ML20309A752

2 to Updated Final Safety Analysis Report, Chapter 15, Accident Analysis

ML20309A752
Person / Time
Site:	McGuire, Mcguire
Issue date:	10/08/2020
From:	Duke Energy Carolinas
To:	Office of Nuclear Reactor Regulation
Shared Package
ML20309A875	List: ML20282A521 ML20309A720 ML20309A721 ML20309A726 ML20309A728 ML20309A729 ML20309A730 ML20309A731 ML20309A733 ML20309A734 ML20309A735 ML20309A736 ML20309A737 ML20309A738 ML20309A739 ML20309A740 ML20309A741 ML20309A742 ML20309A744 ML20309A745 ML20309A746 ML20309A747 ML20309A748 ML20309A749 ML20309A750 ML20309A751 ML20309A752 ML20309A753 ML20309A754 ML20309A755 ML20309A756 ML20309A758 ML20309A759 ML20309A760 ML20309A761 ML20309A762 ML20309A763 ML20309A764 ML20309A765 ML20309A766 ML20309A767 ML20309A768 ML20309A769 ML20309A772 ML20309A773 ML20309A776 ML20309A778 ML20363A151 ML21270A023 ML21286A737 ... further results
References
RA-19-0424
Download: ML20309A752 (148)

Text

McGuire Nuclear Station UFSAR Chapter 15 Table of Contents 15.0 Accident Analysis 15.0.1 References 15.1 Increase in Heat Removal by the Secondary System 15.1.1 Feedwater System Malfunctions that Result in a Reduction in Feedwater Temperature 15.1.1.1 Identification of Causes and Accident Description 15.1.1.2 Analysis of Effects and Consequences 15.1.1.3 Conclusions 15.1.2 Feedwater System Malfunction Causing an Increase in Feedwater Flow 15.1.2.1 Identification of Causes and Accident Description 15.1.2.2 Analysis of Effects and Consequences 15.1.2.3 Environmental Consequences 15.1.2.4 Conclusions 15.1.3 Excessive Increase in Secondary Steam Flow 15.1.3.1 Identification of Causes and Accident Description 15.1.3.2 Analysis of Effects and Consequences 15.1.3.3 Environmental Consequences 15.1.3.4 Conclusions 15.1.4 Inadvertent Opening of a Steam Generator Relief or Safety Valve 15.1.4.1 Identification of Causes and Accident Description 15.1.4.2 Analysis of Effects and Consequences 15.1.4.3 Environmental Consequences 15.1.4.4 Conclusions 15.1.5 Steam System Piping Failure 15.1.5.1 Identification of Causes and Accident Description 15.1.5.2 Analysis of Effects and Consequences 15.1.5.3 Environmental Consequences 15.1.6 References 15.2 Decrease in Heat Removal by the Secondary System 15.2.1 Steam Pressure Regulator Malfunction or Failure That Results In Decreasing Steam Flow 15.2.2 Loss of External Load 15.2.2.1 Identification of Causes and Accident Description 15.2.2.2 Analysis of Effects and Consequences 15.2.2.3 Environmental Consequences 15.2.2.4 Conclusions 15.2.3 Turbine Trip 15.2.3.1 Identification of Causes and Accident Description 15.2.3.2 Analysis of Effects and Consequences 15.2.3.3 Environmental Consequences 15.2.3.4 Conclusions 15.2.4 Inadvertent Closure of Main Steam Isolation Valves 15.2.5 Loss of Condenser Vacuum and Other Events Causing a Turbine Trip 15.2.6 Loss of Non-Emergency AC Power to the Station Auxiliaries 15.2.6.1 Identification of Causes and Accident Description 15.2.6.2 Analysis of Effects and Consequences 15.2.6.3 Environmental Consequences 15.2.6.4 Conclusions 15.2.7 Loss of Normal Feedwater Flow 15.2.7.1 Identification of Causes and Accident Description 15.2.7.2 Analysis of Effects and Consequences (13 APR 2020) 15 - i

McGuire Nuclear Station UFSAR Chapter 15 15.2.7.3 Environmental Consequences 15.2.7.4 Conclusions 15.2.8 Feedwater System Pipe Break 15.2.8.1 Identification of Causes and Accident Description 15.2.8.2 Analysis of Effects and Consequences 15.2.8.3 Environmental Consequences 15.2.8.4 Conclusions 15.2.9 References 15.3 Decrease in Reactor Coolant System Flow Rate 15.3.1 Partial Loss of Forced Reactor Coolant Flow 15.3.1.1 Identification of Causes and Accident Description 15.3.1.2 Analysis of Effects and Consequences 15.3.1.3 Environmental Consequences 15.3.1.4 Conclusions 15.3.2 Complete Loss of Forced Reactor Coolant Flow 15.3.2.1 Identification of Causes and Accident Description 15.3.2.2 Analysis of Effects and Consequences 15.3.2.3 Environmental Consequences 15.3.2.4 Conclusions 15.3.3 Reactor Coolant Pump Shaft Seizure (Locked Rotor) 15.3.3.1 Identification of Causes and Accident Description 15.3.3.2 Analysis of Effects and Consequences 15.3.3.3 Environmental Consequences 15.3.3.4 Conclusions 15.3.4 Reactor Coolant Pump Shaft Break 15.3.4.1 Identification of Causes and Accident Description 15.3.4.2 Environmental Consequences 15.3.4.3 Conclusions 15.3.5 References 15.4 Reactivity and Power Distribution Anomalies 15.4.1 Uncontrolled Rod Cluster Control Assembly Bank Withdrawal From a Subcritical or Low Power Startup Condition 15.4.1.1 Identification of Causes and Accident Description 15.4.1.2 Analysis of Effects and Consequences 15.4.1.3 Environmental Consequences 15.4.1.4 Conclusions 15.4.2 Uncontrolled Rod Cluster Control Assembly Bank Withdrawal at Power 15.4.2.1 Identification of Causes and Accident Description 15.4.2.2 Analysis of Effects and Consequences 15.4.2.3 Environmental Consequences 15.4.2.4 Conclusions 15.4.3 Rod Cluster Control Assembly Misoperation (System Malfunction or Operator Error) 15.4.3.1 Identification of Causes and Accident Description 15.4.3.2 Analysis of Effects and Consequences 15.4.3.3 Environmental Consequences 15.4.3.4 Conclusions 15.4.4 Startup of an Inactive Reactor Coolant Pump at an Incorrect Temperature 15.4.4.1 Identification of Causes and Accident Description 15.4.4.2 Analysis of Effects and Consequences 15.4.4.3 Environmental Consequences 15.4.4.4 Conclusions 15.4.5 A Malfunction or Failure of the Flow Controller in a BWR Loop that Results in an Increased Reactor Coolant Flow Rate (13 APR 2020) 15 - ii

McGuire Nuclear Station UFSAR Chapter 15 15.4.6 Chemical and Volume Control System Malfunction that Results in a Decrease in Boron Concentration in the Reactor Coolant 15.4.6.1 Identification of Causes and Accident Description 15.4.6.2 Analysis of Effects and Consequences 15.4.6.3 Environmental Consequences 15.4.6.4 Conclusions 15.4.7 Inadvertent Loading and Operation of a Fuel Assembly in an Improper Position 15.4.7.1 Identification of Causes and Accident Description 15.4.7.2 Analysis of Effects and Consequences 15.4.7.3 Environmental Consequences 15.4.7.4 Conclusions 15.4.8 Spectrum of Rod Cluster Control Assembly Ejection Accidents 15.4.8.1 Identification of Causes and Accident Description 15.4.8.1.1 Design Precautions and Protection 15.4.8.1.2 Limiting Criteria 15.4.8.2 Analysis of Effects and Consequences 15.4.8.2.1 Stages of Analysis 15.4.8.2.2 Calculation of Basic Parameters 15.4.8.3 Environmental Consequences 15.4.8.4 Conclusions 15.4.9 Spectrum of Rod Drop Accidents (BWR) 15.4.10 References 15.5 Increase in Reactor Coolant Inventory 15.5.1 Inadvertent Operation of Emergency Core Cooling System During Power Operation 15.5.1.1 Identification of Causes and Accident Description 15.5.1.2 Analysis of Effects and Consequences 15.5.1.3 Environmental Consequences 15.5.1.4 Conclusions 15.5.2 Chemical and Volume Control System Malfunction That Increases Reactor Coolant Inventory 15.5.3 A Number of BWR Transients 15.5.4 References 15.6 Decrease in Reactor Coolant Inventory 15.6.1 Inadvertent Opening of a Pressurizer Safety or Relief Valve 15.6.1.1 Identification of Causes and Accident Description 15.6.1.2 Analysis of Effects and Consequences 15.6.1.3 Environmental Consequences 15.6.1.4 Conclusions 15.6.2 Break In Instrument Line or Other Lines From Reactor Coolant Pressure Boundary That Penetrate Containment 15.6.2.1 Identification of Causes and Accident Description 15.6.2.2 Analysis of Effects and Consequences 15.6.2.3 Environmental Consequences 15.6.3 Steam Generator Tube Failure 15.6.3.1 Identification of Causes and Accident Description 15.6.3.2 Analysis of Effects and Consequences 15.6.3.3 Environmental Consequences 15.6.4 Spectrum of BWR Steam System Piping Failures Outside Containment 15.6.5 Loss-of-Coolant Accidents 15.6.5.1 Identification of Causes and Accident Description 15.6.5.2 Analysis of Effects and Consequences 15.6.5.3 Environmental Consequences 15.6.5.4 10 CFR 50.46 Reporting Summary 15.6.6 A Number of BWR Transients (13 APR 2020) 15 - iii

McGuire Nuclear Station UFSAR Chapter 15 15.6.7 References 15.7 Radioactive Release From a Subsystem or Component 15.7.1 Radioactive Gas Waste System Leak or Failure 15.7.1.1 Identification of Causes and Accident Description 15.7.1.2 Analysis of Effects and Consequences 15.7.1.3 Environmental Consequences 15.7.2 Radioactive Liquid Waste System Leak or Failure 15.7.2.1 Identification of Causes and Accident Description 15.7.2.2 Analysis of Effects and Consequences 15.7.2.3 Environmental Consequences 15.7.3 Postulated Radioactive Releases Due to Liquid Tank Failures 15.7.4 Fuel Handling Accidents in the Containment and Spent Fuel Storage Buildings 15.7.4.1 Fuel Handling Accident Inside Containment 15.7.4.1.1 Identification of Causes and Accident Description 15.7.4.1.2 Analysis of Effects and Consequences 15.7.4.1.3 Environmental Consequences 15.7.4.2 Fuel Handling Accident in the Fuel Building - Fuel Assembly Drop 15.7.4.2.1 Identification of Causes and Accident Description 15.7.4.2.2 Analysis of Effects and Consequences 15.7.4.2.3 Environmental Consequences 15.7.4.3 Fuel Handling Accident in the Fuel Building - Weir Gate Drop 15.7.4.3.1 Identification of Causes and Accident Description 15.7.4.3.2 Analysis of Effects and Consequences 15.7.4.3.3 Environmental Consequences 15.7.4.4 Spent Fuel Cask Drop into the Spend Fuel Pool 15.7.4.5 Spent Fuel Cask Drop in Fuel Building 15.7.4.5.1 Identification of Causes and Accident Description 15.7.4.5.2 Analysis of Effects and Consequences 15.7.4.5.3 Environmental Consequences 15.7.5 References 15.8 Anticipated Transients Without Scram 15.8.1 References 15.9 Formerly Chapter 15 Appendix A - Models Used for Calculation of Accident Doses 15.9.1 External Whole Body Doses 15.9.2 Internal Thyroid Doses 15.9.3 Control Room Operator Doses 15.9.3.1 Geometry Factor 15.9.3.2 Iodine Protection Factor 15.9.3.3 Control Room Occupancy Factors 15.9.3.4 Control Room Operator Dose Equations 15.9.4 References 15.10 Formerly Chapter 15 Appendix B - Supplementary Radiological Analyses 15.10.1 Tornado Missile Impact - Spent Fuel Analysis 15.10.1.1 Identification of Causes and Accident Description 15.10.2 Analysis of Effects and Consequences 15.10.3 Method of Analysis 15.10.3.1 Environmental Consequences 15.10.4 References (13 APR 2020) 15 - iv

McGuire Nuclear Station UFSAR Chapter 15 List of Tables Table 15-1. Deleted Per 1993 Update Table 15-2. Summary of Accidents Analyzed With Computer Codes Table 15-3. Summary of Computer Codes and Methodologies Used in Accident Analyses Table 15-4. Summary of Input Parameters for Accident Analyses Using Computer Codes Table 15-5. Deleted Per 1992 Update Table 15-6. Deleted Per 1992 Update Table 15-7. Rod Drop Times Used in FSAR Analyses Table 15-8. Trip Points and Time Delays to Trip Assumed in Accident Analyses Table 15-9. Deleted Per 1992 Update Table 15-10. Reactor Core Iodine and Noble Gas Source Terms Gap Release Fractions Table 15-11. Normal Reactor Coolant Specific Activities for Iodine and Noble Gas Isotopes Table 15-12. Environmental Consequences Table 15-13. Time Sequence of Events for Incidents Which Cause an Increase In Heat Removal By The Secondary System Table 15-14. Parameters for Main Steam Line Break Dose Analysis Table 15-15. Deleted per 2014 Update Table 15-16. Time Sequence Of Events For Incidents Which Cause A Decrease In Heat Removal By The Secondary System Table 15-17. Time Sequence of Events for Incidents Which Cause a Decrease in Reactor Coolant System Flow Table 15-18. Parameters for Locked Rotor Dose Analysis Table 15-19. Time Sequence of Events for Incidents which Cause Reactivity and Power Distribution Anomalies Table 15-20. Parameters Used in the Analysis of the Rod Cluster Control Assembly Ejection Accident Table 15-21. Parameters for Rod Ejection Accident Dose Analysis Table 15-22. Deleted Per 1998 Update.

Table 15-23. Time Sequence of Events For Incidents Which Cause A Decrease In Reactor Coolant Inventory (13 APR 2020) 15 - v

McGuire Nuclear Station UFSAR Chapter 15 Table 15-24. Parameters for Steam Generator Tube Rupture Dose Analysis Table 15-25. Deleted Per 1998 Update Table 15-26. Deleted Per 1998 Update Table 15-27. Deleted Per 1996 Update Table 15-28. Deleted Per 1996 Update Table 15-29. Deleted Per 1996 Update Table 15-30. Deleted Per 1996 Update Table 15-31. Deleted Per 1998 Update Table 15-32. Deleted Per 1998 Update Table 15-33. Parameters for Minimum Safeguards (Design Basis) LOCA Dose Analysis Table 15-34. Deleted Per 2009 Update Table 15-35. Source Term Inventory and Gap Fractions Assumed for Fuel Handling and Tornado Missile Accidents Table 15-36. Deleted Per 1992 Update Table 15-37. Parameters for Postulated Instrument Line Break Accident Analysis Table 15-38. Deleted Per 1998 Update.

Table 15-39. Parameters Used to Evaluate Tornado Missile Impact On Spent Fuel Table 15-40. Parameters Used to Evaluate LOCA During Lower Containment Pressure Relief Table 15-41. Deleted per 2015 Update Table 15-42. Input Parameters Used in the SBLOCA Analyses Table 15-43. Deleted Per 2001 Update Table 15-44. Deleted Per 2001 Update Table 15-45. Minimum Injected ECCS Flows Assumed in LBLOCA Analyses.

Table 15-46. Parameters for Post-LOCA Subcriticality Analysis Table 15-47. Deleted Per 1998 Update Table 15-48. Deleted Per 1998 Update Table 15-49. Small Break LOCA Results Fuel Cladding Data Table 15-50. Minimum ECCS Flow Assumed in SBLOCA Analyses (13 APR 2020) 15 - vi

McGuire Nuclear Station UFSAR Chapter 15 Table 15-51. Small Break LOCA Time Sequence of Events Table 15-52. Large Break LOCA Time Sequence of Events for Reference Transient Table 15-53. Key Large Break LOCA Parameters and Initial Transient Assumptions Table 15-54. Best-Estimate Large Break LOCA - Overall Results Table 15-55. Plant Operating Range Allowed by the Best-Estimate Large Break LOCA Analysis Table 15-56. Rod Census Used in Best-Estimate large Break LOCA Analysis Table 15-57. Deleted Per 2012 Update Table 15-58. Reactor Core Inventory and Release Fractions for LOCA Table 15-59. Assumptions Used for the Cask Drop Accident Table 15-60. Isotopic Inventory of the Dry Cask Drop Accident Table 15-61. Summary of Licensing Basis LOCA PCT Results, Including PCT Assessments Table 15-62. Dose Equivalent Iodine-131 (DEI-131)

Table 15-63. Dose Equivalent Xenon-133 (DEX-133)

Table 15-64. Deleted Per 2014 Update (13 APR 2020) 15 - vii

McGuire Nuclear Station UFSAR Chapter 15 List of Figures Figure 15-1. Illustration of Overtemperature and Overpower (T Protection Figure 15-2. Deleted Per 1998 Update.

Figure 15-3. Deleted Per 1998 Update.

Figure 15-4. Deleted Per 1998 Update.

Figure 15-5. Deleted Per 1998 Update.

Figure 15-6. Deleted Per 1998 Update.

Figure 15-7. Excessive Increase in Feedwater Flow Figure 15-8. Excessive Increase in Feedwater Flow Figure 15-9. Ten Percent Step Load Increase, Minimum Reactivity Feedback, Manual Reactor Control Figure 15-10. Ten Percent Step Load Increase, Minimum Reactivity Feedback, Manual Reactor Control Figure 15-11. Ten Percent Step Load Increase, Maximum Reactivity Feedback, Manual Reactor Control Figure 15-12. Ten Percent Step Load Increase, Maximum Reactivity Feedback, Manual Reactor Control Figure 15-13. Deleted Per 1998 Update Figure 15-14. Deleted Per 1998 Update Figure 15-15. Deleted Per 1998 Update Figure 15-16. Deleted Per 1998 Update Figure 15-17. Reactivity Versus Moderator Temperature Figure 15-18. Failure of a Steam Generator Safety or Dump Valve Figure 15-19. Failure of a Steam Generator Safety or Dump Valve Figure 15-20. Deleted Per 1998 Update.

Figure 15-21. Steamline Break, Offsite Power Maintained Figure 15-22. Steamline Break, Offsite Power Maintained Figure 15-23. Steamline Break, Offsite Power Maintained Figure 15-24. Steamline Break, Offsite Power Maintained (13 APR 2020) 15 - viii

McGuire Nuclear Station UFSAR Chapter 15 Figure 15-25. Steamline Break, Offsite Power Maintained Figure 15-26. Steamline Break, Offsite Power Maintained Figure 15-27. Turbine Trip, Maximum Secondary Pressure Case Figure 15-28. Turbine Trip, Maximum Secondary Pressure Case Figure 15-29. Turbine Trip, Maximum Secondary Pressure Case Figure 15-30. Turbine Trip, Maximum Secondary Pressure Case Figure 15-31. Turbine Trip, Maximum Secondary Pressure Case Figure 15-32. Turbine Trip, Maximum Primary Pressure Case Figure 15-33. Deleted Per 2006 Update Figure 15-34. Deleted Per 2006 Update Figure 15-35. Loss of Offsite Power Figure 15-36. Loss of Offsite Power Figure 15-37. Loss of Offsite Power Figure 15-38. Loss of Normal Feedwater Figure 15-39. Loss of Normal Feedwater Figure 15-40. Feedwater System Pipe Break, Long Term Core Cooling Analysis Figure 15-41. Feedwater System Pipe Break, Long Term Core Cooling Analysis Figure 15-42. Feedwater System Pipe Break, Long Term Core Cooling Analysis Figure 15-43. Feedwater System Pipe Break, Long Term Core Cooling Analysis Figure 15-44. Feedwater System Pipe Break, Long Term Core Cooling Analysis Figure 15-45. Feedwater System Pipe Break, Long Term Core Cooling Analysis Figure 15-46. Feedwater System Pipe Break, Long Term Core Cooling Analysis Figure 15-47. Deleted Per 1992 Update Figure 15-48. Deleted Per 1992 Update Figure 15-49. Deleted Per 1992 Update Figure 15-50. Deleted Per 1992 Update Figure 15-51. Partial Loss of Forced Reactor Coolant Flow Figure 15-52. Partial Loss of Forced Reactor Coolant Flow (13 APR 2020) 15 - ix

McGuire Nuclear Station UFSAR Chapter 15 Figure 15-53. Partial Loss of Forced Reactor Coolant Flow Figure 15-54. Partial Loss of Forced Reactor Coolant Flow Figure 15-55. Deleted per 2003 Update Figure 15-56. Complete Loss of Forced Reactor Coolant Flow Figure 15-57. Complete Loss of Forced Reactor Coolant Flow Figure 15-58. Complete Loss of Forced Reactor Coolant Flow Figure 15-59. Complete Loss of Forced Reactor Coolant Flow Figure 15-60. Complete Loss of Forced Reactor Coolant Flow Figure 15-61. Deleted per 2003 Update Figure 15-62. Locked Rotor RCS Flow (Fraction of Initial) - Offsite Power Lost Figure 15-63. Uncontrolled RCCA Bank Withdrawal at HZP Figure 15-64. Uncontrolled RCCA Bank Withdrawal at HZP Figure 15-65. Uncontrolled RCCA Bank Withdrawal at HZP Figure 15-66. Uncontrolled RCCA Bank Withdrawal at HZP Figure 15-67. Uncontrolled RCCA Bank Withdrawal at HZP Figure 15-68. Uncontrolled RCCA Bank Withdrawal at HZP Figure 15-69. Uncontrolled RCCA Bank Withdrawal from 10% Power Figure 15-70. Uncontrolled RCCA Bank Withdrawal from 10% Power Figure 15-71. Uncontrolled RCCA Bank Withdrawal from 10% Power Figure 15-72. Uncontrolled RCCA Bank Withdrawal from 10% Power Figure 15-73. Deleted per 2003 Update Figure 15-74. Deleted per 2003 Update Figure 15-75. Deleted per 2003 Update Figure 15-76. Single RCCA Withdrawal Figure 15-77. Startup of an Inactive Reactor Coolant Pump at an Incorrect Temperature Figure 15-78. Startup of an Inactive Reactor Coolant Pump at an Incorrect Temperature Figure 15-79. Startup of an Inactive Reactor Coolant Pump at an Incorrect Temperature Figure 15-80. Startup of an Inactive Reactor Coolant Pump at an Incorrect Temperature (13 APR 2020) 15 - x

McGuire Nuclear Station UFSAR Chapter 15 Figure 15-81. Startup of an Inactive Reactor Coolant Pump at an Incorrect Temperature Figure 15-82. Interchange Between Region 1 and Region 3 Assembly Figure 15-83. Interchange Between Region 1 and Region 2 Assembly, Burnable Poison Rods Being Retained by the Region 2 Assembly Figure 15-84. Interchange Between Region 1 and Region 2 Assembly, Burnable Poison Rods Being Transferred to the Region 1 Assembly Figure 15-85. Enrichment Error: A Region 2 Assembly Loaded into the Core Central Position Figure 15-86. Loading a Region 2 Assembly into a Region 1 Position Near Core Periphery Figure 15-87. Single RCCA Withdrawal Figure 15-88. Single RCCA Withdrawal Figure 15-89. Single RCCA Withdrawal Figure 15-90. Dropped Rod Accident Figure 15-91. Deleted Per 1998 Update Figure 15-92. Deleted Per 1998 Update Figure 15-93. Deleted Per 1998 Update.

Figure 15-94. Inadvertent Opening of a Pressurizer Safety Valve Figure 15-95. Inadvertent Opening of a Pressurizer Safety Valve Figure 15-96. Deleted Per 1998 Update Figure 15-97. Deleted Per 2001 Update Figure 15-98. Deleted Per 1996 Update Figure 15-99. Deleted Per 1998 Update Figure 15-100. Deleted Per 1996 Update Figure 15-101. Deleted Per 1996 Update Figure 15-102. Deleted Per 1996 Update Figure 15-103. Deleted Per 1996 Update Figure 15-104. Deleted Per 1996 Update Figure 15-105. Deleted Per 1996 Update Figure 15-106. Deleted Per 1996 Update Figure 15-107. Deleted Per 1996 Update (13 APR 2020) 15 - xi

McGuire Nuclear Station UFSAR Chapter 15 Figure 15-108. Deleted Per 1996 Update Figure 15-109. Deleted Per 1996 Update Figure 15-110. Deleted Per 1996 Update Figure 15-111. Deleted Per 1996 Update Figure 15-112. Deleted Per 1996 Update Figure 15-113. Deleted Per 1996 Update Figure 15-114. Deleted Per 1996 Update Figure 15-115. Deleted Per 1996 Update Figure 15-116. Deleted Per 1996 Update Figure 15-117. Deleted Per 1996 Update Figure 15-118. Deleted Per 1996 Update Figure 15-119. Deleted Per 1996 Update Figure 15-120. Deleted Per 1996 Update Figure 15-121. Deleted Per 1996 Update Figure 15-122. Deleted Per 1996 Update Figure 15-123. Deleted Per 1996 Update Figure 15-124. Deleted Per 1996 Update Figure 15-125. Deleted Per 1996 Update Figure 15-126. Deleted Per 1996 Update Figure 15-127. Deleted Per 1996 Update Figure 15-128. Deleted Per 1996 Update Figure 15-128. Deleted Per 1996 Update Figure 15-130. Deleted Per 1996 Update Figure 15-131. Deleted Per 1996 Update Figure 15-132. Deleted Per 1996 Update Figure 15-133. Deleted Per 2001 Update Figure 15-134. Deleted Per 1998 Update Figure 15-135. Deleted Per 1996 Update (13 APR 2020) 15 - xii

McGuire Nuclear Station UFSAR Chapter 15 Figure 15-136. Deleted Per 1996 Update.

Figure 15-137. Small Break Power Distribution Assumed for LOCA Analysis Figure 15-138. Deleted Per 1998 Update Figure 15-139. Deleted Per 2001 Update Figure 15-140. Deleted Per 1998 Update Figure 15-141. Deleted Per 1998 Update Figure 15-142. Deleted Per 1998 Update Figure 15-143. Deleted Per 1998 Update Figure 15-144. Deleted Per 1998 Update Figure 15-145. Deleted Per 1998 Update Figure 15-146. Deleted Per 1998 Update Figure 15-147. Deleted Per 1998 Update Figure 15-148. Deleted Per 1998 Update Figure 15-149. Deleted Per 1998 Update Figure 15-150. Deleted Per 1998 Update Figure 15-151. Deleted Per 1998 Update Figure 15-152. Deleted Per 1994 Update Figure 15-153. Deleted Per 1994 Update Figure 15-154. RCCA Position Versus Time to Dashpot Figure 15-155. Normalized Rod Worth Versus Percent Inserted Figure 15-156. Normalized RCCA Bank Reactivity Worth Versus Normalized Drop Time Figure 15-157. Steamline Break Offsite Power Maintained Figure 15-158. Steamline Break Offsite Power Maintained Figure 15-159. Steamline Break Offsite Power Maintained Figure 15-160. Steamline Break Offsite Power Maintained Figure 15-161. Steamline Break Offsite Power Maintained Figure 15-162. Steamline Break Offsite Power Lost Figure 15-163. Steamline Break Offsite Power Lost (13 APR 2020) 15 - xiii

McGuire Nuclear Station UFSAR Chapter 15 Figure 15-164. Steamline Break Offsite Power Lost Figure 15-165. Steamline Break Offsite Power Lost Figure 15-166. Steamline Break Offsite Power Lost Figure 15-167. Steamline Break Offsite Power Lost Figure 15-168. Steamline Break Offsite Power Lost Figure 15-169. Steamline Break Offsite Power Lost Figure 15-170. Steamline Break Offsite Power Lost Figure 15-171. Steamline Break Offsite Power Lost Figure 15-172. Steamline Break Offsite Power Lost Figure 15-173. Deleted Per 1998 Update Figure 15-174. Locked Rotor Neutron Power (Fraction of Initial) - Offsite Power Lost Figure 15-175. Locked Rotor Core Average Heat Flux (Fraction of Nominal) - Offsite Power Lost Figure 15-176. Locked Rotor Loop Average Temperature (Deg F) - Offsite Power Lost Figure 15-177. Locked Rotor Pressurizer Pressure (psig) - Offsite Power Lost Figure 15-178. Locked Rotor RCS Flow (Fraction of Initial) - Offsite Power Maintained Figure 15-179. Deleted Per 1998 Update.

Figure 15-180. Dropped Rod Accident Figure 15-181. Dropped Rod Accident Figure 15-182. Dropped Rod Accident Figure 15-183. Dropped Rod Accident Figure 15-184. Rod Ejection Accident (BOC,HFP)

Figure 15-185. Rod Ejection Accident (EOC,HZP)

Figure 15-186. Uncontrolled RCCA Bank Withdrawal at HZP Max. RCS Pressure Figure 15-187. Uncontrolled RCCA Bank Withdrawal from 8% Power Figure 15-188. Deleted Per 2001 Update Figure 15-189. Deleted Per 1998 Update Figure 15-190. Deleted Per 1998 Update Figure 15-191. Deleted Per 1998 Update (13 APR 2020) 15 - xiv

McGuire Nuclear Station UFSAR Chapter 15 Figure 15-192. Deleted Per 2001 Update Figure 15-193. Deleted Per 2001 Update Figure 15-194. Deleted Per 2001 Update Figure 15-195. Deleted Per 2001 Update Figure 15-196. Deleted Per 2001 Update Figure 15-197. Deleted Per 2001 Update Figure 15-198. Deleted Per 2001 Update Figure 15-199. Deleted Per 1998 Update Figure 15-200. Deleted Per 1998 Update Figure 15-201. Deleted Per 1998 Update Figure 15-202. Deleted Per 2001 Update Figure 15-203. Deleted Per 2001 Update Figure 15-204. Deleted Per 2001 Update Figure 15-205. Deleted Per 1996 Update Figure 15-206. Deleted Per 1996 Update Figure 15-207. Excessive Increase in Feedwater Flow Figure 15-208. Excessive Increase in Feedwater Flow Figure 15-209. Excessive Increase in Feedwater Flow Figure 15-210. Deleted per 2003 Update Figure 15-211. Excessive Increase in Feedwater Flow (RFA Fuel)

Figure 15-212. Loss of Offsite Power Figure 15-213. Loss of Offsite Power Figure 15-214. Deleted Per 2001 Update Figure 15-215. Deleted Per 2001 Update Figure 15-216. Deleted Per 2001 Update Figure 15-217. Deleted Per 2001 Update Figure 15-218. Deleted Per 2001 Update Figure 15-219. Deleted Per 2001 Update (13 APR 2020) 15 - xv

McGuire Nuclear Station UFSAR Chapter 15 Figure 15-220. Deleted Per 2001 Update Figure 15-221. Deleted Per 2001 Update Figure 15-222. Deleted Per 2001 Update Figure 15-223. Deleted Per 2001 Update Figure 15-224. Deleted Per 2001 Update Figure 15-225. Deleted Per 2001 Update Figure 15-226. Steam Generator Tube Rupture Figure 15-227. Steam Generator Tube Rupture Figure 15-228. Steam Generator Tube Rupture Figure 15-229. Steam Generator Tube Rupture Figure 15-230. Steam Generator Tube Rupture Figure 15-231. Steam Generator Tube Rupture Figure 15-232. Steam Generator Tube Rupture Figure 15-233. Lower Bound Containment Pressure Used for Best-Estimate Large Break LOCA Figure 15-234 LBLOCA Peak Cladding Temperature (Reference Transient)

Figure 15-235. LBLOCA Liquid Mass Flowrate at Inlet to Hot Assembly Figure 15-236. LBLOCA Vapor Mass Flowrate at Blowdown PCT Location Figure 15-237. LBLOCA Entrained Liquid Mass Flowrate at Blowdown PCT Location Figure 15-238. LBLOCA Accumulator Discharge Flowrate Figure 15-239. LBLOCA Pumped Safety Injection Figure 15-240. LBLOCA Collapsed Liquid Level in the Lower Plenum Figure 15-241. LBLOCA Collapsed Liquid Level in Hot Assembly Figure 15-242. LBLOCA Collapsed Liquid Level in Downcomer Figure 15-243. Duke Energy Best-Estimate LBLOCA Duke Energy Best-Estimate LBLOCA Figure 15-244. LBLOCA Axial Power Distribution for Reference Transient Duke Energy Best Estimate LOCA Analysis Power Shape 10 Figure 15-245. McGuire Units 1 and 2 2-Inch Pressurizer Pressure Figure 15-246. McGuire Units 1 and 2 2-Inch Core Mixture Level (13 APR 2020) 15 - xvi

McGuire Nuclear Station UFSAR Chapter 15 Figure 15-247. McGuire Units 1 and 2 2-Inch Core Exit Vapor Temperature Figure 15-248. McGuire Units 1 and 2 2-Inch Break Vapor Flow and Upper Head Spray Nozzle Vapor Flow Figure 15-249. McGuire Units 1 and 2 2-Inch Break Liquid Flow and Total Safety Injection Flow Figure 15-250. McGuire Units 1 and 2 2-Inch Peak Clad Temperature and Maximum Transient Oxidation Figure 15-251. McGuire Units 1 and 2 2-Inch RCS Mass Figure 15-252. McGuire Units 1 and 2 3-Inch Pressurizer Pressure Figure 15-253. McGuire Units 1 and 2 3-Inch Core Mixture Level Figure 15-254. McGuire Units 1 and 2 3-Inch Peak Clad Temperature and Maximum Transient Oxidation Figure 15-255. McGuire Units 1 and 2 4-Inch Pressurizer Pressure Figure 15-256. McGuire Units 1 and 2 4-Inch Core Mixture Level Figure 15-257. McGuire Units 1 and 2 4-Inch Peak Clad Temperature and Maximum Transient Oxidation Figure 15-258. McGuire Units 1 and 2 1-1/2-Inch Pressurizer Pressure Figure 15-259. McGuire Units 1 and 2 1-1/2-Inch Core Mixture Level Figure 15-260. Deleted Per 2008 Update Figure 15-261. Loss of Normal Feedwater - Short Term Core Cooling Figure 15-262. Loss of Normal Feedwater - Short Term Core Cooling Figure 15-263. Loss of Normal Feedwater - Short Term Core Cooling Figure 15-264. Loss of Normal Feedwater - Short Term Core Cooling Figure 15-265. Loss of Normal Feedwater - Short Term Core Cooling Figure 15-266. Loss of Normal Feedwater - Short Term Core Cooling Figure 15-267. Deleted Per 2011 Update Figure 15-268. Loss of Normal Feedwater - Short Term Core Cooling Figure 15-269. Partial Loss of Forced Reactor Coolant Flow Figure 15-270. Complete Loss of Forced Reactor Coolant Flow Figure 15-271. Locked Rotor Neutron Power (% of Nominal) - Offsite Power Maintained (13 APR 2020) 15 - xvii

McGuire Nuclear Station UFSAR Chapter 15 Figure 15-272. Locked Rotor Core Average Heat Flux (Fraction of Nominal) - Offsite Power Maintained Figure 15-273. Locked Rotor Loop Average Temperature (Deg F) - Offsite Power Maintained Figure 15-274. Locked Rotor Pressurizer Pressure (psig) - Offsite Power Maintained Figure 15-275. Locked Rotor RCS Pressure - Peak RCS Pressure Figure 15-276. Deleted Per 2005 Update Figure 15-277. Deleted per 2003 Update Figure 15-278. Uncontrolled RCCA Bank Withdrawal from 10% Power Figure 15-279. Uncontrolled RCCA Bank Withdrawal from 50% Power Figure 15-280. Uncontrolled RCCA Bank Withdrawal from 100% Power Figure 15-281. Uncontrolled RCCA Bank Withdrawal from 98% Power Figure 15-282. Steamline Break at Power Figure 15-283. Steamline Break at Power Figure 15-284. Steamline Break at Power Figure 15-285. Steamline Break at Power Figure 15-286. Steamline Break at Power Figure 15-287. Steamline Break at Power Figure 15-288. Steamline Break at Power Figure 15-289. Steamline Break at Power Figure 15-290. Steamline Break at Power Figure 15-291. Steamline Break at Power (13 APR 2020) 15 - xviii

McGuire Nuclear Station UFSAR Chapter 15 15.0 Accident Analysis This chapter addresses the representative initiating events listed on pages 15-10, 15-11, and 15-12 of Regulatory Guide 1.70, Revision 3, as they apply to the McGuire Nuclear Station.

Certain items in the guide warrant comment, as follows:

Items 1.3 and 2.1 - There are no pressure regulators in the Nuclear Steam Supply System (NSSS) pressurized water reactor (PWR) design whose malfunction or failure could cause a steam flow transient.

Classification of Plant Conditions Since 1970, the American Nuclear Society (ANS) classification of plant conditions has been used which divides plant conditions into four categories in accordance with anticipated frequency of occurrence and potential radiological consequences to the public. The four categories are as follows:

1. Condition I: Normal Operation and Operational Transients.

2. Condition II: Faults of Moderate Frequency.

3. Condition III: Infrequent Faults.

4. Condition IV: Limiting Faults.

The basic principle applied in relating design requirements to each of the conditions is that the most probable occurrences should yield the least radiological risk to the public and those extreme situations having the potential for the greatest risk to the public shall be those least likely to occur. Where applicable, Reactor Trip System and Engineered Safeguards functioning is assumed, to the extent allowed by considerations such as the single failure criterion, in fulfilling this principle.

Condition I - Normal Operation and Operational Transients Condition I occurrences are those which are expected frequently or regularly in the course of power operation, refueling, maintenance, or maneuvering of the plant. As such, Condition I occurrences are accommodated with margin between any plant parameter and the value of that parameter which would require either automatic or manual protective action. Inasmuch as Condition I occurrences occur frequently or regularly, they must be considered from the point of view of affecting the consequences of fault conditions (Conditions II, III and IV). In this regard, analysis of each fault condition described is generally based on a conservative set of initial conditions corresponding to adverse conditions which can occur during Condition I operation.

A typical list of Condition I events is listed below:

1. Steady state and shutdown operations

a. Power operation ( > 5 to 100 percent of rated thermal power)

b. Startup (Keff 0.99 to 5 percent of rated thermal power)

c. Hot standby (subcritical, temperature above the permissive for placing the Residual Heat Removal System in service)

d. Hot shutdown (subcritical, temperature between 200°F and 350°F)

e. Cold shutdown (subcritical, temperature 200°F)

f. Refueling

2. Operation with permissible deviations (13 APR 2020) 15.0 - 1

UFSAR Chapter 15 McGuire Nuclear Station Various deviations which may occur during continued operation as permitted by the plant Technical Specifications must be considered in conjunction with other operational modes. These include:

a. Operation with components or systems out of service

b. Radioactivity in the reactor coolant, due to leakage from fuel with clad defects

1) Fission products

2) Corrosion products

3) Tritium

c. Operation with steam generator leaks up to the maximum allowed by the Technical Specifications

d. Testing as allowed by Technical Specifications

3. Operational transients

a. Plant heatup and cooldown (up to 100°F/hour for the Reactor Coolant System during cooldown and 60°F/hr for the Reactor Coolant System during heatup; 200°F/hour for the pressurizer during cooldown and 100°F/ hour for the pressurizer during heatup)

b. Step load changes (up to +/-10 percent)

c. Ramp load changes (up to +/-5 percent/minute)

d. Load rejection up to and including design full load rejection transient Condition II - Faults of Moderate Frequency These faults, at worst, result in the reactor trip with the plant being capable of returning to operation. By definition, these faults (or events) do not propagate to cause a more serious fault, i.e., Condition III or IV events. In addition, Condition II events are not expected to result in fuel rod failures or Reactor Coolant System or secondary system overpressurization. For the purposes of this report, the following faults are included in this category:

1. Feedwater system malfunctions that result in a decrease in feedwater temperature (Section 15.1.1).

2. Feedwater system malfunctions that result in an increase in feedwater flow (Section 15.1.2).

3. Excessive increase in secondary steam flow (Section 15.1.3).

4. Inadvertent opening of a steam generator relief or safety valve (Section 15.1.4).

5. Loss of external electrical load (Section 15.2.2).

6. Turbine trip (Section 15.2.3).

7. Inadvertent closure of main steam isolation valves (Section 15.2.4).

8. Loss of condenser vacuum and other events resulting in turbine trip (Section 15.2.5).

9. Loss of nonemergency AC power to the station auxiliaries (Section 15.2.6)

10. Loss of normal feedwater flow (Section 15.2.7).

11. Partial loss of forced reactor coolant flow (Section 15.3.1).

12. Deleted

13. Uncontrolled rod cluster control assembly bank withdrawal from a subcritical or low power startup condition (Section 15.4.1).

14. Uncontrolled rod cluster control assembly bank withdrawal at power (Section 15.4.2).

15.0 - 2 (13 APR 2020)

McGuire Nuclear Station UFSAR Chapter 15

15. Rod cluster control assembly misalignment (dropped full length assembly, dropped full length assembly bank, or statically misaligned full length assembly) (Section 15.4.3).

16. Startup of an inactive reactor coolant pump at an incorrect temperature (Section 15.4.4).

17. Chemical and Volume Control System malfunction that results in a decrease in the boron concentration in the reactor coolant (Section 15.4.6).

18. Inadvertent operation of the Emergency Core Cooling System during power operation (Section 15.5.1).

19. Chemical and Volume Control System malfunction that increases reactor coolant inventory (Section 15.5.2).

20. Inadvertent opening of a pressurizer safety or relief valve (Section 15.6.1).

21. Break in instrument line or other lines from reactor coolant pressure boundary that penetrate containment (Section 15.6.2).

Condition III - Infrequent Faults By definition Condition III occurrences are faults which may occur very infrequently during the life of the plant. They will be accommodated with the failure of only a small fraction of the fuel rods although sufficient fuel damage might occur to preclude resumption of the operation for a considerable outage time. The release of radioactivity will not be sufficient to interrupt or restrict public use of those areas beyond the exclusion radius. A Condition III fault will not, by itself, generate a Condition IV fault or result in a consequential loss of function of the Reactor Coolant System or Containment barriers. For the purposes of this report the following faults are included in this category:

1. Steam system piping failure (minor) (Section 15.1.5).

2. Feedwater system pipe break (minor) Section 15.2.8

3. Complete loss of forced reactor coolant flow (Section 15.3.2).

4. Rod cluster control assembly misoperation (single rod cluster control assembly withdrawal at full power) (Section 15.4.3).

5. Inadvertent loading and operation of a fuel assembly in an improper position (Section 15.4.7).

6. Loss of coolant accidents resulting from a spectrum of postulated piping breaks within the reactor coolant pressure boundary (small break) (Section 15.6.5).

7. Radioactive gas waste system leak or failure (Section 15.7.1).

8. Radioactive liquid waste system leak or failure (Section 15.7.2).

9. Postulated radioactive releases due to liquid tank failures (Section 15.7.3).

10. Spent fuel cask drop accidents (Section 15.7.4).

Condition IV - Limiting Faults Condition IV occurrences are faults which are not expected to take place, but are postulated because their consequences would include the potential for the release of significant amounts of radioactive material.

They are the most drastic which must be designed against and represent limiting design cases. Condition IV faults are not to cause a fission product release to the environment resulting in an undue risk to public health and safety in excess of guideline values of 10CFR 100. A single Condition IV fault is not to cause a consequential loss of required functions of systems needed to cope with the fault including those of the (13 APR 2020) 15.0 - 3

UFSAR Chapter 15 McGuire Nuclear Station Emergency Core Cooling System and the Containment. For the purposes of this report, the following faults have been classified in this category:

1. Steam system piping failure (major) (Section 15.1.5).

2. Feedwater system pipe break (major) (Section 15.2.8).

3. Reactor coolant pump shaft seizure (locked rotor) (Section 15.3.3).

4. Reactor coolant pump shaft break (Section 15.3.4).

5. Spectrum of rod cluster control assembly ejection accidents (Section 15.4.8).

6. Steam generator tube failure (Section 15.6.3).

7. Loss of coolant accidents resulting from the spectrum of postulated piping breaks within the reactor coolant pressure boundary (large break) (Section 15.6.5).

8. Design basis fuel handling accidents (Section 15.7.4).

Optimization of Control Systems A control system setpoint study (Reference 17) is performed in order to simulate performance of the reactor control and protection systems. In this study, emphasis is placed on the development of a control system which will automatically maintain prescribed conditions in the plant even under a conservative set of reactivity parameters with respect to both system stability and transient performance.

For each mode of plant operation, a group of optimum controller setpoints is determined. In areas where the resultant setpoints are different, compromises based on the optimum overall performance are made and verified. A consistent set of control system parameters is derived satisfying plant operational requirements throughout the core life and for various levels of power operation.

The study comprises an analysis of the following control systems: rod control, steam dump, steam generator level, feedwater pump speed, pressurizer pressure, pressurizer level, control rod insertion limits, rod stops and turbine runbacks.

Initial Conditions and Power Distributions Assumed in the Accident Analyses Initial Conditions For most accidents which are DNB limited, nominal values of initial conditions are assumed. The allowances on power, temperature, and pressure are determined on a statistical basis and are included in the limit DNBR, as described in Reference 7. These procedures are discussed more fully in Section 4.4.

For accidents which are not DNB limited, or for which the Statistical Core Design Methodology is not employed, the initial conditions are obtained by adding the maximum steady state errors to rated values.

The following conservative steady state errors were typically assumed in the analysis:

1. Core power +/-2 percent allowance for calorimetric error

2. Average Reactor Coolant System temperature +/-4°F allowance for controller deadband and measurement error

3. Pressurizer pressure +60, -42 pounds per square inch (psi) allowance for steady state fluctuations, measurement error, and pressure increases during boron mixing

4. Reactor Coolant Loop Flow -2.2% allowance for measurement error 15.0 - 4 (13 APR 2020)

McGuire Nuclear Station UFSAR Chapter 15 The control band allowances for pressurizer pressure includes the effect of the observed thermal non-repeatability when ITT-Barton class 1E transmitters are used at McGuire.

Table 15-3 summarizes the computer codes used in the accident analyses and shows which accidents employed a statistical DNB analysis.

Table 15-4 summarizes input parameters and initial conditions used in the accident analyses.

Measurement Uncertainty Recapture (MUR) Power Uprate Both McGuire Nuclear Station units received NRC approval to uprate the licensed core power from 3411 MWt to 3469 MWt for a total uprate of 1.7% (ML13073A041, dated May 16, 2013). All of the transients and accidents described in UFSAR Chapter 15 are valid for the MUR power uprate.

Many of the analyses were performed for 3479 MWt, which corresponds to a rated thermal power of 3411 MWt plus a 2% allowance for heat balance error. After the MUR power uprate, rated thermal power of 3469 MWt plus a 0.3% allowance for heat balance error, is still 3479 MWt. Consequently, the previous analyses remain applicable. Many references to power level in the text have been converted to MWt rather than percent power, to avoid confusion about original rated power and post MUR rated power.

Where percent power remains, it refers to percent of 3411 MWt, unless otherwise explained in the text.

Power Distribution The transient response of the reactor system is dependent on the initial power distribution. The nuclear design of the reactor core minimizes adverse power distributions through operating instructions and the placement of control rods. Power distribution may be characterized by the radial peaking factor (FH) and the total peaking factor (FQ). The peaking factor limits are given in the Core Operating Limits Report.

For transients which may be DNB limited, the radial peaking factor is of importance. The radial peaking factor increases with decreasing power level due to rod insertion. This increase in FH is included in the core limits illustrated in Figure 15-1. All transients that may be DNB limited are assumed to begin with a FH consistent with the limit defined in the Core Operating Limits Report with the exception of those transients that involve changes in the core power distribution. For these events, cycle-specific core power distributions at the statepoint conditions are analyzed to ensure that the DNB design basis is met for each reload core.

The axial power shapes used in the DNB calculation are discussed in Section 4.4. The radial and axial power distributions described above are input to a detailed thermal-hydraulics code as described in Section 4.4.

For transients which may be overpower limited, the total peaking factor (FQ) is of importance. All transients that may be overpower limited are assumed to begin with plant conditions, including power distributions, which are consistent with reactor operation as defined in the Technical Specifications.

Some overpower transients are slow with respect to the fuel rod thermal time constant, for example, the Chemical and Volume Control System malfunction that results in a decrease in the boron concentration in the reactor coolant incident, which lasts many minutes, and the excessive increase in secondary steam flow incident, which may reach equilibrium without causing a reactor trip. For these transients the fuel rod thermal evaluations are performed as discussed in Section 4.4. Other overpower transients are fast with respect to the fuel rod thermal time constant, for example, the rod cluster control assembly ejection incident, which result in a large power rise over a few seconds. For these transients a detailed fuel heat transfer calculation must be performed.

(13 APR 2020) 15.0 - 5

UFSAR Chapter 15 McGuire Nuclear Station Reactivity Coefficients Assumed in the Accident Analyses The transient response of the reactor system is dependent on reactivity feedback effects, in particular the moderator temperature coefficient and the fuel temperature coefficient. These reactivity coefficients and their values are discussed in detail in Chapter 4.

In the analysis of certain events, conservatism requires the use of large reactivity coefficient values, whereas in the analysis of other events, conservatism requires the use of small reactivity coefficient values. Some events, such as the loss of reactor coolant from steam generator tube ruptures, do not depend on reactivity feedback effects. The values assumed for these coefficients are given in Table 15-4.

The justification for the use of conservatively large versus small reactivity coefficient values is treated on an event-by-event basis. In some cases conservative combinations of parameters are used to bound the effects of core life, although these combinations may not represent possible realistic situations.

Rod Cluster Control Assembly Insertion Characteristics The negative reactivity insertion following a reactor trip is a function of the position versus time characteristic of the rod cluster control assemblies and of the variation in rod worth as a function of rod position. With respect to accident analyses, the critical parameter is the time of insertion up to the dashpot entry, approximately 85 percent of the rod cluster travel. The rod cluster control assembly position versus time characteristic assumed in the accident analyses is shown in Figure 15-154. The rod cluster control assembly insertion time is referenced to dashpot entry. To ensure a conservatively modeled position versus time, the normalized RCCA position versus normalized drop time curve is shifted to the right by 0.1 normalized time units. Thus, rod insertion begins at 0.1 normalized time units, dashpot entry begins at 1.1 normalized time units, and rod insertion is complete at 1.5 normalized time units. The conservatism of this shifting is demonstrated by the following example. If the assumed drop time to dashpot entry is 2.2 seconds, the modeled time to dashpot entry is 2.2 sec x 1.1 = 2.42 seconds, and the modeled time to complete insertion is 2.2 sec x 1.5 = 3.3 seconds. Table 15-7 gives the drop times assumed for each FSAR analysis.

Figure 15-155 show the fraction of total negative reactivity insertion versus normalized rod position for a core where the axial distribution is skewed to the lower region of the core. An axial distribution which is skewed to the lower region of the core can arise from an unbalanced xenon distribution. This curve is used to compute the negative reactivity insertion versus time following a reactor trip, which is input to all point kinetics core models used in transient analyses. The bottom skewed power distribution itself is not input into the point kinetics core model.

There is inherent conservatism in the use of Figure 15-155 in that they are based on a skewed flux distribution which would exist relatively infrequently. For cases other than those associated with unbalanced xenon distributions, significant negative reactivity would have been inserted due to the more favorable axial distribution existing prior to trip.

The normalized rod cluster control assembly negative reactivity insertion versus shifted normalized rod drop time is shown in Figure 15-156. The curves shown in these figures were obtained from Figure 15-154 and Figure 15-155. A maximum negative reactivity insertion of 4 percent k/k following a trip from full power is assumed in the transient analyses except where specifically noted otherwise. This assumption is conservative with respect to the calculated trip reactivity worth available as shown in Table 4-6. For Figure 15-154 and Figure 15-156, the rod cluster control assembly drop time is normalized to the value used in the analyses, and shifted right 0.1 units.

The normalized rod cluster control assembly negative reactivity insertion versus shifted normalized rod drop time curve (Figure 15-156) for an axial power distribution skewed to the bottom is used in those transient analyses for which a point kinetics core model is used.

15.0 - 6 (13 APR 2020)

McGuire Nuclear Station UFSAR Chapter 15 Transients analyzed with RETRAN-02 employ the RCCA insertion curves illustrated in Figure 15-154, Figure 15-155 and Figure 15-156.

Where special analyses require use of three dimensional core models, the negative reactivity insertion of the control rods is adjusted to match Figure 15-155.

Trip Points and Time Delays to Trip Assumed in Accident Analyses A reactor trip signal acts to open two trip breakers connected in series feeding power to the control rod drive mechanisms. The loss of power to the mechanism coils causes the mechanisms to release the rod cluster control assemblies which then fall by gravity into the core. There are various instrumentation delays associated with each trip function, including delays in signal actuation, in opening the trip breakers, and in the release of the rods by the mechanisms. The total delay to trip is defined as the time delay from the time that trip conditions are reached to the time the rods are free and begin to fall. Limiting trip setpoints assumed in accident analyses and the time delay assumed for each trip function are given in Table 15-8. Reference is made in that table to the overtemperature and overpower T trips shown in Figure 15-1.

This figure (Figure 15-1) presents the allowable Reactor Coolant loop average temperature and T for the design flow and power distribution as a function of primary coolant pressure. The boundaries of operation defined by the overpower T trip and the overtemperature T trip are represented as protection lines on this diagram. The protection lines are drawn to include all adverse instrumentation and setpoint errors so that under nominal conditions trip would occur well within the area bounded by these lines. The utility of this diagram is in the fact that the limit imposed by any given DNBR can be represented as a line. The DNB lines represent the locus of conditions for which the DNBR equals the limit value. All points below and to the left of a DNB line for a given pressure have a DNBR greater than the limit value. The diagram shows that DNB is prevented for all cases if the area enclosed with the maximum protection lines is not traversed by the applicable DNBR line at any point.

The area of permissible operation (power, pressure and temperature) is bounded by the combination of reactor trips: high neutron flux (fixed setpoint), high pressure (fixed setpoint), low pressure (fixed setpoint), overpower and overtemperature T (variable setpoints).

The limit value, which was used as the DNBR limit for all accidents analyzed with statistical design methods (see Table 15-3), is conservative compared to the actual design DNBR value required to meet the DNB design basis.

The difference between the limiting trip point assumed for the analysis and the nominal trip point represents an allowance for instrumentation channel error and setpoint error. Nominal trip setpoints are specified in the plant Technical Specifications or Core Operating Limits Reports. During plant startup tests, it was demonstrated that actual instrument time delays are equal to or less than the assumed values.

Additionally, protection system channels are calibrated and instrument response times are determined periodically in accordance with the Technical Specifications.

Environmental Consequences A summary of the offsite doses is presented in Table 15-12 with the dose limits given parenthetically. A description of each accident analysis is given in the appropriate section.

Operability of Non-Safety Grade Equipment In general, the transient analyses presented in this chapter only assume non-safety grade systems and equipment are operable in the following situations:

(13 APR 2020) 15.0 - 7

UFSAR Chapter 15 McGuire Nuclear Station

1. When operation of the system will cause the transient to be more severe. If there is doubt about the system's effect, the transient is analyzed and presented with and without the system available.

2. When a loss of a non-safety grade system initiates a transient by itself, it is not superimposed upon other transients unless there is a credible reason that one would cause the other.

The following non-safety grade systems and equipment are assumed operable in some analyses presented in this chapter.

1. Automatic rod control.

2. Pressurizer pressure control (power operated relief valves, heaters and spray).

3. Main Feedwater System.

DNB limited transients are analyzed assuming that pressurizer pressure control is available to maintain pressure low since this is conservative. DNB transients which might cause RCS pressurization are also evaluated with pressurizer pressure control unavailable.

Since a late reactor trip generally reduces the margin to the acceptance criteria in any transient, the effect of operable pressurizer pressure control in delaying reactor trip is considered for those transients where it would occur.

Loss of main feedwater flow is a Condition II occurrence by itself and is analyzed in Section 15.2.7.

There is no credible reason for any of the Condition II events listed above to cause a loss of feedwater flow. Therefore, a loss of feedwater is not considered coincidentally with those occurrences listed above which are Condition II.

The exceptions to this analysis philosophy are:

1. Rod Control System: Credit is taken for the withdrawal of control rods at a maximum speed of 45 in/min with normal overlap. Control rod bank and control rod assembly withdrawal events assume control rods are at the control rod insertion limits. The rod insertion limit alarm will alert the operator if the required core reactivity shutdown margin is not available due to excessive control rod insertion, e.g. in a boron dilution event during Mode 1 operation.

2. Main feedwater control and bypass control valves: Closure is assumed to provide redundancy in case either the upper or lower nozzle isolation valve fails.

3. Source range high-flux-at-shutdown alarm: This alarm alerts the operators to the possibility of a boron dilution event during Modes 3-6 operation.

4. Turbine stop valve and actuation circuitry: Various transients credit this valve as closing to prevent overcooling after a reactor trip.

5. Electrical bus undervoltage/underfrequency: Safety system performance of pumps assumes minimum or maximum performance of pumps based on voltage or frequency. Voltage or frequency regulation is therefore assumed.

6. Manual reactor coolant pump: manually trip the reactor coolant pumps on an indicated loss of subcooling in the reactor coolant system.

7. Main feedwater overspeed trip: The increase in main feedwater flow transient credits the main feedwater overspeed trip by limiting the step increase in feedwater flow to a flow which is just below the trip setpoint.

15.0 - 8 (13 APR 2020)

McGuire Nuclear Station UFSAR Chapter 15 Fission Product Inventories Inventory in the Core Core isotopic inventories are constructed from fuel assembly isotopic predictions. Fuel assembly isotopics are determined by the use of depletion codes. These codes use relevant scenario dependent parameters such as power level, burnup, peaking and fuel assembly construction parameters to model the fuel burnup and the isotopic production. Post discharge decay can also be modeled where desired. The core isotopic inventory can then be constructed by combining the activity of the isotopes of interest from the component fuel assembly isotopic predictions to mimic the core composition reflected in the scenario model.

Inventory in the Fuel Pellet Clad Gap The radiation sources associated with non-LOCA, DNB accidents which are predicted to cause clad failure are based on the assumption that the fission products in the gap between the fuel pellets and the cladding of the damaged fuel rods are released as a result of cladding failure.

The core inventories and associated gap release fractions for accidents with failed fuel source terms (i.e.,

loss of coolant, locked rotor, single rod withdrawal, and rod ejection) are shown in Table 15-10 and Table 15-58. The source term inventory and gap fractions for fuel handling accidents are shown in Table 15-35.

Inventories in the Reactor Coolant The radiation sources associated with accidents which are not expected to cause fuel failures (main steam line break, loss of external load, steam generator tube rupture, and liquid storage tank rupture) are given in Table 15-11.

Residual Decay Heat Total Residual Heat Residual heat in a subcritical core is calculated for the loss of coolant accident per the requirements of Appendix K of 10CFR 50. These requirements include assuming infinite irradiation time before the core goes subcritical to determine fission product decay energy. For transients analyzed with the RETRAN-02 code, fission product decay energy is also based on the core average exposure at the end of an equilibrium cycle. The model used in the RETRAN-02 analyses is based on Reference 10, with a two standard deviation uncertainty adjustment applied to the results in lieu of the 1.2 factor of 10CFR 50 Appendix K.

Distribution of Decay Heat Following Loss of Coolant Accident During a loss of coolant accident, the core is rapidly shut down by void formation, rod cluster control assembly insertion, or both, and a large fraction of the heat generation to be considered comes from fission product decay gamma rays. This heat is not distributed in the same manner as steady state fission power. Local peaking effects which are important for the neutron dependent part of the heat generation do not apply to the gamma ray contribution. The steady state factor of 97.4 percent which represents the fraction of heat generated within the clad and pellet drops to 95 percent for the hot rod in a small break loss of coolant accident. The hot rod energy deposition for the large break loss of coolant accident (WCOBRA/TRAC analysis) is calculated based on the time-dependent fission and decay heat generation, the coolant density, and the radial power distribution. The hot rod energy deposition calculated for the large break loss of coolant accident is slightly less than that for the small break loss of coolant accident.

(13 APR 2020) 15.0 - 9

UFSAR Chapter 15 McGuire Nuclear Station Computer Codes Utilized Summaries of some of the principal computer codes used in transient analyses are given below. Other codes, in particular very specialized codes in which the modeling has been developed to simulate one particular accident, such as those used in the analysis of the Reactor Coolant System pipe rupture (Section 15.6.5), are summarized in their respective accident analyses sections. The codes used in the analyses of each transient have been listed in Table 15-3.

RETRAN-02 RETRAN-02 is a code capable of simulating most thermal-hydraulic transients of interest in both PWRs and BWRs. It has the flexibility to model any general fluid system by partitioning the system into a one-dimensional network of fluid volumes and connecting flowpaths or junctions. The mass, momentum, and energy conservation equations are then solved by employing a semi-implicit solution technique. The time step selection logic is based on algorithms that detect rapid changes in physical processes and limit time steps to ensure accuracy and stability. Although the equations describe homogeneous equilibrium fluid volumes, phase separation can be modeled by separated bubble rise volumes and by a dynamic slip model. The pressurizer and other regions can be modeled as non-equilibrium volumes when such phenomena are present. Reactor power generation can be represented by either explicit input as a function of time, a point kinetics model, or a one-dimensional kinetics model. Heat transfer across steam generator tubes and to or from structural components can be modeled. Special component models for centrifugal pumps, valves, trip logic, control systems, and other features useful for fluid system modeling are available. RETRAN-02 is further discussed in Reference 11.

VIPRE-01 VIPRE-01 is a subchannel thermal-hydraulic computer code. With a subchannel analysis approach, the nuclear fuel element is divided into a number of quasi one-dimensional channels that communicate laterally by diversion crossflow and turbulent mixing. However, VIPRE-01 is also capable of simulating single subchannel geometry. Given the geometry of the reactor core and coolant channel, and the boundary conditions for forcing functions, it calculates core flow distributions, coolant thermodynamic conditions, fuel rod temperatures, and the departure from nucleate boiling ratio (DNBR) for steady-state and transient conditions. VIPRE-01 accepts all necessary boundary conditions originating from a system transient simulation code or transient core neutronics simulation code. Included is the capability to impose different boundary conditions on different segments of the core model. For example, different transient inlet temperatures, flow rates, heat flux transients, and even different transient assembly and rod radial powers or axial flux shapes, can be modeled. VIPRE-01 is further discussed in Reference 12.

CASMO-3 CASMO-3 is a multigroup two-dimensional transport theory code for fuel assembly burnup calculations.

It uses a library of 40 or 70 energy group cross sections based primarily on the ENDF/B-IV data base.

This code produces two-group cross sections assembly discontinuity factors, fission produt data, detector reaction rates, and pin power data. The data from CASMO-3 is reformatted, using a data processing linkage code, into two- or three-dimensional tables for input to the three-dimensional code SIMULATE-3P. CASMO-3 is further discussed in Reference 18.

SIMULATE-3P SIMULATE-3P is a two-group three dimensional coarse mesh diffusion theory code based on the QPANDA neutronics model. SIMULATE-3P accounts for the effects on fuel and moderator feedback using its nodal thermal-hydraulics model. The model explicitly models the baffle and reflector region.

The program uses data from CASMO-3 for each pin in the fuel assembly and uses inter-assembly and 15.0 - 10 (13 APR 2020)

McGuire Nuclear Station UFSAR Chapter 15 intra-assembly data obtained from the coarse mesh solution to reconstruct the power distribution for each pin. SIMULATE-3P is further discussed in Reference 18.

SIMULATE-3K SIMULATE-3K is computer code, compatible with SIMULATE-3P (above), and uses a three dimensional neutron kinetics model based on the QPANDA two group nodal model to calculate three dimensional power distributions, core reactivity, or a power level for both static and transient applications. Transient core power distributions and hot assembly peak pin power distributions predictions are enhanced, relative to SIMULATE-3P, at bounding physics parameter conditions for input into fuel enthalpy, peak RCS pressure and DNB calculations. SIMULATE-3K is further discussed in Reference 20.

CASMO-4 CASMO-4 is a multipgroup two-dimensional transport theory code for fuel assembly burnup calculations.

It uses a library of 70 energy group cross sections based primarily on the ENDF/-IV data base. This code produces two-group cross sections assembly discontinuity factors, fission product data, detector reaction rates, and pin power data. The data from CASMO-4 is reformatted, using a data processing linkage code, into two- or three-dimensional tables for input to the three-dimensional code SIMULATE-3 MOX.

CASMO-4 is futher discussed in Reference 16.

SIMULATE-3 MOX SIMULATE-3 MOX is a two-group three dimensional coarse mesh diffusion theory code based on the QPANDA neutronics model. SIMULATE-3 MOX includes enhancements to model the steep thermal flux gradient between MOX and LEU fuel and is applicable for analysis of all LEU or cores containing MOX LTA fuel. SIMULATE-3 MOX accounts for the effects on fuel and moderator feedback using its nodal thermal-hydraulics model. The model explicitly models the baffle and reflector region. The program uses data from CASMO-4 for each pin in the fuel assembly and uses inter-assembly and intra-assembly data obtained from the coarse mesh solution to reconstruct the power distribution for each pin.

SIMULATE-3 MOX is futher discussed in Reference 16.

Nuclear Design Methodology using CASMO-4/SIMULATE-3 MOX, DPC-NE-1005-P-A (Reference 16) is approved for modeling an LEU or mixed LEU/MOX LTA only core.

15.0.1 References

1. Deleted Per 1998 Update

2. Deleted Per 1998 Update

3. Deleted Per 1998 Update

4. Deleted Per 1998 Update

5. Deleted Per 1998 Update

6. Deleted Per 1998 Update

7. "Duke Power Company Thermal-Hydraulic Statistical Core Design Methodology" DPC-NE-2005P-A, Revision 4a, December 2008.

8. Deleted Per 1998 Update

9. Nuclear Physics Methodology for Reload Design, DPC-NF-2010A, Duke Power Company, Revision 2a, December 2009.

10. American Nuclear Society, "Decay Heat Power in Light Water Reactors", ANSI/ANS 5.1, 1979.

(13 APR 2020) 15.0 - 11

UFSAR Chapter 15 McGuire Nuclear Station

11. EPRI, "RETRAN-02: A Program for Transient Thermal-Hydraulic Analysis of Complex Fluid Flow Systems", EPRI NP-1850-CCM, Revision 6.1, June 2007.

12. EPRI, "VIPRE-01: A Thermal-Hydraulic Code for Reactor Cores", EPRI NP-2511-CCM-A, Revision 4.2, June 2007.

13. Deleted Per 1998 Update

14. Deleted Per 1998 Update

15. Deleted Per 1998 Update

16. Nuclear Design Methodology using CASMO-4/SIMULATE-3 MOX, DPC-NE-1005-P-A, Revision 1, November 2008.

17. Little, J. L., and R. E. Paris, "Setpoint Study Duke Power Company William B. McGuire Nuclear Plant Units 1 and 2", WCAP-8921.

18. "Design Methodology Using CASMO-3/SIMULATE-3P", DPC-1004-A, Revision 1a, January 2009.

19. Deleted Per 2006 Update.

20. Duke Power Company Westinghouse Fuel Transition Report, DPC-NE-2009P-A, Revision 2a, July 2009.

THIS IS THE LAST PAGE OF THE TEXT SECTION 15.0.

15.0 - 12 (13 APR 2020)

McGuire Nuclear Station UFSAR Chapter 15 15.1 Increase in Heat Removal by the Secondary System A number of events have been postulated which could result in an increase in heat removal from the Reactor Coolant System by the Secondary System. Detailed analyses are presented for several such events which have been identified as limiting cases.

Discussions of the following events are presented in this section:

1. Feedwater System malfunction causing a reduction in feedwater temperature.

2. Feedwater System malfunction causing an increase in feedwater flow.

3. Excessive increase in secondary steam flow.

4. Inadvertent opening of a steam generator relief or safety valve.

5. Steam System piping failure.

The above are considered to be ANS Condition II events, with the exception of a major steam system pipe break, which is considered to be an ANS Condition IV event. Section 15.0 contains a discussion of ANS classifications and applicable acceptance criteria.

15.1.1 Feedwater System Malfunctions that Result in a Reduction in Feedwater Temperature 15.1.1.1 Identification of Causes and Accident Description Reductions in feedwater temperature will cause an increase in core power by decreasing reactor coolant temperature. Such transients are attenuated by the thermal capacity of the secondary plant and of the Reactor Coolant System (RCS). The overpower - overtemperature protection (neutron overpower, overtemperature and overpower T trips) prevents any power increase which could lead to a DNBR less than the limit value.

A reduction in feedwater temperature may be caused by the accidental opening of a feedwater bypass valve, which diverts flow around a portion of the feedwater heaters. In the event of an accidental opening of the bypass valve, there could be a sudden reduction in feedwater inlet temperature to the steam generators. At power, this increased subcooling will create a greater load demand on the RCS.

With the plant at no-load conditions, the addition of cold feedwater may cause a decrease in RCS temperature and, thus, a reactivity insertion due to the effects of the negative moderator coefficient of reactivity. However, the rate of energy change is reduced as load and feedwater flow decrease, so the no-load transient is less severe than the full power case.

The net effect on the RCS due to a reduction in feedwater temperature would be similar to the effect of increasing secondary steam flow, i.e., the reactor will reach a new equilibrium condition at a power level corresponding to the new steam generator T.

A decrease in normal feedwater temperature is classified as an ANS Condition II event, a fault of moderate frequency. See Section 15.0 for a discussion of Condition II events.

15.1.1.2 Analysis of Effects and Consequences Method of Analysis This transient is analyzed by computing conditions at the feedwater pump inlet following opening of the heater bypass valve. These feedwater conditions are then used to recalculate a (13 APR 2020) 15.1 - 1

UFSAR Chapter 15 McGuire Nuclear Station heat balance through the high pressure heaters. This heat balance gives the new feedwater conditions at the steam generator inlet.

The following assumptions are made:

1. Plant initial power level corresponding to guaranteed NSSS thermal power output.

2. High pressure heater bypass valve opens, resulting in condensate flow splitting between the bypass line and the high pressure heaters. The flow through each path is inversely proportional to the pressure drops.

Plant characteristics and initial conditions are further discussed in Section 15.0.

Results Opening of a high pressure heater bypass valve causes a reduction in feedwater temperature of less than 60°F, resulting in an increase in heat load on the primary system. The increased thermal load would thus result in a transient very similar, but of reduced magnitude, to that presented in Section 15.1.3 for an Excessive Load Increase Incident, which evaluates the consequences of a 10 percent step load increase. Therefore, the results of this analysis are not presented.

15.1.1.3 Conclusions The decrease in feedwater temperature transient is less severe than the increase in feedwater flow event (Section 15.1.2) or the increase in secondary steam flow event (Section 15.1.3).

Based on results presented in Sections 15.1.2 and 15.1.3, the applicable acceptance criteria for the decrease in feedwater temperature event have been met.

15.1.2 Feedwater System Malfunction Causing an Increase in Feedwater Flow 15.1.2.1 Identification of Causes and Accident Description Addition of excessive feedwater will cause an increase in core power by decreasing reactor coolant temperature. Such transients are attenuated by the thermal capacity of the secondary plant and of the Reactor Coolant System (RCS). The overpower - overtemperature protection (neutron overpower, overtemperature, and overpower T trips) prevents any power increase which could lead to a DNBR less than the limit value.

An example of excessive feedwater flow would be a full opening of a feedwater control valve due to a feedwater control system malfunction or an operator error. At power, this excess flow causes a greater load demand on the RCS due to increased subcooling in the steam generator.

With the plant at no-load conditions, the addition of cold feedwater may cause a decrease in RCS temperature and, thus, a reactivity insertion due to the effects of the negative moderator coefficient of reactivity.

Continuous addition of excessive feedwater is prevented by the steam generator high-high level trip, which closes the feedwater valves.

An increase in normal feedwater flow is classified as an ANS Condition II event, a fault of moderate frequency. See Section 15.0 for a discussion of Condition II events.

15.1.2.2 Analysis of Effects and Consequences Method of Analysis 15.1 - 2 (13 APR 2020)

McGuire Nuclear Station UFSAR Chapter 15 The excessive heat removal due to a feedwater system malfunction transient is analyzed by using the detailed digital computer code RETRAN-02 (Reference 7). This code simulates a multi-loop system, neutron kinetics, the pressurizer, pressurizer relief and safety valves, pressurizer spray, steam generator, and steam generator safety valves. The code computes pertinent plant variables including temperatures, pressures, and power level.

The system is analyzed to demonstrate plant behavior in the event that excessive feedwater addition occurs due to a control system malfunction or operator error, which allows the feedwater control valves to open fully. Two cases are analyzed as follows:

1. Accidental opening of all feedwater control valves with the reactor in manual control at full power.

2. Accidental opening of all feedwater control valves with the reactor just critical at zero load conditions assuming a conservatively large negative moderator temperature coefficient.

The DNBR calculation for this accident is performed using the Statistical Core Design Methodology and VIPRE-01 Code as described in References 8 and 10. Utilizing the WRB-2M critical heat flux correlation (Reference 12) for Westinghouse RFA fuel, the VIPRE-01 code calculates the DNBR during the transient based on the RETRAN-02 boundary conditions. Plant characteristics and initial conditions are discussed in Section 15.0 (see Table 15-4). The reactivity insertion rate following a feedwater system malfunction is calculated with the following assumptions:

1. Initial reactor power, pressure, flow, and RCS temperatures are assumed to be at their nominal values. Uncertainties in initial conditions are included in the limit DNBR as described in Reference 13.

2. For the feedwater control valve accident at full power, all feedwater control valves are assumed to fully open resulting in a step increase to approximately 142 percent of nominal feedwater mass flow to four steam generators.

3. For the feedwater control valve accident at zero load condition, a malfunction occurs which results in an increase in flow to four steam generators from zero to approximately 152 percent of the nominal full load mass flow rate.

4. For the zero load condition, feedwater temperature is at a conservatively low value of 70°F.

5. The positive reactivity inserted by the cooldown for the zero power case is based on Figure 15-17.

Normal reactor control systems and Engineered Safety Systems are not required to function.

The Reactor Protection System may function to trip the reactor due to overpower or low-low steam generator level conditions. No single active failure will prevent operation of the Reactor Protection System. A discussion of ATWS considerations is presented in Reference 3.

Results In the case of an accidental full opening of all feedwater control valves with the reactor at zero power and the above mentioned assumptions, the maximum reactivity insertion rate is less than the maximum reactivity insertion rate analyzed in Section 15.4.1, and, therefore, the results of the analysis are not presented here. It should be noted that if the incident occurs with the unit just critical at no load, the reactor may be tripped by the power range high neutron flux trip (low setting) set at approximately 25 percent of nominal full power.

The full power case (maximum reactivity feedback coefficients, manual rod control) gives the largest reactivity feedback and results in the greatest power increase. Assuming the reactor to (13 APR 2020) 15.1 - 3

UFSAR Chapter 15 McGuire Nuclear Station be in the automatic rod control mode results in a less severe transient. The rod control system is, therefore, not required to function for an excessive feedwater flow event.

For feedwater flow rates below 126 percent of nominal feedwater flow, when the steam generator water level in the faulted loop reaches the high-high level setpoint, all feedwater isolation valves and control valves are automatically closed and the main feedwater pumps are tripped. This prevents a continuous addition of feedwater. In addition, a turbine trip is initiated.

Following turbine trip, the reactor will be tripped on low-low steam generator water level signals in the unaffected steam generators. If the reactor were in the automatic control mode, the control rods would be inserted at the maximum rate following turbine trip, and the ensuing transient would then be similar to a loss of load (turbine trip event) as analyzed in Section 15.2.3.

Feedwater flow rates above 126 percent of nominal feedwater flow provide enough overcooling to trip the reactor on OPT prior to the high-high level setpoint being reached and subsequent boildown to low-low level reactor trip. Transient results (see Figure 15-7, Figure 15-8 and Figure 15-207 through Figure 15-211) show the increase in nuclear power and T associated with the increased thermal load on the reactor. The maximum feedwater flow rate of approximately 142 percent of nominal feedwater flow results in the highest peak thermal power and thus results in the lowest DNB ratio. The DNB ratio does not decrease below the limit value.

Following the reactor trip, the plant approaches a stabilized condition. Standard plant shutdown procedures may then be followed to further cool down the plant.

Since the power level rises during the excessive feedwater flow incident, the fuel temperatures will also rise until after reactor trip occurs. The core heat flux lags behind the neutron flux response due to the fuel rod thermal time constant, and the peak value does not exceed 118.5% of its nominal value. The peak fuel temperature will thus remain well below the fuel melting temperature.

The transient results show that DNB does not occur at any time during the excessive feedwater flow incident. Thus, the ability of the primary coolant to remove heat from the fuel rod is not reduced. The fuel cladding temperature, therefore, does not rise significantly above its initial value during the transient.

The calculated sequence of events for this accident is shown in Table 15-13.

15.1.2.3 Environmental Consequences There will be no radiological consequences associated with this event since activity is contained within the fuel rods and reactor coolant system within design limits.

15.1.2.4 Conclusions The results of the analysis show that the DNB ratios encountered for an excessive feedwater addition at power are above the limiting value. Hence, no fuel or clad damage is predicted.

Additionally, it has been shown that the reactivity insertion rate which occurs at no load conditions following excessive feedwater addition is less than the maximum value considered in the rod withdrawal from a subcritical condition analysis.

15.1 - 4 (13 APR 2020)

McGuire Nuclear Station UFSAR Chapter 15 15.1.3 Excessive Increase in Secondary Steam Flow 15.1.3.1 Identification of Causes and Accident Description An excessive increase in secondary system steam flow (excessive load increase incident) is defined as a rapid increase in steam flow that causes a power mismatch between the reactor core power and the steam generator load demand. The Reactor Control System is designed to accommodate a 10 percent step load increase or a 5 percent per minute ramp load increase in the range of 15 to 100 percent of full power. Any loading rate in excess of these values may cause a reactor trip actuated by the Reactor Protection System. Steam flow increases greater than 10 percent are analyzed in Sections 15.1.4 and 15.1.5.

This accident could result from either an administrative violation such as excessive loading by the operator or an equipment malfunction in the steam dump control or turbine speed control.

During power operation, steam dump to the condenser is controlled by reactor coolant condition signals, i.e. high reactor coolant temperature indicates a need for steam dump. A single controller malfunction does not cause steam dump. An interlock is provided which blocks the opening of the valves unless a large turbine load decrease or a turbine trip has occurred.

Protection against an excessive load increase accident is provided by the following Reactor Protection System signals:

1. Overpower T

2. Overtemperature T

3. Power range high neutron flux An excessive load increase incident is considered to be an ANS Condition II event, a fault of moderate frequency. See Section 15.0 for a discussion of Condition II events.

15.1.3.2 Analysis of Effects and Consequences Method of Analysis This accident is analyzed using the RETRAN-02 Code (Reference 7). The code simulates the neutron kinetics, Reactor Coolant System, pressurizer, pressurizer relief and safety valves, pressurizer spray, steam generator, steam generator safety valves, and feedwater system. The code computes pertinent plant variables including temperatures, pressures, and power level.

Two cases are analyzed to demonstrate the plant behavior following a 10 percent step load increase from rated load. These cases are as follows:

1. Reactor control in manual with a most negative moderator temperature coefficient.

2. Reactor control in automatic with a most negative moderator temperature coefficient.

The most negative moderator temperature coefficient results in the largest amount of reactivity feedback due to changes in coolant temperature.

Both cases are analyzed without credit being taken for pressurizer heaters.

This accident is analyzed with the Statistical Core Design Methodology as described in Reference 10. Plant characteristics and initial conditions are discussed in Section 15.0 (see Table 15-4). Initial reactor power, pressure, flow, and RCS temperatures are assumed to be at their nominal values. Uncertainties in initial conditions are included in the limit DNBR as described in Reference 10.

(13 APR 2020) 15.1 - 5

UFSAR Chapter 15 McGuire Nuclear Station Normal reactor control systems and Engineered Safety Systems are not required to function.

The Reactor Protection System is assumed to be operable. However, a reactor trip does not occur in either case. No single active failure will prevent the Reactor Protection System from performing its intended function.

The case which assumes automatic rod control is analyzed to ensure that the worst case is presented. The automatic function is not required.

Results The system response with rods in automatic or manual control is very similar. Since the manual rod control mode is slightly conservative, only this case is presented.

Figure 15-9 through Figure 15-12 illustrate the transient with the reactor in the manual control mode. For this case, there is an increase in reactor power due to the moderator feedback. A reduction in DNBR is experienced but DNBR remains above the limit value. For this case, the plant rapidly reaches a stabilized condition at the higher power level. Normal plant operating procedures would then be followed to reduce power.

The excessive load increase incident is an overpower transient for which the fuel temperatures will rise. Reactor trip does not occur for the cases analyzed, and the plant reaches a new equilibrium condition at a higher power level corresponding to the increase in steam flow.

Since DNB does not occur at any time during the excessive load increase transients, the ability of the primary coolant to remove heat from the fuel rod is not reduced. Thus, the fuel cladding temperature does not rise significantly above its initial value during the transient.

The calculated sequence of events for the excessive load increase incident is shown on Table 15-13.

15.1.3.3 Environmental Consequences There will be no radiological consequences associated with this event since activity is contained within the fuel rods and the reactor coolant system remains within design limits.

15.1.3.4 Conclusions The analysis presented above shows that for a ten percent step load increase, the DNBR remains above the limit value thereby precluding fuel or clad damage. The plant reaches a stabilized condition rapidly following the load increase.

15.1.4 Inadvertent Opening of a Steam Generator Relief or Safety Valve 15.1.4.1 Identification of Causes and Accident Description The most severe core conditions resulting from an accidental depressurization of the Main Steam System are associated with an inadvertent opening of a single steam dump, relief, or safety valve. The analyses performed assuming a rupture of a main steam line are given in Section 15.1.5. The main steam line break analysis bounds the inadvertent opening of a steam generator relief or safety valve analysis.

The steam release as a consequence of this accident results in an initial increase in steam flow which decreases during the accident as the steam pressure falls. The energy removal from the RCS causes a reduction of coolant temperature and pressure. In the presence of a negative moderator temperature coefficient, the cooldown results in an insertion of positive reactivity.

15.1 - 6 (13 APR 2020)

McGuire Nuclear Station UFSAR Chapter 15 The analysis is performed to demonstrate that the following criterion is satisfied: Assuming a stuck rod cluster control assembly, with offsite power available, and assuming a single failure in the Engineered Safety Features System, there will be no consequential damage to the core or Reactor Coolant System after reactor trip for a steam release equivalent to the spurious opening, with failure to close, of the largest of any single steam dump, relief, or safety valve.

The following systems provide the necessary protection against an accidental depressurization of the Main Steam System.

1. Safety Injection System actuation from any of the following:

a. Two-out-of-four low pressurizer pressure signals.

b. Two-out-of-three high containment pressure signals.

2. The overpower reactor trips (neutron flux and T) and the reactor trip occurring in conjunction with receipt of the safety injection signal.

3. Redundant isolation of the main feedwater lines.

Sustained high feedwater flow would cause additional cooldown. Therefore, in addition to the normal control action which will close the main feedwater valves following reactor trip, a safety injection signal would trip the main feedwater pumps and will generate a feedwater isolation signal which will rapidly close all main feedwater control valves and isolation valves.

4. Trip of the fast-acting main steam isolation valves (designed to close in less than 8 seconds following receipt of an isolation signal) on:

a. Two-out-of-three low steamline pressure signals in any one loop.

b. Two-out-of-four high-high containment pressure signals.

c. Two-out-of-three high negative steamline pressure rate signals in any one loop (used only during cooldown and heatup operations).

Accidental depressurization of the secondary system is classified as an ANS Condition II event, a fault of moderate frequency. See Section 15.0 for a discussion of Condition II events.

15.1.4.2 Analysis of Effects and Consequences Method of Analysis The following analyses of a secondary system steam release are performed for this section:

1. A full plant digital computer simulation using the RETRAN-02 Code (Reference 7) to determine RCS temperature and pressure during cooldown, and the effect of safety injection.

2. Analyses to determine that there is no damage to the core or reactor coolant system.

The following conditions are assumed to exist at the time of a secondary steam system release:

1. End-of-life shutdown margin at no-load, equilibrium xenon conditions, and with the most reactive rod cluster control assembly stuck in its fully withdrawn position. Operation of rod cluster control assembly banks during core burnup is restricted in such a way that addition of positive reactivity in a secondary system steam release accident will not lead to a more adverse condition than the case analyzed.

(13 APR 2020) 15.1 - 7

UFSAR Chapter 15 McGuire Nuclear Station

2. A negative moderator temperature coefficient corresponding to the end-of-life rodded core with the most reactive rod cluster control assembly in the fully withdrawn position. The variation of the coefficient with temperature is included. The reactivity versus temperature corresponding to the negative moderator temperature coefficient used is shown in Figure 15-17.

3. Minimum capability for injection of high concentration boric acid solution corresponding to the most restrictive single failure in the Safety Injection System. This corresponds to the flow delivered by one safety injection train delivering its full contents to the cold leg header.

No credit is taken for the low concentration boric acid which must be swept from the safety injection lines downstream of the refueling water storage tank prior to the delivery of concentrated boric acid (2395 ppm from the refueling water storage tank) to the reactor coolant loops.

4. The case studied is an initial steam flow of 280 pounds per second at approximately 1120 psig with offsite power available. This is the maximum capacity of any single steam dump, relief, or safety valve. Initial hot zero power conditions at time zero are assumed since this represents the most conservative initial condition. A penalty is taken for immediate operator action to trip the reactor. This is conservative with respect to reactor trip and is equivalent to initial hot standby operation. Should the reactor be operating at power at the time of a steam release, the reactor will be tripped by the normal overpower protection when power level reaches a trip point. Following a trip at power, the RCS contains more stored energy than at no-load, the average coolant temperature is higher than at no-load and there is appreciable energy stored in the fuel. Thus, the additional stored energy is removed via the cooldown caused by the steam release before the no-load conditions of RCS temperature and shutdown margin assumed in the analyses are reached. After the additional stored energy has been removed, the cooldown and reactivity insertions proceed in the same manner as in the analysis which assumes no-load condition at time zero. However, since the initial steam generator water inventory is greatest at no-load, the magnitude and duration of the RCS cooldown are less for a steam line release occurring at power.

5. In computing the steam flow, the Moody critical flow model for saturated steam (Reference

4) is used.

6. Perfect moisture separation in the steam generator is assumed.

Table 15-4 summarizes input parameters and initial conditions used.

The response times assumed for SI flow to the RCS, main feedwater isolation and main steam isolation for the inadvertent opening of a steam generator relief or safety valve transient are:

1. main steam isolation on steamline pressure low is assumed to occur in 8 seconds from receipt of a closure signal.

2. safety injection on pressurizer pressure low with offsite power available is assumed to occur in 17 seconds upon receipt of the low pressure signal.

3. main feedwater isolation upon receipt of a safety injection signal in 10 seconds.

Results The calculated time sequence of events for this accident is listed in Table 15-13.

Figure 15-18 and Figure 15-19 show the transient results for the inadvertent opening of a steam generator relief or safety valve.

The assumed steam release is the maximum capacity of any single steam dump, relief, or safety valve. Safety injection is initiated automatically by low pressurizer pressure. Boron 15.1 - 8 (13 APR 2020)

McGuire Nuclear Station UFSAR Chapter 15 solution at 2395 ppm enters the RCS from the refueling storage water tank (RWST), providing sufficient negative reactivity to prevent core damage. The cooldown results in a return-to-power of 14% RTP, which is bounded by the steam line break analysis.

15.1.4.3 Environmental Consequences The inadvertent opening of a single steam dump relief or safety valve can result in steam release from the secondary system. If steam generator leakage exists coincident with the failed fuel conditions, some activity will be released.

The radiological consequences resulting from an inadvertent opening of a steam generator relief of safety valve will be less severe than the steamline break event analyzed in Section 15.1.5.3 since no fuel damage is postulated to occur.

15.1.4.4 Conclusions Based on the DNB results presented for the steam system piping failure event in Section 15.1.5, the criteria stated earlier in this section are satisfied. For an accidental depressurization of the main steam system, the DNB design limits are not exceeded. This case is less limiting than the steam line rupture case described in Section 15.1.5.

15.1.5 Steam System Piping Failure 15.1.5.1 Identification of Causes and Accident Description Identification of Causes The steam release arising from a rupture of a main steam line would result in an initial increase in steam flow which decreases during the accident as the steam pressure falls. The energy removal from the RCS causes a reduction of coolant temperatures and pressure. In the presence of a negative moderator temperature coefficient, the cooldown reults in an insertion of positive reactivity. Steam system piping failure is analyzed for two operating conditions: hot zero power and hot full power.

Accident Description for Steam System Piping Failure at Hot Zero Power If the most reactive rod cluster control assembly (RCCA) is assumed stuck in its fully withdrawn position after reactor trip, there is an increased possibility that the core will become critical and return to power. A return to power following a steam line rupture is a potential problem mainly because of the high power peaking factors which exist assuming the most reactive RCCA to be stuck in its fully withdrawn position. The core is ultimately shut down by the boric acid injection deleivered by the Safety Injection System.

The following functions provide the protection for a steamline rupture:

1. Safety Injection System actuation from any of the following:

a. Two-out-of-four low pressurizer pressure signals.

(13 APR 2020) 15.1 - 9

UFSAR Chapter 15 McGuire Nuclear Station

b. Two-out-of-three high containment pressure signals.

2. The overpower reactor trips (neutron flux and T) and the reactor trip occurring in conjunction with receipt of the safety injection signal.

3. Redundant isolation of the main feedwater lines.

Sustained high feedwater flow would cause additional cooldown. Therefore, in addition to the normal control action which will close the main feedwater valves, the safety injection signal will trip the main feedwater pumps and will generate a feedwater isolation signal which will rapidly close all main feedwater control valve, and isolation valves.

4. Trip of the fast-acting main steam isolation valves (designed to close in less than 8 seconds following receipt of an isolation signal) on:

a. Two-out-of-three low steam line pressure signals in any one loop.

b. Two-out-of-four high-high containment pressure signals.

c. Two-out-of-three high negative steam line pressure rate signals in any one loop (used only during cooldown and heatup operations.

For breaks downsteam of the main steam isolation valves, closure of all valves would completely terminate the blowdown. For any break, in any location, no more than one steam generator would experience an uncontrolled blowdown even if one of the isolation valves fails to close. A description of steam line isolation is included in Section 10.3.2.

Steam flow is measured by monitoring dynamic head in nozzles located in the throat of the steam generator. The effective throat area of the nozzles is 1.4 square feet, which is considerably less than the main steam pipe area. Thus, the nozzles also serve to limit the maximum steam flow exiting the steam generators for a break at any location.

Accident Description for Steam System Piping Failure at Hot Zero Power The increase in the core power could result in centerline fuel melt (CFM) and departure from nucleate boiling (DNB). The core is shut down by either the power range high neutron flux positive rate trip, the power range high neutron flux trip, or the overpower T (OPT) of the Reactor Protection System. The main steam and feedwater line isolation valves are automatically closed. The auxiliary feedwater system supplies makeup water to the the steam generators. Decay heat is removed as necessary through the unaffected steam generators.

After the reactor trip, the continuation of the pressure decrease in the secondary side would cause the RCS pressure and temperature to decrease further, and consequently a reactor core return-to-power can occur. This situation is similar to the break of a main steam line at zero power. However, the magnitude of return-to-power due to a main steam line at zero power is higher. Therefore, the steam line break at zero power analysis is applicable to the post-trip response following a main steam line break at hot full power when the limiting condition corresponding to the return-to-power occurs. The steam line break at hot full power analysis is applicable to the pre-trip power excursion following a main steam line break at power.

An analysis of the system transient is presented to show that CFM and DNB do not occur following a break of a main steam line at hot full power A major steamline rupture is classified as an ANS Condition IV event, a limiting fault. See Section 15.0 for a discussion of Condition IV events.

15.1 - 10 (13 APR 2020)

McGuire Nuclear Station UFSAR Chapter 15 Effects of minor secondary system pipe breaks are bounded by the analysis presented in this section. Minor secondary system pipe breaks are classified as Condition III events, as described in Section 15.0.

15.1.5.2 Analysis of Effects and Consequences Method of Analysis for Steam Line Break at Hot Zero Power The analysis of a main steamline rupture is performed to demonstrate that the following criteria are satisfied:

Assuming a stuck RCCA with or without offsite power, and assuming a single failure in the engineered safety features, the core remains in place and intact. Radiation doses do not exceed the guidelines of 10 CFR 100.

Although DNB and possible clad perforation following a steam pipe rupture are not necessarily unacceptable, the following analysis, in fact, shows that no DNB occurs for any rupture assuming the most reactive assembly stuck in its fully withdrawn position. The DNBR design basis is discussed in Section 4.4.

The major rupture of a steamline is the most limiting cooldown transient and is analyzed at zero power. A detailed analysis of this transient with the most limiting break size, 2.0 ft2, is presented here.

The analysis of the steam pipe rupture has been performed to determine:

1. The core heat flux and RCS temperature and pressure resulting from the cooldown following the steam line break. The RETRAN-02 Code (Reference 7) has been used.

2. The thermal and hydraulic behavior of the core following a steam line break. A detailed thermal and hydraulic digital-computer code, VIPRE-01 (Reference 8), has been used to determine if DNB occurs for the core conditions computed in item 1 above.

The Westinghouse RFA fuel has been analyzed. The system response for the RFA analysis is presented here.

Studies have been performed to determine the sensitivity of steam line break results to various assumptions (Reference 5). Based upon this study, the following conditions were assumed to exist at the time of the main steam line break accident:

1. End-of-life shutdown margin at no-load, equilibrium xenon conditions, and the most reactive RCCA stuck in its fully withdrawn position. Operation of the control rod banks during core burnup is restricted in such a way that addition of positive reactivity in a steamline break accident will not lead to a more adverse condition than the case analyzed.

2. A negative moderator coefficient corresponding to an end-of-cycle (EOC) rodded core. The change in core reactivity during the cooldown considered the effects of temperature, pressure and the most reactive rod in its fully withdrawn position. The impact on reactivity due to the spatial redistribution of the flux resulting from a non-uniform cooldown were also considered. The reactivity versus temperature curve used in the analysis is shown in Figure 15-17. The effect of power generation in the core on overall reactivity is modeled by fuel temperature coefficient as described in Reference 5.

The core properties associated with the sector nearest the affected steam generator and those associated with the remaining sector were conservatively combined to obtain average core properties for reactivity feedback calculations. Further, it was conservatively assumed that the core energy deposition distribution from power generation was uniform. These two (13 APR 2020) 15.1 - 11

UFSAR Chapter 15 McGuire Nuclear Station conditions cause underprediction of the reactivity feedback in the high power region near the stuck rod. To verify the conservatism of this method, the reactivity as well as the power distribution were checked for the limiting statepoints for the cases analyzed.

This core analysis considered the Doppler reactivity from the high fuel temperature near the stuck RCCA, moderator feedback from the high water enthalpy near the stuck RCCA, power redistribution and nonuniform core inlet temperature effects. The effect of void was indirectly accounted for in the analysis. It was determined that the reactivity employed in the system kinetics analysis was always larger than the reactivity calculated including the above local effects for the statepoints. These results verify conservatism; i.e., underprediction of negative reactivity feedback from power generation.

3. Minimum capability for injection of boric acid (2395 ppm from the RWST) solution corresponding to the most restrictive single failure in the Safety Injection System. The Emergency Core Cooling System consists of four systems: 1) the passive accumulators, 2) the low head safety injection (LHSI) System, and 3) the intermediate head safety injection (IHSI) and 4) the high head safety injection (HHSI) system. Only the latter two actuate for the steam line break accident analysis.

The actual modeling of the HHSI and IHSI systems in RETRAN-02 is described in Reference 5. No credit has been taken for the low concentration borated water (0 ppmb is assumed) which must be swept from the lines downstream of the RWST prior to the delivery of high concentration boric acid to the reactor coolant loops.

For the cases where offsite power is maintained, the sequence of events in the HHSI and IHSI systems is the following. After the generation of the safety injection signal (appropriate delays for instrumentation, logic, and signal transport included), the appropriate valves begin to operate and the safety injection pumps start. 17 seconds after the safety injection signal is generated, the valves are assumed to be in their final position and the pumps are assumed to be at full speed. The volume containing the unborated water is swept before the 2395 ppm water reaches the core. This delay, described above, is inherently included in the modeling.

In cases where offsite power is lost, an additional 15 second delay is assumed to start the diesels and to load the necessary safety injection equipment onto them.

4. Zero steam generator tube plugging is assumed to maximize heat removal by the secondary system.

5. The steam generators are provided with integral flow restrictors with a 1.4 ft2 throat area.

Sensitivity studies conclude that a 2.0 ft2 break causes the most severe core transient with respect to DNB. This break size is the smallest of those analyzed that results in choked flow at the faulted steam generator outlet flow restrictor. The following cases are analyzed in this section:

a. A 2.0 ft2 split break with the plant at hot zero power with all four reactor coolant pumps running and offsite power maintained throughout the transient.

b. A 2.0 ft² split break with loss of offsite power coincident with the safety injection signal.

Loss of offsite power results in reactor coolant pump coastdown.

6. Power peaking factors, corresponding to one stuck RCCA and non-uniform core inlet coolant temperatures, are determined for end of core life. The coldest core inlet temperatures are assumed to occur in the sector with the stuck rod. The effects of voids were indirectly accounted for in the analysis. The power peaking factors depend upon the core power, temperature, pressure, and flow, and thus are different for each case studied.

15.1 - 12 (13 APR 2020)

McGuire Nuclear Station UFSAR Chapter 15 The core parameters used for each of the two cases correspond to values determined from the respective transient analysis.

Both cases above assume that the reactor is initially critical at 10-9 times nominal power. A penalty is taken for immediate operator action to trip the reactor. This is conservative with respect to reactor trip and is equivalent to initial hot standby operation. This is a conservative boundary condition for maximizing RCS cooldown, and does not imply an immediate operator action necessary to mitigate the consequences of the event. Should the reactor be operating at power at the time of a steam line break, the reactor will be tripped by the normal overpower protection system when power level reaches a trip point. Following a trip at power, the RCS contains more stored energy than at no-load, the average coolant temperature is higher than at no-load, and there is appreciable energy stored in the fuel.

Thus, the additional stored energy is removed via the cooldown caused by the steam line break before the no-load conditions of RCS temperature and shutdown margin assumed in the analyses are reached. After the additional stored energy has been removed, the cooldown and reactivity insertions proceed in the same manner as in the analysis which assumes no-load condition at time zero.

7. In computing the steam flow during a steam line break, the Moody critical flow model for saturated steam (Reference 4) is used.

These assumptions are discussed more fully in Reference 5. Table 15-4 summarizes input parameters and initial conditions used.

Method of Analysis for Steam Line Break at Hot Full Power The anlysis of a main steam line break at power is performed to demonstrate that the following criteria are satisfied:

Assuming without offsite power and a single failure in the engineered safety features, the core remains in place and intact. Radiation doses do not exceed the guidelines of 10CFR 100.

Although DNB and possible clad perforation following a steam pipe break are not necessarily unacceptable, the following analysis in fact show that CFM and DNB do not occur for any break. The CFM and DNB design bases are discussed in Section 4.4.

The analysis of a main steam line break at power has been performed for the Westinghouse RFA fuel to determine:

1. The core transient heat flux, RCS temperature and pressure resulting from the cooldown follow the steam line break. The RETRAN-02 Code (Reference 7) and the Statistitcal Core design Methodology (Reference 10) have been used. The peak local transient reactor power is used to evaluate CFM.

2. A detailed thermal and hydraulic digital-computer code, VIPRE-01 (Reference 8), and the Statistical Core Design Methodology have been used to determine if DNB occurs. The WRB-2M critical heat flux correlation (Reference 12) is used for the DNBR calculation for the RFA fuel.

Plant characteristics and initial conditions for this accident are discussed in Section 15.0. The analysis is performed for the FSG steam generators. Studies have been performed to determine conservative initial and boundary conditions assumed to exist for the main steam line break at power accident:

1. Double-end breaks and split breaks with a spectrum of break sizes at various locations outside the containment are analyzed. A break inside the containment is non-limiting due to (13 APR 2020) 15.1 - 13

UFSAR Chapter 15 McGuire Nuclear Station an immediate reactor trip on high containment pressure. In computing the steam flow during a steam line break, the Moody critical flow model for saturated steam (Reference 4) is used.

2. Break size and break location and moderator temperature coefficient (MTC) determine simultaneously the magnitude of the pre-trip power increase. Therefore, for a given break, the maximum pre-trip power level is determined by analyzing a range of negative MTC values which bound the c;urrent core designs. The MTC is modeled as a density coefficient based on the core average coolant density.

3. An increase of fuel temperature is expected before reactor trip since there is a reactor power excursion. A least negative Doppler temperature coefficient (DTC) would therefore maximize the pre-trip power level, and is used in the analysis.

4. The reactor trip on high neutron flux is assumed to be actuated at a conservative value of 113.2% of nominal full power. The assumptions of 2 out of 4 detector channel output logic and a failed channel are applied in the analysis. The calculated neutron flux is conservatively modified to account for transient changes in the flux incident on the excore detectors as described below. The high flux positive rate trip and OPT trip include all adverse instrumentation and setpoint errors. The delays for trip actuation are assumed to be the maximum values.

5. As the steam generators depressurize, the saturation temperature decreases and causes excessive primary-to-secondary heat transfer. The resulting decrease in cold leg temperature upon entering the reactor vessel downcome attenuates the neutron flux leakage exiting the reactor. This attenuation effect reduces the flux incident on the excore neutron detectors, thereby creating an error in the indicated flux value (indicated excore detector power less than true reactor power). A conservative attenuation factor is assumed as a function of the change in reactor vessel downcomer density.

6. A possible loss of offsite power coincident with the break or coincident with the turbine trip is considered. A loss of offsite power at the time of turbine trip has been shown to be limiting.

The main consequences of the loss of offsite power are that control rods insert and reactor coolant pumps coast down.

7. The Rod Control System is assumed to be in manual control to maximize the power increase.

8. The Main Feedwater System is modeled to include the increase in main feedwater flow as the steam generator pressure decreases to maximize cooldown. Main feedwater control valve position and pump speed are assumed to be in manual control.

9. The main turbine is modeled in automatic control mode with the control valves modulating to control to full power steam load to maximize the depressurization until the valve-wide-open position is reached. Thereafter the turbine flow is modeled as a critical flow junction and flow decreases as steam header pressure decreases. Turbine trip occurs on loss of offsite power or reactor trip.

10. In order to maximize the effects of the increased secondary system heat removal, no tube plugging is assumed.

Using the above assumptions, RETRAN system analyses are performed to determine a limiting CFM case and a limiting DNB case based on the combination of break size and break location and MTC. Results show that the limiting CFM case is a 3.4 ft² split break down stream of the MSIV with -24 pcm/°F MTC and the limiting DNB case a 4.9 ft² split break down stream of the MSIV with a-24 pcm/°F MTC.

Results of Steam Line Break at Hot Zero Power 15.1 - 14 (13 APR 2020)

McGuire Nuclear Station UFSAR Chapter 15 The calculated sequence of events for both cases analyzed is shown on Table 15-13.

Core Power and Reactor Coolant System Transient Figure 15-21 through Figure 15-26 and Figure 15-157 through Figure 15-161 show the RCS and secondary system transient following a main steam line rupture at initial no-load condition.

Offsite power is assumed available so that full reactor coolant flow exists. The transient shown assumes an uncontrolled steam release from only one steam generator. Should the core be critical at near zero power when the rupture occurs, the initiation of safety injection on low pressurizer pressure will shut down the reactor. Steam release from more than one steam generator will be prevented by automatic trip of the fast acting isolation valves in the steam lines by a low steam line pressure signals, high-high containment pressure signals, or high negative steam line pressure rate signals. Even with the failure of one valve, release is ended for the other steam generators while the one generator blows down. The isolation valves are designed to be fully closed in 8 seconds from receipt of a closure signal.

As shown in Figure 15-26, the core attains criticality with the RCCAs inserted (with the design shutdown margin assuming one stuck RCCA) and the peak heat flux occurs before boron solution at 2395 ppm enters the RCS. Doppler feedback mitigates the power excursion and power is decreasing when boron reaches the core. The continued addition of boron ensures a peak core power significantly lower than the nominal full power value.

The calculation assumes the boric acid is mixed with, and diluted by, the water flowing in the RCS prior to entering the reactor core. The concentration after mixing depends upon the relative flow rates in the RCS and the Safety Injection System. The variation of mass flow rate in the RCS due to water density changes is included in the calculation, as is the variation of flow rate in the Safety Injection System due to changes in the RCS pressure. The Safety Injection System flow calculation includes the line losses in the system as well as the pump head curve.

Figure 15-162 through Figure 15-172 show the salient parameters for the case with the loss of offsite power at the time the safety injection signal is generated. Criticality is achieved later and the core power increase is slower than in the similar case with offsite power available. The ability of the emptying steam generator to extract heat from the RCS is reduced by the decreased flow in the RCS. The peak power remains well below the nominal full power value.

It should be noted that following a steam line break only one steam generator blows down completely. Thus, the remaining steam generators are still available for dissipation of decay heat after the initial transient is over. In the case of loss of offsite power this heat is removed to the atmosphere via the steam line safety valves.

Margin to Critical Heat Flux A DNB analysis was performed for both of these cases. It was found that both cases have a minimum DNBR greater than the limit value of the WLOP CHF correlation (Reference 15)

Effect of Continued Auxiliary Feedwater Addition An analysis was performed to determine the potential for unacceptable worsening of the reactor return-to-power as a result of continued addition of auxiliary feedwater following a main steam line break. The main steam line break transient as analyzed here should be insensitive to continued auxiliary feedwater addition, since the limiting core conditions, as described above, occur within the first few minutes due to the initial high cooldown rate. During this time the primary-to-secondary heat transfer rate from the blowdown of the initial steam generator water inventory is several orders of magnitude greater than the rate due to the additional auxiliary feedwater, even when runout flow is assumed. The supplementary analysis, assuming auxiliary feedwater at runout flow conditions as described in Section 6.2.1.1.3.4, was evaluated in (13 APR 2020) 15.1 - 15

UFSAR Chapter 15 McGuire Nuclear Station Reference 6. This evaluation found that the transient was insensitive to continued auxiliary feedwater addition, and, therefore, that the main analysis above remained bounding.

Steam Line Break in Mode 3 when Safety Injection is Blocked A potentially more limiting steam line break accident could occur for a steam line break outside containment when in Mode 3 with the low pressurizer pressure signal for safety injection actuation blocked. In this scenario, feedwater would not automatically isolate, and return-to-power peak heat fluxes may increase to values significantly greater than the steam line break analysis initiating from no-load conditions. Therefore, when safety injection is blocked, administrative controls on boron concentration are required to prevent a return-to-power following a steam line break.

Results of Steam Line Break at Hot Full Power The calculated sequences of events for both CFM and DNB cases are shown on Table 15-13.

The reactor power increases due to the insertion of the positive reactivity resulted from the coolant temperature decrease. Eventually the reactor is tripped on high neutron flux for the CFM case and on OPT for the DNB case. The transient response for the limiting CFM case is shown in Figures 282 through 290. The transient response for the limiting DNB case is not shown due to similarity. Loss of offsite power coincident with the turbine trip is assumed.

Figure 15-287 shows the substantial difference between the actual neutron power and the attenuated neutrol flux, which is seen by the excore neutron detector, due to the decrease of the downcomer coolant temperature. The limiting CFM case yields a positive CFM margin.

A VIPRE analysis was performed for the limiting DNB case. The transient DNBR result (Figure 15-291) shows that the MDNBR is above the limit value of the WLOP CHF correlation (Reference15).

Conclusion for Steam Line Break at Hot Full Power The results of the analyses show that both CFM and DNB have positive margin. Therefore, no fuel or clad damage is predicted during the steam line break at power.

15.1.5.3 Environmental Consequences The reactor coolant inventory is listed in Table 15-62 and Table 15-63. This accident involves the double-ended rupture of a main steam line.

Two cases are analyzed for this accident scenario. One of the cases is a pre-existing spike case, where a reactor transient has occurred prior to the postulated main steam line break - this case uses a 60 µCi/g DE I-131 source term. The other case analyzed is the coincident spike scenario, which increases the release rate from the primary coolant to a value 500 times greater than the release rate corresponding to the equilibrium iodine concentration at 1.0 µCi/g DE I-131. Radioactivity is released (release fractions, iodine species) per the guidelines in Regulatory Guide 1.183 (Reference 14).

This accident involves the double-ended rupture of a main steam line. The faulted steam generator dries out within minutes of the initiating event, ending the blowdown phase. All iodine entrained in leakage across the tubes to the faulted steam generator is taken to escape to the environment. The rapid decrease in steam generator pressure causes a Main Steam Isolation signal to be initiated which results in theclosure of a Main Steam Isolation Valve. This stops the uncontrolled loss of water inventory from the intact steam generators.

A safety injection signal also is initiated on low pressurizer pressure. Offsite power is assumed to be lost at this time. Following loss of offsite power, all boiloff from the intact steam generators 15.1 - 16 (13 APR 2020)

McGuire Nuclear Station UFSAR Chapter 15 is released through the associated steam generator Power Operated Relief Valves and Main Steam Code Safety Valves. See Table 15-14 for specific values assumed in the anaylsis.

Cooldown of the unit begins quickly after accident initiation. It occurs in two phases. First, the unit will be cooled down to a temperature of 350 °F with the CA system. Then the ND system will be aligned to the reactor coolant system to continue to cool the unit down to a temperature of 200 °F. The release ends when the reactor coolant system is cooled to the point where no flashing or atomization of leakage occurs.

The dose consequences for this accident are calculated using methods described in Regulatory Guide 1.183 (Reference 14). The calculated doses are listed in Table 15-12. Note that the EAB dose corresponds to the highest dose over any 2-hour duration during the accident.

15.1.6 References

1. Deleted Per 1998 Update.

2. Deleted Per 1998 Update.

3. Letter (NS-TMA-2182) from T.M. Anderson (Westinghouse) to S.H. Hanauer (NRC),

December 30, 1979.

4. Moody, F. S., Transactions of the ASME, Journal of Heat Transfer, Figure 3, page 134, February 1965.

5. McGuire and Catawba Nuclear Stations Multidimensional Reactor Transients and Safety Analysis Physics Parameters Methodology, DPC-NE-3001-PA, Duke Power Company, Revision 1, March 2015.

6. Letter, T. M. Novak (NRC) to H. B. Tucker, October 14, 1982.

Enclosure:

Safety Evaluation Report of Duke Power Co. response to I. E.Bulletin 80-04.

7. RETRAN-02: A Program for Transient Thermal-Hydraulic Analysis of Complex Fluid Flow Systems, EPRI NP-1850-CCM, Revision 6.1, EPRI, June 2007.

8. VIPRE-01: A Thermal-Hydraulic Code for Reactor Cores, EPRI NP-2511-CCM-A, Revision 4.2, EPRI, June 2007.

9. Deleted Per 1998 Update.

10. Duke Power Company Thermal-Hydraulic Statistical Core Design Methodology DPC-NE-2005P-A, Revision 4a, December 2008.

11. Deleted Per 2006 Update.

12. WCAP-15025-P, Modified WRB-2 Correlation, WRB-2M, for Predicting Critical Heat Flux in 17x17 Rod Bundles with Modified LPO Mixing Vane Grids, Westinghouse, February, 1998.

13. Duke Power Company Westinghouse Fuel Transition Report, DPC-NE-2009P-A, Revision 2a, July 2009.

14. USNRC Regulatory Guide 1.183, "Alternative Radiological Source Terms for Evaluating Design Basis Accidents at Nuclear Power Reactors", Original Issue, July 2000.

15. WCAP-14565-P-A, Addendum 2 to WCAP-14565-P-A Extended Application of ABB-NV Correlation and Modified ABB-NV Correlation WLOP for PWR Low Pressure Applications, April 2008.

(13 APR 2020) 15.1 - 17

UFSAR Chapter 15 McGuire Nuclear Station THIS IS THE LAST PAGE OF THE TEXT SECTION 15.1.

15.1 - 18 (13 APR 2020)

McGuire Nuclear Station UFSAR Chapter 15 15.2 Decrease in Heat Removal by the Secondary System A number of transients and accidents have been postulated which could result in a reduction of the capacity of the secondary system to remove heat generated in the Reactor Coolant System (RCS). Detailed analyses are presented for several such events which have been identified as limiting cases.

Discussions of the following events are presented in this section:

1. Steam pressure regulator malfunction

2. Loss of External Load

3. Turbine Trip

4. Inadvertent closure of main steam isolation valves

5. Loss of Condenser Vacuum and Other Events Resulting in Turbine Trip

6. Loss of Non-Emergency AC Power to the Station Auxiliaries

7. Loss of Normal Feedwater Flow

8. Feedwater System Pipe Break The above items are considered to be ANS Condition II events, with the exception of a Feedwater System Pipe Break, which is considered to be an ANS Condition IV event. Section 15.0 contains a discussion of ANS classifications and applicable acceptance criteria.

15.2.1 Steam Pressure Regulator Malfunction or Failure That Results In Decreasing Steam Flow There are no pressure regulators in the McGuire plant whose failure or malfunction could cause a steam flow transient.

15.2.2 Loss of External Load 15.2.2.1 Identification of Causes and Accident Description A major load loss on the plant can result from loss of external electrical load due to some electrical system disturbance. Offsite AC power remains available to operate plant components such as the reactor coolant pumps. As a result, the onsite emergency diesel generators are not required to function for this event. Following the loss of generator load, an immediate fast closure of the turbine control valves will occur. This will cause a sudden reduction in steam flow, resulting in an increase in pressure and temperature in the steam generator shell. As a result, the heat transfer rate in the steam generator is reduced, causing the reactor coolant temperature to rise, which in turn causes coolant expansion, pressurizer insurge, and RCS pressure rise.

For a loss of external electrical load without subsequent turbine trip, the plant would be expected to trip from the Reactor Protection System if a safety limit were approached. A continued steam load of approximately 5 percent would exist after total loss of external electrical load because of the steam demand of plant auxiliaries.

In the event that a safety limit is approached, protection would be provided by the high pressurizer pressure and overtemperature T trips. Power and frequency relays associated with the reactor coolant pump provide no additional safety function for this event. Following a (13 APR 2020) 15.2 - 1

UFSAR Chapter 15 McGuire Nuclear Station complete loss of load, the maximum turbine overspeed would be approximately 8 to 9 percent, resulting in an overfrequency of less than 6 Hz. This resulting overfrequency is not expected to damage the sensors (non-NSSS) in any way. However, it is noted that frequency testing of this equipment is required by the Technical Specifications. Any degradation in their performance could be ascertained at that time. Any increased frequency to the reactor coolant pump motors will result in slightly increased flowrate and subsequent additional margin to safety limits. For postulated loss of load and subsequent turbine generator overspeed, any overfrequency condition is not seen by safety related pump motors, Reactor Protection System equipment, or other safeguards loads. Safeguards loads are supplied from offsite power or, alternatively, from emergency diesels. Reactor Protection System equipment is supplied from the inverters; the inverters are supplied from a DC bus energized from batteries or by a rectified AC voltage from safeguards buses.

In the event the steam dump valves fail to open following a large loss of load, the steam generator safety valves may lift and the reactor may be tripped by the high pressurizer pressure signal, the high pressurizer water level signal, or the overtemperature T signal. The steam generator shell side pressure and reactor coolant temperatures will increase rapidly. The pressurizer safety valves and steam generator safety valves are, however, sized to protect the Reactor Coolant System (RCS) and steam generator against overpressure for all load losses without assuming the operation of the steam dump system, pressurizer spray, pressurizer power-operated relief valves, or automatic rod cluster control assembly control.

The steam generator safety valve capacity is sized to remove the steam flow at the engineered safety features design rating (105 percent of steam flow at rated power) from the steam generator without exceeding 110 percent of the steam system design pressure. The pressurizer safety valve capacity is sized based on a complete loss of heat sink with the plant initially operating at the maximum calculated turbine load along with operation of the steam generator safety valves. The pressurizer safety valves are then able to relieve sufficient steam to maintain the RCS pressure within 110 percent of the RCS design pressure.

A more complete discussion of overpressure protection can be found in Reference 1.

A loss of external load event results in an NSSS transient that is less severe than a turbine trip event (see Section 15.2.3). Therefore, a detailed transient analysis is not presented for the loss of external load.

The primary-side transient is caused by a decrease in heat transfer capability from primary to secondary due to a rapid termination of steam flow to the turbine, accompanied by an automatic reduction of feedwater flow. (Should feed flow not be reduced, a larger heat sink would be available and the transient would be less severe). Termination of steam flow to the turbine following a loss of external load occurs due to automatic fast closure of the turbine control valves in approximately 0.3 seconds. Following a turbine trip event, termination of steam flow occurs via turbine stop valve closure, which occurs in approximately 0.1 seconds. Therefore, the transient in primary pressure, temperature, and water volume will be less severe for the loss of external load than for the turbine trip due to a slightly slower loss of heat transfer capability.

A loss of external load is classified as an ANS Condition II event, a fault of moderate frequency.

See Section 15.0 for a discussion of Condition II events.

15.2.2.2 Analysis of Effects and Consequences Method of Analysis 15.2 - 2 (13 APR 2020)

McGuire Nuclear Station UFSAR Chapter 15 Refer to Section 15.2.3.2 for the method used to analyze the limiting transient (turbine trip) in this grouping of events. The results of the turbine trip event analysis are more severe than those expected for the loss of external load, as discussed in Section 15.2.2.1.

Normal reactor control systems and Engineered Safety Systems are not required to function.

The Auxiliary Feedwater System may, however, be automatically actuated following a loss of main feedwater. This will further mitigate the effects of the transient.

The Reactor Protection System may be required to function following a complete loss of external load to terminate core heat input and prevent DNB. Depending on the magnitude of the load loss, pressurizer safety valves and/or steam generator safety valves may be required to open to maintain system pressure below allowable limits. No single active failure will prevent operation of any system required to function. A discussion of ATWS considerations is presented in Reference 2.

15.2.2.3 Environmental Consequences The radiological consequences resulting from a loss of external load accident will be less severe than the steamline break event analyzed in Section 15.1.5.3 since no fuel damage is postulated to occur.

15.2.2.4 Conclusions Based on results obtained for the turbine trip event (Section 15.2.3) and considerations described in Section 15.2.2.1, the applicable acceptance criteria for a loss of external load event are met.

15.2.3 Turbine Trip 15.2.3.1 Identification of Causes and Accident Description For a turbine trip event, the turbine stop valves close rapidly (typically 0.1 sec.) on loss of trip fluid pressure actuated by one of a number of possible turbine trip signals as described in Section 10.2.2.

Upon initiation of stop valve closure, steam flow to the turbine stops abruptly. Sensors on the stop valves detect the turbine trip and initiate steam dump. The loss of steam flow results in an almost immediate rise in secondary system temperature and pressure with a resultant primary system transient as described in Section 15.2.2.1 for the loss of external load event. A more severe transient occurs for the turbine trip event due to the more rapid loss of steam flow caused by the more rapid valve closure.

The automatic steam dump system would normally accommodate the excess steam generation.

Reactor coolant temperatures and pressure do not significantly increase if the steam dump system and pressurizer pressure control system are functioning properly. If the turbine condenser were not available, the excess steam generation would be dumped to the atmosphere and main feedwater flow would be lost. For this situation feedwater flow would be maintained by the Auxiliary Feedwater System to ensure adequate residual and decay heat removal capability. Should the steam dump system fail to operate, the steam generator safety valves may lift to provide pressure control. See Section 15.2.2.1 for a further discussion of the transient.

(13 APR 2020) 15.2 - 3

UFSAR Chapter 15 McGuire Nuclear Station A turbine trip event is the most limiting of loss of external load, loss of condenser vacuum, and other turbine trip events. As such, this event has been analyzed in detail. Results and discussion of the analysis are presented in Section 15.2.3.2.

A turbine trip is classified as an ANS Condition II event, a fault of moderate frequency. See Section 15.0 for a discussion of Condition II events.

15.2.3.2 Analysis of Effects and Consequences Method of Analysis In this analysis, the behavior of the unit is evaluated for a complete loss of steam load from 102 percent of full power to show the adequacy of the pressure relieving devices of both the primary and secondary systems. The reactor is not tripped until conditions in the RCS result in a trip.

No credit is taken for steam dump or auxiliary feedwater to mitigate the consequences of the transient.

The turbine trip transients are analyzed by employing the detailed digital computer program RETRAN-02 (Reference 6). The program simulates the neutron kinetics, RCS, pressurizer, pressurizer relief and safety valves, pressurizer spray, steam generator, and steam generator safety valves. The program computes pertinent plant variables including temperatures, pressures, and power level.

Major assumptions are summarized below:

1. Initial operating conditions are assumed to be at their full power values adjusted for uncertainties.

2. Moderator and Doppler Coefficients of Reactivity - the turbine trip is analyzed with most positive reactivity feedback. The analysis assumes a most negative moderator density coefficient and the least negative Doppler temperature coefficient corresponding to beginning of core life.

3. Reactor Control - from the standpoint of the maximum pressures attained it is conservative to assume that the reactor is in manual control. If the reactor were in automatic control, the control rod banks would move prior to trip and reduce the severity of the transient.

4. Steam Release - no credit is taken for the operation of the steam dump system or steam generator power-operated relief valves. The steam generator pressure rises to the safety valve setpoint where steam release through safety valves limits secondary steam pressure.

5. Pressurizer Spray and Power-Operated Relief Valves:

a. Full penalty is taken for the effect of pressurizer spray and power-operated relief valves in reducing or limiting the coolant pressure in the maximum secondary system pressure case. Pressurizer pressure control prevents early reactor trip on high pressurizer pressure. Pressurizer safety valves are also available.

b. No credit is taken for the effect of pressurizer spray and power operated relief valves in reducing or limiting the coolant pressure in the maximum primary system pressure case.

Pressurizer safety valves are available. The safety valves are assumed to fully open when pressurizer pressure increases to 3% above nominal lift pressure.

6. Feedwater Flow - main feedwater flow to the steam generators is assumed to be lost at the time of turbine trip for both cases. No credit is taken for auxiliary feedwater flow since a stabilized plant condition will be reached before auxiliary feedwater initiation is normally assumed to occur. However, the auxiliary feedwater pumps would be expected to start on a 15.2 - 4 (13 APR 2020)

McGuire Nuclear Station UFSAR Chapter 15 trip of the main feedwater pumps. The auxiliary feedwater flow would remove core decay heat following plant stabilization.

7. Reactor trip is actuated by the first Reactor Protection System trip setpoint reached. Trip signals are expected due to high pressurizer pressure, overtemperature T, high pressurizer water level, and low-low steam generator water level. No credit is assumed in this analysis for a reactor trip due to a turbine trip.

8. The high pressurizer pressure trip is assumed to be at 2415 psig for the peak primary pressure case and 2415 psig for the peak secondary pressure case.

Plant characteristics and initial conditions are further discussed in Section 15.0 (see Table 15-4).

Except as discussed above, normal reactor coolant system and Engineered Safety Systems are not required to function. The maximum secondary system pressure case is presented in which pressurizer spray and power operated relief valves are assumed, but this is to delay reactor trip on high pressurizer pressure.

The Reactor Protection System may be required to function following a turbine trip. Pressurizer safety valves and/or steam generator safety valves may be required to open to maintain system pressures below allowable limits. No single active failure will prevent operation of any system required to function. A discussion of ATWS considerations is presented in Reference 2.

Results The transient response for a turbine trip from 102 percent of full power is presented for the maximum Main Steam System pressure case and the maximum primary system pressure case.

Since the transient response is virtually identical, except for the difference in primary pressure response for the two cases, the system response is presented for the maximum Main Steam System pressure case, and only the primary pressure response of the maximum primary system pressure case is presented. The calculated sequence of events for the accident is shown in Table 15-16.

Figure 15-27 through Figure 15-31 show the transient response following a turbine trip for the maximum Main Steam System pressure case. Full credit is taken for the pressurizer sprays and pressurizer power-operated relief valves. No credit is taken for the steam dump. The reactor is tripped by the OTT trip channel. The steam generator safety valves limit the Main Steam System pressure below 110 percent of the design value.

The transient response following a turbine trip for the maximum primary system pressure case is virtually identical as that presented for the maximum Main Steam System pressure case in Figure 15-27 through Figure 15-30, except for the primary system pressure response provided in Figure 15-31, The primary system pressure response for the maximum primary system pressure case is presented in Figure 15-32. No credit is taken for the pressurizer sprays and pressurizer power-operated relief valves. No credit is taken for the steam dump. The reactor is tripped by the high pressurizer pressure trip function. The steam generator safety valves limit the Main System pressure below 110 percent of the design value. The pressurizer safety valves limit the primary system pressure below 110 percent of the design value.

Reference 1 presents additional results of an analysis for a complete loss of heat sink including loss of main feedwater. This analysis shows the overpressure protection that is afforded by the pressurizer and steam generator safety valves.

(13 APR 2020) 15.2 - 5

UFSAR Chapter 15 McGuire Nuclear Station 15.2.3.3 Environmental Consequences The radiological consequences resulting from atmospheric steam dump will be less severe than the steamline break event analyzed in Section 15.1.5.3 since no fuel damage is postulated to occur.

15.2.3.4 Conclusions Results of the analyses, including those in Reference 1, show that the plant design is such that a turbine trip presents no hazard to the integrity of the RCS or the main steam system.

Pressure relieving devices incorporated in the two systems are adequate to limit the maximum pressures to within the design limits.

15.2.4 Inadvertent Closure of Main Steam Isolation Valves Inadvertent closure of the main steam isolation valves (MSIV) would result in a transient response similar to that of a turbine trip. The closure of the MSIVs would isolate a smaller volume of steam piping than a turbine trip, which would tend to cause a transient more severe than a turbine trip event. However, the longer closing time of the MSIVs, relative to the turbine stop valve closure time, offsets the effects of the smaller steam piping volume, and therefore the MSIV closure event is less severe than a turbine trip event. Turbine trips are discussed in Section 15.2.3.

15.2.5 Loss of Condenser Vacuum and Other Events Causing a Turbine Trip Loss of condenser vacuum is one of the events that can cause a turbine trip. Turbine trip initiating events are described in Section 10.2.2. A loss of condenser vacuum would preclude the use of steam dump to the condenser. However, since steam dump is assumed not to be available in the turbine trip analysis, no additional adverse effects would result if the turbine trip were caused by loss of condenser vacuum. Therefore, the analysis results and conclusions contained in Section 15.2.3 apply to loss of condenser vacuum. In addition, analyses for the other possible causes of a turbine trip, as listed in Section 10.2.2 are covered by Section 15.2.3. Possible overfrequency effects due to a turbine overspeed condition are discussed in Section 15.2.2.1 and are not a concern for this type of event.

15.2.6 Loss of Non-Emergency AC Power to the Station Auxiliaries 15.2.6.1 Identification of Causes and Accident Description A complete loss of non-emergency AC power may result in the loss of all power to the plant auxiliaries, i.e., the reactor coolant pumps, condensate pumps, etc. The loss of power may be caused by a complete loss of the offsite grid accompanied by a turbine generator trip at the station, or by a loss of the onsite AC distribution system.

The reactor will trip (1) upon reaching one of the trip setpoints in the primary and secondary systems as a result of the flow coastdown and decrease in secondary heat removal or (2) due to loss of power to the control rod drive mechanisms as a result of the loss of power to the plant.

Following a loss of AC power with turbine and reactor trips, the sequence described below will occur:

1. Plant vital instruments are supplied from emergency DC power sources.

15.2 - 6 (13 APR 2020)

McGuire Nuclear Station UFSAR Chapter 15

2. As the steam system pressure rises following the trip, the steam generator power-operated relief valves may be automatically opened to the atmosphere. The condenser is assumed not to be available for steam dump. If steam flow through the relief valves is not available, the steam generator safety valves may lift to dissipate the sensible heat of the fuel and coolant plus the residual decay heat produced in the reactor.

3. As the no load temperature is approached, the steam generator power-operated relief valves (or safety valves, if the relief valves are not available) are used to dissipate the residual decay heat and to maintain the plant at the hot shutdown condition.

4. The standby diesel generators, started on loss of voltage on the plant emergency busses, begin to supply plant vital loads.

The Auxiliary Feedwater System is started automatically as discussed in Section 10.4.10.2.

Upon the loss of power to the reactor coolant pumps, coolant flow necessary for core cooling and the removal of residual heat is maintained by natural circulation in the reactor coolant loops.

A loss of AC power to the plant auxiliaries as postulated above could result in a loss of normal feedwater if the condensate pumps lose their power supply.

The loss of non-emergency AC power analysis has a loss of all feedwater, RCS flow coastdown and reactor trip signals from loss of power to the RCCA's or any of the primary coolant flow trips within 1.5 seconds of the initiating event.

The RCS flow coastdown subsequent to the loss of non-emergency AC power is computed using the same methodology as the loss of flow transients in Section 15.3. Figure 15-213 shows core flow predicted during the loss of non-emergency AC power transient.

Following the reactor coolant pump coastdown caused by the loss of AC power, the natural circulation capability of the RCS will remove residual and decay heat from the core, aided by auxiliary feedwater in the secondary system. The analysis presented here shows that the natural circulation flow in the RCS following a loss of AC power event is sufficient to remove residual heat from the core.

A loss of non-emergency AC power to the station auxiliaries is classified as an ANS Condition II event, a fault of moderate frequency. See Section 15.0 for a discussion of Condition II events.

15.2.6.2 Analysis of Effects and Consequences Method of Analysis A detailed analysis using the RETRAN-02 Code (Reference 6) is performed to obtain the natural circulation flow following a loss of offsite power. The simulation describes the plant thermal kinetics, Reactor Coolant System (RCS) including natural circulation, the pressurizer, steam generators and feedwater system. The digital program computes pertinent variables including the steam generator level, pressurizer water level, and reactor coolant average temperature.

The assumptions used in the analysis are as follows:

1. The plant is initially operating at 102 percent of nominal power.

2. Core residual heat generation is based on the 1979 version of ANS-5.1 (Reference 5).

ANSI/ANS-5.1-1979 is a conservative representation of the decay energy release rates.

3. Control rod motion is assumed to occur within 0.5 sec of the loss of offsite power.

(13 APR 2020) 15.2 - 7

UFSAR Chapter 15 McGuire Nuclear Station

4. The worst single failure is assumed to be the turbine-driven auxiliary feedwater pump. The minimum amount of auxiliary feedwater delivered to the steam generators is a function of steam generator pressure.

5. Secondary system steam relief is achieved through the steam generator safety valves.

6. 5% of the tubes in each steam generator were assumed to be plugged.

Power is assumed to be lost to the reactor coolant pumps at the time of reactor trip.

Plant characteristics and initial conditions are further discussed in Section 15.0 (see Table 15-4).

Results The transient response of the RCS following a loss of AC power is shown in Figure 15-35 through Figure 15-37, Figure 15-212 and Figure 15-213. The calculated sequence of events for this transient is given in Table 15-16.

The first few seconds after the loss of power to the reactor coolant pumps will closely resemble a simulation of the complete loss of flow incident (see Section 15.3.2), i.e., core damage due to rapidly increasing core temperatures is prevented by promptly tripping the reactor. After the reactor trip, stored and residual decay heat must be removed to prevent damage to either the RCS or the core.

The RETRAN-02 code results show that the natural circulation flow available is sufficient to provide adequate core decay heat removal following reactor trip and reactor coolant pump coastdown.

15.2.6.3 Environmental Consequences Since steam dump to the condenser is assumed to be lost, heat removal from the secondary system would occur through the steam generator power-operated relief valves or safety valves.

Since no fuel damage is postulated to occur, radiological consequences resulting from this transient would be less severe than the steamline break accident analyzed in Section 15.1.5.3.

15.2.6.4 Conclusions Analysis of the natural circulation capability of the Reactor Coolant System has demonstrated that sufficient heat removal capability exists following reactor coolant pump coastdown to prevent fuel or clad damage.

15.2.7 Loss of Normal Feedwater Flow 15.2.7.1 Identification of Causes and Accident Description A loss of normal feedwater (from pump failures, valve malfunctions, or loss of offsite AC power) results in a reduction in capability of the secondary system to remove the heat generated in the reactor core. If an alternative supply of feedwater were not supplied to the plant, core residual heat following reactor trip could heat the primary system water to the point where water relief from the pressurizer would occur, resulting in a substantial loss of water from the Reactor Coolant System (RCS). Additionally, the RCS heatup associated with the loss of normal feedwater could bring the plant closer to a DNB condition.

The following occur upon loss of normal feedwater (assuming main feedwater pump failures or valve malfunctions):

15.2 - 8 (13 APR 2020)

McGuire Nuclear Station UFSAR Chapter 15

1. As the steam system pressure rises following the trip, the steam generator power-operated relief valves and the steam generator safety valves lift to dissipate the sensible heat of the fuel and coolant plus the residual decay heat produced in the reactor. Steam dump to the condenser is assumed to be unavailable.

2. As the no load temperature is approached, the steam generator power-operated relief valves and safety valve are used to dissipate the residual decay heat and to maintain the plant at the hot shutdown condition.

The reactor trip on low-low narrow range level in any steam generator provides the necessary protection against a loss of normal feedwater.

The Auxiliary Feedwater System is started automatically as discussed in Section 10.4.10.2. The turbine-driven auxiliary feedwater pump utilizes steam from the secondary system and exhausts to the atmosphere. The motor-driven auxiliary feedwater pumps are supplied by power from the diesel generators.

An analysis of the system transient is presented below to show that DNB does not occur following a loss of normal feedwater, and that the Auxiliary Feedwater System is capable of removing the stored and residual heat, thus preventing either overpressurization of the RCS or loss of water from the reactor core, and returning the plant to a stabilized condition.

A loss of normal feedwater is classified as an ANS Condition II event, a fault of moderate frequency. See Section 15.0 for a discussion of Condition II events. A discussion of ATWS considerations is presented in Reference 2.

15.2.7.2 Analysis of Effects and Consequences Method of Analysis A detailed analysis using the RETRAN-02 Code (Reference 6) is performed in order to obtain the plant transient following a loss of normal feedwater. The simulation describes the plant thermal kinetics, RCS, pressurizer, steam generators and feedwater system. The digital program computes pertinent variables including the steam generator level, pressurizer water level, and reactor coolant average temperature.

The loss of normal feedwater analysis consists of a short-term core cooling (DNBR) analysis and a long-term core cooling analysis to demonstrate the capability of the Auxiliary Feedwater System to remove stored and residual heat.

Short-Term Core Cooling Analysis The short-term core cooling analysis consists of a RETRAN-02 (Reference 6) plant transient simulation and a VIPRE-01 (Reference 7) core thermal-hydraulic analysis using the Statistical Core Design Methodology as described in Reference 8. Utilizing the WRB-2M critical heat flux correlation for Westinghouse RFA fuel (Reference 11), the VIPRE-01 code calculates the DNBR during the transient based on the RETRAN-02 boundary conditions. The system response is calculated based on the following assumptions:

1. The plant is initially operating at 3469 MWth. Pressure, flow, and RCS temperatures are assumed to be at their nominal full power values. Uncertainties in initial conditions are included in the limit DNBR as described in Reference 8.

2. A most-positive Doppler temperature coefficient is used.

3. A least-negative moderator temperature coefficient is assumed to conservatively minimize negative feedback due to coolant heatup.

(13 APR 2020) 15.2 - 9

UFSAR Chapter 15 McGuire Nuclear Station

4. Reactor trip occurs on the steam generator low-low level trip setpoint, assumed to be 2.7%

narrow range.

5. The pressurizer power-operated relief and safety valves are assumed to function normally to minimize the RCS pressure increase during the transient. Pressurizer spray is not credited since a sensitivity study has shown that the power-operated relief valves alone will result in minimum RCS pressure.

6. No credit is taken for auxiliary feedwater actuation after the low-low steam generator level setpoint is reached due to the short duration of the transient.

7. Secondary system steam relief is achieved through the steam generator safety valves which are conservatively modeled such that maximum RCS coolant temperature is achieved.

8. 5% of the tubes in each steam generator are assumed to be plugged.

Table 15-4 summarizes input parameters and initial conditions used.

Long-Term Core Cooling Analysis The long-term core cooling analysis is performed to demonstrate the adequacy of the Reactor Protection and Engineered Safeguards System (e.g., the Auxiliary Feedwater System) in removing long-term decay heat and preventing excessive heatup of the RCS with possible boiling. As such, the assumptions used in this analysis are designed to minimize the energy removal capability of the system. The long-term analysis is performed using the RETRAN-02 computer code based on the following assumptions:

1. The plant is initially operating at 102 percent of rated thermal power. Parameter uncertainties are applied directly to pressurizer pressure, pressurizer level, flow, and RCS temperature initial conditions in the conservative direction.

2. A least-negative Doppler temperature coefficient is used.

3. A least-negative moderator temperature coefficient is assumed to conservatively minimize negative feedback due to coolant heatup.

4. Core decay heat is based on the 1979 version of ANS-5.1 (Reference 5) plus 2 uncertainty.

5. Reactor trip occurs on the steam generator low-low level trip setpoint, assumed to be a 2.7% narrow range.

6. The pressurizer spray, power-operated relief valves, and safety valves are assumed to function normally to minimize the RCS pressure increase during the transient.

7. The worst single failure is assumed to be the turbine-driven auxiliary feedwater pump to minimize the auxiliary feedwater to be delivered to the steam generators.

8. A delay time of 60 seconds is assumed for the auxiliary feedwater actuation after the low-low steam generator level setpoint is reached.

9. There is no purge volume of hot main feedwater to be delivered prior to the cold auxiliary feedwater for the McGuire units. However, since the analysis is performed to bound both McGuire units and Catawba Unit 1, a purge volume of hot main feedwater characteristic of Catawba is modeled in the analysis.

10. Secondary system steam relief is achieved through the steam generator safety valves which are conservatively modeled such that maximum RCS coolant temperature is achieved.

11. The assumed steam generator tube plugging level is 5%.

15.2 - 10 (13 APR 2020)

McGuire Nuclear Station UFSAR Chapter 15 Table 15-4 summarizes input parameters and initial conditions used.

Results Short-Term Core Cooling Analysis Figures15-261 through 15-268 show the significant plant parameters for the short-term core cooling analysis. The sequence of events is given in Table 15-16. A loss of main feedwater flow initiates the transient. The Reactor Coolant System temperatures (Figure 15-265) increase gradually due to the secondary side heatup before the reactor trips. As the temperature increases, the reactor coolant expands and surges into the pressurizer causing the level to increase (Figure 15-264). Pressurizer pressure (Figure 15-263) increases until the PORV lift setpoints are reached. Pressurizer pressure then cycles with the opening and closing of the PORVs until after the reactor trips. The loss of main feedwater results in a decrease in the steam generator liquid inventory and level (Figure 15-266). The level decreases to the low-low level trip setpoint causing the reactor to trip. Prior to reactor trip neutron power (Figure 15-261) decreases slightly due to moderator and Doppler feedback. After the reactor trips neutron power decreases quickly, and RCS temperatures, pressurizer level, and pressure all decrease. The steam line pressure (Figure 15-262) increases steadily due to the loss of subcooled feedwater flow and a resulting increase in the conversion of steam generator liquid inventory to steam.

After the turbine trips, the steam line pressure increases immediately and causes several main steam safety valves to open.

The minimum transient DNBR is shown in Figure 15-268 for RFA fuel. The result is greater than the statistical core design (SCD) design DNBR limits of 1.45 when using the WRB-2M correlation.

Long-Term Core Cooling Analysis Figures 15-38 and 15-39 show the significant plant parameters following a loss of normal feedwater. The calculated sequence of events for this analysis is listed in Table 15-16. Before auxiliary feedwater flow starts, the plant response is similar to the short-term analysis. After auxiliary feedwater flow starts, the MSSV banks cycle and cause oscillations in the steam line pressure (Figure 15-39, Part 1 of 2). The pressurizer pressure, pressurizer level, and cold and hot leg temperatures (Figure 15-38) trend the steam line pressure until the end of the simulation. After the reactor and turbine trip, the steam generator inventory continues to deplete due to the post-trip boil of dissipating the stored energy and decay heat. The auxiliary feedwater flow matches the decay heat and pump heat and the steam generator inventory stabilizes at approximately 1749 seconds.

In conclusion, the long-term core cooling analysis has shown that the Auxiliary Feedwater System can mitigate the event and return the plant to a stabilized condition. Therefore, the long-term cooling capability for the loss of normal feedwater event has been demonstrated.

As shown in Figure 15-38 and Figure 15-39, the plant approaches a stabilized condition following reactor trip and auxiliary feedwater initiation. Plant procedures may be followed to further cool down the plant.

15.2.7.3 Environmental Consequences Since steam dump to the condenser is assumed to be lost, heat removal from the secondary system would occur through the steam generator power-operated relief valves or safety valves.

Since no fuel damage is postulated to occur, radiological consequences resulting from this transient would be less severe than the steamline break accident analyzed in Section 15.1.5.3.

(13 APR 2020) 15.2 - 11

UFSAR Chapter 15 McGuire Nuclear Station 15.2.7.4 Conclusions Results of the analysis show that a loss of normal feedwater transient will not result in DNB and that the Auxiliary Feedwater System is capable of returning the plant to a stabilized condition.

15.2.8 Feedwater System Pipe Break 15.2.8.1 Identification of Causes and Accident Description A major feedwater line rupture is defined as a break in a feedwater line large enough to prevent the addition of sufficient feedwater to the steam generators to maintain shell side fluid inventory in the steam generators. If the break is postulated in a feedline between the check valve and the steam generator, fluid from the steam generator may also be discharged through the break.

Further, a break in this location could preclude the subsequent addition of auxiliary feedwater to the affected steam generator. (A break upstream of the feedline check valve would affect the Nuclear Steam Supply System only as a loss of feedwater. This case is covered by the evaluation in Section 15.2.7).

Depending upon the size of the break and the plant operating conditions at the time of the break, the break could cause either a RCS cooldown (by excessive energy discharge through the break) or a RCS heatup. Potential RCS cooldown resulting from a secondary pipe rupture is evaluated in Section 15.1.5. Therefore, only the RCS heatup effects are evaluated for a feedwater line rupture.

A feedwater line rupture reduces the ability to remove heat generated by the core from the RCS for the following reasons:

1. Feedwater flow to the steam generators is reduced. Since feedwater is subcooled, its loss may cause reactor coolant temperatures to increase prior to reactor trip.

2. Fluid in the steam generator may be discharged through the break, and would then not be available for decay heat removal after trip.

3. The break may be large enough to prevent the addition of any main feedwater after trip.

An Auxiliary Feedwater System is provided to ensure that adequate feedwater will be available such that:

1. No substantial overpressurization of the RCS shall occur.

2. Sufficient liquid in the RCS shall be maintained in order to provide adequate decay heat removal.

Section 10.4.10 contains a description of the Auxiliary Feedwater System interfaces.

The severity of the feedwater line rupture transient depends on a number of system parameters including break size, initial reactor power, and credit taken for the functioning of various control and safety systems. A number of cases of feedwater line break have been analyzed. Based on these analyses, it has been shown that the most limiting feedwater line ruptures are the double ended rupture of the largest feedwater line with no credit taken for the heaters or the pressurizer power-operated relief valves. This case is analyzed below.

The following provides the necessary protection for a main feedwater rupture:

1. A reactor trip on any of the following conditions:

a. High pressurizer pressure.

b. Overtemperature T.

15.2 - 12 (13 APR 2020)

McGuire Nuclear Station UFSAR Chapter 15

c. Low-low narrow range level in any steam generator.

d. Safety injection signal from 2/3 high containment pressure.

(Chapter 7 contains a description of the actuation system).

2. An Auxiliary Feedwater System to provide an assured source of feedwater to the steam generators for decay heat removal. (Section 10.4.10.2 contains a description of the Auxiliary Feedwater System).

A major feedwater line rupture is classified as an ANS Condition IV event, a limiting fault. See Section 15.0 for a discussion of Condition IV events.

15.2.8.2 Analysis of Effects and Consequences Method of Analysis - Short Term Cooling Capability The short term core cooling (DNB) analysis is performed with the VIPRE-01 computer code (Reference 7) using the Statistical Core Design (SCD) methodology described in Reference 8.

Following the methodology outlined in Reference 9, the DNB analysis for the feedwater system pipe break accident is performed by modeling a complete loss of flow event (Section 15.3.2) initiated from an off-normal temperature condition due to a heatup from a feedwater system pipe break. The maximum amount of heatup prior to reactor trip is limited by the OTT reactor trip function, which is conservatively assumed in the analysis along with the flow coastdown associated with the loss of offsite power. No credit is taken for a reactor trip due to a high containment pressure safety injection actuation or the steam generator low-low narrow range reactor trip for the DNB analysis.

Method of Analysis - Long Term Cooling Capability A detailed analysis using the RETRAN-02 Code (Reference 6) is performed in order to determine the plant transient following a feedwater line rupture. The code models the plant thermal kinetics, RCS including natural circulation, pressurizer, steam generators and feedwater system, and computes pertinent variables including the pressurizer pressure, pressurizer water level, and reactor coolant average temperature.

The cases analyzed assume a double ended rupture of the largest feedwater pipe at full power.

Major assumptions made in the long-term core cooling analysis (case 1) are as follows:

1. The plant is initially operating at 102 percent of the NSSS power rating.

2. Initial reactor coolant average temperature is 4.0°F above the nominal value, and the initial pressurizer pressure is 42 psi below its nominal value.

3. No credit is taken for the pressurizer heaters or the power-operated relief valves.

Pressurizer spray is assumed operable.

4. Initial pressurizer level is at the nominal programmed value minus 9 percent; initial steam generator water level is at the nominal value minus 8.0 percent.

5. No credit is taken for the high pressurizer pressure reactor trip.

6. Main feedwater flow to all steam generators is assumed to be lost at the time the break occurs (all main feedwater spills out through the break).

7. The worst possible break area is assumed. This maximizes the blowdown discharge rate following the time of trip, which maximizes the resultant heatup of the reactor coolant.

(13 APR 2020) 15.2 - 13

UFSAR Chapter 15 McGuire Nuclear Station

8. The flow exiting the steam generator through the break is determined using the Moody (saturated) and Extended Henry (subcooled) correlations for choked flow.

9. Reactor trip is assumed to be initiated on high containment pressure safety injection.

10. The Auxiliary Feedwater System is actuated by the high containment pressure safety injection signal. A minimum amount of auxiliary feedwater delivered to the intact steam generators is a function of the individual generator pressures. The faulted SG assumes no auxiliary feedwater enters it (auxiliary feedwater exits the steam generator through the feedring prior to removing any primary system energy). However, the auxiliary feedwater flow injected to the generator receiving flow from the same auxiliary feedwater pump is appropriately penalized for the increased flow to the faulted generator until the faulted generator is isolated. The faulted generator is assumed isolated at 30 minutes into the transient.

11. No credit is taken for charging or letdown.

12. Core residual heat generation is assumed based upon the 1979 version of ANS-5.1 (Reference 5). ANSI/ANS-5.1-1979 is a conservative representation of the decay energy release rates.

13. No credit is taken for the following potential protection logic signals to mitigate the consequences of the accident:

a. High pressurizer pressure.

b. Overtemperature T.

c. High pressurizer level.

14. 5% of the tubes in each steam generator were assumed to be plugged.

15. Safety injection actuation occurs upon the receipt of a high containment pressure signal.

The amount of safety injection flow delivered to the Reactor Coolant System is a function of RCS pressure. Safety injection is terminated by procedure with a conservatively short operator response time. Main steam isolation is assumed to occur coincident with turbine trip.

16. A loss of offsite power is assumed coincident with reactor trip. The LOOP results in the reactor coolant pumps coasting down.

17. Emergency operating procedures following a secondary system line rupture call for the isolation of feedwater flow spilling out the break of the ruptured steam generator and to isolate the faulted generator.

Safety injection pumps are stopped if:

a. RCS pressure is stable or increasing,

b. Pressurizer water level is on span,

c. The RCS is adequately subcooled, and

d. Steam generator narrow range level indication exists in at least one steam generator or sufficient auxiliary feedwater is being injected into the steam generators to provide an adequate heat sink.

Subsequent to recovery of level in the intact steam generators, the plant operating procedures will be followed in cooling the plant to hot shutdown conditions.

15.2 - 14 (13 APR 2020)

McGuire Nuclear Station UFSAR Chapter 15 Plant characteristics and initial conditions are further discussed in Section 15.0 (see Table 15-4).

No reactor control systems are assumed to function. The Reactor Protection System is required to function following a feedwater line rupture as analyzed here. No single active failure will prevent operation of this system. A discussion of ATWS considerations is presented in Reference 2.

The engineered safety systems assumed to function are the Auxiliary Feedwater System and the Safety Injection System. For the Auxiliary Feedwater System, the worst case configuration has been used, i.e., the turbine-driven auxiliary feedwater pump has been assumed to fail. Only one train of safety injection has been assumed to be available. A detailed description and analysis of the Safety Injection System is provided in Section 6.3. The Auxiliary Feedwater System is described in Section 10.4.10.

Following the trip of the reactor coolant pumps there will be a flow coastdown until flow in the loops reaches the natural circulation value. The natural circulation capability of the RCS has been shown in Section 15.2.6, for the loss of non-emergency AC power transient, to be sufficient to remove core decay heat following reactor trip. Pump coastdown characteristics are demonstrated in Section 15.3.2 for multiple reactor coolant pump trips.

Results The short term core cooling (DNB) capability is maintained as the MDNBR of 1.648 is well above the design DNBR limit (DDL) of 1.45 for RFA fuel.

For the long term core cooling analysis, the calculated plant parameters following a major feedwater line rupture are shown in Figure 15-40 through Figure 15-46. These figures depict the long-term core cooling analysis, for which the calculated sequence of events is given in Table 15-16.

The hot leg temperatures are shown in Figure 15-42. This figure illustrates the amount of margin to hot leg boiling, which is a precursor to loss of long-term core cooling. As shown, there is approximately 35°F of margin to the saturation temperature.

Pressurizer pressure and level are shown in Figure 15-40 and 15-43. Pressurizer pressure initially decreases post-break as the secondary system depressurizes. Upon reactor trip, there is a brief pressure spike associated with the increased secondary pressures (Figure 15-45). As the faulted generator continues blowing down, pressurizer pressure rapidly decreases. Once dryout occurs in the faulted generator, pressurizer pressure begins to increase as the RCS heats up and coolant surges into the pressurizer. The pressure rise is terminated as the pressurizer level increase begins to subside. Subsequently, both pressure and level decrease gradually as the RCS cools down over the remainder of the transient.

Figure 15-45 shows that the Main Steam System pressure in the intact generators holding fairly steady near the safety valve lift setpoint, well below 110 percent of the design pressure.

The short term core cooling (DNB) capability has been demonstrated, thus ensuring the integrity of the core is maintained in the short term. The adequacy of the auxiliary feedwater system to remove decay heat, as shown by Figure 15-42, ensures the integrity of the core in the long term.

15.2.8.3 Environmental Consequences No fuel failure following any main feedwater line break scenario is predicted. The activity in the reactor coolant for this accident would be the pre-existent activity up to the limits allowed by the (13 APR 2020) 15.2 - 15

UFSAR Chapter 15 McGuire Nuclear Station technical specifications, and amplified by either a pre-existent iodine spike or a concurrent iodine spike. The radiological consequences of a main feedwater line break would not exceed the corresponding radiological consequences of a main steam line break, analyzed as reported in UFSAR 15.1.5.3.

15.2.8.4 Conclusions Results of the analyses show that for the postulated feedwater line rupture, the assumed Auxiliary Feedwater System capacity is adequate to remove decay heat and to prevent uncovering the reactor core and that fuel integrity is maintained. Radioactivity doses from the postulated feedwater line rupture are bounded by those previously presented for the postulated steam line break. All applicable acceptance criteria are therefore met.

15.2.9 References

1. Mangan, M. A., Overpressure Protection for Westinghouse Pressurized Water Reactors, WCAP-7769, October 1971.

2. Letter (NS-TMA-2182) from T.M. Anderson (Westinghouse) to S.H. Hanauer (NRC) dated December 30, 1979.

3. Deleted Per 1998 Update

4. Deleted Per 1998 Update

5. ANSI/ANS-5-1-1979, American National Standard for Decay Heat in Light Water Reactors, August, 1979.

6. EPRI, "RETRAN-02: A Program for Transient Thermal-Hydraulic Analysis of Complex Fluid Flow Systems", EPRI NP-1850-CCM, Revision 6.1, June 2007.

7. EPRI, "VIPRE-01: A Thermal-Hydraulic Code for Reactor Cores:, EPRI NP-2511-CCM-A, Revision 4.2, June 2007.

8. "Duke Power Company Thermal-Hydraulic Statistical Core Design Methodology",

DPC-NE-2005P-A, Rev. 4a, December 2008.

9. "UFSAR Chapter 15 System Transient Analysis Methodology," DPC-NE-3002-A, Duke Power Company, Revision 4a, April 2009.

10. Deleted Per 2006 Update.

11. Modified WRB-2 Correlation, WRB-2M, for Predicting Critical Heat Flux in 17x17 Rod Bundles with Modified LPD Mixing Vane Grids, WCAP-15025-P, February 1998.

THIS IS THE LAST PAGE OF THE TEXT SECTION 15.2.

15.2 - 16 (13 APR 2020)

McGuire Nuclear Station UFSAR Chapter 15 15.3 Decrease in Reactor Coolant System Flow Rate A number of events have been postulated which could result in a decrease in Reactor Coolant System flow rate. Detailed analyses are presented for several such events which have been identified as limiting cases.

Discussions of the following events are presented in this section:

1. Partial loss of forced Reactor Coolant flow

2. Complete loss of forced Reactor Coolant flow

3. Reactor Coolant Pump shaft seizure (locked rotor)

4. Reactor Coolant Pump shaft break Items 1 and 2 above are considered to be ANS Condition II events, and items 3 and 4 ANS Condition IV events. Section 15.0 contains a discussion of ANS classifications and applicable acceptance criteria.

15.3.1 Partial Loss of Forced Reactor Coolant Flow 15.3.1.1 Identification of Causes and Accident Description A partial loss of coolant flow accident can result from a mechanical or electrical failure in a reactor coolant pump, or from a fault in the power supply to the pump or pumps supplied by a reactor coolant pump bus. If the reactor is at power at the time of the accident, the immediate effect of loss of coolant flow is a rapid increase in the coolant temperature. This increase could result in DNB with subsequent fuel damage if the reactor is not tripped promptly.

Normal power for the pumps is supplied through individual buses connected to the generator and the offsite power system. When a generator trip occurs, the buses continue to be supplied from external power lines, and the pumps continue to circulate coolant through the core.

The necessary protection against a partial loss of coolant flow accident is provided by the low primary coolant flow reactor trip signal which is actuated in any reactor coolant loop by two out of three low flow signals. Above Permissive 8 (Refer to Table 7-2 for a discussion of permissives.), low flow in any loop will actuate a reactor trip. Between approximately 10 percent power (Permissive 7) and the power level corresponding to Permissive 8, low flow in any two loops will actuate a reactor trip. Above Permissive 7, two or more reactor coolant pump circuit breakers opening will actuate the corresponding undervoltage relays. This results in a reactor trip which serves as a backup to the low flow trip.

A partial loss of forced reactor coolant flow is classified as an ANS Condition II event, a fault of moderate frequency. See Section 15.0 for a discussion of Condition II events.

15.3.1.2 Analysis of Effects and Consequences Method of Analysis The loss of one pump with four loops in operation has been analyzed.

This transient is analyzed by two digital computer codes. First, the RETRAN-02 Code (Reference 1) is used to calculate the loop and core flow during the transient, the time of reactor trip based on the calculated flows, the nuclear power, heat flux, and the primary system pressure and temperature transients. Utilizing the WRB-2M heat flux correlation for (13 APR 2020) 15.3 - 1

UFSAR Chapter 15 McGuire Nuclear Station Westinghouse RFA fuel (Reference 6), the VIPRE-01 Code (Reference 2) is used to calculate the DNBR during the transient based on the RETRAN-02 boundary conditions.

This accident is analyzed with the Statistical Core Design Methodology as described in Reference 4. Plant characteristics and initial conditions are discussed in Section 15.0.

Initial Conditions Initial reactor power, pressure, flow, and RCS temperature are assumed to be at their nominal values. Uncertainties in initial conditions are included in the limit DNBR as described in Reference 9 (see Table 15-4).

Reactivity Coefficients A least negative Doppler temperature coefficient is used.

The least negative moderator temperature coefficient is assumed since this results in the maximum core power during the initial part of the transient when the minimum DNBR is reached.

Flow Coastdown The flow coastdown calculated by RETRAN-02 is based on a momentum balance around each reactor coolant loop and across the reactor core. This momentum balance is combined with the continuity equation, a pump momentum balance and the pump characteristics and is based on high estimates of system pressure losses. The conservatism of the calculated flow coastdown is confirmed by comparison with the startup test data of the McGuire units.

Results Figure 15-51 through Figure 15-54 and Figure 15-269 show the transient response for the loss of one reactor coolant pump with four loops in operation. Figure 15-269 shows the DNBR to be always greater than the limit value (Reference 9).

Since DNB does not occur, the ability of the primary coolant to remove heat from the fuel rod is not greatly reduced. Thus, the average fuel and clad temperatures do not increase significantly above their respective initial values.

The calculated sequence of events tables for the case analyzed is shown on Table 15-17. The affected reactor coolant pump will continue to coast down, and the core flow will reach a new equilibrium value corresponding to the number of pumps still in operation. With the reactor tripped, a stable plant condition will eventually be attained. Normal plant shutdown may then proceed.

15.3.1.3 Environmental Consequences A partial loss of reactor coolant flow from full load would result in a reactor and turbine trip.

Assuming that the condenser is not available, atmospheric steam dump may be required. The radiological consequences resulting from atmospheric steam dump would be less severe than the steamline break event analyzed in Section 15.1.5 since fuel damage as a result of this transient is not postulated.

15.3.1.4 Conclusions The analysis shows that the DNBR will not decrease below the limit value at any time during the transient. Thus, no fuel or clad damage is predicted, and all applicable acceptance criteria are met.

15.3 - 2 (13 APR 2020)

McGuire Nuclear Station UFSAR Chapter 15 15.3.2 Complete Loss of Forced Reactor Coolant Flow 15.3.2.1 Identification of Causes and Accident Description A complete loss of forced reactor coolant flow may result from a simultaneous loss of electrical supplies to all reactor coolant pumps. If the reactor is at power at the time of the accident, the immediate effect of loss of coolant flow is a rapid increase in the coolant temperature. This increase could result in DNB with subsequent fuel damage if the reactor were not tripped promptly.

Normal power for the reactor coolant pumps is supplied through buses from a transformer connected to the generator and through the offsite power system. Each pump is on a separate bus. When a generator trip occurs the buses continue to be supplied from external power lines and the pumps continue to supply coolant flow to the core.

The following signals provide the necessary protection against a complete loss of flow accident:

1. Reactor coolant pump power supply undervoltage or underfrequency.

2. Low reactor coolant loop flow.

The reactor trip on reactor coolant pump undervoltage is provided to protect against conditions which can cause a loss of voltage to all reactor coolant pumps, i.e., loss of offsite power. This function is blocked below approximately 10 percent power (Permissive 7).

The reactor trip on reactor coolant pump underfrequency is provided to trip the reactor for an underfrequency condition, resulting from frequency disturbances on the power grid. Since the underfrequency case is bounded by the undervoltage case, only the complete loss of flow due to reactor coolant pump undervoltage analysis is presented.

The reactor trip on low primary coolant loop flow is provided to protect against loss of flow conditions which affect only one reactor coolant loop. This function is generated by two out of three low flow signals per reactor coolant loop. Above Permissive 8, low flow in any loop will actuate a reactor trip. Between approximately 10 percent power (Permissive 7) and the power level corresponding to Permissive 8, low flow in any two loops will actuate a reactor trip.

A complete loss of forced reactor coolant flow is classified as an ANS Condition III event, an infrequent fault. See Section 15.0 for a discussion of Condition III events.

15.3.2.2 Analysis of Effects and Consequences The loss of four pumps with four loops in operation has been analyzed.

This transient is analyzed by two digital computer codes. The system thermal-hydraulic analysis is performed using RETRAN-02 (Reference 1). RETRAN-02 calculates the core inlet flow, core inlet temperature, core exit pressure and core average heat flux during the transient.

Utilizing the WRB-2M correlation for the Westinghouse RFA fuel (Reference 6), the VIPRE-01 code (Reference 2) is then used to calculate the transient DNBR based on the RETRAN-02 boundary conditions.

The method of analysis and the assumptions made regarding initial operating conditions and reactivity coefficients are identical to those discussed in Section 15.3.1 (see Table 15-4), except that following the loss of power supply to all pumps at power, a reactor trip is actuated by either reactor coolant pump power supply undervoltage or underfrequency.

Results (13 APR 2020) 15.3 - 3

UFSAR Chapter 15 McGuire Nuclear Station Figure 15-56 through Figure 15-60 and Figure 15-270 show the transient response for the loss of power to all reactor coolant pumps with four loops in operation. The reactor is assumed to be tripped on an undervoltage signal. Figure 15-270 shows the DNBR to be always greater than the limit value (Reference 9).

Since DNB does not occur, the ability of the primary coolant to remove heat from the fuel rod is not greatly reduced. Thus, the average fuel and clad temperatures do not increase significantly above their respective initial values.

The calculated sequence of events is shown on Table 15-17. The reactor coolant pumps will continue to coast down, and natural circulation flow will eventually be established, as demonstrated in Section 15.2.6. With the reactor tripped, a stable plant condition would be attained. Normal plant shutdown may then proceed.

15.3.2.3 Environmental Consequences A complete loss of reactor coolant flow from full load results in a reactor and turbine trip.

Assuming that the condenser is not available, atmospheric steam dump would be required. The quantity of steam released would be the same as for a loss of offsite power. Since fuel damage is not postulated, the radiological consequences resulting from atmospheric steam dump would be less severe than the steamline break analyzed in Section 15.1.5.

15.3.2.4 Conclusions The analysis performed has demonstrated that for the complete loss of forced reactor coolant flow, the DNBR does not decrease below the limit value at any time during the transient. Thus, no fuel or clad damage is predicted, and all applicable acceptance criteria are met.

15.3.3 Reactor Coolant Pump Shaft Seizure (Locked Rotor) 15.3.3.1 Identification of Causes and Accident Description The accident postulated is an instantaneous seizure of a reactor coolant pump rotor such as is discussed in Section 5.5.1.3.5. Flow through the affected reactor coolant loop is rapidly reduced, leading to an initiation of a reactor trip on a low flow signal.

Following initiation of the reactor trip, heat stored in the fuel rods continues to be transferred to the coolant causing the coolant to expand. At the same time, heat transfer to the shell side of the steam generators is reduced, first because the reduced flow results in a decreased tube side film coefficient and then because the reactor coolant in the tubes cools down while the shell side temperature increases (turbine steam flow is reduced to zero upon plant trip). The rapid expansion of the coolant in the reactor core, combined with reduced heat transfer in the steam generators, causes an insurge into the pressurizer and a pressure increase throughout the Reactor Coolant System. The insurge into the pressurizer compresses the steam volume, actuates the automatic spray system, opens the power-operated relief valves, and opens the pressurizer safety valves, in that sequence. The three power-operated relief valves are designed for reliable operation and would be expected to function properly during the accident.

However, for conservatism, their pressure reducing effect as well as the pressure reducing effect of the spray is not included in the analysis.

A reactor coolant pump shaft seizure is classified as an ANS Condition IV event, a limiting fault.

See Section 15.0 for a discussion of Condition IV events.

15.3 - 4 (13 APR 2020)

McGuire Nuclear Station UFSAR Chapter 15 15.3.3.2 Analysis of Effects and Consequences The reactor coolant pump shaft seizure transient has been analyzed for one loop seized with four loops in operation.

Method of Analysis Two digital computer codes are used to analyze this transient. The RETRAN-02 Code (Reference 1) is used to calculate the resulting loop and core flow transients following the pump seizure, the time of reactor trip based on the loop flow transients, the nuclear power following reactor trip, and the peak pressure. The thermal behavior of the fuel located at the core hot spot is investigated using the VIPRE-01 Code (Reference 2), which uses the core flow, core inlet temperature, core exit pressure and nuclear power calculated by RETRAN-02.

Evaluation of the Pressure Transient At the beginning of the postulated locked rotor accident, i.e., at the time the shaft in one of the reactor coolant pumps is assumed to seize, the plant is assumed to be in operation under the most adverse steady state operating condition, i.e., maximum guaranteed steady state thermal power, maximum steady state pressure, and maximum steady state coolant average temperature. Plant characteristics and initial conditions are further discussed in Section 15.0 (see Table 15-4).

For the peak pressure evaluation, the initial pressure is conservatively estimated as 60 psi above the nominal pressure of 2250 psia to allow for errors in the pressurizer pressure measurement and control channels and for operator action to establish elevated pressure during pressurizer boron concentration equalization. This is done to obtain the highest possible rise in the coolant pressure during the transient.

After pump seizure, the neutron flux is rapidly reduced by control rod insertion. Rod motion is assumed to begin one second after the flow in the affected loop reaches 83.5 percent of nominal flow. No credit is taken for the pressure reducing effect of the pressurizer relief valves, pressurizer spray, steam dump or controlled feedwater flow after plant trip. Although these operations are expected to occur and would result in a lower peak pressure, an additional degree of conservatism is provided by ignoring their effect. The pressurizer safety valves pop open at a pressure that is 3% above the nominal lift setpoint (Reference 7). Their capacity for steam relief is as described in Section 5.5.13.

Evaluation of DNB in the Core During the Accident For this accident, DNB occurs in the core, and therefore, a VIPRE-01 analysis of the consequences with respect to fuel rod thermal transients is performed. The Statistical Core Design Methodology as described in Reference 4 is employed for the DNB analysis. Both offsite power maintained (OSPM) and offsite power lost (OSPL) cases are analyzed utilizing the WRB-2M correlation for the Westinghouse RFA fuel (Reference 6). Plant characteristics and initial conditions are discussed in "Initial Conditions and Power Distributions Assumed in the Accident Analyses". The result of this VIPRE-01 analysis is a power peaking limit which yields a DNBR equal to the limit value. All fuel pins exceeding this peaking limit are assumed to undergo DNB and subsequently fail.

For this analysis, the initial value of the pressure is used throughout the transient since it is the most conservative with respect to DNBR and clad temperature calculations.

Results (13 APR 2020) 15.3 - 5

UFSAR Chapter 15 McGuire Nuclear Station The transient results for the DNB calculation are shown in Figure 15-62, Figure 15-174 through Figure 15-178, and Figure 15-271 through Figure 15-274. With the exception of the primary system pressure, the transient results of the locked rotor peak pressure analysis are virtually identical to those from the DNBR calculation. The peak Reactor Coolant System pressure from the peak pressure analysis is presented in Figure 15-275 and is at the point in the Reactor Coolant System having the maximum pressure. The peak Reactor Coolant System pressure reached during the transient is less than that which would cause stresses to exceed the faulted condition stress limits.

The calculated sequence of events is shown on Table 15-17. Figure 15-178 shows that the core flow rapidly reaches a new equilibrium value. With the reactor tripped, a stable plant condition will eventually be attained. Normal plant shutdown may then proceed.

15.3.3.3 Environmental Consequences The locked rotor inventory is listed in Table 15-10. The accident assumes 6% of the fuel pins experience DNB for the scenario involving a Loss of Offsite Power (LOOP) and 1.5% of fuel pins for the scenario with Offsite Power Available (OPA). Regulatory Guide 1.183 illustrates the methodology used for this analysis. A concurrent iodine spike is conservatively assumed to occur for the locked rotor accident as well.

The locked rotor accident may be followed with releases of radioactivity from the steam generators. Radioactivity is assumed to be transported to the SG secondary sides with tube leakage. Periods of tube bundle uncovery exist, which affect how much iodine is partitioned and released to the environment. They will uncover and recover, dependent on the opening of the steam generator power operated relief valves.

The dose consequences for this accident are listed in Table 15-12. Note that the EAB dose corresponds to the highest dose over any 2-hour duration during the accident. For additional detail regarding the inputs for this analysis, see Table 15-18.

15.3.3.4 Conclusions

1. Since the peak Reactor Coolant System pressure reached during any of the transients is less than that which would cause stresses to exceed the faulted condition stress limits, the integrity of the primary coolant system is not endangered.

2. DNB is predicted to occur for this event, the extent of which is verified for each reload to be less than the maximum allowed by the dose analysis.

15.3.4 Reactor Coolant Pump Shaft Break 15.3.4.1 Identification of Causes and Accident Description The accident is postulated as an instantaneous failure of a reactor coolant pump shaft, such as discussed in Section 5.4. Flow through the affected reactor coolant loop is rapidly reduced, though the initial rate of reduction of coolant flow is greater for the reactor coolant pump shaft seizure event. Reactor trip is initiated on a low flow signal in the affected loop. Following initiation of the reactor trip, heat stored in the fuel rods continues to be transferred to the coolant causing the coolant to expand. At the same time, heat transfer to the shell side of the steam generators is reduced, first because the reduced flow results in a decreased tube side film coefficient and then because the reactor coolant in the tubes cools down while the shell side temperature increases (turbine steam flow is reduced to zero upon plant trip). The rapid expansion of the coolant in the reactor core, combined with reduced heat transfer in the steam 15.3 - 6 (13 APR 2020)

McGuire Nuclear Station UFSAR Chapter 15 generators, causes an insurge into the pressurizer and a pressure increase throughout the Reactor Coolant System. The insurge into the pressurizer compresses the steam volume, actuates the automatic spray system, opens the power-operated relief valves, and opens the pressurizer safety valves, in that sequence. The three power-operated relief valves are designed for reliable operation and would be expected to function properly during the accident.

However, for conservatism, their pressure reducing effect as well as the pressure reducing effect of the spray is not included in the analysis.

A reactor coolant pump shaft break is classified as an ANS Condition IV event, a limiting fault.

See Section 15.0 for a discussion of Condition IV events.

15.3.4.2 Environmental Consequences The consequences of a reactor coolant pump shaft break are similar to those calculated for the locked rotor incident (see Section 15.3.3).

15.3.4.3 Conclusions The bounding results for the locked rotor transients presented in Figure 15-62 and Figure 15-174 thru Figure 15-178 and summarized in Table 15-18 are also applicable to the reactor coolant pump shaft break. With a failed shaft, the impeller could conceivably be free to spin in a reverse direction as opposed to being fixed in position as assumed in the locked rotor analysis.

However, the net effect on core flow is negligible, resulting in only a slight decrease in the end point (steady state) core flow. For both the shaft break and locked rotor incidents, reactor trip occurs very early in the transient.

15.3.5 References

1. RETRAN-02: A Program for Transient Thermal-Hydraulic Analysis of Complex Fluid Flow Systems, EPRI NP-1850-CCM, Revision 6.1, June 2007.

2. VIPRE-01: A Thermal-Hydraulic Code for Reactor Cores, EPRI NP-2511-CCM-A, Revision 4.2, June 2007.

3. Deleted Per 2001 Update.

4. "Duke Power Company Thermal-Hydraulic Statistical Core Design Methodology, "DPC-NE-2005P-A, Revision 4a, December 2008.

5. Deleted Per 2003 Update.

6. WCAP-15025-P, Modified WRB-2 Correlation, WRB-2M, for Predicting Critical Heat Flux in 17x17 Rod Bundles with Modified LPD Mixing Vane Grids, Westinghouse, February 1998.

7. DPC-NE-3002-A, UFSAR Chapter 15 System Transient Analysis Methodology, Revision 4a, April 2009.

8. Letter from V. Nerses (USNRC) to H. B. Barron (Duke), Issuance of Amendments -

McGuire Nuclear Station, Units 1 and 2 (TAC Nos. M90590 and M90591), May 5, 1997 (and enclosed Safety Evaluation).

9. Duke Power Company Westinghouse Fuel Transition Report DPC-NE-2009P-A, Revision 2a, July 2009.

THIS IS THE LAST PAGE OF THE TEXT SECTION 15.3.

(13 APR 2020) 15.3 - 7

UFSAR Chapter 15 McGuire Nuclear Station THIS PAGE LEFT BLANK INTENTIONALLY.

15.3 - 8 (13 APR 2020)

McGuire Nuclear Station UFSAR Chapter 15 15.4 Reactivity and Power Distribution Anomalies A number of events have been postulated which could result in reactivity and power distribution anomalies. Detailed analyses are presented for several such events which have been identified as limiting cases.

Discussions of the following events are presented in this section:

1. Uncontrolled Rod Cluster Control Assembly Bank Withdrawal from a Subcritical or Low Power Startup Condition

2. Uncontrolled Rod Cluster Control Assembly Bank Withdrawal at Power

3. Rod Cluster Control Assembly Misoperation

4. Startup of an Inactive Reactor Coolant Pump at an Incorrect Temperature

5. A Malfunction or Failure of the Flow Controller in a BWR Loop that Results in an Increased Reactor Coolant Flow Rate

6. Chemical and Volume Control System Malfunction that Results in a Decrease in Boron Concentration in the Reactor Coolant

7. Inadvertent Loading and Operation of a Fuel Assembly in an Improper Position

8. Spectrum of Rod Cluster Control Assembly Ejection Accidents

9. Spectrum of Rod Drop Accidents (BWR)

Items 1, 2, 4, and 6 are considered to be ANS Condition II events, Item 7 an ANS Condition III event, and item 8 an ANS Condition IV event. Item 3 entails both Condition II and III events.

Section 15.0 contains a discussion of ANS classifications and applicable acceptance criteria.

15.4.1 Uncontrolled Rod Cluster Control Assembly Bank Withdrawal From a Subcritical or Low Power Startup Condition 15.4.1.1 Identification of Causes and Accident Description A rod cluster control assembly (RCCA) withdrawal accident is defined as an uncontrolled addition of reactivity to the reactor core caused by withdrawal of RCCA's resulting in a power excursion. Such a transient could be caused by a malfunction of the Rod Control System. This could occur with the reactor either subcritical, at hot zero power or at power. The at power case is discussed in Section 15.4.2.

Although the reactor is normally brought to power from a subcritical condition by means of RCCA withdrawal, initial startup procedures with a clean core call for boron dilution. The maximum rate of reactivity increase in the case of boron dilution is less than that assumed in this analysis (see Section 15.4.6).

The RCCA drive mechanisms are wired into preselected bank configurations which are not altered during reactor life. These circuits prevent the RCCA's from being automatically withdrawn in other than their respective banks. Power supplied to the banks is controlled such that no more than two banks can be withdrawn at the same time and in their proper withdrawal sequence. The RCCA drive mechanisms are of the magnetic latch type and coil actuation is sequenced to provide variable speed travel. The maximum reactivity insertion rate analyzed in the detailed plant analysis is that occurring with the simultaneous withdrawal of the combination of two sequential control banks having the maximum combined worth at maximum speed.

(13 APR 2020) 15.4 - 1

UFSAR Chapter 15 McGuire Nuclear Station The neutron flux response to a continuous reactivity insertion is characterized by a very fast rise terminated by the reactivity feedback effect of the negative Doppler coefficient. This self limitation of the power excursion is of primary importance since it limits the power to a tolerable level during the delay time for protective action. Should a continuous RCCA withdrawal accident occur, the transient will be terminated by the following automatic features of the Reactor Protection System:

1. Source Range High Neutron Flux Reactor Trip- actuated when either of two independent source range channels indicates a neutron flux level above a preselected manually adjustable setpoint. This trip function may be manually bypassed only after an intermediate range flux channel indicates a flux level above a specified level. It is automatically reinstated when both intermediate range channels indicate a flux level below a specified level.

2. Intermediate Range High Neutron Flux Reactor Trip- actuated when either of two independent intermediate range channels indicates a flux level above a preselected manually adjustable setpoint. This trip function may be manually bypassed only after two of the four power range channels are reading above approximately 10 percent of full power and is automatically reinstated when three of the four channels indicate a power level below this value.

3. Power Range High Neutron Flux Reactor Trip (Low Setting)- actuated when two out of the four power range channels indicate a power level above approximately 25 percent of full power. This trip function may be manually bypassed when two of the four power range channels indicate a power level above approximately 10 percent of full power and is automatically reinstated only after three of the four channels indicate a power level below this value.

4. Power Range High Neutron Flux Reactor Trip (High Setting)- actuated when two out of the four power range channels indicate a power level above a preset setpoint. This trip function is always active.

5. High Nuclear Flux Rate Reactor Trip- actuated when the positive rate of change of neutron flux on two out of four nuclear power range channels indicate a rate above the preset setpoint. This trip function is always active.

In addition, control rod stops on high intermediate range flux level (one of two) and high power range flux level (one out of four) serve to discontinue rod withdrawal and prevent the need to actuate the intermediate range flux level trip and the power range flux level trip, respectively.

An uncontrolled RCCA bank withdrawal from a subcritical or low power startup condition is classified as an ANS Condition II event, a fault of moderate frequency. See Section 15.0 for a discussion of Condition II events.

15.4.1.2 Analysis of Effects and Consequences Method of Analysis The analysis of the uncontrolled RCCA bank withdrawal from zero power consists of a RETRAN-02 (Reference 1) plant transient simulation and a VIPRE-01 (Reference 6) core thermal-hydraulic analysis using the Statistical Core Design Methodology (Reference 8). The reactor power transient initiated by the uncontrolled rod withdrawal is modeled using point kinetics. Moderator and Doppler feedback and control rod insertion following reactor trip are modeled. Primary and secondary systems are modeled in detail. Boundary conditions from the RETRAN analysis are input to VIPRE to determine the detailed thermal-hydraulic response of the reactor, including the hot function. The RETRAN-02 analysis also predicts a separate peak 15.4 - 2 (13 APR 2020)

McGuire Nuclear Station UFSAR Chapter 15 primary system pressure during the transient. The minimum transient DNBR is determined using the WRB-2M correlation for the Westinghouse RFA fuel (Reference 23).

Plant characteristics and initial conditions for this accident are discussed in Section 15.0 (see Table 15-4). In order to give conservative results for the zero power bank withdrawal accident, the following assumptions are made:

1. Since the magnitude of the power peak reached during the initial part of the transient for any given rate of reactivity insertion is strongly dependent on the Doppler coefficient, conservatively low values as a function of fuel average temperature are used. At zero power a Doppler coefficent of -1.50 pcm/°F is used. This value decreases linearly to a value of -1.20 pcm/°F at full power.

2. Contribution of the moderator reactivity coefficient is negligible during the initial part of the transient because the heat transfer time between the fuel and the moderator is much longer than the neutron flux response time. However, after the initial neutron flux peak, the succeeding rate of power increase is affected by the moderator reactivity coefficient. A highly conservative initial value equivalent to the Technical Specification MTC vs. power level relationship is used. Between zero and 70% power, the MTC is +7 pcm/°F. This initial value decreases linearly to zero at 100% power. The MTC is modeled as a density coefficient based on the core average moderator temperature.

3. The reactor is assumed to be at hot zero power. This assumption is more conservative than that of a lower initial system temperature. The higher initial system temperature yields a large fuel-water heat transfer coefficient, larger specific heats, and a less negative (smaller absolute magnitude) Doppler coefficient, all of which tend to reduce the Doppler feedback effect thereby increasing the neutron flux peak. The initial effective multiplication factor is assumed to be 1.0 since this results in the worst nuclear power transient.

4. Reactor trip is assumed to be initiated by power range high neutron flux (low setting). The most adverse combination of instrument and setpoint errors, as well as delays for trip signal actuation and rod cluster control assembly release, is taken into account. The nominal high power range flux low setpoint is 25% FP. Due to the effect of control rod motion on the excore flux signal, a conservatively high setpoint of 116.1% is used in the analysis. Since the rise in the neutron flux is so rapid, the effect of errors in the trip setpoint on the actual time at which the rods are released is negligible. In addition, the reactor trip insertion characteristic is based on the assumption that the highest worth rod cluster control assembly is stuck in its fully withdrawn position. The worth withdrawn during the transient is reinserted during the reactor trip. See Section 15.0 for rod cluster control assembly insertion characteristics.

5. The maximum positive reactivity insertion rate assumed is greater than that for the simultaneous withdrawal of the combination of the two sequential control banks having the greatest combined worth when at maximum design speed (45 inches/minute). Control rod drive mechanism design is discussed in Section 4.2.3.

6. The most limiting axial and radial power shapes, associated with having the two highest combined worth banks in their high worth position, are assumed in the DNB analysis.

7. The initial power level is assumed to be below the power level expected for any shutdown condition (10-9 of nominal power). This combination of highest reactivity insertion rate and lowest initial power produces the highest peak heat flux.

(13 APR 2020) 15.4 - 3

UFSAR Chapter 15 McGuire Nuclear Station

8. Three reactor coolant pumps are assumed to be in operation. This is conservative with respect to DNB. The peak pressure analysis assumes four reactor coolant pumps in operation, which is more limiting than the three pump case.

9. The steam generator secondary is modeled as a single control volume and uses the RETRAN-02 local conditions heat transfer option. This approach is consistent with the zero power initial condition. The steam generator tube plugging level assumed is 0% for the DNB case, and 5% for the peak RCS pressure analysis.

Results Figure 15-63 through Figure 15-68 show the transient response following an uncontrolled bank withdrawal from 1.0E-9 rated power. The sequence of events is given in Table 15-19. The total reactivity is shown in Figure 15-63. The reactor goes prompt critical before Doppler feedback terminates the power excursion. Rod insertion on reactor trip ensures the shutdown of the reactor. The neutron power transient is shown in Figure 15-64 and the resulting thermal power in Figure 15-65. The thermal power is the key result with respect to determining the approach to DNB. The fuel average temperature and the hot and cold leg temperatures are shown in Figure 15-66 and Figure 15-67, respectively. These temperatures are well below the nominal full power values. The minimum transient DNBR is shown in Figure 15-68. This figure shows the DNBR is always greater than the limit value (References 8 and 25).

The transient results of the uncontrolled RCCA bank withdrawal from low power peak pressure analysis are similar to those from the DNBR calculation. The peak Reactor Coolant System pressure (2603.6 psig) from the peak pressure analysis is presented in Figure 15-186.

15.4.1.3 Environmental Consequences There will be no radiological consequences associated with an uncontrolled rod cluster assembly bank withdrawal from a subcritical or low power start up condition event since radioactivity is contained within the fuel rods and Reactor Coolant System within design limits.

15.4.1.4 Conclusions In the event of a RCCA withdrawal accident from the subcritical condition, the core and the Reactor Coolant System are not adversely affected, since the combination of thermal power and the coolant temperature result in a DNBR greater than the limit value. Thus, no fuel or clad damage is predicted as a result of DNB.

15.4.2 Uncontrolled Rod Cluster Control Assembly Bank Withdrawal at Power 15.4.2.1 Identification of Causes and Accident Description Uncontrolled rod cluster control assembly (RCCA) bank withdrawal at power results in an increase in the core heat flux. Since the heat extraction from the steam generator lags behind the core power generation until the steam generator pressure reaches the relief or safety valve setpoint, there is a net increase in the reactor coolant temperature. Unless terminated by manual or automatic action, the power mismatch and resultant coolant temperature rise could eventually result in DNB. Therefore, in order to avert damage to the fuel clad the Reactor Protection System is designed to terminate any such transient before the DNBR falls below the limit value.

15.4 - 4 (13 APR 2020)

McGuire Nuclear Station UFSAR Chapter 15 The automatic features of the Reactor Protection System which prevent core damage following the postulated accident include the following:

1. Reactor trip is actuated if any two out of four power range neutron flux instrumentation channels exceed an overpower setpoint.

2. Reactor trip is actuated if any two out of four T channels exceed an overtemperature T setpoint. This setpoint is automatically varied with axial power imbalance, coolant temperature and pressure to protect against DNB.

3. Reactor trip is actuated if any two out of four T channels exceed an overpower T setpoint.

This setpoint is automatically varied with axial power imbalance, coolant temperature and coolant temperature increase rate to ensure that the allowable heat generation rate (kw/ft) is not exceeded.

4. A reactor trip is actuated if any two out of four pressurizer pressure channels exceed a fixed setpoint. This set pressure is less than the set pressure for the pressurizer safety valves.

5. A reactor trip is actuated if any two out of three pressurizer level channels exceed a fixed setpoint when the reactor power is above approximately 10 percent (Permissive-7).

In addition to the above listed reactor trips, there are the following RCCA withdrawal blocks:

1. High neutron flux (one out of four power range)

2. Overpower T (two out of four)

3. Overtemperature T (two out of four)

The manner in which the combination of overpower and overtemperature T trips provide protection over the full range of Reactor Coolant System conditions is described in Chapter 7.

Figure 15-1 presents allowable reactor coolant loop average temperature and T for the design power distribution and flow as a function of primary coolant pressure. The boundaries of operation defined by the overpower T trip and the overtemperature T trip are represented as protection lines on this diagram. The protection lines are drawn to include all adverse instrumentation and setpoint errors so that under nominal conditions trip would occur well within the area bounded by these lines. The utility of this diagram is in the fact that the limit imposed by any given DNBR can be represented as a line. The DNB lines represent the locus of conditions for which the DNBR equals the limit value. All points below and to the left of a DNB line for a given pressure have a DNBR greater than the limit value. The diagram shows that DNB is prevented for all cases if the area enclosed with the maximum protection lines is not traversed by the applicable DNBR line at any point.

The area of permissible operation (power, pressure and temperature) is bounded by the combination of reactor trips: high neutron flux (fixed setpoint), high pressure (fixed setpoint),

low pressure (fixed setpoint), and overpower and overtemperature T (variable setpoints).

The uncontrolled RCCA bank withdrawal from full power is classified as an ANS Condition II event, a fault of moderate frequency. See Section 15.0 for a discussion of Condition II events.

15.4.2.2 Analysis of Effects and Consequences Method of Analysis The transient is analyzed by the RETRAN-02 Code (Reference 1.) This code simulates the neutron kinetics, Reactor Coolant System, pressurizer, pressurizer relief and safety valves, (13 APR 2020) 15.4 - 5

UFSAR Chapter 15 McGuire Nuclear Station pressurizer spray, steam generator, and steam generator safety valves. The code computes pertinent plant variables including temperature, pressures, and power level.

The DNBR calculation for this accident is performed using the Statistical Core Design Methodology and VIPRE-01 Code as described in References 6 and 8. Utilizing the WRB-2M correlation for the Westinghouse RFA fuel (Reference 23), the VIPRE-01 code calculates the DNBR during the transient based on the RETRAN-02 boundary conditions. Plant characteristics and initial conditions are discussed in Section 15.0 (see Table 15-4). In order to obtain conservative results for an uncontrolled rod withdrawal at power accident, the following assumptions are made:

1. Initial reactor power, pressure, flow, and RCS temperatures are assumed to be at their nominal values. Uncertainties in initial conditions are included in the limit DNBR as described in Reference 8.

2. Reactivity Coefficients - Two cases are analyzed:

a. The most positive moderator temperature coefficient (MTC) allowed by the Technical Specifications is implemented as a least positive moderator density coefficient (MDC). A Doppler temperature coefficient (DTC) variable with fuel temperature is used in the analysis.

b. A conservatively positive MTC, corresponding to end of core life (EOL), is implemented as a least positive MDC. A DTC variable with fuel temperature is used.

3. The reactor trip on high neutron flux is assumed to be actuated at a conservative value of 113.2 percent of nominal full power. The calculated neutron flux is conservatively modified to account for transient changes in the flux incident on the excore detectors. The T trips include all adverse instrumentation and setpoint errors. The delays for trip actuation are assumed to be the maximum values.

4. The RCCA trip insertion characteristic is based on the assumption that the highest worth assembly is stuck in its fully withdrawn position.

5. The maximum positive reactivity insertion rate is greater than that for the simultaneous withdrawal of the combinations of the two control banks having the maximum combined worth at maximum speed.

6. The high pressurizer pressure trip function setpoint is assumed to be 2415 psig.

7. The pressurizer safety valves are modeled with opening and closing characteristics which minimize the pressurizer pressure.

8. The steam line safety valves are modeled with opening and closing characteristics which maximize transient secondary side pressure and minimize transient primary-to-secondary heat transfer.

9. Analyses are performed for initial power levels of 10% power (Case 1), 50% power (Case 3),

98% power (Case 4), and 100% power (Case 5). The 10%, 50% and 98% power cases assume 99% of the minimum RCS flow required by Technical Specifications.

The maximum RCS pressure analysis (Case 2) is performed utilizing the RETRAN-02 code with the method that accounts for uncertainties directly in initial power, flow and RCS temperature.

The following assumptions are made:

1. The initial power level is 8% which includes uncertainty.

2. The initial pressurizer pressure is the nominal value. Uncertainty in the initial pressurizer pressure is accounted for in the high pressure reactor trip setpoint.

15.4 - 6 (13 APR 2020)

McGuire Nuclear Station UFSAR Chapter 15

3. A bounding high steam generator tube plugging value is assumed to maximize the RCS pressure.

4. The high pressurizer pressure trip setpoint is assumed to be 2415 psig.

5. Parts 2, 3, 4, 5 and 8 in the DNBR analysis above are also applied.

6. The pressurizer safety valves are modeled with opening and closing characteristics which maximize the pressurizer pressure.

The effect of RCCA movement on the axial core power distribution is to cause a decrease in overtemperature T trip setpoint proportional to a decrease in margin to DNB as described in Reference 12. This effect is not accounted for in the analyses.

A discussion of ATWS considerations is presented in Reference 5.

Results The transient response for a slow RCCA withdrawal from 10% power is shown in Figure 15-69 through Figure 15-72. With the exception of the primary system pressure, the transient results of the RCCA maximum RCS pressure analysis are virtually identical to those from the DNBR analysis. The maximum RCS pressure from the maximum pressure analysis (BOL) is presented in Figure 15-187. Reactor trip on the high flux setpoint occurs after a significant rise in reactor power. The minimum DNBR is greater than the limit value.

Figure 15-278 shows DNBR as a function of reactivity insertion rate from initial 10% power operation for BOL reactivity feedback. It can be seen that three reactor trip functions provide protection over the whole range of reactivity insertion rates. These are the high neutron flux, high pressurizer pressure and overtemperature T functions. The minimum DNBR is slightly lower than the design limit. As described in Chapter 15.0, this minimum DNBR point establishes the statepoint conditions in which the event is analyzed to ensure that the DNB design basis is met for each reload core.

Figure 15-279, Figure 15-280 and Figure 15-281 show the minimum DNBR as a function of reactivity insertion rate for RCCA withdrawal incidents starting at 50, 100 and 98 percent power, respectively. The results are similar to the 10 percent power case. In all cases the DNBR does not fall below the corresponding limit values (References 8 and 25).

The shape of the curves of minimum DNB ratio versus reactivity insertion rate in the referenced figures is due both to reactor core and coolant system transient response and to protection system action in initiating a reactor trip.

Referring to Figure 15-278, for example, it is noted that:

1. For high reactivity insertion rates reactor trip is initiated by the high neutron flux trip for the BOL feedback cases. The neutron flux level in the core rises rapidly for these insertion rates while core heat flux and coolant system temperature lag behind due to the thermal capacity of the fuel and coolant system fluid. Thus, the reactor is tripped prior to significant increase in heat flux or water temperature with resultant high minimum DNB ratios during the transient. As reactivity insertion rate decreases, core heat flux and coolant temperatures can remain more nearly in equilibrium with the neutron flux; minimum DNB ratio during the transient thus decreases with decreasing insertion rate for the rate range in which the high flux trip provides primary protection.

2. The overtemperature T reactor trip circuit initiates a reactor trip when measured coolant loop T exceeds a setpoint based on measured Reactor Coolant System average temperature and pressure. This trip circuit is described in detail in Section 7.2.1. It is (13 APR 2020) 15.4 - 7

UFSAR Chapter 15 McGuire Nuclear Station important to note that the loop T and average temperature contributions to the circuit are lead-lag compensated in order to decrease the effect of the thermal capacity of the Reactor Coolant System in response to power increases.

3. With a further decrease in reactivity insertion rate, assuming pressurizer pressure control operable, the overtemperature T and high pressure trips become equally effective in terminating the transient. For these reactivity insertion rates the effectiveness of the overtemperature T trip increases (in terms of increased minimum DNB ratio) due to the fact that with lower insertion rates the power increase rate is slower, the rate of increase of average coolant temperature is slower and the system lags and delays become less significant.

Deleted Per 2005 Update.

4. For even slower reactivity insertion rates, the steam line safety valves might lift prior to reactor trip. Whether this occurs depends on several factors, including the steam line pressure at the beginning of the transient, the safety valve setpoints, the amount and type of reactivity feedback, and the availability of the steam line PORVs. The effect of steam line safety valve and PORV lift depends upon the reactivity insertion rate and feedback. In general, valve lift tends to reduce the rate of increase of reactor vessel average temperature, which is a component of the overtemperature T trip setpoint equation. For this transient, the lead/lag compensation in this equation causes this increasing temperature to decrease the setpoint, making a trip more likely. Even if no credit is taken for this compensation, a conservative assumption which bounds the effect of valve lift, the maneuvering analysis described in Reference 12 ensures that the minimum DNBR remains above the limit value for insertion rates slow enough to trip on overtemperature T.

Since the RCCA withdrawal at power incident is an overpower transient, the fuel temperatures rises during the transient until after reactor trip occurs. For high reactivity insertion rates, the overpower transient is fast with respect to the fuel rod thermal time constant, and the core heat flux lags behind the neutron flux response. Due to this lag, the peak core heat flux does not exceed 113.2 percent of its nominal value (i.e., the high neutron flux trip setpoint assumed in the analysis). Taking into account the effect of the RCCA withdrawal on the axial core power distribution, the peak fuel temperature will still remain below the fuel melting temperature.

For slow reactivity insertion rates, the core heat flux remains more nearly in equilibrium with the neutron flux. The overpower transient is terminated by the overtemperature T reactor trip before a DNB condition is reached. The peak heat flux again is maintained below 113.2 percent of its nominal value. Taking into account the effect of the RCCA withdrawal on the axial core power distribution, the peak centerline temperature will remain below the fuel melting temperature.

Since DNB does not occur at any time during the RCCA withdrawal at power transient, the ability of the primary coolant to remove heat from the fuel rod is not reduced. Thus, the fuel cladding temperature does not rise significantly above its initial value during the transient.

The calculated sequence of events for the 10% initial power cases for this accident is shown on Table 15-19. With the reactor tripped, the plant eventually returns to a stable condition. The plant may subsequently be cooled down further by following normal plant shutdown procedures.

15.4.2.3 Environmental Consequences The reactor trip causes a turbine trip, and heat is removed from the secondary system through the steam generator power operated relief valves or safety valves. Since no fuel damage is 15.4 - 8 (13 APR 2020)

McGuire Nuclear Station UFSAR Chapter 15 postulated to occur, the radiological consequences associated with atmospheric steam release from this event would be less severe than the steamline break accident analyzed in Section 15.1.5.

15.4.2.4 Conclusions The high neutron flux, high pressurizer pressure and overtemperature T trip channels provide adequate protection over the entire range of possible reactivity insertion rates, i.e., the minimum value of DNBR is always larger than the limit value, and the maximum RCS pressure is less than the limit value. The radiological consequences would be less severe than the steamline break accident analyzed in Section 15.1.5.

15.4.3 Rod Cluster Control Assembly Misoperation (System Malfunction or Operator Error) 15.4.3.1 Identification of Causes and Accident Description Rod cluster control assembly (RCCA) misoperation accidents include:

a. One or more dropped RCCAs within the same group

b. A dropped RCCA bank

c. Statically misaligned RCCA

d. Withdrawal of a single RCCA Each RCCA has a position indicator channel which displays the position of the assembly. The displays of assembly positions are grouped for the operator's convenience. Fully inserted assemblies are further indicated by a rod at bottom signal, which actuates a local alarm and a control room annunciator. Group demand position is also indicated.

Full length RCCA's are always moved in preselected banks, and the banks are always moved in the same preselected sequence. Each bank of RCCAs is divided into two groups. The rods comprising a group operate in parallel through multiplexing thyristors. The two groups in a bank move sequentially such that the first group is always within one step of the second group in the bank. A definite schedule of actuation (or deactuation of the stationary gripper, movable gripper, and lift coils of a mechanism) is required to withdraw the RCCA attached to the mechanism. Since the stationary gripper, movable gripper, and lift coils associated with the four RCCA's of a rod group are driven in parallel, any single failure which would cause rod withdrawal would affect a minimum of one group. Mechanical failures are in the direction of insertion, or immobility.

The dropped RCCA assemblies, dropped RCCA assembly bank, and statically misaligned RCCA assembly events are classified as ANS Condition II incidents (incidents of moderate frequency) as defined in Section 15.0. The single RCCA withdrawal incident is classified as an ANS Condition III event (Reference 13) for reasons discussed below.

No single electrical or mechanical failure in the rod control system could cause the accidental withdrawal of a single RCCA from the inserted bank at full power operation. The operator could withdraw a single RCCA in the control bank since this feature is necessary in order to retrieve an assembly should one be accidentally dropped. The event analyzed must result from multiple wiring failures (probability for single random failure is on the order of 10-8/hour - refer to Section 7.7.2.2) or multiple significant operator errors and subsequent and repeated operator disregard (13 APR 2020) 15.4 - 9

UFSAR Chapter 15 McGuire Nuclear Station of event indication. The probability of such a combination of conditions is considered low enough that the limiting consequences may include slight fuel damage.

Thus, consistent with the philosophy and format of ANSI N18.2, the event is classified as a Condition III event. By definition Condition III occurrences include incidents, any one of which may occur during the lifetime of a particular plant, and shall not cause more than a small fraction of fuel elements in the reactor to be damaged...

This selection of criterion is not in violation of GDC 25 which states, The protection system shall be designed to assure that specified acceptable fuel design limits are not exceeded for any single malfunction of the reactivity control systems, such as accidental withdrawal (not ejection or dropout) of control rods. (Emphasis have been added). It has been shown that single failures resulting in RCCA bank withdrawals do not violate specified fuel design limits.

Moreover, no single malfunction can result in the withdrawal of a single RCCA. Thus, it is concluded that criterion established for the single rod withdrawal at power is appropriate and in accordance with GDC 25.

A dropped RCCA or RCCA bank is detected by:

1. Sudden drop in the core power level as seen by the Nuclear Instrumentation System

2. Asymmetric power distribution as seen on out-of-core neutron detectors or core exit thermocouples

3. Rod at bottom signal

4. Rod deviation alarm

5. Rod position indication Misaligned RCCAs are detected by:

1. Asymmetric power distribution as seen on out-of-core neutron detectors or core exit thermocouples

2. Rod deviation alarm

3. Rod position indicators The resolution of the rod position indicator channel is +/-5 percent of span (+/-7.2 inches).

Deviation of any RCCA from its group by twice this distance (10 percent of span, or 14.4 inches) will not cause power distributions worse than the design limits. The deviation alarm alerts the operator to rod deviation with respect to the group position in excess of 5 percent of span. If the rod deviation alarm is not operable, the operator is required to take action as required by the Technical Specifications.

If one or more rod position indicator channels should be out of service, detailed operating instructions shall be followed to ensure the alignment of the non-indicated RCCAs. The operator is also required to take action as required by the Technical Specifications.

In the extremely unlikely event of simultaneous electrical failures which could result in single RCCA withdrawal, rod deviation and rod control urgent failure would both be displayed on the plant annunciator, and the rod position indicators would indicate the relative positions of the assemblies in the bank. The urgent failure alarm also inhibits automatic rod motion in the group in which it occurs. Withdrawal of a single RCCA by operator action, whether deliberate or by a combination of errors, would result in activation of the same alarm and the same visual indications. Withdrawal of a single RCCA results in both a positive reactivity insertion tending to increase core power and an increase in local power density in the core area associated with the RCCA. Automatic protection for this event is provided by the overtemperature T reactor trip, 15.4 - 10 (13 APR 2020)

McGuire Nuclear Station UFSAR Chapter 15 although, due to the increase in local power density, it is not possible in all cases to provide assurance that the core safety limits will not be violated.

15.4.3.2 Analysis of Effects and Consequences Method of Analysis

a. One or more dropped RCCAs from the same group.

For evaluation of the dropped RCCA event, the transient system response is calculated using the RETRAN-02 code (Reference 1). The code simulates the neutron kinetics, Reactor Coolant System, pressurizer, pressurizer relief and safety valves, pressurizer spray, steam generator, and steam generator safety valves. The code computes pertinent plant variables including temperatures, pressures, and power level.

Statepoints are calculated and nuclear models are used to obtain hot channel factors at conditions consistent or conservative with the primary system conditions and reactor power. By incorporating the primary conditions from the transient and the hot channel factor from the nuclear analysis, the DNB design basis is shown to be met using the VIPRE-01 code (Reference 6). The transient response, nuclear peaking factor analysis, and DNB design basis confirmation are performed in accordance with the methodology described in Reference 15.

b. Dropped RCCA Bank The method used for analyzing this event is the same as for one or more dropped RCCAs from the same group.

c. Statically Misaligned RCCA Steady state power distribution are analyzed using the computer codes as described in Table 4-2. The peaking factors are then compared to maximum allowable peaking limits from the VIPRE-01 code (Reference 6). No allowances for uncertainties are included in the maximum allowable peaking limits for initial reactor power, pressure and RCS temperature since uncertainties for these initial conditions are included in the SCD DNBR limit as described in Reference 8.

d. Single RCCA Withdrawal A single RCCA withdrawal transient is analyzed by employing the RETRAN-02 computer code (Reference 1). The code simulates neutron kinetics, decay heat, the Reactor Coolant System (RCS), control rods, pressurizer, pressurizer power-operated relief valves (PORVs), pressurizer spray, steam generator, turbine, and the Reactor Protection System. The code computes pertinent plant variables including power level, temperatures, pressures, mass flow rates, and liquid inventories.

The DNBR calculation for this accident is performed with the VIPRE-01 computer code (Reference 6) using the Statistical Core Design Methodology described in Reference 8.

Utilizing the WRB-2M correlation (Reference 23), the VIPRE-01 code calculates the DNBR during the transient based on the RETRAN-02 boundary conditions for Westinghouse RFA fuel. The result of this calculation is a power peaking limit which, at the statepoint, yields a DNBR equal to the limit value. All fuel pins exceeding this peaking limit are assumed to undergo DNB and subsequently fail.

Plant characteristics and initial conditions are discussed in Section 15.0 (see Table 15-4). In order to obtain conservative results for a single RCCA withdrawal accident, the following assumptions are made:

(13 APR 2020) 15.4 - 11

UFSAR Chapter 15 McGuire Nuclear Station

1. The values assumed for initial reactor power, pressurizer pressure, RCS average temperature, and RCS flow include no allowance for uncertainties. Uncertainties in initial conditions are included in the SCD DNBR limit as described in Reference 8.

2. A most negative moderator density coefficient of reactivity is assumed corresponding to the beginning of core life. A least negative variable fuel temperature coefficient is assumed corresponding to the beginning of core life. These feedback assumptions lead to the most limiting statepoint with respect to thermal-hydraulic conditions. Peaking limits derived from this statepoint are compared to peaking results from beginning and end of core life to ensure that the percent of fuel rods in DNB is smaller than the acceptance criterion.

3. The reactor trip on high neutron flux is assumed to be actuated at a conservative value higher than 113.2 percent of nominal full power. The calculated neutron flux is conservatively modified to account for transient changes in the flux incident on the excore detectors. The T trips include all adverse instrumentation and setpoint errors. The delays for trip actuation are assumed to be maximum values.

4. The RCCA trip insertion characteristic is based on the assumption that the highest worth assembly is stuck in its fully withdrawn position.

5. The maximum positive insertion rate is greater than that for the maximum speed withdrawal of the most reactive single Control Bank D RCCA from at or above its insertion limit, accounting for uncertainties in the indicated RCCA position.

6. The case presented assumes normal pressurizer spray and the pressurizer PORVs operable. A sensitivity study was performed to ensure that the minimum DNBR for this case bounds other pressurizer pressure control availability assumptions.

7. The high pressurizer pressure trip function setpoint is assumed to be 2415 psig.

8. The steam generator tube plugging level assumed is 5%.

Results

a. One or more dropped RCCAs from the same group For those dropped RCCAs which do not result in a reactor trip power may be reestablished either by reactivity feedback or control bank withdrawal. Following a dropped rod event in manual rod control, the plant will establish a new equilibrium condition. The equilibrium process without control system interaction is monotonic, thus removing power overshoot as a concern, and establishing the automatic rod control mode of operation as the limiting case.

For a dropped RCCA event in the automatic rod control mode, the Rod Control System detects the drop in power and initiates control bank withdrawal. Power overshoot may occur due to this action by the automatic rod controller after which the control system will insert the control bank to restore nominal power. Figure 15-90, Figure 15-180, Figure 15-181, Figure 15-182 and Figure 15-183 show a typical transient response to a dropped RCCA (or RCCAs) in automatic control.

b. Dropped RCCA Bank The results for a dropped RCCA bank are bounded by the analysis presented for one or more dropped rods.

c. Statically Misaligned RCCA The most severe misalignment situations with respect to DNBR at significant power levels arise from cases in which one RCCA is fully inserted, or where bank D is fully 15.4 - 12 (13 APR 2020)

McGuire Nuclear Station UFSAR Chapter 15 inserted with one RCCA fully withdrawn. Multiple independent alarms, including a bank insertion limit alarm, alert the operator well before the postulated conditions are approached. The bank can be inserted to its insertion limit with any one assembly fully withdrawn without the DNBR falling below the limit value. Any action required of the operator to maintain the plant in a stabilized condition will be in a time frame in excess of ten minutes following the incident.

The insertion limits in the Technical Specifications may vary from time to time depending on a number of limiting criteria. It is preferable, therefore, to analyze the misaligned RCCA case at full power for a position of the control bank as deeply inserted as the criteria on minimum DNBR and power peaking factor will allow. The full power insertion limits on control bank D must then be chosen to be above that position and will usually be dictated by other criteria. Detailed results will vary from cycle to cycle depending on fuel arrangements.

For this RCCA misalignment, with bank D inserted to its full power insertion limit including RCCA position uncertainties and one RCCA fully withdrawn, DNBR does not fall below the limit value. This case is analyzed assuming the initial reactor power, pressure, and RCS temperatures are at their nominal values (as given in Table 15-4) but with the increased radial peaking factor associated with the misaligned RCCA.

For RCCA misalignments with one RCCA fully inserted, the DNBR does not fall below the limit value. This case is analyzed assuming the initial reactor power, pressure, and RCS temperatures are at their nominal values, (as given in Table 15-4) but with the increased radial peaking factor associated with the misaligned RCCA.

DNB does not occur for the RCCA misalignment incident and thus the ability of the primary coolant to remove heat from the fuel rod is not reduced. The peak fuel temperature corresponds to a linear heat generation rate based on the radial peaking factor penalty associated with the misaligned RCCA and a limiting axial power distribution. The resulting linear heat generation is well below that which would cause fuel melting.

Following the identification of a RCCA group misalignment condition by the operator, the operator is required to take action as required by the plant Technical Specifications and operating procedures.

d. Single RCCA Withdrawal Table 15-19 shows the sequence of events for the single uncontrolled rod withdrawal transient. Figure 15-76, Figure 15-87, Figure 15-88 and Figure 15-89 show the transient response for the single uncontrolled rod withdrawal event. System temperature and system pressure increase until reactor trip occurs, which is after the RCCA is completely withdrawn.

For the single rod withdrawal event, two cases have been considered as follows:

1) If the reactor is in the manual control mode, continuous withdrawal of a single RCCA results in both an increase in core power and coolant temperature, and an increase in the local hot channel factor in the area of the withdrawing RCCA. In terms of the overall system response, this case is similar to those presented in Section 15.4.2.

Depending on initial bank insertion and location of the withdrawn RCCA, automatic reactor trip on OTT or high pressurizer pressure may not occur fast enough to prevent the minimum core DNBR from falling below the limit value; however, an upper limit for the number of rods with a DNBR less than the limit value is 5 percent.

(13 APR 2020) 15.4 - 13

UFSAR Chapter 15 McGuire Nuclear Station

2) If the reactor is in the automatic control mode, the multiple failures that result in the withdrawal of a single RCCA will result in the immobility of the other RCCAs in the controlling bank. The transient will then proceed in the same manner as Case (d.1) described above.

For such cases a reactor trip will ultimately occur as above, although not fast enough in all cases to prevent a minimum DNBR in the core of less than the limit value.

Following reactor trip, normal shutdown procedures are followed.

15.4.3.3 Environmental Consequences The radiological consequences resulting from a single rod withdrawal accident will be less severe than the steamline break event analyzed in Section 15.1.5.3 since no fuel damage is postulated to occur.

15.4.3.4 Conclusions For cases of dropped RCCAs or dropped banks for which the reactor is tripped, there is no reduction in the margin to core thermal limits, and consequently the DNB design basis is met. It is shown for all cases which do not result in reactor trip that the DNBR remains greater than the limit value and, therefore, the DNB design is met.

For all cases of any RCCA fully inserted, or bank D inserted to its rod insertion limits with any single RCCA in that bank fully withdrawn (static misalignment), the DNBR remains greater than the limit value.

For the case of the accidental withdrawal of a single RCCA, with the reactor in the automatic or manual control mode and initially operating at full power with bank D at the insertion limit, an upper bound of the number of fuel rods experiencing DNB is 5 percent of the total fuel rods in the core.

15.4.4 Startup of an Inactive Reactor Coolant Pump at an Incorrect Temperature 15.4.4.1 Identification of Causes and Accident Description If the plant is operating with one pump out of service, there is reverse flow through the inactive loop due to the pressure difference across the reactor vessel. The cold leg temperature in an inactive loop is identical to the cold leg temperature of the active loops (the reactor core inlet temperature). If the reactor is operated at power, and assuming the secondary side of the steam generator in the inactive loop is not isolated, there is a temperature drop across the steam generator in the inactive loop and, with the reverse flow, the hot leg temperature of the inactive loop is lower than the reactor core inlet temperature.

Administrative procedures require that the unit be brought to a load of less than 25 percent of full power prior to starting the pump in an inactive loop in order to bring the inactive loop hot leg temperature closer to the core inlet temperature. Starting of an idle reactor coolant pump without bringing the inactive loop hot leg temperature close to the core inlet temperature would result in the injection of cold water into the core, which would cause a reactivity insertion and subsequent power increase.

Should the startup of an inactive reactor coolant pump accident occur, the transient will be terminated automatically by a reactor trip on low coolant loop flow when the power range neutron flux (two out of four channels) exceeds the P-8 setpoint (See Table 7-2 for a description of interlocks).

15.4 - 14 (13 APR 2020)

McGuire Nuclear Station UFSAR Chapter 15 The startup of an inactive reactor coolant pump at an incorrect temperature is classified as an ANS Condition II event, a fault of moderate frequency. See Section 15.0 for a discussion of Condition II events.

15.4.4.2 Analysis of Effects and Consequences Method of Analysis The RETRAN-02 Code (Reference 1) is used to calculate the loop and core flow, nuclear power and core pressure and temperature transients following the startup of an idle pump. The DNB evaluation is not performed since the reactor coolant pump startup event is characterized by increasing core exit pressure, increasing core inlet flow and decreasing core inlet temperature, all of which are DNB benefits. Although the average heat flux increases, the increase is substantially less than the 100%RTP value and lags the increase in core flow. Therefore, the reactor coolant pump startup event does not pose a DNB concern.

Plant characteristics and initial conditions are discussed in Section 15.0 (see Table 15-4).

In order to obtain conservative results for the startup of an inactive pump accident, the following assumptions are made:

1. Uncertainties in initial conditions are conservatively applied to minimize thermal margin.

2. Following initiation of startup of the idle pump, the inactive loop flow reverses and accelerates to its nominal full flow value in approximately 10 seconds. This value is less than the expected startup time and is conservative for this analysis.

3. A conservative EOC most negative moderator temperature coefficient is assumed which is modeled as a most positive moderator density coefficient.

4. A conservative EOC least negative Doppler temperature coefficient is assumed.

5. This event is analyzed assuming that the plant administration procedure to lower the plant load to 25% RTP prior to startup of the idle pump is not followed.

6. The reactor trip function on low loop flow indication when power level is above the P-8 setpoint is conservatively assumed to be unavailable. The P-8 setpoint is used to specify the initial condition.

7. All other trip functions are credited.

Results The results following the startup of an idle pump with the above listed assumptions are shown in Figure 15-77 through Figure 15-81. As shown in these curves, during the first part of the transient the increase in core flow with cooler water results in an increase in nuclear power and a decrease in core average temperature. Reactor trip does not occur.

Reactivity addition for the inactive loop startup accident is due to the decrease in core water temperature. During the transient, this decrease is due both to the increase in reactor coolant flow and, as the inactive loop flow reverses, to the colder water entering the core from the hot leg side (colder temperature side prior to the start of the transient) of the steam generator in the inactive loop. Thus, the reactivity insertion rate for this transient changes with time. The resultant core nuclear power transient, computed with consideration of both moderator and Doppler reactivity feedback effects, is shown on Figure 15-77.

The calculated sequence of events for this accident is shown on Table 15-19.

(13 APR 2020) 15.4 - 15

UFSAR Chapter 15 McGuire Nuclear Station 15.4.4.3 Environmental Consequences There would be minimal radiological consequences associated with startup of an inactive reactor coolant loop at an incorrect temperature. Therefore, this event is not limiting. Since no fuel damage is postulated to occur from this transient, the radiological consequences associated with this event would be less severe than the steam line break event analyzed in Section 15.1.5.

15.4.4.4 Conclusions The transient results show that the core is not adversely affected and DNB is not a concern.

Thus, no fuel or clad damage is predicted.

15.4.5 A Malfunction or Failure of the Flow Controller in a BWR Loop that Results in an Increased Reactor Coolant Flow Rate (Not applicable to McGuire).

15.4.6 Chemical and Volume Control System Malfunction that Results in a Decrease in Boron Concentration in the Reactor Coolant 15.4.6.1 Identification of Causes and Accident Description Reactivity can be added to the core by feeding primary grade water into the Reactor Coolant System via the reactor makeup portion of the Chemical and Volume Control System. Boron dilution is a manual operation under administrative control with procedures calling for a limit on the rate and duration of dilution. A boric acid blend system is provided to permit the operator to match the boron concentration of reactor coolant makeup water during normal charging to that in the Reactor Coolant System. The Chemical and Volume Control System is designed to limit, even under various postulated failure modes, the potential rate of dilution to a value which, after indication through alarms and instrumentation, provides the operator sufficient time to correct the situation in a safe and orderly manner.

The opening of the reactor water makeup control valve provides makeup to the Reactor Coolant System which can dilute the reactor coolant. Inadvertent dilution from this source can be readily terminated by closing the control valve. In order for makeup water to be added to the Reactor Coolant System at pressure, at least one charging pump must be running in addition to a reactor makeup water pump.

The rate of addition of unborated makeup water to the Reactor Coolant System when it is not at pressure is limited by administratively limiting the output of the reactor makeup water pumps.

Normally, only one reactor makeup water pump is operating while the other is on standby. With the RCS at pressure, the maximum delivery rate is limited by the control valve.

The boric acid from the boric acid tank is blended with primary grade water in the blender and the composition is determined by the preset flow rates of boric acid and primary grade water on the control board.

In order to dilute, two separate operations are required:

1. The operator must switch from the automatic makeup mode to the dilute mode

2. The start button must be depressed.

Omitting either step would prevent dilution.

15.4 - 16 (13 APR 2020)

McGuire Nuclear Station UFSAR Chapter 15 Information on the status of the reactor coolant makeup is continuously available to the operator. Lights are provided on the control board to indicate the operating condition of the pumps in the Chemical and Volume Control System. Alarms are actuated to warn the operator if boric acid or demineralized water flow rates deviate from preset values as a result of system malfunction (may be defeated by the operator when in Modes 5 & 6 - defeat alarm is generated). The signals initiating these alarms also cause the closure of control valves terminating the addition to the Reactor Coolant System.

A boron dilution is classified as an ANS Condition II event, a fault of moderate frequency. See Section 15.0 for a discussion of Condition II events.

15.4.6.2 Analysis of Effects and Consequences Method of Analysis Boron dilution during startup and power operation is considered in this analysis. Boron dilution during refueling is not considered a credible accident because potential dilution flow paths are required to be isolated by Technical Specifications.

Alarm Function Which Initiates Mitigation Mitigation of a boron dilution accident is not assumed to begin until an alarm has warned of the abnormal circumstances caused by the event. For Mode 2 and for manual rod control during Mode 1, the alarm function is provided by the earliest reactor trip setpoint reached. Finally, for automatic rod control during Mode 1, the alarm function is provided by the alarm which occurs when the control rods reach their insertion limits.

Dilution Volume A postulated dilution event progresses faster for smaller RCS water volumes. Therefore, the analysis considers the smallest RCS water volume in which the unborated water is actively mixed by forced circulation. For Modes 1 and 2, the Technical Specifications require that at least one reactor coolant pump be operating. This forced circulation will mix the RCS inventory in the reactor vessel and each of the four reactor coolant loops. The pressurizer and the pressurizer surge line are not included in the volume available for dilution in Modes 1 and 2.

Boron Concentrations The Technical Specifications require that the shutdown margin in the various modes be above a certain minimum value. The difference in boron concentration, between the value at which the relevant alarm function is actuated and the value at which the reactor is just critical, determines the time available to mitigate a dilution event. Mathematically, this time is a function of the ratio of these two concentrations, where a large ratio corresponds to a longer time. During the reload safety analysis for each new core, the above concentrations are checked to ensure that the value of this ratio for each mode is larger than the corresponding ratio assumed in the accident analysis. Each mode of operation covers a range of temperatures. Therefore, within that mode, the temperature which minimizes this ratio is used for comparison with the accident analysis ratio. For accident initial conditions in which the control rods are withdrawn, it is conservatively assumed, in calculating the critical boron concentration, that the most reactive RCCA does not fall into the core at reactor trip.

Dilution Flow Rate In the absence of flow rate restrictions, the dilution flow rate assumed to enter the RCS is greater than or equal to the design volumetric flow rate of both reactor makeup water pumps. In a dilution event, these pumps are assumed to deliver unborated water to the suction of the (13 APR 2020) 15.4 - 17

UFSAR Chapter 15 McGuire Nuclear Station centrifugal charging pumps. Since the water delivered by these pumps is typically colder than the RCS inventory, the unborated water expands within the RCS, causing a given volmetric flow rate measured at the colder temperatue to correspond to a larger volumetric dilution flow rate within the RCS. This density difference in the dilution flow rate is accounted for in the analysis.

Results The calculated sequence of events is shown in Table 15-19. The results presented in Table 15-19 are for the dilution flow rates which, assuming the boron concentration ratios are at the reload safety analysis limits, give exactly these operator response times. Flow rates are restricted, through Technical Specifications and administrative controls, to values which are less than these analyzed flow rates, thus in practice giving even longer operator response times.

Additional margin is provided by the fact there is typically margin between the assumed boron concentration ratio for a given mode and the actual corresponding concentration ratio for the reload core.

Dilution During Refueling An uncontrolled boron dilution accident cannot occur during refueling as a result of a reactor coolant makeup system malfunction. This is not considered a credible accident because potential dilution flow paths are required to be isolated by Technical Specifications.

Dilution During Startup For dilution during startup there is adequate time following reactor trip (at least 15 minutes) for the operator to manually terminate the source of dilution flow.

Dilution at Power

1. With the reactor in automatic control, the power and temperature increase from boron dilution results in insertion of the rod cluster control assemblies and a decrease in the shutdown margin. The rod insertion limit alarms (low and low-low settings) provide the operator with adequate time (at least 15 minutes) to determine the cause of dilution, isolate the primary grade water source, and initiate reboration before the total shutdown margin is lost due to dilution.

2. With the reactor in manual control and if no operator action is taken, the power and temperature rise would cause the reactor to reach the high flux trip high setpoint. There is adequate time available (at least 15 minutes) after a reactor trip for the operator to determine the cause of dilution, isolate the primary grade water sources and initiate reboration before the reactor can return to criticality.

15.4.6.3 Environmental Consequences There would be minimal radiological consequences associated with a Chemical and Volume Control System malfunction that results in a decrease in boron concentration in the reactor coolant. The reactor trip causes a turbine trip, and heat may be removed from the secondary system through the steam generator power operated relief valves or safety valves. Since no fuel damage occurs from this transient, the radiological consequences associated with this event are less severe than the steam line break event analyzed in Section 15.1.5.

15.4.6.4 Conclusions Although the above results do not explicitly demonstrate fulfillment of the Standard Review Plan requirements for Modes 3-5, (Reference 7) states that these requirements will not be backfitted to operating plants. The results presented for Modes 1-2 above show that there is adequate 15.4 - 18 (13 APR 2020)

McGuire Nuclear Station UFSAR Chapter 15 time for the operator to manually terminate the source of dilution flow. Following termination of the dilution flow, the reactor will be in a stable condition. The operator can then initiate reboration to recover the shutdown margin.

15.4.7 Inadvertent Loading and Operation of a Fuel Assembly in an Improper Position 15.4.7.1 Identification of Causes and Accident Description Fuel and core loading errors such as can arise from the inadvertent loading of one or more fuel assemblies into improper positions, loading a fuel rod during manufacture with one or more pellets of the wrong enrichment or the loading of a full fuel assembly during manufacture with pellets of the wrong enrichment will lead to increased heat fluxes if the error results in placing fuel in core positions calling for fuel of lesser enrichment. Also included among possible core loading errors is the inadvertent loading of one or more fuel assemblies requiring burnable poison rods into a new core without burnable poison rods.

Any error in enrichment, beyond the normal manufacturing tolerances, can cause power shapes which are more peaked than those calculated with the correct enrichments. A penalty is applied to the design peaking factors to account for power peaking changes within the allowed operating axial offset limits. The incore system of moveable flux detectors, which is used to verify power shapes at the beginning of cycle, is capable of revealing any assembly enrichment error or loading error which causes power shapes to be peaked in excess of the design value.

To reduce the probability of core loading errors, each fuel assembly is marked with an identification number and loaded in accordance with a core loading diagram. During core loading, the identification number will be checked before each assembly is moved into the core.

A process is in place to indentify fuel assembly identification numbers and associated insert types to ensure fuel assemblies are placed within correct core locations.

The power distortion due to any combination of misplaced fuel assemblies can significantly raise peaking factors which would be readily observable with incore flux monitors. In addition to the flux monitors, thermocouples are located at the outlet of about one third of the fuel assemblies in the core. There is a high probability that these thermocouples would also indicate any abnormally high coolant enthalpy rise. Incore flux measurements and core symmetry checks are performed during the startup subsequent to every refueling operation.

The inadvertent loading and operation of a fuel assembly in an improper position is classified as an ANS Condition III event, a infrequent fault. See Section 15.0 for a discussion of Condition III events.

15.4.7.2 Analysis of Effects and Consequences Method of Analysis Per Section 14.3.3, a low power level flux map is taken during the initial cycle startup. The moveable incore flux detector system provides measured reaction rates that are compared to predicted reaction rates. The deviations between these values (or the calculated assembly powers) are compared to the acceptance criteria presented in Section 14.3.3.

For analysis purposes, predicted reaction rates (for all functioning moveable incore locations) from a large number of postulated misloaded cores are compared to the predicted reaction rates for a correctly loaded core. Deviations that exceed the acceptance criteria allow detection of an incorrectly loaded core. If the loading error does not violate the acceptance criteria, a second (13 APR 2020) 15.4 - 19

UFSAR Chapter 15 McGuire Nuclear Station check is made to verify that the power peaking at all times in the cycle will not challenge the DNB limits of the fuel, thereby preventing any loading error induced fuel failures. If needed, the cycle specific acceptance criteria are made more restrictive than those listed in Section 14.3.3 to help detect a core loading error.

The power distributions are calculated using the NRC approved computer codes described in Chapter 4.

A sufficiently large number of loading errors, with a range of reactivity changes and at various core locations, are modeled to ensure the effectiveness of the acceptance criteria used in the initial startup procedures. The scenarios considered include:

1) Two assemblies being swapped with each other in the core, excluding misloads that result in invalid control rod configurations.

2) Burnable poisons being misloaded, either manufactured wrong or two feed assemblies with different burnable poisons being interchanged.

3) Any one feed assembly with an incorrect enrichment.

4) Swapping a typical discharged assembly from the spent fuel pool with any assembly in the core.

For each of these core loading error cases, the percent deviations in the assembly powers from a normally loaded core are shown at all incore detector locations. (See Figure 15-82 to Figure 15-86, inclusive).

Results The following example core loading error cases are presented:

Case 1:

This case assumes a feed assembly is interchanged with a reinsert asssembly. The particular case shown in Figure 15-82 was the interchange of two nearby assemblies near the periphery of the core. This example loading error would not maintain DNB margin if operated at nominal conditions, but the measured errors are greater than the acceptance criteria so the misload would be identified prior to achieving a power level that would challenge DNB.

Case 2:

This case assumes a burnable absorber is placed in the core incorrectly. Two examples are presented for this case in Figure 15-83 and Figure 15-84.

In Case 2-A, two feed assemblies with different burnable absorbers are interchanged. This example loading error maintains positive DNB margin at nominal conditions.

In Case 2-B, a feed assembly is manufactured with incorrect burnable absorbers. This example loading error would not maintain positive DNB margin if operated at nominal conditions, but the measured errors are greater than the acceptance criteria so the misload would be identified prior to achieving a power level that would challenge DNB.

Case 3:

This case assumes a feed assembly has a higher than expected enrichment at the center of the core as shown in Figure 15-85. This example loading error maintains positive DNB margin at nominal conditions.

Case 4:

15.4 - 20 (13 APR 2020)

McGuire Nuclear Station UFSAR Chapter 15 This case assumes a feed assembly is replaced by a discharged fuel assembly loaded near the core periphery as shown in Figure 15-86. This example loading error maintains positive DNB margin at nominal conditions.

15.4.7.3 Environmental Consequences There are no radiological consequences associated with inadvertent loading and operation of a fuel assembly in an improper position since activity is contained within the fuel rods and the Reactor Coolant System remains within design limits.

15.4.7.4 Conclusions Fuel assembly enrichment errors should be prevented by administrative procedures implemented in fabrication.

In the event that a single pin or pellet has a higher enrichment than the nominal value, the consequences in terms of reduced DNBR and increased fuel and clad temperatures will be limited to the incorrectly loaded pin or pins.

Fuel assembly loading errors are prevented by administrative procedures implemented during core loading. In the unlikely event that a loading error occurs, analyses in this section confirm that resulting power distribution effects will either be readily detected by the incore moveable detector system or will cause a sufficiently small perturbation as to be acceptable and the DNB limit would not be exceeded during Condition 1 transients.

15.4.8 Spectrum of Rod Cluster Control Assembly Ejection Accidents 15.4.8.1 Identification of Causes and Accident Description This accident is defined as the mechanical failure of a control rod mechanism pressure housing resulting in the ejection of a rod cluster control assembly (RCCA) and drive shaft. The consequence of this mechanical failure is a rapid positive reactivity insertion together with an adverse core power distribution, possibly leading to localized fuel rod damage.

15.4.8.1.1 Design Precautions and Protection Certain features in the McGuire units are intended to preclude the possibility of a rod ejection accident, or to limit the consequences if the accident were to occur. These include a sound, conservative mechanical design of the rod housings, a thorough quality control (testing) program during assembly, and a nuclear design which lessens the potential ejection worth of RCCA's and minimizes the number of RCCA's inserted at high power levels.

Mechanical Design The mechanical design is discussed in Section 4.2.3. Mechanical design and quality control procedures intended to preclude the possibility of a RCCA drive mechanism housing failure are listed below:

1. Each full length control rod drive mechanism housing is completely assembled and shop tested at 4100 psi.

2. The mechanism housings are individually hydrotested after they are attached to the head adapters in the reactor vessel head, and checked during the hydrotest of the completed reactor coolant system.

(13 APR 2020) 15.4 - 21

UFSAR Chapter 15 McGuire Nuclear Station

3. Stress levels in the mechanism are not affected by anticipated system transients at power, or by the thermal movement of the coolant loops. Moments induced by the design earthquake can be accepted within the allowable primary working stress range specified by the ASME Code,Section III, for Class 1 components.

4. The latch mechanism housing and rod travel housing are each a single length of forged Type-304 stainless steel. This material exhibits excellent notch toughness at all temperatures which will be encountered.

A significant margin of strength in the elastic range together with the large energy absorption capability in the plastic range gives additional assurance that gross failure of the housing will not occur. The joints between the latch mechanism housing and head adapter, and between the latch mechanism housing and rod travel housing, are threaded joints reinforced by canopy type rod welds. Administrative regulations require periodic inspections of these (and other) welds.

Nuclear Design Even if a rupture of a RCCA drive mechanism housing is postulated, the operation of a plant utilizing chemical shim is such that the severity of an ejected RCCA is inherently limited. In general, the reactor is operated with the RCCA's inserted only far enough to permit load follow.

Reactivity changes caused by core depletion and xenon transients are typically compensated for by boron changes. Further, the location and grouping of control RCCA banks are selected during the nuclear design to lessen the severity of a RCCA ejection accident. Therefore, should a RCCA be ejected from its normal position during full power operation, only a minor reactivity excursion, at worst, could be expected to occur.

However, it may be occasionally desirable to operate with larger than normal RCCA insertions.

For this reason, a rod insertion limit is defined as a function of power level. Operation with the RCCA's above this limit guarantees adequate shutdown capability and acceptable power distribution. The position of all RCCA's is continuously indicated in the control room. An alarm will occur if a bank of RCCA's approaches its insertion limit or if one RCCA deviates from its bank. Operating procedures require boration at low level alarm and emergency boration at the low-low alarm, unless the condition is expected due to a runback.

Reactor Protection The protection for this accident is provided by high neutron flux trip (high and low setting) and high neutron flux rate trip. These protection functions are described in detail in Section 7.2.

Effects on Adjacent Housings Disregarding the remote possibility of the occurrence of a RCCA mechanism housing failure, investigations have shown that failure of a housing due to either longitudinal or circumferential cracking would not cause damage to adjacent housings. However, even if damage is postulated, it would not be expected to lead to a more severe transient since RCCA's are inserted in the core in symmetric patterns, and control rods immediately adjacent to worst ejected rods are not in the core when the reactor is critical. Damage to an adjacent housing could, at worst, cause that RCCA not to fall on receiving a trip signal; however, this is already taken into account in the analysis by assuming that the ejected rod and the remaining highest worth rod does not fall into the reactor core.

15.4.8.1.2 Limiting Criteria This event is classified as an ANS Condition IV incident. See Section 15.0 for a discussion of ANS classifications. Due to the extremely low probability of a RCCA ejection accident, some fuel damage could be considered an acceptable consequence.

15.4 - 22 (13 APR 2020)

McGuire Nuclear Station UFSAR Chapter 15 Based on the requirements of Section 15.4.8 of NUREG-0800, Reference 16, the following criteria are applicable to the rod ejection event to reduce the probability of fuel dispersal in the coolant, gross lattice distortion or severe shock waves, and to limit offsite dose.

1. The radially averaged fuel pellet shall not exceed 280 cal/gm at any axial location. This criterion ensures that a coolable core geometry is maintained.

2. Offsite dose consequences must be shown to be "well within" the 10CFR 100 dose limits of 25 rem whole-body and 300 rem to the thyroid. "Well within" is interpreted to be less than 25% of the above values. The radionuclide source term used in the dose analysis is determined by conservatively predicting the number of fuel pins in DNB and the percentage of melted fuel.

3. The peak Reactor Coolant System pressure must be within Service Limit C as defined by the ASME code, Reference 17. The peak Reactor Coolant System pressure is 3000 psia or 120% of the 2500 psia design pressure per Reference 15.

15.4.8.2 Analysis of Effects and Consequences 15.4.8.2.1 Stages of Analysis Method of Analysis The analysis of the rod ejection event is complex and requires the application of a sequence of computer codes. The core power response is simulated with a three-dimensional transient neutronic and thermal-hydraulic model using the SIMULATE-3K code, Reference 24. The resulting transient core power distribution results are then input to VIPRE-01 (Reference 6) core thermal-hydraulic models. The VIPRE-01 models calculate the peak fuel pellet enthalpy, the allowable power peaking to avoid exceeding the DNBR limit, and the core coolant expansion rate. The allowable power peaking is then used along with a post-ejected condition fuel pin census to determine the percent of pins in DNB (failed fuel pins). The coolant expansion rate is input to a RETRAN-02 (Reference 1) model of the Reactor Coolant System to determine the peak pressure resulting from the core power excursion.

A detailed discussion of the method of analysis can be found in References 15 and 25.

Nuclear Analysis Model Deleted Per 2006 Update.

The SIMULATE-3K code is a three-dimensional transient neutronic version of the SIMULATE-3P code. SIMULATE-3K uses the QPANDA full two-group nodal spatial model developed in SIMULATE-3P, with the addition of six delayed neutron groups. The program employs a fully-implicit time integration of the neutron flux, delayed neutron precursor, and heat conduction models. Beta is fully functionalized as similar to other cross sections to provide a value of beta for the time-varying neutron flux. Additional features of SIMULATE-3K include the application of conservatism to key physics parameters through simple user input.

The SIMULATE-3K thermal-hydraulic model includes a spatial heat conduction and a hydraulic channel model. The heat conduction model solves the conduction equation on a multi-region mesh in cylindrical coordinates. Temperature-dependent values may be employed for the heat capacity, thermal conductivity, and gap conductances. A single characteristic pin conduction calculation is performed consistent with the radial neutronic node geometry. Burnup dependent models may be employed for the thermal conductivity, gap conductance and for the pellet radial profile. A single characteristic hydraulic channel calculation is performed based on the radial neutronic node geometry. This thermal-hydraulic model is used to determine fuel and moderator (13 APR 2020) 15.4 - 23

UFSAR Chapter 15 McGuire Nuclear Station temperatures for updating the cross-sections, and used to provide edits of fuel temperature throughout the transient.

The SIMULATE-3K model is used to calculate the transient core power response versus time, and the radial, total and axial peaking factors by assembly for selected time steps. This information is used by VIPRE-01 to determine the fuel temperature, enthalpy, and the amount of fuel failures resulting from DNB.

Core Thermal-Hydraulic Analysis Model The VIPRE-01 code is used for the rod ejection analysis thermal evaluations. VIPRE-01 is a subchannel thermal-hydraulic computer code. With the subchannel analysis approach, the nuclear fuel element is divided into a number of quasi one-dimensional channels that communicate laterally by diversion crossflow and turbulent mixing. Given the geometry of the reactor core and coolant channel, and the boundary conditions or forcing functions, VIPRE-01 calculates core flow distributions, coolant conditions, fuel rod temperatures and the departure from nucleate boiling ratio (DNBR) for steady-state and transient conditions. VIPRE-01 accepts all necessary boundary conditions that originate either from a system transient simulation code such as RETRAN, or a transient core neutronics simulation code such as SIMULATE-3K.

Included is the capability to impose different boundary conditions on different segments of the core model.

Fuel Temperature and Enthalpy Calculation In order to show that the peak fuel enthalpy acceptance criterion described in Section 15.4.8.1.2 is met, a VIPRE model with fuel conduction is utilized to calculate the maximum hot spot fuel temperature and enthalpy during the transient. Given the transient core neutron power and core power distribution obtained from the SIMULATE-3K analysis, this VIPRE-01 model calculates the transient maximum hot spot average fuel temperature and the maximum radial average fuel enthalpy. In the analysis, the fuel pellet power profile, the gap conductivity, clad-to-coolant heat transfer correlations, and flow correlations are selected to give conservative maximum hot spot fuel temperature and enthalpy results during the transient.

Coolant Expansion Rate Calculation If the peak fuel enthalpy criterion is met, there is little chance of fuel dispersal into the coolant.

Therefore, the Reactor Coolant System expansion rate may be calculated using conventional heat transfer from the fuel and prompt heat generation in the coolant. This rate must be calculated with the consideration of the spatial power distribution before and during the transient since this rate, at any location in the reactor core, depends on the initial amount of subcooling and the rate of change of the heat added into the coolant channels. Using the SIMULATE-3K transient calculation results, the VIPRE-01 model calculates the flow rate in each channel during the transient. Using the VIPRE-01 channel flow rates, the total coolant expansion rate is calculated. This total coolant expansion rate is input to a RETRAN plant transient model for simulating the resulting pressure response. In the analysis, the fuel pellet power profile, the gap conductivity, clad-to-coolant heat transfer coefficients, and flow correlations are selected to give conservative coolant expansion rate calculation result.

DNBR Evaluation To determine the dose consequences, an analysis is performed using the VIPRE-01 code to determine the percentage of the core experiencing DNB. The allowable power peaking to avoid exceeding the DNBR limit during the transient is determined. Those fuel pins which exceed the DNBR limit are assumed to fail. The correlation used is WRB-2M (Reference 23) for Westinghouse RFA fuel, with its respective non-SCD DNBR limit. In the analysis, the fuel pellet 15.4 - 24 (13 APR 2020)

McGuire Nuclear Station UFSAR Chapter 15 power profile, the gap conductivity, clad-to-coolant heat transfer coefficents, and flow correlations are selected to give conservative DNBR and allowable power peaking results during the transient.

15.4.8.2.2 Calculation of Basic Parameters Input parameters for the analysis are conservatively selected on the basis of values calculated for this type of core. The more important parameters are discussed below. Table 15-4 and Table 15-20 present the parameters used in this analysis.

Ejected Rod Worths and Hot Channel Factors The ejected rod worths used in rod ejection accident licensing are calculated with the SIMULATE-3K code. The magnitude of the ejected rod worths analyzed are selected such that they bound expected ejected rod worths of future core designs. The cycle specific confirmation of these worths is performed using three dimensional steady state neutronics codes which have been approved for reload design analyses.

Ejected rod worth calculations are performed assuming that the control banks containing the ejected rod are inserted to the power dependent rod insertion limit, including uncertainties. For ejected rod worth calculations performed at power, no credit is taken for the reactivity feedback resulting from the increase in fuel temperature and moderator temperature during the transient.

The effects of transient xenon conditions are also considered.

The licensing analysis hot channel factors for the post ejected condition are calculated as described in Reference 25 (SIMULATE-3K) and are based on the transient analysis results using a conservative set of initial conditions for the rod ejection event. Confirmation that rod ejection hot channel factors remain bounding for reload cores is accomplished through a series of three dimensional static calculations using steady state neutronic codes approved for reload design analysis. The calculations performed take no credit for moderator or fuel temperature feedback but does account for the effects of adverse xenon distributions.

Moderator and Doppler Coefficient The moderator and Doppler temperature coefficients used by SIMULATE-3K were adjusted to bound expected values for these parameters which are expected to occur in future reload core designs. The method used to adjust both the Doppler and moderator temperature coefficients is described in Reference 25.

Delayed Neutron Fraction, Calculations of the effective delayed neutron fraction (eff) typically yield values no less than 0.60 percent at beginning of life and 0.50 percent at end of life for the first cycle. The accident is sensitive to if the ejected rod worth is equal to or greater than as in zero power transients.

In order to allow for future cycles, pessimistic estimates of of 0.56 percent at beginning of cycle and 0.47 percent at end of cycle were used in the analysis.

Trip Reactivity Insertion The trip reactivity assumed in the rod ejection accident is set conservatively small by reducing the amount of shutdown reactivity available by both the worth of the ejected rod and the worth of the highest worth remaining rod. The net effect of this requirement is to reduce the available shutdown margin to a conservatively small value. Trip reactivity is modelled by either one of two methods. In the first method, the insertion of this reactivity is modelled by dropping several control banks of the required worth into the reactor core. The start of rod motion occurs at 0.5 seconds after the high neutron flux trip setpoint is reached. A curve of trip rod insertion versus (13 APR 2020) 15.4 - 25

UFSAR Chapter 15 McGuire Nuclear Station time is used which assumes that insertion to the dashpot does not occur until 2.2 seconds after the start of fall. The choice of such a conservative insertion rate means that there is approximately one second after the trip point is reached before significant shutdown reactivity is inserted into the core. This is a particularly important conservatism for hot full power accidents.

In the second method, the effect of top and bottom xenon is explicitly accounted for. Trip reactivity is modelled by assuming that both the ejected rod and an adjacent rod do not fall into the reactor core. The worth of the remaining rods is reduced by a cross section adjustment.

The trip insertion time is assumed to be at the technical specification limit. The rate of reactivity insertion in this method is determined by the initial condition xenon distribution and the resulting axial power distribution Conservatism is maintained by the reduction in rod worth, by the delay in the start of control rod motion and by assuming a technical specification control rod drop time.

The minimum design shutdown available at HZP may be reached only at end of life in the equilibrium cycle. This value includes an allowance for the worst stuck rod, transient xenon effects, conservative Doppler and moderator defects, and an allowance for calculational uncertainties. Physics calculations have shown that the effect of two stuck RCCA's (one of which is the worst ejected rod) is to reduce the shutdown margin by about an additional one percent k/k. Therefore, following a reactor trip resulting from an RCCA ejection accident, the reactor will be subcritical when the core returns to HZP.

Reactivity Effects of Small Break LOCA Aspects of Rod Ejection Accident Depressurization calculations have been performed for a typical four-loop plant assuming the maximum possible size break (2.75 inch diameter) located in the reactor pressure vessel head.

The results show a rapid pressure drop and a decrease in system water mass due to the break.

The safety injection system is actuated on low pressurizer pressure within one minute after the break.

The reactor coolant system pressure continues to drop and reaches saturation (1100 to 1300 psi depending on the system temperature) in about two to three minutes. Due to the large thermal inertia of primary and secondary system, there has been no significant decrease in the reactor coolant system temperature below no-load by this time, and the depressurization itself has caused an increase in shutdown margin by about 0.2 percent k/k due to the pressure coefficient. The cooldown transient could not absorb the available shutdown margin until more than ten minutes after the break. The addition of borated safety injection flow starting one minute after the break is much more than sufficient to ensure that the core remains subcritical during the cooldown.

Reactor Protection As discussed in Section 15.4.8.1.1, reactor protection for a rod ejection is provided by high neutron flux trip (high and low setting) and high neutron flux rate trip. These protection functions are part of the Reactor Protection System. No single failure of the Reactor Protection System will negate the protection functions required for the rod ejection accident, or adversely affect the consequences of the accident.

Results Cases are presented for both beginning and end of life at zero and full power for the Westinghouse RFA fuel type.

1. Beginning of Cycle, Full Power 15.4 - 26 (13 APR 2020)

McGuire Nuclear Station UFSAR Chapter 15 Control bank D was assumed to be inserted to its insertion limit including uncertainties. The worst ejected rod worth and hot channel factor were calculated to be $0.19 and 4.90 respectively. The peak clad temperature was 798°F. The peak hot spot fuel center temperature was 5068°F.

2. Beginning of Cycle, Zero Power Control bank D was assumed to be fully inserted and banks B and C were at their insertion limits. The worst ejected rod is located in control bank D and has a worth of $1.32 and a hot channel factor of 19.60. The peak clad temperature reached 741°F, and the fuel center temperature was 2062°F.

3. End of Cycle, Full Power Control bank D was assumed to be inserted to its insertion limit including uncertainties. The worst ejected rod worth and hot channel factors were calculated to be $0.26 and 4.84 respectively. This resulted in a peak clad temperature of 1296°F. The peak hot spot fuel temperature reached 4326°F.

4. End of Cycle, Zero Power Control bank D was assumed to be fully inserted and bank C was at its insertion limit. The ejected rod has a worth of $1.45 and a hot channel factor of 20.78 respectively. The peak clad and fuel center temperatures were 768°F and 1640°F respectively.

5. Beginning of Cycle, Full Power Peak RCS Pressure A detailed calculation of the pressure surge for the worst case, at beginning of life, hot full power, indicates that the peak pressure does not exceed that which would cause stress to exceed the faulted condition stress limits as discussed in Section 15.4.8.

A summary of the cases presented above is given in Table 15-20. The nuclear power transient response for the BOC HFP and EOC HZP cases is presented in Figure 15-184 and Figure 15-185.

The calculated sequence of events for the rod ejection accidents as shown in Figure 15-184 and Figure 15-185, is presented in Table 15-19. For all cases, Doppler feedback terminates the power excursion, and then the reactor trip shuts the reactor down. As discussed previously in Section 15.4.8.2.2, the reactor will remain subcritical following reactor trip.

The ejection of an RCCA constitutes a break in the Reactor Coolant System, located in the reactor pressure vessel head. The effects and consequences of loss of coolant accidents are discussed in Section 15.6.5. Following the RCCA ejection, the operator would follow the same emergency instructions as for any other loss of coolant accident to recover from the event.

Fission Product Release It is assumed that fission products are released from the gaps of all rods entering DNB. The amount of failed fuel for each case analyzed is shown in Table 15-20. The BOC, HFP case is the limiting case. Less than 22% of the rods entered DNB.

Lattice Deformations A large temperature gradient will exist in the region of the hot spot. Since the fuel rods are free to move in the vertical direction, differential expansion between separate rods cannot produce distortion. However, the temperature gradients across individual rods may produce a differential expansion tending to bow the midpoint of the rods toward the hotter side of the rod. Calculations have indicated that this bowing would result in a negative reactivity effect at the hot spot since Westinghouse cores are under-moderated, and bowing will tend to increase the under-(13 APR 2020) 15.4 - 27

UFSAR Chapter 15 McGuire Nuclear Station moderation at the hot spot. Since the 17 x 17 fuel design is also under-moderated, the same effect would be observed. In practice, no significant bowing is anticipated, since the structural rigidity of the core is more than sufficient to withstand the forces produced. Boiling in the hot spot region would produce a net flow away from that region. However, the heat from the fuel is released to the water relatively slowly, and it is considered inconceivable that cross flow will be sufficient to produce significant lattice forces. Even if massive and rapid boiling, sufficient to distort the lattice, is hypothetically postulated, the large void fraction in the hot spot region would produce a reduction in the total core moderator to fuel ratio, and a large reduction in this ratio at the hot spot. The net effect would therefore be a negative feedback. It can be concluded that no conceivable mechanism exists for a net positive feedback resulting from lattice deformation.

In fact, a small negative feedback may result. The effect is conservatively ignored in the analysis.

Deleted Per 2006 Update.

15.4.8.3 Environmental Consequences The rod ejection accident inventory is listed in Table 15-10. The accident assumes 22% of the fuel pins experience DNB. Regulatory Guide 1.183 illustrates the methodology used for this analysis.

The rod ejection accident may be followed with releases of radioactivity from the steam generators. Radioactivity is assumed to be transported to the SG secondary sides with tube leakage. Periods of tube bundle uncovery exist, which affect how much iodine is partitioned and released to the environment. Containment leakage is also assumed to be released to the environment. These two dose constituents are then summed.

The dose consequences for this accident are listed in Table 15-12. Note that the EAB dose corresponds to the highest dose over any 2-hour duration during the accident. For additional detail regarding the inputs for this analysis, see table Table 15-21.

15.4.8.4 Conclusions Even on a pessimistic basis, the analyses indicate that the described fuel and clad limits are not exceeded. It is concluded that there is no danger of sudden fuel dispersal into the coolant.

Since the peak pressure does not exceed that which would cause stresses to exceed the faulted condition stress limits, it is concluded that there is no danger of further consequential damage to the Reactor Coolant System. The analyses have demonstrated that an upper limit in fission product release, as a result of a number of fuel rods entering DNB, amounts to twenty-two percent.

15.4.9 Spectrum of Rod Drop Accidents (BWR)

(Not Applicable to McGuire.)

15.4.10 References

1. EPRI, "RETRAN-02: A Program for Transient Thermal-Hydraulic Analysis of Complex Fluid Flow Systems", EPRI NP-1850-CCM-A, Revision 6.1, June 2007.

2. Deleted Per 1998 Update.

3. Deleted Per 1998 Update.

15.4 - 28 (13 APR 2020)

McGuire Nuclear Station UFSAR Chapter 15

4. Deleted Per 1998 Update.

5. Letter (NS-TMA-2182) from T.M. Anderson (Westinghouse) to S.H. Hanauer (NRC) dated December 30, 1979.

6. EPRI, "VIPRE-01: A Thermal-Hydraulic Code for Reactor Cores", EPRI NP-2511-CCM-A, Revision 4.5 February 2014.

7. U.S.N.R.C. Generic Letter 85-05, Inadvertent Boron Dilution Events, January 31, 1985.

8. "Duke Power Company Thermal-Hydraulic Statistical Core Design Methodology", DPC-NE-2005P-A, Revision 4a, December 2008.

9. Deleted Per 1998 Update.

10. Deleted Per 1998 Update.

11. Deleted Per 1998 Update.

12. DPC-NE-2011-PA, Nuclear Design Methodology for Core Operating Limits of Westinghouse Reactors, Duke Power Company, Revision 1a, June 2009.

13. Letter from R. E. Martin (USNRC) to M. S. Tuckman (DPC), "Safety Evaluation of Topical Report BAW-10173P, Revision 2, Mark-BW Reload Safety Analysis for Catawba and McGuire," February 20, 1991.

14. Deleted Per 1998 Update.

15. DPC-NE-3001-PA, "Multidimensional Reactor Transients and Safety Analysis Physics Parameters Methodology", Duke Power Company, Revision 1, March 2015.

16. USNRC Standard Review Plan, Section 15.4.8, NUREG-0800, Rev. 2, July 1981.

17. ASME Boiler and Pressure Vessel Code,Section III, "Nuclear Power Plant Components",

ASME.

18. Deleted per 2011 Update.

19. Deleted Per 2006 Update.

20. Deleted Per 2001 Update.

21. Deleted Per 2001 Update.

22. Deleted Per 2006 Update.

23. WCAP-15025-P, Modified WRB-2 Correlation, WRB-2M, for Predicting Critical Heat Flux in 17x17 Rod Bundles with Modified LPD Mixing Vane Grids, Westinghouse, February 1998.

24. SIMULATE-3K Models & Methodology, SSP-98/13, Rev. 6, /Studsvik Scandpower, January 2009

25. DPC-NE-2009-PA, Westinghouse Fuel Transition Report, Duke Power Company, Revision 3a, September 2011.

26. Letter from V. Nerses (USNRC) to H. B. Barron (Duke), Issuance of Amendments -

McGuire Nuclear Station, Units 1 and 2 (TAC Nos. M90590 and M90591), May 5, 1997 (and enclosed Safety Evaluation).

THIS IS THE LAST PAGE OF THE TEXT SECTION 15.4.

(13 APR 2020) 15.4 - 29

UFSAR Chapter 15 McGuire Nuclear Station THIS PAGE LEFT BLANK INTENTIONALLY.

15.4 - 30 (13 APR 2020)

McGuire Nuclear Station UFSAR Chapter 15 15.5 Increase in Reactor Coolant Inventory A number of events have been postulated which could result in an increase in Reactor Coolant System inventory. Detailed analyses are presented for several such events which have been identified as limiting cases.

Discussions of the following events are presented in this section:

1. Inadvertent Operation of Emergency Core Cooling System During Power Operation

2. Chemical and Volume Control System Malfunction That Increases Reactor Coolant Inventory

3. A number of BWR Transients (Not applicable to McGuire)

The above are considered to be ANS Condition II events. Section 15.0 contains a discussion of ANS classifications and applicable acceptance criteria.

15.5.1 Inadvertent Operation of Emergency Core Cooling System During Power Operation 15.5.1.1 Identification of Causes and Accident Description Spurious Emergency Core Cooling System (ECCS) operation at power could be caused by operator error or a false electrical actuation signal. A spurious signal may originate from any of the safety injection actuation channels as described in Section 7.3.

Following the actuation signal, the suction of the centrifugal charging pumps is diverted from the volume control tank to the refueling water storage tank. The charging pumps then force highly concentrated boric acid solution from the refueling water storage tank through the header and injection lines and into the cold leg of each loop. The safety injection pumps also start automatically but provide no flow when the Reactor Coolant System is at normal pressure. The passive accumulators and the low head system also provide no flow at normal Reactor Coolant System pressure.

A Safety Injection System (SIS) signal normally results in a reactor trip followed by a turbine trip.

However, it cannot be assumed that any single fault that actuates the SIS will also produce a reactor trip. If a reactor trip is generated by the spurious SIS signal, the operator should determine if the spurious signal was transient or steady state in nature. The operator must also determine if the safety injection signal should be blocked. For a spurious occurrence, the operator would stop the safety injection and maintain the plant in the hot standby condition. If the ECCS actuation instrumentation must be repaired, future plant operation will be in accordance with the Technical Specifications.

If the Reactor Protection System does not produce an immediate trip as a result of the spurious SIS signal, the reactor experiences a negative reactivity excursion due to the injected boron causing a decrease in reactor power. The power mismatch causes a drop in Tavg and consequent coolant shrinkage. Pressurizer pressure and water level drop. Load will decrease due to the effect of reduced steam pressure on load after the turbine throttle valve is fully open.

If automatic rod control is used, these effects will be lessened until the rods have moved out of the core. The transient is eventually terminated by the Reactor Protection System low pressurizer pressure trip or by manual trip.

(13 APR 2020) 15.5 - 1

UFSAR Chapter 15 McGuire Nuclear Station The time to trip is affected by initial operating conditions including core burnup history, which affects initial boron concentration, rate of change of boron concentration, and Doppler and moderator coefficients.

Recovery from this second case is made in the same manner as described for the case where the SIS signal results directly in a reactor trip. The only difference is the lower Tavg and pressure associated with the power mismatch during the transient. The time at which reactor trip occurs is of little concern for this transient. At lower loads coolant contraction will be slower resulting in a longer time to trip.

Inadvertent operation of the ECCS at power is classified as a Condition II event, a fault of moderate frequency. See Section 15.0 for a discussion of Condition II events.

15.5.1.2 Analysis of Effects and Consequences Method of Analysis The inadvertent operation of the Emergency Core Cooling System could be caused by either operator error or by a spurious electrical actuation signal. Upon receipt of the actuation signal, the centrifugal charging pumps begin delivering highly borated Refueling Water Storage Tank water to the Reactor Coolant System. The resultant negative reactivity insertion causes a decrease in core reactivity and, consequently, a decrease in temperature. Initially, coolant shrinkage causes a reduction in both pressurizer water level and pressure. Core cooling capability (DNB) is the primary concern during this time period due to the decrease in system pressure. Following the initial depressurization, the increase in reactor coolant inventory causes pressurizer level to increase and pressurization to occur. Pressurizer level might increase sufficiently to overfill the pressurizer and cause water relief through the pressurizer safety valves (PSVs). Water relief through the PSVs could degrade valve operability and lead to a Condition III event.

Core Cooling Evaluation The most severe potential challenge to core cooling occurs if the postulated transient is initiated from a full power initial condition. The magnitude of the pressure decrease for this transient is no more severe than that for the inadvertent opening of a pressurizer safety or relief valve transient, which will result in a reactor trip on low pressurizer pressure or overtemperature T.

Furthermore, the opening of a PSV does not introduce core power and Reactor Coolant System temperature decreases that are as severe as an inadvertent ECCS actuation. Neither event involves any reduction in the Reactor Coolant System flow rate, since the reactor coolant pumps are not tripped. Therefore, the DNB results of this transient are bounded by the inadvertent opening of a pressurizer safety or relief valve transient. A quantitative core cooling capability analysis of this transient is therefore not a part of the licensing basis.

Pressurizer Overfill Analysis The concern in the pressurizer overfill analysis is that water relief through the PSVs will degrade valve operability and lead to a Condition III event. However, even if water relief occurs, valve operability is not degraded provided that the temperature of the pressurizer water is sufficiently high. Therefore, the acceptance criterion for this analysis is the minimum water relief temperature to ensure PSV operability. The following assumptions are made in performing this analysis:

1. A hot zero power initial condition is assumed in this analysis. Reference 3 states that the acceptable initial power for the analysis is the licensed core thermal power, i.e., full power.

However, lower power is more limiting in order to minimize the initial RCS system 15.5 - 2 (13 APR 2020)

McGuire Nuclear Station UFSAR Chapter 15 temperature. If overfill occurs at lower initial power, then the water relief temperature is more likely to be less than the acceptance criterion.

2. Actual system response to a safety injection (SI) would be an initial pressure drop then subsequent pressurization above initial pressure. During the depressurization phase, SI flow would increase above the initial flow rate, and during the pressurization phase SI flow would decrease below initial flow rate. RCS pressure is assumed conservatively low (1700 psia) to determine the SI flow during the event.

3. Low initial temperature (hot zero power programmed Tavg less the 4°F temperature allowance, or 553°F) is used in order to minimize pressurizer water temperature.

4. High steam generator tube plugging (20%) and a smaller primary system U-tube volume (Model D steam generators) are assumed in order to decrease the volume of the initial RCS water, which minimizes the RCS water temperature as it mixes with the cold SI water.

5. Per Technical Specification requirements for Modes 1 and 2, all reactor coolant pumps are assumed to be operating. Mixing of the cold SI water injected into the RCS cold legs reduces the temperature of the water in the RCS hot leg to which the pressurizer surge line is connected, thus reducing the temperature of the liquid which might be relieved through the PSVs.

6. The pressurizer heaters are assumed to be in manual and off since heater operation would increase the temperature of the pressurizer water. Normal makeup is isolated upon SI, and credit is taken neither for letdown to lessen the impact of the injected mass nor pressurizer sprays or PORVs to lessen the likelihood of PSV opening.

7. A maximum safety injection flow rate from both high head safety injection pumps (405 gpm) is assumed. RCS pressure remains above the shutoff head of the intermediate head and low head safety injection pumps for the duration of the event. Operator action is assumed in 15 minutes to terminate the flow from the high head safety injection pumps.

8. Minimum injection temperature (60°F) is assumed in order to minimize relief temperature.

Results Calculated PSV water relief temperature remains above 500°F. Relief of water at a temperature this high will not result in failure of the PSVs to close.

15.5.1.3 Environmental Consequences There are minimal radiological consequences associated with inadvertent ECCS operation. If the SIS signal results in a reactor trip, the reactor trip causes a turbine trip and heat may be removed from the secondary system through the steam generator power-operated relief valves or safety valves. Since no fuel damage is postulated to occur from this transient, the radiological consequences associated with atmospheric steam releases from this event would be less severe than the steam line break event analyzed in Section 15.1.5.

15.5.1.4 Conclusions Results of the analysis show that spurious safety injection without immediate reactor trip presents no hazard to the integrity of the Reactor Coolant System. Based on the DNB results presented for the inadvertent opening of a pressurizer safety or relief valve transient (15.6.1) there will be no cladding damage and no release of fission products to the Reactor Coolant System. If the reactor does not trip immediately, the low pressurizer pressure reactor trip will be (13 APR 2020) 15.5 - 3

UFSAR Chapter 15 McGuire Nuclear Station actuated. This trips the turbine and prevents excessive cooldown thereby expediting recovery from the incident.

15.5.2 Chemical and Volume Control System Malfunction That Increases Reactor Coolant Inventory An increase in reactor coolant inventory which results from the addition of cold, unborated water to the Reactor Coolant System is analyzed in Section 15.4.6. An increase in reactor coolant inventory which results from the injection of highly borated water into the Reactor Coolant System is analyzed in Section 15.5.1.

15.5.3 A Number of BWR Transients Not applicable to McGuire.

15.5.4 References

1. Deleted Per 1998 Update.

2. Deleted Per 1998 Update.

3. NUREG-0800, "USNRC Standard Review Plan".

THIS IS THE LAST PAGE OF THE TEXT SECTION 15.5.

15.5 - 4 (13 APR 2020)

McGuire Nuclear Station UFSAR Chapter 15 15.6 Decrease in Reactor Coolant Inventory A number of events have been postulated which could result in a decrease in Reactor Coolant System inventory. Detailed analyses are presented for several such events which have been identified as limiting cases.

Discussions of the following events are presented in this section:

1. Inadvertent opening of a pressurizer safety or relief valve.

2. Break in Instrument Line or other lines from reactor coolant pressure boundary that penetrate containment.

3. Steam Generator Tube Failure

4. BWR Piping failure outside containment (Not applicable to McGuire).

5. Loss-of-Coolant Accident resulting from a spectrum of postulated piping breaks within the Reactor Coolant Pressure Boundary.

6. A number of BWR transients (Not applicable to McGuire).

Items 1 and 2 are considered to be ANS Condition II events, item 5 entails both ANS Condition III and IV events, and item 3 is considered to be an ANS Condition IV event. Section 15.0 contains a discussion of ANS classifications and applicable acceptance criteria.

15.6.1 Inadvertent Opening of a Pressurizer Safety or Relief Valve 15.6.1.1 Identification of Causes and Accident Description An accidental depressurization of the Reactor Coolant System could occur as a result of an inadvertent opening of a pressurizer relief or safety valve. Since a safety valve is sized to relieve approximately twice the steam flowrate of a relief valve, and will therefore allow a much more rapid depressurization upon opening, the most severe core conditions resulting from an accidental depressurization of the Reactor Coolant System are associated with an inadvertent opening of a pressurizer safety valve. Initially the event results in a rapidly decreasing Reactor Coolant System pressure. The pressure decreases throughout the relatively short fraction of the transient which is simulated in a DNBR analysis. The effect of the pressure decrease would be to decrease power via the moderator density feedback, but the rod control system (if in the automatic mode) functions to maintain the power and average coolant temperature until reactor trip occurs.

The reactor might be tripped by either of the following Reactor Protection System signals:

1. Overtemperature T

2. Pressurizer low pressure An inadvertent opening of a pressurizer safety valve is classified as an ANS Condition II event, a fault of moderate frequency. See Section 15.0 for a discussion of Condition II events.

15.6.1.2 Analysis of Effects and Consequences Method of Analysis The accidental depressurization transient is analyzed by employing the detailed digital computer code RETRAN-02 described in the introduction to this chapter. The VIPRE-01 code is used to (13 APR 2020) 15.6 - 1

UFSAR Chapter 15 McGuire Nuclear Station calculate DNBR during the transient based on the RETRAN-02 boundary conditions. It is also analyzed with the Statistical Core Design Methodology as described in Reference 31. Plant characteristics and initial conditions are discussed in Section 15.0 (see Table 15-4).

The analysis utilizes a Catawba RETRAN model with a Model D5 steam generator. However, input assumptions are conservatively chosen such that the analysis results bound the analysis results of the Feedring Steam Generators (FSG) that are present in both McGuire units.

In order to give conservative results in calculating the DNBR during the transient, the following assumptions are made:

1. Initial reactor power, pressure, flow, and RCS temperatures are assumed to be at their nominal values. Uncertainties in initial conditions are included in the limit DNBR as described in Reference 31.

2. A zero moderator temperature coefficient of reactivity is assumed. The special effect of voiding due to local or subcooled boiling is not considered in the analysis with respect to reactivity feedback or core power shape.

3. A least negative Doppler temperature coefficient of reactivity is assumed.

Normal reactor control systems are not required to function. However, the rod control system is assumed to be in the manual mode. The Reactor Protection System functions to trip the reactor on the appropriate signal. No single active failure will prevent the Reactor Protection System from functioning properly.

Results The system response to an inadvertent opening of a pressurizer safety or relief valve is shown on Figure 15-94 (parts 1 and 2) and Figure 15-95. Figure 15-94 part 1 illustrates the nuclear power transient following the depressurization. Nuclear power maintains the initial value until reactor trip occurs on low pressurizer pressure. The pressure decay transient following the accident is given in Figure 15-94 part 2. Pressure drops more rapidly while core heat generation is reduced via the trip. The DNBR decreases initially, but increases rapidly following the trip, as shown in Figure 15-95. The DNBR remains above the limit value throughout the transient.

The calculated sequence of events for the inadvertent opening of a pressurizer safety valve incident is shown on Table 15-23.

15.6.1.3 Environmental Consequences The radiological consequences of this event are bounded by the consequences of the Loss of Coolant Accident.

15.6.1.4 Conclusions The results of the analysis show that the pressurizer low pressure Reactor Protection System signal provides adequate protection against the RCS depressurization event. No fuel or clad damage is predicted for this accident.

15.6 - 2 (13 APR 2020)

McGuire Nuclear Station UFSAR Chapter 15 15.6.2 Break In Instrument Line or Other Lines From Reactor Coolant Pressure Boundary That Penetrate Containment 15.6.2.1 Identification of Causes and Accident Description Instrument lines connected to the RCS that penetrate the containment are discussed in Section 6.2.4. There are also the sample lines from the hot legs of reactor coolant loops A and D, the sample lines from the steam and liquid space of the pressurizer, and the Chemical and Volume Control System (CVCS) letdown and excess letdown lines that penetrate the containment. In all cases the containment isolation provisions are designed in accordance with the requirements of General Design Criteria 55 of Appendix A to 10CFR 50.

A break in an instrument line or other lines from reactor coolant pressure boundary that penetrate containment is classified as an ANS Condition II event, a fault of moderate frequency.

See Section 15.0 for a discussion of Condition II events.

15.6.2.2 Analysis of Effects and Consequences The most severe pipe rupture with regard to radioactivity release during normal plant operation occurs in the CVCS. This would be a complete severance, at rated power conditions, of the 3 inch letdown line just outside containment, between the outboard letdown isolation valve and the letdown heat exchanger (see Figure 9-98). The occurrence of a complete severance of the letdown line would result in a loss of reactor coolant at the rate of approximately 150 gpm (referenced at a density of 62 lb/ft3). Since the release rate is within the capability of the reactor makeup system, it would not result in Engineered Safety Features System actuation. Area radiation and leakage detection instrumentation provide the primary means for detection of a letdown line rupture. Frequent operation of the CVCS reactor makeup control system and other CVCS instrumentation would aid the operator in identifying and isolating the rupture within 30 minutes. Once the rupture is identified, the operator would isolate the letdown line rupture by closing the letdown orifice isolation valves and the pressurizer low level letdown isolation valves.

Alternatively, the operator would close the letdown line isolation valve outside containment to isolate the rupture. All valves are provided with control switches at the main control board.

There are no single failures that would prevent isolation of the letdown line rupture.

15.6.2.3 Environmental Consequences The reactor coolant inventory is listed in Table 15-62 and Table 15-63. This accident involves a break in the NV system letdown line in the auxiliary building.

Two cases are analyzed for this accident scenario. One of the cases is a pre-existing spike case, where a reactor transient has occurred prior to the postulated instrument line break - this case uses a 60 µCi/g DE I-131 source term. The other case analyzed is the coincident spike scenario, which increases the release rate from the primary coolant to a value 335 times greater than the release rate corresponding to the equilibrium iodine concentration at 1.0 µCi/g DE I-131. Radioactivity is released (release fractions, iodine species) per the guidelines in Regulatory Guide 1.183 (Reference 67).

This accident consists of a break to a small line connected to the Reactor Coolant System. This occurs outside of containment. The break is small enough such that it would not prevent orderly reactor shutdown and cooldown assuming makeup is provided by normal makeup only.

Therefore, the instrument line break does not include a unit trip, safety injection, or any ESF actuation.

(13 APR 2020) 15.6 - 3

UFSAR Chapter 15 McGuire Nuclear Station The break occurs in an NV system line. The break occurs downstream of the Regenerative Heat Exchanger and letdown orifices, but upstream of the Letdown Heat Exchanger. See Table 15-37 for specific values assumed in the analysis.

The flow in the letdown line increases with the break while the pressure in the line drops. The NV charging flow offsets the letdown line break flow somewhat, but not entirely. The level in the volume control tank decreases given the difference between the break flow and charging flow.

Any or all of these symptoms would be noticed by control room operators, who terminate the break within 30 minutes of accident initiation.

The dose consequences for this accident are calculated using methods described in Regulatory Guide 1.183 (Reference 67). The calculated doses are listed in Table 15-12. Note that the EAB dose corresponds to the highest dose over any 2-hour duration during the accident.

15.6.3 Steam Generator Tube Failure 15.6.3.1 Identification of Causes and Accident Description The accident examined is the complete severance of a single steam generator tube. The accident is assumed to take place at power with the reactor coolant contaminated with fission products corresponding to continuous operation with a limited amount of defective fuel rods.

The accident leads to an increase in contamination of the secondary system due to leakage of radioactive coolant from the RCS. In the event of a coincident loss of offsite power, or failure of the condenser steam dump system, discharge of activity to the atmosphere takes place via the steam generator safety and/or power operated relief valves.

In view of the fact that the steam generator tube material is Inconel-690, which is highly ductile, it is considered that the assumption of a complete severance is somewhat conservative. The more probable mode of tube failure would be one or more minor leaks of undetermined origin.

Activity in the Steam and Power Conversion System is subject to continual surveillance and an accumulation of minor leaks which exceeds the limit established in the Technical Specifications is not permitted during the unit operation.

The operator is expected to determine that a steam generator tube rupture has occurred, and to identify and isolate the affected steam generator within 15 minutes after reactor trip, or when any narrow range steam generator level reaches 30%, whichever is later, in order to minimize contamination of the secondary system and ensure termination of radioactive release to the atmosphere from the affected unit. The recovery procedure can be carried out on a time scale which ensures that break flow to the secondary system is terminated before water level in the affected steam generator rises into the main steam piping. Sufficient indications and controls are provided to enable the operator to carry out these functions satisfactorily. NRC requirements to demonstrate by analysis that steam generator overfill following a SGTR will not occur are not applicable to McGuire. Therefore, while the operators will be instructed to prevent steam generator overfill, there is no licensing commitment to do so.

Immediately apparent symptoms of a tube rupture accident such as falling pressurizer pressure and level and increased charging pump flow are also symptoms of small steam line breaks and loss of coolant accidents. It is therefore important for the operator to determine that the accident is a rupture of a steam generator tube in order that he may carry out the correct recovery procedure. The accident under discussion can be identified by the following method.

In the event of a complete tube rupture, the reactor coolant system pressure decreases and the condenser air ejector radiation monitor, main steam line N-16 monitors and/or steam generator blowdown radiation monitors exhibit abnormally high readings. If the containment pressure, 15.6 - 4 (13 APR 2020)

McGuire Nuclear Station UFSAR Chapter 15 containment radiation and containment recirculation sump level exhibit normal readings, then a steam generator rupture is diagnosed to have occurred.

Note that break sizes smaller than complete severance of a tube, with less break flow from primary to secondary, exhibit a slower rise in steam generator water level, and an increased time interval for actuation of the blowdown line radiation monitor and the condenser air ejector radiation monitor. Therefore more time may be available to the operator to diagnose the accident and take steps to isolate the ruptured steam generator.

If normal operation of the various plant control systems is assumed, the following events are initiated by a tube rupture:

1. Pressurizer low pressure and low level alarms are actuated and charging pump flow increases in an attempt to maintain pressurizer level. On the secondary side steam flow/feedwater flow mismatch occurs as feedwater flow to the affected steam generator is reduced as a result of primary coolant break flow to that generator.

2. The decrease in RCS pressure, due to continued loss of reactor coolant inventory, leads to a reactor trip signal on low pressurizer pressure or overtemperature T. The resultant plant cooldown following reactor trip leads to a rapid decrease in pressurizer level. A safety injection signal, initiated manually or by low pressurizer pressure, follows soon after reactor trip. The safety injection signal automatically terminates normal feedwater supply and initiates auxiliary feedwater addition.

3. The steam generator blowdown sample monitor, main steam line N-16 monitors and/or the condenser air ejector radiation monitor will alarm, indicating a sharp increase in radioactivity in the secondary system. Also, the steam generator blowdown sample monitor will automatically terminate steam generator blowdown.

4. The reactor trip automatically trips the turbine and, if offsite power is available, the steam dump valves open permitting steam dump to the condenser. In the event of a coincident loss of offsite power, as assumed in the analyses presented in this section, the steam dump valves automatically close to protect the condenser. The steam generator pressure rapidly increases resulting in steam discharge to the atmosphere through the steam generator safety and/or power operated relief valves. Steam flow as a function of time is constant initially until reactor trip. This is followed by turbine trip, which results in a large decrease in flow, but a rapid increase in steam pressure to the safety valve setpoint.

5. Following reactor trip, the continued action of the auxiliary feedwater supply and borated safety injection flow (supplied from the RWST) provide a heat sink which absorbs the decay heat. Thus, steam bypass to the condenser or, in the case of loss of offsite power, steam relief to the atmosphere, is attenuated during the time frame in which the recovery procedure leading to isolation is being carried out.

6. Safety injection flow results in increasing pressurizer water level, the rate of increase depending upon the amount of auxiliary equipment operating.

7. In order to stop the leakage from the Reactor Coolant System to the ruptured steam generator, the operator uses the intact steam generators to reduce the temperature of the primary coolant. This is accomplished using steam dump to the condenser or, in the absence of offsite power, the PORVs on the steam lines of the intact steam generators.

Motive force for the steam line PORVs is provided by the Instrument Air (VI) System. In the absence of the VI system, manual action outside of the containment would be used to operate these valves.

(13 APR 2020) 15.6 - 5

UFSAR Chapter 15 McGuire Nuclear Station The reduction in primary coolant temperature enables the Reactor Coolant System to remain subcooled as the Reactor Coolant System pressure is reduced to approximately that of the ruptured steam generator. The pressure reduction eliminates the driving force for the primary-to-secondary leakage. The reduction is accomplished using normal pressurizer spray. For a case in which the VI system is unavailable (this system also provides motive force for the normal pressurizer spray valves and the pressurizer PORVs), the operator aligns the cold leg accumulator nitrogen gas as a motive force for either of two pressurizer PORVs.

A steam generator tube failure is classified as an ANS Condition IV event, a limiting fault. See Section 15.0 for a discussion of Condition IV events.

15.6.3.2 Analysis of Effects and Consequences Method of Analysis Two separate evaluations are performed for this accident. First, the offsite doses are calculated.

Second, the potential for DNB to cause fuel cladding failures, which would increase the offsite doses, is evaluated. The separate evaluations sometimes make conflicting assumptions in order to conservatively determine the degree to which the separate acceptance criteria are challenged.

The SGTR accident is analyzed by employing the detailed digital computer program RETRAN-02 (described in the introduction to this chapter). The program simulates the neutron kinetics, RCS, pressurizer, pressurizer relief and safety valves, pressurizer spray, steam generator, and steam generator relief and safety valves. The code computes pertinent plant variables including temperatures, pressures, break flow and steam generator levels.

In calculating the mass transfer from the RCS through the broken tube for dose calculation purposes, the following assumptions are made:

1. Reactor trip occurs on low pressurizer pressure or manual operator action at 20 minutes.

Loss of offsite power occurs at reactor trip, which results in a reactor coolant pump trip.

2. Following the initiation of the safety injection signal, two safety injection trains are actuated and are assumed in the analyses to continue to deliver flow until operators manually secure them.

3. After reactor trip break flow reaches equilibrium when it is balanced by incoming safety injection flow. The resultant break flow is assumed to persist from plant trip until primary and secondary pressures equalize. Operator actions are modeled to terminate break flow.

4. A loss of offsite power occurs coincident with turbine trip.

5. The steam line PORV on the ruptured SG fails open and requires local operator action to close it.

The assumption of a loss of offsite power, which trips the reactor coolant pumps, is conservative because the McGuire Emergency Procedures allow the reactor coolant pumps to be kept operating following a steam generator tube rupture up to the design basis single-tube rupture.

Continued reactor coolant pump operation provides heat removal and enhanced control in accordance with the guidance in NRC Generic Letter 85-12 (Reference 64).

The DNB calculation employs the results of a RETRAN-02 analysis as input to the VIPRE-01 computer code (described in the introduction to this chapter) utilizing the Statistical Core Design Methodology described in Reference 31. The following assumptions are made for the DNB calculation:

15.6 - 6 (13 APR 2020)

McGuire Nuclear Station UFSAR Chapter 15

1. Initial reactor power, pressure, flow, and RCS temperatures are assumed to be at their nominal values. Uncertainties in initial conditions are included in the limit DNBR as described in Reference 63 (see Table 15-4.

2. A loss of offsite power occurs coincident with reactor trip.

3. Reactor trip occurs on low pressurizer pressure or OTDT.

Results The results of the thermal-hydraulic calculations for dose inputs are presented in Figures15-226 through 15-232. The sequence of events is presented in Table 15-23.

Following the tube rupture, pressurizer pressure and level steadily decrease until manual reactor trip occurs at 20 minutes. Following reactor trip, a LOOP occurs coincident with turbine trip. This results in a loss of RCS flow, which with the post-trip secondary side pressurization, causes a temporary pressurization of the primary system. Following this, SG pressures steadily decrease due to the failed open PORV. This results in an overcooling event in the primary system. Following the reactor trip, operators isolate CA from the ruptured generator at 90 seconds. Operators identify the ruptured SG 15 minutes after reactor trip and close the MSIV on its steam line. This action causes a more rapid depressurization of the ruptured SG since only its inventory is being steamed and released through the failed open PORV. The other three SGs at this time are now bottled up, and begin to slowly repressurize. The overcooling portion of this event continues until operators close the block valve on the failed open PORV at approximately 3362 seconds. Following isolation of the failed open PORV block valve, both the primary and secondary systems slowly repressurize until operators begin cooling down the unit using the operable SM PORVs at 5754 seconds. A 20°F subcooling margin relative to the ruptured SG pressure is reached in the primary system at 6325 seconds. Following this, operators begin depressurizing the RCS at 6850 seconds to stop break flow. Break flow termination is achieved at approximately 6931 seconds.

The DNB sequence of events for this event is tabulated in Table 15-23. The system response is similar to a complete loss of flow accident initiating from a depressed primary system pressure (see Section 15.3.2). DNBR remains well above the DNBR limit and therefore, DNB does not occur for this event.

15.6.3.3 Environmental Consequences The reactor coolant inventory is listed in Table 15-62 and Table 15-63. This accident involves the complete severance of a single steam generator tube. This leads to an increase in activity of the secondary system due to leakage of radioactive coolant from the reactor coolant system.

Two cases are analyzed for this accident scenario. One of the cases is a pre-existing spike case, where a reactor transient has occurred prior to the postulated steam generator tube rupture - this case uses a 60 µCi/g DE I-131 source term. The other case analyzed is the coincident spike scenario, which increases the release rate from the primary coolant to a value 335 times greater than the release rate corresponding to the equilibrium iodine concentration at 1.0 µCi/g DE I-131. Radioactivity is released (release fractions, iodine species) per the guidelines in Regulatory Guide 1.183 (Reference 67).

Before the reactor is tripped, the condensers are online. Effluent is released to the environment from the Condenser Steam Air Ejectors (CSAEs). Credit is taken for iodine scrubbing in the condenser hotwells.

Manual reactor trip, turbine trip, and a loss of offsite power are assumed to occur 20 minutes after accident initiation. Safety injection also occurs at this time. Coincident to the assumed (13 APR 2020) 15.6 - 7

UFSAR Chapter 15 McGuire Nuclear Station loss of offsite power is the failure of the condenser and the steam dump system. The plant cool down discharges activity to the atmosphere via the steam generator safety and/or power operated relief valves. All noble gases in the steam generator tube rupture break flow are assumed to be released to the environment without mitigation. When the break location is below the surface of the water, credit is taken for partitioning of iodine from the liquid portion of the steam generator inventory. See Table 15-24 for specific values assumed in the analysis.

Immediately following the reactor trip, a Power Operated Relief Valve (PORV) on the ruptured steam generator fails open. This event is the single failure event for the accident. Steam and activity are then released directly to the environment. The release continues until the operator closes the PORV block valve.

The release of radioactivity from the unaffected steam generators is assumed to continue until shutdown cooling is in operation. Steam flow from the affected steam generator includes allowance for steam leaks.

The dose consequences for this accident are calculated using methods described in Regulatory Guide 1.183 (Reference 67). The calculated doses are listed in Table 15-12. Note that the EAB dose corresponds to the highest dose over any 2-hour duration during the accident.

15.6.4 Spectrum of BWR Steam System Piping Failures Outside Containment This Section is not applicable to McGuire.

15.6.5 Loss-of-Coolant Accidents 15.6.5.1 Identification of Causes and Accident Description Acceptance Criteria and Frequency Classification A loss-of-coolant accident (LOCA) is the result of a pipe rupture of the Reactor Coolant System (RCS) pressure boundary. For the analyses presented here, a major pipe break (large break) is defined as a rupture with a total cross sectional area equal to or greater than 1.0 ft2. This event is considered an ANS Condition IV event, a limiting fault. See Section 15.0 for a discussion of Condition IV events.

A minor pipe break (small break), as considered in this section, is defined as a rupture of the reactor coolant pressure boundary with a total cross-sectional area less than 1.0 ft2 in which the normally operating charging system flow is not sufficient to sustain pressurizer level and pressure. This is considered a Condition III event, an infrequent fault. See Section 15.0 for a discussion of Condition III events.

The Acceptance Criteria for the loss-of-coolant accident is described in Reference 3 as follows:

1. The calculated peak fuel element cladding temperature is below the requirement of 2200°F.

2. The cladding temperature transient is terminated at a time when the core geometry is still amenable to cooling. The localized cladding oxidation limits of 17% are not exceeded during or after quenching.

3. The calculated total amount of hydrogen generated from the chemical reaction of the cladding with water or steam shall not exceed 0.01 times the hypothetical amount that would be generated if all of the metal in the cladding cylinders surrounding the fuel, excluding the cladding surrounding the plenum volume, were to react.

15.6 - 8 (13 APR 2020)

McGuire Nuclear Station UFSAR Chapter 15

4. The core remains amenable to cooling during and after the break.

5. The core temperature is reduced and decay heat is removed for an extended period of time, as required by the long lived radioactivity remaining in the core.

These criteria were established to provide significant margin in ECCS performance following a LOCA.

In all cases, small breaks (less than 1.0 ft2) yield results with more margin to the Acceptance Criteria limits than large breaks.

For the best-estimate LBLOCA analysis, it is noted that criteria 1 through 3 above are satisfied by ensuring that there is a high level of probability that when uncertainties in the analysis method and inputs are accounted for, the criteria are not exceeded.

Description of a Large Break LOCA Transient Should a major break occur, depressurization of the RCS results in a pressure decrease in the pressurizer. The reactor trip signal subsequently occurs when the pressurizer low pressure trip setpoint is reached. A safety injection signal (SI) is generated when the appropriate setpoint is reached. The counter-measures will limit the consequences of the accident in two ways:

1. Reactor trip and borated water injection complement void formation in causing rapid reduction of power to a residual level corresponding to fission product decay heat.

However, no credit is taken in the peak clad temperature calculation analysis for boron content of the injection water. In addition, the insertion of control rods to shut down the reactor is neglected in the large break analysis.

2. Injection of borated water provides for heat transfer from the core and prevents excessive clad temperatures.

Before the break occurs, the unit is in an equilibrium condition, i.e., the heat generated in the core is being removed via the secondary system. During blowdown, heat from fission product decay, hot internals, and the vessel continues to be transferred to the reactor coolant. At the beginning of the blowdown phase, the entire RCS contains subcooled liquid which transfers heat from the core by forced convection with some fully developed nucleate boiling. Thereafter, the core heat transfer is based on local conditions with transition boiling and forced convection to steam as the major heat transfer mechanisms.

The heat transfer between the Reactor Coolant System and the secondary system may be in either direction depending on the relative temperatures. In the case of continued heat addition to the secondary, secondary system pressure increases and the main steam safety valves may actuate to limit the pressure. Makeup water to the secondary side is automatically provided by the Auxiliary Feedwater System. The SI actuates a feedwater isolation signal, which isolates normal feedwater flow by closing the main feedwater isolation valves, and also initiates emergency feedwater flow by starting the auxiliary feedwater pumps. The secondary flow aids in the reduction of Reactor Coolant System pressure.

When the Reactor Coolant System depressurizes to approximately 600 psia, the accumulators begin to inject borated water into the reactor coolant loops.

The sequence of events following a nominal large double-ended cold leg guillotine break LOCA is presented in Table 15-52. A large double-ended cold leg guillotine (DECLG) break is assumed to open almost instantaneously in one of the main RCS pipes. Calculations have demonstrated that the most severe transient results occur for a DECLG break between the pump and the reactor vessel.

(13 APR 2020) 15.6 - 9

UFSAR Chapter 15 McGuire Nuclear Station Immediately following the cold leg break, a rapid system depressurization occurs along with a core flow reversal due to a high discharge of subcooled fluid into the broken cold leg and out the break. The fuel rods go through departure from nucleate boiling (DNB) and the cladding rapidly heats up, while the core power shuts down due to voiding in the core. The hot water in the core and upper plenum flashes to steam, and subsequently the cooler water in the lower plenum, upper head and downcomer begins to flash. Once the system has depressurized to the accumulator pressure, the accumulators begin to inject cold borated water into the intact cold legs. During the blowdown period a portion of the injected ECCS water is calculated to be bypassed around the downcomer and out the break. The bypass period ends as the system pressure (initially assumed at a nominal 2250 psia) continues to decrease and approaches the containment pressure, resulting in reduced break flow and consequently reduced core flow.

As the refill period begins, the core begins a period of heatup and the vessel begins to fill with ECCS water. This phase continues until the lower plenum is filled and the bottom of the core begins to reflood and entrainment begins.

During the reflood period, the core flow is oscillatory as ECCS water periodically rewets and quenches the hot fuel cladding which generates steam and causes system repressurization.

The steam and entrained water must pass through the vessel upper plenum, the hot legs, the steam generators, and the reactor coolant pumps before it is vented out the break. About 90 seconds after the break, the water in the downcomer begins to boil due to heat transferred from the hot vessel wall and barrel. The resulting loss in driving head stagnates the reflood progression, and delays core recovery. Eventually, the continuing addition of pumped safety injection restores the driving head, reflood resumes, and the cladding temperature excursion is terminated.

Continued operation of the ECCS pumps supplies water during long term cooling. Core temperatures have been reduced to long-term steady-state levels associated with dissipation of residual heat. After the water level in the refueling water storage tank (RWST) reaches a minimum allowable value, coolant for long-term cooling of the core is obtained by switching to the cold leg recirculation phase of operation in which spilled borated water is drawn from the containment sump by the low head safety injection (RHR) pumps and returned to the RCS cold legs. The Containment Spray System is initiated after the recirculation phase has begun to further reduce containment pressure. Prior to the time at which the core boron concentration is calculated to increase to within 4 weight percent of the solubility limit, the ECCS is realigned to supply water to the RCS hot legs in order to control the boric acid concentration in the reactor vessel.

Description of Small Break LOCA Transient Ruptures of small cross section will cause expulsion of the coolant at a rate which can be accommodated by the charging pumps. These pumps would maintain an operational water level in the pressurizer permitting the operator to execute an orderly shutdown. The coolant which would be released to the containment contains the fission products existing at equilibrium.

The maximum break size for which the normal makeup system can maintain the pressurizer level is obtained by comparing the calculated flow from the Reactor Coolant System through the postulated break against the charging pump makeup flow at normal Reactor Coolant System pressure, i.e., 2250 psia. A makeup flow rate from one centrifugal charging pump is typically adequate to sustain pressurizer level at 2250 psia for a break through a 0.375 inch diameter hole. This break results in a loss of approximately 17.25 lb/sec.

Should a larger break occur, depressurization of the Reactor Coolant System causes fluid to flow into the loops from the pressurizer resulting in a pressure and level decrease in the 15.6 - 10 (13 APR 2020)

McGuire Nuclear Station UFSAR Chapter 15 pressurizer. Reactor trip occurs when the low pressurizer pressure trip setpoint is reached.

During the earlier part of the small break transient, the effect of the break flow is not strong enough to overcome the flow maintained by the reactor coolant pumps through the core as they are coasting down following the loss of offsite power which is assumed at reactor trip.

Therefore, upward flow through the core is maintained. The Safety Injection System is actuated when the appropriate setpoint is reached. The consequences of the accident are limited in two ways:

1. Reactor trip and borated water injection complement void formation in causing rapid reduction of nuclear power to a residual level corresponding to the delayed fission and fission product decay.

2. Injection of borated water ensures sufficient flooding of the core to prevent excessive clad temperature.

Before the break occurs the plant is in equilibrium condition, i.e., the heat generated in the core is being removed via the secondary system. During blowdown, heat from decay, hot internals, and the vessel continues to be transferred to the Reactor Coolant System. The heat transfer between the Reactor Coolant System and the secondary system may be in either direction depending on the relative temperatures. In the case of continued heat addition to the secondary, secondary system pressure increases and the main steam safety valves may actuate to limit the pressure. Makeup water to the secondary side is automatically provided by the Auxiliary Feedwater System. The SI actuates a feedwater isolation signal, which isolates normal feedwater flow by closing the main feedwater isolation valves, and also initiates auxiliary feedwater flow by starting the auxiliary feedwater pumps. The secondary flow aids in the reduction of Reactor Coolant System pressure.

Reactor Coolant Pump Operating Strategy During Small Break LOCA The reactor coolant pumps may be kept operating during a small break LOCA until indicated subcooling is lost. Forced circulation supports heat removal from the reactor core and simplifies operator control. This strategy is described in the McGuire Emergency Procedures and was developed in response to NRC Generic Letters 85-12 and 83-10c (References 64 and 65).

These generic letters advised that delayed trip of the reactor coolant pumps after a small break LOCA could result in additional loss of coolant that would uncover the fuel and produce excessive cladding temperatures. Analyses performed by the Westinghouse Owners Group are cited in Generic Letter 85-12, and demonstrate using most probable best estimate techniques that the reactor coolant pumps can be tripped at any time during a small break LOCA without incurring unacceptable clad temperatures. In a letter dated March 26, 1984 (Reference 66) which responded to NRC Generic Letter 83-10c, Duke concluded that the UFSAR analyses remain bounding as long as the reactor coolant pumps are tripped within 2 minutes after subcooling conditions have been lost, as required by the Emergency Procedures.

15.6.5.2 Analysis of Effects and Consequences Methods of Analysis The bases used to select the numerical values that are input parameters to the best-estimate large break LOCA analysis are based on the results from previous four-loop plant analyses (Reference 46) which developed a list of key LOCA parameters, as shown in Table 15-4 and Table 15-53. The values for the parameters are such that they represent a more likely initial condition for the plant than was typically assumed in prior analyses. However, in some cases the assumption is still a conservative one. The general rule applied was to use limiting assumptions in cases where the parameter effect was small, or where the parameter was (13 APR 2020) 15.6 - 11

UFSAR Chapter 15 McGuire Nuclear Station difficult to quantify statistically. To confirm these choices for McGuire/Catawba analyses, runs were performed to vary several parameters which are required to be set to the bounding value in the PWR uncertainty calculation. These studies are performed to determine if the alternate assumption results in a more limiting transient. If it does, the initial transient assumption is modified to include it. Upon completion of the remaining confirmatory cases, the limiting direction for these parameters is determined. The final calculation that incorporates these results is referred to as the reference transient.

The bases used to select the numerical values that are input parameters to the small break LOCA analysis follows the approach documented in References 53 and 54 (see Table 15-4). In addition, the requirements of Appendix K regarding specific model features were met by selecting models which provide a significant overall conservatism in the analysis. The assumptions made pertain to the conditions of the reactor and associated safety system equipment at the time that the SBLOCA occurs and include such items as the core peaking factors, core axial power distribution, and the performance of the ECCS system. Decay heat generated throughout the SBLOCA transient is also conservatively calculated as required by Appendix K of 10CFR 50.

In both large and small break LOCA analyses for McGuire, loss-of-offsite power coincident with the accident is assumed. The single failure subsequently considered for both large and small break analyses is the loss of a diesel generator so that only one train of ECCS flow of the two actually present is considered to be available. Therefore, ECCS flow to the core is at a conservatively low value following its automatic actuation, especially since all water delivered to the broken loop is considered to spill directly to the containment sump. Notwithstanding these conservatisms, conformance with the 10CFR 50.46 acceptance criteria is demonstrated in the large and small break LOCA analyses. The requirements of an acceptable ECCS Evaluation Model are presented in 10CFR 50.46 and Appendix K of 10CFR 50.

Large Break Evaluation Model In 1988, the NRC staff amended the requirements of 10 CFR 50.46 and Appendix K, ECCS Evaluation Models to permit the use of a realistic evaluation model to analyze the performance of the ECCS during a hypothetical LOCA. This decision was based on an improved understanding of LOCA thermal-hydraulic phenomena gained by extensive research programs.

Under the amended rules, best-estimate thermal-hydraulic models may be used in place of models with Appendix K features. The rule change also requires, as part of the LOCA analysis, an assessment of the uncertainty of the best estimate calculations. It further requires that this analysis uncertainty be included when comparing the results of the calculations to the prescribed acceptance criteria of 10 CFR 50.46. Further guidance for the use of best-estimate codes is provided in Regulatory Guide 1.157 (Reference 47).

To demonstrate use of the revised ECCS rule, the NRC and its consultants developed a method called the Code Scaling, Applicability, and Uncertainty (CSAU) evaluation methodology (Reference 48). This method outlined an approach for defining and qualifying a best-estimate thermal-hydraulic code and quantifying the uncertainties in a LOCA analysis.

A LOCA evaluation methodology for three- and four-loop PWR plants based on the revised 10 CFR 50.46 rules was developed by Westinghouse with the support of EPRI and Consolidated Edison and has been approved by the NRC Safety Evaluation Report (Reference 49). The methodology is documented in WCAP-12945-P-A, Code Qualification Document (CQD) for Best Estimate LOCA Analysis (Reference 46).

15.6 - 12 (13 APR 2020)

McGuire Nuclear Station UFSAR Chapter 15 The thermal-hydraulic computer code which was reviewed and approved for the calculation of fluid and thermal conditions in the PWR during a large break LOCA is WCOBRA/TRAC Version Mod 7A, Rev. 1 (Reference 46). WCOBRA/TRAC combines two-fluid, three-field, multi-dimensional fluid equations used in the vessel with one-dimensional drift-flux equations used in the loops to allow a complete and detailed simulation of a PWR. The evolution of the transient through blowdown, refill, and reflood proceeds continuously, using the same computer code (WCOBRA/TRAC) and the same modeling assumptions. Containment pressure is modeled with the BREAK component using a time dependent pressure table. Containment pressure as a function of time is calculated using the LOTIC-2 code (References 50 and 51). Details of the analysis are provided in Section 6.2.1.5 Minimum Containment Pressure Analysis for Performance Capability Studies of Emergency Core Cooling System (see Figure 15-233). The mass and energy releases used in the LOTIC-2 analysis are taken from the WCOBRA/TRAC calculation.

The methods used in the application of WCOBRA/TRAC to the large break LOCA are described in Reference 46. Modeling of a PWR introduces additional uncertainties which are identified and quantified in the plant-specific analysis. The final step of the best-estimate methodology is to combine all the uncertainties related to the code and plant parameters, and estimate the PCT at 95 percent probability.

There are three major uncertainty categories or elements:

1. Initial condition bias and uncertainty

2. Power distribution bias and uncertainty

3. Model bias and uncertainty Conceptually, these elements may be assumed to affect the reference transient PCT as shown below PCT i = PCT REF,i + PCT IC,i + PCT PD,i + PCT MOD ,i (Eq. 15.6-1)

where, PCT i = PCT frequency distribution: Evaluated for three time periods; blowdown (i=1), first reflood (i=2), and second reflood (i=3).

PCT REF,i = Reference transient PCT: The reference transient PCT is calculated using WCOBRA/TRAC at the nominal conditions identified in Table 15-53.

PCT IC,i = Initial condition bias and uncertainty: This bias is the difference between the reference transient PCT, which assumes several nominal or average initial conditions, and the average PCT taking into account all possible values of the initial conditions. This bias takes into account plant variations which have a relatively small effect on PCT. The elements which make up this bias and its uncertainty are plant specific.

(13 APR 2020) 15.6 - 13

UFSAR Chapter 15 McGuire Nuclear Station PCT PD,i = Power distribution bias and uncertainty: This bias is the difference between the reference transient PCT, which assumes a nominal power distribution, and the average PCT taking into account all possible power distributions during normal plant operation. Elements which contribute to the uncertainty of this bias are calculational uncertainties, and variations due to transient operation of the reactor.

PCT MOD ,i = Model bias and uncertainty: This component accounts for uncertainties in the ability of the WCOBRA/TRAC code to accurately predict important phenomena which affect the overall system response and the local fuel rod response. The code and model bias is the difference between the reference transient PCT, which assumes nominal values for the global and local parameters, and the average PCT taking into account all possible values of global and local parameters.

The separability of the uncertainty components in the manner described above is an approximation, since the parameters in each element may be affected by parameters in other elements. The bias and uncertainty associated with this assumption is quantified as part of the overall uncertainty methodology and included in the final estimates of the 95th percentile PCT (PCT95% ).

Subcriticality Evaluation for Large Break LOCA An analysis has been performed to determine the minimum sump mixed mean boron concentration corresponding to the time of hot leg switchover as a function of pre-trip Reactor Coolant System (RCS) boron concentration for a postulated large break LOCA. Water mass contributions from the RCS, cold leg accumulators (CLAs), refueling water storage tank (RWST), ice condenser, and Emergency Core Cooling System (ECCS) and containment spray piping have been taken into account. This analysis used the principle input parameters provided in Table 15-46. High concentration borated water volumes (e.g., RWST and CLAs) are conservatively minimized using Core Operating Limits Report minimum allowed values minus associated measurement uncertainties. Ice Mass is conservatively maximized (based on ice basket capacity) at the minimum Technical Specification boron concentration value minus measurement uncertainty. Potential borated water holdup in upper containment from the initiation of normal containment spray was taken into account.

Results of the analysis are compared with the required boron concentrations necessary to keep the core subcritical during the sump recirculation mode. The analysis provides a minimum sump mixed mean boron concentration curve at the time of hot leg switchover (the most limiting time post-LOCA) that must bound the required all rods in with the highest worth rod out (ARI N-

1) critical boron concentrations for each cycle. The required ARI N-1 critical boron concentrations as allowed by Reference 61 are evaluated for each core design as part of the reload safety analysis process.

Since much of the ECCS piping is used during normal operation for residual heat removal and normal chemical and volume control, much of this ECCS piping contains relatively low concentration borated water. A single failure of an ECCS train would therefore be non-conservative, and was thus not considered in the large break LOCA subcriticality analysis.

15.6 - 14 (13 APR 2020)

McGuire Nuclear Station UFSAR Chapter 15 Small Break LOCA Evaluation Model The NOTRUMP computer code (Reference 53) is used in the analysis of loss-of-coolant accidents due to small breaks in the Reactor Coolant System (RCS). The NOTRUMP computer code is a state-of-the-art one-dimensional general network code consisting of a number of advanced features. Among these features are the calculation of thermal non-equilibrium in all fluid volumes, flow regime-dependent drift flux calculations with counter-current flooding limitations, mixture level tracking logic in multiple-stacked fluid nodes, and regime-dependent heat transfer correlations. The NOTRUMP small break LOCA emergency core cooling system (ECCS) evaluation model (Reference 55) was developed to determine the RCS response to design basis small break LOCAs and to address the NRC concerns expressed in NUREG-0611, "Generic Evaluation of Feedwater Transients and Small Break Loss-of-Coolant Accidents in Westinghouse Design Operating Plants."

In NOTRUMP, the RCS is nodalized into volumes interconnected by flowpaths. The broken loop is modeled explicitly with the intact loops lumped into a second loop. The transient behavior of the system is determined from the governing conservation equations of mass, energy and momentum applied throughout the system. A detailed description of NOTRUMP is given in References 53 and 55.

The use of NOTRUMP in the analysis involves, among other things, the representation of the reactor core as heated control volumes with an associated bubble rise model to permit a transient mixture height calculation. The multinode capability of the program enables an explicit and detailed spatial representation of various system components. In particular, it enables a proper calculation of the behavior of the loop seal during a loss-of-coolant transient.

Cladding thermal analyses are performed with the LOCTA-IV (Reference 56) code which uses the RCS pressure, fuel rod power history, steam flow past the uncovered part of the core, and mixture height history from the NOTRUMP hydraulic calculations, as input.

The McGuire small break analysis was performed with the approved Westinghouse ECCS Small Break Evaluation Model documented in References 55, 57, 58 and extended in Reference 59.

Methodology for Developing Assumed Safety Injection Flow Rates A single failure is assumed in both the small and large break analyses that result in only one-train of safety injection.

The remaining assumptions used in defining safety injection flow for a large cold leg break LOCA analysis include:

1. The spilling of the broken loop accumulator directly to containment.

2. The spilling of the safety injection line attached to the broken cold leg.

Each of the four RCS cold legs has an injection line attached. Flow delivered into the RCS is computed based on the following logic:

1. The ECCS pumps start and deliver flow into the containment through all four branch injection lines.

2. One branch injection line spills to containment backpressure. The branch injection line with minimum system resistance is selected to spill to minimize reactor delivery. Therefore, only (13 APR 2020) 15.6 - 15

UFSAR Chapter 15 McGuire Nuclear Station the remaining three branch lines actually deliver flow into the reactor vessel via the cold legs.

3. The flow delivered into the reactor through the reactor coolant pump seals is assumed to be lost and, therefore, seal injection is not included in the total core delivery.

4. SBLOCA sensitivity analyses have determined that ECCS injection into the broken loop yield more conservative results. Therefore the SBLOCA analysis assumes ECCS injection into the broken loop.

Safety injection flows computed with this methodology are conservatively low for any postulated break location.

Large Break Input Parameters and Initial Conditions A composite model for the McGuire/Catawba stations was developed for the best-estimate large break LOCA analysis. The composite model combined the limiting vessel type and the limiting loop configuration into a limiting composite model. The limiting configuration was determined through a series of sensitivity studies, documented in Reference 52.

A series of WCOBRA/TRAC calculations were performed using the McGuire/Catawba composite model to determine the PCT effect of variations in key LOCA parameters. An initial transient calculation was performed in which several parameters were set at their assumed bounding (most limiting) values in order to calculate a conservative PCT response to a large break LOCA. The range for parameters was set to encompass the range of operation for all four McGuire and Catawba stations. The bounding values assumed in Table 15-53 were confirmed or modified by completing confirmatory sensitivity analyses, and incorporating the results into a final calculation which is referred to as the reference transient. Single parameter variation studies based on the reference transient were performed to assess which parameters have a significant effect on the PCT results. The initial calculation, confirmatory runs, and final reference transient are described in detail in Reference 52.

Small Break Input Parameters and Initial Conditions Table 15-42 lists important parameters and initial conditions used in the small break analyses.

The axial power distribution for the small break analyses is shown in Figure 15-137.

Safety injection flow rate to the Reactor Coolant System as a function of the system pressure is used as part of the input. The Safety Injection (SI) system was assumed to be delivering flow to the RCS 32 seconds after the generation of a Safety Injection signal.

For these analyses, the SI delivery considers pumped injection flow which is given in Table 15-50 as a function of RCS pressure. This table represents injection flow from the SI pumps based on performance curves degraded from the design head. The SI delay includes time required for diesel startup and loading of the safety injection pumps onto the emergency buses. The effect of flow from the RHR pumps is not considered here since their shutoff head is lower than RCS pressure during the time portion of the transient considered here. Also, minimum safeguards Emergency Core Cooling System capability and operability has been assumed in these analyses.

Note that the SBLOCA analysis was performed with ZIRLO cladding. However, Reference 78 concluded that the LOCA ZIRLO cladding models are acceptable for application to Optimized 15.6 - 16 (13 APR 2020)

McGuire Nuclear Station UFSAR Chapter 15 ZIRLO cladding in the Small Break analysis and that no additional calculations are necessary for evaluating the use of Optimized ZIRLO cladding provided that the plant specific ZIRLO calculations were previously performed.

Large Break Results Reference Transient Description The McGuire/Catawba reference transient models a double-ended cold leg guillotine break which assumed the conditions listed in Table 15-53 and includes the loss-of-offsite power, low peripheral assembly power (0.2) and high SGTP (10%) configuration bounded study assumptions. The reference transient calculation was performed with other parameters set at their bounding values as denoted in Table 15-53 in order to calculate a relatively high PCT. The reference transient is the basis for the uncertainty calculations necessary to establish the McGuire/Catawba 95th percentile PCT.

The LOCA transient can be conveniently divided into a number of time periods in which specific phenomena are occurring. For a typical large break, the blowdown period can be divided into the critical heat flux (CHF) phase, the upward core flow phase, and the downward core flow phase. These are followed by the refill, reflood, and long term cooling phases. The important phenomena occurring during each of these phases are discussed for the reference transient DECLG break with a discharge coefficient of 1.0. The results are shown in Figures15-234 through 15-242. Key events and the time of their occurrence are listed in Table 15-52.

The reference transient resulted in a blowdown PCT of 1328°F and a second reflood PCT of 1649°F.

Sensitivity Studies A large number of single parameter sensitivity calculations of key LOCA parameters were performed to determine the PCT effect on the large break LOCA transient. These calculations are required as part of the approved best-estimate methodology (Reference 46) to develop data for use in the uncertainty evaluation. For each sensitivity study, a comparison between the reference transient results and the sensitivity transient results was made.

Several calculations were performed to evaluate the PCT effect of changes in the initial conditions on the large break LOCA transient. The results of these sensitivity studies were used to develop uncertainty distributions for the blowdown, first and second reflood peaks. The uncertainty distributions resulting from the initial conditions, PCTIC,i, are used in the overall PCT uncertainty evaluation to determine the final estimate of PCT 95%.

Several calculations were performed to evaluate the PCT effect of changes in power distributions on the large break LOCA transient. The results of these studies indicate that power distributions with peak powers skewed to the top of the core produced the most limiting PCTs.

The results of these sensitivity studies were used to develop response surfaces, which are used to predict the PCT due to changes in power distributions for the blowdown, first and second reflood peaks. The uncertainty distributions resulting from the power distributions, PCTPD,i, are used in the overall PCT uncertainty evaluation to determine the final estimate of PCT 95%.

Several calculations were performed to evaluate the PCT effect of changes in global models on the large break LOCA transient. The results of these sensitivity studies were used to develop response surfaces, which are used to predict the PCT due to changes in global models for the DECLG blowdown, first and second reflood peaks. The uncertainty distribution resulting from the global models, PCTMOD,i, is used in the overall PCT uncertainty evaluation to determine the final estimate of PCT 95%.

(13 APR 2020) 15.6 - 17

UFSAR Chapter 15 McGuire Nuclear Station Overall PCT Uncertainty Evaluation and Results The equation used to initially estimate the 95th percentile PCT (PCTi of Equation 15.6-1) was presented previously in this section. Each of the uncertainty elements (PCTIC,i, PCTPD,i, PCTMOD,i) are considered to be independent of the each other. Each element includes a correction or bias, which is added to PCTREF,i to move it closer to the expected, or average PCT.

The bias from each element has an uncertainty associated with the methods used to derive the bias.

Each bias component of the uncertainty elements is considered a random variable, whose uncertainty distribution is obtained directly, or is obtained from the uncertainty of the parameters of which the bias is a function. Since PCTi is the sum of these biases, it also becomes a random variable. Separate initial PCT frequency distributions are constructed as follows for the DECLG and the limiting split break:

1. Generate a random value of each uncertainty element (PCTIC, PCTPD, PCTMOD)

2. Calculate the resulting PCT using Equation 15.6-1.

3. Repeat the process many times to generate a histogram of PCTs.

For McGuire/Catawba, the results of this assessment showed the DECLG to be the limiting break type.

A final verification step is performed to quantify the bias and uncertainty resulting from the superposition assumption (i.e., the assumption that the major uncertainty elements are independent). Several additional WCOBRA/TRAC calculations are performed in which variations in parameters from each of the three uncertainty elements are modeled for the DECLG. These predictions are compared to the predictions based on Equation 15.6-1 and additional biases and uncertainties are applied where appropriate.

The estimate of the PCT at 95 percent probability is determined by finding that PCT below which 95 percent of the calculated PCTs reside. This estimate is the licensing basis PCT, under the revised ECCS rule. The results of the McGuire/Catawba best-estimate LBLOCA analysis are presented in Table 15-54. The difference between the 95th percentile PCT and the 50th percentile PCT increases during reflood due to propagation of uncertainties. The 50th and 95th percentile PCTs are 1512 °F and 2028 °F respectively. The maximum local cladding oxidation is 10% and the maximum core wide oxidation is 0.88%. The results of the best-estimate large break LOCA analysis are from Reference 52.

Plant Operating Range The expected PCT and associated uncertainty is valid for a range of plant operating conditions.

In contrast to Appendix K calculations, many parameters in the reference transient calculation are at nominal values. The range of variation of the operating parameters has been accounted for in the estimated PCT uncertainty. Table 15-55 summarizes the operating ranges for McGuire/Catawba. Note that Figure 15-243 illustrates the axial power distribution limits which were analyzed and are verified on a cycle-specific basis. If plant operation is maintained within the plant operating ranges presented in Table 15-55, the LBLOCA analysis is considered to be valid.

Note that the LBLOCA analysis was performed with ZIRLO cladding. However, Reference 78 concluded that the LOCA ZIRLO cladding models are acceptable for application to Optimized ZIRLO cladding in the Large Break analysis and that no additional calculations are necessary 15.6 - 18 (13 APR 2020)

McGuire Nuclear Station UFSAR Chapter 15 for evaluating the use of Optimized ZIRLO cladding provided that the plant specific ZIRLO calculations were previously performed.

Small Break Results A spectrum of break sizes including diameters of 1.5 inch, 2 inch, 3 inch, and 4 inches was analyzed for McGuire Units 1 and 2. The 2 inch small break LOCA (SBLOCA) case was determined to be the limiting case in the spectrum analyzed. The peak cladding temperature for the 2 inch break is 1323°F at an elevation of 11.5 feet. The maximum oxidation is 0.24 percent and the core-wide oxidation is 0.03 percent based on the 2 inch break. The results of the break spectrum are presented in Table 15-49 and Table 15-51.

Deleted Per 2006 Update.

Figures15-245 through 15-259 present the McGuire SBLOCA transient response for the parameters of interest.

15.6.5.3 Environmental Consequences Fission product inventories are listed in Table 15-58 and were determined as described in Section 15.0.

The event begins with a double-ended guillotine rupture of one of the main reactor coolant system pipes. The reactor automatically trips and Engineered Safeguards and Safety Injection signals are generated. This action activates the ECCS, VE, VA and VC Systems, and it begins containment isolation. The hi-hi containment pressure signal is initiated almost simultaneously with the Safety Injection signal and activates the VX system after a 10-minute delay.

Radioactivity is released (release fractions, iodine species) from the core per Regulatory Guide 1.183.

Complicating initial conditions and single equipment failures are effective immediately. These include (1 of 4) closed VC inlets and Class 1E power failures which result in the loss of one train of ECCS, VE, VX, and VC Systems. The air exchange flow rate between the upper and lower compartments is also reduced in this scenario. The simulation of ECCS leakage of sump water to the Auxiliary Building and FWST begin with the initiation of sump recirculation flow.

The accident causes the release of the fuel melt source term to containment. From there, the activity is released to the atmosphere via several paths. Once such manner of release is containment leakage: release from containment to the annulus, bypass leakage that goes directly from containment to the environment, and equipment hatch leakage. The containment leakage bypasses the annulus until annulus vacuum is established. Then, the bypass leakage is set to the Technical Specification value and the rest of the containment leakage goes to the annulus. Containment leakage is also reduced by a factor of 2, starting 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> after the incident, per Regulatory Guide 1.183, and continues for 30 days. Leakage from upper containment through the equipment hatch is modeled to maximize the leakage through that release point. The remainder of the leakage from upper containment is modeled to be released from the unit vent. All other releases are ultimately modeled as release from the unit vent stack, as the unit vent dispersion factor bounds all other potential release points except the equipment hatch. ECCS leakage was also modeled. It includes partitioned back-leakage from the containment sump to the Auxiliary Building and the FWST. Other MNS specific inputs are located in Table 15-33.

Various plant responses are modeled to remove activity. Spray is credited for removal of particulate and elemental forms of Iodine from upper containment. The containment air return system forces circulation between lower and upper containment, where radioactivity is removed (13 APR 2020) 15.6 - 19

UFSAR Chapter 15 McGuire Nuclear Station by spray. Credit is taken for filtration in the VA, VE, and VC systems. Only one train of these systems is credited, which is the limiting scenario. No credit is taken for removal of activity via plateout, natural deposition, or ice condenser scrubbing.

The dose consequences for this accident are calculated using methods described in Regulatory Guide 1.183. The calculated doses are listed in Table 15-12. Note that the EAB dose corresponds to the highest dose over any 2-hour duration during the accident.

15.6.5.4 10 CFR 50.46 Reporting Summary In addition to the analyses presented in Subsection 15.6.5.2, LOCA evaluations may be performed as needed to address evaluation model issues or to support plant changes. The issues or changes are evaluated, and the impact on the peak cladding temperature (PCT) is determined. The resultant increase or decrease in PCT is added to the analysis of record PCT.

10 CFR 50.46 allows for the estimates of errors in, or changes to, an ECCS evaluation model or its application. These PCT changes are reported to the NRC, in accordance with the requirements of 10 CFR 50.46. In Reference 68, Westinghouse has described their process to enable licensees to comply with the 10 CFR 50.46 reporting requirements, and pertinent terms are briefly defined below.

Definitions Analysis: The application of an appropriate protion of an acceptable Evaluation Model to demonstrate compliance with criteria in 10 CFR 50.46(b).

Analysis-Of-Record (AOR): The AOR is the latest plant specific analysis performed using the latest acceptable Evaluation Model.

Evaluation Model (EM): An Evaluation Model is the calculational framework for evaluating the behavior of the reactor coolant system during a postulated LOCA. It includes one or more computer programs and all other information necessary for application of the calculational framework to a specific LOCA, such as mathematical models used, assumptions included in the programs, procedure(s) for treating the program input and output information, specification of those portions of analysis not included in computer programs, values of parameters, and all other information necessary to specify the calculational procedure.

Estimated Effect: The estimated effect of a change in the Evaluation Model must be determined for 10 CFR 50.46 reporting purposes. The effect of a change to, or error in, the ECCS Evaluation Model is the difference in the LOCA results when the change is included in the Evaluation Model.

Evaluation: The use of a combination of information, either derived from Evaluation Model sensitivity studies, calculated from first principles, extracted from existing calculations, or based upon engineering experience, along with known sensitivities from appropriate applications of ECCS Evaluation Models to determine the estimated effect of a change on calculated PCT of other 10 CFR 50.46 criteria. It is distinguished from an Analysis in that it may or may not involve the direct application of the computer codes or calculations which comprise an Evaluation Model to determine the effect of a change.

Licensing Basis LOCA Results: The AOR LOCA results as modified to include the estimated effects of changes in the approved Evaluation Model, corrections of errors in application, and plant changes implemented under 10 CFR 50.59 or 10 CFR 50.92. The licensing basis LOCA PCT result appears in the required 10 CFR 50.46 reporting, which aids in the demonstration of compliance with the 10 CFR 50.46(b)(1) criterion when changes to the AOR LOCA result occur.

15.6 - 20 (13 APR 2020)

McGuire Nuclear Station UFSAR Chapter 15 Table 15-61 provides a summary of the current licensing basis LOCA PCT values as reported pursuant to 10 CFR 50.46 for McGuire Nuclear Station.

15.6.6 A Number of BWR Transients Not applicable to McGuire.

15.6.7 References

1. Deleted Per 1994 Update.

2. Deleted Per 1998 Update.

3. Acceptance Criteria for Emergency Core Cooling System for Light Water Cooled Nuclear Power Reactors, 10CFR 50.46 and Appendix K of 10CFR 50.

4. Deleted Per 1994 Update.

5. Deleted Per 1996 Update.

6. Deleted Per 1998 Update.

7. Deleted Per 1998 Update.

8. Deleted Per 1998 Update.

9. Deleted Per 1994 Update.

10. Deleted Per 1994 Update.

11. Deleted Per 1998 Update.

12. Deleted Per 1996 Update.

13. Deleted Per 1996 Update.

14. Deleted Per 1994 Update.

15. Deleted Per 1998 Update.

16. Deleted Per 1996 Update.

17. Deleted Per 1998 Update.

18. Deleted Per 1994 Update.

19. Deleted Per 1994 Update.

20. Deleted Per 1998 Update.

21. Deleted Per 1994 Update.

22. Deleted Per 2001 Update.

23. Deleted Per 2001 Update.

24. Deleted Per 2001 Update.

25. Deleted Per 2001 Update.

26. Deleted Per 1996 Update.

27. Deleted Per 2001 Update.

28. Deleted Per 1998 Update.

(13 APR 2020) 15.6 - 21

UFSAR Chapter 15 McGuire Nuclear Station

29. Deleted Per 1998 Update.

30. Deleted Per 1994 Update.

31. "Duke Power Company Thermal-Hydraulic Statistical Core Design Methodology," DPC-NE-2005P-A, Revision 4a, December 2008.

32. Deleted Per 2001 Update.

33. Deleted Per 1998 Update.

34. Deleted Per 1998 Update.

35. Deleted Per 1996 Update.

36. Deleted Per 1996 Update.

37. Deleted Per 1998 Update.

38. Deleted Per 1998 Update.

39. Deleted Per 1998 Update.

40. Deleted Per 1998 Update.

41. Deleted Per 1996 Update.

42. Deleted Per 1998 Update.

43. Deleted Per 2001 Update.

44. Deleted Per 2001 Update.

45. Deleted Per 2001 Update.

46. Code Qualification Document for Best Estimate LOCA Analysis, WCAP-12945-P-A (Proprietary), Volume I, Revision 2, and Volumes II-V, Revision 1, and WCAP-14747 (Non-Proprietary), Westinghouse Electric Company, March 1998.

47. USNRC Regulatory Guide 1.157, Best-Estimate Calculations of Emergency Core Cooling System Performances, May, 1989.

48. "Qualifying Reactor Safety Margins: Application of Code Scaling Applicability and Uncertainty (CSAU) Evaluation Methodology to a Large Break Loss-of-Coolant-Accident,"

NUREG/CR-5249, 1989.

49. Letter, R. C. Jones (USNRC) to N. J. Liparulo (W), "Acceptance for Referencing of the Topical Report WCAP-12945 (P), Westinghouse Code Qualification Document for Best Estimate Loss-of-Coolant Analysis," June 28, 1996.

50. Grimm, N. P., et al, "Long Term Ice Condenser Containment Code - LOTIC Code," WCAP-8354-P-A (Proprietary) and WCAP-8355-A (Non-Proprietary), April 1976.

51. Hseih, et al, "Long Term Ice Condenser Containment Code - LOTIC Code," WCAP-8354-P-A, Supplement 1 (Proprietary) and WCAP-8355-A, Supplement 1 (Non-Proprietary), April 1976.

52. Best Estimate Analysis of the Large Break Loss of Coolant Accident for the McGuire and Catawba Nuclear Stations, WCAP-15440, Rev. 0, Westinghouse Electric Company LLC, July, 2000.

53. Meyer, P. E., "NOTRUMP, A Nodal Transient Small Break and General Network Code",

WCAP-10079-P-A (Proprietary), August 1985.

15.6 - 22 (13 APR 2020)

McGuire Nuclear Station UFSAR Chapter 15

54. Rupprecht, S. D., et al., Westinghouse Small Break LOCA ECCS Evaluation Model Generic Study with the NOTRUMP Code, WCAP-11145-P-A (Proprietary) and WCAP-11372 (Non-Proprietary), October 1986.

55. Lee, H., Tauche, W. D., Schwarz, W. R., "Westinghouse Small Break ECCS Evaluation Model Using the NOTRUMP Code", WCAP-10054-P-A (Proprietary), August 1985.

56. Bordelon, F.M. et.al., "LOCTA-IV Program: Loss of Coolant Transient Analysis," WCAP-8301 (proprietary) and WCAP-8305 (Non-Proprietary) June 1974.

57. Thompson, C. M., et al., "Addendum to the Westinghouse Small Break ECCS Evaluation Model Using the NOTRUMP Code: Safety Injection into the Broken Loop and COSI Condensation Model," WCAP-10054-P-A (Proprietary), Addendum 2, Revision 1, July 1997.

58. Shimeck, D. J., "1-D Heat Conduction Model for Annular Fuel Pellets," WCAP-14710-P-A (Proprietary), WCAP-14711-NP-A (Non-Proprietary), May 1998.

59. Akers, J. J. ed., "Model Changes to the Westinghouse Appendix K Small Break LOCA NOTRUMP Evaluation Model: 1988 - 1997," WCAP-15085, July 1998.

60. Letter, W. R. McCollum, Jr. (Duke) to USNRC, Report Pursuant to 10 CFR 50.46, Changes to or Errors in an ECCS Evaluation Model, July 29, 2003.

61. Safety Evaluation by the office of Nuclear Reactor Regulation Related to Amendment No.

236 to Facility Operating License No. DPR-58 and Amendment No. 218 to Facility Operating License No. DPR-74, Indiana Michigan Power Company, Donald C. Cook Nuclear Plant, Units 1 and 2, Docket Nos. 50-315 and 50-316. Implemented via 10CFR50.59 dated 9/13/2004.

62. Deleted Per 2008 Update.

63. Duke Power Company Westinghouse Fuel Transition Report, DPC-NE-2009P-A, Revision 2a, July 2009.

64. NRC Generic Letter 85-12, Implementation of TMI Action Item II.K.3.5, Automatic Trip of Reactor Coolant Pumps, June 28, 1985.

65. NRC Generic Letter 83-10d, TMI Action Item II.K.3.5, Automatic Trip of Reactor Coolant Pumps, Letter to Licensees with Westinghouse NSSSs, February 8, 1983.

66. Letter from H.B. Tucker (Duke) to H.R. Denton (NRC), dated March 30, 1984, McGuire Nuclear Station, Response to Generic Letter 83-10d.

67. USNRC Regulatory Guide 1.183, "Alternative Radiological Source Terms for Evaluations Design Basis Accidents at Nuclear Power Reactors," Original Issue, July 2000.

68. "Westinghouse Methodology for Implementation of 10 CFR 50.46 Reporting," WCAP-13451, October 1992.

69. Letter, M.S. Tuckman (Duke) to USNRC, "Report Pursuant to 10 CFR 50.46, Changes to or Errors in an ECCS Evaluation Model," May 3, 2001.

70. Letter, M.S. Tuckman (Duke) to USNRC, "Report Pursuant to 10 CFR 50.46, Changes to or Errors in an ECCS Evaluation Model," April 3, 2002.

71. Letter, W.R. McCollum, Jr. (Duke) to USNRC, "Report Pursuant to 10 CFR 50.46, Changes to or Errors in an ECCS Evaluation Model," May 26, 2004.

(13 APR 2020) 15.6 - 23

UFSAR Chapter 15 McGuire Nuclear Station

72. Letter, J.R. Morris (Duke) to USNRC, "Report Pursuant to 10 CFR 50.46, Changes to or Errors in an ECCS Evaluation Model," June 21, 2005.

73. Letter, T.C. Geer (Duke) to USNRC, "Report Pursuant to 10 CFR 50.46, Changes to or Errors in an ECCS Evaluation Model," March 13, 2007.

74. Letter, D.C. Culp (Duke) to USNRC, "Response to Information Request Pursuant to 10 CFR 50.54(f) Related to the Estimated Effect on Peak Cladding Temperature Resulting from Thermal Conductivity Degradation in the Westinghouse-Furnished Realistic Emergency Core Cooling System Evaluation and 30-Day Report Pursuant to 10 CFR 50.46, Changes to or Errors in an Evaluation Model," March 16, 2012.

75. Letter, T.C. Geer (Duke) to USNRC, "Report Pursuant to 10 CFR 50.46, Changes to or Errors in an ECCS Evaluation Model," May 22, 2007.

76. Letter, R.J. Duncan (Duke) to USNRC, Report Pursuant to 10 CFR 50.46, Changes to or Errors in an ECCS Evaluation Model, August 29, 2013

77. Letter, B.C. Waldrep (Duke) to USNRC, Report Pursuant to 10 CFR 50.46, Changes to or Errors in an ECCS Evaluation Model, February 25, 2014.

78. Shah, H. H. and Schueren, P., "Optimized ZIRLO'," WCAP-12610-P-A & CENPD-404-P-A, Addendum 1-A, July 2006.

THIS IS THE LAST PAGE OF THE TEXT SECTION 15.6.

15.6 - 24 (13 APR 2020)

McGuire Nuclear Station UFSAR Chapter 15 15.7 Radioactive Release From a Subsystem or Component A number of events have been postulated which could result in a radioactive release from a plant subsystem or component. Detailed analyses are presented for several such events which have been identified as limiting cases.

Discussions of the following events are presented in this section:

1. Radioactive Gas Waste System leak or failure.

2. Radioactive Liquid Waste System leak or failure.

3. Postulated radioactive releases due to liquid tank failures.

4. Fuel handling accidents in the Containment and Spent Fuel Buildings.

5. Spent fuel cask drop accident.

The above are considered to be ANS Condition III events, with the exception of the design basis fuel handling accidents, which are considered to be ANS Condition IV events. Section 15.0 contains a discussion of ANS classifications and applicable acceptance criteria.

15.7.1 Radioactive Gas Waste System Leak or Failure 15.7.1.1 Identification of Causes and Accident Description The Waste Gas System (WG), as discussed in Chapter 11, is designed to remove fission product gases from the reactor coolant. The system consists of a closed loop with waste gas compressors, hydrogen recombiners, waste gas decay tanks for service at power, and other waste gas decay tanks for service at shut-down and startup.

The accident is defined as an unexpected and uncontrolled release of radioactive xenon and krypton fission product gases stored in a waste decay tank as a consequence of a failure of a single gas decay tank, or any combination of gas decay tanks cross-tied together, or associated piping.

Deleted Per 2012 Update.

A Waste Gas System leak or failure is classified as an ANS Condition III event, an infrequent fault. See Section 15.0 for a discussion of Condition III events.

15.7.1.2 Analysis of Effects and Consequences Method of Analysis The accident is defined as the uncontrolled release of activity stored in a waste gas decay tank.

The entirety of the tank is assumed to be released to the auxiliary building, without credit for holdup. The activity is then instantaneously released to the environment. Below is a list of key assumptions in the analysis:

1. Release from the tank is assumed to instantaneously be released to the auxiliary building.

2. The unit vent dispersion factor is assumed for the release from the auxiliary building.

3. No credit is assumed for filtration or holdup in the auxiliary building.

4. No credit is taken for radioactive decay.

5. No iodine spiking is assumed in this analysis.

(13 APR 2020) 15.7 - 1

UFSAR Chapter 15 McGuire Nuclear Station

6. No credit is assumed for control room ventilation. The unfiltered inleakage is assumed to be 625 cfm for the duration of the accident.

7. The activity in the gas waste decay tank is assumed to be 49,000 Curies of Xe-133 equivalent.

15.7.1.3 Environmental Consequences The maximum activity in a single gas decay tank or any combination of gas decay tanks tied together is limited by SLC 16.11.20. Restricting the quantity of radioactivity contained in each gas storage tank provides assurance that in the event of an uncontrolled release of the tank contents, the resulting radiation dose to an individual at the exclusion area boundary will not exceed 0.5 rem, TEDE.

The calculated offsite doses are listed in Table 15-12.

15.7.2 Radioactive Liquid Waste System Leak or Failure 15.7.2.1 Identification of Causes and Accident Description The accident is defined as the uncontrolled atmospheric release from the 112,000 gallon recycle holdup tank due to the postulated rupture of the tank. This tank is the highest potential atmospheric release source because of its activity level and volume. The holdup tank is a part of the Boron Recycle System and is discussed in Section 9.3.6.

A radioactive liquid waste system leak or failure is classified as an ANS Condition III event, an infrequent fault. See Section 15.0 for a discussion of Condition III events.

15.7.2.2 Analysis of Effects and Consequences Method of Analysis The accident is defined as the uncontrolled release from the 112,000-gallon recycle holdup tank. The entirety of the tank is assumed to be released to the auxiliary building, without credit for holdup. The activity is then instantaneously released to the environment. Below is a list of key assumptions in the analysis:

1. Release from the tank is assumed to instantaneously be released to the auxiliary building.

2. The unit vent dispersion factor is assumed for the release from the auxiliary building.

3. No credit is assumed for filtration or holdup in the auxiliary building.

4. No credit is taken for radioactive decay.

5. No iodine spiking is assumed in this analysis.

6. No credit is assumed for control room ventilation. The unfiltered inleakage is assumed to be 625 cfm for the duration of the accident.

7. The activity in the recycle holdup tank is assumed to be 1 µCi/g.

8. The iodine partition fraction is assumed to be 0.1.

15.7.2.3 Environmental Consequences The doses from this accident are within 10 CFR 50.67 limits.

15.7 - 2 (13 APR 2020)

McGuire Nuclear Station UFSAR Chapter 15 15.7.3 Postulated Radioactive Releases Due to Liquid Tank Failures Based on the discussion in Section 2.4.12 and from an evaluation of radioactive releases from a postulated liquid tank failure it is concluded that the effluent from a failed liquid tank at McGuire could not directly enter groundwater. Furthermore, the radioactive concentrations at the nearest potable water intake from a liquid tank failure that follows a surface water pathway are determined to be small fractions of the 10 CFR Part 20, Appendix B limits for effluent concentrations.

15.7.4 Fuel Handling Accidents in the Containment and Spent Fuel Storage Buildings 15.7.4.1 Fuel Handling Accident Inside Containment 15.7.4.1.1 Identification of Causes and Accident Description A fuel handling accident is postulated whereby a fuel assembly is damaged while being moved inside containment. Activity is released from the fuel assembly into the water in the fuel transfer canal and then into the containment atmosphere. The activity released into containment is released to the environment through the assumed open equipment hatch. Control room operators manually start control room outside air filtered pressurization within a prescribed period.

A fuel handling accident inside containment is classified as an ANS Condition IV event, a limiting fault. See Section 15.0 for a discussion of Condition IV events.

15.7.4.1.2 Analysis of Effects and Consequences Method of Analysis Fission product inventories are listed in Table 15-35 and were determined as described in Section 15.0. For fuel pins which exceed the rod power/burnup criteria of Footnote 11 in RG 1.183, the gap fractions from RG 1.183 are increased by a factor of 3 for Kr-85, Xe-133, Cs-134 and Cs-137, and increased by a factor of 2 for I-131, and other noble gases, halogens and alkali metals (References 1 and 2). A maximum of 25 fuel rods, per assembly, shall be allowed to exceed the rod power/burnup criteria of Footnote 11 in RG 1.183, in accordance with the license amendment request submitted by letter dated July 15, 2015.

The isotopics of the damaged assembly bound all spent fuel and design types. The modeled assembly isotopics are based upon bounding fuel characteristics (burnup, enrichment, peaking, etc.). It is assumed to have decayed at least three days prior to being damaged. The gap inventory from all of the fuel pins is assumed to be instantaneously released into the water. As the radioactivity moves up through the water to the surface, particulates (radioiodines and alkali metals) are removed and elemental iodine is scrubbed. The remainder of the radioiodines and all of the noble gases enter the containment atmosphere and are released through the equipment hatch in containment when it is open. This is the most limiting release point and it bounds other potential release locations. Neither containment purge filtration nor any other filtration is credited once the activity is released from the fuel transfer canal water to the environment. The control room model credits filtration by the Control Room Ventilation System and includes unfiltered in-leakage. Although the majority of the activity is released over a two hour period, the modeled release is continued for a 30 day period for control room and low population zone doses.

(13 APR 2020) 15.7 - 3

UFSAR Chapter 15 McGuire Nuclear Station The fuel handling accident in containment and the fuel handling accident inside the spent fuel pool building are the same postulated accidents, but with different atmospheric dispersion factors.

The offsite release and dose consequences for this accident are calculated using methods described in Regulatory Guide 1.183.

Results The calculated offsite doses are listed in Table 15-12.

15.7.4.1.3 Environmental Consequences The doses from this accident are within 10 CFR 50.67 limits.

15.7.4.2 Fuel Handling Accident in the Fuel Building - Fuel Assembly Drop 15.7.4.2.1 Identification of Causes and Accident Description A fuel handling accident in the Fuel Building is postulated whereby a fuel assembly is damaged while being moved inside the Spent Fuel Pool Building. Activity is released from the fuel assembly into the water in the spent fuel pool and then into the Fuel Building atmosphere. The activity released into the Fuel Building is released to the environment through the unit vent (via the Fuel Handling Ventilation System). Control room operators manually start control room outside air filtered pressurization within a prescribed period.

A fuel handling accident inside the fuel building is classified as an ANS Condition IV event, a limiting fault. See Section 15.0 for a discussion of Condition IV events.

15.7.4.2.2 Analysis of Effects and Consequences Method of Analysis The isotopics of the damaged assembly bound all spent fuel and design types. The modeled assembly isotopics are based upon bounding fuel characteristics (burnup, enrichment, peaking, etc.). It is assumed to have decayed at least three days prior to being damaged. The gap inventory from all of the fuel pins is assumed to be instantaneously released into the water. For fuel pins which exceed the rod power/burnup criteria of Footnote 11 in RG 1.183, the gap fractions from RG 1.183 are increased by a factor of 3 for Kr-85, Xe-133, Cs-134 and Cs-137, and increased by a factor of 2 for I-131, and other noble gases, halogens and alkali metals (References 1 and 2). A maximum of 25 fuel rods, per assembly, shall be allowed to exceed the rod power/burnup criteria of Footnote 11 in RG 1.183, in accordance with the license amendment request submitted by letter dated July 15, 2015. As the radioactivity moves up through the water to the surface, particulates (radioiodines and alkali metals) are removed and elemental iodine is scrubbed. The remainder of the radioiodines and all of the noble gases enter the Fuel Building atmosphere and are released through the unit vent. This is the most limiting release point and it bounds other potential release locations. Neither Fuel Handling Ventilation filtration nor any other filtration is credited once the activity is released from the spent fuel pool water to the environment. The control room model credits filtration by the Control Room Ventilation System and includes unfiltered in-leakage. Although the majority of the activity is released over a two hour period, the modeled release is continued for a 30 day period for control room and low population zone doses.

15.7 - 4 (13 APR 2020)

McGuire Nuclear Station UFSAR Chapter 15 The fuel handling accident in the spent fuel pool building and the fuel handling accident inside containment are the same postulated accidents, but with different atmospheric dispersion factors.

Results The results of the fuel handling accident inside the spent fuel building are bounded by the fuel handling accident inside containment.

15.7.4.2.3 Environmental Consequences The doses from this accident are within 10 CFR 50.67 limits.

15.7.4.3 Fuel Handling Accident in the Fuel Building - Weir Gate Drop 15.7.4.3.1 Identification of Causes and Accident Description The weir gate drop accident scenario postulates that one of the two weir gates in the spent fuel pool is dropped, while being maneuvered, onto seven fuel assemblies. Activity is released from the fuel assemblies into the water in the spent fuel pool and then into the Fuel Building atmosphere. The activity released into the Fuel Building is released to the environment through the unit vent (via the Fuel Handling Ventilation System). Control room operators manually start control room outside air filtered pressurization within a prescribed period.

15.7.4.3.2 Analysis of Effects and Consequences Method of Analysis The bounding fuel assembly isotopics used in the single fuel assembly Fuel Handling Accidents is used for each of the seven fuel assemblies damaged in the weir gate drop. These assemblies are decayed the minimum amount of time after refueling which must pass until the weir gate is permitted to move (at least 17.5 days). The gap inventory from all of the fuel pins in all seven of the assemblies is assumed to be instantaneously released into the spent fuel pool water. For fuel pins which exceed the rod power/burnup criteria of Footnote 11 in RG 1.183, the gap fractions from RG 1.183 are increased by a factor of 3 for Kr-85, Xe-133, Cs-134 and Cs-137, and increased by a factor of 2 for I-131, and other noble gases, halogens and alkali metals (References 1 and 2). A maximum of 25 fuel rods, per assembly, shall be allowed to exceed the rod power/burnup criteria of Footnote 11 in RG 1.183, in accordance with the license amendment request submitted by letter dated July 15, 2015. As the radioactivity moves up through the water to the surface, particulates (radioiodines and alkali metals) are removed and elemental iodine is scrubbed. The remainder of the radioiodines and all of the noble gases enter the Fuel Building atmosphere and are released through the unit vent. This is the most limiting release point and it bounds other potential release locations. Neither Fuel Handling Ventilation filtration nor any other filtration is credited once the activity is released from the spent fuel pool water to the environment. The control room model credits filtration by the Control Room Ventilation System and includes unfiltered in-leakage. Although the majority of the activity is released over a two hour period, the modeled release is continued for a 30 day period for control room and low population zone doses.

The offsite release and dose consequences for this accident were calculated using methods described in Regulatory Guide 1.183.

(13 APR 2020) 15.7 - 5

UFSAR Chapter 15 McGuire Nuclear Station 15.7.4.3.3 Environmental Consequences The doses from this accident are within 10 CFR 50.67 limits.

The calculated offsite doses are listed in Table 15-12.

15.7.4.4 Spent Fuel Cask Drop into the Spend Fuel Pool Based on an analysis discussed in Section 9.1.2.3.2 it is concluded that the cask can not enter the spent fuel pool due to a postulated dropping or tipping of the cask. Based on this conclusion, the radiological consequences of a spent fuel cask drop accident need not be evaluated.

Radiation doses were calculated for a drop of a loaded but unsealed fuel cask into the fuel cask pit. Since this cask was not sealed, it was assumed to be breached on impact. It was assumed that the dropped cask contained 37 fuel assemblies that have been cooled for 4 years. It also was assumed that the fuel assemblies are submerged at all times during this scenario. The analysis of this fuel cask drop scenario was completed with the method of Alternative Source Terms (AST) and in conformance to Regulatory Guide 1.183 and Appendix B. The fuel assembly isotopic activities (assuming no prior decay) include 85Kr (29,320 Ci) and its two precursors: 85Br (517,800 Ci) and 85mKr (519,100 Ci). Of all isotopes in the resulting source term, only 85Kr escapes the water in the fuel cask pit; the other radioisotopes either disappear with radioactive decay or remain in the pool (134Cs and 137Cs). Rupture of the pin cladding for all fuel assemblies in the dropped cask and release of gap activity into the water in the pit was assumed. For fuel pins which exceed the rod power/burnup criteria of Footnote 11 in RG 1.183, the gap fractions from RG 1.183 are increased by a factor of 3 for Kr-85, Xe-133, Cs-134 and Cs-137, and increased by a factor of 2 for I-131, and other noble gases, halogens and alkali metals (References 1 and 2). A maximum of 25 fuel rods, per assembly, shall be allowed to exceed the rod power/burnup criteria of Footnote 11 in RG 1.183, in accordance with the license amendment request submitted by letter dated July 15, 2015. The entire 85Kr inventory was assumed to be released to the environment within 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> of event initiation. The analysis included a sensitivity study to ensure the calculation of the limiting radiation dose in the control room.

The acceptance criteria for radiation doses for the fuel cask drop included 6.3 Rem at the offsite locations and 5.0 Rem in the control room. The acceptance limit for the offsite radiation doses is in accord with Standard Review Plan 15.7.5, NUREG-0612 Section 5.1, 10 CFR 50.67, and Regulatory Guide 1.183. The limit for control room radiation doses is taken pursuant to 10 CFR 50.67 and General Design Criterion 19. The limiting radiation doses from the analysis of this fuel cask drop are listed in Table 15-12.

15.7.4.5 Spent Fuel Cask Drop in Fuel Building 15.7.4.5.1 Identification of Causes and Accident Description The spent fuel cask drop accident scenario postulates that a dry storage cask is dropped when moving the fuel from the spent fuel pool to the dry storage area. Activity is released from the fuel pins to the canister. From there, the activity is released from the cask to the atmosphere. The activity released into the Fuel Building is released to the environment via the Fuel Handling Ventilation System.

15.7.4.5.2 Analysis of Effects and Consequences Method of Analysis 15.7 - 6 (13 APR 2020)

McGuire Nuclear Station UFSAR Chapter 15 The fuel assembly isotopics for this accident assume seven years decay time. Table 15-60 contains a list of these isotopics. Thirty-two fuel assemblies inside the cask are ruptured when the dry cask is dropped in transit from the spent fuel pool to the dry storage area. Activity is assumed to be released from the fuel into the cask cavity as provided in Interim Staff Guidance

- 5 (ISG-5). Much of the activity released into the cask is deposited in the cask while some is released to the fuel building. The fuel building ventilation system collects the airborne activity released into the building, filters it through HEPA and charcoal filter banks, and releases it to the environment.

More detailed assumptions are found in Table 15-59.

15.7.4.5.3 Environmental Consequences The doses from this accident are within a small fraction of the 10 CFR 100 limits.

The calculated offsite doses are listed in Table 15-12.

15.7.5 References

1. Repko, Regis T (Duke Energy) to USNRC, License Amendment Request Proposing a New Set of Fission Gas Gap Release Fractions for High Burnup Fuel Rods that Exceed the Linear Heat Generation Rate Limit Detailed in Regulatory Guide 1.183, Table 3, Footnote 11, July 15, 2015.

2. Hall, James R (USNRC) to Repko, Regis T (Duke Energy), Catawba Nuclear Station, Units 1 and 2; McGuire Nuclear Station, Units 1 and 2; and Oconee Nuclear Station, Units 1, 2, and 3 - Issuance of Amendments Regarding Request to Use an Alternate Fission Gas Gap Release Fraction (CAC NOS. MF6480, MF6481, MF6482, MF6483, MF6484, MF6485, and MF6486), July 19, 2016.

THIS IS THE LAST PAGE OF THE TEXT SECTION 15.7.

(13 APR 2020) 15.7 - 7

UFSAR Chapter 15 McGuire Nuclear Station THIS PAGE LEFT BLANK INTENTIONALLY.

15.7 - 8 (13 APR 2020)

McGuire Nuclear Station UFSAR Chapter 15 15.8 Anticipated Transients Without Scram An anticipated transient without trip (ATWT) or anticipated transient without scram (ATWS) is an anticipated operational occurrence (such as loss of feedwater, loss of condenser vacuum, or loss of offsite power) that is accompanied by a failure of the reactor trip system to shut down the reactor. A series of generic studies (Reference 1 and 2) on limiting ATWS events for Westinghouse plants (such as inadvertent control rod withdrawal, loss of feedwater, loss of electrical load, turbine trip, loss of condenser vacuum, or loss of offsite power) showed that acceptable consequences would result provided that the turbine trips and auxiliary feedwater flow is initiated in a timely manner.

The effects of ATWS are not considered as part of the design basis for transients analyzed in Chapter 15.0. The final USNRC ATWS rule (Reference 3) requires that all US Westinghouse-designed plants install ATWS mitigation system actuation circuitry (AMSAC) to initiate a turbine trip and actuate auxiliary feedwater independent of the reactor trip system.

15.8.1 References

1. Burnett, T.W.T., et al., Westinghouse Anticipated Transients Without Trip Analysis, WCAP-8330, August, 1974.

2. Letter from T.M. Anderson (Westinghouse) to S.H. Hanauer (USNRC), ATWS Submittal, NS-TMA-2182, December, 1979.

3. ATWS Final Rule, Code of Federal Regulations 10 CFR 50.62, Requirements for Reduction of Risk from Anticipated Transients Without Scram (ATWS) Events for Light-Water-Cooled Nuclear Power Plants.

THIS IS THE LAST PAGE OF THE TEXT SECTION 15.8.

(13 APR 2020) 15.8 - 1

UFSAR Chapter 15 McGuire Nuclear Station THIS PAGE LEFT BLANK INTENTIONALLY.

15.8 - 2 (13 APR 2020)

McGuire Nuclear Station UFSAR Chapter 15 15.9 Formerly Chapter 15 Appendix A - Models Used for Calculation of Accident Doses The applicable dose criteria for evaluation of Design Basis Accidents (DBAs) depends upon the source term incorporated in the dose consequence analyses. For dose analyses using the TID 14844 source term, the offsite dose criteria at the exclusion area boundary (EAB) and low population zone (LPZ) is specified in 10 CFR 100.11 and the dose criteria for the control room is specified in General Design Criteria 19 of Appendix A to 10 CFR 50. The EAB and LPZ dose criteria of 10 CFR 100.11 are defined for total whole body and thyroid. The control room dose defined in 10 CFR 50, GDC 19 is specific to whole body.

For dose analyses that use Reference 7, the dose criterion is specified in 10 CFR 50.67 as a total effective dose equivalent for offsite EAB and LPZ and control room doses.

Doses are calculated at three locations: the EAB, LPZ and in the Control Room. Doses calculated at the EAB and LPZ are modeled as a receptor located in a semi-infinite cloud of activity (Reg. Guide 1.109, Reference 1). Control Room doses use a combination of the Reg.

Guide 1.109 and Murphy/Campe methodologies. The Murphy/Campe methodologies provide dose correction factors that must be applied to account for the Control Room Engineered Safety Features and geometry considerations.

The following sections provide the equations used for calculating the external whole body and internal thyroid doses at the various receptor locations.

15.9.1 External Whole Body Doses External whole body doses are calculated using the following equation from Reference 1, as presented, is used to calculate the external whole body doses at the EAB and LPZ. Equation 15.9-1.

D wbx = 31.7

• A i

• DCFi

• X / Q x Equation 15.9-1 where; Dwbx = the total dose, in Rems, at location x.

31.7 = unit conversion; changes the DCFi units from mRem-m3/pCi-yr to Rem-m3/Ci-sec.

Ai = The activity released of isotope i, in Ci (this value is calculated for each accident).

DCFi = the whole body dose conversion factor for isotope i, in mRem-m3/pCi-yr.

X/Qx = the atmospheric dispersion factor at location x for a particular time period, in sec/m3.

15.9.2 Internal Thyroid Doses Inhalation doses to the thyroid are potentially significant due to the build-up of iodine species in the core during normal operation of the reactor. In addition, the potential for iodine spiking can result in larger iodine concentrations in the core, thus resulting in potentially larger doses to the receptors. The inhalation thyroid doses are calculated using the following equation from (13 APR 2020) 15.9 - 1

UFSAR Chapter 15 McGuire Nuclear Station Reference 1, as presented, is used to calculate the inhalation thyroid doses at the EAB and LPZ. Equation 15.9-2.

D thx = 1E + 9

• BR

• A i

• DCFi

• X / Q x Equation 15.9-2

where, Dthx = the total dose, in Rems, at location x.

1E+9 = unit conversion; changes the DCFi units from mRem/pCi to Rem/Ci.

BR = adult breathing rate, in m3/sec.

Ai = the activity released of isotope i, in Ci (calculated for each accident).

DCFi = the thyroid dose conversion factor for isotope i, in mRem/pCi.

X/Qx = the atmospheric dispersion factor at location x for a particular time period, in sec/m3.

15.9.3 Control Room Operator Doses The Control Room operator dose uses a combination of Equation 15.9-1 and Equation 15.9-2 along with several correction factors to account for the Control Room Engineered Safety Systems, geometry considerations, and occupancy factors. Each of the correction factors is presented below.

15.9.3.1 Geometry Factor (References 2 and 4)

The whole body gamma dose from noble gas isotopes is easily evaluated on the basis of immersion in an infinite cloud. Since control structures are usually effective in shielding out most of the gamma radiation from outside the control room, the dose inside the control room is substantially less than what the infinite cloud model predicts. A correction for this effect can be made by using a geometry factor which is a ratio of infinite-to-finite could doses, i.e.,

dose from an infinite cloud GF =

dose from a cloud of volume V where V is the control room volume. Taking into account geometric effects and gamma attenuation (using 0.733 MeV as the average gamma energy for noble gases considered in the control room dose analysis) in air, it can be shown that GF equals:

1173 GF = Equation 15.9-3 V 0.338 where the control room geometry is represented by a hemisphere of volume V (cubic feet). For the McGuire Nuclear Station, the geometry factor is as follows:

1173 GFMNS =

(1.16E + 5) 0.338 15.9 - 2 (13 APR 2020)

McGuire Nuclear Station UFSAR Chapter 15 GFMNS = 22.78 This factor is applied to the external whole body dose equation (Equation 15.9-1) to convert the dose model from a semi-infinite cloud to a finite cloud model.

15.9.3.2 Iodine Protection Factor (References 2 and 4)

There are several control room ventilation-filtration configurations which are used in reducing the iodine isotope concentration within the control room atmosphere. A time dependant control room ventilation model can be used or approximated using an iodine protection factor (IPF) which is evaluated by considering an equilibrium balance between iodine sources and losses within the control room. The figure below shows the VC flow configuration at McGuire (Reference 5).

VC Flow Configuration at McGuire where the variables are:

F1 = rate of filtered outside air intake.

F2 = rate of filtered air recirculation.

F3 = rate of unfiltered outside air infiltration.

F4 = rate of filtered flow going into the control room.

A= specific activity within the control room.

Ao = specific activity at control room air intake.

n = filter efficiency/100.

Under equilibrium conditions, the following equilibrium ratio of outside to inside specific activity, known as the iodine protection factor (IPF), occurs (Reference 4). This ratio is applied to the (13 APR 2020) 15.9 - 3

UFSAR Chapter 15 McGuire Nuclear Station thyroid dose equation (Equation 15.9-2) to account for the filtration of iodine from the air going to the control room.

F4

[F4 + F3 ] F2 [ ](1 n )

Ao F1 + F2

= Equation 15.9-4 A F F3 + F1 [ 4 ](1 n )

F1 + F2 15.9.3.3 Control Room Occupancy Factors (Reference 3)

Control Room occupancy factors (OF) are applied to account for the fraction of the time the Control Room is occupied during various time periods of the accident. These time periods correspond to the time periods established for the X/Q values. These occupancy factors, taken from Reference 6, are as follows:

Time Occupancy Factor 0-8 hrs 1.0 8-24 hrs 1.0 1-4 days 0.6 4-30 days 0.4 These factors are applied to both Equation 15.9-1 and Equation 15.9-2 for the specific time period during the accident.

15.9.3.4 Control Room Operator Dose Equations Based on the discussions in the previous sections, the following two equations are used to calculated the doses to operators in the Control Room:

Control Room Operator Whole Body Dose (Dcrwb)

D crwb = (31.7

• A i

• DCFi

• X / Q x

• OF) / GF i

Equation 15.9-5 where all variables have been previously defined.

Control Room Operator Thyroid Dose (Dcrth)

D crth = (1E + 9

• BR

• A i

• DCFi

• X / Q x

• OF) / IPF i

Equation 15.9-6 where all variables have been previously defined.

15.9.4 References

1. Regulatory Guide 1.109, Calculation of Annual Doses to Man from Routine Releases of Reactor Effluents for the Purpose of Evaluating Compliance with 10CFR 50, Appendix I, Rev. 1, 10/77.

15.9 - 4 (13 APR 2020)

McGuire Nuclear Station UFSAR Chapter 15

2. K. G. Murphy and K. M. Campe, Nuclear Power Plant Control Room Ventilation System Design for Meeting GDC 19, 13th AEC Air Cleaning Conference, August 1974.

3. NUREG-0800, Standard Review Plan 6.4, Control Room Habitability System, Rev. 2, 7/81.

4. Duke Calculation Number COM-0204.C6-11-0043, DOSECON Computer Code Verification, Rev. 1, January 1991.

5. Duke Design Specification MCS-1578.VC-00-0001, McGuire Units 1 and 2, Design Basis Specification for the VC/YC System GDCS, Rev. OA, 2/20/91.

6. Limits on Intakes of Radionuclides by Workers, International Commission on Radiation Units and Measurements Publication 30, 1979.

7. USNRC Regulatory Guide 1.183, Alternative Radiological Source Terms for Evaluating Design Basis Accidents at Nuclear Power Reactors, Original Issue, July 2000.

THIS IS THE LAST PAGE OF THE TEXT SECTION 15.9.

(13 APR 2020) 15.9 - 5

UFSAR Chapter 15 McGuire Nuclear Station THIS PAGE LEFT BLANK INTENTIONALLY.

15.9 - 6 (13 APR 2020)

McGuire Nuclear Station UFSAR Chapter 15 15.10 Formerly Chapter 15 Appendix B - Supplementary Radiological Analyses 15.10.1 Tornado Missile Impact - Spent Fuel Analysis 15.10.1.1 Identification of Causes and Accident Description The north end of the fuel building at McGuire is not provided with tornado missile protection.

The radiological consequences of a tornado missile impact are mitigated by limiting the age of the fuel discharged to the spent fuel pool.

15.10.2 Analysis of Effects and Consequences 15.10.3 Method of Analysis An analysis was performed to determine the dose consequences in the event of a postulated tornado missile accident. A tornado-generated missile is assumed to breach the fuel building and rupture thirty-eight assemblies in region 2 of the spent fuel pool. The entire gap activity is assumed to be instantly released to the spent fuel pool water. For fuel pins which exceed the rod power/burnup criteria of Footnote 11 in RG 1.183, the gap fractions from RG 1.183 are increased by a factor of 3 for Kr-85, Xe-133, Cs-134 and Cs-137, and increased by a factor of 2 for I-131, and other noble gases, halogens and alkali metals (References 1 and 2). A maximum of 25 fuel rods, per assembly, shall be allowed to exceed the rod power/burnup criteria of Footnote 11 in RG 1.183, in accordance with the license amendment request submitted by letter dated July 15, 2015. The activity is assumed to be released to the envirnoment, with no holdup in the fuel building, over a 2-hour period. Key assumptions pertaining to this accident include:

1. Eight assemblies are assumed to have decayed for sixteen days and thirty assemblies are assumed to have decayed for 295 days.

2. Fuel pins are breached and are equivalent to thirty-eight assemblies in region 2 being ruptured.

3. The source term is listed in Table 15-35.

4. The effective iodine decontamination factor is 200. Only elemental iodine and organic iodine compounds are released from the spent fuel pool. All particulates are assumed to stay in the water.

5. The Fuel Building Ventilation (VF) System is credited for this analysis in the sense that the release point is not the unit vent, but is actually the rollup door, since it is not tornado-proof.

No credit is taken however for filtration from the VF system.

6. The Control Room Area Ventilation (VC) System is assumed to be in service within 30 minutes of the accident. The rate of unfiltered inleakage is set to 500 cfm before pressurization and 210 cfm once pressurization occurs.

7. Other assumptions are detailed in Table 15-39.

Results A maximum number of fuel pins that rupture, equivalent to 38 fuel assemblies, could potentially suffer a loss of integrity due to a tornado missile accident. The resulting doses are presented in Table 15-12.

(13 APR 2020) 15.10 - 1

UFSAR Chapter 15 McGuire Nuclear Station 15.10.3.1 Environmental Consequences The doses for this accident are below 10 CFR 50.67 limits.

15.10.4 References

1. Repko, Regis T (Duke Energy) to USNRC, License Amendment Request Proposing a New Set of Fission Gas Gap Release Fractions for High Burnup Fuel Rods that Exceed the Linear Heat Generation Rate Limit Detailed in Regulatory Guide 1.183, Table 3, Footnote 11, July 15, 2015.

2. Hall, James R (USNRC) to Repko, Regis T (Duke Energy), Catawba Nuclear Station, Units 1 and 2; McGuire Nuclear Station, Units 1 and 2; and Oconee Nuclear Station, Units 1, 2, and 3 - Issuance of Amendments Regarding Request to Use an Alternate Fission Gas Gap Release Fraction (CAC NOS. MF6480, MF6481, MF6482, MF6483, MF6484, MF6485, and MF6486), July 19, 2016.

THIS IS THE LAST PAGE OF THE TEXT SECTION 15.10.

15.10 - 2 (13 APR 2020)