.2 - 7

UFSAR Chapter 15 Catawba Nuclear Station The assumptions used in the analysis are as follows:

1. The plant is initially operating at 3479 MWt (rated thermal power plus measurement uncertainty).

2. Core residual heat generation is based on the 1979 version of ANS-5.1 (Reference 5).

ANSI/ANS-5.1-1979 is a conservative representation of the decay energy release rates.

3. Credit is taken for immediate release of the control rod drive mechanisms caused by a loss of offsite power.

4. The worst single failure is assumed to be the turbine-driven auxiliary feedwater pump. The minimum amount of auxiliary feedwater delivered to the steam generators is a function of steam generator pressure.

5. Secondary system steam relief is achieved through the steam generator safety valves.

6. 18% of the tubes in each steam generator are assumed to be plugged. An evaluation was performed to support uniform plugging of the steam generator tubes up to a maximum level of 24% for any individual steam generator with a plant average maximum of 20%. The results of this evaluation show that the natural circulation analysis is not sensitive to increased tube plugging levels.

Power is asumed to be lost to the reactor coolant pumps at the time of reactor trip.

Plant characteristics and initial conditions are further discussed in Section 15.0 (see Table 15-4).

Results The transient response of the RCS following a loss of AC power is shown in Figure 15-36 through Figure 15-40. The calculated sequence of events for this transient is given in Table 15-18.

The first few seconds after the loss of power to the reactor coolant pumps will closely resemble a simulation of the complete loss of flow incident (see Section 15.3.2), i.e., core damage due to rapidly increasing core temperatures is prevented by promptly tripping the reactor. After the reactor trip, stored and residual decay heat must be removed to prevent damage to either the RCS or the core.

The RETRAN-02 code results show that the natural circulation flow available is sufficient to provide adequate core decay heat removal following reactor trip and reactor coolant pump coastdown.

15.2.6.3 Environmental Consequences Since steam dump to the condenser is assumed to be lost, heat removal from the secondary system would occur through the steam generator power-operated relief valves or safety valves.

Since no fuel damage is postulated to occur, radiological consequences resulting from this transient would be less severe than the steamline break accident analyzed in Section 15.1.5.3.

15.2.6.4 Conclusions Analysis of the natural circulation capability of the Reactor Coolant System has demonstrated that sufficient heat removal capability exists following reactor coolant pump coastdown to prevent fuel or clad damage.

15.2 - 8 (09 OCT 2019)

Catawba Nuclear Station UFSAR Chapter 15 15.2.7 Loss of Normal Feedwater Flow 15.2.7.1 Identification of Causes and Accident Description A loss of normal feedwater (from pump failures, valve malfunctions, or loss of offsite AC power) results in a reduction in capability of the secondary system to remove the heat generated in the reactor core. If an alternative supply of feedwater were not supplied to the plant, core residual heat following reactor trip could heat the primary system water to the point where water relief from the pressurizer would occur, resulting in a substantial loss of water from the Reactor Coolant System (RCS). Additionally, the RCS heatup associated with loss of normal feedwater could bring the plant closer to a DNB condition.

The following occur upon loss of normal feedwater (assuming main feedwater pump failures or valve malfunctions):

1. As the steam system pressure rises following the trip, the steam generator power-operated relief valves and the steam generator safety valves lift to dissipate the sensible heat of the fuel and coolant plus the residual decay heat produced in the reactor. Steam dump to the condenser is assumed not to be available.

2. As the no load temperature is approached, the steam generator power-operated relief valves (and safety valves) are used to dissipate the residual decay heat and to maintain the plant at the hot shutdown condition.

The reactor trip on low-low narrow range level in any steam generator provides the necessary protection against a loss of normal feedwater.

The Auxiliary Feedwater System is started automatically as discussed in Section 10.4.9. The turbine-driven auxiliary feedwater pump utilizes steam from the secondary system and exhausts to the atmosphere. The motor-driven auxiliary feedwater pumps are supplied by power from the diesel generators.

An analysis of the system transient is presented below to show that DNB does not occur following a loss of normal feedwater, and that the Auxiliary Feedwater System is capable of removing the stored and residual heat, thus preventing either overpressurization of the RCS or loss of water from the reactor core, and returning the plant to a stabilized condition.

A loss of normal feedwater is classified as an ANS Condition II event, a fault of moderate frequency. See Section 15.0 for a discussion of Condition II events. A discussion of ATWS considerations is presented in Reference 2 15.2.7.2 Analysis of Effects and Consequences Method of Analysis A detailed analysis using the RETRAN-02 Code (Reference 6) is performed in order to obtain the plant transient following a loss of normal feedwater. The simulation describes the plant thermal kinetics, RCS, pressurizer, steam generators and feedwater system. The digital program computes pertinent variables including the steam generator level, pressurizer water level, and reactor coolant average temperature.

The loss of normal feedwater analysis consists of a short-term core cooling (DNBR) analysis and a long-term core cooling analysis to demonstrate the capability of the Auxiliary Feedwater System to remove stored and residual heat. The short-term analysis is presented for Unit 1 only since it bounds Unit 2. Separate long-term analyses are presented for each unit due to the (09 OCT 2019) 15.2 - 9

UFSAR Chapter 15 Catawba Nuclear Station effects of different steam generator designs (FSG for Unit 1 and D5 for Unit 2) on the plant transient response.

Table 15-4 summarizes input parameters and initial conditons used.

Short-Term Core Cooling Analysis The short-term core cooling analysis consists of a RETRAN-02 (Reference 6) plant transient simulation and a VIPRE-01 (Reference 7) core thermal-hydraulic analysis using the Statistical Core Design Methodology as described in Reference 8. Utilizing the WRB-2M critical heat flux correlation (Reference 12), the VIPRE-01 code calculates the DNBR during the transient based on the RETRAN-02 boundary conditions. The system response is calculated based on the following assumptions.

1. The plant is initially operating at 3,469 MWth. Pressure, flow, and RCS temperatures are assumed to be at their nominal values. Uncertainties in initial conditions are included in the limit DNBR as described in Reference 8.

2. A least negative Doppler temperature coefficient is used.

3. A most positive moderator temperature coefficient allowed by Technical Specifications is assumed to conservatively minimize negative feedback due to coolant heatup.

4. Reactor trip occurs on steam generator low-low level trip setpoint, assumed to be at 2.7%

narrow range level.

5. The pressurizer power-operated relief and safety valves are assumed to function normally to minimize the RCS pressure increase during the transient and to obtain minimum DNBR.

Pressurizer sprays are not credited.

6. No credit is taken for the auxiliary feedwater actuation after the low-low steam generator level setpoint is reached due to the short duration of the transient.

7. Secondary system steam relief is achieved through the steam generator safety valves which are conservatively modeled such that maximum RCS coolant temperature is achieved.

8. 10% of the tubes in each steam generator are assumed to be plugged.

Long-Term Core Cooling Analysis The long-term core cooling analysis is performed to demonstrate the adequacy of the Reactor Protection and Engineered Safeguards Systems (e.g., the Auxiliary Feedwater System) in removing long-term decay heat and preventing excessive heatup of the RCS with possible boiling. As such, the assumptions used in this analysis are designed to minimize the energy removal capability of the system. The long-term analysis is performed using the RETRAN-02 computer code and the non-Statistical Core Design Methodology. The system response is calculated based on the following assumptions:

1. The plant is initially operating at 3479 MWt (rated thermal power plus measurement uncertainty). Parameter uncertainties are applied directly to pressurizer pressure, pressurizer level, flow, and RCS temperature initial conditions in the conservative direction.

2. A least negative Doppler temperature coefficient is used.

3. A most positive moderator temperature coefficient allowed by Technical Specifications is assumed to conservatively minimize negative feedback due to coolant heatup.

4. Core residual heat generation is based on the 1979 version of ANS-5.1 (Reference 5) plus 2 uncertainty. ANSI/ANS-5.1-1979 is a conservative representation of the decay energy release rates.

15.2 - 10 (09 OCT 2019)

Catawba Nuclear Station UFSAR Chapter 15

5. Reactor trip occurs on steam generator low-low level trip setpoint, assumed to be at 2.7%

(Unit 1) and 25.8% (Unit 2).

6. The pressurizer spray, power-operated relief valves, and safety valves are assumed to function normally to minimize the RCS pressure increase during the transient.

7. The worst single failure is assumed to be the turbine-driven auxiliary feedwater pump to minimize the auxiliary feedwater to be delivered to four steam generators.

8. A delay time of 60 seconds is assumed for the auxiliary feedwater actuation after the low-low steam generator level setpoint is reached.

9. Secondary system steam relief is achieved through the steam generator safety valves which are conservatively modeled such that maximum RCS coolant temperature is achieved.

10. The assumed steam generator tube plugging level is 5% (Unit 1) or 10% (Unit 2).

Short-Term Core Cooling Analysis Figure 15-257 through Figure 15-262 shows the significant plant parameters for the short-term core cooling analysis. The sequence of events is given in Table 15-18. A loss of main feedwater flow initiates the transient. The Reactor Coolant System temperatures (Figure 15-261) increase gradually due to the secondary side heatup before the reactor trips. As the temperature increases, the reactor coolant expands and surges into the pressurizer causing the level to increase (Figure 15-260). Pressurizer Pressure (Figure 15-259) increases until the PORV lift setpoints are reached. Pressurizer pressure then cycles with the opening and closing of the PORVs until after the reactor trips. The loss of main feedwater results in a decrease in the steam generator liquid inventory and level (Figure 15-262). The level decreases to the low-low level trip setpoint causing the reactor to trip. Prior to reactor trip neutron power (Figure 15-257) decreases slightly due to moderator and Doppler feedback. After the reactor trips neutron power decreases quickly, and RCS temperatures, pressurizer level, and pressure all decrease.

The steam pressure (Figure 15-258) increases steadily due to the loss of subcooled feedwater flow and a resulting increase in the conversion of steam generator liquid inventory to steam.

After the turbine trips, the steam line pressure increases immediately and causes several main steam safety valves to open.

The minimum transient DNBR is shown in Figure 15-263. The result is greater than the statistical core design (SCD) design DNBR limit of 1.45 when using the WRB-2M correlation.

Unit 1 Long-Term Core Cooling Analysis Figure 15-41 through Figure 15-43 show the significant plant parameters following a loss of normal feedwater for Unit 1 with FSGs. The calculated sequence of events for this analysis is listed in Table 15-18.

Before auxiliary feedwater flow starts, the plant response is similar to the short-term analysis.

After auxiliary feedwater flow starts, the MSSV banks cycle and cause oscillations in the steam line pressure Figure 15-42 (Part 2 of 2). The pressurizer pressure, pressurizer level, and cold and hot leg temperatures Figure 15-41 to Figure 15-42, Page 1 of 2 trend the steam line pressure until the end of the simulation. After the reactor and turbine trip, the steam generator inventory continues to deplete due to the post-trip boil of dissipating the stored energy and decay heat. The auxiliary feedwater flow matches the decay heat and pump heat and the steam generator inventory stabilizes at approximately 1290 seconds.

In conclusion, the long-term core cooling analysis has shown that the Auxiliary Feedwater System can mitigate the event and return the plant to a stabilized condition. Therefore, the long-term cooling capability for the loss of normal feedwater event has been demonstrated.

(09 OCT 2019) 15.2 - 11

UFSAR Chapter 15 Catawba Nuclear Station As shown in Figure 15-41 and Figure 15-42, the plant approaches a stabilized condition following reactor trip and auxiliary feedwater initiation. Plant procedures may be followed to further cool down the plant.

Unit 2 Long-Term Core Cooling Analysis Figure 15-264 through Figure 15-268 show the significant plant parameters for the long-term core cooling analysis for Unit 2 with Model D5 steam generators. The sequence of events is given in Table 15-18.

The overall transient responses of the long-term core cooling analysis are described as follows.

Before the reactor trips, the neutron power (Figure 15-264) already decreases slightly due to moderator and Doppler feedback. After the reactor trips, the neutron power decreases quickly as the control rods insert until the shutdown margin is reached. Then the decrease of reactor power becomes slower. As the primary side heats up, the pressurizer pressure (Figure 15-266) increases until the PORV lift setpoints are reached. Afterward the pressurizer pressure cycles with the opening and closing of the PORVs until after the reactor trips. As the loop average temperature increases, the RCS coolant expands and surges into the pressurizer causing the level to increase (Figure 15-267). After the reactor trips, the level begins to decrease as the loop average temperature decreases. The cold leg and hot leg temperatures (Figure 15-268) increase due to the secondary side heatup before the reactor trips. After the turbine trips, the cold leg temperature rapidly increases as the secondary side pressurizes. The hot leg temperature continues to increase until the amount of heat transferred to the steam generators offsets the amount heat generated in the reactor core. The steam pressure (Figure 15-265) increases steadily due to the conversion of steam generator liquid inventory to steam. After the turbine trips, the steam line pressure increases immediately and causes several main steam safety valves (MSSVs) to open. Prior to the auxiliary feedwater flow starting, the MSSV banks re-seat and lift according to the setpoints to cause the rising and falling of the steam line pressure (Figure 15-265). The pressurizer pressure, pressurizer level, cold and hot leg temperatures (Figure 15-266 to 268) trend the steam line pressure until the end of the simulation. The cold and hot leg temperatures are decreasing at the end of the simulation.

Following the loss of feedwater from full load, steam generator inventory decreases while the steam line pressure increases. After the reactor and turbine trip, the steam generator inventory will continue to deplete due to the post-trip boiloff as steam flow through the safety valves continues to dissipate the stored and generated heat, and the steam line pressure will immediately increase and cycle about the main safety valve lift setpoints. Only when the auxiliary feedwater flow provides sufficient heat removal capacity to match the decay heat and pump heat will steam generator inventory stop decreasing. This occurs at approximately 230 seconds as indicated by the RCS temperatures beginning to decrease.

In conclusion, the long-term core cooling analysis has shown that the Auxiliary Feedwater System can mitigate the event and return the plant to a stabilized condition. Therefore, the long-term cooling capability during the loss of normal feedwater event has been demonstrated.

15.2.7.3 Environmental Consequences Since steam dump to the condenser is assumed to be lost, heat removal from the secondary system would occur through the steam generator power-operated relief valves or safety valves.

Since no fuel damage is postulated to occur, radiological consequences resulting from this transient would be less severe than the steamline break accident analyzed in Section 15.1.5.3.

15.2 - 12 (09 OCT 2019)

Catawba Nuclear Station UFSAR Chapter 15 15.2.7.4 Conclusions Results of the analysis show that a loss of normal feedwater will not result in DNB occurring, and that the Auxiliary Feedwater System is capable of returning the plant to a stabilized condition.

15.2.8 Feedwater System Pipe Break 15.2.8.1 Identification of Causes and Accident Description A major feedwater line rupture is defined as a break in a feedwater line large enough to prevent the addition of sufficient feedwater to the steam generators to maintain shell side fluid inventory in the steam generators. For Unit 2, if the break is postulated inside containment in a feedline between the check valve and the steam generator, fluid from the steam generator may also be discharged through the break. For Unit 1, if the break is postulated in a feedline between the doghouse check valve and the steam generator, fluid from the steam generator may also be discharged through the break. Further, a break in these locations could preclude the subsequent addition of auxiliary feedwater to the affected steam generator. (A break upstream of the feedline check valve for Unit 2, or upstream of the doghouse check valve for Unit 1, would affect the Nuclear Steam Supply System only as a loss of feedwater. This case is covered by the evaluation in Section 15.2.7).

Depending upon the size of the break and the plant operating conditions at the time of the break, the break could cause either a RCS cooldown (by excessive energy discharge through the break) or a RCS heatup. Potential RCS cooldown resulting from a secondary pipe rupture is evaluated in Section 15.1.5. Therefore, only the RCS heatup effects are evaluated for a feedwater line rupture.

A feedwater line rupture reduces the ability to remove heat generated by the core from the RCS for the following reasons:

1. Feedwater flow to the steam generators is reduced. Since feedwater is subcooled, its loss may cause reactor coolant temperatures to increase prior to reactor trip.

2. Fluid in the steam generator may be discharged through the break, and would then not be available for decay heat removal after trip.

3. The break may be large enough to prevent the addition of any main feedwater after trip.

An Auxiliary Feedwater System is provided to ensure that adequate feedwater will be available such that:

1. No substantial overpressurization of the RCS shall occur.

2. Sufficient liquid in the RCS shall be maintained in order to provide adequate decay heat removal.

Section 10.4.9.1 contains a description of the Auxiliary Feedwater System interfaces.

The severity of the feedwater line rupture transient depends on a number of system parameters including break size, initial reactor power, and credit taken for the functioning of various control and safety systems. A number of cases of feedwater line break have been analyzed. Based on these analyses, it has been shown that the most limiting feedwater line ruptures are the double ended rupture of the largest feedwater line with no credit taken for the pressurizer heaters or power-operated relief valves (PORVs). This case is analyzed below.

The following provides the necessary protection for a main feedwater rupture:

(09 OCT 2019) 15.2 - 13

UFSAR Chapter 15 Catawba Nuclear Station

1. A reactor trip on any of the following conditions:

a. High pressurizer pressure.

b. Overtemperature T.

c. Low-low narrow range level in any steam generator.

d. Safety injection signal from 2/3 high containment pressure.

e. Safety injection signal from low pressurizer pressure.

(Chapter 7 contains a description of the actuation system).

2. An Auxiliary Feedwater System to provide an assured source of feedwater to the steam generators for decay heat removal. (Section 10.4.9.2 contains a description of the Auxiliary Feedwater System).

A major feedwater line rupture is classified as an ANS Condition IV event, a limiting fault. See Section 15.0 for a discussion of Condition IV events.

15.2.8.2 Analysis of Effects and Consequences Method of Analysis - Short Term Cooling Capability The short term core cooling (DNB) analysis is performed with the VIPRE-01 computer code (Reference 7) using the Statistical Core Design (SCD) methodology described in Reference 8.

Following the methodology outlined in Reference 9, the DNB analysis for the feedwater system pipe break accident is performed by modeling a complete loss of flow event (Section 15.3.2) initiated from an off-normal temperature condition due to a heatup from a feedwater system pipe break. The maximum amount of heatup prior to reactor trip is limited by the OTT reactor trip function, which is conservatively assumed in the analysis along with the flow coastdown associated with the loss of offsite power. No credit is taken for a reactor trip due to a high containment pressure safety injection actuation or the steam generator low-low narrow range reactor trip for the DNB analysis.

Method of Analysis - Long Term Cooling Capability A detailed analysis using the RETRAN-02 Code (Reference 6) is performed in order to determine the plant transient following a feedwater line rupture. The code models the plant thermal kinetics, RCS including natural circulation, pressurizer, steam generators and feedwater system, and computes pertinent variables including the pressurizer pressure, pressurizer water level, and reactor coolant average temperature.

Both the feedring steam generators(FSG) and the McGuire model D steam generators are analyzed. The model D analysis is performed such that the results bound the current Catawba Unit 2 model D5 steam generators. Given the different system response to a feedwater line break for the two units, both analyses are presented.

The cases analyzed assume a double ended rupture of the largest feedwater pipe at full power.

Major assumptions made in the long term core cooling analyses are as follows:

1. The plant is initially operating at 3479 MWt (rated thermal power plus measurement uncertainty).

2. Initial reactor coolant average temperature is 4.0°F above the nominal value, and the initial pressurizer pressure is 42 psi below its nominal value for Unit 2, and 60 psi above its nominal value for Unit 1.

15.2 - 14 (09 OCT 2019)

Catawba Nuclear Station UFSAR Chapter 15

3. No credit is taken for the pressurizer heaters or power-operated relief valves. Pressurizer spray is assumed operable.

4. Initial pressurizer level is at the nominal programmed value minus 9 percent; initial steam generator water level is 8.0 percent below the nominal value for Unit 2, and 10.0 percent above the nominal value for Unit 1.

5. Deleted.

6. Main feedwater flow to all steam generators is assumed to be lost at the time the break occurs (all main feedwater spills out through the break).

7. The worst possible break area is assumed. This maximizes the blowdown discharge rate following the time of trip, which maximizes the resultant heatup of the reactor coolant.

8. The flow exiting the steam generator through the break is determined using the Moody (saturated) and Extended Henry (subcooled) correlations for choked flow.

9. Reactor trip is assumed to be initiated on high containment pressure safety injection for Unit 2, and low-low steam generator level for Unit 1.

10. The Auxiliary Feedwater System is actuated by the high containment pressure safety injection signal for Unit 2, and the low-low steam generator level signal for Unit 1. The amount of auxiliary feedwater delivered to the faulted and intact steam generators is a function of the individual generator pressures. For Unit 1, no auxiliary feedwater is assumed to enter the faulted SG (auxiliary feedwater exits the steam generator through the feedring prior to removing any primary system energy). However, the auxiliary feedwater flow injected to the generator receiving flow from the same auxiliary feedwater pump is appropriately penalized for the increased flow to the faulted generator until the faulted generator is isolated. The faulted generator is assumed isolated at 30 minutes into the transient. For both units, a volume of 40 ft3 is assumed for each feedwater line which must be purged of relatively hot main feedwater before the cold (138°F) auxiliary feedwater enters the steam generators. For Unit 2, operator action is assumed to terminate auxiliary feedwater flow to the faulted generator two minutes into the transient. This increases the auxiliary feedwater supply to the three unaffected steam generators.

11. No credit is taken for charging or letdown.

12. Core residual heat generation is assumed based upon the 1979 version of ANS-5.1 (Reference 5). ANSI/ANS-5.1-1979 is a conservative representation of the decay energy release rates.

13. No credit is taken for the following potential protection logic signals to mitigate the consequences of the accident:

a. High pressurizer pressure.

b. Overtemperature T.

c. High pressurizer level.

14. For Unit 1 (FSG steam generator), 5% of the tubes in each steam generator are assumed to be plugged.

For Unit 2 (Model D5 steam generator), 15% of the tubes in each steam generator are assumed to be plugged. An evaluation was performed to support uniform plugging of the steam generator tubes up to a maximum level of 24% for any individual steam generator with a plant average maximum of 20%. The results of this evaluation show that the long term core cooling analysis is not sensitive to increased tube plugging levels.

(09 OCT 2019) 15.2 - 15

UFSAR Chapter 15 Catawba Nuclear Station

15. Safety injection actuation occurs upon the receipt of a high containment pressure signal for Unit 2, and a low pressurizer pressure signal for Unit 1. The amount of safety injection flow delivered to the Reactor Coolant System is a function of RCS pressure. Safety injection is terminated by procedure, with a conservatively short operator response time. For Unit 2, a high-high containment pressure signal generates a main steam line isolation signal which closes the steam line isolation valves in all four steam lines. For Unit 1, main steam line isolation is assumed to occur on low steam line pressure.

16. For Unit 1, the limiting case assumes no loss of offsite power (no-LOOP). For Unit 2, the reactor coolant pumps are tripped following a high-high pressure containment isolation signal at 15 seconds. The difference in the timing of the pump trip is not important to the results of the analysis.

17. Emergency operating procedures following a secondary system line rupture call for the isolation of feedwater flow spilling out the break of ruptured steam generator and to isolate the faulted generator.

18. Safety injection pumps are stopped if:

a. RCS pressure is stable or increasing,

b. Pressurizer water level is on span,

c. The RCS is adequately subcooled, and

d. Steam generator narrow range level indication exists in at least one steam generator or sufficient auxiliary feedwater is being injected into the steam generators to provide an adequate heat sink.

Subsequent to recovery of level in the intact steam generators, the plant operating procedures will be followed in cooling the plant to hot shutdown conditions.

Plant characteristics and initial conditions are further discussed in Section 15.0 (see Table 15-4).

No reactor control systems are assumed to function. The Reactor Protection System is required to function following a feedwater line rupture as analyzed here. No single active failure will prevent operation of this system. A discussion of ATWS considerations is presented in Reference 2.

The engineered safety systems assumed to function are the Auxiliary Feedwater System and the Safety Injection System. For the Auxiliary Feedwater System, the worst case configuration has been used, i.e., the turbine-driven auxiliary feedwater pump has been assumed to fail. Only one train of safety injection has been assumed to be available. A detailed description and analysis of the Safety Injection System is provided in Section 6.3. The Auxiliary Feedwater System is described in Section 10.4.9.1.

Following the trip of the reactor coolant pumps (for Unit 2) there will be a flow coastdown until flow in the loops reaches the natural circulation value. The natural circulation capability of the RCS has been shown in Section 15.2.6, for the loss of AC non-emergency power transient, to be sufficient to remove core decay heat following reactor trip. Pump coastdown characteristics are demonstrated in Section 15.3.2 for multiple reactor coolant pump trips.

Results The short term core cooling (DNB) capability is maintained as the MDNBR of 1.648 for Unit 1 and 1.579 for Unit 2 are well above the design DNBR limit (DDL) of 1.45 for RFA fuel.

15.2 - 16 (09 OCT 2019)

Catawba Nuclear Station UFSAR Chapter 15 For the Unit 2 long term core cooling analysis, the calculated plant parameters following a major feedwater line rupture are given in Figures 15-33, 15-34 and 15-45 through Figure 15-49.

These figures depict the long term core cooling analysis, for which the calculated sequence of events is given in Table 15-18.

Pressurizer pressure, shown in Figure 15-45, increases initially on the loss of heat sink, then decreases due to the blowdown of the faulted steam generator and the loss of heat input following reactor trip. As the faulted generator blows dry, the overcooling phase of the transient is terminated and pressure again begins to increase. The auxiliary feedwater system heat removal capacity turns this pressure increase around before the pressurizer safety valves are even challenged. The pressurizer safety valves relief capacity is adequate to maintain primary system pressure below 110 percent of design pressure.

Figure 15-48 shows that the Main Steam System pressure in the intact generators holding fairly steady near the safety valve lift setpoint, well below 110 percent of the design pressure.

The Unit 1 FSG long term core cooling analysis is presented in Figure 15-222 through Figure 15-228. These figures depict the long term core cooling analysis, for which the calculated sequence of events is given in Table 15-18.

The hot leg temperatures are shown in Figure 15-223. This figure illustrates the amount of margin to hot leg boiling, which is a precursor to loss of long-term core cooling. As shown, there is approximately 3°F of margin to the saturation temperature.

Pressurizer pressure and level are shown in Figure 15-224 and Figure 15-225. Pressurizer pressure initially decreases post-feedline break as the secondary system depressurizes. Once steam line isolation occurs, pressurizer pressure begins to increase as the secondary repressurizes. The pressure rise is terminated as the steam line safety valves (SMSVs) open and the secondary side pressure stops increasing. Subsequently, both pressure and level remain relatively steady for the remainder of the transient as the RCS temperature levels out.

The short term core cooling (DNB) capability has been demonstrated, thus ensuring the integrity of the core is maintained in the short term. The adequacy of the auxiliary feedwater system to remove decay heat, as shown by Figure 15-34 and Figure 15-223, ensures the integrity of the core in the long term.

15.2.8.3 Environmental Consequences No fuel failure following any main feedwater line break scenario is predicted. The activity in the reactor coolant for this accident would be the pre-existent activity up to the limits allowed by the technical specifications, and amplified by either a pre-existent iodine spike or a concurrent iodine spike. The radiological consequences of a main feedwater line break would not exceed the corresponding radiological consequences of a main steam line break, analyzed as reported in Section 15.1.5.3.

15.2.8.4 Conclusions Results of the analyses show that for the postulated feedwater line rupture, the assumed Auxiliary Feedwater System capacity is adequate to remove decay heat, to prevent overpressurizing the RCS, and to prevent uncovering the reactor core and that fuel integrity is maintained. Radioactivity doses from the postulated feedwater line rupture are bounded by those previously presented for the postulated steam line break. All applicable acceptance criteria are therefore met.

(09 OCT 2019) 15.2 - 17

UFSAR Chapter 15 Catawba Nuclear Station 15.2.9 References

1. Mangan, M. A., Overpressure Protection for Westinghouse Pressurized Water Reactors, WCAP-7769, Revision 1, June 1972.

2. Letter (NS-TMA-2182), T.M. Anderson (Westinghouse) to S. H. Hanaver (NRC), Dec 30, 1979.

3. Deleted Per 1997 Update

4. Deleted per 2000 Update.

5. ANSI/ANS-5-1-1979, American National Standard for Decay Heat in Light Water Reactors, August, 1979.

6. EPRI, "RETRAN-02: A Program for Transient Thermal-Hydraulic Analysis of Complex Fluid Flow Systems", EPRI NP-1850-CCM, Revision 6.1, June, 2007.

7. EPRI, "VIPRE-01: A Thermal-Hydraulic Code for Reactor Cores", EPRI NP-2511-CCM-A, Revision 4.2, June, 2007.

8. "Duke Power Company Thermal-Hydraulic Statistical Core Design Methodology", DPC-NE-2005-PA, Revision 4a, December, 2008.

9. "UFSAR Chapter 15 System Transient Analysis Methodology," DPC-NE-3002-A, Duke Power Company, Revision 4b, September, 2010.

10. Deleted Per 2006 Update.

11. "Oconee Nuclear Station, McGuire Nuclear Station, Catawba Nuclear Station, Thermal-Hydraulic Transient Analysis Methodology," DPC-NE-3000-PA, Revision 4a, July, 2009.

12. WCAP-15025-P, Modified WRB-2 Correlation, WRB-2M, for Predicting Critical Heat Flux in 17 x 17 Rod Bundles with Modified LPD Mixing Vane Grids, Westinghouse, February 1998.

THIS IS THE LAST PAGE OF THE TEXT SECTION 15.2.

15.2 - 18 (09 OCT 2019)

Catawba Nuclear Station UFSAR Chapter 15 15.3 Decrease in Reactor Coolant System Flow Rate A number of events have been postulated which could result in a decrease in Reactor Coolant System flow rate. Detailed analyses are presented for several such events which have been identified as limiting cases.

Discussions of the following events are presented in this section:

1. Partial loss of forced Reactor Coolant flow

2. Complete loss of forced Reactor Coolant flow

3. Reactor Coolant Pump shaft seizure (locked rotor)

4. Reactor Coolant Pump shaft break Item 1 is considered an ANS Condition II event, item 2 is considered an ANS Condition III event, and items 3 and 4 ANS Condition IV events. Section 15.0 contains a discussion of ANS classifications and applicable acceptance criteria.

15.3.1 Partial Loss of Forced Reactor Coolant Flow 15.3.1.1 Identification of Causes and Accident Description A partial loss of coolant flow accident can result from a mechanical or electrical failure in a reactor coolant pump, or from a fault in the power supply to the pump or pumps supplied by a reactor coolant pump bus. If the reactor is at power at the time of the accident, the immediate effect of loss of coolant flow is a rapid increase in the coolant temperature. This increase could result in DNB with subsequent fuel damage if the reactor is not tripped promptly.

Normal power for the pumps is supplied through individual buses connected to the generator and the offsite power system. When a generator trip occurs, the buses continue to be supplied from external power lines, and the pumps continue to circulate coolant through the core.

The necessary protection against a partial loss of coolant flow accident is provided by the low primary coolant flow reactor trip signal which is actuated in any reactor coolant loop by two out of three low flow signals. Above Permissive 8 (Refer to Table 7-2 for a discussion of permissives.), low flow in any loop will actuate a reactor trip. Between approximately 10 percent power (Permissive 7) and the power level corresponding to Permissive 8, low flow in any two loops will actuate a reactor trip. Above Permissive 7, two or more reactor coolant pump circuit breakers opening will actuate the corresponding undervoltage relays. This results in a reactor trip which serves as a backup to the low flow trip.

A partial loss of forced reactor coolant flow is classified as an ANS Condition II event, a fault of moderate frequency. See Section 15.0 for a discussion of Condition II events.

15.3.1.2 Analysis of Effects and Consequences Method of Analysis The loss of one pump with four loops in operation has been analyzed.

This transient is analyzed by two digital computer codes. First, the RETRAN-02 Code (Reference 1) is used to calculate the loop and core flow during the transient, the time of reactor trip based on the calculated flows, the nuclear power, heat flux, and the primary system pressure and temperature transients. Utilizing the WRB-2M heat flux correlation for (09 OCT 2019) 15.3 - 1

UFSAR Chapter 15 Catawba Nuclear Station Westinghouse RFA fuel (Reference 6), the VIPRE-01 Code (Reference 2) is used to calculate the DNBR during the transient based on the RETRAN-02 boundary conditions. The DNBR transients presented represent the minimum of the typical or thimble cell.

The analysis utilizes a McGuire RETRAN-02 model with a feedring steam generator (FSG).

However, input assumptions are conservatively chosen such that the analysis results bound Catawba Unit 1. The Catawba Model 2 steam generator (Unit 2) is also analyzed. Due to the similarity in the system response between the analyses, only the FSG analysis that is representative of Unit 1 is presented.

This accident is analyzed with the Statistical Core Design Methodology as described in Reference 4. Plant characteristics and initial conditions are discussed in Section 15.0 (see Table 15-4).

Initial Conditions Initial reactor power, pressure, flow, and RCS temperature are assumed to be at their nominal values. Uncertainties in initial conditions are included in the limit DNBR as described in Reference 7.

Reactivity Coefficients A least negative Doppler temperature coefficient is used.

The least negative moderator temperature coefficient is assumed since this results in the maximum core power during the initial part of the transient when the minimum DNBR is reached.

Flow Coastdown The flow coastdown calculated by RETRAN-02 is based on a momentum balance around each reactor coolant loop and across the reactor core. This momentum balance is combined with the continuity equation, a pump momentum balance and the pump characteristics and is based on high estimates of system pressure losses. The conservatism of the calculated flow coastdown is confirmed by comparison with the startup test data of the Catawba units.

Results Figure 15-55 through Figure 15-58, and Figure 15-269, show the transient response for the loss of one reactor coolant pump with four loops in operation. Figure 15-269 shows the DNBR to be always greater than the limit value.

Since DNB does not occur, the ability of the primary coolant to remove heat from the fuel rod is not greatly reduced. Thus, the average fuel and clad temperatures do not increase significantly above their respective initial values.

The calculated sequence of events tables for the case analyzed is shown on Table 15-20 The affected reactor coolant pump will continue to coast down, and the core flow will reach a new equilibrium value corresponding to the number of pumps still in operation. With the reactor tripped, a stable plant condition will eventually be attained. Normal plant shutdown may then proceed.

15.3.1.3 Environmental Consequences A partial loss of reactor coolant flow from full load would result in a reactor and turbine trip.

Assuming that the condenser is not available, steam release to atmosphere via MSSVs and/or SG PORVs may be required.

15.3 - 2 (09 OCT 2019)

Catawba Nuclear Station UFSAR Chapter 15 The radiological consequences resulting from steam release to atmosphere would be less severe than the steamline break event analyzed in Section 15.1.5.3, since fuel damage as a result of this transient is not postulated.

15.3.1.4 Conclusions The analysis shows that the DNBR will not decrease below the limit value at any time during the transient. Thus, no fuel or clad damage is predicted, and all applicable acceptance criteria are met.

15.3.2 Complete Loss of Forced Reactor Coolant Flow 15.3.2.1 15.3.2.1 Identification of Causes and Accident Description A complete loss of forced reactor coolant flow may result from a simultaneous loss of electrical supplies to all reactor coolant pumps. If the reactor is at power at the time of the accident, the immediate effect of loss of coolant flow is a rapid increase in the coolant temperature. This increase could result in DNB with subsequent fuel damage if the reactor were not tripped promptly.

Normal power for the reactor coolant pumps is supplied through buses from a transformer connected to the generator and through the offsite power system. Each pump is on a separate bus. When a generator trip occurs the buses continue to be supplied from external power lines and the pumps continue to supply coolant flow to the core.

The following signals provide the necessary protection against a complete loss of flow accident:

1. Reactor coolant pump power supply undervoltage or underfrequency.

2. Low reactor coolant loop flow.

The reactor trip on reactor coolant pump undervoltage is provided to protect against conditions which can cause a loss of voltage to all reactor coolant pumps, i.e., loss of offsite power. This function is blocked below approximately 10 percent power (Permissive 7).

The reactor trip on reactor coolant pump underfrequency is provided to trip the reactor for an underfrequency condition, resulting from frequency disturbances on the power grid. Since the underfrequency case is bounded by the undervoltage case, only the complete loss of flow due to reactor coolant pump undervoltage analysis is presented.

The reactor trip on low primary coolant loop flow is provided to protect against loss of flow conditions which affect only one reactor coolant loop. This function is generated by two out of three low flow signals per reactor coolant loop. Above Permissive 8, low flow in any loop will actuate a reactor trip. Between approximately 10 percent power (Permissive 7) and the power level corresponding to Permissive 8, low flow in any two loops will actuate a reactor trip.

A complete loss of forced reactor coolant flow is classified as an ANS Condition III event, an infrequent fault. See Section 15.0 for a discussion of Condition III events.

15.3.2.2 Analysis of Effects and Consequences The loss of four pumps with four loops in operation has been analyzed.

This transient is analyzed by two digital computer codes. The system thermal-hydraulic analysis is performed using RETRAN-02 (Reference 1). RETRAN-02 calculates the core inlet (09 OCT 2019) 15.3 - 3

UFSAR Chapter 15 Catawba Nuclear Station flow, core inlet temperature, core exit pressure and core average heat flux during the transient.

Utilizing the WRB-2M critical heat flux correlation for Westinghouse RFA fuel (Reference 6), the VIPRE-01 Code (Reference 2) is used to calculate the DNBR during the transient based on the RETRAN-02 boundary conditions.

The analysis utilizes a McGuire RETRAN-02 model with a feedring steam generator (FSG).

However, input assumptions are conservatively chosen such that the analysis results bound Catawba Unit 1. The Catawba Model 2 steam generator (Unit 2) is also analyzed. Due to the similarity in the system response between the analyses, only the FSG analysis that is representative of Unit 1 is presented.

The method of analysis and the assumptions made regarding initial operating conditions and reactivity coefficients are identical to those discussed in Section 15.3.1, except that following the loss of power supply to all pumps at power, a reactor trip is actuated by either reactor coolant pump power supply undervoltage or underfrequency. Table 15-4 summarizes input parameters and initial conditons used.

Results Figure 15-60 through Figure 15-64, and Figure 15-270, show the transient response for the loss of power to all reactor coolant pumps with four loops in operation. The reactor is assumed to be tripped on an undervoltage signal. Figure 15-270 shows the DNBR to be always greater than the limit value.

Since DNB does not occur, the ability of the primary coolant to remove heat from the fuel rod is not greatly reduced. Thus, the average fuel and clad temperatures do not increase significantly above their respective initial values.

The calculated sequence of events is shown on Table 15-20. The reactor coolant pumps will continue to coast down, and natural circulation flow will eventually be established, as demonstrated in Section 15.2.6. With the reactor tripped, a stable plant condition would be attained. Normal plant shutdown may then proceed.

15.3.2.3 Environmental Consequences A complete loss of reactor coolant flow from full load results in a reactor and turbine trip.

Assuming that the condenser is not available, steam release to atmosphere via MSSVs and/or SG PORVs dump would be required. The quantity of steam released would be the same as for a loss of offsite power. Since fuel damage is not postulated, the radiological consequences resulting from steam release to atmosphere would be less severe than the steamline break analyzed in Section 15.1.5.3.

15.3.2.4 Conclusions The analysis performed has demonstrated that for the complete loss of forced reactor coolant flow, the DNBR does not decrease below the limit value at any time during the transient. Thus, no fuel or clad damage is predicted, and all applicable acceptance criteria are met.

15.3.3 Reactor Coolant Pump Shaft Seizure (Locked Rotor) 15.3.3.1 Identification of Causes and Accident Description The accident postulated is an instantaneous seizure of a reactor coolant pump rotor such as is discussed in Section 5.4.1.3.4. Flow through the affected reactor coolant loop is rapidly reduced, leading to an initiation of a reactor trip on a low flow signal.

15.3 - 4 (09 OCT 2019)

Catawba Nuclear Station UFSAR Chapter 15 Following initiation of the reactor trip, heat stored in the fuel rods continues to be transferred to the coolant causing the coolant to expand. At the same time, heat transfer to the shell side of the steam generators is reduced, first because the reduced flow results in a decreased tube side film coefficient and then because the reactor coolant in the tubes cools down while the shell side temperature increases (turbine steam flow is reduced to zero upon plant trip). The rapid expansion of the coolant in the reactor core, combined with reduced heat transfer in the steam generators, causes an insurge into the pressurizer and a pressure increase throughout the Reactor Coolant System. The insurge into the pressurizer compresses the steam volume, actuates the automatic spray system, opens the power-operated relief valves, and opens the pressurizer safety valves, in that sequence. The three power-operated relief valves are designed for reliable operation and would be expected to function properly during the accident.

However, for conservatism, their pressure reducing effect as well as the pressure reducing effect of the spray is not included in the analysis.

A reactor coolant pump shaft seizure is classified as an ANS Condition IV event, a limiting fault.

See Section 15.0 for a discussion of Condition IV events.

15.3.3.2 Analysis of Effects and Consequences The reactor coolant pump shaft seizure transient has been analyzed for one loop seized with four loops in operation.

Method of Analysis Two digital computer codes are used to analyze this transient. The RETRAN-02 Code (Reference 1) is used to calculate the resulting loop and core flow transients following the pump seizure, the time of reactor trip based on the loop flow transients, the nuclear power following reactor trip, and the peak pressure. The thermal behavior of the fuel located at the core hot spot is investigated using the VIPRE-01 Code (Reference 2), which uses the core flow, core inlet temperature, core exit pressure and nuclear power calculated by RETRAN-02. Utilizing the WRB-2M critical heat flux correlation for Westinghouse RFA fuel (Reference 6), the VIPRE-01 code calculates the DNBR during the transient.

Both the feedring steam generator (FSG) and the Unit 2 Model D5 steam generator are analyzed. Due to the similarity in the system response between the analyses, only the FSG analysis that is representative of Catawba Unit 1 is presented. Table 15-4 summarizes input parameters and initial conditions used.

Evaluation of the Pressure Transient: At the beginning of the postulated locked rotor accident, i.e., at the time the shaft in one of the reactor coolant pumps is assumed to seize, the plant is assumed to be in operation under the most adverse steady state operating condition, i.e.,

maximum guaranteed steady state thermal power, maximum steady state pressure, and maximum steady state coolant average temperature. Plant characteristics and initial conditions are further discussed in Section 15.0.

For the peak pressure evaluation, the initial pressure is conservatively estimated as 60 psi above the nominal pressure of 2250 psia to allow for errors in the pressurizer pressure measurement and control channels and for operator action to establish elevated pressure during pressurizer boron concentration equalization. This is done to obtain the highest possible rise in the coolant pressure during the transient. The pressure response shown in Figure 15-275 is at the point in the Reactor Coolant System having the maximum pressure.

After pump seizure, the neutron flux is rapidly reduced by control rod insertion. Rod motion is assumed to begin one second after the flow in the affected loop reaches 83.5 percent of nominal flow. No credit is taken for the pressure reducing effect of the pressurizer relief valves, (09 OCT 2019) 15.3 - 5

UFSAR Chapter 15 Catawba Nuclear Station pressurizer spray, steam dump or controlled feedwater flow after plant trip. Although these operations are expected to occur and would result in a lower peak pressure, an additional degree of conservatism is provided by ignoring their effect. The pressurizer safety valves for the Catawba Unit 1 analysis pop open at a pressure that is 3% above the nominal lift setpoint (Reference 8). The pressurizer safety valves for the Catawba Unit 2 analysis are full open when pressurizer pressure increases to 3% above the nominal lift setpoint. In both analyses, the modeling of the pressurizer safety valves was inconsequential because peak pressurizer pressure was well below the pressurizer safety valve lift setpoint used in the analysis. Their capacity for steam relief is as described in Section 5.4.13.

Evaluation of DNB in the Core During the Accident: To determine if DNB occurs in the core following this accident, a VIPRE-01 analysis of the consequences with respect to fuel rod thermal transients is performed. The Statistical Core Design Methodology as described in Reference 4 is employed for the DNB evaluation. Both offsite power maintained (OSPM) and offsite power lost (OSPL) cases are analyzed. Plant characteristics and initial conditions are discussed in Initial Conditions and Power Distributions assumed in the Accident Analyses. The result of this VIPRE-01 analysis is a power peaking limit which yields a DNBR equal to the limit value. All fuel pins exceeding this peaking limit are assumed to undergo DNB and subsequently fail.

For this analysis, the initial value of the pressure is used throughout the transient since it is the most conservative with respect to DNBR calculation.

Results The transient results for the DNB calculation are shown in Figure 15-66, and Figure 15-192 through Figure 15-196, and Figures15-271 through 15-275. With the exception of the primary system pressure, the transient results of the locked rotor peak pressure analysis are virtually identical to those from the DNBR calculation. The peak Reactor Coolant System pressure from the peak pressure analysis is presented in Figure 15-275. The peak Reactor Coolant System pressure reached during the transient is less than that which would cause stresses to exceed the faulted condition stress limits.

The calculated sequence of events is shown on Table 15-20. Figure 15-195 shows that the core flow rapidly reaches a new equilibrium value. With the reactor tripped, a stable plant condition will eventually be attained. Normal plant shutdown may then proceed.

15.3.3.3 Environmental Consequences No fuel clad damage is predicted following any locked rotor scenario. The activity in the reactor coolant with this accident would be pre-existent activity up to the limits allowed by the plant technical specifications, and amplified by either a pre-existent iodine spike or a concurrent iodine spike. The radiological consequences of this accident would not exceed those for the main steam line break, analyzed as reported in Section 15.1.5.3.

15.3.3.4 Conclusions

1. Since the peak Reactor Coolant System pressure reached during any of the transients is less than that which would cause stresses to exceed the faulted condition stress limits, the integrity of the primary coolant system is not endangered.

2. No DNB is predicted to occur for this event, the extent of which is verified for each reload to not exceed the maximum allowed by the dose analysis.

15.3 - 6 (09 OCT 2019)

Catawba Nuclear Station UFSAR Chapter 15 15.3.4 Reactor Coolant Pump Shaft Break 15.3.4.1 Identification of Causes and Accident Description The accident is postulated as an instantaneous failure of a reactor coolant pump shaft, such as discussed in Section 5.4. Flow through the affected reactor coolant loop is rapidly reduced, though the initial rate of reduction of coolant flow is greater for the reactor coolant pump shaft seizure event. Reactor trip is initiated on a low flow signal in the affected loop. Following initiation of the reactor trip, heat stored in the fuel rods continues to be transferred to the coolant causing the coolant to expand. At the same time, heat transfer to the shell side of the steam generators is reduced, first because the reduced flow results in a decreased tube side film coefficient and then because the reactor coolant in the tubes cools down while the shell side temperature increases (turbine steam flow is reduced to zero upon plant trip). The rapid expansion of the coolant in the reactor core, combined with reduced heat transfer in the steam generators, causes an insurge into the pressurizer and a pressure increase throughout the Reactor Coolant System. The insurge into the pressurizer compresses the steam volume, actuates the automatic spray system, opens the power-operated relief valves, and opens the pressurizer safety valves, in that sequence. The three power-operated relief valves are designed for reliable operation and would be expected to function properly during the accident.

However, for conservatism, their pressure reducing effect as well as the pressure reducing effect of the spray is not included in the analysis.

A reactor coolant pump shaft break is classified as an ANS Condition IV event, a limiting fault.

See Section 15.0 for a discussion of Condition IV events.

15.3.4.2 Conclusions The consequences of a reactor coolant pump shaft break are similar to those calculated for the locked rotor incident (see Section 15.3.3). The bounding results for the locked rotor transients presented in Figure 15-66 and Figure 15-192 thru Figure 15-196 and summarized in Table 15-20 are also applicable to the reactor coolant pump shaft break. With a failed shaft, the impeller could conceivably be free to spin in a reverse direction as opposed to being fixed in position as assumed in the locked rotor analysis. However, the net effect on core flow is negligible, resulting in only a slight decrease in the end point (steady state) core flow. For both the shaft break and locked rotor incidents, reactor trip occurs very early in the transient.

15.3.5 References

1. RETRAN-02: A Program for Transient Thermal-Hydraulic Analysis of Complex Fluid Flow Systems, EPRI NP-1850-CCM, Revision 6.1, June, 2007.

2. VIPRE-01: A Thermal-Hydraulic Code for Reactor Cores, EPRI NP-2511-CCM-A, Revision 4.2, June, 2007.

3. Deleted Per 2001 Update.

4. Duke Power Company Thermal-Hydraulic Statistical Core Design Methodology, DPC-NE-2005-PA, Revision 4A, December, 2008.

5. Deleted Per 2006 Update.

6. WCAP-15025-P, "Modified WRB-2 correlation, WRB-2M, for Predicting Critical Heat Flux in 17x17 Rod Bundles with Modified LPD Mixing Vane Grids," Westinghouse, February 1998.

(09 OCT 2019) 15.3 - 7

UFSAR Chapter 15 Catawba Nuclear Station

7. Duke Power Company Westinghouse Fuel Transition Report, DPC-NE-2009-PA, Revision 3, September, 2010.

8. DPC-NE-3002-A, "UFSAR Chapter 15, System Transient Analysis Methodology," Revision 4b, September, 2010.

THIS IS THE LAST PAGE OF THE TEXT SECTION 15.3.

15.3 - 8 (09 OCT 2019)

Catawba Nuclear Station UFSAR Chapter 15 15.4 Reactivity and Power Distribution Anomalies A number of events have been postulated which could result in reactivity and power distribution anomalies. Detailed analyses are presented for several such events which have been identified as limiting cases.

Discussions of the following events are presented in this section:

1. Uncontrolled Rod Cluster Control Assembly Bank Withdrawal from a Subcritical or Low Power Startup Condition

2. Uncontrolled Rod Cluster Control Assembly Bank Withdrawal at Power

3. Rod Cluster Control Assembly Misoperation

4. Startup of an Inactive Reactor Coolant Pump at an Incorrect Temperature

5. A Malfunction or Failure of the Flow Controller in a BWR Loop that Results in an Increased Reactor Coolant Flow Rate

6. Chemical and Volume Control System Malfunction that Results in a Decrease in Boron Concentration in the Reactor Coolant

7. Inadvertent Loading and Operation of a Fuel Assembly in an Improper Position

8. Spectrum of Rod Cluster Control Assembly Ejection Accidents

9. Spectrum of Rod Drop Accidents (BWR)

Items 1, 2, 4, and 6 are considered to be ANS Condition II events, Item 7 an ANS Condition III event, and item 8 an ANS Condition IV event. Item 3 entails both Condition II and III events.

Section 15.0 contains a discussion of ANS classifications and applicable acceptance criteria.

15.4.1 Uncontrolled Rod Cluster Control Assembly Bank Withdrawal From a Subcritical or Low Power Startup Condition 15.4.1.1 Identification of Causes and Accident Description A rod cluster control assembly (RCCA) withdrawal accident is defined as an uncontrolled addition of reactivity to the reactor core caused by withdrawal of RCCA's resulting in a power excursion. Such a transient could be caused by a malfunction of the Rod Control System. This could occur with the reactor either subcritical, at hot zero power or at power. The at power case is discussed in Section 15.4.2.

Although the reactor is normally brought to power from a subcritical condition by means of RCCA withdrawal, initial startup procedures with a clean core call for boron dilution. The maximum rate of reactivity increase in the case of boron dilution is less than that assumed in this analysis (see Section 15.4.6).

The RCCA drive mechanisms are wired into preselected bank configurations which are not altered during reactor life. These circuits prevent the RCCA's from being automatically withdrawn in other than their respective banks. Power supplied to the banks is controlled such that no more than two banks can be withdrawn at the same time and in their proper withdrawal sequence. The RCCA drive mechanisms are of the magnetic latch type and coil actuation is sequenced to provide variable speed travel. The maximum reactivity insertion rate analyzed in the detailed plant analysis is that occurring with the simultaneous withdrawal of the combination of two sequential control banks having the maximum combined worth at maximum speed.

(09 OCT 2019) 15.4 - 1

UFSAR Chapter 15 Catawba Nuclear Station The neutron flux response to a continuous reactivity insertion is characterized by a very fast rise terminated by the reactivity feedback effect of the negative Doppler coefficient. This self limitation of the power excursion is of primary importance since it limits the power to a tolerable level during the delay time for protective action. Should a continuous RCCA withdrawal accident occur, the transient will be terminated by the following automatic features of the Reactor Protection System:

1. Source Range High Neutron Flux Reactor Trip- actuated when either of two independent source range channels indicates a neutron flux level above a preselected manually adjustable setpoint. This trip function may be manually bypassed only after an intermediate range flux channel indicates a flux level above a specified level. It is automatically reinstated when both intermediate range channels indicate a flux level below a specified level.

2. Intermediate Range High Neutron Flux Reactor Trip- actuated when either of two independent intermediate range channels indicates a flux level above a preselected manually adjustable setpoint. This trip function may be manually bypassed only after two of the four power range channels are reading above approximately 10 percent of full power and is automatically reinstated when three of the four channels indicate a power level below this value.

3. Power Range High Neutron Flux Reactor Trip (Low Setting)- actuated when two out of the four power range channels indicate a power level above approximately 25 percent of full power. This trip function may be manually bypassed when two of the four power range channels indicate a power level above approximately 10 percent of full power and is automatically reinstated only after three of the four channels indicate a power level below this value.

4. Power Range High Neutron Flux Reactor Trip (High Setting)- actuated when two out of the four power range channels indicate a power level above a preset setpoint. This trip function is always active.

5. High Nuclear Flux Rate Reactor Trip- actuated when the positive rate of change of neutron flux on two out of four nuclear power range channels indicate a rate above the preset setpoint. This trip function is always active.

In addition, control rod stops on high intermediate range flux level (one of two) and high power range flux level (one out of four) serve to discontinue rod withdrawal and prevent the need to actuate the intermediate range flux level trip and the power range flux level trip, respectively.

An uncontrolled RCCA bank withdrawal from a subcritical or low power startup condition is classified as an ANS Condition II event, a fault of moderate frequency. See Section 15.0 for a discussion of Condition II events.

15.4.1.2 Analysis of Effects and Consequences Method of Analysis The analysis of the uncontrolled RCCA bank withdrawal from zero power consists of a RETRAN-02 (Reference 1) plant transient simulation and a VIPRE-01 (Reference 6) core thermal-hydraulic analysis using the Statistical Core Design Methodology (Reference 8). The reactor power transient initiated by the uncontrolled rod withdrawal is modeled using point kinetics. Moderator and Doppler feedback and control rod insertion following reactor trip are modeled. Primary and secondary systems are modeled in detail. Boundary conditions from the RETRAN analysis are input to VIPRE to determine the detailed thermal-hydraulic response of the reactor, including the hot function. The RETRAN-02 analysis also predicts a separate peak 15.4 - 2 (09 OCT 2019)

Catawba Nuclear Station UFSAR Chapter 15 primary system pressure during the transient. The minimum transient DNBR is determined using the WRB-2M correlation for the Westinghouse RFA fuel (Reference 23).

Both the feedring steam generators (FSG) and the Catawba Unit 2 Model D5 steam generators are analyzed. Due to the similarity in the system response between the analyses, only the FSG analysis that is representative of Catawba Unit 1 is presented.

Plant characteristics and initial conditions for this accident are discussed in Section 15.0 (see Table 15-4). In order to give conservative results for the zero power bank withdrawal accident, the following assumptions are made:

1. Since the magnitude of the power peak reached during the initial part of the transient for any given rate of reactivity insertion is strongly dependent on the Doppler coefficient, conservatively low values as a function of fuel average temperature are used. At zero power a Doppler coefficent of -1.50 pcm/°F is used. This value decreases linearly to a value of -

1.20 pcm/°F at full power.

2. Contribution of the moderator reactivity coefficient is negligible during the initial part of the transient because the heat transfer time between the fuel and the moderator is much longer than the neutron flux response time. However, after the initial neutron flux peak, the succeeding rate of power increase is affected by the moderator reactivity coefficient. A highly conservative initial value equivalent to the Technical Specification MTC vs. power level relationship is used. Between zero and 70% power, the MTC is +7 pcm/°F. This initial value decreases linearly to zero at 100% power. The MTC is modeled as a density coefficient based on the core average moderator temperature.

3. The reactor is assumed to be at hot zero power. This assumption is more conservative than that of a lower initial system temperature. The higher initial system temperature yields a large fuel-water heat transfer coefficient, larger specific heats, and a less negative (smaller absolute magnitude) Doppler coefficient, all of which tend to reduce the Doppler feedback effect thereby increasing the neutron flux peak. The initial effective multiplication factor is assumed to be 1.0 since this results in the worst nuclear power transient.

4. Reactor trip is assumed to be initiated by power range high neutron flux (low setting). The most adverse combination of instrument and setpoint errors, as well as delays for trip signal actuation and rod cluster control assembly release, is taken into account. The nominal high power range flux low setpoint is 25% FP. Due to the effect of control rod motion on the excore flux signal, a conservatively high setpoint of 116.1% is used in the analysis. Since the rise in the neutron flux is so rapid, the effect of errors in the trip setpoint on the actual time at which the rods are released is negligible. In addition, the reactor trip insertion characteristic is based on the assumption that the highest worth rod cluster control assembly is stuck in its fully withdrawn position. The worth withdrawn during the transient is reinserted during the reactor trip. See Section 15.0 for rod cluster control assembly insertion characteristics.

5. The maximum positive reactivity insertion rate assumed is greater than that for the simultaneous withdrawal of the combination of the two sequential control banks having the greatest combined worth when at maximum design speed (45 inches/minute). Control rod drive mechanism design is discussed in Section 3.9.4.

6. The most limiting axial and radial power shapes, associated with having the two highest combined worth banks in their high worth position, are assumed in the DNB analysis.

(09 OCT 2019) 15.4 - 3

UFSAR Chapter 15 Catawba Nuclear Station

7. The initial power level is assumed to be below the power level expected for any shutdown condition (10-9 of nominal power). This combination of highest reactivity insertion rate and lowest initial power produces the highest peak heat flux.

8. Three reactor coolant pumps are assumed to be in operation. This is conservative with respect to DNB. The peak pressure analysis assumes four reactor coolant pumps in operation, which is more limiting than the three pump case.

9. The steam generator secondary is modeled as a single control volume and uses the RETRAN-02 local conditions heat transfer option. This approach is consistent with the zero power initial condition. The steam generator tube plugging level assumed is 0% for the DNB case, and 5% for the peak pressure analysis.

Deleted per 2006 Update.

Results Figure 15-67 through Figure 15-72 show the transient response following an uncontrolled bank withdrawal from 1.0E-9 rated power. The sequence of events is given in Table 15-23. The total reactivity is shown in Figure 15-67. The reactor goes prompt critical before Doppler feedback terminates the power excursion. Rod insertion on reactor trip ensures the shutdown of the reactor. The neutron power transient is shown in Figure 15-68 and the resulting thermal power in Figure 15-69. The thermal power is the key result with respect to determining the approach to DNB. The fuel average temperature and the hot and cold leg temperatures are shown in Figure 15-70 and Figure 15-71, respectively. These temperatures are well below the nominal full power values. The minimum transient DNBR is shown in Figure 15-72. This figure shows the DNBR is always greater than the limit value.

The transient results of the controlled RCCA bank from low power peak pressure analysis are similar to those from the DNBR calculation. The peak Reactor Coolant System pressure (2603.6 psig) from the peak pressure analysis is presented in Figure 15-203.

15.4.1.3 Environmental Consequences There will be no radiological consequences associated with an uncontrolled rod cluster assembly bank withdrawal from a subcritical or low power start up condition event since radioactivity is contained within the fuel rods and Reactor Coolant System within design limits.

15.4.1.4 Conclusions In the event of a RCCA withdrawal accident from the subcritical condition, the core and the Reactor Coolant System are not adversely affected, since the combination of thermal power and the coolant temperature result in a DNBR greater than the limit value. Thus, no fuel or clad damage is predicted as a result of DNB.

15.4.2 Uncontrolled Rod Cluster Control Assembly Bank Withdrawal at Power 15.4.2.1 Identification of Causes and Accident Description Uncontrolled rod cluster control assembly (RCCA) bank withdrawal at power results in an increase in the core heat flux. Since the heat extraction from the steam generator lags behind the core power generation until the steam generator pressure reaches the relief or safety valve setpoint, there is a net increase in the reactor coolant temperature. Unless terminated by manual or automatic action, the power mismatch and resultant coolant temperature rise could eventually result in DNB. Therefore, in order to avert damage to the fuel clad the Reactor 15.4 - 4 (09 OCT 2019)

Catawba Nuclear Station UFSAR Chapter 15 Protection System is designed to terminate any such transient before the DNBR falls below the limit value.

The automatic features of the Reactor Protection System which prevent core damage following the postulated accident include the following:

1. Reactor trip is actuated if any two out of four power range neutron flux instrumentation channels exceed an overpower setpoint.

2. Reactor trip is actuated if any two out of four T channels exceed an overtemperature T setpoint. This setpoint is automatically varied with axial power imbalance, coolant temperature and pressure to protect against DNB.

3. Reactor trip is actuated if any two out of four T channels exceed an overpower T setpoint.

This setpoint is automatically varied with axial power imbalance, coolant temperature and coolant temperature increase rate to ensure that the allowable heat generation rate (kw/ft) is not exceeded.

4. A reactor trip is actuated if any two out of four pressurizer pressure channels exceed a fixed setpoint. This set pressure is less than the set pressure for the pressurizer safety valves.

5. A reactor trip is actuated if any two out of three pressurizer level channels exceed a fixed setpoint when the reactor power is above approximately 10 percent (Permissive-7).

In addition to the above listed reactor trips, there are the following RCCA withdrawal blocks:

1. High neutron flux (one out of four power range)

2. Overpower T (two out of four)

3. Overtemperature T (two out of four)

The manner in which the combination of overpower and overtemperature T trips provide protection over the full range of Reactor Coolant System conditions is described in Chapter 7.

Figure 15-1 presents allowable reactor coolant loop average temperature and T for the design power distribution and flow as a function of primary coolant pressure. The boundaries of operation defined by the overpower T trip and the overtemperature T trip are represented as protection lines on this diagram. The protection lines are drawn to include all adverse instrumentation and setpoint errors so that under nominal conditions trip would occur well within the area bounded by these lines. The utility of this diagram is in the fact that the limit imposed by any given DNBR can be represented as a line. The DNB lines represent the locus of conditions for which the DNBR equals the limit value. All points below and to the left of a DNB line for a given pressure have a DNBR greater than the limit value. The diagram shows that DNB is prevented for all cases if the area enclosed with the maximum protection lines is not traversed by the applicable DNBR line at any point.

The area of permissible operation (power, pressure and temperature) is bounded by the combination of reactor trips: high neutron flux (fixed setpoint), high pressure (fixed setpoint),

low pressure (fixed setpoint), and overpower and overtemperature T (variable setpoints).

The uncontrolled RCCA bank withdrawal from full power is classified as an ANS Condition II event, a fault of moderate frequency. See Section 15.0 for a discussion of Condition II events.

15.4.2.2 Analysis of Effects and Consequences Method of Analysis (09 OCT 2019) 15.4 - 5

UFSAR Chapter 15 Catawba Nuclear Station The transient is analyzed by the RETRAN-02 Code (Reference 1.) This code simulates the neutron kinetics, Reactor Coolant System, pressurizer, pressurizer relief and safety valves, pressurizer spray, steam generator, and steam generator safety valves. The code computes pertinent plant variables including temperature, pressures, and power level.

The analysis utilizes a RETRAN-02 model with a feedring steam generator (FSG). Input assumptions are conservatively chosen such that the analysis results bound Catawba Unit 1.

The Catawba Unit 2 Model D5 steam generator is also analyzed. Due to the similarity in the system response between the analyses, only the FSG analysis that is representative of Catawba Unit 1 is presented.

The DNBR calculation for this accident is performed using the Statistical Core Design Methodology and VIPRE-01 Code as described in References 6 and 8. Utilizing the WRB-2M correlation for the Westinghouse RFA fuel (Reference 23), the VIPRE-01 code calculates the DNBR during the transient based on the RETRAN-02 boundary conditons. Plant characteristics and initial conditions are discussed in Section 15.0 (see Table 15-4). In order to obtain conservative results for an uncontrolled rod withdrawal at power accident, the following assumptions are made:

1. Initial reactor power, pressure, flow, and RCS temperatures are assumed to be at their nominal values. Uncertainties in initial conditions are included in the limit DNBR as described in Reference 8.

2. Reactivity Coefficients - Two cases are analyzed:

a. The most positive moderator temperature coefficient (MTC) allowed by the Technical Specifications is implemented as a least positive moderator density coefficient (MDC). A Doppler temperature coefficient (DTC) variable with fuel temperature is used in the analysis.

b. A conservatively positive MTC, corresponding to end of core life (EOL), is implemented as a least positive MDC. A DTC variable with fuel temperature is used.

3. The reactor trip on high neutron flux is assumed to be actuated at a conservative value of 113.2 percent of nominal full power. The calculated neutron flux is conservatively modified to account for transient changes in the flux incident on the excore detectors. The T trips include all adverse instrumentation and setpoint errors. The delays for trip actuation are assumed to be the maximum values.

4. The RCCA trip insertion characteristic is based on the assumption that the highest worth assembly is stuck in its fully withdrawn position.

5. The maximum positive reactivity insertion rate is greater than that for the simultaneous withdrawal of the combinations of the two control banks having the maximum combined worth at maximum speed.

6. The high pressurizer pressure trip function setpoint is assumed to be 2415 psig.

7. The pressurizer safety valves are modeled with opening and closing characteristics which minimize the pressurizer pressure.

8. The steam line safety valves are modeled with opening and closing characteristics which maximize transient secondary side pressure and minimize transient primary-to-secondary heat transfer.

15.4 - 6 (09 OCT 2019)

Catawba Nuclear Station UFSAR Chapter 15

9. Analyses are performed for initial power levels of 10% power (Case 1), 50% power (Case 3),

98% power (Case 4), and 100% power (Case 5). The 10%, 50% and 98% power cases assume 99% of the minimum RCS flow required by Technical Specifications.

The maximum RCS pressure analysis (Case 2) is performed utilizing the RETRAN-02 code with the method that accounts for uncertainties directly in initial power, flow and RCS temperature.

The following assumptions are made:

1. The initial power level is 8% which includes uncertainty.

2. The initial pressurizer pressure is the nominal value. Uncertainty in the initial pressurizer pressure is accounted for in the high pressure reactor trip setpoint.

3. A bounding high steam generator tube plugging value is assumed to maximize the RCS pressure.

4. The high pressurizer pressure trip setpoint is assumed to be 2415 psig.

5. Parts 2, 3, 4, 5 and 8 in the DNBR analysis above are also applied.

6. The pressurizer safety valves are modeled with opening and closing characteristics which maximize the pressurizer pressure.

The effect of RCCA movement on the axial core power distribution is accounted for by causing a decrease in overtemperature T trip setpoint proportional to a decrease in margin to DNB as described in Reference 12.

A discussion of ATWS considerations is presented in Reference 5.

Results The transient response for a slow RCCA withdrawal from 10% power is shown in Figure 15-73 through Figure 15-76. With the exception of the primary system pressure, the transient results of the RCCA maximum RCS pressure analysis are virtually identical to those from the DNBR analysis. The maximum RCS pressure from the maximum pressure analysis (BOL) is presented in Figure 15-204. Reactor trip on the high flux setpoint occurs after a significant rise in reactor power. The minimum DNBR is greater than the limit value.

Figure 15-277 shows minimum DNBR as a function of reactivity insertion rate from initial 10%

power operation for BOL reactivity feedback. It can be seen that three reactor trip functions provide protection over the whole range of reactivity insertion rates. These are the high neutron flux, high pressurizer pressure and overtemperature T functions. The minimum DNBR is slightly lower than the design limit. As decribed in Chapter 15.0, this minimum DNBR point establishes the statepoint conditions in which the event is analyzed to ensure that the DNB design basis is met for each reload core.

Figure 15-278, Figure 15-279, and Figure 15-281 show minimum DNBR as a function of reactivity insertion rate for RCCA withdrawal incidents starting at 50, 100 and 98 percent power, respectively. The results are similar to the 10 percent power case. In all cases the DNBR does not fall below the corresponding limit values.

The shape of the curves of minimum DNB ratio versus reactivity insertion rate in the referenced figures is due both to reactor core and coolant system transient response and to protection system action in initiating a reactor trip.

Referring to Figure 15-277, for example, it is noted that:

1. For high reactivity insertion rates reactor trip is initiated by the high neutron flux trip for the BOL feedback cases. The neutron flux level in the core rises rapidly for these insertion (09 OCT 2019) 15.4 - 7

UFSAR Chapter 15 Catawba Nuclear Station rates while core heat flux and coolant system temperature lag behind due to the thermal capacity of the fuel and coolant system fluid. Thus, the reactor is tripped prior to significant increase in heat flux or water temperature with resultant high minimum DNB ratios during the transient. As reactivity insertion rate decreases, core heat flux and coolant temperatures can remain more nearly in equilibrium with the neutron flux; minimum DNB ratio during the transient thus decreases with decreasing insertion rate for the rate range in which the high flux trip provides primary protection.

2. The overtemperature T reactor trip circuit initiates a reactor trip when measured coolant loop T exceeds a setpoint based on measured Reactor Coolant System average temperature and pressure. This trip circuit is described in detail in Section 7.2.1. It is important to note that the loop T and average temperature contributions to the circuit are lead-lag compensated in order to decrease the effect of the thermal capacity of the Reactor Coolant System in response to power increases.

3. With a further decrease in reactivity insertion rate, assuming pressurizer pressure control operable, the overtemperature T and high pressure trips become equally effective in terminating the transient. For these reactivity insertion rates the effectiveness of the overtemperature T trip increases (in terms of increased minimum DNB ratio) due to the fact that with lower insertion rates the power increase rate is slower, the rate of increase of average coolant temperature is slower and the system lags and delays become less significant.

Deleted per 2006 Update.

4. For even slower reactivity insertion rates, the steam line safety valves might lift prior to reactor trip. Whether this occurs depends on several factors, including the steam line pressure at the beginning of the transient, the safety valve setpoints, the amount and type of reactivity feedback, and the availability of the steam line PORVs. The effect of steam line safety valve and PORV lift depends upon the reactivity insertion rate and feedback. In general, valve lift tends to reduce the rate of increase of reactor vessel average temperature, which is a component of the overtemperature T trip setpoint equation. For this transient, the lead/lag compensation in this equation causes this increasing temperature to decrease the setpoint, making a trip more likely. Even if no credit is taken for this compensation, a conservative assumption which bounds the effect of valve lift, the maneuvering analysis described in Reference 12 ensures that the minimum DNBR remains above the limit value for insertion rates slow enough to trip on overtemperature T.

Since the RCCA withdrawal at power incident is an overpower transient, the fuel temperatures rises during the transient until after reactor trip occurs. For high reactivity insertion rates, the overpower transient is fast with respect to the fuel rod thermal time constant, and the core heat flux lags behind the neutron flux response. Due to this lag, the peak core heat flux does not exceed 113.2 percent of its nominal value (i.e., the high neutron flux trip setpoint assumed in the analysis). Taking into account the effect of the RCCA withdrawal on the axial core power distribution, the peak fuel temperature will still remain below the fuel melting temperature.

For slow reactivity insertion rates, the core heat flux remains more nearly in equilibrium with the neutron flux. The overpower transient is terminated by the overtemperature T reactor trip before a DNB condition is reached. The peak heat flux again is maintained below 113.2 percent of its nominal value. Taking into account the effect of the RCCA withdrawal on the axial core power distribution, the peak centerline temperature will remain below the fuel melting temperature.

15.4 - 8 (09 OCT 2019)

Catawba Nuclear Station UFSAR Chapter 15 Since DNB does not occur at any time during the RCCA withdrawal at power transient, the ability of the primary coolant to remove heat from the fuel rod is not reduced. Thus, the fuel cladding temperature does not rise significantly above its initial value during the transient.

The calculated sequence of events for the 10% initial power cases for this accident is shown on Table 15-23. With the reactor tripped, the plant eventually returns to a stable condition. The plant may subsequently be cooled down further by following normal plant shutdown procedures.

15.4.2.3 Environmental Consequences The reactor trip causes a turbine trip, and heat is removed from the secondary system through the steam generator power relief valves or safety valves. Since no fuel damage is postulated to occur, the radiological consequences associated with atmospheric steam release from this event would be less severe than the steamline break accident analyzed in Section 15.1.5.

15.4.2.4 Conclusions The high neutron flux, high pressurizer pressure and overtemperature T trip channels provide adequate protection over the entire range of possible reactivity insertion rates, i.e., the minimum value of DNBR is always larger than the limit value, and the maximum RCS pressure is less than the limit value. The radiological consequences would be less severe than the steamline break accident analyzed in Section 15.1.5.

15.4.3 Rod Cluster Control Assembly Misoperation (System Malfunction or Operator Error) 15.4.3.1 Identification of Causes and Accident Description Rod cluster control assembly (RCCA) misoperation accidents include:

a. One or more dropped RCCAs within the same group

b. A dropped RCCA bank

c. Statistically misaligned RCCA

d. Withdrawal of a single RCCA Each RCCA has a position indicator channel which displays the position of the assembly. The displays of assembly positions are grouped for the operator's convenience. Fully inserted assemblies are further indicated by a rod at bottom signal, which actuates a local alarm and a control room annunciator. Group demand position is also indicated.

Full length RCCA's are always moved in preselected banks, and the banks are always moved in the same preselected sequence. Each bank of RCCAs is divided into two groups. The rods comprising a group operate in parallel through multiplexing thyristors. The two groups in a bank move sequentially such that the first group is always within one step of the second group in the bank. A definite schedule of actuation (or deactuation of the stationary gripper, movable gripper, and lift coils of a mechanism) is required to withdraw the RCCA attached to the mechanism. Since the stationary gripper, movable gripper, and lift coils associated with the four RCCA's of a rod group are driven in parallel, any single failure which would cause rod withdrawal would affect a minimum of one group. Mechanical failures are in the direction of insertion, or immobility.

The dropped RCCA assemblies, dropped RCCA assembly bank, and statistically misaligned RCCA assembly events are classified as ANS Condition II incidents (incidents of moderate (09 OCT 2019) 15.4 - 9

UFSAR Chapter 15 Catawba Nuclear Station frequency) as defined in Section 15.0. The single RCCA withdrawal incident is classified as an ANS Condition III event (Reference 13) for reasons discussed below.

No single electrical or mechanical failure in the rod control system could cause the accidental withdrawal of a single RCCA from the inserted bank at full power operation. The operator could withdraw a single RCCA in the control bank since this feature is necessary in order to retrieve an assembly should one be accidentally dropped. The event analyzed must result from multiple wiring failures (probability for single random failure is on the order of 10-8/hour - refer to Section 7.7.2) or multiple significant operator errors and subsequent and repeated operator disregard of event indication. The probability of such a combination of conditions is considered low enough that the limiting consequences may include slight fuel damage.

Thus, consistent with the philosophy and format of ANSI N18.2, the event is classified as a Condition III event. By definition Condition III occurrences include incidents, any one of which may occur during the lifetime of a particular plant, and shall not cause more than a small fraction of fuel elements in the reactor to be damaged...

This selection of criterion is not in violation of GDC 25 which states, The protection system shall be designed to assure that specified acceptable fuel design limits are not exceeded for any single malfunction of the reactivity control systems, such as accidental withdrawal (not ejection or dropout) of control rods. (Emphasis have been added). It has been shown that single failures resulting in RCCA bank withdrawals do not violate specified fuel design limits.

Moreover, no single malfunction can result in the withdrawal of a single RCCA. Thus, it is concluded that criterion established for the single rod withdrawal at power is appropriate and in accordance with GDC 25.

A dropped RCCA or RCCA bank is detected by:

1. Sudden drop in the core power level as seen by the Nuclear Instrumentation System

2. Asymmetric power distribution as seen on out-of-core neutron detectors or core exit thermocouples

3. Rod at bottom signal

4. Rod deviation alarm

5. Rod position indication Misaligned RCCAs are detected by:

1. Asymmetric power distribution as seen on out-of-core neutron detectors or core exit thermocouples

2. Rod deviation alarm

3. Rod position indicators The resolution of the rod position indicator channel is +/-5 percent of span (+/-7.2 inches).

Deviation of any RCCA from its group by twice this distance (10 percent of span, or 14.4 inches) will not cause power distributions worse than the design limits. The deviation alarm alerts the operator to rod deviation with respect to the group position in excess of 5 percent of span. If the rod deviation alarm is not operable, the operator is required to take action as required by the Technical Specifications.

If one or more rod position indicator channels should be out of service, detailed operating instructions shall be followed to ensure the alignment of the non-indicated RCCAs. The operator is also required to take action as required by the Technical Specifications.

15.4 - 10 (09 OCT 2019)

Catawba Nuclear Station UFSAR Chapter 15 In the extremely unlikely event of simultaneous electrical failures which could result in single RCCA withdrawal, rod deviation and rod control urgent failure would both be displayed on the plant annunciator, and the rod position indicators would indicate the relative positions of the assemblies in the bank. The urgent failure alarm also inhibits automatic rod motion in the group in which it occurs. Withdrawal of a single RCCA by operator action, whether deliberate or by a combination of errors, would result in activation of the same alarm and the same visual indications. Withdrawal of a single RCCA results in both a positive reactivity insertion tending to increase core power and an increase in local power density in the core area associated with the RCCA. Automatic protection for this event is provided by the overtemperature T reactor trip, although, due to the increase in local power density, it is not possible in all cases to provide assurance that the core safety limits will not be violated.

15.4.3.2 Analysis of Effects and Consequences Method of Analysis

a. One or more dropped RCCAs from the same group.

For evaluation of the dropped RCCA event, the transient system response is calculated using the RETRAN-02 code (Reference 1). The code simulates the neutron kinetics, Reactor Coolant System, pressurizer, pressurizer relief and safety valves, pressurizer spray, steam generator, and steam generator safety valves. The code computes pertinent plant variables including temperatures, pressures, and power level.

The analysis utilizes a McGuire RETRAN-02 model with feedring steam generators (FSG). However, input assumptions are conservatively chosen such that the analysis results bound Catawba Unit 1. The Catawba Model D5 steam generator is also analyzed. Due to the similarity in the system response between the analyses, only the FSG analysis that is representative of Catawba Unit 1 is presented.

Statepoints are calculated and nuclear models are used to obtain hot channel factors at conditions consistent or conservative with the primary system conditions and reactor power. By incorporating the primary conditions from the transient and the hot channel factor from the nuclear analysis, the DNB design basis is shown to be met using the VIPRE-01 code (Reference 6). The transient response, nuclear peaking factor analysis, and DNB design basis confirmation are performed in accordance with the methodology described in Reference 15.

b. Dropped RCCA Bank The method used for analyzing this event is the same as for one or more dropped RCCAs from the same group.

c. Statically Misaligned RCCA Steady state power distribution are analyzed using the computer codes as described in Table 4-2. The peaking factors are then compared to maximum allowable peaking limits from the VIPRE-01 code (Reference 6). No allowances for uncertainties are included in the maximum allowable peaking limits for initial reactor power, pressure and RCS temperature since uncertainties for these initial conditions are included in the SCD DNBR limit as described in Reference 8.

d. Single RCCA Withdrawal A single RCCA withdrawal transient is analyzed by employing the RETRAN-02 computer code (Reference 1). The code simulates neutron kinetics, decay heat, the Reactor (09 OCT 2019) 15.4 - 11

UFSAR Chapter 15 Catawba Nuclear Station Coolant System (RCS), control rods, pressurizer, pressurizer power-operated relief valves (PORVs), pressurizer spray, steam generator, turbine, and the Reactor Protection System. The code computes pertinent plant variables including power level, temperatures, pressures, mass flow rates, and liquid inventories.

The analysis utilizes a McGuire RETRAN-02 model with feedring steam generators (FSG). However, input assumptions are conservatively chosen such that the analysis results bound Catawba Unit 1. The Catawba Model D5 steam generator is also analyzed. Due to the similarity in the system response between the analyses, only the FSG analysis that is representative of Catawba Unit 1 is presented.

The DNBR calculation for this accident is performed with the VIPRE-01 computer code (Reference 6) using the Statistical Core Design Methodology described in Reference 8.

The VIPRE-01 code calculates the DNBR during the transient based on the RETRAN-02 boundary conditions. Westinghouse RFA fuel has been analyzed with VIPRE utilizing the WRB-2M CHF correlation (Reference 23). The result of this calculation is a power peaking limit which, at the statepoint, yields a DNBR equal to the limit value. All fuel pins exceeding this peaking limit are assumed to undergo DNB and subsequently fail.

Deleted Per 2006 Update.

Plant characteristics and initial conditions are discussed in Section 15.0 (see Table 15-4). In order to obtain conservative results for a single RCCA withdrawal accident, the following assumptions are made:

1) The values assumed for initial reactor power, pressurizer pressure, RCS average temperature, and RCS flow include no allowance for uncertainties. Uncertainties in initial conditions are included in the SCD DNBR limit as described in Reference 8.

2) A most negative moderator density coefficient of reactivity is assumed corresponding to the beginning of core life. A least negative variable fuel temperature coefficient is assumed corresponding to the beginning of core life. These feedback assumptions lead to the most limiting statepoint with respect to thermal-hydraulic conditions.

Peaking limits derived from this statepoint are compared to peaking results from beginning and end of core life to ensure that the percent of fuel rods in DNB is smaller than the acceptance criterion.

3) The reactor trip on high neutron flux is assumed to be actuated at a conservative value higher than 113.2 percent of nominal full power. The calculated neutron flux is conservatively modified to account for transient changes in the flux incident on the excore detectors. The T trips include all adverse instrumentation and setpoint errors. The delays for trip actuation are assumed to be maximum values.

4) The RCCA trip insertion characteristic is based on the assumption that the highest worth assembly is stuck in its fully withdrawn position.

5) The maximum positive insertion rate is greater than that for the maximum speed withdrawal of the most reactive single Control Bank D RCCA from at or above its insertion limit, accounting for uncertainties in the indicated RCCA position.

6) The case presented assumes normal pressurizer spray and the pressurizer PORVs operable. A sensitivity study was performed to ensure that the minimum DNBR for this case bounds other pressurizer pressure control availability assumptions.

7) The high pressurizer pressure trip function setpoint is assured to be 2415 psig.

8) The steam generator tube plugging level assumed is 5%.

15.4 - 12 (09 OCT 2019)

Catawba Nuclear Station UFSAR Chapter 15 Results

a. One or more dropped RCCAs from the same group For those dropped RCCAs which do not result in a reactor trip, power may be reestablished either by reactivity feedback or control bank withdrawal. Following a dropped rod event in manual rod control, the plant will establish a new equilibrium condition. The equilibrium process without control system interaction is monotonic, thus removing power overshoot as a concern, and establishing the automatic rod control mode of operation as the limiting case.

For a dropped RCCA event in the automatic rod control mode, the Rod Control System detects the drop in power and initiates control bank withdrawal. Power overshoot may occur due to this action by the automatic rod controller after which the control system will insert the control bank to restore nominal power. Figure 15-95, Figure 15-197, Figure 15-198, Figure 15-199 and Figure 15-200 show a typical transient response to a dropped RCCA (or RCCAs) in automatic control.

b. Dropped RCCA Bank The results for a dropped RCCA bank are bounded by the analysis presented for one or more dropped rods.

c. Statically Misaligned RCCA The most severe misalignment situations with respect to DNBR at significant power levels arise from cases in which one RCCA is fully inserted, or where bank D is fully inserted with one RCCA fully withdrawn. Multiple independent alarms, including a bank insertion limit alarm, alert the operator well before the postulated conditions are approached. The bank can be inserted to its insertion limit with any one assembly fully withdrawn without the DNBR falling below the limit value. Any action required of the operator to maintain the plant in a stabilized condition will be in a time frame in excess of ten minutes following the incident.

The insertion limits in the Technical Specifications may vary from time to time depending on a number of limiting criteria. It is preferable, therefore, to analyze the misaligned RCCA case at full power for a position of the control bank as deeply inserted as the criteria on minimum DNBR and power peaking factor will allow. The full power insertion limits on control bank D must then be chosen to be above that position and will usually be dictated by other criteria. Detailed results will vary from cycle to cycle depending on fuel arrangements.

For this RCCA misalignment, with bank D inserted to its full power insertion limit including RCCA position uncertainties and one RCCA fully withdrawn, DNBR does not fall below the limit value. This case is analyzed assuming the initial reactor power, pressure, and RCS temperatures are at their nominal values (as given in Table 15-4) but with the increased radial peaking factor associated with the misaligned RCCA.

For RCCA misalignments with one RCCA fully inserted, the DNBR does not fall below the limit value. This case is analyzed assuming the initial reactor power, pressure, and RCS temperatures are at their nominal values, (as given in Table 15-4) but with the increased radial peaking factor associated with the misaligned RCCA.

DNB does not occur for the RCCA misalignment incident and thus the ability of the primary coolant to remove heat from the fuel rod is not reduced. The peak fuel temperature corresponds to a linear heat generation rate based on the radial peaking factor penalty associated with the misaligned RCCA and a limiting axial power (09 OCT 2019) 15.4 - 13

UFSAR Chapter 15 Catawba Nuclear Station distribution. The resulting linear heat generation is well below that which would cause fuel melting.

Following the identification of a RCCA group misalignment condition by the operator, the operator is required to take action as required by the plant Technical Specifications and operating procedures.

d. Single RCCA Withdrawal Table 15-23 shows the sequence of events for the single uncontrolled rod withdrawal transient. Figure 15-80, Figure 15-92, Figure 15-93 and Figure 15-94 show the transient response for the single uncontrolled rod withdrawal event. System temperature and system pressure increase until reactor trip occurs, which is after the RCCA is completely withdrawn.

For the single rod withdrawal event, two cases have been considered as follows:

1) If the reactor is in the manual control mode, continuous withdrawal of a single RCCA results in both an increase in core power and coolant temperature, and an increase in the local hot channel factor in the area of the withdrawing RCCA. In terms of the overall system response, this case is similar to those presented in Section 15.4.2.

Although some post accident DNB is consistent with the current license basis, no post accident fuel failure is predicted.

2) If the reactor is in the automatic control mode, the multiple failures that result in the withdrawal of a single RCCA will result in the immobility of the other RCCAs in the controlling bank. The transient will then proceed in the same manner as Case (d.l) described above.

For such cases a reactor trip will ultimately occur as above, although not fast enough in all cases to prevent a minimum DNBR in the core of less than the limit value.

Following reactor trip, normal shutdown procedures are followed.

15.4.3.3 Environmental Consequences No fuel clad damage is predicted for the most limiting rod cluster assembly misoperation, the single rod withdrawal accident. The initial activity in the reactor coolant then would be that allowed by the plant technical specifications and amplified by either a pre-existent iodine spike or a concurrent iodine spike. The radiological consequences of this accident would not exceed those for the main line break, analyzed in Section 15.1.5.3.

15.4.3.4 Conclusions For cases of dropped RCCAs or dropped banks, for which the reactor is tripped, there is no reduction in the margin to core thermal limits, and consequently the DNB design basis is met. It is shown for all cases which do not result in reactor trip that the DNBR remains greater than the limit value and, therefore, the DNB design is met.

For all cases of any RCCA fully inserted, or bank D inserted to its rod insertion limits with any single RCCA in that bank fully withdrawn (static misalignment), the DNBR remains greater than the limit value.

For the case of the accidental withdrawal of a single RCCA, with the reactor in the automatic or manual control mode and initially operating at full power with bank D at the insertion limit, an upper bound of the number of fuel rods experiencing DNB is 5 percent of the total fuel rods in the core.

15.4 - 14 (09 OCT 2019)

Catawba Nuclear Station UFSAR Chapter 15 15.4.4 Startup of an Inactive Reactor Coolant Pump at an Incorrect Temperature 15.4.4.1 Identification of Causes and Accident Description If the plant is operating with one pump out of service, there is reverse flow through the inactive loop due to the pressure difference across the reactor vessel. The cold leg temperature in an inactive loop is identical to the cold leg temperature of the active loops (the reactor core inlet temperature). If the reactor is operated at power, and assuming the secondary side of the steam generator in the inactive loop is not isolated, there is a temperature drop across the steam generator in the inactive loop and, with the reverse flow, the hot leg temperature of the inactive loop is lower than the reactor core inlet temperature.

Administrative procedures require that the unit be brought to a load of less than 25 percent of full power prior to starting the pump in an inactive loop in order to bring the inactive loop hot leg temperature closer to the core inlet temperature. Starting of an idle reactor coolant pump without bringing the inactive loop hot leg temperature close to the core inlet temperature would result in the injection of cold water into the core, which would cause a reactivity insertion and subsequent power increase.

Should the startup of an inactive reactor coolant pump accident occur, the transient will be terminated automatically by a reactor trip on low coolant loop flow when the power range neutron flux (two out of four channels) exceeds the P-8 setpoint (See Table 7-2 for a description of interlocks).

The startup of an inactive reactor coolant pump at an incorrect temperature is classified as an ANS Condition II event, a fault of moderate frequency. See Section 15.0 for a discussion of Condition II events.

15.4.4.2 Analysis of Effects and Consequences Method of Analysis The RETRAN-02 Code (Reference 1) is used to calculate the loop and core flow, nuclear power, core average heat flux, core pressure, and temperature transients following the startup of an idle pump. A DNB evaluation is not performed since the reactor coolant pump startup event is characterized by increasing core exit pressure and inlet flow, and decreasing core inlet temperature, which are DNB benefit. Although the core average heat flux increases, the increase is substantially less than the 100% FP value and lags the increase in core flow.

Therefore, the reactor coolant pump startup event does not pose a DNB concern.

This accident is analyzed with the Statistical Core Design Methodology as described in Reference 8. Plant characteristics and initial conditions are discussed in Section 15.0 (see Table 15-4). The analysis utilizes the RETRAN-02 model with a FSG steam generator. The results are representative for both units.

In order to obtain conservative results for the startup of an inactive pump accident, the following assumptions are made:

1. Uncertainties in initial conditions are conservatively applied to minimize thermal margin.

2. Following initiation of startup of the idle pump, the inactive loop flow reverses and accelerates to its nominal full flow value in approximately 10 seconds. This value is less than the expected startup time, and is conservative for this analysis.

3. A conservative EOC most negative moderator temperature coefficient.

4. A conservative EOC least negative Doppler coefficient.

(09 OCT 2019) 15.4 - 15

UFSAR Chapter 15 Catawba Nuclear Station

5. This event is analyzed assuming that the plant administrative procedure to lower the plant load to 25% FP prior to startup of the idle pump is not followed.

6. The reactor trip function on low loop flow indication when power level is above the P-8 setpoint is conservatively assumed to be unavailable. The P-8 setpoint is used to specify the initial conditions.

7. All other reactor trip functions are available.

Results The results following the startup of an idle pump with the above listed assumptions are shown in Figure 15-82 through Figure 15-86. As shown in these curves, during the first part of the transient the increase in core flow with cooler water results in an increase in nuclear power and a decrease in core average temperature. Reactor trip does not occur.

Reactivity addition for the inactive loop startup accident is due to the decrease in core water temperature. During the transient, this decrease is due both to the increase in reactor coolant flow and, as the inactive loop flow reverses, to the colder water entering the core from the hot leg side (colder temperature side prior to the start of the transient) of the steam generator in the inactive loop. Thus, the reactivity insertion rate for this transient changes with time. The resultant core nuclear power transient, computed with consideration of both moderator and Doppler reactivity feedback effects, is shown on Figure 15-82.

The calculated sequence of events for this accident is shown on Table 15-23.

15.4.4.3 Environmental Consequences There would be minimal radiological consequences associated with startup of an inactive reactor coolant loop at an incorrect temperature. Therefore, this event is not limiting. Since no fuel damage is postulated to occur from this transient, the radiological consequences associated with this event would be less severe than the steam line break event analyzed in Section 15.1.5.

15.4.4.4 Conclusions The transient results show that the core is not adversely affected. There is considerable margin to the limiting DNBR. Thus, no fuel or clad damage is predicted.

15.4.5 A Malfunction or Failure of the Flow Controller in a BWR Loop that Results in an Increased Reactor Coolant Flow Rate (Not applicable to Catawba).

15.4.6 Chemical and Volume Control System Malfunction that Results in a Decrease in Boron Concentration in the Reactor Coolant 15.4.6.1 Identification of Causes and Accident Description Reactivity can be added to the core by feeding primary grade water into the Reactor Coolant System via the reactor makeup portion of the Chemical and Volume Control System. Boron dilution is a manual operation under administrative control with procedures calling for a limit on the rate and duration of dilution. A boric acid blend system is provided to permit the operator to match the boron concentration of reactor coolant makeup water during normal charging to that in the Reactor Coolant System. The Chemical and Volume Control System is designed to limit, even under various postulated failure modes, the potential rate of dilution to a value which, after 15.4 - 16 (09 OCT 2019)

Catawba Nuclear Station UFSAR Chapter 15 indication through alarms and instrumentation, provides the operator sufficient time to correct the situation in a safe and orderly manner.

The opening of the reactor water makeup control valve provides makeup to the Reactor Coolant System which can dilute the reactor coolant. Inadvertent dilution from this source can be readily terminated by closing the control valve. In order for makeup water to be added to the Reactor Coolant System at pressure, at least one charging pump must be running in addition to a reactor makeup water pump.

The rate of addition of unborated makeup water to the Reactor Coolant System when it is not at pressure is limited by administratively limiting the output of the reactor makeup water pumps.

Normally, only one reactor makeup water pump is operating while the other is on standby. With the RCS at pressure, the maximum delivery rate is limited by the control valve.

The boric acid from the boric acid tank is blended with primary grade water in the blender and the composition is determined by the preset flow rates of boric acid and primary grade water on the control board.

In order to dilute, two separate operations are required:

1. The operator must switch from the automatic makeup mode to the dilute mode.

2. The start button must be depressed.

Omitting either step would prevent dilution.

Information on the status of the reactor coolant makeup is continuously available to the operator. Lights are provided on the control board to indicate the operating condition of the pumps in the Chemical and Volume Control System. Alarms are actuated to warn the operator if boric acid or demineralized water flow rates deviate from preset values as a result of system malfunction.

A boron dilution is classified as an ANS Condition II event, a fault of moderate frequency. See Section 15.0 for a discussion of Condition II events.

The Boron Dilution Mitigation System (BDMS) uses two wide range detectors to monitor the subcritical multiplication of the reactor core. An alarm setpoint is continually calculated as 2 times the lowest measured count rate, including compensation for background and the statistical variation in the count rate. Once the alarm setpoint is exceeded, each train of the BDMS will automatically shut off both reactor makeup water pumps, align the suction of the charging pumps to highly borated water from the RWST, and isolate flow to the charging pumps from the VCT. Since these functions are automatically actuated by the BDMS, no operator action is necessary to terminate the dilution event and recover the shutdown margin. Because of the averaging scheme used by the BDMS to determine the count rate, there is a time delay or lag between the calculated output and the actual count rate. This time delay is a function of the initial, steady-state count rate. In order to maximize this time delay, a lower bound on the initial count rate of 1 cps is assumed.

15.4.6.2 Analysis of Effects and Consequences Method of Analysis To cover all phases of the plant operation, boron dilutions during cold shutdown, hot shutdown, hot standby, startup, and power operation are considered in this analysis. Boron dilution during refueling is not considered a credible accident because potential dilution flow paths are required to be isolated.

(09 OCT 2019) 15.4 - 17

UFSAR Chapter 15 Catawba Nuclear Station Modes 3-5 are analyzed with two different methods for two different purposes. First, with the BDMS assumed to be operable, the accident is analyzed to demonstrate that there is adequate time, without restrictions on the flow rates from potential dilution sources, for the BDMS to terminate the dilution prior to criticality. This time consists of two components: 1) the period required to stroke the valves manipulated by the BDMS and 2) the period required, once the unborated water source has been isolated, to purge the remaining unborated water from the piping leading to the RCS. Second, with the BDMS assumed to be inoperable, the accident is analyzed to demonstrate that there is adequate time, possibly with restrictions on the flow rates from potential dilution sources, for the operator to terminate the dilution prior to criticality. Since the BDMS is not used in Modes 1 and 2, the analysis of these modes is similar to the analysis of Modes 3-5 with the BDMS assumed to be inoperable, but without the restrictions on flow rates.

Alarm Function Which Initiates Mitigation Mitigation of a boron dilution accident is not assumed to begin until an alarm has warned of the abnormal circumstances caused by the event. For Modes 3-5 with the BDMS operable, the alarm function is provided by the measured wide range count rate exceeding the BDMS setpoint. For Modes 3-5 with the BDMS inoperable, the alarm function is provided by the source range high-flux-at-shutdown alarm exceeding its setpoint. During the period between the intentional defeat of BDMS function in Mode 3 and entry into Mode 2 via rod withdrawal to achieve criticality, adequate notification of unplanned dilution is provided by BDMS alarms. For Mode 2 and for manual rod control during Mode 1, the alarm function is provided by the earliest reactor trip setpoint reached. Finally, for automatic rod control during Mode 1, the alarm function is provided by the alarm which occurs when the control rods reach their insertion limits.

Dilution Volume A postulated dilution event progresses faster for smaller RCS water volumes. Therefore, the analysis considers the smallest RCS water volume in which the unborated water is actively mixed by forced circulation. For Modes 1-3, the Technical Specifications require that at least one reactor coolant pump be operating. This forced circulation will mix the RCS inventory in the reactor vessel and each of the four reactor coolant loops. The pressurizer and the pressurizer surge line are not included in the volume available for dilution in Modes 1-3. For Modes 4 and 5, Technical Specifications require forced circulation in the RCS by either a reactor coolant pump or a single train of the Residual Heat Removal (RHR) system. When the RCS loops are filled in Modes 4 and 5 and forced circulation is provided by a reactor coolant pump, the available RCS water volume for dilution is similar to that for Mode 3. For operating conditions in Mode 4 where a single RHR train is in operation, the dilution volume is assumed to be comprised of the reactor vessel (excluding the upper head), the RHR system, and portions of the hot and cold legs between the RHR system inlet and outlet connections. For operating conditions in Mode 5 where the reactor coolant water level may be drained to below the top of the main coolant loop piping and at least one train of RHR is operating, the RCS volume available for dilution is limited to the smaller volume RHR system train plus the portions of the reactor vessel and reactor coolant loop piping below the minimum water level (7.5 inches above the centerline of the hot and cold leg piping) and beween the RHR system inlet and outlet connections. The minimum water level used to calculate this volume is corrected for level instrument uncertainty.

Boron Concentrations The Technical Specifications require that the shutdown margin in the various modes be above a certain minimum value. The difference in boron concentration, between the value at which the 15.4 - 18 (09 OCT 2019)

Catawba Nuclear Station UFSAR Chapter 15 relevant alarm function is actuated and the value at which the reactor is just critical, determines the time available to mitigate a dilution event. Mathematically, this time is a function of the ratio of these two concentrations, where a large ratio corresponds to a longer time. During the reload safety analysis for each new core, the above concentrations are checked to ensure that the value of this ratio for each mode is larger than the corresponding ratio assumed in the accident analysis. Each mode of operation covers a range of temperatures. Therefore, within that mode, the temperature which minimizes this ratio is used for comparison with the accident analysis ratio. For accident initial conditions in which the control rods are withdrawn, it is conservatively assumed, in calculating the critical boron concentration, that the most reactive RCCA does not fall into the core at reactor trip. This assumption is also conservatively applied in Mode 3 when the initial condition is hot zero power. For colder conditions in Modes 3-5, emergency procedures for reactor trip with a stuck RCCA require that, prior to the initiation of the cooldown, the boron concentration be increased by an amount which compensates for any RCCAs not completely inserted.

Dilution Flow Rate In the absence of flow rate restrictions, the dilution flow rate assumed to enter the RCS is greater than or equal to the maximum volumetric flow rate of both reactor makeup water pumps.

In a dilution event, these pumps are assumed to deliver unborated water to the suction of the centrifugal charging pumps. Since the water delivered by these pumps is typically colder than the RCS inventory, the unborated water expands within the RCS, causing a given volumetric flow rate measured at the colder temperature to correspond to a larger volumetric dilution flow rate within the RCS. This density difference in the dilution flow rate is accounted for in the analysis.

Results The calculated sequence of events is shown in Table 15-23. The results presented in Table 15-23 are for the dilution flow rates which, assuming the boron concentration ratios are at the reload safety analysis limits, give exactly these operator response times. Flow rates are restricted, through Technical Specifications and administrative controls, to values which are less than these analyzed flow rates, thus in practice giving even longer operator response times.

Additional margin is provided by the fact there is typically margin between the assumed boron concentration ratio for a given mode and the actual corresponding concentration ratio for the reload core.

Dilution During Modes in which the BDMS is Required (Modes 3-5)

For Modes 3-5 with the BDMS operable, the results presented in Table 15-23 show that there is adequate time to reach the BDMS alarm setpoint, stroke closed the valves to isolate the source of unborated water, and purge the unborated water already in the CVCS piping, before the shutdown margin is exhausted. For Modes 3-5 with the BDMS inoperable, the results presented in Table 15-23 show that, with limitations on flow rates from potential sources of unborated water, there is adequate time for the operator to determine the cause of the dilution, isolate the source of unborated water, and initiate reboration before the shutdown margin is exhausted. In accordance with Reference 16, adequate time is judged to be at least 15 minutes for Modes 3-5.

Dilution During Startup (Mode 2)

This mode of operation is a transitory mode to go to power and is the operational mode in which the operator intentionally dilutes and withdraws control rods to take the plant critical. During this mode, the plant is in manual control with the operator required to maintain a very high awareness of the plant status. For a normal approach to criticality the operator must manually (09 OCT 2019) 15.4 - 19

UFSAR Chapter 15 Catawba Nuclear Station initiate a limited dilution and subsequently manually withdraw the control rods, a process that takes several hours. The plant Technical Specifications require that the operator determine the estimated critical position of the control rods prior to approaching criticality thus assuring that the reactor does not go critical with rods below the insertion limits. Prior to disabling the BDMS function (to prevent undesired actuation during approach to criticality), the operator resets the BDMS alarm setpoints. The BDMS alarms afford sufficient notification of unplanned dilution between the time BDMS function is defeated and control rod withdrawal is commenced for the operator to take action to terminate the dilution. Once critical, the power escalation must be sufficiently slow to allow the operator to manually block the Source Range reactor trip after receiving P-6 from the Intermediate Range (nominally at 105 cps). Too fast of a power escalation (due to an unknown dilution) would result in reaching P-6 unexpectedly, leaving insufficient time to manually block the Source Range reactor trip. Failure to perform this manual action results in a reactor trip and immediate shutdown of the reactor, allowing sufficient time prior to a loss of shutdown margin for the operator to terminate the dilution event.

However, in the event of an unplanned approach or dilution during power escalation while in the startup mode, the plant status is such that minimal impact will result. The plant will slowly escalate in power to a reactor trip on the Power Range Neutron Flux Low Setpoint (nominally 25% RTP). After reactor trip, there is adequate time (at least 15 minutes per Reference 16) for operator action prior to a loss of shutdown margin to terminate the dilution.

Dilution During Full Power Operation (Mode 1)

1. With the reactor in automatic control, the power and temperature increase from boron dilution results in insertion of the rod cluster control assemblies and a decrease in the shutdown margin. The rod insertion limit alarms (low and low-low settings) provide the operator with adequate time (at least 15 minutes per Reference 16) to determine the cause of dilution, isolate the primary grade water source, and initiate reboration before the total shutdown margin is lost due to dilution.

2. With the reactor in manual control and if no operator action is taken, the power and temperature rise will cause the reactor to reach the high flux trip high setpoint. There is adequate time available (at least 15 minutes per Reference 16) after a reactor trip for the operator to determine the cause of dilution, isolate the primary grade water sources, and initiate reboration before the reactor can return to criticality.

15.4.6.3 Environmental Consequences There would be minimal radiological consequences associated with a Chemical and Volume Control System malfunction that results in a decrease in boron concentration in the reactor coolant. The reactor trip causes a turbine trip, and heat may be removed from the secondary system through the steam generator power relief valves or safety valves. Since no fuel damage occurs from this transient, the radiological consequences associated with this event are less severe than the steam line break event analyzed in Section 15.1.5.

15.4.6.4 Conclusions For Modes 1 and 2, the results presented above show that there is adequate time for the operator to manually terminate the source of dilution flow. Following termination of the dilution flow, the reactor will be in a stable condition. The operator can then initiate boration to recover the shutdown margin. If the BDMS is inoperable, the secondary source of protection against a dilution event in Modes 3 through 5 is operator action. Longer response times are required to be assumed for such manual actions. When these longer response times are considered, it is necessary to restrict the flow rates from potential dilution sources.

15.4 - 20 (09 OCT 2019)

Catawba Nuclear Station UFSAR Chapter 15 For Modes 3 through 5, the BDMS, as described in Section 7.6.23, is the primary source of protection against a dilution event. Even considering the conservative delays assumed in this analysis, the preceding results indicate that the BDMS will automatically terminate a dilution event in Modes 3 through 5 prior to a loss of shutdown margin.

15.4.7 Inadvertent Loading and Operation of a Fuel Assembly in an Improper Position 15.4.7.1 Identification of Causes and Accident Description Fuel and core loading errors such as can arise from the inadvertent loading of one or more fuel assemblies into improper positions, loading a fuel rod during manufacture with one or more pellets of the wrong enrichment, or the loading of a full fuel assembly during manufacture with pellets of the wrong enrichment will lead to increased heat fluxes if the error results in placing fuel in core positions calling for fuel of lesser enrichment. Also included among possible core loading errors is the inadvertent loading of one or more fuel assemblies requiring burnable poison rods into a new core without burnable poison rods.

Any error in enrichment, beyond the normal manufacturing tolerances, can cause power shapes which are more peaked than those calculated with the correct enrichments. A penalty is applied to the design peaking factors to account for power peaking changes within the allowed operating axial offset limits. The incore system of moveable flux detectors, which is used to verify power shapes at the beginning of cycle, is capable of revealing any assembly enrichment error or loading error which causes power shapes to be peaked in excess of the design value.

To reduce the probability of core loading errors, each fuel assembly is marked with an identification number and loaded in accordance with a core loading diagram. Before core loading, the fuel assemblies in the Spent Fuel Pool, designated for the next fuel cycle, will have the fuel assembly identification numbers and insert identification numbers checked. During core loading, the identification number will be checked before each assembly is moved into the core.

During or immediately following core loading, the fuel assembly identification numbers (read during movement or after placement) are checked against the core loading diagram as final assurance that the core has been loaded properly.

The power distortion due to any combination of misplaced fuel assemblies can significantly raise peaking factors which would be readily observable with incore flux monitors. In addition to the flux monitors, thermocouples are located at the outlet of about one third of the fuel assemblies in the core. There is a high probability that these thermocouples would also indicate any abnormally high coolant enthalpy rise. Incore flux measurements and core symmetry checks are performed during the startup subsequent to every refueling operation.

The inadvertent loading and operation of a fuel assembly in an improper position is classified as an ANS Condition III event, an infrequent fault. See Section 15.0 for a discussion of Condition III events.

15.4.7.2 Analysis of Effects and Consequences Method of Analysis Per Section 14.3.3, a low power level flux map is taken during the initial cycle startup. The movable incore flux detector system provides measured reaction rates that are compared to predicted reaction rates. The deviations between these values (or the calculated assembly powers) are compared to the acceptance criteria presented in Section 14.3.3.

(09 OCT 2019) 15.4 - 21

UFSAR Chapter 15 Catawba Nuclear Station For analysis purposes, predicted reaction rates (for all functioning moveable incore locations) from a large number of postulated misloaded cores are compared to the predicted reaction rates for a correctly loaded core. Deviations that exceed the acceptance criteria allow detection of an incorrectly loaded core. If the loading error does not violate the acceptance criteria, a second check is made to verify that the power peaking at all times in the cycle will not challenge the DNB limits of the fuel, thereby preventing any loading error inducted fuel failures. If needed, the cycle specific acceptance criteria are made more restrictive than those listed in Section 14.3.3 to help detect a core loading error.

The power distributions are calculated using the NRC approved computer codes described in Chapter 4.

A sufficiently large number of loading errors, with a range of reactivity changes and at various core locations, are modeled to ensure the effectiveness of the acceptance criteria used in the initial startup procedures. The scenarious considered include:

1. Two assemblies being swapped with each other in the core, excluding misloads that result in invalid control rod configurations.

2. Burnable poisons being misloaded, either manufactured wrong or two feed assemblies with different burnable poisons beng interchanged.

3. Any one feed assembly with an incorrect enrichment.

4. Swapping a typical discharged assembly from the spent fuel pool with any assembly in the core.

For each of these core loading error cases, the percent deviations in the assembly powers from a normally loaded core are shown at all incore detector locations. (See Figure 15-87 to Figure 15-91, inclusive).

Results The following example core loading error cases are presented:

Case 1:

This case assumes a feed assembly is interchanged with a reinsert assembly. The particular case shown in Figure 15-87 was the interchange of two nearby assemblies near the periphery of the core. This example loading error would not maintain DNB margin if operated at nominal conditions, but the measured errors are greater than the acceptance criteria so the misload would be identified prior to achieving a power level that would challenge BNB.

Case 2:

This case assumes a burnable absorber is placed in the core incorrectly. Two examples are presented for this case in Figure 15-88 and Figure 15-89.

In Case 2-A, two feed assemblies with different burnable absorbers are interchanged. This example loading error maintains positive DNB margin at nominal conditions.

In Case 2-B, a feed assembly is manufactured with incorrect burnable absorbers. This example loading error would not maintain positive DNB margin if operated at nominal conditions, but the measured errors are greater than the acceptance criteria so the misload would be identified prior to achieving a power level that would challenge DNB.

Case 3:

15.4 - 22 (09 OCT 2019)

Catawba Nuclear Station UFSAR Chapter 15 This case assumes a feed assembly has a higher than expected enrichment at the center of the core as shown in Figure 15-90. This example loading error maintains positive DNB margin at nominal conditions.

Case 4:

This case assumes a feed assembly is replaced by a discharged fuel assembly loaded near the core periphery as shown in Figure 15-91. This example loading error maintains positive DNB margin at nominal conditions.

15.4.7.3 Environmental Consequences There are no radiological consequences associated with inadvertent loading and operation of a fuel assembly in an improper position since activity is contained with the fuel rods and Reactor Coolant System within design limits.

15.4.7.4 Conclusions Fuel assembly enrichment errors should be prevented by administrative procedures implemented in fabrication.

In the event that a single pin or pellet has a higher enrichment than the nominal value, the consequences in terms of reduced DNBR and increased fuel and clad temperatures will be limited to the incorrectly loaded pin or pins. Fuel assembly loading errors are prevented by administrative procedures implemented during core loading. In the unlikely event that a loading error occurs, analyses in this section confirm that resulting power distribution effects will either be readily detected by the incore moveable detector system or will cause a sufficiently small perturbation as to be acceptable and the DNB limit would not be exceeded during Condition 1 transients.

15.4.8 Spectrum of Rod Cluster Control Assembly Ejection Accidents 15.4.8.1 Identification of Causes and Accident Description This accident is defined as the mechanical failure of a control rod mechanism pressure housing resulting in the ejection of a rod cluster control assembly (RCCA) and drive shaft. The consequence of this mechanical failure is a rapid positive reactivity insertion together with an adverse core power distribution, possibly leading to localized fuel rod damage.

15.4.8.1.1 Design Precautions and Protection Certain features in the Catawba units are intended to preclude the possibility of a rod ejection accident, or to limit the consequences if the accident were to occur. These include a sound, conservative mechanical design of the rod housings, a thorough quality control (testing) program during assembly, and a nuclear design which lessens the potential ejection worth of RCCA's and minimizes the number of RCCA's inserted at high power levels.

Mechanical Design The mechanical design is discussed in Section 4.6. Mechanical design and quality control procedures intended to preclude the possibility of a RCCA drive mechanism housing failure are listed below:

1. Each full length control rod drive mechanism housing is completely assembled and shop tested at 4100 psi.

(09 OCT 2019) 15.4 - 23

UFSAR Chapter 15 Catawba Nuclear Station

2. The mechanism housings are individually hydrotested after they are attached to the head adapters in the reactor vessel head, and checked during the hydrotest of the completed reactor coolant system.

3. Stress levels in the mechanism are not affected by anticipated system transients at power, or by the thermal movement of the coolant loops. Moments induced by the design earthquake can be accepted within the allowable primary working stress range specified by the ASME Code,Section III, for Class 1 components.

4. The latch mechanism housing and rod travel housing are each a single length of forged Type-304 stainless steel. This material exhibits excellent notch toughness at all temperatures which will be encountered.

A significant margin of strength in the elastic range together with the large energy absorption capability in the plastic range gives additional assurance that gross failure of the housing will not occur. The joints between the latch mechanism housing and head adapter, and between the latch mechanism housing and rod travel housing, are threaded joints reinforced by canopy type rod welds. Administrative regulations require periodic inspections of these (and other) welds.

Nuclear Design Even if a rupture of a RCCA drive mechanism housing is postulated, the operation of a plant utilizing chemical shim is such that the severity of an ejected RCCA is inherently limited. In general, the reactor is operated with the RCCA's inserted only far enough to permit load follow.

Reactivity changes caused by core depletion and xenon transients are typically compensated for by boron changes. Further, the location and grouping of control RCCA banks are selected during the nuclear design to lessen the severity of a RCCA ejection accident. Therefore, should a RCCA be ejected from its normal position during full power operation, only a minor reactivity excursion, at worst, could be expected to occur.

However, it may be occasionally desirable to operate with larger than normal RCCA insertions.

For this reason, a rod insertion limit is defined as a function of power level. Operation with the RCCA's above this limit guarantees adequate shutdown capability and acceptable power distribution. The position of all RCCA's is continuously indicated in the control room. An alarm will occur if a bank of RCCA's approaches its insertion limit or if one RCCA deviates from its bank. Operating procedures require boration at low level alarm and a search for any source of dilution, verification of shutdown margin, and boration necessary to restore RCCA position above the insertion limit setpoint at the low-low alarm.

Reactor Protection The protection for this accident is provided by high neutron flux trip (high and low setting) and high neutron flux rate trip. These protection functions are described in detail in Section 7.2.

Effects on Adjacent Housings Disregarding the remote possibility of the occurrence of a RCCA mechanism housing failure, investigations have shown that failure of a housing due to either longitudinal or circumferential cracking would not cause damage to adjacent housings. However, even if damage is postulated, it would not be expected to lead to a more severe transient since RCCA's are inserted in the core in symmetric patterns, and control rods immediately adjacent to worst ejected rods are not in the core when the reactor is critical. Damage to an adjacent housing could, at worst, cause that RCCA not to fall on receiving a trip signal; however, this is already taken into account in the analysis by assuming that the ejected rod and the remaining highest worth rod does not fall into the reactor core.

15.4 - 24 (09 OCT 2019)

Catawba Nuclear Station UFSAR Chapter 15 15.4.8.1.2 Limiting Criteria This event is classified as an ANS Condition IV incident. See Section 15.0 for a discussion of ANS classifications. Due to the extremely low probability of a RCCA ejection accident, some fuel damage could be considered an acceptable consequence.

Based on the requirements of Section 15.4.8 of NUREG-0800, Reference 16, the following criteria are applicable to the rod ejection event to reduce the probability of fuel dispersal in the coolant, gross lattice distortion or severe shock waves, and to limit offsite doses.

1. The radially averaged fuel pellet shall not exceed 280 cal/gm at any axial location. This criterion ensures that a coolable core geometry is maintained.

2. Offsite radiation doses must be shown to be at most 6.3 Rem Total Effective Dose Equivalent (TEDE), the acceptance limit in Regulatory Guide 1.183. The control room radiation dose must be shown not to exceed 5.0 Rem TEDE, pursuant to 10 CFR 50.67, General Design Criterion 19, and Regulatory Guide 1.183.

3. The peak Reactor Coolant System pressure must be within Service Limit C as defined by the ASME code, Reference 17. The peak Reactor Coolant System pressure is 3000 psia or 120% of the 2500 psia design pressure per Reference 15.

15.4.8.2 Analysis of Effects and Consequences 15.4.8.2.1 Stages of Analysis Method of Analysis The analysis of the rod ejection event is complex and requires the application of a sequence of computer codes. The core power response is simulated with a three-dimensional transient neutronic and thermal-hydraulic model using the SIMULATE-3K code, Reference 24. The resulting transient core power distribution results are then input to VIPRE-01 (Reference 6) core thermal-hydraulic models. The VIPRE-01 models calculate the peak fuel pellet enthalpy, the allowable power peaking to avoid exceeding the DNBR limit, and the core coolant expansion rate. The allowable power peaking is then used along with a post-ejected condition fuel pin census to determine the percent of pins in DNB (failed fuel pins). The coolant expansion rate is input to a RETRAN-02 (Reference 1) model of the Reactor Coolant System to determine the peak pressure resulting from the core power excursion. The peak pressure analysis utilizes a McGuire Unit 1 RETRAN-02 model with a feedring (FSG) steam generator. However, input assumptions are conservatively chosen such that the analysis results bound Catawba Unit 1.

The Catawba Model D5 steam generator is also analyzed. Due to the similarity in the system response, only the FSG analysis that is representative of Catawba Unit 1 is presented. Table 15-4 summarizes input parameters and initial conditions used.

A detailed discussion of the method of analysis can be found in References 15 and 25.

Nuclear Analysis Model Deleted Per 2006 Update.

The SIMULATE-3K code is a three-dimensional transient neutronic version of the SIMULATE-3 code. SIMULATE-3K uses the QPANDA full two-group nodal spatial model developed in SIMULATE-3, with the addition of six delayed neutron groups. The program employs a fully-implicit time integration of the neutron flux, delayed neutron precursor, and heat conduction models. Beta is fully functionalized as similar to other cross sections to provide a value of beta (09 OCT 2019) 15.4 - 25

UFSAR Chapter 15 Catawba Nuclear Station for the time varying neutron flux. Additional features of SIMULATE-3K include the application of conservatism to key physics parameters through simple user input.

The SIMULATE-3K thermal-hydraulic model includes a spatial heat conduction and a hydraulic channel model. The heat conduction model solves the conduction equation on a multi-region mesh in cylindrical coordinates. Temperature-dependent values may be employed for the heat capacity, thermal conductivity, and gap conductances. A single characteristics pin conduction calculation is performed consistent with the radial neutronic node geometry. Burnup dependent models may be employed for the thermal conductivity, gap conductance, and pellet radial profile. A single characteristic hydraulic channel calculation is performed based on the radial neutronic node geometry. This thermal-hydraulic model is used to determine fuel and moderator temperatures for updating the cross-sections, and used to provide edits of fuel temperature throughout the transient.

The Westinghouse RFA fuel type is analyzed. The SIMULATE-3K model is used to calculate the transient core power response versus time, and the radial, total and axial peaking factors by assembly for selected time steps. This information is used by VIPRE-01 to determine the fuel temperature, enthalpy, and the amount of fuel failures resulting from DNB.

Core Thermal-Hydraulic Analysis Model The VIPRE-01 code is used for the rod ejection analysis thermal evaluations. VIPRE-01 is a subchannel thermal-hydraulic computer code. With the subchannel analysis approach, the nuclear fuel element is divided into a number of quasi one-dimensional channels that communicate laterally by diversion crossflow and turbulent mixing. Given the geometry of the reactor core and coolant channel, and the boundary conditions or forcing functions, VIPRE-01 calculates core flow distributions, coolant conditions, fuel rod temperatures and the departure from nucleate boiling ratio (DNBR) for steady-state and transient conditions. VIPRE-01 accepts all necessary boundary conditions that originate either from a system transient simulation code such as RETRAN, or a transient core neutronics simulation code such as SIMULATE-3K.

Included is the capability to impose different boundary conditions on different segments of the core model.

Fuel Temperature and Enthalpy Calculation In order to show that the peak fuel enthalpy acceptance criterion described in Section 15.4.8.1.2 is met, a VIPRE model with fuel conduction is utilized to calculate the maximum hot spot fuel temperature and enthalpy during the transient. Given the transient core neutron power and core power distribution obtained from the SIMULATE-3K analysis, this VIPRE-01 model calculates the transient maximum hot spot average fuel temperature and the maximum radial average fuel enthalpy. In the analysis, the fuel pellet power profile, the gap conductivity, clad-to-coolant heat transfer correlations, and flow correlations are selected to give conservative maximum hot spot fuel temperature and enthalpy results during the transient.

Coolant Expansion Rate Calculation If the peak fuel enthalpy criterion is met, there is little chance of fuel dispersal into the coolant.

Therefore, the Reactor Coolant System expansion rate may be calculated using conventional heat transfer from the fuel and prompt heat generation in the coolant. This rate must be calculated with the consideration of the spatial power distribution before and during the transient since this rate, at any location in the reactor core, depends on the initial amount of subcooling and the rate of change of the heat added into the coolant channels. Using the SIMULATE-3K transient calculation results, the VIPRE-01 model calculates the flow rate in each channel during the transient. Using the VIPRE-01 channel flow rates, the total coolant expansion rate is calculated. This total coolant expansion rate is input to a RETRAN plant transient model for 15.4 - 26 (09 OCT 2019)

Catawba Nuclear Station UFSAR Chapter 15 simulating the resulting pressure response. In the analysis, the fuel pellet power profile, the gap conductivity, clad-to-coolant heat transfer coefficients, and flow correlations are selected to give conservative coolant expansion rate calculation result.

DNBR Evaluation To determine the dose consequences, an analysis is performed using the VIPRE-01 code to determine the percentage of the core experiencing DNB. The allowable power peaking to avoid exceeding the DNBR limit during the transient is determined. Those fuel pins which exceed the DNBR limit are assumed to fail. The correlation used is WRB-2M (Reference 23) for Westinghouse RFA fuel with its respective non-SCD DNBR limit. In the analysis, the fuel pellet power profile, the gap conductivity, clad-to-coolant heat transfer coefficents, and flow correlations are selected to give conservative DNBR and allowable power peaking results during the transient.

15.4.8.2.2 Calculation of Basic Parameters Input parameters for the analysis are conservatively selected on the basis of values calculated for this type of core. The more important parameters are discussed below. Table 15-25 presents the parameters used in this analysis.

Ejected Rod Worths and Hot Channel Factors The ejected rod worths used in rod ejection accident licensing are calculated with the SIMULATE-3K code. The magnitude of the ejected rod worths analyzed are selected such that they bound expected ejected rod worths of future core designs. The cycle specific confirmation of these worths is performed using three dimensional steady state neutronics codes which have been approved for reload design analyses.

Ejected rod worth calculations are performed assuming that the control banks containing the ejected rod are inserted to the power dependent rod insertion limit, including uncertainties. For ejected rod worth calculations performed at power, no credit is taken for the reactivity feedback resulting from the increase in fuel temperature and moderator temperature during the transient.

The effects of transient xenon conditions are also considered.

The licensing analysis hot channel factors for the post ejected condition are calculated as described in Reference 25 (SIMULATE-3K) and are based on the transient analysis results using a conservative set of initial conditions for the rod ejection event. Confirmation that rod ejection hot channel factors remain bounding for reload cores is accomplished through a series of three dimensional static calculations using steady state neutronic codes approved for reload design analysis. The calculations performed take no credit for moderator of fuel temperature feedback and also accounts for the effects of adverse xenon distributions.

Moderator and Doppler Coefficient The moderator and Doppler temperature coefficients used by SIMULATE-3K were adjusted to bound expected values for these parameters which are expected to occur in future reload core designs. The method used to adjust both the Doppler and moderator temperature coefficients is described in Reference 25.

Delayed Neutron Fraction, Calculations of the effective delayed neutron fraction (eff) typically yield values no less than 0.60 percent at beginning of life and 0.50 percent at end of life for the first cycle. The accident is sensitive to if the ejected rod worth is equal to or greater than as in zero power transients.

(09 OCT 2019) 15.4 - 27

UFSAR Chapter 15 Catawba Nuclear Station In order to allow for future cycles, pessimistic estimates of of 0.56 percent at beginning of cycle and 0.47 percent at end of cycle were used in the analysis.

Trip Reactivity Insertion The trip reactivity assumed in the rod ejection accident is set conservatively small by reducing the amount of shutdown reactivity available by both the worth of the ejected rod and the worth of the highest worth remaining rod. The net effect of this requirement is to reduce the available shutdown margin to a conservatively small value. Trip reactivity is modelled by either one of two methods. In the first method, the insertion of this reactivity is modelled by dropping several control banks of the required worth into the reactor core. The start of rod motion occurs at 0.5 seconds after the high neutron flux trip setpoint is reached. A curve of trip rod insertion versus time is used which assumes that insertion to the dashpot does not occur until 2.2 seconds after the start of fall. The choice of such a conservative insertion rate means that there is approximately one second after the trip point is reached before significant shutdown reactivity is inserted into the core. This is a particularly important conservatism for hot full power accidents.

In the second method, the effect of top and bottom xenon is explicitly accounted for. Trip reactivity is modelled by assuming that both the ejected rod and an adjacent rod do not fall into the reactor core. The worth of the remaining rods is reduced by a cross section adjustment.

The trip insertion time is assumed to be at the technical specification limit. The rate of reactivity insertion in this method is determined by the initial condition xenon distribution and the resulting axial power distribution. Conservatism is maintained by the reduction in rod worth, by the delay in the start of control rod motion and by assuming a technical specification control rod drop time.

The minimum design shutdown available at HZP may be reached only at end of life in the equilibrium cycle. This value includes an allowance for the worst stuck rod, transient xenon effects, conservative Doppler and moderator defects, and an allowance for calculational uncertainties. Physics calculations have shown that the effect of two stuck RCCA's (one of which is the worst ejected rod) is to reduce the shutdown margin by about an additional one percent k/k. Therefore, following a reactor trip resulting from an RCCA ejection accident, the reactor will be subcritical when the core returns to HZP.

Reactivity Effects of Small Break LOCA Aspects of Rod Ejection Accident Depressurization calculations have been performed for a typical four-loop plant assuming the maximum possible size break (2.75 inch diameter) located in the reactor pressure vessel head.

The results show a rapid pressure drop and a decrease in system water mass due to the break.

The safety injection system is actuated on low pressurizer pressure within one minute after the break.

The reactor coolant system pressure continues to drop and reaches saturation (1100 to 1300 psi depending on the system temperature) in about two to three minutes. Due to the large thermal inertia of primary and secondary system, there has been no significant decrease in the reactor coolant system temperature below no-load by this time, and the depressurization itself has caused an increase in shutdown margin by about 0.2 percent k/k due to the pressure coefficient. The cooldown transient could not absorb the available shutdown margin until more than ten minutes after the break. The addition of borated safety injection flow starting one minute after the break is much more than sufficient to ensure that the core remains subcritical during the cooldown.

Reactor Protection As discussed in Section 15.4.8.1.1, reactor protection for a rod ejection is provided by high neutron flux trip (high and low setting) and high neutron flux rate trip. These protection functions are part of the Reactor Protection System. No single failure of the Reactor Protection System 15.4 - 28 (09 OCT 2019)

Catawba Nuclear Station UFSAR Chapter 15 will negate the protection functions required for the rod ejection accident, or adversely affect the consequences of the accident.

Results Cases are presented for both beginning and end of life at zero and full power for the Westinghouse RFA fuel type.

1. Beginning of Cycle, Full Power Control bank D was assumed to be inserted to its insertion limit including uncertainties. The worst ejected rod worth and hot channel factor were calculated to be $0.19 and 4.90 respectively. The peak clad temperature was 794°F. The peak hot spot fuel center temperature was 5021°F.

2. Beginning of Cycle, Zero Power Control bank D was assumed to be fully inserted and banks B and C were at their insertion limits. The worst ejected rod is located in control bank D and has a worth of $1.32 and a hot channel factor of 19.60. The peak clad temperature reached 738°F, and the fuel center temperature was 2064°F.

3. End of Cycle, Full Power Control bank D was assumed to be inserted to its insertion limit including uncertainties. The worst ejected rod worth and hot channel factors were calculated to be $0.26 and 4.84 respectively. This resulted in a peak clad temperature of 1296°F. The peak hot spot fuel temperature reached 4353°F.

4. End of Cycle, Zero Power Control bank D was assumed to be fully inserted and bank C was at its insertion limit. The ejected rod has a worth of $1.45 and a hot channel factor of 20.78 respectively. The peak clad and fuel center temperatures were 755°F and 1646°F respectively.

5. Beginning of Cycle, Full Power Peak RCS Pressure A detailed calculation of the pressure surge for the worst case, at beginning of life, hot full power, indicates that the peak pressure does not exceed that which would cause stress to exceed the faulted condition stress limits as discussed in Section 15.4.8.

A summary of the cases presented above is given in Table 15-25. The nuclear power transient response for the BOC HFP and EOC HZP cases presented in Figure 15-201 and Figure 15-202.

The calculated sequence of events for the rod ejection accidents, as shown in Figure 15-201 and Figure 15-202, is presented in Table 15-23. For all cases, doppler feedback terminates the power excursion, and then the reactor trip shuts the reactor down. As discussed previously in Section 15.4.8.2.2, the reactor will remain subcritical following reactor trip.

The ejection of an RCCA constitutes a break in the Reactor Coolant System, located in the reactor pressure vessel head. The effects and consequences of loss of coolant accidents are discussed in Section 15.6.5. Following the RCCA ejection, the operator would follow the same emergency instructions as for any other loss of coolant accident to recover from the event.

Fission Product Release It is assumed that fission products are released from the gaps of all rods entering DNB. The amount of failed fuel for each case analyzed is shown in Table 15-25. The BOC, HFP case is the limiting case. Less than 40% of the rods entered DNB.

(09 OCT 2019) 15.4 - 29

UFSAR Chapter 15 Catawba Nuclear Station Lattice Deformations A large temperature gradient will exist in the region of the hot spot. Since the fuel rods are free to move in the vertical direction, differential expansion between separate rods cannot produce distortion. However, the temperature gradients across individual rods may produce a differential expansion tending to bow the midpoint of the rods toward the hotter side of the rod. Calculations have indicated that this bowing would result in a negative reactivity effect at the hot spot since Westinghouse cores are under-moderated, and bowing will tend to increase the under-moderation at the hot spot. Since the 17 x 17 fuel design is also under-moderated, the same effect would be observed. In practice, no significant bowing is anticipated, since the structural rigidity of the core is more than sufficient to withstand the forces produced. Boiling in the hot spot region would produce a net flow away from that region. However, the heat from the fuel is released to the water relatively slowly, and it is considered inconceivable that cross flow will be sufficient to produce significant lattice forces. Even if massive and rapid boiling, sufficient to distort the lattice, is hypothetically postulated, the large void fraction in the hot spot region would produce a reduction in the total core moderator to fuel ratio, and a large reduction in this ratio at the hot spot. The net effect would therefore be a negative feedback. It can be concluded that no conceivable mechanism exists for a net positive feedback resulting from lattice deformation.

In fact, a small negative feedback may result. The effect is conservatively ignored in the analysis.

Deleted Per 2006 Update.

15.4.8.3 Environmental Consequences An analysis of a postulated rod ejection accident was performed to determine the limiting radiological consequences at offsite locations. The analysis was based on assumptions provided in Regulatory Guide 1.183 and Appendix H. Some additional conservative assumptions were made based on the nature of the postulated scenario and the state of knowledge of it. The analysis is based on the instantaneous release of fission products from the gaps of fuel pins projected to be in DNB. No fuel melt was postulated.

Following the postulated accident, two activity release paths contribute to the total radiological consequences. The first release path is via containment leakage resulting from release of activity from the primary coolant to the containment. The second path is via steam generator tube (S/G) leaks. Radioactivity entrained with S/G tube leaks either mixes with the water during the times the tubes are completely submerged, resulting in release through the power operated release valves, or escapes to the environment during times of tube bundle recovery. The upper bound radiation doses are obtained by adding the constituents for post accident containment leakage to the corresponding constituent for post accident S/G steam releases.

As part of an evaluation of single failures, radiation doses were calculated for the following four rod ejection accident scenarios at Catawba Nuclear Station:

• rod ejection accident with a Minimum Safeguards failure

• rod ejection accident with an Annulus Ventilator pressure transmitter failure

• rod ejection accident with an Auxiliary Feedwater turbine driven pump failure

• rod ejection accident with an initially closed Control Room Area Ventilation outside air intake The following assumptions are used in the analysis of the release of radioactivity in the event of a postulated rod ejection accident. The parameters used in the analysis are given in Table 15-26.

15.4 - 30 (09 OCT 2019)

Catawba Nuclear Station UFSAR Chapter 15 The following assumptions are used for the calculations of radiation doses for all release paths associated with the postulated rod ejection accident:

1. Forty (40) percent of the fuel rods ion the core are assumed to fail due to DNB, releasing all fission products stored in the gap.

2. No fuel melt is assumed.

3. The following assumptions apply to fission product releases from the gaps of fuel pins with assumed clad failure. All fission products (noble gases, halogens, and alkali metals) are assumed to be released to the reactor coolant and be available for release to the S/G secondary side with S/G tube leakage. It also is assumed that all fission products also are released to the atmosphere in the lower compartment. Finally, it is assumed that all fission products but noble gases are released to the containment sump.

4. For releases to the reactor coolant, containment atmosphere, and the containment sump, the iodine chemical composition fractions are set to 0.97 for diatomic iodine and 0.03 for organic iodine compounds.

The following assumptions apply to the calculation of the dose constituents associated with containment leakage for all rod ejection accident scenarios:

5. Containment leakage for the first day is set to the limit allowed in the plant Technical Specifications: 0.3 mass percent per day. After the first day, containment leakage is set to 50% of the Technical Specification limit (0.15 mass percent per day).

6. All containment leakage is assumed to bypass the annulus before the Annulus Ventilation System is draws the pressure to -0.25 in.w.g. or lower everywhere within the annulus.

7. Once the Annulus Ventilation System has drawn the pressure to -0.25 in.w.g. or lower everywhere in the annulus, the containment bypass leak rate is set to 7% of the total containment leak rate.

8. All containtment leakage to the annulus is assumed to mix with the air in 50% of the annulus volume.

9. No credit is taken for removal of fission products from the upper compartment atmosphere by the Containment Spray System. However, credit is taken for natural deposition of bromine and alkali metals on containment internal structures (Reference 26).

10. Start of one Containment Air Return fan (CARF) at 600 seconds is simulated, it is assumed that the other CARF fan fails. No circulation of air between the lower and upper compartments before simulated start of the CARF. No credit is taken for removal of diatomic iodine from the flow through the ice condenser.

The following assumptions apply to the calculation of the dose constituents associated with containment leakage for a rod ejection accident with a minimum Safeguards failure.

11. One Annulus Ventilation fan is assumed to fail to start.

12. One Containment Air Return fan is assumed to fail to start.

The following assumptions apply to the calculation of the dose continuants associated with containment leakage for a rod ejection accident with an Annulus Ventilauon pressure transmitter failure.

13. Both Annulus Ventilation System fans start automatically as designed. The pressure transmitter for one Annulus Ventilation trains fails, giving a falsely high indication of annulus pressure. When the fans draw the annulus to the setpoint for modulation between exhaust (09 OCT 2019) 15.4 - 31

UFSAR Chapter 15 Catawba Nuclear Station and recirculation, the train affected by the failure continues to operate in the Exhaust mode.

The unaffected train operates in the Recirculation mode. At 2.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> into the event, the control room operators diagnose the failure and trip the affected Annulus Ventilation fan.

The unaffected Annulus Ventilation train operates as designed, with its dampers aligned to modulate between exhaust and recirculation.

14. Both Containment Air Return fans start and run as designed.

The following assumption applies to the calculation of the dose constituent associated with containment leakage for both a rod ejection accident with an Auxiliary Feedwater turbine driven pump failure and a rod ejection accident with an initially closed Control Room Area Ventilation outside air intake.

15. Both Annulus Ventilation fans and Both Containment Air Return fans start and run as designed.

The following assumptions apply to the release of fission products to the reactor coolant and to the environment with primary to secondary leakage.

16. The primary to secondary leak rate is 150 gal/day per steam generator.

17. Noble gases entrained with primary to secondary leakage are assumed to be released directly to the environment.

18. Time spans have been calculated during which the steam generator tubes are at least partly uncovered. Over the time span during which the tubes of a steam generator are calculated to be uncovered, all fission products entrained with leakage through its tubes are assumed to be released directly to the environment.

19. For time spans during which the tubes of a steam generator are calculated to be submerged, fission products other than noble gases entrained with primary to secondary leakage are assumed to mix homogeneously with the water in the secondary side.

20. The iodine partition fraction for steam releases from steam generators is set to 0.01.

21. For the first 30 minutes following a rod ejection accident, the operators are assumed to maintain reactor coolant average temperature at 558ºF. It is assumed that they then begin cooldown of the affected unit at 50ºF/hr. Steam releases are assumed to stop when the unit temperature is lowered to 210ºF.

22. For the rod ejection accident with a motor driven Auxiliary Feedwater pump failure, one steam generator aligned to the failed motor driven Auxiliary Feedwater pump vents from the outboard doghouse. Of the two steam generators aligned to the unaffected motor driven Auxiliary Feedwater, the one with the longer interval of tube bundle uncovery vents from the outboard doghouse. The remaining two steam generators vent from the inboard doghouse.

23. For all other rod ejection scenarios, the two steam generators with the longest intervals of tube bundle uncovery vent from the outboard doghouse. The remaining two steam generators vent from the inboard doghouse.

Additional assumptions and input are listed in Table 15-26. Based on the foregoing model, offsite and control room radiation doses following a rod ejection accident have been calculated and are listed in Table 15-14. These radiation doses are within the acceptance criteria of 10 CFR 50.67, General Design Criterion 19, and Regulatory Guide 1.183.

15.4 - 32 (09 OCT 2019)

Catawba Nuclear Station UFSAR Chapter 15 15.4.8.4 Conclusions Even on a pessimistic basis, the analyses indicate that the described fuel and clad limits are not exceeded. It is concluded that there is no danger of sudden fuel dispersal into the coolant.

Since the peak pressure does not exceed that which would cause stresses to exceed the faulted condition stress limits, it is concluded that there is no danger of further consequential damage to the Reactor Coolant System. The analyses have demonstrated that an upper limit in fission product release, as a result of a number of fuel rods entering DNB, amounts to fifty percent.

15.4.9 Spectrum of Rod Drop Accidents (BWR)

(Not Applicable to Catawba.)

15.4.10 References

1. EPRI, "RETRAN-02: A Program for Transient Thermal-Hydraulic Analysis of Complex Fluid Flow Systems", EPRI NP-1850-CCM-A, Revision 6.1, June, 2007.

2. Deleted Per 1997 Update

3. Deleted Per 1997 Update

4. Deleted Per 1997 Update

5. Letter (NS-TMA-2182), T.M. Anderson (Westinghouse) to S.H. Hanaver (NRC), Dec 30, 1979.

6. EPRI, "VIPRE-01: A Thermal-Hydraulic Code for Reactor Cores", EPRI NP-2511-CCM-A, Revision 4.5, February 2014.

7. Deleted Per 2000 Update.

8. Duke Power Company Thermal - Hydraulic Statistical Core Design Methodology, DPC-NE-2005-PA, Revision 5, March 2016.

9. Deleted Per 1998 Update

10. Deleted Per 1998 Update

11. Deleted Per 2006 Update.

12. DPC-NE-2011-PA, "Nuclear Design Methodology for Core Operating Limits of Westinghouse Reactors", Duke Power Company, Revision 1a, June, 2009.

13. Letter from R. E. Martin (USNRC) to M. S. Tuckman (DPC), "Safety Evaluation of Topical Report BAW-10173P, Revision 2, Mark-BW Reload Safety Analysis for Catawba and McGuire," February 20, 1991.

14. Deleted Per 1998 Update

15. DPC-NE-3001-PA, "Multidimensional Reactor Transients and Safety Analysis Physics Parameters Methodology", Duke Power Company, Revision 1, March 2015.

16. USNRC Standard Review Plan, Section 15.4.8, NUREG-0800, Rev. 2, July 1981.

17. ASME Boiler and Pressure Vessel Code,Section III, "Nuclear Power Plant Components",

ASME.

18. Deleted Per 2006 Update.

(09 OCT 2019) 15.4 - 33

UFSAR Chapter 15 Catawba Nuclear Station

19. Deleted Per 2006 Update.

20. Deleted Per 2006 Update.

21. Deleted Per 2006 Update.

22. Deleted Per 2006 Update.

23. WCAP-15025-P, "Modified WRB-2 Correlation, WRB-2M, for Predicting Critical Heat Flux in 17x17 Rod Bundles with Modified LPD Mixing Vane Grids," Westinghouse, February 1998.

24. SIMULATE-3K Models & Methodology, SSP-98/13, Rev 6, Studsvik Scandpower, January 2009.

25. DPC-NE-2009-PA, "Westinghouse Fuel Transition Report," Duke Power Company, Revision 3a, September, 2011.

26. D.A. Powers and K.C. Washington (Sandia National Laboratories), S.B. Burson (USNRC),

and J.L. Sprung (SNL), A Simplified Model of Areosol Removal by Natural Porcesses in Reactor Containments, NUREG/CR-6189 (SAND 94-0407), July 1996.

THIS IS THE LAST PAGE OF THE TEXT SECTION 15.4.

15.4 - 34 (09 OCT 2019)

Catawba Nuclear Station UFSAR Chapter 15 THIS PAGE LEFT BLANK INTENTIONALLY.

(09 OCT 2019) 15.4 - 35

Catawba Nuclear Station UFSAR Chapter 15 15.5 Increase in Reactor Coolant Inventory A number of events have been postulated which could result in an increase in Reactor Coolant System inventory. Detailed analyses are presented for several such events which have been identified as limiting cases.

Discussions of the following events are presented in this section:

1. Inadvertent Operation of Emergency Core Cooling System During Power Operation

2. Chemical and Volume Control System Malfunction That Increases Reactor Coolant Inventory

3. A number of BWR Transients (Not applicable to Catawba)

The above are considered to be ANS Condition II events. Section 15.0 contains a discussion of ANS classifications and applicable acceptance criteria.

15.5.1 Inadvertent Operation of Emergency Core Cooling System During Power Operation 15.5.1.1 Identification of Causes and Accident Description Spurious Emergency Core Cooling System (ECCS) operation at power could be caused by operator error or a false electrical actuation signal. A spurious signal may originate from any of the safety injection actuation channels as described in Section 7.3.

Following the actuation signal, the suction of the centrifugal charging pumps is diverted from the volume control tank to the refueling water storage tank. The charging pumps then force highly concentrated boric acid solution from the refueling water storage tank through the header and injection lines and into the cold leg of each loop. The safety injection pumps also start automatically but provide no flow when the Reactor Coolant System is at normal pressure. The passive accumulators and the low head system also provide no flow at normal Reactor Coolant System pressure.

A Safety Injection System (SIS) signal normally results in a reactor trip followed by a turbine trip.

However, it cannot be assumed that any single fault that actuates the SIS will also produce a reactor trip. If a reactor trip is generated by the spurious SIS signal, the operator should determine if the spurious signal was transient or steady state in nature. The operator must also determine if the safety injection signal should be blocked. For a spurious occurrence, the operator would stop the safety injection and maintain the plant in the hot standby condition. If the ECCS actuation instrumentation must be repaired, future plant operation will be in accordance with the Technical Specifications.

If the Reactor Protection System does not produce an immediate trip as a result of the spurious SIS signal, the reactor experiences a negative reactivity excursion due to the injected boron causing a decrease in reactor power. The power mismatch causes a drop in Tavg and consequent coolant shrinkage. Pressurizer pressure and water level drop. Load will decrease due to the effect of reduced steam pressure on load after the turbine throttle valve is fully open.

If automatic rod control is used, these effects will be lessened until the rods have moved out of the core. The transient is eventually terminated by the Reactor Protection System low pressure trip or by manual trip.

(09 OCT 2019) 15.5 - 1

UFSAR Chapter 15 Catawba Nuclear Station The time to trip is affected by initial operating conditions including core burnup history, which affects initial boron concentration, rate of change of boron concentration, and Doppler and moderator coefficients.

Recovery from this second case is made in the same manner as described for the case where the SIS signal results directly in a reactor trip. The only difference is the lower Tavg and pressure associated with the power mismatch during the transient. The time at which reactor trip occurs is of little concern for this transient. At lower loads, coolant contraction will be slower resulting in a longer time to trip.

Inadvertent operation of the ECCS at power is classified as a Condition II event, a fault of moderate frequency. See Section 15.0 for a discussion of Condition II events.

15.5.1.2 Analysis of Effects and Consequences Method of Analysis The inadvertent operation of the Emergency Core Cooling System could be caused by either operator error or by a spurious electrical actuation signal. Upon receipt of the actuation signal, the centrifugal charging pumps begin delivering highly borated Refueling Water Storage Tank water to the Reactor Coolant System. The resultant negative reactivity insertion causes a decrease in core reactivity and, consequently, a decrease in temperature. Initially, coolant shrinkage causes a reduction in both pressurizer water level and pressure. Core cooling capability (DNB) is the primary concern during this time period due to the decrease in system pressure. Following the initial depressurization, the increase in reactor coolant inventory causes pressurizer level to increase and pressurization to occur. Pressurizer level might increase sufficiently to overfill the pressurizer and cause water relief through the pressurizer safety valves (PSVs). Water relief through the PSVs could degrade valve operability and lead to a Condition III event.

Core Cooling Evaluation The most severe potential challenge to core cooling occurs if the postulated transient is initiated from a full power initial condition. The magnitude of the pressure decrease for this transient is no more severe than that for the inadvertent opening of a pressurizer safety or relief valve transient, which will result in a reactor trip on low pressurizer pressure or overtemperature T.

Furthermore, the opening of a PSV does not introduce core power and Reactor Coolant System temperature decreases that are as severe as an inadvertent ECCS actuation. Neither event involves any reduction in the Reactor Coolant System flow rate, since the reactor coolant pumps are not tripped. Therefore, the DNB results of this transient are bounded by the inadvertent opening of a pressurizer safety or relief valve transient. A quantitative core cooling capability analysis of this transient is therefore not a part of the licensing basis.

Pressurizer Overfill Analysis The concern in the pressurizer overfill analysis is that water relief through the PSVs will degrade valve operability and lead to a Condition III event. However, even if water relief occurs, valve operability is not degraded provided that the temperature of the pressurizer water is sufficiently high. Therefore, the acceptance criterion for this analysis is the minimum water relief temperature to ensure PSV operability. The following assumptions are made in performing this analysis:

1. A hot zero power initial condition is assumed in this analysis. Reference 3 states that the acceptable initial power for the analysis is the licensed core thermal power, i.e., full power.

However, lower power is more limiting in order to minimize the initial NC system 15.5 - 2 (09 OCT 2019)

Catawba Nuclear Station UFSAR Chapter 15 temperature. If overfill occurs at lower initial power, then the water relief temperature is more likely to be less than the acceptance criterion.

2. Actual system response to a safety injection (SI) would be an initial pressure drop then subsequent pressurization above initial pressure. During the depressurization phase, SI flow would increase above the initial flow rate, and during the pressurization phase SI flow would decrease below initial flow rate. RCS pressure is assumed conservatively low (1700 psia) to determine the SI flow during the event.

3. Low initial temperature (hot zero power programmed Tavg less the 4°F temperature allowance, or 553°F) is used in order to minimize pressurizer water temperature.

4. High steam generator tube plugging (20%) and a smaller primary system U-tube volume (Model D steam generators) are assumed in order to decrease the volume of the initial RCS water, which minimizes the RCS water temperature as it mixes with the cold SI water.

5. Per Technical Specification requirements for Modes 1 and 2, all reactor coolant pumps are assumed to be operating. Mixing of the cold SI water injected into the RCS cold legs reduces the temperature of the water in the RCS hot leg to which the pressurizer surge line is connected, thus reducing the temperature of the liquid which might be relieved through the PSVs.

6. The pressurizer heaters are assumed to be in manual and off since heater operation would increase the temperature of the pressurizer water. Normal makeup is isolated upon SI, and credit is taken neither for letdown to lessen the impact of the injected mass nor pressurizer sprays or PORVs to lessen the likelihood of PSV opening.

7. A maximum safety injection flow rate from both high head safety injection pumps (405 gpm) is assumed. RCS pressure remains above the shutoff head of the intermediate head and low head safety injection pumps for the duration of the event. Operator action is assumed in 15 minutes to terminate the flow from the high head safety injection pumps.

8. Minimum injection temperature (60°F) is assumed in order to minimize relief temperature.

Results Calculated PSV water relief temperature remains above 500°F. Relief of water at a temperature this high will not result in failure of the PSVs to close.

15.5.1.3 Environmental Consequences There are minimal radiological consequences associated with inadvertent ECCS operation. If the SIS signal results in a reactor trip, the reactor trip causes a turbine trip and heat may be removed from the secondary system through the steam generator power relief valves or safety valves. Since no fuel damage is postulated to occur from this transient, the radiological consequences associated with atmospheric steam releases from this event would be less severe than the steam line break event analyzed in Section 15.1.5.

15.5.1.4 Conclusions Results of the analysis show that spurious safety injection without immediate reactor trip presents no hazard to the integrity of the Reactor Coolant System. Based on the DNB results presented for the inadvertent opening of a pressurizer safety or relief valve transient (15.6.1),

there will be no cladding damage and no release of fission products to the Reactor Coolant System. If the reactor does not trip immediately, the low pressure reactor trip will be actuated.

(09 OCT 2019) 15.5 - 3

UFSAR Chapter 15 Catawba Nuclear Station This trips the turbine and prevents excessive cooldown thereby expediting recovery from the incident.

15.5.2 Chemical and Volume Control System Malfunction that Increases Reactor Coolant Inventory An increase in reactor coolant inventory which results from the addition of cold, unborated water to the Reactor Coolant System is analyzed in Section 15.4.6. An increase in reactor coolant inventory which results from the injection of highly borated water into the Reactor Coolant System is analyzed in Section 15.5.1.

15.5.3 A Number of BWR Transients Not applicable to Catawba.

15.5.4 References

1. Deleted Per 1995 Update.

2. Deleted Per 1995 Update.

3. NUREG-0800, "USNRC Standard Review Plan".

THIS IS THE LAST PAGE OF THE TEXT SECTION 15.5.

15.5 - 4 (09 OCT 2019)

Catawba Nuclear Station UFSAR Chapter 15 15.6 Decrease in Reactor Coolant Inventory A number of events have been postulated which could result in a decrease in Reactor Coolant System inventory. Detailed analyses are presented for several such events which have been identified as limiting cases.

Discussions of the following events are presented in this section:

1. Inadvertent opening of a pressurizer safety or relief valve.

2. Failure of small lines carrying primary coolant outside containment.

3. Steam Generator Tube Rupture.

4. BWR Piping failure outside containment (Not applicable to Catawba).

5. Loss-of-Coolant Accident resulting from a spectrum of postulated piping breaks within the Reactor Coolant Pressure Boundary.

6. A number of BWR transients (Not applicable to Catawba).

Items 1 and 2 are considered to be ANS Condition II events, item 5 entails both Condition III and IV events, and item 3 is considered to be an ANS Condition IV event. Section 15.0 contains a discussion of ANS classifications and applicable acceptance criteria.

15.6.1 Inadvertent Opening of a Pressurizer Safety or Relief Valve 15.6.1.1 Identification of Causes and Accident Description An accidental depressurization of the Reactor Coolant System could occur as a result of an inadvertent opening of a pressurizer relief or safety valve. Since a safety valve is sized to relieve approximately twice the steam flowrate of a relief valve, and will therefore allow a much more rapid depressurization upon opening, the most severe core conditions resulting from an accidental depressurization of the Reactor Coolant System are associated with an inadvertent opening of a pressurizer safety valve. Initially, the event results in a rapidly decreasing Reactor Coolant System pressure. The pressure decreases throughout the relatively short fraction of the transient which is simulated in a DNBR analysis. The effect of the pressure decrease would be to decrease power via the moderator density feedback, but the rod control system (if in the automatic mode) functions to maintain the power and average coolant temperature until reactor trip occurs.

The reactor might be tripped by either of the following Reactor Protection System signals:

1. Overtemperature T

2. Pressurizer low pressure An inadvertent opening of a pressurizer safety valve is classified as an ANS Condition II event, a fault of moderate frequency. See Section 15.0 for a discussion of Condition II events.

15.6.1.2 Analysis of Effects and Consequences Method of Analysis The accidental depressurization transient is analyzed by employing the detailed digital computer code RETRAN-02 described in the introduction of this chapter. The VIPRE-01 code is used to calculate DNBR during the transient based on the RETRAN-02 boundary conditions. It is also (09 OCT 2019) 15.6 - 1

UFSAR Chapter 15 Catawba Nuclear Station analyzed with the Statistical Core Design Methodology as described in Reference 44. Plant characteristics and initial conditions are discussed in Section 15.0 (see Table 15-4). The analysis utilizes a Catawba Unit 2 RETRAN-02 model. However, input assumptions are conservatively chosen such that the results of the analysis bound both Catawba units.

In order to give conservative results in calculating the DNBR during the transient, the following assumptions are made:

1. Initial reactor power, pressure, flow, and RCS temperatures are assumed to be at their nominal values. Uncertainties in initial conditions are included in the limit DNBR as described in Reference 44.

2. A zero moderator coefficient of reactivity is assumed. The spatial effect of voiding due to local or subcooled boiling is not considered in the analysis with respect to reactivity feedback or core power shape.

3. A least negative Doppler coefficient of reactivity is assumed.

Normal reactor control systems are not required to function. However, the Rod Control System is assumed to be in the manual mode. The Reactor Protection System functions to trip the reactor on the appropriate signal. No single active failure will prevent the Reactor Protection System from functioning properly.

Results The system response to an inadvertent opening of a pressurizer safety or relief valve is shown in Figure 15-100, Figure 15-101 parts 1 & 2. Figure 15-100 illustrates the nuclear power transient following the depressurization. Nuclear power maintains the initial value until reactor trip occurs on low pressurizer pressure. The pressure decay transient following the accident is given in Figure 15-101 part 1. Pressure drops more rapidly while core heat generation is reduced via the trip. The DNBR decreases initially, but increases rapidly following the trip, as shown in Figure 15-101 part 2. The DNBR remains above the limit value throughout the transient.

The calculated sequence of events for the inadvertent opening of a pressurizer safety valve incident is shown on Table 15-28.

15.6.1.3 Conclusions The results of the analysis show that the pressurizer low pressure Reactor Protection System signal provides adequate protection against the RCS depressurization event. No fuel or clad damage is predicted for this accident.

15.6.2 Break in Instrument Line or Other Lines from Reactor Coolant Pressure Boundary that Penetrate Containment 15.6.2.1 Identification of Causes and Accident Description Instrument lines connected to the RCS that penetrate the containment are discussed in Section 6.2.4. There are also the sample lines from the hot legs of reactor coolant loops A and D, the sample lines from the steam and liquid space of the pressurizer, and the Chemical and Volume Control System (CVCS) letdown and excess letdown lines that penetrate the containment. The sample lines are provided with normally closed isolation valves on both sides of the normally open containment isolation valves on both sides of the containment wall. In all cases the 15.6 - 2 (09 OCT 2019)

Catawba Nuclear Station UFSAR Chapter 15 containment isolation provisions are designed in accordance with the requirements of General Design Criteria 55 of Appendix A to 10CFR 50.

15.6.2.2 Analysis of Effects and Consequences The most severe pipe rupture with regard to radioactivity release during normal plant operation occurs in the CVCS. This would be a complete severance, at rated power conditions, of the 3 inch letdown line just outside containment, between the outboard letdown isolation valve and the letdown heat exchanger (see Figure 9-89). The occurrence of a complete severance of the letdown line would result in a loss of reactor coolant at the rate of approximately 140 gpm (referenced at a density of 62 lb/ft3). Since the release rate is within the capability of the reactor makeup system, it would not result in Engineered Safety Features System actuation. Area radiation and leakage detection instrumentation provide the primary means for detection of a letdown line rupture. Frequent operation of the CVCS reactor makeup control system and other CVCS instrumentation would aid the operator in identifying and isolating the rupture within 30 minutes. Once the rupture is identified, the operator would isolate the letdown line rupture by closing the letdown orifice isolation valves and the pressurizer low level letdown isolation valves.

Alternatively, the operator would close the letdown line isolation valve outside containment to isolate the rupture. All valves are provided with control switches at the main control board.

There are no single failures that would prevent isolation of the letdown line rupture.

The rupture outside containment of any other small line connected to the reactor coolant system can be isolated and will have less severe consequences with regard to release of reactor coolant.

Normal AC power was assumed to be maintained. This increases the amount of fission products released and the accumulation of fission products in the control room. Several cases were analyzed based as follows:

1) Analyses were completed for letdown line breaks occurring either in Unit 1 or Unit 2.

2) Analyses were completed for two different iodine spike: a pre-existent iodine spike or a concurrent iodine spike.

For the pre-existent iodine spike, the reactor coolant iodine specific activity is set to 60

µCi/gm Dose Equivalent Iodine-131 (DEI). This is the maximum iodine specific activity allowed in the reactor coolant at full power operations.

For the concurrent iodine spike, the reactor coolant iodine specific activity is set to 1 µCi/gm DEI. This is the maximum equilibrium iodine specific activity allowed in the reactor coolant during unit power operations. At event initiation, the rate of appearance of iodine in the reactor coolant presumably is increased to 335 times its equilibrium value. The concurrent iodine spike is assumed to end 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> after the initiating event.

3) No single failure has any impact on offsite radiation doses following the instrument line break. The following two events were assumed separately in the calculation of radiation doses to the control room operators.

In one set of scenarios, the on-line Control Room Area Ventilation pressurized filter train was assumed to fail. In the absence of Safety Injection and with normal AC power maintained, the operators must start of the redundant Control Room Area Ventilation pressurized filter train. Presumably they start it 30 minutes after event initiation.

In the remaining set of scenarios, one control room outside air intake is assumed to be initially closed.

(09 OCT 2019) 15.6 - 3

UFSAR Chapter 15 Catawba Nuclear Station Other assumptions and parameters are found in Table 15-29.

15.6.2.3 Environmental Consequences Based on the foregoing model, total effective dose equivalents (TEDEs) to the Exclusion Area Boundary (EAB), the boundary of the Low Population Zone (denoted as the LPZ), and the control room operators were calculated. The results appear in Table 15-29. The acceptance criterion for radiation doses at the EAB and the LPZ is set to 2.5 Rem. The NRC acceptance criterion in 10 CFR 50.67 and Regulatory Guide 1.183 for TEDEs to the control room operators following any design basis accident is 5 Rem. As seen in Table 15-29, all radiation doses resulting from the failure of the 3 inch letdown line are within the corresponding acceptance criteria.

15.6.3 Steam Generator Tube Failure 15.6.3.1 Identification of Causes and Accident Description The accident examined is the complete severance of a single steam generator tube. The accident is assumed to take place at power with the reactor coolant contaminated with fission products corresponding to continuous operation with a limited amount of defective fuel rods.

The accident leads to an increase in contamination of the secondary system due to leakage of radioactive coolant from the RCS. In the event of a coincident loss of offsite power or failure of the condenser steam dump system, discharge of activity to the atmosphere takes place via the steam generator safety and/or power operated relief valves.

In view of the fact that the steam generator tube materials are highly ductile Inconel-600 and Inconel-690, the assumption of a complete severance is considered somewhat conservative.

The more probable mode of tube failure would be one or more minor leaks of undetermined origin. Activity in the Steam and Power Conversion System is subject to continual surveillance and an accumulation of minor leaks which exceeds the limit established in the Technical Specifications is not permitted during the unit operation.

The operator is expected to determine that a steam generator tube rupture has occurred and to identify and isolate the affected steam generator on a restricted time scale, in order to minimize contamination of the secondary system and ensure termination of radioactive release to the atmosphere from the affected unit. The recovery procedure can be carried out on a time scale which ensures that break flow to the secondary system is terminated before water level in the affected steam generator rises into the main steam piping. Sufficient indications and controls are provided to enable the operator to carry out these functions satisfactorily.

Immediately apparent symptoms of a tube rupture accident, such as falling pressurizer pressure and level and increased charging pump flow, are also symptoms of small steam line breaks and loss of coolant accidents. It is therefore important for the operator to determine that the accident is a rupture of a steam generator tube, in order to carry out the correct recovery procedure. The accident under discussion can be identified by the following method. In the event of a complete tube rupture, the reactor coolant system pressure decreases and the condenser air ejector radiation monitor (if aligned) exhibit abnormally high readings. If the containment pressure, containment radiation, and containment recirculation sump level exhibit normal readings, then a steam generator rupture is diagnosed to have occurred.

Note that break sizes smaller than complete severance of a tube, with less break flow from primary to secondary, exhibit a slower rise in steam generator water level, and an increased time interval for actuation of the condenser air ejector radiation monitor. Therefore, more time 15.6 - 4 (09 OCT 2019)

Catawba Nuclear Station UFSAR Chapter 15 may be available to the operator to diagnose the accident and take steps to isolate the ruptured steam generator.

If normal operation of the various plant control systems is assumed, the following events are initiated by a tube rupture:

1. Pressurizer low pressure and low level alarms are actuated and charging pump flow increases in an attempt to maintain pressurizer level. On the secondary side, steam flow/feedwater flow mismatch occurs as feedwater flow to the affected steam generator is reduced as a result of primary coolant break flow to that generator.

2. The decrease in RCS pressure, due to continued loss of reactor coolant inventory, leads to a reactor trip signal on low pressurizer pressure or overtemperature T. The resultant plant cooldown following reactor trip leads to a rapid decrease in pressurizer level. A safety injection signal, initiated manually or by low pressurizer pressure, follows soon after reactor trip. The safety injection signal automatically terminates normal feedwater supply and initiates auxiliary feedwater addition.

3. The steam generator leakage monitor adjacent to the affected main steam line will alarm based on increased Nitrogen-16 activity.

4. The condenser air ejector radiation monitor will alarm, indicating a sharp increase in radioactivity in the secondary system, and will automatically terminate steam generator blowdown.

5. The reactor trip automatically trips the turbine and, if offsite power is available, the steam dump valves open, permitting steam dump to the condenser. In the event of a coincident station blackout (loss of offsite power), as assumed in the analyses presented in this section, the steam dump valves automatically close to protect the condenser. The steam generator pressure rapidly increases resulting in steam discharge to the atmosphere through the steam generator safety and/or power operated relief valves. Steam flow as a function of time is constant initially until reactor trip. This is followed by a turbine trip which results in a large decrease in flow, but a rapid increase in steam pressure to the safety valve setpoint.

6. Following reactor trip, the continued action of the auxiliary feedwater supply and borated safety injection flow (supplied from the RWST) provide a heat sink which absorbs the decay heat.

7. Safety injection flow results in increasing pressurizer water level, the rate of increase depending upon the amount of auxiliary equipment operating.

8. In order to stop the leakage from the Reactor Coolant System to the ruptured steam generator, the operator uses the intact steam generators to reduce the temperature of the primary coolant. This is accomplished using steam dump to the condenser or, in the absence of offsite power, the PORVs on the steam lines of the intact steam generators.

Motive force for the steam line PORVs is provided by the Instrument Air (VI) System. In the absence of the VI system, nitrogen cylinders in the Doghouse would be used to operate these valves.

The reduction in primary coolant temperature enables the Reactor Coolant System to remain subcooled as the Reactor Coolant System pressure is reduced to approximately that of the ruptured steam generator. The pressure reduction eliminates the driving force for the primary-to-secondary leakage. The reduction is accomplished using normal pressurizer spray. For a case in which the VI system is unavailable (this system also provides motive force for the normal pressurizer spray valves and the pressurizer PORVs), the operator (09 OCT 2019) 15.6 - 5

UFSAR Chapter 15 Catawba Nuclear Station aligns the cold leg accumulator nitrogen gas as a motive force for either of two pressurizer PORVs.

A steam generator tube failure is classified as an ANS Condition IV event, a limiting fault. See Section 15.0 for a discussion of Condition IV events.

15.6.3.2 Analysis of Effects and Consequences Method of Analysis Three separate evaluations are performed for this accident. First, the offsite doses are calculated. Second, the margin to steam generator overfill is determined. Third, the potential for DNB to cause fuel cladding failures, which would increase the offsite doses, is evaluated.

The separate evaluations sometimes make conflicting assumptions in order to conservatively determine the degree to which the separate acceptance criteria are challenged.

Steam generator tube rupture scenarios with failure of Distribution Center EDE or EDF are excluded from the design and license bases of Catawba per Facility Operating License Amendment 217/211 (Reference 49). Refer to Section 8.3.2.2.1 for additional details.

Detailed thermal-hydraulic calculations are performed to determine primary to secondary mass release and to determine the amount of steam vented from each of the steam generators, using the RETRAN-02 code, described in the introduction to this chapter, and using the methodology described in Section 7.2.2 of Reference 34.

In estimating the mass transfer from the RCS through the broken tube for dose calculation purposes, the following assumptions are made:

1. Reactor trip occurs on low pressurizer pressure or manual operator action at 20 minutes.

Loss of offsite power occurs at reactor trip, which results in a reactor coolant pump trip.

2. Following the initiation of the safety injection signal, two high-head safety injection pumps are aligned to the safety injection flowpath and two intermediate-head safety injection pumps are actuated. These pumps continue to deliver flow until safety injection is manually terminated by the operator.

3. After reactor trip, break flow reaches an equilibrium when it is balanced by incoming safety injection flow as shown in Figure 15-103. The resultant break flow continues from plant trip until pressures are equalized. Operator actions are modeled to terminate break flow.

4. The single failure identified for maximizing offsite dose is the failure of the PORV on the ruptured steam generator to close.

The above assumptions, extremely conservative for the design basis tube rupture, are made to maximize doses and do not model all expected operator actions for recovery. Plant characteristics and initial conditions are discussed in Section 15.0 (see Table 15-4). Both the feedring steam generators (Unit 1) and the model D5 steam generators (Unit 2) are analyzed.

Due to the similarity in the system response between the two analyses, only the feedring steam generator analysis that is representative of Unit 1 is presented.

Detailed RETRAN-02 calculations are also performed to evaluate steam generator overfill for both the Catawba Unit 1 feedring steam generators (FSG) and the Catawba Unit 2 Model D5 steam generators. The method used for both analyses is based on the methodology presented in Reference 48. The results indicate that steam generator overfill will not occur for either Catawba Unit.

15.6 - 6 (09 OCT 2019)

Catawba Nuclear Station UFSAR Chapter 15 The DNBR calculation for this accident is performed with the VIPRE-01 computer code described in introduction to this chapter using the Statistical Core Design procedure described in Reference 44 and the WRB-2M critical heat flux correlation for Westinghouse RFA fuel (Reference 6). DNBR is a concern for this transient because the assumed loss of offsite power causes a reactor coolant pump coastdown. Because of the loss of inventory through the ruptured tube, the RCS pressure is significantly lower than the normal operating value when the coastdown occurs. Since the loss of offsite power is assumed to occur coincident with reactor and turbine trip, the amount of depressurization prior to the coastdown would be limited by the overtemperature T trip function. This trip setpoint is reduced both by depressurizations and RCS heatup. Because of the relative effects on DNBR of the heatup and depressurization allowed by this trip function, the steam generator tube rupture coastdown transient from a lower RCS pressure is bounded by the complete loss of flow transient in Section 15.3.2.

Results The results of the thermal-hydraulic calculations for dose inputs are shown in the following figures.

Loop 1 models a single RCS loop with the ruptured SG.

Loop 3 models a double RCS loop with intact SGs.

Loop 2 models the remaining single RCS loop with an intact SG.

Figure 15-103 Break Flow Figure 15-104 Pressurizer Pressure Figure 15-105 Reactor Coolant System Hot Leg Temperatures Figure 15-106 Reactor Coolant System Cold Leg Temperatures Figure 15-107 Pressurizer Water Level Figure 15-108 Steam Generator Pressure Figure 15-229 Steam Generator Water Levels The sequence of events is presented in Table 15-49 for both the Dose and DNB Evaluations.

15.6.3.3 Environmental Consequences The reactor coolant flow from the failed steam generator tube accounts for most of the fission products released to the environment following a postulated steam generator tube rupture. All noble gases entrained with the break flow are released to the environment. Iodine radioisotopes entrained with the break flow escape in proportion to the break flow flash fraction.

The remainder of the break flow mixes with the water in the secondary side of the ruptured steam generator, from whence some of the iodine radioisotopes are released with steam generator boiloff.

Radiological consequences of the design basis steam generator tube rupture have been analyzed. The conservative analysis was completed in conformance to Regulatory Guide 1.183 for the method of Alternative Source Terms. Radiation doses (total effective dose equivalents -

TEDEs) were calculated for several steam generator tube rupture scenarios. These scenarios involved variations in the following characteristics:

1) The steam generator tube rupture was postulated to occur at Unit 1 for some scenarios and in Unit 2 for others.

(09 OCT 2019) 15.6 - 7

UFSAR Chapter 15 Catawba Nuclear Station

2) The reactor coolant activity was varied as follows:

For some scenarios, there is a pre-existent iodine spike. For these scenarios, the reactor coolant DEI specific activity is at the maximum level permitted in the plant Facility Operating License (FOL) 159/151 (26 µCi/gm at full power) at event initiation.

For other scenarios, there is a concurrent iodine spike precipitated by the accident. The DEI specific activity in the reactor coolant is at the maximum equilibrium level permitted in the plant FOL 159/151 (0.46 µCi/gm). With the accident the rate of appearance of iodine in the reactor coolant is increased to 335 times its equilibrium value.

3) The steam generator tube rupture scenarios included different single failures as follows:

For some steam generators tube rupture scenarios, one of the two control room outside air intakes is assumed to be closed. Presumably the operators open it within 10 hours1.157407e-4 days <br />0.00278 hours <br />1.653439e-5 weeks <br />3.805e-6 months <br /> after trip of the affected nuclear unit.

For the remaining steam generator tube rupture scenarios, the power operated relief valve (PORV) for the ruptured steam generator is assumed to fail open. Presumably the operators close its isolation valve after they have identified the ruptured steam generator.

For all steam generator tube rupture scenarios, the following assumptions were made.

1) Prior to the accident, the activity of fission products is at equilibrium in both the primary and secondary systems.

2) The activity in the primary system is set to correspond to the limiting values for specific activities in the reactor coolant set in the plant FOL 159/151 and the iodine spike.

3) The activity in the steam generator shell side is set to correspond to the limiting value for DEI specific activity set for the secondary systems in the plant Technical Specifications.

4) For defining the radioactive source term in the balance of the secondary systems of the affected unit, perfect scrubbing of iodine in the main condenser is assumed. For the calculation of fission product releases before unit trip, the efficiency of the main condenser in scrubbing iodine from steam condensing in it is set to 85%.

5) Offsite power is lost with trip of the affected nuclear unit.

6) All noble gases entrained in the break flow escape.

7) Iodine entrained in the break flow escapes directly to the environment in proportion to the break flow flash fraction.

8) Reactor coolant flow through the broken steam generator tube ends after termination of Safety Injection and subsequent approach of the reactor coolant pressure to the pressure in the ruptured steam generator. Within half an hour, the control room operators being long-term cooldown of the affected nuclear unit. They choose to cool the ruptured steam generator by routing Auxiliary Feedwater flow to it and steaming it to control inventory.

During this cooldown, additional break flow is assumed and set to 10% of the maximum break flow rate before Safety Injection termination. Fission product releases from the ruptured steam generator stop once the control room operators cool it to 350°F, and allow for an additional 12-hour delay prior to opening the ND loop suctions from the NC system to allow any pressure trapped between the valve seats to depressurize to suction piping pressure.

9) Releases from the intact steam generators end when the affected nuclear unit is cooled to 211°F.

15.6 - 8 (09 OCT 2019)

Catawba Nuclear Station UFSAR Chapter 15

10) The ruptured steam generator and one intact steam generator is associated with the outboard steam generator doghouse. The remaining two intact steam generators are associated with the inboard steam generator doghouse.

Additional assumptions, some of them associated with a representative steam generator tube rupture scenario, are listed in Table 15-31.

Based on the foregoing model, TEDEs at the exclusion area boundary, boundary of the low population zone, and to the control room operators were calculated. The limiting TEDEs for these locations are listed in Table 15-31. The TEDEs at both offsite locations and in the control room are below the corresponding regulatory acceptance criteria for all steam generator tube rupture scenarios.

The current controls for dose equivalent I-131 (DEI) specific activity are established by the license conditions of Facility Operating License Amendment 159/151 (Reference 83). The current limits are 0.46 µCi/gm DEI for equilibrium reactor coolant specific activity and 26 µCi/gm DEI for transient reactor coolant specific activity. These limits are based on a supplemental calculation of radiation doses for a postulated steam generator tube rupture with failure of control power to the power operated relief valves of two steam generators.

The reactor coolant activity assumed for the supplemental analysis as based on the following two cases:

Case 1: There is pre-existing iodine spike at the initiation of the accident. The reactor coolant specific activity is 26 µCi/gm DEI.

Case 2: There is a concurrent iodine spike at the time the accident occurs. The primary coolant activity at accident initiation is set to 0.46 µCi/gm DEI. The reactor coolant iodine activity following accident initiation are found by increasing the equilibrium appearance rate in the coolant by a factor of 500.

The following assumptions and parameters are used to calculate the activity release and offsite radiation doses in this supplmental analysis.

1. The accident begins with the double ended rupture of a single steam generator tube. It is followed by the transfer of approximately 275,000 pounds of reactor coolant into the shell side of the defective steam generator.

2. The control room operators trip the affected unit 20 minutes after accident initiation.

3. Offsite power is assumed to be lost with trip of the affected unit.

4. The primary to secondary leakage is 150 gpd (0.104 gpm) in each of the intact steam generators.

5. All noble gases entrained with the break flow are released to the environment.

6. Primary bypass of atomized droplets is assumed to occur for the first 5 minutes after unit trip. The bypass fraction for this time span is set to 0.12 based on methodology developed by Westinghouse for calculating primary bypass fractions for the steam generator tube rupture (Reference 84).

7. A portion of the break flow is assumed to flash based on conditions upstream and downstream of the break. No credit is taken for scrubbing of flashed break flow.

8. The break flow from the ruptured steam generator tube stops 106 minutes after accident initiation.

(09 OCT 2019) 15.6 - 9

UFSAR Chapter 15 Catawba Nuclear Station

9. After termination of break flow, long-term cooldown of the affected nuclear unit at 50 ºF/hr begins. It is assumed that the operators cool the ruptured steam generator by releasing steam from it and replacing the released water with flow from the Auxiliary Feedwater System. Cooldown is terminated at 355 minutes.

10. Other assumptions are listed in Table 15-74.

Based on the foregoing model, thyroid and whole body radiation doses are calculated at the exclusion area boundary and the low population zone. The thyroid radiation doses at the Exclusion Area Boundary are presented in Table 15-31. They are limiting with respect to relative margin to the germane regulatory acceptance criteria. The radiation doses at these distances are below the regulatory acceptance criteria for each of the above cases analyzed.

15.6.4 Spectrum of BWR Steam System Piping Failures Outside Containment This section is not applicable to Catawba.

15.6.5 Loss-of-Coolant Accidents 15.6.5.1 Identification of Causes and Accident Description Acceptance Criteria and Frequency Classification A loss-of-coolant accident (LOCA) is the result of a pipe rupture of the Reactor Coolant System (RCS) pressure boundary. For the analyses presented here, a major pipe break (large break) is defined as a rupture with a total cross sectional area equal to or greater than 1.0 ft2. This event is considered an ANS Condition IV event, a limiting fault. See Section 15.0 for a discussion of Condition IV events.

A minor pipe break (small break), as considered in this section, is defined as a rupture of the reactor coolant pressure boundary (Section 5.2) with a total cross-sectional area less than 1.0 ft2 in which the normally operating charging system flow is not sufficient to sustain pressurizer level and pressure. This is considered a Condition III event, an infrequent fault. See Section 15.0 for a discussion of Condition III events.

Table 15-4 summarizes input parameters and initial conditons used.

The Acceptance Criteria for the loss-of-coolant accident is described in 10CFR 50.46 as follows:

1. The calculated peak fuel element cladding temperature is below the requirement of 2200°F.

2. The cladding temperature transient is terminated at a time when the core geometry is still amenable to cooling. The localized cladding oxidation limits of 17% are not exceeded during or after quenching.

3. The calculated total amount of hydrogen generated from the chemical reaction of the cladding with water or steam shall not exceed 0.01 times the hypothetical amount that woiuld be generated if all of the metal in the cladding cylinders surrounding the fuel, excluding the cladding surrounding the plenum volume, were to react.

4. The core remains amenable to cooling during and after the break.

5. The core temperature is reduced and decay heat is removed for an extended period of time, as required by the long lived radioactivity remaining in the core.

These criteria were established to provide significant margin in ECCS performance following a LOCA.

15.6 - 10 (09 OCT 2019)

Catawba Nuclear Station UFSAR Chapter 15 For the best-estimate LBLOCA analysis, it is noted that criteria 1 through 3 above are satisfied by ensuring that there is a high level of probability that when uncertainties in the analysis method and inputs are accounted for, the criteria are not exceeded.

The assumptions used in defining safety injection flow for a large or small cold legs break LOCA analysis are chosen to yield conservative results (maximize the calculated peak cladding temperature).

A single failure is assumed in both the small break and large break analyses that result in only one train of safety injection.

The remaining assumptions used in defining safety injection flow for either a large cold leg break LOCA analysis includes:

1. The spilling of the broken loop accumulator directly to containment.

2. The spilling of the safety injection line attached to the broken cold leg.

Each of the four RCS cold legs has an injection line attached. Flow delivered into the RCS is computed based on the following logic:

1. The ECCS pumps start and deliver flow into the containment through all four branch injection lines.

2. One branch injection line spills to containment backpressure. The branch injection line with minimum system resistance is selected to spill to minimize reactor delivery. Therefore, only the remaining three branch lines actually deliver flow into the reactor vessel via the cold legs.

3. The flow delivered into the reactor through the reactor coolant pump seals is assumed to be lost and, therefore, seal injection is not included in the total core delivery.

4. SBLOCA sensitivity analyses have determined that ECCS injection into the broken loop yield more conservative results. Therefore the SBLOCA analysis assumes ECCS injection into the broken loop.

In all cases, small breaks (less than 1.0 ft2) yield results with more margin to the Acceptance Criteria limits than large breaks.

Description of a Large Break LOCA Transient Should a major break occur, depressurization of the RCS results in a pressure decrease in the pressurizer. The reactor trip signal subsequently occurs when the pressurizer low pressure trip setpoint is reached. A safety injection signal (SI) is generated when the appropriate setpoint is reached. The countermeasures will limit the consequences of the accident in two ways:

1. Reactor trip and borated water injection complement void formation in causing rapid reduction of power to a residual level corresponding to fission product decay heat.

However, no credit is taken in the peak clad temperature calculation for boron content of the injection water. In addition, the insertion of control rods to shut down the reactor is neglected in the large break analysis.

2. Injection of borated water provides for heat transfer from the core and prevents excessive clad temperatures.

Deleted Paragraph Per 2001 Update.

Before the break occurs, the unit is in an equilibrium condition, i.e., the heat generated in the core is being removed via the secondary system. During blowdown, heat from fission product decay, hot internals, and the vessel continues to be transferred to the reactor coolant. At the (09 OCT 2019) 15.6 - 11

UFSAR Chapter 15 Catawba Nuclear Station beginning of the blowdown phase, the entire RCS contains subcooled liquid which transfers heat from the core by forced convection with some fully developed nucleate boiling. Thereafter, the core heat transfer is based on local conditions with transition boiling and forced convection to steam as the major heat transfer mechanisms.

The heat transfer between the Reactor Coolant System and the secondary system may be in either direction depending on the relative temperatures. In the case of continued heat addition to the secondary, secondary system pressure increases and the main steam safety valves may actuate to limit the pressure. Makeup water to the secondary side is automatically provided by the Auxiliary Feedwater System. The SI actuates a feedwater isolation signal, which isolates normal feedwater flow by closing the main feedwater isolation valves, and also initiates auxiliary feedwater flow by starting the auxiliary feedwater pumps. The secondary flow aids in the reduction of Reactor Coolant System pressure.

When the Reactor Coolant System depressurizes to approximately 600 psia, the accumulators begin to inject borated water into the reactor coolant loops.

The sequence of events following a nominal large double-ended cold leg guillotine break LOCA is presented in Table 15-68. A large double-ended cold leg guillotine (DECLG) break is assumed to open almost instantaneously in one of the main RCS pipes. Calculations have demonstrated that the most severe transient results occur for a DECLG break between the pump and the reactor vessel.

Immediately following the cold leg break, a rapid system depressurization occurs along with a core flow reversal due to a high discharge of subcooled fluid into the broken cold leg and out the break. The fuel rods go through departure from nuclear boiling (DNB) and the cladding rapidly heats up, while the core power shuts down due to voiding in the core. The hot water in the core and upper plenum flashes to steam, and subsequently the cooler water in the lower plenum, upper head and downcomer begins to flash. Once the system has depressurized to the accumulator pressure, the accumulators begin to inject cold borated water into the intact cold legs. During the blowdown period a portion of the injected ECCS water is calculated to be bypassed around the downcomer and out the break. The bypass period ends as the system pressure (initially assumed at a nominal 2250 psia) continues to decrease and approaches the containment pressure, resulting in reduced break flow and consequently reduced core flow.

As the refill period begins, the core begins a period of heatup and the vessel begins to fill with ECCS water. This phase continues until the lower plenum is filled and the bottom of the core begins to reflood and entrainment begins.

During the reflood period, the core flow is oscillatory as ECCS water periodically rewets and quenches the hot fuel cladding which generates steam and causes system repressurization.

The steam and entrained water must pass through the vessel upper plenum, the hot legs, the steam generators, and the reactor coolant pumps before it is vented out the break. About 90 seconds after the break, the water in the downcomer begins to boil due to heat transferred from the hot vessel wall and barrel. The resulting loss in driving head stagnates the reflood progression, and delays core recovery. Eventually, the continuing addition of pumped safety injection restores the driving head, reflood resumes, and the cladding temperature excursion is terminated.

Continued operation of the ECCS pumps supplies water during long term cooling. Core temperatures have been reduced to long term steady state levels associated with dissipation of residual heat. After the water level in the refueling water storage tank (RWST) reaches a minimum allowable value, coolant for long term cooling of the core is obtained by switching to the cold leg recirculation phase of operation in which spilled borated water is drawn from the 15.6 - 12 (09 OCT 2019)

Catawba Nuclear Station UFSAR Chapter 15 containment sump by the low head safety injection (RHR) pumps and returned to the RCS cold legs. The Containment Spray System continues to operate to further reduce containment pressure. Prior to the time at which the core boron concentration is calculated to increase to within 4 weight percent of the solubility limit, the ECCS is realigned to supply water to the RCS hot legs in order to control the boric acid concentration in the reactor vessel.

Description of Small Break LOCA Transient Ruptures of small cross section will cause expulsion of the coolant at a rate which can be accommodated by the charging pumps. These pumps would maintain an operational water level in the pressurizer permitting the operator to execute an orderly shutdown. The coolant which would be released to the containment contains the fission products existing at equilibrium.

The maximum break size for which the normal makeup system can maintain the pressurizer level is obtained by comparing the calculated flow from the Reactor Coolant System through the postulated break against the charging pump makeup flow at normal Reactor Coolant System pressure, i.e., 2250 psia. A makeup flow rate from one centrifugal charging pump is typically adequate to sustain pressurizer level at 2250 psia for a break through a 0.375 inch diameter hole. This break results in a loss of approximately 17.25 lb/sec.

Should a larger break occur, depressurization of the Reactor Coolant System causes fluid to flow into the loops from the pressurizer resulting in a pressure and level decrease in the pressurizer. Reactor trip occurs when the low pressurizer pressure trip setpoint is reached.

During the earlier part of the small break transient, the effect of the break flow is not strong enough to overcome the flow maintained by the reactor coolant pumps through the core as they are coasting down following the loss of offsite power which is assumed at reactor trip.

Therefore, upward flow through the core is maintained. The Safety Injection System is actuated when the appropriate setpoint is reached. The consequences of the accident are limited in two ways:

1. Reactor trip and borated water injection complement void formation in causing rapid reduction of nuclear power to a residual level corresponding to the delayed fission and fission product decay.

2. Injection of borated water ensures sufficient flooding of the core to prevent excessive clad temperatures.

Before the break occurs the plant is in an equilibrium condition, i.e., the heat generated in the core is being removed via the secondary system. During blowdown, heat from decay, hot internals, and the vessel continues to be transferred to the Reactor Coolant System. The heat transfer between the Reactor Coolant System and the secondary system may be in either direction depending on the relative temperatures. In the case of continued heat addition to the secondary, secondary system pressure increases and the main steam safety valves may actuate to limit the pressure. Makeup water to the secondary side is automatically provided by the Auxiliary Feedwater System. The SI actuates a feedwater isolation signal, which isolates normal feedwater flow by closing the main feedwater isolation valves, and also initiates auxiliary feedwater flow by starting the auxiliary feedwater pumps. The secondary flow aids in the reduction of Reactor Coolant System pressure.

When the RCS depressurizes to approximately 600 psia, the cold leg accumulators begin to inject water into the reactor coolant loops. The reactor coolant pumps are assumed to be tripped at the initiation of the accident and effects of pump coastdown are included in the blowdown analyses.

Reactor Coolant Pump Operating Strategy During Small Break LOCA (09 OCT 2019) 15.6 - 13

UFSAR Chapter 15 Catawba Nuclear Station The reactor coolant pumps may be kept operating during a small break LOCA until indicated subcooling is lost. Forced circulation supports heat removal from the reactor core and simplifies operator control. This strategy is described in the Catawba Emergency Procedures and was developed in response to NRC Generic Letters 85-12 and 83-10c (References 100 and 101).

These generic letters advised that delayed trip of the reactor coolant pumps after a small break LOCA could result in additional loss of coolant that would uncover the fuel and produce excessive cladding temperatures. Analyses performed by the Westinghouse Owners Group are cited in Generic Letter 85-12, and demonstrate using most probable best estimate techniques that the reactor coolant pumps can be tripped at any time during a small break LOCA without incurring unacceptable clad temperatures. In a letter dated March 26, 1984 (Reference 102) which responded to NRC Generic Letter 83-10c, Duke concluded that the UFSAR analyses remain bounding as long as the reactor coolant pumps are tripped within 2 minutes after subcooling conditions have been lost, as required by the Emergency Procedures.

15.6.5.2 Analysis of Effects and Consequences Method of Analysis The bases used to select the numerical values that are input parameters to the best-estimate large break LOCA analysis are based on the results from previous four-loop plant analyses (Reference 77) which developed a list of key LOCA parameters, as shown in Table 15-69. The values for the parameters are such that they represent a more likely initial condition for the plant than was typically assumed in prior analyses. However, in some cases the assumption is still a conservative one. The general rule applied was to use limiting assumptions in cases where the parameter effect was small, or where the parameter was difficult to quantify statistically. To confirm these choices for McGuire/Catawba analyses, runs were performed to vary several parameters which are required to be set to the bounding value in the PWR uncertainty calculation. These studies are performed to determine if the alternate assumption results in a more limiting transient. If it does, the initial transient assumption is modified to include it. Upon completion of the remaining confirmatory cases, the limiting direction for these parameters is determined. The final calculation that incorporates these results is referred to as the reference transient.

The bases used to select the numerical values that are input parameters to the small break LOCA analysis follows the approach documented in References 11 and 76. In addition, the requirements of Appendix K regarding specific model features were met by selecting models which provide a significant overall conservatism in the analysis. The assumptions made pertain to the conditions of the reactor and associated safety system equipment at the time that the SBLOCA occurs and include such items as the core peaking factors, core axial power distribution and the performance of the ECCS system. Decay heat generated throughout the SBLOCA transient is also conservatively calculated as required by Appendix K of 10CFR 50.

In both large and small break LOCA analyses for Catawba, loss-of-offsite power coincident with the accident is assumed. The single failure subsequently considered for both large and small break analyses is the loss of a diesel generator so that only one train of ECCS flow of the two actually present is considered to be available. Therefore, ECCS flow to the core is at a conservatively low value following its automatic actuation. Notwithstanding these conservatisms, conformance with the 10CFR 50.46 acceptance criteria is demonstrated in the large and small break LOCA analyses. The requirements of an acceptable ECCS Evaluation Model are presented in 10CFR 50.46 and Appendix K of 10CFR 50.

Deleted Per 1997 Update Large Break Evaluation Model 15.6 - 14 (09 OCT 2019)

Catawba Nuclear Station UFSAR Chapter 15 In 1988, the NRC staff amended the requirements of 10 CFR 50.46 and Appendix K, ECCS Evaluation Models to permit the use of a realistic evaluation model to analyze the performance of the ECCS during a hypothetical LOCA. This decision was based on an improved understanding of LOCA thermal-hydraulic phenomena gained by extensive research programs.

Under the amended rules, best estimate thermal-hydraulic models may be used in place of models with Appendix K features. The rule change also requires, as part of the LOCA analysis, an assessment of the uncertainty of the best-estimate calculations. It further requires that this analysis uncertainty be included when comparing the results of the calculations to the prescribed acceptance criteria of 10 CFR 50.46. Further guidance for the use of best-estimate codes is provided in Regulatory Guide 1.157 (Reference 78).

To demonstrate use of the revised ECCS rule, the NRC and its consultants developed a method called the Code Scaling, Applicability, and Uncertainty (CSAU) evaluation methodology (Reference 79). This method outlined an approach for defining and qualifying a best-estimate thermal-hydraulic code and quantifying the uncertainties in a LOCA analysis.

A LOCA evaluation methodology for the three-and four-loop PWR plants based on the revised 10 CFR 50.46 rules was developed by Westinghouse with the support of EPRI and Consolidated Edison and has been approved by the NRC Safety Evaluation Report (Reference 80). The methodology is documented in WCAP-12945-P-A, Code Qualification Document (CQD) for Best Estimate LCOA Analysis (Reference 77).

The thermal-hydraulic computer code which was reviewed and approved for the calculation of fluid and thermal conditions in the PWR during a large break LOCA is WCOBRA/TRAC Version Mod 7A, Rev.1 (Reference 77). WCOBRA/TRAC combines two-fluid, three-field, multi-dimensional fluid equations used in the vessel with one-dimensional drift-flux equations used in the loops to allow a complete and detailed simulation of a PWR. The evolution of the transient through blowdown, refill, and reflood proceeds continuously, using the same computer code (WCOBRA/TRAC) and the same modeling assumptions. Containment pressure is modeled with the BREAK component using a time dependent pressure table. Containment pressure as a function of time is calculated using the LOTIC-2 code (Reference 7). Details of the analysis are provided in Section 6.2.1.5 (see Figure 15-302). The mass and energy releases used in the LOTIC-2 analysis are taken from the WCOBRA/TRAC calculation.

The methods used in the application of WCOBRA/TRAC to the large break LOCA are described in Reference 77. Modeling of a PWR introduces additional uncertainties which are identified and quantified in the plant-specific analysis. The final step of the best-estimate methodology is to combine all the uncertainties related to the code and plant parameters, and estimate the PCT at 95 percent probability.

There are three major uncertainty categories or elements:

1. Initial condition bias and uncertainty

2. Power distribution bias and uncertainty

3. Model bias and uncertainty Conceptually, these elements may be assumed to affect the reference transient PCT as shown below PCTi = PCTREF,i + PCTIC,i + PCTPD,i + PCTMOD,i Equation 15.6-1

where, (09 OCT 2019) 15.6 - 15

UFSAR Chapter 15 Catawba Nuclear Station PCTi = PCT frequency distribution: Evaluated for three time periods; blowdown (i=1), first reflood (i=2), and second reflood (i=3).

PCTREF,i = Reference transient PCT: The reference transient PCT is calculated using WCOBRA/TRAC at the nominal conditions identified in Table 15-69.

PCTIC,i = Initial condition bias and uncertainty: This bias is the difference between the reference transient PCT, which assumes several nominal or average initial conditions, and the average PCT taking into account all possible values of the initial conditions. This bias takes into account plant variations which have a relatively small effect on PCT. The elements which make up this bias and its uncertainty are plant specific PCTPD,i = Power distribution bias and uncertainty: This bias is the difference between the reference transient PCT, which assumes a nominal power distribution, and the average PCT taking into account all possible power distributions during normal plant operation. Elements which contribute to the uncertainty of this bias are calculational uncertainties, and variations due to the transient operation of the reactor.

PCTMOD,i Model bias and uncertainty: This component accounts for uncertainties in the ability of the WCOBRA/TRAC code to accurately predict important phenomena which affect the overall system response and the local fuel rod response. The code and model bias is the difference between the reference transient PCT, which assumes nominal values for the global and local parameters, and the average PCT taking into account all possible values of global and local parameters.

The separability of the uncertainty components in the manner described above is an approximation, since the parameters in each element may be affected by parameters in other elements. The bias and uncertainty associated with this assumption is quantified as part of the overall uncertainty methodology and included in the final estimates of the 95th percentile PCT (PCT95%).

Subcriticality Evaluation for Large Break LOCA An analysis has been performed to determine the minimum sump mixed mean boron concentration corresponding to the time of hot leg switchover as a function of pre-trip Reactor Coolant System (RCS) boron concentration for a postulated large break LOCA. Water mass contributions from the RCS, cold leg accumulators (CLAs), refueling water storage tank (RWST), ice condenser, and Emergency Core Cooling System (ECCS) and containment spray piping have been taken into account. This analysis used the principle input parameters provided in Table 15-48. High concentration borated water volumes (e.g., RWST and CLAs) are conservatively minimized using Core Operating Limits Report minimum allowed value minus associated measurement uncertainties. Ice mass is conservatively maximized (based on ice basket capacity) at the minimum Technical Specification boron concentration value minus measurement uncertainty. Potential borated water holdup in upper containment from the initiation of normal containment spray was taken into account.

Results of the analysis are compared with the required boron concentrations necessary to keep the core subcritical during the sump recirculation mode. The analysis provides a minimum sump mixed mean boron concentration curve at the time of hot leg switchover (the most limiting time post-LOCA) that must bound the required all rods in with the highest worth rod out (ARI N-

1) critical boron concentrations for each cycle. The required ARI N-1 critical boron 15.6 - 16 (09 OCT 2019)

Catawba Nuclear Station UFSAR Chapter 15 concentrations as allowed by Reference 85 are evaluated for each core design as part of the reload safety analysis process.

Since much of the ECCS piping is used during normal operation for residual heat removal and normal chemical and volume control, much of this ECCS piping contains relatively low concentration borated water. A single failure of an ECCS train would therefore be non-conservative, and was thus not considered in the large break LOCA subcriticality analysis.

Small Break LOCA Evaluation Model The NOTRUMP computer code (Reference 15) is used in the analysis of loss-of-coolant accidents due to small breaks in the Reactor Coolant System. The NOTRUMP computer code is a state-of-the-art one-dimensional general network code consisting of a number of advanced features. Among these features are the calculation of thermal non-equilibrium in all fluid volumes, flow regime-dependent drift flux calculations with counter-current flooding limitations, mixture level tracking logic in multiple-stacked fluid nodes, and regime-dependent heat transfer correlations. The NOTRUMP small break LOCA emergency core cooling system (ECCS) evaluation model (Reference 11) was developed to determine the RCS response to design basis small break LOCAs and to address the NRC concerns expressed in NUREG-0611, "Generic Evaluation of Feedwater Transients and Small Break Loss-of-Coolant Accidents in Westinghouse Design Operating Plants."

In NOTRUMP, the RCS is nodalized into volumes interconnected by flowpaths. The broken loop is modeled explicitly with the intact loops lumped into a second loop. The transient behavior of the system is determined from the governing conservation equations of mass, energy and momentum applied throughout the system. A detailed description of NOTRUMP is given in References 11 and 15.

The use of NOTRUMP in the analysis involves, among other things, the representation of the reactor core as heated control volumes with an associated bubble rise model to permit a transient mixture height calculation. The multinode capability of the program enables an explicit and detailed spatial representation of various system components. In particular, it enables a proper calculation of the behavior of the loop seal during a loss-of-coolant transient.

Cladding thermal analyses are performed with the LOCTA-IV (Reference 8) code which uses the RCS pressure, fuel rod power history, steam flow past the uncovered part of the core, and mixture height history from the NOTRUMP hydraulic calculations, as input.

Deleted Paragraph Per 2001 Update.

The Catawba small break analysis was performed with the approved Westinghouse ECCS Small Break Evaluation Model documented in References 11, 72, 73 and extended in Reference 74.

Deleted Paragraph Per 2001 Update.

Large Break Input Parameters and Initial Conditions A composite model for the McGuire/Catawba stations was developed for the best-estimate large break LOCA analysis. The composite model combined the limiting vessel type and the limiting loop configuration into a limiting composite model. The limiting configuration was determined through a series of sensitivity studies, documented in Reference 81.

A series of WCOBRA/TRAC calculations were performed using the McGuire/Catawba composite model to determine the PCT effect of variations in key LOCA parameters. An initial transient calculation was performed in which several parameters were set at their assumed bounding (most limiting) values in order to calculate a conservative PCT response to a large (09 OCT 2019) 15.6 - 17

UFSAR Chapter 15 Catawba Nuclear Station break LOCA. The range for parameters was set to encompass the range of operation for all four McGuire and Catawba stations. The bounding values assumed in Table 15-69 were confirmed or modified by completing confirmatory sensitivity analyses, and incorporating the results into a final calculation which is referred to as the reference transient. Single parameter variation studies based on reference transient were performed to assess which parameters have a significant effect on the PCT results. The initial calculation, confirmatory runs, and final reference transient are described in detail in Reference 81.

Table 15-4 summarizes input parameters and initial conditons used.

Small Break Input Parameters and Initial Conditions Table 15-59 lists important input parameters and initial conditions used in the Unit 1 small break analyses. Table 15-32 lists important input parameters and initial conditions used in the Unit 2 small break analyses. The axial power distribution assumed for the small break analyses is shown in Figure 15-282.

Safety injection flow rate to the Reactor Coolant System as a function of the system pressure is used as part of the input. The Safety Injection (SI) system was assumed to be delivering to the RCS 32 seconds after the generation of a safety injection signal.

For these analyses, the SI delivery considers pumped injection flow which are given in Table 15-57 as a function of RCS pressure. This table represent injection flow from the SI pumps based on performance curves degraded from the design head. The delay described above includes time required for diesel startup and loading of the safety injection pumps onto the emergency buses. The effect of flow from the RHR pumps is not considered here since their shut-off head is lower than RCS pressure during the time portion of the transient considered here. Also, minimum safeguards Emergency Core Cooling System capability and operability has been assumed in these analyses.

Table 15-4 summarizes input parameters and initial conditions used.

Note that the SBLOCA analysis was performed with ZIRLO cladding. However, Reference 114 concluded that the LOCA ZIRLO cladding models are acceptable for application to Optimized ZIRLO cladding in the Small Break analysis, and that no additional calculations are necessary for evaluating the use of Optimized ZIRLO cladding provided that the plant specific ZIRLO calculations were previously performed.

Large Break Results The McGuire/Catawba reference transient models a double-ended cold leg guillotine break which assumed the conditions listed in Table 15-69 and includes the loss-of-offsite power, low peripheral assembly power (0.2) and high SGTP (10%) configuration bounded study assumptions. The reference transient calculation was performed with other parameters set at their bounding values as denoted in Table 15-69 in order to calculate a relatively high PCT. The reference transient is the basis for the uncertainty calculations necessary to establish the McGuire/Catawba 95th percentile PCT.

The LOCA transient can be conveniently divided into a number of time periods in which specific phenomena are occurring. For a typical large break, the blowdown period can be divided into the critical heat flux (CHF) phase, the upward core flow phase, and the downward core flow phase. These are followed by the refill, reflood, and long term cooling phases. The important phenomena occurring during each of these phases are discussed for the reference transient DECLG break with a discharge coefficient of 1.0. The results are shown in Figures15-303 through 15-311. Key events and the time of their occurrence are listed in Table 15-68.

15.6 - 18 (09 OCT 2019)

Catawba Nuclear Station UFSAR Chapter 15 The reference transient resulted in a blowdown PCT of 1328°F and a second reflood PCT of 1649°F.

Sensitivity Studies A large number of single parameter sensitivity calculations of key LOCA parameters were performed to determine the PCT effect on the large break LOCA transient. These calculations are required as part of the approved best-estimate methodology (Reference 77) to develop data for use in the uncertainty evaluation. For each sensitivity study, a comparison between the reference transient results and the sensitivity transient was made.

Several calculations were performed to evaluate the PCT effect of changes in the initial conditions on the large break LOCA transient. The results of these sensitivity studies were used to develop uncertainty distributions for the blowdown, first and second reflood peaks. The uncertainty distributions resulting from the initial conditions, PCTIC,i, are used in the overall PCT uncertainty evaluation to determine the final estimate of PCT95%.

Several calculations were performed to evaluate the PCT effect of changes in power distributions on the large break LOCA transient. The results of these studies indicate that power distributions with peak powers skewed to the top of the core produced the most limiting PCTs.

The results of these sensitivity studies were used to develop response surfaces, which are used to predict the PCT due to changes in power distributions for the blowdown, first and second reflood peaks. The uncertainty distributions resulting from the power distributions, PCTPD,i, are used in the overall PCT uncertainty evaluation to determine the final estimate of PCT95%.

Several calculations were performed to evaluate the PCT effect of changes in global models on the large break LOCA transient. The results of these sensitivity studies were used to develop response surfaces, which are used to predict the PCT due to changes in global models for the DECLG blowdown, first and second reflood peaks. The uncertainty distribution resulting from the global models, PCTMOD,i, is used in the overall PCT uncertainty evaluation to determine the final estimate of PCT95%.

Overall PCT Uncertainty Evaluation and Results The equation used to initially estimate the 95th percentile PCT (PCTi of Equation 15.6-1) was presented previously in this section. Each of the uncertainty elements (PCTIC,i, PCTPD,i, PCTMOD,i) are considered to be independent of the each other. Each element includes a correction or bias, which is added to PCTREF,i to move it closer to the expected, or average PCT. The bias from each element has an uncertainty associated with the methods used to derive the bias.

Each bias component of the uncertainty elements is considered a random variable, whose uncertainty distribution is obtained directly, or is obtained from the uncertainty of the parameters of which the bias is a function. Since PCTi is the sum of these biases, it also becomes a random variable. Separate initial PCT frequency distributions are constructed as follows for the DECLG and the limiting split break:

1. Generate a random value of each uncertainty element (PCTIC PCTPD, PCTMOD)

2. Calculate the resulting PCT using Equation 15.6-1.

3. Repeat the process many times to generate a histogram of PCTs.

For McGuire/Catawba, the results of this assessment showed that DECLG to be the limiting break type.

(09 OCT 2019) 15.6 - 19

UFSAR Chapter 15 Catawba Nuclear Station A final verification step is performed to quantify the bias and uncertainty resulting from the superposition assumption (i.e., the assumption that the major uncertainty elements are independent). Several additional WCOBRA/TRAC calculations are performed in which variations in parameters from each of the three uncertainty elements are modeled for the DECLG. These predictions are compared to the predictions based on Equation 15.6-1 and additional biases and uncertainties are applied where appropriate.

The estimate of the PCT at 95 percent probability is determined by finding that PCT below which 95 percent of the calculated PCTs reside. This estimate is the licensing basis PCT, under the revised ECCS rule. The results of the McGuire/Catawba best-estimate LBLOCA analysis are presented in Table 15-70. The difference between the 95th percentile PCT and the 50th percentile PCT increases during reflood due to propagation of uncertainties. The 50th and 95th percentile PCTs are 1512°F and 2028°F respectively. The maximum local cladding oxidation is 10% and the maximum core wide oxidation is 0.88%.The results of the best-estimate large break LOCA analysis are from Reference 81.

Plant Operating Range The expected PCT and associated uncertainty is valid for a range of plant operating conditions.

In contrast to Appendix K calculations, many parameters in the reference transient calculation are at nominal values. The range of variation of the operating parameters has been accounted for in the estimated PCT uncertainty. Table 15-71 summarizes the operating ranges for McGuire/Catawba.

Note that Figure 15-312 illustrates the axial power distribution limits which were analyzed and are verified on a cycle-specific basis. If plant operation is maintained within the plant operating ranges presented in Table 15-71, the LBLOCA analysis is considered to be valid.

Note that the LBLOCA analysis was performed with ZIRLO cladding. However, Reference 114 concluded that the LOCA ZIRLO cladding models are acceptable for application to Optimized ZIRLO cladding in the Large Break analysis, and that no additional calculations are necessary for evaluating the use of Optimized ZIRLO cladding provided that the plant specific ZIRLO calculations were previously performed.

Small Break Results (Unit 1)

A spectrum of break sizes including diameters of 1.5 inch, 2 inch, 3 inch and 4 inches was analyzed. The 2-inch small break LOCA (SBLOCA) case was determined to be the limiting case in the spectrum analyzed. The peak cladding temperature for the 2 inch break is 1323°F at an elevation of 11.5 feet. The maximum oxidation is 0.24 percent and the core-wide oxidation is 0.03 percent based on the 2 inch break. The results of the break spectrum are presented in Table 15-60 and Table 15-61.

Deleted Per 2006 Update Figures15-314 through Figures15-329 present the transient response for the parameters of interest.

Small Break Results (Unit 2)

A spectrum of break sizes including diameters of 1.5 inch, 2 inch, 3 inch, and 4 inches was analyzed. The 4-inch small break LOCA (SBLOCA) case was determined to be the limiting case in the spectrum analyzed. The peak cladding temperature for the 4-inch break is 1243 °F at an elevation of 11.25 feet, while the next limiting case, the 3-inch break, has a peak cladding temperature of 1164°F. The maximum oxidation is 0.10 percent and occurs for 3-inch break.

15.6 - 20 (09 OCT 2019)

Catawba Nuclear Station UFSAR Chapter 15 The core-wide oxidation is 0.01 percent based on the 3-inch break and 4-inch break. The results of the break spectrum are presented in Table 15-38 and Table 15-39.

Deleted Per 2006 Update Figure 15-283 through Figure 15-306 present the Unit 2 SBLOCA transient response for the parameters of interest.

15.6.5.3 Radiological Consequences This section reports the analysis of radiological consequences of the design basis loss-of-coolant accident.

An analysis of the radiological consequences of the design basis LOCA has been completed.

The analysis employed the Alternative Source Term methodology and was completed in conformance to the germane regulatory positions in Regulatory Guide (R.G.) 1.183 (References 86 & 87). The results of the analysis show that the radiation doses at offsite locations and in the control room do not exceed the acceptance criteria given in 10 CFR 50.67 and the guidance values of R.G. 1.183.

The analysis takes into consideration the following:

1) Type and timing of fission products released from the core to the containment and containment sump.

2) Effectiveness of mechanisms for removal of fission products from the contaimment atmosphere.

3) Mechanisms and rate at which the fission products are released from the containment.

4) Effectiveness of the annulus and Annulus Ventilation System.

5) Leakage from ESF components outside the containment.

6) The effect of single failures.

7) Transport and dispersion after release to the environment.

8) Control room and the Control Room Area Ventilation System.

9) Dose coefficients.

These considerations are discussed below. Detailed lists of assumptions are given in Tables 15-40 and 15-41.

The Bechtel computer code LOCADOSE (Reference 88-90) is used in the analyses of radiological consequences of all design basis accidents with postulated releases of fission products to the environment. The code calculates transport and release of radioactivity for a network of nodes and flow paths defined by the user. The generalized transport equations used in the code are the same as those listed by the Staff in germane regulatory positions (Reference 91). In particular, the code solves the time dependent Murphy Campe Equation to calculate the activity in the control room and radiation doses to the control room operators (Reference 30).

Type and Timing of Fission Products Released from the Core Following a postulated guillotine double-ended rupture of a main reactor coolant pipe and subsequent blowdown, the Emergency Core Cooling System keeps cladding temperature below the melting point and limits Zircaloy-water reactions to an insignificant level, assuring that the core remains intact and in a coolable geometry. As a result, of the increase in cladding temperature and rapid depressurization of the core however, some cladding failure may occur in (09 OCT 2019) 15.6 - 21

UFSAR Chapter 15 Catawba Nuclear Station the hottest regions of the core. The fission products accumulated in the pellet-cladding gaps of the affected fuel assemblies may escape to the Reactor Coolant System and thereby to the containment. Nonetheless, a gross release of fission products has been assumed in the analysis reported herein. The only postulated mechanism for such a release required multiple simultaneous and extended failures to occur in the engineered safety features (ESF) systems, producing severe physical degradation of core geometry and partial melting of the fuel.

The radioactivity levels of the fission products in the entire core of a nuclear unit at Catawba Nuclear Station were calculated. The calculations conformed to the regulatory positions in RG 1.183 (Reference 86). Maximum full power operation was assumed, including calorimetric uncertainty for an assumed power level of 102% rated power. In addition, limiting values were taken for fuel enrichment and burnup. The resultant values of levels of fission product radioactivity in the core at the initiating of the design basis LOCA is presented in Table 15-12.

Radioactivity was assumed to be released from the core in two phases. During the gap release phase, from 30 seconds to 30 minutes after the initiating event, gap activity was assumed to be released to the environment. This includes 5% apiece of the inventory in the core of noble gases (krypton and xenon), halogens (iodine and bromine), and alkali metals (rubidium and cesium). The gap release phase is assumed to be followed immediately by the early in-vessel release phase, lasting from 30 minutes to 1.8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> (108 minutes). During this time, the following fission products are taken to be released to containment (the numbers denoting percent of the core inventories).

Chemical Group  % Core Inventory Noble gases 95.00 Halogens 35.00 Alkali metals 25.00 Tellurium metals (Ts, Sb, Sc) 5.00 Ba Sr (Alkaline earth metals) 2.00 Noble metals (Ru, Rh, Pd, Mo, Tc) 0.25 Cerium group (Ce, Pu, Np) 0.05 Lanthanides (La, Zr, Nd, Eu, Nb, Pm, Pr, Sm, Y, Cm, 0.02 Am)

Pursuant to the germane regulatory positions (Reference 86 & 87), the following conservative assumptions were made pertaining to release of the fission products in the source term to the containment and containment sump:

1) The fission products were assumed to be instantly released to the lower compartment of the ice condenser containment. The release is taken to begin at 30 sec and last until 1.8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br />.

This time span is after the completion of the blowdown phase of the design basis LOCA (Section 6.2). Normally, there are no large bypass apertures in the divider deck separating the lower and upper compartments. Therefore, the only credible initial placement of the source term in containment is in the lower compartment. This assumption conforms to the germane regulatory position.

2) The iodine isotopes released to the lower compartment were assumed to take the form of particulates (e.g., iodide salts - 95% of the iodine isotopes), diatomic iodine (4.85% of the 15.6 - 22 (09 OCT 2019)

Catawba Nuclear Station UFSAR Chapter 15 iodine isotopes), and organic iodine compounds (0.15% of the iodine compounds). This assumption was validated in an evaluation of the post LOCA sump chemistry (Section 6.1.1.2). Except for the noble gases, the remaining fission products were assumed to take the form of particulates.

3) Only tellurium and iodine isotopes were taken to be released to the containment sump. The Staff takes the position that all isotopes in the source term should be assumed to be released to the containment sump but that only iodine isotopes are assumed to be released from the containment sump. In respect to post LOCA effluent analysis and calculations of radiation doses, this is equivalent to the Duke position (accounting for production of iodine with decay of tellurium). The iodine released from the containment sump was assumed to take the form of diatomic iodine (97%) and organic iodine compounds (3%).

Removal of Fission Products from the Containment Atmosphere Fission products may be removed from the primary containment by the following processes:

1) Radioactive decay,

2) Leakage from primary containment, and

3) ESF grade fission product removal systems.

Radioactive decay is a well known process. Leakage from primary containment is discussed in the section below. The assumptions concerning the ESF grade fission products removal systems in the containments at Catawba Nuclear Station are the subject of this discussion.

Each containment building at Catawba is equipped with two systems the design functions of which include the removal of fission products from the containment atmosphere. These are the ice condenser and the Containment Spray System (CSS). Their primary design function is to removal thermal energy from the containment atmosphere, ensuring that the post accident pressure in containment does not exceed the design pressure.

The analysis does not take credit for the ice condenser to remove fission products from the air and steam flow through it following a design basis LOCA. The ice condenser has been evaluated only for the removal of diatomic iodine from the air and steam flow through it. This is reflected in the current Standard Review Plan 6.5.4 (Reference 24) in which the stated expectation of the NRC Staff is that credit is taken only for the removal of diatomic iodine from the flow stream at an efficiency of 30%. Diatomic iodine is seen to constitute only 4.85% of the iodine inventory in the alternative source term. In addition, the Staff expects that no credit will be taken for scrubbing of iodine in the ice condenser after meltout of the first ice bed, simulated to occur within an hour after the initiating event. For these reasons, no credit is taken for scrubbing of fission products from the flow stream through the ice condenser.

Credit was taken for removal of fission products in the upper compartment atmosphere by the CSS. Fission products are assumed to be released only to the lower compartment and transfer of fission products to the upper compartment is not stimulated to begin until activation of the Containment Air Return Fans 10 minutes after the initiating event. Beyond this, simulation of washout of fission products from the upper compartment by the CSS is begun at 80 minutes after event initiation with presumed start of one CSS pump. Washout of all fission products except noble gases and organic iodine compounds was simulated. The washout time constants for diatomic iodine were obtained using a methodology based on NUREG/CR-5950 (Reference 92). Credit for washout of diatomic iodine was ended whenever the decontamination factor for diatomic iodine reached 200 (Reference 87). The method of NUREG/CR-0009 (Reference 93) was used to calculated washout time constants for particulate fission products. The NRC Staff takes the position that the time constant for particulate washout should be reduced by a factor of (09 OCT 2019) 15.6 - 23

UFSAR Chapter 15 Catawba Nuclear Station 10 when the particulate decontamination factor reaches 50. The time constants for spray washout of particulates were set to one-tenth of the calculated values beginning at the time predicted for the particulate decontamination factor first reaching 50.

Release of Fission Products from the Containment The containment leak rate for the first day after the initiating event is set to 0.3 volume percent per day and half that or 0.15 volume percent per day afterwards. This accounts for an expected gradual decrease in post LOCA containment pressure and corresponding decrease in containment leakage.

Containment leakage may be partitioned into two categories: containment leakage into the annulus and containment leakage directly to the environment (bypassing the annulus). The containment bypass leak rate is set to 7% of the total containment leak rate. The remaining 93% of the containment leakage is assumed to enter the annulus.

Containment leakage is portioned into 60% from the lower compartment and 40% from the upper compartment. These partition fractions are used for the containment leakage to the annulus and containment bypass leakage.

Effectiveness of the Annulus and Annulus Ventilation System Each nuclear unit at Catawba is equipped with a primary containment and a secondary containment or annulus which encloses the primary containment. The annulus, together with the Annulus Ventilation System (AVS), serves to reduce the release of radioactivity to the environment to a minimum by means of holdup and filtration. The conditions in the annulus and the response of the AVS to a design basis LOCA have been analyzed. That analysis is reported in Section 6.2.3.3. The results of that analysis are used in the analysis of radiological consequences of the design basis LOCA.

The AVS activates following a Safety Injection Signal. One of its design functions is to draw the annulus pressure to -0.25 w.g. everywhere in the annulus relative to all adjacent volumes, including the containment and the outside air. The analysis of post LOCA annulus conditions and AVS response includes calculations of the ability of the AVS to draw the annulus to 0.25 w.g. everywhere in the annulus. The analysis takes into account the difference in the hydrostatic gradients in the annulus following a design basis LOCA and the outside air at a 99th percentile low temperature (Reference 87, 94).

All containment leakage is assumed initially to escape to the environment, bypassing the annulus. This assumption is maintained until simulated drawdown of the annulus by the AVS to

-0.25 in w.g. everywhere within. Thereafter, it is assumed that containment leakage to the annulus is retained therein, mixing with the air in 50% of the annulus.

The AVS also is designed to lower the annulus pressure to a setpoint and thereafter maintain the annulus pressure at that setpoint. The error adjusted setpoint is listed in Table 15-40. Upon activation on a Safety Injection signal, the AVS starts and initially operates in the Exhaust Mode.

Upon drawing the annulus pressure to this setpoint, the system then modulates (i.e. partitions) the airflow through it between recirculation and exhaust. In this manner the AVS maintains the annulus pressure at its setpoint.

Leakage of ESF Components Outside Containment During the recirculation phase of a LOCA, water contaminated with fission products could leak from engineered safety feature (ESF) equipment located outside containment. Such leakage could occur during the recirculation phase through components such as pump seals, valves, and heat exchangers. Some leakage could be into the Auxiliary Building. The possibility exists also for intersystem leakage bypassing the Auxiliary Building, such as backleakage through 15.6 - 24 (09 OCT 2019)

Catawba Nuclear Station UFSAR Chapter 15 ESF leakage systems to the Refueling Water Storage Tank (RWST). In either case, iodine isotopes entrained in the leakage could be released to the atmosphere and contribute to the total radiation doses from the LOCA.

The analysis of the contribution of ESF leakage is performed pursuant to the conservative Staff regulatory positions pertaining to Alternative Source Terms. As noted above, the Staff position is that iodine is released from ESF leakage in the form of diatomic iodine (97%) and organic iodine compounds (3%). The method of NUREG/CR-5950 is used to analyze formation of volatile iodine species and their release to the environment. All calculations of pH in the containment sump, solution of ESF leakage, and leakage in the Auxiliary Building were completed at solution temperature. The iodine assumed to be in the containment sump includes all stable iodine isotopes. (Reference 87, 93)

The method of NUREG/CR-5950 (Reference 92) is used to analyze the conversion of iodine transported to the RWST and calculate the amount of iodine partitioned to the airspace in the RWST and released to the environment. The following assumptions were made:

1) The operators prevent any overflow of the RWST by aligning ESF pumps to it and pumping the accumulated water back to containment.

2) No credit was taken for heat losses in the ESF backleakage.

3) Displacement of air in the FWST by the backleakage itself and diurnal expansion of the RWST was taken into account.

Following a Safety Injection Signal, the Auxiliary Building Ventilation (ABFVES) is automatically aligned directly to the ESF pump rooms and the General Area and Pipe Chase in the basement of the Auxiliary Building (EL 522). The Mechanical Penetration Rooms at EL 543 and EL 560 vent to the Pipe Chase Area and therefore are aligned to the ABFVES. Any iodine airborne from ESF leakage in these rooms is filtered before release. ESF equipment also is located in the Residual Heat Removal System (RHRS) and Containment Spray System (CSS) Heat Exchanger Rooms and the Mechanical Penetration Room at EL 577. The ABFVES is not automatically aligned to these rooms following a Safety Injection Signal. ESF components in all Mechanical Penetration Rooms are downstream of the ND and NS Heat Exchanger Rooms.

Time dependent iodine partition fractions for ESF leakage were calculated using the method of Beahm et.al (Reference 92) in conjunction with the method of Yuill et. al. (Reference 95) for the analysis of mass transfer of iodine from open pools. Forced convective mass transfer by means of VA System airflow was simulated. The iodine partition fractions were used in the calculation of radiation doses at offsite locations and in the control room for ESF leakage in the Auxiliary Building following a design basis LOCA. The analysis made use of the following assumptions:

1) The rate of ESF leakage in the Auxiliary Building was set to 0.9 gpm. This leak rate was partitioned into 0.5 gpm for ESF leaks in rooms to which the ABFVES filters would be initially aligned and 0.4 gpm in rooms into which the ABFVES filters would not be initially aligned.

These leak rates are taken beginning at the initiation of cold leg recirculation and through the duration of the event (30 days).

2) No catastrophic ESF pump seal leak (e.g., 50 gpm for 30 minutes) was taken.

3) The Pipe Chase Area in the Auxiliary Building basement (EL522) was taken for the calculation of iodine partition factors for ESF Systems leaks in rooms to which the ABFVES filters are aligned. The Mechanical Penetration Room at EL577 was chosen for the calculation of iodine fractions for ESF System leaks in rooms to which the ABFVES filters are not initially aligned.

4) No credit was taken for flow of ESF leakage into drains or sumps.

(09 OCT 2019) 15.6 - 25

UFSAR Chapter 15 Catawba Nuclear Station

5) Cooling of pools of accumulated ESF leakage was simulated. Natural convective cooling was simulated even though forced convective mass transfer of iodine from the pools was simulated. The ambient temperature in the rooms in which the pools were assumed to be located was 145°F.

6) No film transfer resistance in the liquid phase was taken.

7) Credit was taken for filtration by the ABFVES of iodine airborne from leaks in all rooms at EL 522, all ESF Pump Rooms, and the Mechanical Penetration Rooms at EL 543 and EL 560.

8) It is assumed that the operators would align the ABFVES filters to all rooms in the Auxiliary Building containing ESF equipment by three days after the initiating event. Restoration of the ABFVES to its normal alignment within three days of the initiating event satisfies this assumption.

Additional assumptions and other input taken in the calculation of radiation doses for ESF Systems leakage either to the RWST or in the Auxiliary Building are listed in Table 15-40.

Radiation doses at offsite locations and in the control room for ESF System leakage following a design basis LOCA are presented in Table 15-40.

Selection of Single Failures Radiation doses at offsite locations and in the control room were calculated for design basis LOCA scenarios with the following single failures:

1) The Minimum Safeguards Failure. An example is failure of a diesel generator to start and run following a design basis LOCA with loss of offsite power. This failure causes loss of one Class 1E train, including one CSS pump, one containment air return fan (lower rate of transfer of activity from the lower compartment to the upper compartment, and one AVS fan (longer drawdown times and lower AVS airflow rates particularly for recirculation). This failure also causes loss of one train of the ECCS, one ABFVES filter train, one Auxiliary Feedwater System (AFWS) motor driven pump, and one pressurized filter train of the Control Room Area Ventilation System. Credit is taken for only one CRAVS pressurized filter train for all design basis LOCA scenarios. Simulation of CRAVS operation does not change with this failure. Loss of one ABFVES filter train, AFWS motor driven pump, and one ECCS train has no affect on radiation doses following a design basis LOCA.

2) Failure of a pressure transmitter of the AVS train. The failure causes the affected AVS train to operate continuously in the Exhaust mode even though the setpoint for modulation between Exhaust and Recirculation may have been reached and passed. It is assumed that the control room operators secure the affected AVS train within 2.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> after the initiating event.

3) Failure of cold water flow through the CSS or RHRS Heat Exchanger. Examples include failure of the Nuclear Service Water isolation valve on the cold water side of the CSS Heat Exchanger or the Component Cooling Water isolation valve on the cold water side of the RHRS Heat Exchanger to open on demand. The iodine partition fraction as calculated with the methodology of NUREG/CR-5950 is extremely sensitive to the leakage temperature.

Failure of cold water flow in the RHRS or CSS Heat Exchanger may yield high values for the iodine partition fraction for ESF leaks in the Auxiliary Building.

4) Closed CRAVS outside air intake isolation valve. This valve may be closed under administrative controls which direct the control room operators to declare one CRAVS pressurized filter train inoperable. Credit is taken for the control room operators opening the valve within 10 hours1.157407e-4 days <br />0.00278 hours <br />1.653439e-5 weeks <br />3.805e-6 months <br />.

15.6 - 26 (09 OCT 2019)

Catawba Nuclear Station UFSAR Chapter 15 Atmospheric Dispersion Factors for transport of fission products to the Exclusion Area (EAB) and the boundary of the low population zone (LPZ) are listed in Table 15-40. The methodology by which they are calculated is reported in Section 2.3.4.

Atmospheric dispersion factors (/Qs) for transport of radioactivity with dispersion to the CRAVS outside air intakes have been calculated. The calculation of individual control room /Qs for transport of radioactivity with dispersion from one release point to one CRAVS outside air intake is presented in Section 2.3.6. The remainder of this section reports the process by which individual control room /Qs were selected and adjusted as necessary for use in the calculation of control room radiation doses following a design basis LOCA. The development of control room /Qs used in the analysis of the design basis LOCA and all design basis accidents involving postulated radioactivity releases conform in general to the regulatory positions of Regulatory Guide 1.194 (Reference 96).

The release path for airborne iodine activity from ESF backleakage to the RWST is through the RWST vent. The release path for airborne iodine activity from ESF leakage in the Auxiliary Building is to the environment through the Unit Vent Stack. The unit vent stack also is the release point for all AVS Exhaust flow, including containment leakage to the annulus that passes through the AVS Exhaust ductwork. Release paths for containment bypass leakage include (1) past the closed containment isolation valves of the Containment Purge Ventilation System, (2) through the equipment hatch, and (3) into the Auxiliary Building and out the unit vent stack. Of these, the limiting control room /Q is associated with releases through the unit vent stack. The limit for overall containment bypass leak rate is much lower than the sum of acceptance criteria for individual bypass penetrations. In addition, the majority of that sum is associated with release through the unit vent stack. For these reasons, a flow weighted composite control room /Q for containment bypass leakage was not calculated. Rather, the control room /Q for containment bypass leakage was set to the control room /Q for releases from the unit vent stack.

Catawba Nuclear Station has the dual intake configuration with no controls for automatic or manual selection. In addition, one of the two CRAVS outside air intakes may be closed under administrative controls (cf. above). Therefore, one design basis LOCA scenario analyzed includes a closed CRAVS outside air intake and no single failure. In this scenario it is assumed that the control room operators open the closed intake within 10 hours1.157407e-4 days <br />0.00278 hours <br />1.653439e-5 weeks <br />3.805e-6 months <br /> after the initiating event (Reference 97). Other design basis LOCA scenarios with single failures are analyzed with both CRAVS outside air intakes valves taken to be open at the initiating event.

Composite control room /Qs were calculated for transport of radioactivity to both CRAVS outside air intakes. The methodology discussed in Section 2.3.6 was used to perform the calculations. The design basis airflow imbalance in the intakes set to 60/40. For releases from the RWST vent, both CRAVS outside air intakes could be in one direction window. For releases from the unit vent stack, only one intake can be in any one wind direction window. These are taken into consideration in the calculations of composite control room /Qs for transport of fission products from these release points with dispersion to both CRAVS outside air intake.

The CRAVS outside air intakes are the receptor points for outside airflow through the CRAVS pressurized filter trains. These locations also are taken as the receptors for unfiltered inleakage to the control room.

Control room /Qs associated with the design basis LOCA are presented in Table 15-41.

Data for Analysis of Consequences in the Control Room (09 OCT 2019) 15.6 - 27

UFSAR Chapter 15 Catawba Nuclear Station The following report includes a synopsis of the control room and the CRAVS. The synopsis and Table 15-41 report characteristics of the control room and CRAVS germane to post accident radiation doses in the control room. To this extent, the synopsis is applicable to the evaluation of radiation doses in the control room for every design basis accident with postulated radioactivity releases.

The control room and the CRAVS are designed to provide operators with a safe environment for monitoring and controlling plant systems either during normal plant operations or following any design basis accident. The design of the control room and CRAVS conform to the requirements of 10 CFR 50 Appendix A General Design Criterion (GDC) 19 and the regulatory positions of Regulatory Guide 1.197 (Reference 98). One of the design functions of the control room and CRAVS is to limit radiation doses of the control room operators following design basis accidents with postulated releases of radioactivity. Pursuant to regulatory positions associated with Alternative Source Term methodology (Reference 87), the control room and CRAVS are designed to limit the Total Effective Dose Equivalent (TEDE) to the control room operators following a design basis accident to 5 Rem.

Radiation doses to control room personnel following a design basis LOCA may originate from several different sources. Post LOCA radiation doses to control room operators may result for airborne radioactivity entering the control room with outside airflow through the CRAVS pressurized filter fans or by leaks to the control room bypassing the CRAVS pressurized filter trains. This control room unfiltered inleakage may be associated with post accident use of the control room doors, leaks through pneumatic controls in the control room, or leaks into the CRAVS ductwork at specific locations at which the pressure within may be less than the pressure outside. In addition, personnel may be exposed to direct gamma radiation penetrating the control room walls, floor, and roof from the following:

1) Radioactivity inside the Reactor Building,

2) Radioactivity in recirculation piping or ventilation filters in the Auxiliary Building, and

3) Radioactivity released from containment passing over the control room roof.

A discussion of radiation protection in general is provided in Chapter 12. The analysis of direct radiation doses to control room operators following a design basis accident is reported in Section 1.8.1.19. The direct radiation dose to the control room operators from all the sources listed above was found to be 750 mRem or 0.75 Rem.

The ESF grade CRAVS is designed to maintain safe conditions for uninterrupted occupancy of the control room following a design basis accident. The CRAVS filter trains continuously draw outside air from two locations to maintain a continuous overpressure in the control room. This reduces to a minimum entry of radioactivity from without and radioactivity in the airflow through them. Each outside air intake is monitored for the presence of radioactivity. Should a high radiation level be detected in the intakes, station procedures direct the operators to close the more contaminated intake. The CRAVS can maintain overpressure in the control room with one intake open.

The intakes are normally open. The isolation valves are Class 1E motor operated valves that fail as is. There are no automatic controls for these valves. Therefore, no single failure in the plant design basis can cause a CRAVS outside air intake to close. One intake may be closed to facilitate maintenance and testing activities. Administrative controls effectively limit the time a CRAVS outside air intake can be closed to 7 days. These controls make the closed CRAVS outside air intake equivalent to a single failure. Therefore, for each design basis accident, a scenario is postulated in which one CRAVS outside air intake is closed but no single failures occur either concurrent with or following the initiating event. For all design basis accidents 15.6 - 28 (09 OCT 2019)

Catawba Nuclear Station UFSAR Chapter 15 sequences postulated with single failures, both CRAVS outside air intakes are taken to be open at all times following the initiating event. Pursuant to the expectations in Standard Review Plan 6.4 (Reference 37) Appendix A, the analysis of design basis scenarios with a closed CRAVS outside air intakes incorporates the following assumptions: One intake remains closed for the first 10 hours1.157407e-4 days <br />0.00278 hours <br />1.653439e-5 weeks <br />3.805e-6 months <br /> after trip of the affected unit. For the design basis LOCA and other accidents, this is deemed to be equivalent to 10 hours1.157407e-4 days <br />0.00278 hours <br />1.653439e-5 weeks <br />3.805e-6 months <br /> after the initiating event. The specific evaluation of control room radiation dose for each design basis accident with postulated radioactivity releases. It is assumed that the closed intake isolation is manually reopened. The times to identify a closed outside air intake valve and open it are taken to be 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> and 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />, respectively. Before 10 hours1.157407e-4 days <br />0.00278 hours <br />1.653439e-5 weeks <br />3.805e-6 months <br /> after trip for the design basis accident with closed CRAVS outside air intake, the control room /Qs for transport of radioactivity to one CRAVS outside air intake are taken. Otherwise, composite control room /Qs for transport of radioactivity to both CRAVS outside air intakes are taken.

Each CRAVS pressurized filter trains supplies up to nominally 6,000 cfm of air passed through high efficiency HEPA and carbon bed filters. Some of the airflow is routed to control room areas outside the control room. In addition, some of the airflow from the CRAVS filter trains to the control room actually is recirculated from the control room. A low value of CRAVS filter train recirculation airflow through the control room is conservative for control room radiation doses.

Studies have shown that for the current control room and CRAVS configuration, a low value of total CRAVS filter train airflow to the control room is conservative for control room radiation doses.

The following pertain to the calculation of post accident radiation doses in the control room.

1) The breathing rate throughout the accident is set to 3.5x10-4 m3/sec.

2) Control room /Qs are calculated pursuant to the regulatory positions of Regulatory Guide 1.194 (Reference 27). Cf. Section 2.3.6 and the discussion above.

3) The control room occupancy factors are 100% for 0-1 day, 60% for 1-4 days, and 40% for 4-30 days after the initiating event (Reference 87).

4) The volume in the control room is set to 117,920 cu.ft. This is used to calculate the activity buildup in the control room and also the control room geometry factor. The geometry factor is used in calculating deep dose equivalents (DDEs) and skin committed dose equivalents (CDEs) in the control room.

Control room radiation doses are calculated for 30 days after the initiating event.

Dose Coefficients The dose coefficients used in the analysis are based of the dose coefficients taken from Federal Guidance Reports (FGRs) 11 and 12 (References 98 & 99).

Results The limiting TEDE at the EAB following a design basis LOCA was found to be 8.79 Rem. The limiting TEDE at the LPZ was found to be 3.78 Rem. The TEDEs at both the EAB and LPZ are less than 25 Rem (10 CFR 50.67 and Reference 87). For the TEDEs at the EAB and LPZ the limiting scenario was a design basis LOCA with failure of cold water flow to a ND or NS Heat Exchanger.

The design basis LOCA scenario limiting for control room TEDE is the design basis LOCA with closed CRAVS outside air intake. The control room TEDE for exposure to and inhalation of fission products accumulating in the control room following this scenario is 2.56 Rem. The direct radiation dose to the control room operators following a design basis accident is 0.75 (09 OCT 2019) 15.6 - 29

UFSAR Chapter 15 Catawba Nuclear Station Rem (cf. Section 1.8.1.19). The total TEDE to the control room operators following a design basis LOCA is 3.31 Rem.

The radiological consequences of the design basis LOCA at Catawba Nuclear Station meet all germane acceptance criteria and target values.

15.6.5.4 10 CFR 50.46 Reporting Summary In addition to the analyses presented in Subsection 15.6.5.2, LOCA evaluations may be performed as needed to address evaluation model issues or to support plant changes. The issues or changes are evaluated, and the impact on the peak cladding temperature (PCT) is determined. The resultant increase or decrease in PCT is added to the analysis of record PCT.

10 CFR 50.46 allows for the estimates of errors in, or changes to, an ECCS evaluation model or its application. These PCT changes are reported to the NRC, in accordance with the requirements of 10 CFR 50.46. In Reference 103, Westinghouse has described their process to enable licensees to comply with the 10 CFR 50 46 reporting requirements, and pertinent terms are briefly defined below.

Definitions Analysis: The application of an appropriate portion of an acceptable Evaluation Model to demonstrate compliance with criteria in 10 CFR 50.46(b).

Analysis-Of-Record (AOR): The AOR is the latest plant specific analysis performed using the latest acceptable Evaluation Model.

Evaluation Model (EM): An Evaluation Model is the calculational framework for evaluating the behavior of the reactor coolant system during a postulated LOCA. It includes one or more computer programs and all other information necessary for application of the calculational framework to a specific LOCA, such as mathematical models used, assumptions included in the programs, procedure for treating the program input and output information, specification of those portions of analysis not included in computer programs, values of parameters, and all other information necessary to specify the calculational procedure.

Estimated Effect: The estimated effect of a change in the Evaluation Model must be determined for 10 CFR 50.46 reporting purposes. The effect of a change to, or error in, the ECCS Evaluation Model is the difference in the LOCA results when the change is included in the Evaluation Model.

Evaluation: The use of a combination of information, either derived from Evaluation Model sensitivity studies, calculated from first principles, extracted from existing calculations, or based upon engineering experience, along with known sensitivities from appropriate applications of ECCS Evaluation Models to determine the estimated effect of a change on calculated PCT of other 10 CFR 50.46 criteria. It is distinguished from an Analysis in that it may or may not involve the direct application of the computer codes or calculations which comprise an Evaluation Model to determine the effect of a change.

Licensing Basis LOCA Results: The AOR LOCA results as modified to include the estimated effects of changes in the approved Evaluation Model, corrections of errors in application, and plant changes implemented under 10 CFR 50.59 or 10 CFR 50.92. The licensing basis LOCA PCT result appears in the required 10 CFR 50.46 reporting, which aids in the demonstration of compliance with the 10 CFR 50.46(b)(1) criterion when changes to the AOR LOCA result occur.

Table 15-82 provides a summary of the current licensing basis LOCA PCT values as reported pursuant to 10 CFR 50.46 for Catawba Nuclear Station.

15.6 - 30 (09 OCT 2019)

Catawba Nuclear Station UFSAR Chapter 15 15.6.6 A Number of BWR Transients Not applicable to Catawba.

15.6.7 References

1. Deleted Per 1994 Update

2. Deleted Per 1997 Update.

3. "Acceptance Criteria for Emergency Core Cooling System for Light Water Cooled Nuclear Power Reactors", 10 CFR 50.46 and Appendix K of 10 CFR 50.

4. Deleted Per 1994 Update

5. Deleted Per 1995 Update

6. WCAP-15025-P, Modified WRB-2 Correlation, WRB-2M, for Predicting Critical Heat Flux in 17 x 17 Rod Bundles with Modified LPD Mixing Vane Grids, Westinghouse, February 1998.

7. Hsieh, T., and Raymond, M., "Long Term Ice Condenser Containment LOTIC Code Supplement 1", WCAP-8355-A Supplement 1, WCAP-8354-P-A (Proprietary), April 1976.

8. Bordelon, F.M. et. al., "LOCTA-IV Program: Loss of Coolant Transient Analysis," WCAP-8301 (proprietary) and WCAP-8305 (Non-Proprietary) June 1974.

9. Deleted Per 1994 Update

10. Deleted Per 1995 Update

11. Lee, H., Tauche, W. D., Schwarz, W. R., "Westinghouse Small Break ECCS Evaluation Model Using the NOTRUMP Code", WCAP-10054-P-A (Proprietary), and WCAP-10081 (Non-Proprietary) August 1985.

12. Deleted Per 1995 Update

13. Deleted Per 1995 Update

14. Deleted Per 1995 Update

15. Meyer, P. E., "NOTRUMP, A Nodal Transient Small Break and General Network Code",

WCAP-10079-P-A (Proprietary), August 1985.

16. Deleted Per 1994 Update

17. Deleted Per 1994 Update

18. Deleted Per 1994 Update

19. DiNunno, J. J., et. al., "Calculations and Distance Factors for Power and Test Reactor Sites," USAEC Report TID-14844, March 1962.

20. Deleted Per 2006 Update

21. Deleted Per 2006 Update

22. Deleted Per 2006 Update

23. Deleted Per 2006 Update

24. Standard Review Plan 6.5.4, "Ice Condenser as a Fission Product Control System," Rev. 2, NUREG-0800, August 1981.

(09 OCT 2019) 15.6 - 31

UFSAR Chapter 15 Catawba Nuclear Station

25. Standard Review Plan 6.5.2, "Containment Spray as a Fission Product Cleanup System,"

Rev. 1, NUREG-0800, July 1981.

26. Soldat, J. K., et. al., "The Dosimetry of the Radioactive Noble Gases," BNWL-SA-4813, 1973.

27. Regulatory Guide 1.109, "Calculation of Annual Doses to Man From Routine Releases of Reactor Effluents for the Purpose of Evaluating Compliance With 10CFR 50, Appendix I,"

U.S. Nuclear Regulatory Commission, Rev. 1, October 1977.

28. Standard Review Plan 6.4, "Control Room Habitability System," Rev. 2, NUREG-0800, July 1981.

29. Deleted Per 2006 Update

30. Murphy, K. G., and Campe, K. M., "Nuclear Power Plant Control Room Ventilation System Design for Meeting General Design Criterion 19," 13th AEC Air Cleaning Conference, August 1974.

31. ICRP Publication 30, "Limits for Intakes of Radionuclides by Workers", Supercedes ICRP Publication 2, July 1978.

32. December 7, 1987 letter from Duke Power (H. B. Tucker) to NRC, "Steam Generator Tube Rupture Analysis".

33. J. H. McFadden, et. al., "RETRAN A Program for Transient Thermal-Hydraulic Analysis of Complex Fluid Flow Systems", NP-1850-CCM-A, Revision 6.1, June, 2007.

34. "FSAR Chapter 15 System Transient Analysis Methodology", DPC-NE-3002-A, Duke Power Co., Revision 4b, September, 2010.

35. Deleted Per 2001 Update

36. Deleted Per 2001 Update

37. Deleted Per 2001 Update

38. Deleted Per 2001 Update

39. Deleted Per 1998 Update.

40. Deleted Per 2001 Update

41. Deleted Per 2000 Update

42. Deleted Per 1994 Update

43. Deleted Per 1994 Update

44. "Duke Power Company Thermal-Hydraulic Statistical Core Design Methodology", DPC-NE-2005-PA, Revision 4a, December, 2008.

45. Deleted Per 2000 Update

46. Deleted Per 2000 Update

47. Deleted Per 1994 Update

48. Lewis, R. N., et al, "SGTR Analysis Methodology to Determine the Margin to Steam Generator Overfill", WCAP-10698-P-A, August 1987.

15.6 - 32 (09 OCT 2019)

Catawba Nuclear Station UFSAR Chapter 15

49. S.N. Peters to D.M. Jamil, Catawba Nuclear Station, Units 1 and 2 - Issuance of Amendments Re: Steam Generator Tube Rupture Licensing Basis (TAC Nos. MB5200 and MB5201), September 24, 2004.

50. Deleted Per 1995 Update

51. Deleted Per 2000 Update

52. Deleted Per 1995 Update

53. Deleted Per 1995 Update

54. Deleted Per 2000 Update

55. Deleted Per 2000 Update

56. Deleted Per 2000 Update

57. Deleted Per 2000 Update

58. Deleted Per 2000 Update

59. Deleted Per 2000 Update

60. Deleted Per 2001 Update

61. Deleted Per 2001 Update

62. Deleted Per 2001 Update

63. Deleted Per 2001 Update

64. Deleted Per 2000 Update

65. Deleted Per 2000 Update

66. Deleted Per 2001 Update

67. Deleted Per 2001 Update

68. Deleted Per 2001 Update

69. Deleted Per 2001 Update

70. Deleted Per 2001 Update

71. Deleted Per 2001 Update

72. Thompson, C. M., et al., "Addendum to the Westinghouse Small Break ECCS Evaluation Model Using the NOTRUMP Code: Safety Injection into the Broken Loop and COSI Condensation Model," WCAP- 10054-P-A (Proprietary), Addendum 2, Revision 1, July 1997.

73. Shimeck, D. J., "1-D Heat Conduction Model for Annular Fuel Pellets," WCAP-14710-P-A (Proprietary), WCAP-14711-NP-A (Non-Proprietary), May 1998.

74. Akers, J. J. ed., "Model Changes to the Westinghouse Appendix K Small Break LOCA NOTRUMP Evaluation Model: 1988 - 1997," WCAP-15085, July 1998.

75. Deleted Per 2001 Update

76. Rupprecht, S.D., et al., Westinghouse Small Break LOCA ECCS Evaluation Model Generic Study with the NOTRUMP Code, WCAP-11145-P-A (Proprietary) and WCAP-11372 (Non-Proprietary), October 1986.

(09 OCT 2019) 15.6 - 33

UFSAR Chapter 15 Catawba Nuclear Station

77. Code Qualification Document for Best Estimate LOCA Analysis, WCAP-12945-P-A (Proprietary), Volume I, Revision 2, and Volumes II-V, Revision 1, and WCAP-14747 (Non-Proprietary), Westinghouse Electric Company, March 1998.

78. USNRC Regulatory Guide 1.157, Best-Estimate Calculations of Emergency Core Cooling System Performances, May, 1989.

79. Qualifying Reactor Safety Margins: Application of Code Scaling Applicability and Uncertainty (CSAU) Evaluation Methodology to a Large Break Loss-of-Coolant-Accident, NUREG/CR-5249, 1989.

80. Letter, R.C. Jones (USNRC) to N.J. Liparulo (W), Acceptance for Referencing of the Topical Report WCAP-12945 (P), Westinghouse Code Qualification Document for Best Estimate Loss-of-Coolant Analysis, June 28, 1996.

81. Best Estimate Analysis of the Large Break Loss of Coolant Accident for the McGuire and Catawba Nuclear Stations, WCAP-15440, Rev.0, Westinghouse Electric Company LLC, July, 2000.

82. Letter, W.R. McCollum, Jr. (DEC) to USNRC, Report Pursuant to 10 CFR 50.46, Changes to or Errors in an ECCS Evaluation Model, July 29, 2003.

83. Peter S. Tam (U.S. Nuclear Regulatory Commission) to W.R. McCollum, Issuance of Amendments-Catawba Nuclear Station, Units 1 and 2 (TAC Nos. M98107 and M98108).

84. O.J. Mendler, M.J. Asztalos, A.C. Cheung, R.N. Lewis, K. Rubin, M.Y. Young (Westinghouse Electric Corporation), The Effect of Steam Generator Tube Bundle Uncovery on Radioiodine Release, WCAP-13132, January 1992.

85. Safety Evaluation by the Office of Nuclear Reactor Regulation Related to Amendment No.

236 to Facility Operating License No. DPR-58 and Amendment No. 218 to Facility Operating License No. DPR-74, Indiana Michigan Power Company, Donald C. Cook Nuclear Plant, Units 1 and 2, Docket Nos. 50-315 and 50-316. Implemented via 10CFR50.59 dated 9/13/2004.

86. S. Nuclear Regulatory Commission, Alternative Radiological Source Term for Evaluating Design Basis Accidents at Nuclear Power Reactors, Regulatory Guide 1.183.

87. Ibid. Appendix A.

88. Bechtel Corporation, LOCADOSE NE-319 Users Manual, Latest Revision to Date. This manual is proprietary to Bechtel Corporation.

89. Bechtel Corporation, LOCADOSE NE-319 Theoretical Manual, Latest Revision to Date.

This manual is proprietary to Bechtel Corporation.

90. Bechtel Corporation, LOCADOSE NE-319 Validation Manual, Latest Revision to Date. This manual is proprietary to Bechtel Corporation.

91. U.S. Nuclear Regulatory Commission, Methods and Assumptions for Evaluating Radiological Consequences of Design Basis Accidents at Ligh-Water Nuclear Power Plants, Regulatory Guide 1.195, May 2003.

92. E.C. Beahm, R.A. Lorenz, and C.P. Weber, Iodine Evolution and Control, NUREG/CR-5950, ORNL/TM-12242 R3, December 1992.

93. A.K. Postma, R.R. Sherry, and P.S. Tam, Technological Bases for Models of Spray Washout of Airborne Contaminants in Containment Vessels, NUREG/CR-0009, Benton City, Washington, 1978.

15.6 - 34 (09 OCT 2019)

Catawba Nuclear Station UFSAR Chapter 15

94. U.S. Nuclear Regulatory Commission, Recent Discovery of a Phenomenon Not Previously Considered in the Design of Secondary Containment Pressure Control, Information Notice 88-76, September 19, 1988.

95. W.A. Yuill, V.F. Baston, and O.L. Cordes, Release of Radionuclides from Open Pools, TID-4500, December 1970.

96. U.S. Nuclear Regulatory Commission, Atmospheric Relative Concentrations for Control Room Radiological Habitability Assessments at Nuclear Power Plants, Regulatory Guide 1.194, June 2003.

97. Licensee Event Report 413/91-08.U.S. Nuclear Regulatory Commission, Demonstrating Control Room Envelope Habitability at Nuclear Power Plants, May 2003.

98. K.F. Eckermann, A.B. Wolbarst, A.C.B. Richardson, Limiting Values of Radionuclide Intake and Air Concentration and Dose Conversion Factors for Inhalation, Submersion, and Ingestion, Federal Guidance Report No. 11, 1988.

99. K.F. Eckermann and J.C. Ryan, External Exposure to Radionuclides in Air, Water, and Soil, Federal Guidance Report No. 12, 1993.

100. NRC Generic Letter 85-12, Implementation of TMI Action Items II.K.3.5, "Automatic Trip of Reactor Coolant Pumps", June 28, 1985.

101. NRC Generic Letter 83-10c, TMI Action Items II.K.3.5, "Automatic Trip of Reactor Coolant Pumps", Letter to Applicants with Westinghouse NSSSs, February 8, 1983.

102. Letter for H.B. Tucker (Duke) to H.R. Denton (NRC), dated March 26, 1984, Catawba Nuclear Station, Response to Generic Letter 83-10c.

103. "Westinghouse Methodology for Implementation of 10 CFR 50.46 Reporting," WCAP-13451, October 1992.

104. Letter, G.R. Peterson (Duke) to USNRC, "Report Pursuant to 10 CFR 50.46, Changes to or Errors in an ECCS Evaluation Model," April 11, 2001.

105. Letter, M.S. Tuckman (Duke) to USNRC, "Report Pursuant to 10 CFR 50.46, Changes to or Errors in an ECCS Evaluation Model," April 03, 2002.

106. Letter, W.R. McCollum, Jr. (Duke) to USNRC, "Report Pursuant to 10 CFR 50.46, Changes to or Errors in an ECCS Evaluation Model," May 26, 2004.

107. Letter, J.R. Morris (Duke) to USNRC, "Report Pursuant to 10 CFR 50.46, Changes to or Errors in an ECCS Evaluation Model," June 21, 2005.

108. Letter, T.C. Greer (Duke) to USNRC, "Report Pursuant to 10 CR 50.46, Changes to or Errors in an ECCS Evaluation Model," March 13, 2007.

109. Letter, D.C. Culp (Duke) to USNRC, "Response to Information Request Pursuant to 10 CFR 50.54(f) Related to the Estimated Effect on Peak Cladding Temperature Resulting from Thermal Conductivity Degradation in the Westinghouse-Furnished Realistic Emergency Core Cooling System Evaluation and 30-Day Report Pursuant to 10 CFR 50.46, Changes to or Errors in an Evaluation Model," March 16, 2012.

110. Letter, T.C. Geer (Duke) to USNRC, "Report Pursuant to 10 CFR 50.46, Changes to or Errors in an ECCS Evaluation Model," May 22, 2007.

111. Letter, R.J. Duncan (Duke) to USNRC, "Report Pursuant to 10 CFR 50.46, Changes to or Errors in an ECCS Evaluation Model," August 29, 2013.

(09 OCT 2019) 15.6 - 35

UFSAR Chapter 15 Catawba Nuclear Station 112. Letter, B.C. Waldrep (Duke) to USNRC, "Report Pursuant to 10 CFR 50.46, Changes to or Errors in an ECCS Evaluation Model," February 25, 2014.

113. Letter from J. Whited (USNRC) to K. Henderson (Duke Energy), "Catawba Nuclear Station, Units 1 and 2 - Issuance of Amendments Regarding Measurement Uncertainty Recapture Power Uprate (CAC Nos. MF4526 and MF4527)", April 29, 2016.

114. Shah, H.H. and Schueren, P., "Optimized ZIRLO'," WCAP-12610-P-A & CENPD-404-P-A, Addendum 1-A, July 2006.

THIS IS THE LAST PAGE OF THE TEXT SECTION 15.6.

15.6 - 36 (09 OCT 2019)

Catawba Nuclear Station UFSAR Chapter 15 15.7 Radioative Release From a Subsystem or Component A number of events have been postulated which could result in a radioactive release from a plant subsystem or component. Detailed analyses are presented for several such events which have been identified as limiting cases.

Discussions of the following events are presented in this section:

1. Radioactive Gas Waste System leak or failure.

2. Radioactive Liquid Waste System leak or failure.

3. Postulated radioactive releases due to liquid tank failures.

4. Fuel handling accidents in the Containment and Spent Fuel Buildings.

5. Spent fuel cask drop accident.

The above are considered to be ANS Condition III events, with the exception of the design basis fuel handling accidents, which are considered to be ANS Condition IV events. Section 15.0 contains a discussion of ANS classifications and applicable acceptance criteria.

15.7.1 Radioactive Gas Waste System Leak or Failure 15.7.1.1 Identification of Causes and Accident Description The Waste Gas System (WG), as discussed in Chapter 11, is designed to remove fission product gases from the reactor coolant. The system consists of a closed loop with waste gas compressors, hydrogen recombiners, waste gas decay tanks for service at power, and other waste gas decay tanks for service at shut-down and startup.

The accident is defined as an unexpected and uncontrolled release of radioactive xenon and krypton fission product gases stored in a waste decay tank as a consequence of a failure of a single gas decay tank or associated piping.

Deleted per 2013 Update.

A Waste Gas System leak or failure is classified as an ANS Condition III event, an infrequent fault. See Section 15.0 for a discussion of Condition III events.

15.7.1.2 Analysis of Effects and Consequences Method of Analysis Selected Licensee Commitment 16.11-19 limits the activity in a Waste Gas tank to ensure that the rupture of one tank does not produce a radiation dose to the whole body at the Exclusion Area Boundary in excess of 0.5 Rem. The Alternative Source Terms (AST) analysis described below was completed to validate this and also to ensure that the total effective dose equivalent (TEDE) to the control room operators from a failure of one Waste Gas tank would be less than 5 Rem pursuant to 10 CFR 50.67 and General Design Criterion 19. The deep dose equivalent (DDE), which is the AST equivalent to the whole body radiation dose, is a constituent to the TEDE. Calculating a TEDE at the EAB and comparing it to the 0.5 Rem cited above ensures that the whole body radiation does does not exceed the 0.5 Rem limit.

The following assumptions, identified in sensitivity analyses, ensure the calculation of limiting radiation doses from a Waste Gas tank failure.

(09 OCT 2019) 15.7 - 1

UFSAR Chapter 15 Catawba Nuclear Station

1. The entire inventory of one tank, constituting a Dose Equivalent Xenon-133 (DEX) activity of 97,000 Curies, is assumed to be released instantly to the auxiliary building.

2. The inventory released from the failed Waste Gas tank consists of noble gases. The DEX activity of each noble gas isotope is proportional to the DEX specific activity listed for the reactor coolant in Table 15-83.

3. No credit is taken for holdup in the auxiliary building.

4. The EAB atmospheric dispersion factor (X/Q) takes an initial value of 4.78E-04 sec/m3. The X/Q for the boundary of the Low Population Zone (denoted as the LPZ) takes an initial value of 6.85 E-05 sec/m3.

5. The entire inventory from the failed Waste Gas tank is released from the unit vent stack.

The initial value for the control X/Q for this release is the 0-2 hour value shown in Table 2-105.

6. One control room intake is closed; the open intake is exposed to the contaminated effluent.

7. Due to coincident loss of normal AC power, both Control Room Area Ventilation pressurized filter trains start automatically. Within one minute, the operators secure one of these on-line pressurized filter trains.

8. Daughter product formation from radioactive decay of the activity releases from the failed Waste Gas tank is calculated.

Results The calculated offsite and control room radiation doses are listed in Table 15-14.

15.7.1.3 Environmental Consequences The maximum activity in a single gas decay tank is limited by Selected Licensee Commitment 16.11-19. This ensures that in the event of an uncontrolled release of the tank contents, the resulting total effective dose equivalent to an individual at the exclusion area boundary is less than 0.5 rem. The control room radiation dose following this event is less than the 5 Rem limit in 10 CFR 50.67 and General Design Criterion 19.

15.7.2 Radioactive Liquid Waste System Leak or Failure 15.7.2.1 Identification of Causes and Accident Description The accident is defined as the uncontrolled atmospheric release from the 112,000 gallon recycle holdup tank due to the postulated rupture of the tank. This tank is the highest potential atmospheric release source because of its activity level and volume. The holdup tank is a part of the Boron Recycle System and is discussed in Section 9.3.5.

A radioactive liquid waste system leak or failure is classified as an ANS Condition III event, an infrequent fault. See Section 15.0 for a discussion of Condition III events.

15.7.2.2 Analysis of Effects and Consequences Method Of Analysis An Alternative Source Terms (AST) analysis of failure of the Recycle Holdup Tank was completed to esnsure that the offsite radiation doses at offsite locations do not exceed 2.5 Rem Total Effective Dose Equivalent (TEDE) and that the control room radiation dose does not 15.7 - 2 (09 OCT 2019)

Catawba Nuclear Station UFSAR Chapter 15 exceed the 5 Rem limit in 10 CFR 50.67 and General Design Criterion 19. Noble gas and iodine radioistopes presumably are released. Since the source term does not correspond to fuel pins in an operating reactor core, no spiking is assumed. The following assumptions, based on a sensitivity study, ensure the calculation of limiting radiation doses for the Liquid Waste tank failure.

1. The activity assumed to be released from the failure of the Recycle Holdup Tank is instantly released to the auxiliary building

2. The activity released from the failed Recycle Holdup Tank includes isotopes of noble gases and iodine. The Dose Equivalent Xenon-133 (DEX) activity of each noble gas radioisotope is proportional to the DEX specific activity listed for the reactor coolant in Table 15-83. The Dose Equivalent Iodine-131 (DEI) specific activity of each iodine radioisotope is proportional to the DEI specific activity listed for the reactor coolant in Table 15-84.

3. All noble gases are instantly released from the failed Recycle Holdup Tank.

4. No credit is taken for holdup in the auxiliary building.

5. One control room intake is closed; the open intake is exposed to the contaminated effluent.

6. The on-line Control Room Area Ventilation pressurized filter train fails at event initiation.

Normal AC power remains available. The operators do not start the standby pressurized filter train.

7. Daughter product formation from radioactive decay of the activity releases from the failed Waste Gas tank is calculated.

Additional assumptions are listed in Table 15-42.

Results The calculated offsite and control room radiation doses are listed in Table 15-14.

15.7.2.3 Environmental Consequences The doses from this accident are within 10 CFR 50.67 limits.

15.7.3 Postulated Radioactive Releases due to Liquid Tank Failures 15.7.3.1 Identification of Causes and Accident Description The accident is defined as the uncontrolled liquid release from the 395,000 gallon refueling water storage tank due to the postulated rupture of the tank. This tank has the highest potential radiological consequence due to a tank rupture of the outdoor tanks - the only tanks which have a potential for an uncontrolled offsite liquid release.

A liquid tank failure is classified as an ANS Condition III event, an infrequent fault. See Section 15.0 for a discussion of condition III events.

15.7.3.2 Analysis of Effects and Consequences Method of Analysis The assumptions made in the analysis are as follows:

1. The refueling water storage tank ruptures releasing 395,000 gallons of liquid. The activity assumed is given in Table 15-43.

(09 OCT 2019) 15.7 - 3

UFSAR Chapter 15 Catawba Nuclear Station

2. A conservative dilution factor of 1.9 x 10-4 (based on assumptions discussed in Section 2.4.12) is assumed to the nearest surface water intake.

Results The resultant activity concentrations at the nearest surface water intake are within the limits of 10CFR 20, Appendix B, Table II, Column 2.

15.7.3.3 Environmental Consequences The general basis for acceptance of radioactivity concentrations in outdoor liquid holdup tanks is to show that the postulated failure of the tank and its associated components would not result in radionuclide concentrations in excess of 10CFR Part 20, Appendix B, Table II, Column 2 at the nearest potable water supply in an unrestricted area. This acceptance criteria can be met independent of individual radionuclide concentrations by using the following equation:

The equation below was revised per 2003 update.

i Conci

• Df

• Vol / EC i

< 1.0 where:

Conci = Liquid holdup tank concentration of radionuclide i, (µCi/ml)

Df = Volume dependent dilution factor for transport of tank spill concentration to the Rock Hill Water Intake

= 4.9 x 10-10 (gallons-1)

ECi = 10CFR 20, Appendix B, Table II, Column 2, Maximum Permissible Concentration for radionuclide i, (µCi/ml)

Vol = Volume of liquid released (gallons) 15.7.4 Fuel Handling Accidents in the Containment and Spent Fuel Storage Buildings 15.7.4.1 Identification of Causes and Accident Description The accident is defined as dropping of a spent fuel assembly, resulting in the rupture of the cladding of all the fuel rods in the assembly despite many administrative controls and physical limitations imposed on fuel handling operations. All refueling operations are conducted in accordance with prescribed procedures under direct surveillance of a supervisor.

A fuel handling accident is classified as an ANS condition IV event, a limiting fault. See Section 15.0 for a discussion of condition IV events.

Also reported in this section is the postulated drop of one of two weir gates into the spent fuel pool at Catawba Nuclear Station. Each spent fuel pool is equipped with two weir gates. The weir gate for the fuel cask decontamination pit (3800 lb) is not suspended over the spent fuel pool, but is moved in very close proximity to it. The weir gate for the fuel transfer canal (3600 lb) cannot be placed into service without moving it over the spent fuel racks. As with all refueling activities, this operation is conducted in accordance with prescribed procedures.

15.7 - 4 (09 OCT 2019)

Catawba Nuclear Station UFSAR Chapter 15 The weir gate drop is classified as an ANS condition IV event, a limiting fault. See Section 15.0 for a discussion of condition IV events.

15.7.4.2 Analysis of Effects and Consequences The fuel assembly discharged from the core region which has the peak inventory is the assembly assumed to be dropped. The assembly inventory is determined assuming maximum full power operation at the end of core life immediately proceeding shutdown. The gap model discussed in Section 15.0 is used to determine the fuel-clad gap activities. Thus 10 percent of the total assembly iodines and noble gases, except for 30 percent of Kr-85, are assumed to be in the fuel-clad gap. The total assembly and fuel-clad gap activities are given in Table 15-45.

15.7.4.2.1 Postulated Fuel Handling Accident Outside Containment The analyses of a postulated fuel handling accident are performed as follows:

1. A conservative analysis was completed with the method of Alternative Source Terms and in conformance to R.G. 1.183 (References 1 and 2).

Deleted per 2004 update.

The parameters used for each of these analyses are listed in Table 15-46.

The basis for the Regulatory Guide 1.183 evaluation is as follows:

1. The accident is assumed to occur 72 hrs after plant shutdown.

2. All of the rods in one fuel assembly are ruptured.

3. The damaged assembly is the highest powered assembly in the core region to be discharged. The values for individual fission product inventories in the damaged assembly are calculated assuming full power operation at the end of core life immediately preceding shutdown. The radial peaking factor is set to 1.65.

4. The maximum fuel rod pressurization is 1300 psig.

5. The minimum water depth between the top of the damaged fuel rods and the spent fuel pool surface is 23 ft.

6. All of the gap activity in the damaged rods is released to the spent fuel pool and consists of 5 percent of the total noble gases other than krypton-85, 10 percent of the krypton-85, 5 percent of the total radioactive halogens other than iodine-131, and 8 percent of iodine-131 in the rods at the time of the accident. For those fuel pins which exceed the rod power/

burnup criteria of Footnote 11 in RG 1.183, the gap fractions from RG 1.183 are increased by a factor of 3 for Kr-85, Xe-133, Cs-134 and Cs-137, and increased by a factor of 2 for I-131, and other noble gases, halogens and alkali metals. A maximum of 25 fuel rods per fuel assembly shall be allowed to exceed the rod power/ burnup criteria of Footnote 11 in RG

[Regulatory Guide] 1.183 in accordance with the license amendment request submitted by letter dated July 15, 2015 [Reference 1].

7. Noble gases released to the spent fuel pool are then immediately released at ground level to the environment.

8. The iodine gap inventory is composed of diatomic iodine (99.85 percent) and organic species (0.15 percent).

(09 OCT 2019) 15.7 - 5

UFSAR Chapter 15 Catawba Nuclear Station

9. The spent fuel pool effective decontamination factor for iodine is 200. The composiion fractions for the iodine leaving the spent fuel pool are 57% for diatomic iodine and 43% for organic iodine compounds.

10. Noble gases are not held up in the fuel pool water.

11. The radioisotopes in the gap were assumed to be released instantly to the spent fuel pool.

The timing of the release of radioactivity from the spent fuel pool to the environment was assumed to take the profile of an exponential decay function. It was assumed that 98% of all radioactivity released to the environment would be released within 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />.

12. Atmospheric dispersion conditions are assumed to be the 0-2 hour ground level case. The potential release paths for the Fuel Handling Accident outside containment are either through penetrations from the Fuel Building to the yard or the unit vent stack either via the Fuel Building Ventilation System (no credit taken for the VF filters) or via the Auxiliary Building (no credit taken for filtration or holdup or mixing). The release path was taken to be the unit vent stack as it is associted with the higher set of control room atmospheric dispersion factors (X/Qs).

13. Maximum burnup is 62 GWD/MTU. For 25 fuel pins in each damaged fuel assembly, the linear heat rate is assumed to take the values specific in the letter to the NRC, dated July 15, 2015 (Reference 1). Otherwise, for burnup less than 54 GWD/MTU, the linear heat rate is less than 6.3 kW/ft.

14. No credit is taken for filtration by the VF System. No credit is taken for mixing within the fuel building.

15. Only one Control Room Area Ventilation (VC) System outside air intake is taken to be open for the duration of the releases, the one exposed to the contaminated air.

16. Offsite power is assumed to be available during the course of the accident.

17. The on-line VC filter train is assumed to fail at the initiating event. Since this is not a Safety Injection event and offsite power is assumed to be available, the standby VC filter train does not automatically start. Manual start of the standby VC filter train with a 30 minute delay is assumed.

15.7.4.2.2 Postulated Fuel Handling Accident Inside Containment The possibility of a fuel handling accident inside Containment during refueling is relatively small due to the many physical, administrative, and safety restrictions imposed on refueling operations. Nevertheless, consideration is given to one accident; a drop of a fuel assembly into the refueling cavity by the refueling machine inside Containment. The impact would result in breaching of the fuel rod cladding and release of a portion of the fission gases from the damaged fuel rods to the refueling cavity.

The parameters used are listed in Table 15-46.

The analysis of the radiological consequences of the fuel handling accident inside containment also is conducted pursuant to R.G. 1.183. The basis for evaluation of the fuel handling accident inside containment is the same as that for the evaluation for the fuel handling accident outside containment (Items 1-14 listed in Section 15.7.4.2.2). In particular, the following clarification is made.

1. No credit is taken for filtration of releases by the Containment Purge Ventilation (VP)

System. No credit is taken for containment isolation or mixing in containment. The process of release is assumed to same as that posed for the fuel handling accident outside 15.7 - 6 (09 OCT 2019)

Catawba Nuclear Station UFSAR Chapter 15 containment: release of the gap activity to the reactor cavity, release from the reactor cavity, and timed release to the environment. The particulars of this process are exactly the same as assumed for the evaluation of the fuel handling accident outside containment. The assumed process of release is equivalent to the Section 15.7.4.2.2 Items 9, 11, and 14.

2. The potential release pathways associated with the fuel handling accident inside containment include releases directly through the open containment hatch (no credit taken for closing it after the initiating event) and into the Auxiliary Building with releases from the unit vent stack (no credit taken for filtration by the VA System or holdup or mixing in the Auxiliary Building). Of these two release paths, the Auxiliary Building to the unit vent stack is associated with the higher set of control room X/Qs and is taken as the release path.

This release path also is taken for the fuel handling accident inside containment as reported in Section 15.7.4.2.2 Item 12.

3. In all other particulars, the basis for the evaluation of the fuel handling accident inside containment is the same as the basis for the evaluation of the fuel handling accident outside containment.

For these reasons, the limiting values of radiation doses (total effective dose equivalents or TEDEs) at offsite locations and in the control room are the same for the fuel handling accidents inside and outside containment.

Results Results from the analyses are presented in Tables 15-14 and 15-46.

15.7.4.2.3 Postulated Weir Gate Drop The analysis of this accident is performed in accordance with the positions of Section 15.0 and Appendix B. The time of decay assumed for this analysis is equal to the restriction in the Selected Licensee Commitments. The inventories of the fuel assemblies damaged by the dropped weir gate are determined assuming maximum full power operation at the end of core life immediately preceeding shutdown. The gap activity specified in Regulatory Guide 1.183 is used to determine the fuel-clad activities. Therefore, 10 percent of all iodine and noble gas radioisotopes, except for Kr-85 (30 percent), are assumed to be in the fuel-clad gap. The assembly and fuel-gap activities are given in Table 15-45.

The basis for evaluation of the weir gate drop is exactly the same as the basis for evaluation of the fuel handling accident outside containment (Section 15.7.4.2.1 Items 1-17) with the following exceptions and clarifications.

1. The lower bound decay time for the fuel assemblies on which a weir gate is assumed to fall is 468 hr or 19.5 days (replaces Item 1 of Section 15.7.4.2.1).

2. The dropped weir gate is assumed to damage 7 fuel assemblies with release of the gap activity of all pins in the impaced 7 fuel assemblies (replaces Item 2 of Section 15.7.4.2.1).

3. The assumptions made concerning the power and peaking factors of the one damaged fuel assembly for the fuel handling accidents applies to all 7 fuel assemblies damaged with the weir gate drop.

The limiting TEDEs at offsite locations and in the control room are listed in Tables 15-14 and 15-58.

(09 OCT 2019) 15.7 - 7

UFSAR Chapter 15 Catawba Nuclear Station 15.7.4.3 Environmental Consequences 15.7.4.3.1 Postulated Fuel Handling Accident Outside Containment The limiting radiation doses at the EAB and inside the control room for this accident scenario are presented in Tables 15-14 and 15-46. They are below the NRC acceptance criteria of Regulatory Guide 1.183 (6.3 Rem for offsite doses and 5.0 Rem for the control room.)

15.7.4.3.2 Postulated Fuel Handling Accident Inside Containment The limiting radiation doses at the EAB and inside the control room for this accident scenario are presented in Tables 15-14 and 15-46. They are below the NRC acceptance criteria of Regulatory Guide 1.183 (6.3 Rem for offsite doses and 5.0 Rem for the control room.)

15.7.4.3.3 Postulated Weir Gate Drop The limiting radiation doses at the EAB and inside the control room for this accident scenario are presented in Tables 15-14 and 15-58. They are below the NRC acceptance criteria of Regulatory Guide 1.183 (6.3 Rem for offsite doses and 5.0 Rem for the control room.)

15.7.5 Spent Fuel Cask Drop Accident Analyses have been completed to determine the consequences of three scenarios in which a fuel cask is either tipped or dropped at Catawba.

In the first scenario, a fuel cask is either tipped or dropped toward a spent fuel pool. The analysis of this scenario is reported in Section 9.1.2.3. It was concluded that a dropped or tipped cask could not fall into the spent fuel pool. Accordingly, this scenario does not yield any radiological consequences.

The second scenario involves dropping a loaded fuel cask onto the ground at Catawba. In this scenario, the loaded cask is sealed. The analysis demonstrates that the fuel cask will not breach on impact. Accordingly, this scenario also yelds no radiological consequences.

The third scenario involves a drop of a loaded but unsealed fuel cask into the fuel cask pit.

Since this cask was not sealed, it was assumed to be breached on impact. It was assumed that the dropped cask contained 37 fuel assemblies that have been cooled for 4 years. It also was assumed that the fuel assemblies are submerged at all times during this scenario. The analysis of this fuel cask drop scenario was completed with the method of Alternative Source Terms (AST) and in conformance to Regulatory Guide 1.183 and Appendix B. The fuel assembly isotopic activities (assuming no prior decay) include 85Kr (29,320 Ci) and its two precursors: 85Br (517,800 Ci) and 85mKr (519,100 Ci). Of all isotopes in the resulting source term, only 85Kr escapes the water in the fuel cask pit; the other radioisotopes either disappear with radioactive decay or remain in the pool (134Cs and 137Cs). Rupture of the pin cladding for all fuel assemblies in the dropped cask and release of gap activity into the water in the pit was assumed. For those fuel pins which exceed the rod power/ burnup criteria of Footnote 11 in RG 1.183, the gap fractions from RG 1.183 are increased by a factor of 3 for Kr-85, Xe-133, Cs-134 and Cs-137, and increased by a factor of 2 for I-131, and other noble gases, halogens and alkali metals. A maximum of 25 fuel rods per fuel assembly shall be allowed to exceed the rod power/ burnup criteria of Footnote 11 in RG [Regulatory Guide] 1.183 in accordance with the license amendment request submitted by letter dated July 15, 2015 [Reference 1]. The entire 85Kr inventory was assumed to be released to the environment within 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> of event initiation. The analysis included a sensitivity study to ensure the calculation of the limiting radiation dose in the control room.

15.7 - 8 (09 OCT 2019)

Catawba Nuclear Station UFSAR Chapter 15 The acceptance criteria for radiation doses for the fuel cask drop included 6.3 Rem at the offsite locations and 5.0 Rem in the control room. The acceptance limit for the offsite radiation doses is in accord with Standard Review Plan 15.7.5, NUREG-0612 Section 5.1, 10 CFR 50.67, and Regulatory Guide 1.183. The limit for control room radiation doses is taken pursuant to 10 CFR 50.67 and General Design Criterion 19. The limiting radiation doses from the analysis of this fuel cask drop are listed in Table 15-14.

15.7.6 References

1. Regis T. Repko (Duke Energy Corporation) to U.S. Regulatory Commission, "Catawba Nuclear Station, Unit Nos. 1 and 2 Docket Nos. 50-413 and 50-414 Renewed License Nos.

NPF-35 and NPF-52 McGuire Nuclear Station, Unit Nos. 1 and 2 Docket Nos. 50-369 and 50-370 Renewed License Nos. NPF-9 and NPF-17 Oconee Nuclear Station, Unit Nos. 1, 2 and 3 Docket Nos. 50-269, 50-270, and 50-287 Renewed License Nos., DPR-38, DPR-47, and DPR-55 License Amendment Request Proposing a New Set of Fission Gas Gap Release Fractions for High Burnup Fuel Rods That Exceed the Linear Heat Generation Rate Limit Detailed in Regulatory 1.183, Table 3, Footnote 11," July 15, 2015.

2. James R. Hall (USNRC) to Regis T. Repko, "Catawba Nuclear Station, Units 1 and 2; McGuire Nuclear Station, Units 1, 2; and Oconee Nuclear Station, Units 1, 2, and 3 -

Issuance of Amendments Regarding Request to Use an Alternate Fission Gas Gap Release Fraction (CAC Nos., MF6480, MF6481, MF6482, MF6483, MF6484, MF6485, and MF6486)," July 19, 2016.

THIS IS THE LAST PAGE OF THE TEXT SECTION 15.7.

(09 OCT 2019) 15.7 - 9

UFSAR Chapter 15 Catawba Nuclear Station THIS PAGE LEFT BLANK INTENTIONALLY.

15.7 - 10 (09 OCT 2019)

Catawba Nuclear Station UFSAR Chapter 15 15.8 Anticipated Transients Without Trip An anticipated transient without trip (ATWT) or anticipated transient without scram (ATWS) is an anticipated operational occurrence (such as loss of feedwater, loss of condenser vacuum, or loss of offsite power) that is accompanied by a failure of the reactor trip system to shut down the reactor. A series of generic studies (References 1 and 2) on ATWS showed that acceptable consequences would result provided that the turbine trips and auxiliary feedwater flow is initiated in a timely manner.

The effects of ATWS are not considered as part of the design basis for transients analyzed in 15.0. The final USNRC ATWS rule (Reference 3) requires that all US Westinghouse-designed plants install ATWS mitigation system actuation circuitry (AMSAC) to initiate a turbine trip and actuate auxiliary feedwater independent of the reactor trip system.

15.8.1 References

1. Burnett, T.W.T., et al., "Westinghouse Anticipated Transients Without Trip Analysis," WCAP-8330, August 1974.

2. Letter from T.M. Anderson (Westinghouse) to S.H. Hanauer (USNRC), "ATWS Submittal, "NS-TMA-2182, December 1979.

3. ATWS Final Rule, Code of Federal Regulations 10 CFR 50.62, "Requirements for Reduction of Risk from Anticipated Transients Without Scram (ATWS) Events for Light-Water-Cooled Nuclear Power Plants."

THIS IS THE LAST PAGE OF THE TEXT SECTION 15.8.

(09 OCT 2019) 15.8 - 1

UFSAR Chapter 15 Catawba Nuclear Station THIS PAGE LEFT BLANK INTENTIONALLY.

15.8 - 2 (09 OCT 2019)

Catawba Nuclear Station UFSAR Chapter 15 15.9 Impact of Lead Test Assemblies on Post Accident Radiation Doses Currently, mixed oxide (MOX) fuel has been retired from use at Catawba Nuclear Station and any further reactor operation of MOX fuel will require a reanalysis. Previously, an analysis was performed to determine the effect of using Westinghouse Next Generation Fuel (NGF) and MOX lead test assemblies (LTAs) at Catawba Nuclear Station. It was determined that operation of Unit 1 with the NGF assemblies would have no effect whatsoever on radiological consequences of design basis accidents at Catawba Nuclear Station. The existing analysis also determined that operation with the four MOX LTAs would have some effect on radiological consequences of certain design basis accidents at Catawba. The common characteristic of these design basis accidents is postulated damage to the fuel pins, either breach of the fuel pin or postulated core damage. These design basis accidents (and the associated UFSAR sections) include the following:

Locked Rotor Accident (UFSAR 15.3.3.3),

Rod Ejection Accident (UFSAR 15.4.8.3),

LOCA (UFSAR 15.6.5.3),

Fuel Handling Accident (UFSAR 15.7.4), and Weir Gate Drop (UFSAR 15.7.4).

This UFSAR section reports the analyses of the effects of operation of Unit 1 with four MOX LTAs on radiation doses following the design basis accidents listed above. The analyses were performed with the method of Alternative Source Terms (AST). The baseline AST analyses of these design basis accidents are reported in the sections listed above. Only the effects of the MOX LTAs are reported here.

15.9.1 Radioactive Source Terms The isotopic radioactivity levels in a MOX LTA are reported in Tables 15-75 and 15-76. The values listed in Table 15-75 were used in the calculation of radiation doses following the design basis locked rotor and rod ejection accidents and LOCA. The values listed in Table 15-76 were used in the calculations of radiation doses for the design basis fuel handling accidents and weir gate drop.

The MOX LTA radioactive source terms were calculated with the same methodology as that used to calculate the radioactive source terms for the low enriched uranium (LEU) fuel assemblies. The assumptions pertaining to the radioactive source terms for the design basis LOCA, and locked rotor and rod ejection accidents were the same for LEU fuel (Tables 15-12 and 15-73) and the MOX LTAs (Table 15-75). Some assumptions pertaining to the source terms for the design basis fuel handling accidents and weir gate drop were different for the LEU fuel assemblies (Table 15-45) and MOX LTAs (Table 15-76). These differences are as follows:

1) A burnup dependent radial peaking factor was used to calculate the LEU fuel assembly isotopics. For the radioactivity levels for the MOX LTAs, the radial peaking factor was held constant at 1.65.

2) In addition to noble gas and iodine isotopes, rubidium, cesium, and bromine isotopes are included in the isotopic inventory for the MOX LTAs.

(09 OCT 2019) 15.9 - 1

UFSAR Chapter 15 Catawba Nuclear Station

3) The MOX LTA isotopics are associated with an enrichment of 5% and burnup of 16.9 GWD/MTU. Limiting LEU fuel assembly isotopics are taken over ranges for enrichment and burnup.

The values associated with LEU fuel and MOX LTAs for the release fractions for the LOCA are compared in Table 15-77. Generally, the release fractions for both the gap release phase and the early in-vessel release phase are set higher for the MOX LTAs than for LEU fuel by a factor of 50%. Noble gases are the exception. For noble gases, the gap release fractions are set to 7.5% for the MOX LTAs and 5% for LEU fuel, for a difference of 50%. The early in-vessel release fractions for noble gases are set to 95% for LEU fuel and 92.5% for the MOX LTAs.

This practice is consistent with assuming that all noble gases in the core are released to containment for the design basis LOCA.

For the non LOCA accidents (clad damage only postulated), the gap fractions for MOX LTAs are set to values 50% higher than the values for the LEU fuel assemblies. The gap fractions for non LOCA accidents are presented in Table 15-78.

For all design basis accidents, the MOX LTAs were assumed to fail preferentially. In particular, the radioactive source terms for the design basis locked rotor and rod ejection accidents include all MOX LTA fuel pins.

15.9.2 Radioactivity Transport The methods, assumptions, and inputs pertaining to the transport of fission products and releases to the environment are essentially the same for both LEU fuel and the MOX LTAs. The following exceptions are noted.

1) One of the values for the iodine partition fraction for leakage of Engineered Safety Features (ESF) equipment in the Auxiliary Building following a design basis LOCA increased slightly.

The iodine partition fractions for post LOCA ESF leakage in the Auxiliary Building are shown in Table 15-79. This is attributed to the increase in iodine inventory in the containment sump with the presence of MOX LTAs.

2) The iodine partition fractions for ESF backleakage to the Refueling Water Storage Tank (FWST) for a design basis rod ejection accident were seen to increase slightly as shown in Table 15-80. Iodine partition fractions for post LOCA ESF backleakage to the FWST were not calculated since it was shown that this release path does not contribute significantly to radiation doses for this design basis accident.

3) Both Control Room Area Ventilation (VC) outside air intakes are assumed to be open in the analysis of the design basis fuel handling accident and weir gate drop.

15.9.3 Post Accident Radiaition Doses The effect of operation of Catawba Unit 1 with four MOX LTAs on post accident radiation doses is presented in Table 15-81. In particular, two set of total effective dose equivalent (TEDEs) for the locked rotor accident, rod ejection accident, LOCA, fuel handling accident, and weir gate drop are listed. For each design basis accident, TEDEs at the Exclusion Area Boundary (EAB),

boundary of the Low Population Zone (denoted as the LPZ), and in the control room are listed as well as the regulatory limits for these TEDEs. This table shows that the radiation doses for design basis accidents remain within the regulatory limits with operation of Unit 1 with four MOX LTAs.

15.9-2 (09 OCT 2019)

Catawba Nuclear Station UFSAR Chapter 15 THIS IS THE LAST PAGE OF THE TEXT SECTION 15.9 (09 OCT 2019) 15.9 - 3

UFSAR Chapter 15 Catawba Nuclear Station THIS PAGE LEFT BLANK INTENTIONALLY.

15.9-4 (09 OCT 2019)