Text

0 to Updated Final Safety Analysis Report, Chapter 15, Decrease in Reactor Coolant Inventory, Sections 6 Thru 12 (Redacted)
	ML21253A062
Person / Time
Site:	Limerick
Issue date:	04/29/2021
From:	Audrey Klett; Plant Licensing Branch 1
To:	; Exelon Generation Co
	Klett A
References
	Download: ML21253A062 (176)
	v • d • e

LGS UFSAR 15.6 DECREASE IN REACTOR COOLANT INVENTORY 15.6.1 INADVERTENT MAIN STEAM RELIEF VALVE OPENING This transient is discussed and analyzed in Section 15.1.4.

15.6.2 INSTRUMENT LINE PIPE BREAK This accident involves the postulation of a small steam or liquid line pipe break inside or outside primary containment but within a controlled release structure. In order to bound the accident, it is assumed that a small instrument line, instantaneously and circumferentially, breaks at a location where it may not be able to be isolated and where immediate detection is not automatic or apparent.

Obviously, this accident is far less limiting than the postulated events in Sections 15.6.4, 15.6.5, and 15.6.6.

This postulated accident represents the envelope evaluation for small line failure inside and outside primary containment, relative to sensitivity to detection. It is summarized in Tables 15.6-1 through 15.6-7 and Figure 15.6-1.

15.6.2.1 Identification of Causes and Frequency Classification 15.6.2.1.1 Identification of Causes and Event Description There is no specific event or circumstance identified that results in the failure of an instrument line.

These lines are designed to high quality engineering codes and standards, and seismic and environmental requirements. However, for the purpose of evaluating the consequences of a small line rupture, the failure of an instrument line is assumed to occur.

A circumferential rupture of an instrument line connected to the primary coolant system is postulated to occur outside primary containment but inside secondary containment. This failure results in the release of primary system coolant to the secondary containment until the reactor is depressurized. This accident could conceivably occur also in the drywell. However, the associated effects would not be as significant as those from a failure in the secondary containment.

15.6.2.1.2 Frequency Classification This accident is categorized as a limiting fault.

15.6.2.2 Sequence of Events and System Operation 15.6.2.2.1 Sequence of Events The sequence of events for this accident is shown in Table 15.6-1.

The operator should isolate the affected instrument line. Depending on which line is broken, the operator should determine whether to continue plant operation until a scheduled shutdown can be made or to proceed with an immediate, orderly plant shutdown and initiate the SGTS or other ventilation effluent treatment systems.

CHAPTER 15 15.6-1 REV. 20, SEPTEMBER 2020

LGS UFSAR As a result of increased radiation, temperature, humidity, fluid, and noise levels within the secondary containment, operator action can be initiated by any one or any combination of the following:

a. Operator comparing the readings of several instruments monitoring the same process variable, such as reactor level, jet pump flow, steam flow, and steam pressure.

b. By alarm, either high or low in the control room, from the instrument served by the failed line.

c. By a half-channel scram if rupture occurred on an RPS instrument line.

d. By a general increase in the area radiation monitor readings.

e. By an increase in the ventilation process radiation monitor readings.

f. By leak detection system actuation.

Upon receiving one or more of the above signals and having made an unsuccessful attempt to isolate the break, the operator should proceed to shutdown the plant in an orderly manner.

15.6.2.2.2 System Operation Normal plant instrumentation and controls are assumed to be fully operational during the entire plant transient to ensure positive identification of the break and safe shutdown of the plant.

Minimum reactor and plant protection system operations are assumed for the analysis, e.g.,

minimum ECCS flow, and pool cooling capability. As a consequence of the accident, the reactor is scrammed and the reactor vessel cooled and depressurized over a 5 hour5.787037e-5 days 0.00139 hours 8.267196e-6 weeks 1.9025e-6 months period.

15.6.2.2.3 The Effect of Single Failures and Operator Errors The initiating event is handled by a protection sequence that can accommodate additional single failures. See Section 15.9 for a more detailed discussion of this subject.

15.6.2.3 Core and System Performance 15.6.2.3.1 Qualitative Summary Instrument line breaks, because of their small size, are substantially less limiting from a core and systems performance standpoint than the accidents examined in Sections 15.6.4, 15.6.5, and 15.6.6. Consequently, instrument line breaks are considered to be bounded specifically by the steam line break (Section 15.6.4). Details of this calculation, including those pertinent to core and system performance, are discussed in detail in Section 15.6.4.3.

Since instrument line breaks result in a slower rate of coolant loss and are bounded by the calculations referenced above, the results presented here are qualitative rather than quantitative.

Since the rate of coolant loss is slow, an orderly reactor system depressurization follows reactor scram, and the primary system is cooled down and maintained without ECCS actuation. No fuel damage or core uncovering occurs as a result of this accident.

CHAPTER 15 15.6-2 REV. 20, SEPTEMBER 2020

LGS UFSAR 15.6.2.3.2 Quantitative Results Instrument line breaks, because of their small size, are substantially less limiting from a core and system performance standpoint than the steam line break outside primary containment. Similarly, instrument line breaks are considered within the spectrum considered in ECCS performance calculations discussed in detail in Section 6.3.3.

Therefore, all information concerning ECCS models employed, input parameters, and detailed results for a more limiting (steam line break) event may be found in Section 6.3.

15.6.2.3.3 Consideration of Uncertainties The approach toward conservatively analyzing this accident is discussed in detail for a more limiting case in Section 6.3.

15.6.2.4 Barrier Performance 15.6.2.4.1 General The release of primary coolant through the orificed instrument line could result in an increase in secondary containment pressure and the potential for isolation of the normal ventilation system.

The following assumptions and conditions are the basis for the mass loss during the 5 hour5.787037e-5 days 0.00139 hours 8.267196e-6 weeks 1.9025e-6 months reactor shutdown period of this accident:

a. Shutdown and depressurization initiated 10 minutes after break occurs.

b. Normal depressurization and cooldown of RPV.

c. Line contains a 1/4 inch diameter flow restricting orifice inside the drywell.

d. Moody critical blowdown flow model (Reference 15.6-1) is applicable, and flow is critical at the orifice.

The total integrated mass of fluid released into the secondary containment via the break during the blowdown is 25,000 pounds. Of this total, 6000 pounds flash to steam. Release of this mass of coolant results in a secondary containment pressure that is well below the design pressure.

Using the assumptions and methods discussed above, analysis shows that following the break of an instrument line installed with a 1/4 inch orifice, the vessel inventory mass loss during the first two hours is 14,500 pounds; of this total, 4200 pounds flash to steam.

Small lines connected to the primary reactor coolant system and penetrating the containment that do not have a 1/4 inch orifice upstream of the primary containment are listed below:

CHAPTER 15 15.6-3 REV. 20, SEPTEMBER 2020

LGS UFSAR System Containment Penetration No.

Recirculation Loop Sample X-28A-1 CRD Insert X-37A-D CRD Withdraw X-38A-D SLCS X-42 Main Steam Sample X-43B As identified in Table 6.2-17, these lines have redundant containment isolation barriers, except for the CRD withdraw lines. An estimate of the primary coolant released from the CRD withdraw lines in the event of a break is provided in NUREG-0803, "Generic Safety Evaluation Report Regarding Integrity of BWR Scram System Piping." Analyses to determine the amount of primary coolant released from the other lines have not been performed because the offsite radiological consequences of breaks in these lines would be bounded by those of a large steam line break outside primary containment (Section 15.6.4).

15.6.2.5 Radiological Consequences Two separate radiological analyses are provided for this accident:

a. The first is based on conservative assumptions considered to be acceptable to the NRC for the purpose of determining adequacy of the plant design to meet 10CFR100. This analysis is referred to as the "design basis analysis."

b. The second is based on assumptions considered to provide a realistic conservative estimate of the radiological consequences. This analysis is referred to as the "realistic analysis."

A schematic of the release path is shown in Figure 15.6-1.

15.6.2.5.1 Design Basis Analysis The design basis analysis is based on SRP 15.6.2 and Regulatory Guide 1.5. The specific models, assumptions, and the program used for computer evaluation are described in Section 15.10. Specific values of parameters used in the evaluation are presented in Table 15.6-2.

The assumptions and calculation methodology used are as follows:

a. Spiking factor The activity released from the fuel to the coolant as a consequence of reactor scram and vessel depression was based on measurements during plant shutdowns (Reference 15.6-2). It was shown that for a 95 percentile probability, a total of 7 Ci of I-131 is released to the coolant for every 1 Ci/sec of prespike I-131 release. This conservative ratio was applied for all the iodine isotopes for the dose analysis. The CHAPTER 15 15.6-4 REV. 20, SEPTEMBER 2020

LGS UFSAR prespike iodine releases were those that correspond to a 0.35 Ci/sec noble gases release, a DBA assumption.

b. Iodine concentration in coolant The total iodine released from the fuel to the coolant was assumed to take place in a span of 5 hours5.787037e-5 days 0.00139 hours 8.267196e-6 weeks 1.9025e-6 months , resulting in continued buildup of coolant activity during that period. The coolant activity during 0-2 hours was assumed to be constant and equal to that at the end of the first hour. The coolant activity during 2-5 hours was assumed to be equal to that at the end of 31/2 hours. This is a conservative assumption, since the rate of increase in coolant activity decreases with time.

c. Partition factor It was assumed that 100% of the activity in the coolant that flashed into steam remains airborne and that 10% of the activity carried by the coolant water into the secondary containment becomes airborne (corresponding to a conservative partition factor of 0.1).

d. Activity in secondary containment and released to the environment The secondary containment volume was assumed to consist of one reactor enclosure, as discussed in Section 15.6.5.5.1.2. The activity airborne in the secondary containment was assumed to be uniformly mixed by the RERS with an air flow rate of 60,000 cfm and a 95% efficient filter. Secondary containment air is released to the environment via the SGTS at the rate of two secondary containment volumes change per day. The SGTS filter has an efficiency of 99%. The SGTS draws air from the RERS exhaust. The activity airborne in the secondary containment and the activity released to the environment are presented in Tables 15.6-3 and 15.6-4, respectively.

The calculated exposure at the EAB and LPZ are presented in Table 15.6-7.

15.6.2.5.2 Realistic Analysis The realistic analysis was based on a realistic but still conservative assessment of this accident.

The specific models, assumptions, and the program used for computer evaluation are described in Reference 15.6-3. Specific values of parameters used in the evaluation are presented in Table 15.6.2. The leakage path used in these calculations is shown in Figure 15.6-1.

Assumptions and calculations for the realistic analysis were identical to that of the design basis except for the following:

a. Total iodine released from the fuel to the coolant was assumed to be 2 Ci for every 1 Ci/sec prespike release. This is an estimated ratio for a 50 percentile probability spiking release during plant shutdowns (Reference 15.6-2).

b. The 50% X/Qs were used instead of the 5% X/Qs used for the design basis analysis.

CHAPTER 15 15.6-5 REV. 20, SEPTEMBER 2020

LGS UFSAR The activity airborne in the secondary containment is presented in Table 15.6-5. The activity released to the environment is presented in Table 15.6-6. The calculated exposure at the EAB and the LPZ are presented in Table 15.6-7.

15.6.3 STEAM GENERATOR TUBE FAILURE This section is not applicable to the direct cycle BWR; this is a PWR-related event.

15.6.4 STEAM SYSTEM PIPING BREAK OUTSIDE PRIMARY CONTAINMENT This accident involves the postulation of a large steam line pipe break outside primary containment. It is assumed that the largest steam line instantaneously and circumferentially breaks at a location downstream of the outermost isolation valve. The plant is designed to immediately detect such an occurrence, initiate isolation of the broken line, and actuate the necessary protective features. This postulated accident represents the envelope evaluation of steam line failures outside primary containment.

This accident is summarized in Tables 15.6-8 through 15.6-11 and Figure 15.6-2.

15.6.4.1 Identification of Causes and Frequency Classification 15.6.4.1.1 Identification of Causes A main steam line break is postulated without the cause being identified. These lines are designed to high quality engineering codes and standards, and seismic and environmental requirements.

However, for the purpose of evaluating the consequences of a postulated large steam line rupture, the failure of a main steam line is assumed to occur.

15.6.4.1.2 Frequency Classification This accident is categorized as a limiting fault.

15.6.4.2 Sequence of Events and System Operation 15.6.4.2.1 Sequence of Events Accidents that result in the release of radioactive materials directly outside primary containment are primary results of postulated breaches in the RCPB or the steam power conversion system boundary. A break spectrum analysis for the complete range of reactor conditions indicates that the limiting fault accident for breaks outside primary containment is a complete severance of one of the four main steam lines. The sequence of events and approximate time required to respond to the accident is given in Table 15.6-8.

Normally, the reactor operator will maintain reactor vessel water inventory and, therefore, core cooling with the RCIC system. Without operator action, the RCIC would initiate automatically on low water level following isolation of the main steam supply system (i.e., MSIV closure). The core would be covered throughout the accident and there would be no fuel damage. Without taking credit for the RCIC water makeup capability and assuming HPCI failure, the termination of the accident without fuel damage is assured because the ADS will actuate at low water level (Level 1).

This will permit the low pressure ECCS to re-establish water level above the core.

CHAPTER 15 15.6-6 REV. 20, SEPTEMBER 2020

LGS UFSAR 15.6.4.2.2 System Operation A postulated guillotine break of one of the four main steam lines outside primary containment results in mass loss from both ends of the break. The flow from the upstream side is initially limited by the flow restrictor upstream of the inboard isolation valve. Flow from the downstream side is initially limited by the total area of the flow restrictors in the three unbroken lines. Subsequent closure of the MSIVs further limits the flow when the valve area becomes less than the limiter area and finally terminates the mass loss when the full closure is reached.

A discussion of plant and reactor protection system action and ESF action is given in Sections 6.3, 7.3, and 7.6.

15.6.4.2.3 The Effect of Single Failures and Operator Errors The effect of single failures has been considered in analyzing this accident. The ECCS aspects are covered in Section 6.3. The break detection and isolation considerations are defined in Sections 7.3 and 7.6. All of the protective sequences for this accident are capable of single failure accommodation and yet completion of the necessary safety action (Section 15.9).

15.6.4.3 Core and System Performance Quantitative results (including mathematical models, input parameters, and consideration of uncertainties) for this accident are given in Section 6.3. The temperature and pressure transients resulting as a consequence of this accident are insufficient to cause fuel damage.

15.6.4.3.1 Input Parameters and Initial Conditions Refer to Section 6.3 for initial conditions.

15.6.4.3.2 Results There is no fuel damage as a consequence of this accident. Refer to Section 6.3 for ECCS analysis.

15.6.4.3.3 Consideration of Uncertainties Sections 6.3 and 7.3 contain discussions of the uncertainties associated with the ECCS performance and the containment isolation systems, respectively.

15.6.4.4 Barrier Performance Since this break occurs outside primary containment, barrier performance within the primary containment envelope is not applicable. Details of the results of this accident can be found in Section 6.2.3.

The following assumptions and conditions are used in determining the mass loss from the primary system from the inception of the break to full closure of the MSIVs:

a. The reactor is operating at the power level associated with maximum mass release (4% Reactor Power, 35% Core Flow).

CHAPTER 15 15.6-7 REV. 20, SEPTEMBER 2020

LGS UFSAR

b. Nuclear system pressure is initially 1060 psia.

c. An instantaneous circumferential break of the main steam line occurs.

d. Isolation valves start to close at 1.0 second on high flow signal and are fully closed at 6.0 seconds.

e. The Moody critical flow model (Reference 15.6-1) is applicable.

f. The SAFER Code (Ref. 15.6-10) is used to calculate the time varying two-phase flow and system pressure during the accident.

Initially, only steam will issue from the broken end of the steam line. The flow in each line is limited by critical flow at the limiter to a maximum of 200% of rated flow for each line. Rapid depressurization of the RPV causes the water level to rise, resulting in a steam/water mixture flowing from the break until the valves are closed. The total integrated mass leaving the RPV through the steam line break is 115,700 lbm of which 101,562 lbm is liquid and 14,138 lbm is steam (Ref. 15.6-26). For the radiological consequence evaluation, a total mass of 140,000 lbm is assumed.

15.6.4.5 Radiological Consequences for the MSLB Regulation 10CFR50.67, "Accident Source Term," provides a mechanism for power reactor licensees to voluntarily replace the traditional TID-14844 (Ref. 15.6-11) accident source term used in design-basis accident analyses with an "Alternative Source Term" (AST). The methodology of approach to this replacement is given in USNRC Regulatory Guide 1.183 (Ref.

15.6-12) and its associated Standard Review Plan 15.0.1 (Ref. 15.6-13).

Accordingly, Limerick Generating Station, Units 1 and 2, have applied the AST methodology for several areas of operational relief in the event of a Design Basis Accident (DBA), without fully crediting the use of previously assumed safety systems. Amongst these systems are the Control Room Emergency Fresh Air Supply System (CREFAS) and the Standby Gas Treatment System (SGTS).

In support of a full-scope implementation of AST as described in and in accordance with the guidance of Ref. 15.6-12, AST radiological consequence analyses are performed for the four DBAs that result in offsite exposure (i.e., Loss of Coolant Accident (LOCA), Main Steam Line Break (MSLB), Fuel Handling Accident (FHA), and Control Rod Drop Accident (CRDA).

Implementation consisted of the following steps:

Identification of the AST based on plant-specific analysis of core fission product inventory,

Calculation of the release fractions for the four DBAs that could potentially result in control room and offsite doses (i.e., LOCA, MSLB, FHA, and CRDA),

Analysis of the atmospheric dispersion for the radiological propagation pathways,

Calculation of fission product deposition rates and removal mechanisms, CHAPTER 15 15.6-8 REV. 20, SEPTEMBER 2020

LGS UFSAR

Calculation of offsite and control room personnel Total Effective Dose Equivalent (TEDE) doses.

15.6.4.5.1 Regulatory Approach The analyses are prepared in accordance with the guidance provided by Regulatory Guide 1.183 (Ref. 15.6-12).

15.6.4.5.2 Dose Acceptance Criteria The AST acceptance criteria for Control Room dose for postulated major credible accident scenarios such as those resulting in substantial meltdown of the core with release of appreciable quantities of fission products is provided by 10CFR50.67, which requires:

"Adequate radiation protection is provided to permit access to and occupancy of the control room under accident conditions without personnel receiving radiation exposures in excess of 0.05 Sv (5 rem) total effective dose equivalent (TEDE) for the duration of the accident."

This limit is applied by Regulatory Guide 1.183 to all of the accidents considered with AST.

The AST acceptance criteria for an individual located at any point on the boundary of the exclusion area (the Exclusion Area Boundary or EAB) are provided by 10 CFR 50.67 as 25 rem TEDE for any 2-hour period following the onset of the postulated fission product release.

The AST acceptance criteria for an individual located at any point on the outer boundary of the low population zone (LPZ) are provided by 10CFR50.67 as 25 rem TEDE during the entire period of passage of the radioactive cloud resulting from the postulated fission product release.

These limits are applied by Regulatory Guide 1.183 to events with a higher probability of occurrence (including CRDA, MSLB, and FHA considered herein) to provide the following acceptance criteria:

For the BWR MSLB for the case of an accident assuming fuel damage or a pre-incident Iodine spike, doses at the EAB and LPZ should not exceed 25 rem TEDE for the accident duration (2 hour2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months dose for EAB and 30 day dose for LPZ). For MSLB accidents assuming normal equilibrium Iodine activity, doses should not exceed 2.5 rem TEDE for the accident duration.

For the BWR CRDA, doses at the EAB and LPZ should not exceed 6.3 rem TEDE for the accident duration (2 hour2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months dose for EAB and 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months dose for LPZ).

For the FHA, doses at the EAB and LPZ should not exceed 6.3 rem TEDE for the accident duration (2 hour2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months dose for EAB and 30 day dose for LPZ).

15.6.4.5.3 Computer Codes New AST calculations for the MSLB were prepared to simulate the radionuclide release, transport, removal, and dose estimates associated with the postulated accidents.

While the RADTRAD computer code (Ref. 15.6-15) endorsed by the NRC for AST analyses was used in the calculations for the LOCA, CRDA and FHA, the MSLB was analyzed using the CHAPTER 15 15.6-9 REV. 20, SEPTEMBER 2020

LGS UFSAR Regulatory Guide 1.183 methodology. The MSLB assessment takes no credit for control room isolation, emergency ventilation or filtration of intake air for the duration of the accident event.

15.6.4.5.4 Source Terms Reactor Coolant Inventory The reactor coolant fission product inventory for MSLB analysis is based on the Technical Specification limits in terms of Dose Equivalent I-131 (the concentration of I-131 that alone would produce the same dose as the quantity and isotopic mixture of I-131, I-132, I-133, I-134, and I-135 actually present), using inhalation Committed Effective Dose Equivalent (CEDE) dose conversion factors from Federal Guidance Report No. 11 (Ref. 15.6-20). Cesium, as Cesium Iodide, and Noble Gas releases are also considered, but the iodine isotopes are the only significant dose contributors.

15.6.4.5.5 Methodology Dose Calculations As per Regulatory Guide 1.183 (Ref. 15.6-12), Total Effective Dose Equivalent (TEDE) doses are determined as the sum of the CEDE and the Effective Dose Equivalent (EDE) using dose conversion factors for inhalation CEDE from Federal Guidance Report No. 11 (Ref. 15.6-20) and for external exposure EDE from Federal Guidance Report No. 12 (Ref. 15.6-21).

Main Steam Line Break (MSLB)

Table 15.6-9 lists the key assumptions and inputs used in the analysis. The postulated MSLB accident assumes a double-ended break of one main steam line outside the primary containment with displacement of the pipe ends that permits maximum blowdown rates.

However, the break mass released is taken for the dose calculations as a bounding maximized value for all current Boiling Water reactor plants of 140,000 pounds of water, as provided in Standard Review Plan 15.6.4 for a GESSAR-251 plant. This value bounds for dose calculation purposes the historic UFSAR values, ensuring that the dose consequences are maximized and that the releases bound any other credible pipe break. Two activity release cases corresponding to the pre-accident spike and maximum equilibrium concentration allowed by Technical Specifications of 4.0 Ci/gm and 0.2 Ci/gm dose equivalent I-131 respectively were assumed, with inhalation CEDE dose conversion factors from Federal Guidance Report 11 conservatively used for normalized Dose Equivalent I-131 determination. The released activity assumptions are consistent with the guidance provided in Appendix D of Regulatory Guide 1.183.

The analysis assumes an instantaneous ground level release. For the control room dose calculations, the released reactor coolant and steam is assumed to expand to a hemispheric volume at atmospheric pressure and temperature (consistent with an assumption of no Turbine Building credit). This hemisphere is then assumed to move at a speed of 1 meter per second downwind past the control room intake. No credit is taken for buoyant rise of the steam cloud or for decay, and dispersion of the activity of the plume was conservatively ignored. For offsite locations, the buoyant rise of the steam cloud is similarly ignored, and the ground level dispersion is based on the conservative and simplified Regulatory Guide 1.5 (Ref. 5.6-22) methodology.

CHAPTER 15 15.6-10 REV. 20, SEPTEMBER 2020

LGS UFSAR The radiological consequences following an MSLB accident were determined using a spreadsheet. The following significant assumptions were made and are detailed in the applicable MSLB design analysis (Ref. 15.6-14):

Iodine activity distribution in the coolant as follows:

Iodine Isotope Activity (Ci/cc)

I-131 0.039 I-132 0.360 I-133 0.267 I-134 0.720 I-135 0.390

Release from the break to the environment is assumed instantaneous. No holdup in the Turbine Building or dilution by mixing with Turbine Building air volume is credited.

The steam cloud is assumed to consist of the portion of the liquid reactor coolant release that flashed to steam.

The activity of the cloud is based on the total mass of water released from the break.

This assumption is conservative because it considers the maximum release of fission products.

Flashing fraction of liquid water released was assumed as 40%. However, all activity in the water is assumed to be released.

15.6.4.5.6 Atmospheric Dispersion Factors (X/Qs)

For the control room dose calculations, the released reactor coolant and resultant flashed steam is assumed to expand to a hemispheric volume at atmospheric pressure and temperature (consistent with an assumption of no Turbine Building credit). This hemisphere is then assumed to move at a speed of 1 meter per second downwind past the control room intake. No credit is taken for buoyant rise of the steam cloud or for decay, and dispersion of the activity of the plume was conservatively ignored.

For offsite locations, the buoyant rise of the steam cloud is similarly ignored, and the ground level dispersion is based on the conservative and simplified Regulatory Guide 1.5 (Ref. 15.6-22) methodology. Table 15.6-10 lists X/Q values for the EAB and LPZ boundaries.

15.6.4.5.7 Summary and Conclusions The radiological consequences of the postulated MSLB are given in Table 15.6-11. As indicated, the control room, EAB, and LPZ calculated doses are within regulatory limits after AST implementation.

15.6.5 LOSS-OF-COOLANT ACCIDENTS (RESULTING FROM SPECTRUM OF POSTULATED PIPING BREAKS WITHIN THE REACTOR COOLANT PRESSURE BOUNDARY) INSIDE PRIMARY CONTAINMENT CHAPTER 15 15.6-11 REV. 20, SEPTEMBER 2020

LGS UFSAR This accident involves the postulation of a spectrum of piping breaks inside containment varying in size, type, and location. The break type includes steam and/or liquid process system lines.

The accident is analyzed quantitatively in Sections 6.3, 6.2, 7.3, 7.6, and 8.3. Therefore, the following discussion provides only new information not presented in the subject sections. All other information is covered by cross-referencing.

The postulated accident represents the envelope evaluation for liquid or steam line failures inside primary containment. It is summarized in Tables 15.6-13 through 15.6-20 and Figure 15.6-3.

15.6.5.1 Identification of Causes and Frequency Classification 15.6.5.1.1 Identification of Causes There are no realistic, identifiable events that would result in a pipe break inside primary containment of the magnitude required to constitute a LOCA coincident with a single active failure.

The subject piping is designed to high quality engineering codes and standards, and seismic and environmental requirements. However, for estimating the resultant effects of this category of pipe breaks, a LOCA plus single active failure are assumed to occur without the causes being identified.

15.6.5.1.2 Frequency Classification This accident is categorized as a limiting fault.

15.6.5.2 Sequence of Events and System Operation 15.6.5.2.1 Sequence of Events The sequence of events associated with this accident is shown in Table 6.3-2 for core system performance and Table 6.2-8 for barrier (containment) performance.

Following the pipe break and scram, the low-low water level (Level 2) trip or the high drywell pressure trip will start the HPCI system. The MSIVs will begin to close on the low-low-low water level (Level 1) trip. Either the Level 1 trip or the high drywell pressure coincident with low reactor pressure trip will start the CS and LPCI systems. From time zero, the CS system will start at less than or equal to 54 seconds, the HPCI system will start at approximately 60 seconds and the LPCI system will start at less than or equal to 70 seconds..

Since automatic actuation and operation of the ECCS is a system design basis, no credit for immediate operator actions are assumed in the evaluation of the accident. However, in accordance with procedural requirements, the operator should perform the following described actions.

The operator should, after ensuring that all rods have been inserted at time 0 plus approximately 10 seconds, determine plant condition by observing the annunciators. After observing that the ECCS flows are initiated, the operator should check that the diesel generators have started and are on standby condition, and that the ESW system has started.

Based on plant conditions, the operator should initiate operation of the RHRSW system and the RHR system heat exchangers in the suppression pool cooling mode. After the RHR system and other auxiliary systems are in proper operation, the operator should monitor the hydrogen concentration in the drywell for proper activation of the post-LOCA recombiners, if necessary.

CHAPTER 15 15.6-12 REV. 20, SEPTEMBER 2020

LGS UFSAR 15.6.5.2.2 System Operation Accidents that could result in the release of radioactive fission products directly into the containment are the result of postulated nuclear system RCPB pipe breaks. A spectrum of pipe break sizes and locations are examined in Sections 6.2 and 6.3, including the severance of small process system lines, the main steam lines upstream of the flow restrictors, and the recirculation loop pipelines. The most severe nuclear system effects and the greatest release of radioactive material to the containment result from a complete circumferential break of one of the two recirculation loops. The minimum required functions of any reactor and plant protection system are discussed in Sections 6.2, 6.3, 7.3, 7.6, 8.3, and 15.9.

15.6.5.2.3 The Effect of Single Failures and Operator Errors Single failures and operator errors have been considered in the analysis of the entire spectrum of primary system breaks. The consequences of a LOCA with considerations for single failures are shown to be fully accommodated without the loss of any required safety function (Section 15.9).

15.6.5.3 Core and System Performance 15.6.5.3.1 Mathematical Model The analytical methods and associated assumptions used in evaluating the consequences of this accident are considered to provide a conservative assessment of the expected consequences of this very improbable event.

The details of these calculations, their justification, and bases for the models are developed in Sections 6.3, 7.3, 7.6, 8.3, and 15.9.

15.6.5.3.2 Input Parameters and Initial Conditions Input parameters and initial conditions used for the analysis of this event are given in Table 6.3-1.

15.6.5.3.3 Results Results of this accident are given in detail in Section 6.3. Even though some swelling may have occurred, the temperature and pressure transients resulting as a consequence of this accident are insufficient to cause perforation of the fuel cladding. Postaccident tracking instrumentation and control are assured. Continued long-term core cooling is demonstrated. Radiological input is minimized and within limits. Continued operator control and surveillance are examined and guaranteed.

15.6.5.3.4 Consideration of Uncertainties This event was conservatively analyzed (Sections 6.3, 7.3, 7.6, 8.3, and 15.9).

15.6.5.4 Barrier Performance The primary containment is designed to maintain pressure integrity in the event of an instantaneous rupture of the largest single primary system piping within the structure while also accommodating the dynamic effects of the pipe break. Therefore, any postulated LOCA would not CHAPTER 15 15.6-13 REV. 20, SEPTEMBER 2020

LGS UFSAR exceed the containment design limit. For details and results of the analyses, see Sections 3.8, 3.9, and 6.2.

15.6.5.5 Radiological Consequences for the LOCA Regulation 10CFR50.67, "Accident Source Term," provides a mechanism for power reactor licensees to voluntarily replace the traditional TID-14844 (Ref. 15.6-11) accident source term used in design-basis accident analyses with an "Alternative Source Term" (AST). The methodology of approach to this replacement is given in USNRC Regulatory Guide 1.183 (Ref.

15.6-12) and its associated Standard Review Plan 15.0.1 (Ref. 15.6-13).

The AST methodology has been applied to justify that a Design Basis Accident (DBA) can be accommodated without fully crediting the use of previously assumed safety systems. Amongst these systems are the Control Room Emergency Fresh Air Supply System (CREFAS) and the Standby Gas Treatment System (SGTS).

In support of a full-scope implementation of AST as described in and in accordance with the guidance of Ref. 15.6-12, AST radiological consequence analyses are performed for the four DBAs that result in offsite exposure (i.e., Loss of Coolant Accident (LOCA), Main Steam Line Break (MSLB), Fuel Handling Accident (FHA), and Control Rod Drop Accident (CRDA)).

Implementation consisted of the following steps:

Identification of the AST based on plant-specific analysis of core fission product inventory,

Calculation of the release fractions for the four DBAs that could potentially result in control room and offsite doses (i.e., LOCA, MSLB, FHA, and CRDA),

Analysis of the atmospheric dispersion for the radiological propagation pathways,

Calculation of fission product deposition rates and removal mechanisms,

Calculation of offsite and control room personnel Total Effective Dose Equivalent (TEDE) doses,

Evaluation of suppression pool pH to ensure that the particulate iodine deposited into the pool during a DBA LOCA does not re-evolve and become airborne as elemental iodine.

15.6.5.5.1 Regulatory Approach The analyses are prepared in accordance with the guidance provided by Regulatory Guide 1.183 (Ref. 15.6-12).

Dose Acceptance Criteria The AST acceptance criteria for Control Room dose for postulated major credible accident scenarios such as those resulting in substantial meltdown of the core with release of appreciable quantities of fission products is provided by 10 CFR 50.67, which requires:

CHAPTER 15 15.6-14 REV. 20, SEPTEMBER 2020

LGS UFSAR "Adequate radiation protection is provided to permit access to and occupancy of the control room under accident conditions without personnel receiving radiation exposures in excess of 0.05 Sv (5 rem) total effective dose equivalent (TEDE) for the duration of the accident.

This limit is applied by Regulatory Guide 1.183 to all of the accidents considered with AST.

The AST acceptance criteria for an individual located at any point on the boundary of the exclusion area (the Exclusion Area Boundary or EAB) are provided by 10 CFR 50.67 as 25 rem TEDE for any 2-hour period following the onset of the postulated fission product release.

The AST acceptance criteria for an individual located at any point on the outer boundary of the low population zone (LPZ) are provided by 10 CFR 50.67 as 25 rem TEDE during the entire period of passage of the radioactive cloud resulting from the postulated fission product release.

These limits are applied by Regulatory Guide 1.183 to events with a higher probability of occurrence (including CRDA, MSLB, and FHA considered herein) to provide the following acceptance criteria:

For the BWR MSLB for the case of an accident assuming fuel damage or a pre-incident Iodine spike, doses at the EAB and LPZ should not exceed 25 rem TEDE for the accident duration (2 hour2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months dose for EAB and 30 day dose for LPZ). For MSLB accidents assuming normal equilibrium Iodine activity, doses should not exceed 2.5 rem TEDE for the accident duration.

For the BWR CRDA, doses at the EAB and LPZ should not exceed 6.3 rem TEDE for the accident duration (2 hour2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months dose for EAB and 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months dose for LPZ).

For the FHA, doses at the EAB and LPZ should not exceed 6.3 rem TEDE for the accident duration (2 hour2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months dose for EAB and 30 day dose for LPZ).

15.6.5.5.3 Computer Codes New AST calculations for the LOCA were prepared to simulate the radionuclide release, transport, removal, and dose estimates associated with the postulated accident scenario.

The RADTRAD computer code (Ref. 15.6-15) endorsed by the NRC for AST analyses was used in the calculations for the LOCA. The RADTRAD program is a radiological consequence analysis code used to estimate post-accident doses at plant offsite locations and in the control room.

Offsite X/Qs were calculated using the guidance of Regulatory Guide 1.145 (Ref. 15.6-17);

control room X/Qs were calculated with the ARCON96 computer code (Ref. 15.6-18).

All of these computer codes and methodologies have been used by the NRC staff in their safety reviews.

15.6.5.5.4 Source Terms Core Inventory The inventory of reactor core fission products used in RADTRAD for the AST LOCA analysis is based on maximum full power operation at a power level of 3527 MWth, which includes a 2%

CHAPTER 15 15.6-15 REV. 20, SEPTEMBER 2020

LGS UFSAR instrument error per Reg. Guide 1.49 (Ref: 15.6-19) (See Section 15.0.4, Regulatory Guide 1.49). The fission products used for the accidents are the 60 isotopes of the standard RADTRAD input library, determined by the code developer as significant in dose consequences.

These were extracted from Attachment A of the LGS Design Analysis LM-0645 (Ref: 15.6-24),

and correspond to 24 month cycle burnup parameters, conservatively calculated using the ORIGEN 2.1 code.

Release Fraction Current design basis accident evaluations as modified by Regulatory Guide 1.183 (Ref:

15.6-12) were used to determine the specific releases of radioactive isotopes at the given stages of fuel pin failure and provide these releases as a percentage of the total release for the accident, as summarized below.

15.6.5.5.5 Methodology Dose Calculations As per Regulatory Guide 1.183 (Ref. 15.6-12), Total Effective Dose Equivalent (TEDE) doses are determined as the sum of the CEDE and the Effective Dose Equivalent (EDE) using dose conversion factors for inhalation CEDE from Federal Guidance Report No. 11 (Ref: 15.6-20) and for external exposure EDE from Federal Guidance Report No. 12 (Ref. 15.6-21). Breathing rates and occupancy factors are given in Table 15.6-13.

Loss of Coolant Accident (LOCA)

The LOCA radiological assessment was performed in accordance with the guidance of Regulatory Guide 1.183. The key inputs used in this analysis are included in Tables 15.6-14 through Table 15.6-17. These inputs and assumptions are grouped into three main categories (i.e., release, transport, and removal). The initial source term parameters are given in Table 15.6-14.

LOCA Release Inputs Key parameters used in the release pathway modeling for the LOCA analysis are given in Table 15.6-15. The primary containment is assumed to leak at 0.5 v%/day for the first 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months , then at a reduced rate of 0.25 v%/day for the remaining 30-day duration of the accident. Separately, the MSIVs are assumed to leak at a combined total of 200 scfh for the first 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months , then at a reduced rate of 110.20 scfh for the remaining accident duration, due to reductions in containment pressure. No primary containment leakage, with the exception of MSIV leakage, has been identified to bypass the secondary containment to be released unfiltered to the atmosphere.

The analysis assumes that the leak rate through the MSIVs to the environment is 200 scfh at a test pressure of 22 psig for the first 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months of the accident. This rate is then assumed to be reduced to 110.20 scfh after 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months and for the duration of the accident, due to containment pressure reductions. The maximum allowable per line is 100 scfh(*).

(*) For Unit 1 Cycle 19 only. The 1B outboard main steam isolation valve (28B) exceeded the 100 scfh leakage by 4.88 scfh. TS Amendment 245 approved a one-time allowable leakage limit of 105 scfh for a single MSIV (UFSAR Reference 15.6-27).

CHAPTER 15 15.6-16 REV. 20, SEPTEMBER 2020

LGS UFSAR The analysis assumes an emergency core cooling system (ECCS) liquid leakage rate outside of containment of 5 gpm (Table 15.6-15). Ten percent of the activity in the leakage is assumed to become airborne. This is consistent with Regulatory Guide 1.183. Although the ECCS leakage rate may realistically be assumed to begin approximately 15 minutes following the accident, with the actuation of the drywell sprays, the present analysis conservatively assumes leakage to begin at the onset of the accident and to continue throughout the 30-day duration of the postulated accident.

The Regulatory Guide 1.183 accident isotopic release specification allows deposition of iodine in the suppression pool. Essentially all of the iodine is assumed to remain in solution as long as the pool pH is maintained at or above a level of 7. Station procedures will direct operators, upon detection of symptoms indicating that core damage is occurring to manually initiate the SLC System. The calculation results demonstrate the buffering effect of the boron solution maintains the suppression pool pH above 7 for the 30-day duration of the postulated LOCA.

LOCA Transport Inputs Prior to the LOCA, the reactor enclosure is mechanically maintained at a negative pressure. At the beginning of the LOCA event, the reactor enclosure exhaust fans are tripped and the reactor enclosure (i.e., secondary containment) is then exhausted by the SGTS continuing the building's negative pressure thus precluding unfiltered exfiltration.

In the analysis, the control room is assumed to be automatically isolated upon a high radiation signal, and therefore in Radiation Mode prior to activity infiltration. Flow rates are given in Table 15.6-16.

LOCA Removal Inputs Key parameters identifying radionuclide removal processes are given in Table 15.6-17. The activity of elemental iodine and aerosols released from the core into the drywell is reduced by deposition (i.e., plate-out) and settling in the drywell utilizing the natural deposition values identified in the RADTRAD code. No credit is assumed for natural deposition of elemental or organic iodine, or for suppression pool scrubbing.

Containment leakage into the reactor building is colIected by the SGTS, which exhausts the reactor building, via filters, and reduces releases. The deposition removal mechanisms are characteristics of the AST methodology and represent a change in the plant design and licensing basis.

Main steam line pipe and main steam condenser particulate and chemical iodine deposition was modeled using the RADTRAD code with removal coefficients based on gravitational settling and chemical plateout. Two-node treatment is used for each steam line in which flow occurs. The first node is from the reactor vessel to the inboard MSIV. The second node is from the inboard MSIV to the outboard MSIV. No credit is taken for holdup or plate-out in the main steam lines beyond the outboard MSIV. However, additional credit is taken for plate-out in the main condenser. Main steam line deposition was based on using the shortest line (i.e., most rapid transport) for the worst case line (i.e., the one with the assumed failed inboard isolation valve).

CHAPTER 15 15.6-17 REV. 20, SEPTEMBER 2020

LGS UFSAR Removal efficiencies for the standby gas treatment system (SGTS), reactor enclosure recirculation system, and the control room emergency filtration system (CREFAS) filters are given in Table 15.6-17.

The analysis assumptions for the transport, reduction, and release of the radioactive material from the fuel and the reactor coolant are consistent with the guidance provided in Appendix C of Regulatory Guide 1.183, and are provided in the design analysis of Ref. 15.6-23.

15.6.5.5.6 Atmospheric Dispersion Factors (X/Qs)

The station release points and control room intake are shown in Figure 15.6-3. Table 15.6-19 lists X/Q values used for the control room dose assessments. For release points applicable to the LOCA, the zero velocity vent release X/Q values were calculated with the ARCON96 computer code, as derived in UFSAR Chapter 2.

Table 15.6-20 lists X/Q values for the EAB and LPZ boundaries. These X/Q values are calculated using Regulatory Guide 1.145 methodology, as derived in UFSAR Chapter 2.

15.6.5.5.7 Summary and Conclusions The radiological consequences of the postulated LOCA are given in Table 15.6-18. As indicated, the control room, EAB, and LPZ calculated doses are within regulatory limits after AST implementation.

15.6.6 FEEDWATER LINE BREAK OUTSIDE PRIMARY CONTAINMENT The postulated break of the feedwater line, representing the largest liquid line outside primary containment, provides the envelope evaluation relative to this type of occurrence. The break is assumed to be instantaneous, circumferential, and upstream of the outermost isolation valve.

A more limiting accident from a core performance evaluation standpoint (feedwater line break inside primary containment) has been quantitatively analyzed in Section 6.3. Therefore, the following discussion provides only new information not presented in Section 6.3. All other information is covered by cross- referencing.

15.6.6.1 Identification of Causes and Frequency Classification 15.6.6.1.1 Identification of Causes A feedwater line break is assumed without the cause being identified. The subject piping is designed to high quality engineering codes and standards, and seismic and environmental requirements.

15.6.6.1.2 Frequency Classification This accident is categorized as a limiting fault.

15.6.6.2 Sequence of Events and System Operation 15.6.6.2.1 Sequence of Events CHAPTER 15 15.6-18 REV. 20, SEPTEMBER 2020

LGS UFSAR The sequence of events is shown in Table 15.6-23.

Since automatic actuation and operation of the ECCS is a system design basis, no credit for immediate operator actions are assumed in the evaluation for this accident. However, in accordance with procedural requirements the operator should perform the following actions, which are shown below for informational purposes:

a. The operator should determine that a line break has occurred and evacuate the area of the turbine enclosure.

b. The operator is not required to take any action to prevent primary reactor system mass loss, but should ensure that the reactor is shut down and that RCIC and/or HPCI are operating normally.

c. The operator should implement appropriate radiation incident procedures.

d. If possible, the operator should shut down the feedwater system and de-energize any electrical equipment that may be damaged by water from the feedwater system in the turbine enclosure.

e. The operator should continue to monitor reactor water level and the performance of the ECCS while the radiation incident procedure is being implemented and should begin normal reactor cooldown measures.

f. When the reactor pressure has decreased below 75 psig, operator should initiate RHR in the shutdown cooling mode to continue cooling down the reactor.

The operator procedures above occur over an elapsed time of 3-4 hours.

15.6.6.2.2 System Operation It is assumed that the normally operating plant instrumentation and controls are functioning. Credit is taken for the actuation of the reactor isolation system and ECCS. The RPS (MSRVs, ECCS, and CRD) and plant protection system (RHR heat exchangers) are assumed to function properly to assure a safe shutdown.

The ESF and RCIC/HPCI systems are assumed to operate normally.

15.6.6.2.3 The Effect of Single Failures and Operator Errors The feedwater line break outside of primary containment is a high energy line break as described in paragraph 3.6.1.2.1.3. For purposes of plant transient analysis, it is considered as a special case of the general LOCA break spectrum considered in detail in Section 6.3. The general single failure analysis for LOCAs is discussed in detail in Section 6.3.3.3. For the feedwater line break outside primary containment, since the break can be isolated, either the RCIC or HPCI can provide adequate flow to the vessel to maintain core cooling and prevent fuel clad failure. A single failure of either the HPCI or the RCIC would still provide sufficient flow to keep the core covered with water. See Sections 6.3 and 15.9 for detailed description of the analysis.

15.6.6.3 Core and System Performance CHAPTER 15 15.6-19 REV. 20, SEPTEMBER 2020

LGS UFSAR 15.6.6.3.1 Qualitative Summary The accident evaluation qualitatively considered in this section is considered to be a conservative and envelope assessment of the consequences of the postulated failure (i.e., severance) of one of the feedwater piping lines outside primary containment. The accident is postulated to occur at the input parameters and initial conditions given in Table 6.3-1.

15.6.6.3.2 Qualitative Results The feedwater line break outside the containment is less limiting than either of the steam line breaks outside primary containment (analysis presented in Section 6.3 and/or in Section 15.6.4) or the feedwater line break inside primary containment (analysis presented in Sections 6.3.3 and 15.6.5). It is far less limiting than the DBA (the recirculation line break analysis presented in Sections 6.3.3 and 15.6.5).

The RCIC and the HPCI initiate on low-low (Level 2) water level and together restore the reactor water level to the normal elevation. MSIV isolation will occur upon receipt of a low-low-low (Level 1) water level signal, but it is unlikely that this level will be reached during this event. The fuel is covered throughout the accident and there are no pressure or temperature transients sufficient to cause fuel damage.

15.6.6.3.3 Consideration of Uncertainties This accident was conservatively analyzed, and uncertainties were adequately considered (Section 6.3).

15.6.6.4 Barrier Performance Accidents that result in the release of radioactive materials outside primary containment are the results of postulated breaches in the RCPB or the steam power conversion system boundary. A break spectrum analysis for the complete range of reactor conditions indicates that the limiting fault event for breaks outside primary containment is a complete severance of one of the main steam lines as described in Section 15.6.4. The feedwater system piping break is less severe than the main steam line break. Results of analysis of this accident can be found in Sections 6.2.3 or 6.2.4.

15.6.6.5 Radiological Consequences 15.6.6.5.1 Design Basis Analysis No design basis analysis is presented.

15.6.6.5.2 Realistic Analysis The realistic analysis is based on a conservative assessment of this accident. The specific models and assumptions, and the program used for computer evaluation, are described in Reference 15.6-3. Specific values of parameters used in the evaluation are presented in Table 15.6-24. A schematic diagram of the leakage path for this accident is shown in Figure 15.6-4.

15.6.6.5.2.1 Fission Product Release CHAPTER 15 15.6-20 REV. 20, SEPTEMBER 2020

LGS UFSAR There is no fuel damage as a consequence of this accident. In addition, an insignificant quantity of activity (compared to that existing in the main condenser hotwell prior to occurrence of the break) is released from the contained piping system prior to isolation closure.

The iodine concentration in the main condenser hotwell is consistent with an offgas release rate of 0.10 Ci/sec at 30 minutes delay and is 0.02 (2% carryover) times the concentration in the reactor coolant. Noble gas activity in the condensate is negligible, since the air ejector removes practically all noble gas from the condenser.

15.6.6.5.2.2 Fission Product Transport to the Environment Two breaks were postulated for release of liquid coolant: a break just outside primary containment, and a break on the 30 inch header manifolding the discharge of three condensate pumps.

If a break just outside primary containment is considered, reverse flow would release 650 gallons of feedwater before the check valve inside primary containment fully closes. During this time no reactor water would be discharged through the break. On the pump side, either the turbine drive protection equipment would sense overspeed, or the pump itself would see low suction pressure.

Very rapid trip would result in either case, minimizing spillage.

For the break on the 30 inch header, the condensate from the hotwell would be released along with the makeup from the CST. Backflow from upstream of the condensate filter/demineralizer would again close the check valves, but condensate in the feedwater heaters would be spilled. Since more coolant would be discharged by this break than by the break just outside primary containment, it was used for the analysis.

The fission transport pathway consists of liquid release from the break, carryover to the turbine enclosure atmosphere due to flashing and partitioning, and unfiltered release to the environment through the turbine enclosure ventilation system.

From the hotwell, 967,000 lb of condensate is released, of which 64,800 lb flashes to steam. Also released is 150,000 lb of condensate that was in the pipes from the break to the filter/demineralizers. Of this condensate, 10,100 lb flashes to steam. Low level in the condenser will send a signal for makeup to the CST; thus, 542,000 lb will be released, of which 36,300 lb will flash to steam. Upstream of the filter/demineralizers, 584,000 lb of condensate will backflow, with 146,000 lb flashing into steam. The condensate is assumed to be at a reactor steam concentrations. Of the activity remaining in the unflashed liquid, 10% is assumed to become airborne. Liquid that was upstream of the filter/demineralizers has passed through the condensate cleanup system, which have a 90% iodine removal efficiency. The CST is assumed to be 99% free of iodine.

Taking no credit for holdup, decay, or plateout during transport through the turbine enclosure, the release of activity to the environment is presented in Table 15.6-25. The release is assumed to take place within two hours of the occurrence of the break.

15.6.6.5.2.3 Results The calculated exposures for the realistic analysis are presented in Table 15.6-26 and are a small fraction of 10CFR100 limits.

CHAPTER 15 15.6-21 REV. 20, SEPTEMBER 2020

LGS UFSAR 15.6.7 LOSS OF FEEDWATER FLOW Refer to Section 15.2.7 15.

6.8 REFERENCES

15.6-1 F.J. Moody, "Maximum Two Phase Vessel Blowdown From Pipes," ASME Paper Number 65 WA/HT 1, (March 15, 1965).

15.6-2 F.J. Brutschy, C.R. Hills, and N.R. Horton, A.J. Levin, "Behavior of Iodine in Reactor Water During Plant Shutdown and Startup", NEDO-10585, (August 1972).

15.6-3 D. Nguyen, "Realistic Accident Analysis - The RELAC Code" NEDO-21142, (October 1977).

15.6-4 G.E. Start, et al., "Rancho Seco Building Wake Effects on Atmospheric Diffusion,"

NOAA Technical Memorandum ERL ARL-XX (in draft), Air Resources Laboratory, Idaho Falls, Idaho, (1977) (Available from Publication Services, Environmental Research Laboratories, National Oceanic and Atmospheric Administration, Boulder, Colorado 80302).

15.6-5 D.M. Rastler, "Suppression Pool Scrubbing Factors For Postulated Boiling Water Reactor Accident Conditions", NEDO-25420, GE, San Jose, CA, (June 1981).

15.6-6 W.E. Garrity, "Analytical Models for Aerosol Leakage Attenuation", ERDA-56, (1975).

15.6-7 G.J.E. Wilcutt, Jr., R.G. Guido, "Mixing of Radiolytic Hydrogen Generated Within A Containment Compartment Following a LOCA", NUREG/CR-0304, Los Alamos Scientific Laboratory, Los Alamos, NM, (August 1978).

15.6-8 G.J.E. Wilcutt, Jr., R.G. Guido, A. Koestel, "Hydrogen Mixing in a Closed Containment Compartment Based on a One-Dimensional Model with Convective Effects", NUREG/CR-1575, Los Alamos Scientific Laboratory, Los Alamos, NM, (September 1980).

15.6-9 A.K. Postma, R.R. Sherry, P.S. Tam, "Technological Bases for Models of Spray Washout of Airborne Contaminants in Containment Vessels", NUREG/CR-0009, NRC, (October 1978).

15.6-10 GE Nuclear Energy, "Limerick Generating Station, Units 1 and 2, SAFER/GESTR-LOCA Loss-of-Coolant Accident Analysis," NEDC-32170P, Revision 2, May 1995.

15.6-11 U. S. Atomic Energy Commission, Technical Information Document (TID) 14844, "Calculation of Distance Factors for Power and Test Reactor Sites," March 23,1962.

15.6-12 U. S. Nuclear Regulatory Commission Regulatory Guide 1.183, "Alternative Radiological Source Terms for Evaluating Design Basis Accidents at Nuclear Power Reactors," July 2000.

CHAPTER 15 15.6-22 REV. 20, SEPTEMBER 2020

LGS UFSAR 15.6-13 U. S. Nuclear Regulatory Commission Standard Review Plan 15.0.1, "Radiological Consequence Analyses Using Alternative Source Terms," Revision 0, July 2000.

15.6-14 LGS Design Analysis LM-0644, Rev. 2, "Re-analysis of Main Steam Line Break Accident (MSLB) Using Alternative Source Terms."

15.6-15 RADTRAD Code, "A Simplified Model for Radionuclide Transport and Removal and Dose Estimation," Version 3.03.

15.6-16 PAVAN Code, "An Atmospheric Dispersion Program for Evaluating Design Bases Accidental Releases of Radioactive Materials from Nuclear Power Stations."

15.6-17 U. S. Nuclear Regulatory Commission Regulatory Guide 1.145, "Atmospheric Dispersion Models for Potential Accident Consequence Assessments at Nuclear Power Plants," Revision 1, November 1982.

15.6-18 ARCON96 Code, "Atmospheric Relative Concentrations in Building Wakes."

15.6-19 U. S. Nuclear Regulatory Commission Regulatory Guide 1.49, "Power Levels of Nuclear Power Plants," Revision 1, December 1973.

15.6-20 Federal Guidance Report No. 11, "Limiting Values of Radionuclide Intake and Air Concentration and Dose Conversion Factors for Inhalation, Submersion, and Ingestion," 1988.

15.6-21 Federal Guidance Report No. 12, "External Exposure to Radionuclides in Air, Water, and Soil," 1993.

15.6-22 Regulatory (Safety) Guide 1.5, "Assumptions Used for Evaluating the Potential Radiological Consequences of a Steam Line Break Accident for Boiling Water Reactors," 3/10/71.

15.6-23 LGS Design Analysis LM-0646, Rev. 4, "Re-analysis of Loss of Coolant Accident (LOCA) Using Alternative Source Terms."

15.6-24 LGS Design Analysis LM-0645, Rev. 4, "Re-analysis of Fuel Handling Accident (FHA) Using Alternative Source Terms."

15.6-25 GE-Hitachi Nuclear Energy, 0000-0077-4603-R1, "BWR Owners Group Evaluation of Steam Flow Induced Error (SFIE) Impact on the L3 Setpoint Analytic Limit," October 2008.

15.6-26 GEH 0000-0158-9651-NP, Revision 0, October 2013, LGS Main Steam Isolation Valve Response Time Testing Analysis (SDOC G-080-VC-00489).

15.6-27 Limerick, Unit 1, TS Amendment No. 245, Change to Allow a One-Time Increase in MSIV Leakage Rate.

CHAPTER 15 15.6-23 REV. 20, SEPTEMBER 2020

LGS UFSAR Table 15.6-1 SEQUENCE OF EVENTS FOR INSTRUMENT LINE BREAK TIME EVENT 0 Instrument line fails 0-10 min Identification of break 10 min Activate SBGTS and initiate orderly shutdown 5 hours5.787037e-5 days 0.00139 hours 8.267196e-6 weeks 1.9025e-6 months Reactor vessel depressurized and break flow terminated CHAPTER 15 15.6-24 REV. 13, SEPTEMBER 2006

LGS UFSAR Table 15.6-2 INSTRUMENT LINE BREAK ACCIDENT: PARAMETERS TABULATED FOR POSTULATED ACCIDENT ANALYSES DESIGN REALISTIC BASIS BASIS ASSUMPTIONS ASSUMPTIONS I. Data and Assumptions used to Estimate Radioactive Source from Postulated Accidents A. Power Level 102% 102%

B. Burnup NA NA C. Fission Product Release NA None from Fuel (fuel damaged)

D. Release of Activity by Table 15.6-4 Table 15.6-6 Nuclide to the environment E. Iodine Fractions

1. Organic NA 0

2. Elemental NA 1

3. Particulate NA 0 F. Reactor Coolant Activity Section Section Before the Accident 15.6.4.5.1 15.6.4.5.2 II. Data and Assumptions Used to Estimate Activity Released A. Primary Containment Leak NA NA Rate (%/day)

B. Secondary Containment Release 100 100 Rate (%/day)

C. Valve Movement Times NA NA D. Adsorption and Filtration Efficiencies (SGTS)

1. Organic iodine 99 99

2. Elemental iodine 99 99

3. Particulate iodine 99 99

4. Particulate fission 99 99 products E. Recirculation System Parameters

1. Flow rate (cfm) 60,000 60,000

2. Mixing efficiency 50 50

3. Filter efficiency 95 95 F. Containment Spray Parameters NA NA (flow rate, drop size, etc.)

CHAPTER 15 15.6-25 REV. 13, SEPTEMBER 2006

LGS UFSAR Table 15.6-2 (Cont'd)

DESIGN REALISTIC BASIS BASIS ASSUMPTIONS ASSUMPTIONS G. Secondary Containment Volume (ft3)

Reactor enclosure, Unit 1 1.8x106 1.8x106 H. All Other Pertinent Data NA NA and Assumptions III. Dispersion Data A. EAB/LPZ Distance (m) 731/2043 731/2043 B. X/Qs for Time Intervals of

1. 0-2 hrs - EAB 2.9x10-4 1.2x10-4

2. 0-8 hrs - LPZ 4.0x10-5 2.0x10-5

3. 8-24 hrs - LPZ 2.9x10-5 1.6x10-5

4. 1-4 days - LPZ 1.4x10-5 9.0x10-6

5. 4-30 days - LPZ 5.4x10-6 4.2x10-6 IV. Dose Data A. Method of Dose Calculation Section Reference 15.10 15.6-3 B. Dose Conversion Assumptions Section Reference 15.10 15.6-3 C. Peak Activity in Table 15.6-3 Table 15.6-5 reactor enclosure D. Doses Table 15.6-7 Table 15.6-7 CHAPTER 15 15.6-26 REV. 13, SEPTEMBER 2006

LGS UFSAR Table 15.6-7 INSTRUMENT LINE FAILURE: RADIOLOGICAL EFFECTS DESIGN BASIS ANALYSIS WHOLE BODY THYROID DOSE (rem) DOSE (rem)

Exclusion Area Boundary (731 meters - 2 hr dose) 5.89x10-7 2.33x10-5 Low Population Zone (2043 meters - 30 day dose) 3.37x10-7 1.76x10-5 REALISTIC ANALYSIS WHOLE BODY THYROID DOSE (rem) DOSE (rem)

Exclusion Area Boundary 6.96x10-8 2.75x10-6 (731 meters - 2 hr dose)

Low Population Zone 4.81x10-8 2.51x10-6 (2043 meters - 30 day dose)

CHAPTER 15 15.6-31 REV. 13, SEPTEMBER 2006

LGS UFSAR Table 15.6-8 SEQUENCE OF EVENTS FOR STEAM LINE BREAK OUTSIDE PRIMARY CONTAINMENT TIME (sec) EVENT 0 Guillotine break of one main steam line outside primary containment.

1.0 (approx) High steam line flow signal initiates closure of MSIV.

< 1.5 Reactor begins scram.

6.0 MSIVs fully closed.

60.0 (approx) RCIC and HPCI initiate on low water level (Level 2) (RCIC considered unavailable, HPCI assumed single failure and therefore may not be available).

60.0 (approx) SRVs open on high vessel pressure. The valves open and close to maintain vessel pressure at approximately 1170 psi.

1780 (approx) Low water level (Level 1) reached. Low pressure ECCS receives signal to start. ADS logic is initiated.

1900 (approx) High drywell pressure bypass timer and ADS timer "timed out". ADS starts. Vessel depressurizes.

2100 (approx) Low pressure ECCS begin injection. Core partially uncovers.

2160 (approx) Core effectively reflooded and clad temperature heatup terminated. No fuel rod failure.

CHAPTER 15 15.6-32 REV. 18, SEPTEMBER 2016

LGS UFSAR Table 15.6-12 Table 15.6-12 Deleted CHAPTER 15 15.6-36 REV. 20, SEPTEMBER 2020

LGS UFSAR Table 15.6-21 Table 15.6-21 Deleted CHAPTER 15 15.6-46 REV. 14, SEPTEMBER 2008

LGS UFSAR Table 15.6-22 Table 15.6-22 Deleted CHAPTER 15 15.6-47 REV. 14, SEPTEMBER 2008

LGS UFSAR Table 15.6-23 SEQUENCE OF EVENTS FOR FEEDWATER LINE BREAK OUTSIDE PRIMARY CONTAINMENT TIME (min) EVENT 0 One feedwater line breaks.

0+ Feedwater line check valves isolate the reactor from the break.

<0.5 At low water level (Level 3), reactor scram would initiate. At low-low water (Level 2), HPCI would initiate, RCIC would initiate, and recirculation pumps would trip. If low-low-low water level (Level 1) is reached, MSIV closure begins, and CS and LPCI receive initiation signals but will not inject due to high reactor pressure.(1) 2 (approx) The MSRVs would open and close and maintain the reactor vessel pressure at approximately 1170 psig.

60 - 120 Normal reactor cooldown procedure established.

Note:

(1)

Because of an additional steam flow induced process measurement error in the Level 3 scram, the timing values following Low water level scram based on the L3 Analytical Limit are slightly different. However, as described in Reference 15.6-25, the impact of the change is not significant.

CHAPTER 15 15.6-48 REV. 17, SEPTEMBER 2014

LGS UFSAR Table 15.6-24 FEEDWATER LINE BREAK ACCIDENT: PARAMETERS TABULATED FOR POSTULATED ACCIDENT ANALYSES DESIGN REALISTIC BASIS BASIS ASSUMPTIONS ASSUMPTIONS I. Data and Assumptions Used to Estimate Radioactive Source from Postulated Accidents A. Power Level NA NA B. Burnup NA NA C. Fission Products Released NA None from Fuel (fuel damaged)

D. Release of Activity by NA Table 15.6-25 Nuclide E. Iodine Fractions

1. Organic NA 0

2. Elemental NA 1.0

3. Particulate NA 0 F. Reactor Coolant Activity NA Section Before the Accident 15.6.6.5.2 II. Data and Assumptions Used to Estimate Activity Released A. Primary containment Leak NA NA Rate (%/day)

B. Secondary Containment Release NA NA Rate (%/day)

C. Isolation Valve Closures NA NA Time (sec)

D. Adsorption and Filtration Efficiencies

1. Organic iodine NA NA

2. Elemental iodine NA NA

3. Particulate iodine NA NA

4. Particulate fission NA NA products E. Recirculation System NA NA Parameters

1. Flow rate NA NA

2. Mixing efficiency NA NA

3. Filter efficiency NA NA F. Containment Spray Parameters NA NA (flow rate, drop size, etc.)

G. Containment Volumes NA NA CHAPTER 15 15.6-49 REV. 13, SEPTEMBER 2006

LGS UFSAR Table 15.6-24 (Cont'd)

DESIGN REALISTIC BASIS BASIS ASSUMPTIONS ASSUMPTIONS H. All Other Pertinent Data NA None and Assumptions III. Dispersion Data A. EAB/LPZ Distance (m) NA 731/2043 B. X/Qs for Total Dose - 1.2x10-4 EAB/LPZ (8 hr) NA 2.0x10-5 IV. Dose Data A. Method of Dose Calculation NA Reference 15.6-3 B. Dose Conversion Assumptions NA Reference 15.6-3 C. Peak Activity Concentrations NA NA in Containment D. Doses NA Table 15.6-26 CHAPTER 15 15.6-50 REV. 13, SEPTEMBER 2006

LGS UFSAR Table 15.6-26 FEEDWATER LINE BREAK: RADIOLOGICAL EFFECTS REALISTIC ANALYSIS WHOLE BODY THYROID DOSE (rem) DOSE (rem)

Exclusion Area Boundary (731 meters - 2 hr dose) 3.06x10-3 3.14x10-1 Low Population Zone (2043 meters - 2 hr(1) dose) 5.10x10-4 5.23x10-2 (1)

Duration of accident is 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months CHAPTER 15 15.6-52 REV. 13, SEPTEMBER 2006

LGS UFSAR Table 15.6-27 LOSS OF COOLANT ACCIDENT: SEQUENCE OF EVENTS FOR RADIOLOGICAL CONSEQUENCE ANALYSIS Time Events and Assumptions 0 DBA LOCA is initiated.

- Instantaneous Regulatory Guide 1.183 source term assumed.

- Activity release from Reactor Enclosure taken at design basis SGTS flow of 3000 cfm per Reactor enclosure, to simulate exfiltration.

18 sec SGTS is initiated.

- No credit is taken for filtration during drawdown period.

- Exfiltration of 3000 cfm per Reactor Enclosure continues to be assumed.

3 min RERS is initiated.

- No credit is taken for filtration during drawdown period.

15.5 Reactor enclosure reaches -1/4 inch wg.

min. [Drawdown Period Ends(1).]

- Unfiltered exfiltration ceases.

- Reactor Enclosure exhausts at 2500 cfm [TS inleakage limit] throughout SGTS with 99% iodine removal eff.

- RERS filtration of recirculation flow with iodine removal eff. of 95% for organic /

elemental and 99% for particulate.

(1)

Drawdown period determined based on a more conservative 2800 cfm SGTS flow, to allow for flow balancing margin.

CHAPTER 15 15.6-53 REV. 14, SEPTEMBER 2008

LGS UFSAR 15.7 RADIOACTIVE RELEASES FROM SUBSYSTEMS AND COMPONENTS 15.7.1 RADIOACTIVE GAS WASTE SYSTEM LEAK OR FAILURE The following radioactive gas waste system components are examined under severe failure mode conditions for effects on plant safety:

a. Main condenser offgas treatment system failure

b. Malfunction of main turbine gland sealing system

c. Failure of SJAE lines.

15.7.1.1 Main Condenser Offgas Treatment System Failure 15.7.1.1.1 Identification of Causes and Frequency Classification 15.7.1.1.1.1 Identification of Causes Those events which could cause a failure in the offgas treatment system are:

a. A seismic occurrence greater than the equipment can withstand.

b. A fire in the filter assemblies.

c. Failure of spacially related equipment.

The equipment and piping are designed to resist any hydrogen/oxygen detonation that has a reasonable probability of occurring. Consequently, a detonation is not considered as a possible failure mode.

The decay heat on the filters is handled inherently by the system and by the available air flows.

The system is reasonably isolated from other systems or components that could cause any serious interaction or failure. The only credible event that could result in the release of significant activity to the environment is an earthquake.

Even though the offgas system is designed to the requirements of Regulatory Guide 1.143 as discussed in Section 11.3, an event resulting in the failure of the offgas system is assumed to occur.

The design basis, description, and performance evaluation of the subject system is given in Section 11.3.

15.7.1.1.1.2 Frequency Classification This accident is categorized as a limiting fault.

15.7.1.1.2 Sequence of Events and System Operation 15.7.1.1.2.1 Sequence of Events CHAPTER 15 15.7-1 REV. 19, SEPTEMBER 2018

LGS UFSAR The sequence of events following this failure is shown in Table 15.7-1.

15.7.1.1.2.2 Identification of Operator Actions Gross failure of this system may require manual isolation of this system from the main condenser.

This isolation results in high condenser pressure and a reactor scram. The operator should monitor the turbine-generator auxiliaries and break vacuum as soon as possible. The operator should notify personnel to evacuate the area immediately and notify radiation protection personnel to survey the area and determine requirements for re-entry. The time to perform these actions is estimated to be about two minutes.

15.7.1.1.2.3 System Operation In analyzing the postulated offgas system failure, credit is taken for functioning of normally operating plant instrumentation and controls and other systems only in assuming the following:

a. Capability to detect the failure itself, indicated by an alarmed increase in radioactivity levels seen by the area radiation monitoring system, in a loss of flow in the offgas system, and in an alarmed increase in activity at the ventilation release.

b. Capability to isolate the system and shut down the reactor.

c. Operational indicators and annunciators in the control room.

15.7.1.1.2.4 The Effect of Single Failures and Operator Errors After the initial system gross failure, the inability of the operator to actuate a system isolation could affect the analysis. However, a seismic event greater than design basis will cause the tripping of the turbine, or will lead to a load rejection. This will result in a scram and negate a need for the operator to initiate a reactor shutdown via system isolation.

See Section 15.9 for a further detailed discussion of this subject.

15.7.1.1.3 Core and System Performance The postulated failure results in a system isolation necessitating reactor shutdown because of loss of vacuum in the main condenser. This transient is analyzed in Section 15.2.5.

15.7.1.1.4 Barrier Performance The postulated failure is the rupture of the offgas treatment system pressure boundary. No credit is taken for performance of secondary barriers, except to the extent inherent in the assumed equipment release fractions discussed in Section 15.7.1.1.5, below.

15.7.1.1.5 Radiological Consequences 15.7.1.1.5.1 General Two separate radiological analyses are provided for this accident:

CHAPTER 15 15.7-2 REV. 19, SEPTEMBER 2018

LGS UFSAR

a. The first is based upon conservative assumptions considered to be acceptable to the NRC for the purpose of determining adequacy of the plant design to meet 10CFR100. This analysis is referred to as the "design basis analysis."

b. The second is based upon assumptions considered to provide a realistic conservative estimate of radiological consequences. This analysis is referred to as the "realistic analysis."

15.7.1.1.5.2 Design Basis Analysis Regulatory Guide 1.98 contains specific quantitative regulatory guidelines upon which a design basis analysis can be performed. The primary differences between this analysis and the realistic analysis are in the basic source terms and atmospheric dilution factors. The same analytical techniques used for the realistic analysis are used for this evaluation. Specific parametric values used in this evaluation are presented in Table 15.7-2.

15.7.1.1.5.2.1 Fission Product Release 15.7.1.1.5.2.1.1 Initial Conditions The activity in the offgas system was based upon the following conditions:

a. 6 scfm air inleakage.

b. 0.35 Ci/sec noble gas after 30 minutes delay for a period of one month, preceding the accident and 0.1 Ci/sec (at 30 minutes delay) for a time earlier than 30 days.

c. The total mass of charcoal in the system is 321,790 lbs. The adsorption coefficients for Xe and Kr are 1000 cc/g and 65 cc/g, respectively.

d. The uncontrolled releases from the SJAE occur for a period of 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months following the accident. The delay time between the SJAE and the break is five minutes.

15.7.1.1.5.2.1.2 Assumptions Depending upon assumptions as to radionuclide release fractions, various equipment pieces may be controlling with respect to dose consequences. The assumed release fractions are shown in Table 15.7-3. All other release sources are negligible. Iodine and activation gases are neglected per Regulatory Guide 1.98.

15.7.1.1.5.2.2 Fission Product Transport to the Environment The transport pathway consists of direct release from the failed component to the environment through the radwaste enclosure ventilation system. The activity released to the environment is presented in Tables 15.7-4 and 15.7-8.

15.7.1.1.5.2.3 Results The dose contributions due to releases from the charcoal tanks and SJAE are presented in Tables 15.7-6 and 15.7-9(a) respectively. The total offsite doses due to failure of the system are summarized in Table 15.7-9(b).

CHAPTER 15 15.7-3 REV. 19, SEPTEMBER 2018

LGS UFSAR 15.7.1.1.5.3 Realistic Analysis The realistic analysis is based upon an engineered but still conservative assessment of this accident. Specific values of parameters used in the evaluation are presented in Table 15.7-2.

15.7.1.1.5.3.1 Fission Product Release 15.7.1.1.5.3.1.1 Initial Conditions The activity in the offgas system is based upon the following conditions:

a. 20 scfm air inleakage.

b. 0.06 Ci/sec noble gas after 30 minutes delay.

c. The total mass of charcoal in the system is 321,790 lbs. The adsorption coefficients for Xe and Kr are 733 cc/g and 31.8 cc/g, respectively.

d. The uncontrolled releases from the SJAE occur for a period of 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months following the accident. The delay time between the SJAE and the break is five minutes.

15.7.1.1.5.3.2 Fission Product Transport to the Environment The activity released to the environment is presented in Table 15.7-5 and 15.7-8.

15.7.1.1.5.3.3 Results The dose contributions due to releases from the charcoal tanks and SJAE are presented in Tables 15.7-6 and 15.7-9(a) respectively. The total offsite doses due to failure of the system are summarized in Table 15.7-9(b).

15.7.1.2 Malfunction of Main Turbine Gland Sealing System 15.7.1.2.1 Identification of Causes and Frequency Classification 15.7.1.2.1.1 Identification of Causes Those events that could cause a malfunction failure in the main turbine gland sealing system are:

a. Failure of the gland steam evaporator and its backup supply.

b. Failure of the gland steam condenser exhausters.

c. Excessive pressure in the steam seal header.

15.7.1.2.1.2 Frequency Classification This accident is categorized as a limiting fault.

15.7.1.2.2 Sequence of Events and System Operation CHAPTER 15 15.7-4 REV. 19, SEPTEMBER 2018

LGS UFSAR It is assumed that the system fails near the condenser. This results in activity normally processed by the offgas treatment system being discharged directly to the turbine enclosure and subsequently through the ventilation system to the environment.

The operator initiates a normal shutdown of the reactor to reduce the gaseous activity being discharged. A loss of main condenser vacuum will result in a turbine trip and reactor shutdown.

Failure of the gland steam evaporator and its backup steam supply would result in the discharge of a small amount of contaminated steam from the high pressure and low pressure shaft seals to the gland steam condenser exhauster.

Failure of both of the gland steam condenser exhausters results in the escape of clean steam from the high pressure and low pressure shaft seals.

Excessive pressure in the steam seal header as a result of a malfunction of the gland steam evaporator or the backup steam supply valve is prevented by a relief valve, so that there is no detrimental effect on the operation of the seals.

15.7.1.2.3 Core and System Performance The failure of this power conversion system does not directly affect the NSSS. It will, of course, lead to the decoupling of the NSSS from the power conversion system.

This failure has no applicable effect on the core or the NSSS safety performance.

15.7.1.2.4 Barrier Analysis This release occurs outside primary containment; therefore, the primary containment barrier integrity is not involved.

15.7.1.2.5 Radiological Consequences Each of the assumed malfunctions results in negligible releases of activity. Therefore, the doses that result from these failures are inconsequential.

15.7.1.3 Failure of Steam Jet Air Ejector Lines 15.7.1.3.1 Identification of Causes and Frequency Classification 15.7.1.3.1.1 Identification of Causes An evaluation of events that could cause a failure of the SJAE line indicates that a seismic event or hydrogen detonation more serious than the system is able to withstand are the only events that could rupture the lines.

15.7.1.3.1.2 Frequency Classification This accident is categorized as a limiting fault.

15.7.1.3.2 Sequence of Events and System Operation CHAPTER 15 15.7-5 REV. 19, SEPTEMBER 2018

LGS UFSAR It is assumed that the line leading from the SJAE to the offgas treatment system fails. This results in activity normally processed by the offgas treatment system being discharged directly to the turbine enclosure and subsequently through the ventilation system to the environment.

The operator will initiate a normal shutdown of the reactor to reduce the gaseous activity being discharged. The operator will isolate the main condenser, which results in high condenser pressure and a reactor scram. The operator will notify personnel to evacuate the area immediately and notify radiation protection personnel to survey the area and determine requirements for re-entry.

15.7.1.3.3 Core and System Performance The failure of this power conversion system does not directly affect the NSSS. It will, of course, lead to the decoupling of the NSSS with power conversion system.

This failure has no applicable effect on the core or the NSSS safety performance.

15.7.1.3.4 Barrier Analysis This release occurs outside primary containment; therefore, the primary containment barrier integrity is not involved.

15.7.1.3.5 Radiological Consequences The offgas release rates at the SJAE are assumed for the design basis and the realistic case to be 0.35 Ci/Sec and 0.06 Ci/Sec at 30 minutes decay, respectively. The delay between the SJAE and the break is assumed to be five minutes. It is conservatively assumed that activities are released directly to the environment and that the uncontrolled release period is one hour before the plant operator initiates a plant shutdown. Iodines are neglected per Regulatory Guide 1.98. Specific parametric values in this evaluation are presented in Table 15.7-7.

The activity released to the environment and the calculated exposures are presented in Tables 15.7-8 and 15.7-9, respectively.

15.7.2 LIQUID RADIOACTIVE WASTE SYSTEM FAILURE 15.7.2.1 Identification of Causes and Frequency Classification 15.7.2.1.1 Identification of Causes It was assumed that an unspecified event causes the complete release of the average radioactivity inventory in the tank containing the largest quantities of significant radionuclides in the liquid radwaste system. This is the RWCU phase separator in the radwaste enclosure. The airborne radioactivity released during this accident passes directly to the environment via the ventilation stack.

Postulated events that could cause release of the radioactive inventory of the RWCU phase separator are cracks in the vessel and operator error. The possibility of small cracks and consequent low-level release rates receives primary consideration in system and component design. The RWCU phase separator is designed to operate at atmospheric pressure and 212F, so the possibility of failure is considered small. A liquid radwaste release caused by operator error CHAPTER 15 15.7-6 REV. 19, SEPTEMBER 2018

LGS UFSAR is also considered a remote possibility. Operating techniques and administrative procedures emphasize detailed system and equipment operating instruction. Should a release of liquid radioactive wastes occur, floor drain sump pumps in the floor of the radwaste enclosure will receive a high-water level signal, activate automatically, and remove the spilled liquid.

15.7.2.1.2 Frequency Classification Much of the discussion concerning the remote likelihood of a leakage or malfunction accident of a RWCU phase separator applies equally to a complete release accident. The probability of a complete rupture or complete malfunction accident is, however, considered even lower.

Although not analyzed for the requirements of seismic Category I equipment, the liquid radwaste tanks are constructed in accordance with sound engineering principles. Therefore, simultaneous failure of all the tanks is not considered credible.

This accident is expected to occur with the frequency of a limiting fault.

15.7.2.2 Sequence of Events and System Operation The sequence of events following this accident is shown in Table 15.7-10.

The rupture of a RWCU phase separator would leave little recourse to the operator. No method of recontaining the gaseous phase discharge is available.

15.7.2.3 Core and System Performance Failure of a RWCU phase separator does not directly affect the NSSS. It will, of course, lead to the decoupling of the NSSS from the liquid radioactive waste system.

This failure is not expected to have any applicable effect on the core or NSSS safety performance.

15.7.2.4 Barrier Performance This release occurs outside primary containment; therefore, barrier integrity is not involved.

15.7.2.5 Radiological Consequences 15.7.2.5.1 Design Basis Analysis It is assumed that a RWCU phase separator contains the inventory of radioactive material as presented in Section 12.2. A RWCU phase separator, which contains the greatest amount of iodine inventory that could be released, is assumed to fail releasing the entire contents of this tank (equal to 80% of the tank capacity) to the radwaste enclosure. An iodine partitioning factor of 100 is assumed for the spilled liquid. The airborne iodine activity is exhausted through the radwaste ventilation system over a two-hour period. Specific parametric values used in this evaluation are presented in Table 15.7-11.

Table 15.7-12 lists the iodine activity released to the environment.

The offsite radiological doses for a RWCU phase separator rupture accident are given in Table 15.7-14.

CHAPTER 15 15.7-7 REV. 19, SEPTEMBER 2018

LGS UFSAR 15.7.2.5.2 Realistic Analysis It is assumed that the inventory in a RWCU phase separator corresponds to 0.05 Ci/sec offgas release under normal operation. Other assumptions are the same as that of the design basis analysis. Activities released to the environment and offsite doses are presented in Tables 15.7-13 and 15.7-14, respectively.

15.7.3 POSTULATED RADIOACTIVE RELEASES DUE TO LIQUID RADWASTE TANK FAILURE Refer to Section 2.4.12 for a discussion of tank failures.

15.7.4 FUEL HANDLING ACCIDENT The material presented in Section 15.7.4 is historical and based on an 8x8 fuel design. However, the material presented in Section 15.7.4.5 is updated for Alternative Source Terms and represents the current licensing basis for the FHA. The analytical methodology and licensing bases for the Fuel Handling Accident are provided in GESTAR II (Reference 4.1-1). Compliance with these bases is verified in Amendment 22 of GESTAR II for each new fuel design. The analysis in this Section generally follows the methodology described in GESTAR II, however, it applies additional conservative assumptions. The GE RCWP jib cranes are permitted to extend into the boundary zone during fuel handling based on a determination in a GE analysis that a collision between a loaded fuel grapple and the GE RCWP would not result in dropping the fuel bundle or mast fuel grapple assembly onto the core; and therefore the original FHA remains bounding.

15.7.4.1 Identification of Causes and Frequency Classification 15.7.4.1.1 Identification of Causes The fuel handling accident is assumed to occur as a consequence of a failure of the fuel assembly lifting mechanism resulting in the dropping of a raised fuel assembly onto other fuel bundles. A variety of events that qualify for the class of accidents termed "fuel handling accidents" has been investigated. The accident that produces the largest number of failed spent fuel rods is the drop of a spent fuel bundle and the fuel grapple assembly of the refueling platform into the reactor core when the reactor vessel head is off. The fuel grapple assembly consists of a telescopic mast and head assembly.

15.7.4.1.2 Frequency Classification This accident is categorized as a limiting fault.

15.7.4.2 Sequence of Events and System Operation 15.7.4.2.1 Sequence of Events The sequence of events following this failure is shown in Table 15.7-15.

15.7.4.2.2 Identification of Operator Actions The operator actions are as follows:

CHAPTER 15 15.7-8 REV. 19, SEPTEMBER 2018

LGS UFSAR

a. Initiate the evacuation of the refueling area.

b. Notify Health Physics

c. The supervisor in charge of fuel handling will alert the control room operator to the accident.

d. Determine if the normal ventilation system has isolated and the SGTS is in operation.

e. Initiate action to determine the extent of potential radiation doses by measuring the radiation levels in the vicinity of or close to the refueling area.

f. Appropriate radiological control methods should be implemented at the entrance of the refueling area.

g. Before entering the refueling area, a careful study of conditions, radiation levels, etc., will be performed.

15.7.4.2.3 System Operation Normally, operating plant instrumentation and controls are assumed to function, although credit is taken only for the isolation of the normal ventilation system and the operation of the SGTS.

Operation of other plant or RPS or ESF systems is not expected.

15.7.4.2.4 The Effect of Single Failures and Operator Errors The automatic ventilation isolation system includes the radiation monitoring detectors and isolation valves. The SGTS is designed to the single failure criterion and safety requirements. Refer to Sections 7.6, 9.4 and 15.10 for further details.

15.7.4.3 Core and System Performance 15.7.4.3.1 Mathematical Model The analytical methods and associated assumptions used to evaluate the consequences of this accident are considered to provide a realistic yet conservative assessment of the consequences.

Calculations were performed to evaluate the consequences of a variety of drop scenarios. The worst-case scenario that produced the greatest number of failed fuel rods is represented by the fuel bundle and grapple assembly falling as two separate and independent units from their respective fully raised heights.

The consequences of a drop scenario consisting of a fuel bundle and grapple assembly falling as a single unit are bounded by the above worst-case scenario, mainly because twice as many fuel rods are struck (and consequently fail due to bending) by the drop of two independent units.

The calculated results of the worst case scenario are conservative because both of the following unlikely events would have to occur:

CHAPTER 15 15.7-9 REV. 19, SEPTEMBER 2018

LGS UFSAR

a. The fuel bundle becomes detached from the grapple by either a break of the bail handle or grapple.

b. The grapple assembly becomes detached from the refueling platform by either a break of the cables or a break of the cable support eye bracket.

To estimate the expected number of failed fuel rods in each impact, an energy approach is used.

The fuel assembly and grapple assembly are expected to impact on the reactor core at a small angle from the vertical, possibly inducing a bending mode of failure on the fuel rods of the dropped assembly. It is assumed that each fuel rod resists the imposed bending load by a couple consisting of two equal, opposite concentrated forces. Therefore, fuel rods are expected to absorb little energy prior to failure as a result of bending. Actual bending tests with concentrated point loads show that each fuel rod absorbs approximately 1 ft-lb prior to cladding failure. Each rod that fails as a result of gross compression distortion is expected to absorb approximately 250 ft-lb before cladding failure (based upon 1% uniform plastic deformation of the rods). The energy of the dropped assemblies is conservatively assumed to be absorbed by only the cladding and other core structures. Because a typical 8x8 fuel assembly consists of 72% fuel, 11% cladding, and 17% other structural material by weight, the assumption that no energy is absorbed by the fuel material results in considerable conservatism in the mass-energy calculations that follow.

It should be noted that the energy required to cause cladding failure due to compression and weight percentages of fuel, cladding, and other structural material are fuel type specific. The values given here are historical as discussed in Section 15.7.4.

The energy absorption on successive impacts is estimated by considering a plastic impact.

Conservation of momentum under a plastic impact shows that the fractional kinetic energy absorbed during impact is:

1 - M1 M1 + M2 where M1 is the impacting mass and M2 is the struck mass.

15.7.4.3.2 Input Parameters and Initial Conditions The assumptions used in the analysis of this accident are listed below:

a. The fuel assembly and grapple assembly are dropped from the maximum height allowed by the refueling platform (32 feet and 47 feet, respectively, when handling fuel) as two separate and independent units.

b. The entire amount of potential energy, referenced to the top of the reactor core, is available for application to the fuel assemblies involved in the accident. This assumption neglects the dissipation of some of the mechanical energy of the falling fuel assembly and grapple assembly in the water above the core.

c. None of the energy associated with the dropped assemblies is absorbed by the fuel material (uranium dioxide).

d. The minimum water depth between the top of the fuel rods and the fuel pool surface is 22 feet.

CHAPTER 15 15.7-10 REV. 19, SEPTEMBER 2018

LGS UFSAR

e. Maximum fuel rod pressurization is 2072 psia.

f. The peak linear power density for the highest power assembly discharged is 13.4 kW/ft and the corresponding maximum centerline operating fuel temperature is 3412F.

g. Because the weights of the fuel assembly and grapple assembly are similar, the fractional energy losses are assumed to be the same for both assemblies.

15.7.4.3.3 Results 15.7.4.3.3.1 Energy Available Dropping a fuel assembly onto the reactor core from the maximum height allowed by the refueling platform (32 feet) results in an impact velocity of 45.4 fps. Dropping the fuel grapple assembly onto the reactor core from the maximum height allowed by the refueling platform (47 feet) results in an impact velocity of 55.0 fps.

The total kinetic energy acquired by the falling assemblies is approximately 45,900 ft-lb and is dissipated in one or more impacts. The total kinetic energy equals the sum of the kinetic energy of the dropped fuel assembly (32 ft x 700 lb = 22,400 ft-lb) and the dropped fuel grapple assembly (47 ft x 500 lb = 23,500 ft-lb).

A review has been made to determine whether there are any potential drops of loads lighter than a fuel bundle and full grapple assembly (i.e., 1200 lb) that could have a higher kinetic energy due to a higher carrying height. The following conclusions have been reached:

No load that weighs less than 540 lb can develop a higher kinetic energy than a fuel bundle and full grapple assembly if dropped over spent fuel. This value is based on a potential energy of 45,900 ft-lb with the load at the maximum lift height of the reactor enclosure crane and relative to the reactor core (worst case). The majority of light loads carried over spent fuel weigh less than 540 lb.

As listed in Table 15.7-22, the potential energy of the remaining few light loads which will be handled over spent fuel and which weigh more than 540 lb is less than 45,900 ft-lb because their maximum drop heights are less than the worst case. Infrequent or unexpected movement of light loads (i.e., weighing greater than 540 lb but less than 1200 lb) over spent fuel which are not identified in Table 15.7-22 are administratively controlled on a case-by-case basis. These infrequent or unexpected load handling situations use the load handling guidelines to ensure that the probability of a load drop is extremely small or that the consequences are acceptable.

Based on the above review, the maximum kinetic energy resulting from the drop of each object weighing less than a fuel bundle and grapple assembly that could be handled over spent fuel will not exceed the effects of the fuel handling accident described above.

15.7.4.3.3.2 Energy Loss Per Impact Based on the fuel geometry in the reactor core and the long narrow shape of both dropped assemblies, four fuel assemblies are struck by each dropped assembly. The fractional energy loss on the first impact is approximately 80%.

CHAPTER 15 15.7-11 REV. 19, SEPTEMBER 2018

LGS UFSAR The second impact is expected to be less direct. The broadside of each dropped assembly impacts approximately 24 more fuel assemblies, so that after the second impact less than 240 ft-lb (approximately 1% of the original kinetic energy) is available for a third impact. Because a single fuel rod is capable of absorbing 250 ft-lb in compression before cladding failure, it is unlikely that any fuel rod will fail on a third impact.

If each dropped assembly strikes only one or two fuel assemblies on its first impact, the energy absorption by the core support structure results in approximately the same energy dissipation on the first impact as in the case where four fuel assemblies are struck. The energy relations on the second and third impacts remain approximately the same as in the original case. Thus, the calculated energy dissipation is as follows:

First impact 80%

Second impact 19%

Third impact 1% (no cladding failures) 15.7.4.3.3.3 Fuel Rod Failures 15.7.4.3.3.3.1 First Impact Failures The first impacts dissipate 0.80 x 45,900 or 36,720 ft-lb of energy. It is assumed that 50% of this energy is absorbed by the dropped fuel assembly and that the remaining 50% is absorbed by the struck fuel assemblies in the core. In addition, it is conservatively assumed that 0% of this energy is absorbed by the dropped grapple assembly and 100% is absorbed by the struck fuel assemblies. Because the fuel rods of the dropped fuel assembly are susceptible to the bending mode of failure and because 1 ft-lb of energy is sufficient to cause cladding failure as a result of bending, all 62 rods of the dropped fuel assembly are assumed to fail.

Each assembly, fuel and grapple, hits four fuel assemblies in the reactor core. This results in 64 tie rod failures as follows: 2 dropped assemblies (fuel and grapple) x 4 struck fuel assemblies per dropped assembly x 8 tie rods per struck fuel assembly.

Because the remaining fuel rods of the struck assemblies are held rigidly in place in the core, they are susceptible only to the compression mode of failure. To cause cladding failure of one fuel rod as a result of compression, 250 ft-lb of energy is required. To cause failure of all the remaining rods of each group of four struck assemblies, 250 x 54 x 4 or 54,000 ft-lb of energy would have to be absorbed in cladding alone. Thus, it is clear that not all the remaining fuel rods of the struck assemblies can fail on the first impact. The number of fuel rod failures caused by compression is computed as follows:

Dropped fuel assembly:

11 0.5 x 0.8 x 22,400 x 11 + 17 = 14 250 Dropped fuel grapple assembly:

11 CHAPTER 15 15.7-12 REV. 19, SEPTEMBER 2018

LGS UFSAR 1.0 x 0.8 x 23,500 x 11 + 17 = 30 250 44 Thus, during the first impact, fuel rod failures are as follows:

Dropped fuel assembly 62 rods (bending)

Struck assemblies 64 tie rods (bending)

Struck assemblies 44 rods (compression) 170 failed rods 15.7.4.3.3.3.2 Second Impact Failures Because of the less severe nature of the second impact and the distorted shape of each dropped assembly, it is assumed that the tie rods in only two of the 24 struck assemblies are subjected to bending failure. Because each dropped assembly strikes 24 fuel assemblies, 2 x 2 x 8 = 32 tie rods are assumed to fail. The number of fuel rod failures caused by compression on the second impact is computed as follows:

Dropped fuel assembly:

0.19 11 2 x 22,400 x 11 + 17 =3 250 Dropped fuel grapple assembly:

11 1.0 x 0.19 x 23,500 x 11 + 17 = 7 250 10 Thus, during the second impact, the fuel rod failures are as follows:

Struck assemblies 32 tie rods (bending)

Struck assemblies 10 rods (compression) 42 failed rods 15.7.4.3.3.3.3 Total Failures The total number of failed rods resulting from the accident is as follows:

First impact 170 rods Second impact 42 rods Third impact 0 rods 212 total failed rods 15.7.4.4 Barrier Performance The RCPB and primary containment are assumed to be open. The transport of fission products from the refueling area is discussed in Sections 15.7.4.5.2.1 and 15.7.4.5.2.2.

15.7.4.5 Radiological Consequences for the FHA CHAPTER 15 15.7-13 REV. 19, SEPTEMBER 2018

LGS UFSAR Regulation 10CFR50.67, "Accident Source Term," provides a mechanism for power reactor licensees to voluntarily replace the traditional TID-14844 (Ref. 15.7-4A) accident source term used in design-basis accident analyses with an "Alternative Source Term" (AST). The methodology of approach to this replacement is given in USNRC Regulatory Guide 1.183 (Ref.

15.7-5) and its associated Standard Review Plan 15.0.1 (Ref. 15.7-6).

Accordingly, Limerick Generating Station, Units 1 and 2, have applied the AST methodology for several areas of operational relief in the event of a Design Basis Accident (DBA), without fully crediting the use of previously assumed safety systems. Amongst these systems are the Control Room Emergency Fresh Air Supply System (CREFAS) and the Standby Gas Treatment System (SGTS).

In support of a full-scope implementation of AST as described in and in accordance with the guidance of Ref. 15.7-5, AST radiological consequence analyses are performed for the four DBAs that result in offsite exposure (i.e., Loss of Coolant Accident (LOCA), Main Steam Line Break (MSLB), Fuel Handling Accident (FHA), and Control Rod Drop Accident (CRDA)).

Implementation consisted of the following steps:

Identification of the AST based on plant-specific analysis of core fission product inventory,

Calculation of the release fractions for the four DBAs that could potentially result in control room and offsite doses (i.e., LOCA, MSLB, FHA, and CRDA),

Analysis of the atmospheric dispersion for the radiological propagation pathways,

Calculation of fission product deposition rates and removal mechanisms,

Calculation of offsite and control room personnel Total Effective Dose Equivalent (TEDE) doses.

15.7.4.5.1 Regulatory Approach The analyses are prepared in accordance with the guidance provided by Regulatory Guide 1.183 (Ref. 15.7-5).

15.7.4.5.2 Dose Acceptance Criteria The AST acceptance criteria for Control Room dose for postulated major credible accident scenarios such as those resulting in substantial meltdown of the core with release of appreciable quantities of fission products is provided by 10CFR50.67, which requires:

"Adequate radiation protection is provided to permit access to and occupancy of the control room under accident conditions without personnel receiving radiation exposures in excess of 0.05 Sv (5 rem) total effective dose equivalent (TEDE) for the duration of the accident."

This limit is applied by Regulatory Guide 1.183 to all of the accidents considered with AST.

CHAPTER 15 15.7-14 REV. 19, SEPTEMBER 2018

LGS UFSAR The AST acceptance criteria for an individual located at any point on the boundary of the exclusion area (the Exclusion Area Boundary or EAB) are provided by 10 CFR 50.67 as 25 rem TEDE for any 2-hour period following the onset of the postulated fission product release.

The AST acceptance criteria for an individual located at any point on the outer boundary of the low population zone (LPZ) are provided by 10CFR50.67 as 25 rem TEDE during the entire period of passage of the radioactive cloud resulting from the postulated fission product release.

These limits are applied by Regulatory Guide 1.183 to events with a higher probability of occurrence (including CRDA, MSLB, and FHA considered herein) to provide the following acceptance criteria:

For the BWR MSLB for the case of an accident assuming fuel damage or a pre-incident Iodine spike, doses at the EAB and LPZ should not exceed 25 rem TEDE for the accident duration (2-hour dose for EAB and 30-day dose for LPZ). For MSLB accidents assuming normal equilibrium Iodine activity, doses should not exceed 2.5 rem TEDE for the accident duration.

For the BWR CRDA, doses at the EAB and LPZ should not exceed 6.3 rem TEDE for the accident duration (2-hour dose for EAB and 24-hour dose for LPZ).

For the FHA, doses at the EAB and LPZ should not exceed 6.3 rem TEDE for the accident duration (2-hour dose for EAB and 30-day dose for LPZ).

15.7.4.5.3 Computer Codes New AST calculations were prepared for the FHA to simulate the radionuclide release, transport, removal, and dose estimates associated with the postulated accident.

The RADTRAD computer code (Ref. 15.7-9) endorsed by the NRC for AST analyses was used in the calculations for analyzing the FHA. The RADTRAD program is a radiological consequence analysis code used to estimate post-accident doses at plant offsite locations and in the control room. The FHA assessment takes no credit for SGTS operation, control room isolation, emergency ventilation or filtration of intake air for the duration of the accident event.

Offsite X/Qs were calculated with the PAVAN computer code (Ref. 15.7-10), using the guidance of Regulatory Guide 1.145 (Ref. 15.7-11). Control room X/Qs were calculated with the ARCON96 computer code (Ref. 15.7-12). The PAVAN and ARCON96 codes calculate relative concentrations in plumes from nuclear power plants at offsite locations and control room air intakes, respectively.

All of these computer codes have been used by the NRC staff in its safety reviews.

15.7.4.5.4 Source Terms Core Inventory As with the LOCA analysis, the inventory of reactor core fission products used as input to RADTRAD for the AST FHA analysis is based on maximum full power operation at a power level of 3527 MWth, which includes a 2% instrument error per Reg. Guide 1.49 (Ref. 15.7-13).

The fission products used for the accidents are the 60 isotopes of the standard RADTRAD input library, determined by the code developer as significant in dose consequences. These were extracted from Attachment A of the LGS Design Analysis LM-0645 (Ref. 15.7-14), and CHAPTER 15 15.7-15 REV. 19, SEPTEMBER 2018

LGS UFSAR correspond to 24 month cycle burnup parameters, conservatively calculated using the ORIGEN 2.1 code.

Release Fraction Current design basis accident evaluations as modified by Regulatory Guide 1.183 (Ref. 15.7-5) were used to determine the specific releases of radioactive isotopes at the given stages of fuel pin failure and provide these releases as a percentage of the total release for each accident, as summarized below.

15.7.4.5.5 Methodology Dose Calculations As per Regulatory Guide 1.183 (Ref. 15.7-5), Total Effective Dose Equivalent (TEDE) doses are determined as the sum of the CEDE and the Effective Dose Equivalent (EDE) using dose conversion factors for inhalation CEDE from Federal Guidance Report No. 11 (Ref. 15.7-15) and for external exposure EDE from Federal Guidance Report No. 12 (Ref. 15.7-16).

Fuel Handling Accident (FHA)

Table 15.7-16 lists the key assumptions and inputs used in the analysis. The AST FHA dose assessments use historical fuel damage assumptions of a total of 212 failed rods based on an 8x8 fuel design containing 62 fuel rods, but with a conservatively higher radial peaking factor (PF) of 1.7 instead of 1.5, as suggested by Reg. Guide 1.183. As per Section 15.7.4, the analytical methodology and licensing bases for determination of fuel damage in an FHA are provided in GESTAR II, and compliance with these bases is verified for each new fuel design.

The new radiological analysis applies additional conservative assumptions so as to continue to provide margin.

The assumed accident is an assembly and mast drop from the maximum height allowed by the refueling platform (a height of 32 feet for the fuel assembly, and 47 feet for the mast) over the reactor well onto fuel in the reactor. Based on fuel damage assessments in Ref. 15.7-17, this bounds the damage assessments for various 8x8 and 7x7 array fuel types with 60 and 49 fuel pins per bundle, respectively, and 111 failed pins and a 1.5 PF, as well as GE11 or GE13 9x9 array fuel types with 74 fuel pins per bundle, 140 failed pins and a 1.5 PF, and GE14 or GNF2 10x10 array fuel types with 172 failed pins per bundle and a 1.7 PF.

The analysis assumes that the activity from the damaged fuel is released from the reactor building through the South Vent Stack with no further credit for reactor building holdup or dilution. No credit is taken for the control room emergency ventilation system or standby gas treatment system operation.

The analysis assumptions for the transport, reduction, and release of the radioactive material from the fuel and the reactor coolant are consistent with the guidance provided in Appendix B of Regulatory Guide 1.183, and are provided in the design analysis of Ref. 15.7-14 and Ref 15.7-17.

15.7.4.5.6 Atmospheric Dispersion Factors (X/Qs)

CHAPTER 15 15.7-16 REV. 19, SEPTEMBER 2018

LGS UFSAR Table 15.7-17 lists X/Q values used for the control room dose assessments, as derived in UFSAR Chapter 2 and applied for the release point (south vent stack) applicable to the FHA, for a zero velocity vent release.

Table 15.7-15 lists X/Q values for the EAB and LPZ boundaries, as also derived in UFSAR Chapter 2 and applied for the release point (south vent stack) applicable to the FHA, for a zero velocity vent release.

15.7.4.5.7 Summary and Conclusions The radiological consequences of the postulated FHA are given in Table 15.7-18. As indicated, the control room, EAB, and LPZ calculated doses are within regulatory limits after AST implementation.

15.7.5 SPENT FUEL CASK-DROP ACCIDENT The spent fuel and/or ISFSI cask will be equipped with lifting lugs and yoke(s) which are single failure proof in accordance with NUREG-0612 compatible with the single failure proof reactor enclosure crane and main hook, thus precluding a cask-drop due to a single failure. Therefore, an analysis of the cask-drop is not required. Refer to Section 9.1.5 for a description of the reactor enclosure crane and the interlocks that prevent moving the cask over the fuel pool.

15.7.6 MOVEMENT OF LOADS WITHOUT SECONDARY CONTAINMENT The methodology provided in the reference 15.7-3 calculation allows the movement of various loads over irradiated fuel, without refueling area secondary containment integrity in place. The calculation provides the methodology to determine the consequences of dropping a load onto irradiated fuel, without secondary containment integrity, to remain bounded by the Fuel Handling Accident Analysis. Using the methodology provided in reference 15.7-3 ensures that the offsite dose values for the UFSAR Fuel Handling Accident Analysis will not be exceeded if the load being carried over irradiated fuel is dropped.

15.

7.7 REFERENCES

15.7-1 D. Nguyen, "Realistic Accident Analysis - The RELAC Code", NEDO-21142, (January 1978).

15.7-2 N.R. Horton, W.A. Williams, and J.W. Holtzclaw, "Analytical Methods for Evaluating the Radiological Aspects of the General Electric Boiling Water Reactor," APED 5756, (March 1969).

15.7-3 LGS Design Analysis LM-0033, Rev. 4, "Methodology to determine the acceptability of Moving Loads over Irradiated Fuel Without Secondary Containment Integrity" 15.7-4 Not Used 15.7-4A U. S. Atomic Energy Commission, Technical Information Document (TID) 14844, "Calculation of Distance Factors for Power and Test Reactor Sites," March 23, 1962.

CHAPTER 15 15.7-17 REV. 19, SEPTEMBER 2018

LGS UFSAR 15.7-5 U. S. Nuclear Regulatory Commission Regulatory Guide 1.183, "Alternative Radiological Source Terms for Evaluating Design Basis Accidents at Nuclear Power Reactors," July 2000.

15.7-6 U. S. Nuclear Regulatory Commission Standard Review Plan 15.0.1, "Radiological Consequence Analyses Using Alternative Source Terms," Revision 0, July 2000.

15.7-7 LGS Design Analysis LM-0646, Rev. 3, "Loss of Coolant Accident (LOCA) Using Alternative Source Terms."

15.7-8 NEDC-32868 P, "GE14 Compliance with Amendment 22 of NEDE-24011-P-A (GESTAR II)," Rev. 1, September 2000.

15.7-9 RADTRAD Code, "A Simplified Model for Radionuclide Transport and Removal and Dose Estimation," Version 3.03.

15.7-10 PAVAN Code, "An Atmospheric Dispersion Program for Evaluating Design Bases Accidental Releases of Radioactive Materials from Nuclear Power Stations."

15.7-11 U. S. Nuclear Regulatory Commission Regulatory Guide 1.145, "Atmospheric Dispersion Models for Potential Accident Consequence Assessments at Nuclear Power Plants," Revision 1, November 1982.

15.7-12 ARCON96 Code, "Atmospheric Relative Concentrations in Building Wakes."

15.7-13 U. S. Nuclear Regulatory Commission Regulatory Guide 1.49, "Power Levels of Nuclear Power Plants," Revision 1, December 1973.

15.7-14 LGS Design Analysis LM-0645, Rev. 3, "Re-analysis of Fuel Handling Accident (FHA) Using Alternative Source Terms."

15.7-15 Federal Guidance Report No. 11, "Limiting Values of Radionuclide Intake and Air Concentration and Dose Conversion Factors for Inhalation, Submersion, and Ingestion," 1988.

15.7-16 Federal Guidance Report No. 12, "External Exposure to Radionuclides in Air, Water, and Soil," 1993.

15.7-17 GNF2 Fuel Design Cycle Independent Analyses for Limerick Generating Station Units 1 and 2, Global Nuclear Fuels Document, NEDC-33627P, (latest approved revision).

CHAPTER 15 15.7-18 REV. 19, SEPTEMBER 2018

LGS UFSAR Table 15.7-1 SEQUENCE OF EVENTS FOR MAIN CONDENSER OFFGAS TREATMENT SYSTEM FAILURE TIME (sec) EVENTS 0 Event begins - system fails.

0 Noble gases are released.

<60 Area radiation alarms alert plant personnel.

<60 Operator actions begin with:

a. Initiation of appropriate system isolations.

b. Manual scram actuation.

c. Assurance of reactor shutdown cooling.

CHAPTER 15 15.7-19 REV. 13, SEPTEMBER 2006

LGS UFSAR Table 15.7-2 RADIOACTIVE GAS WASTE SYSTEM FAILURE: PARAMETERS TABULATED FOR POSTULATED ACCIDENT ANALYSES DESIGN REALISTIC BASIS BASIS ASSUMPTIONS ASSUMPTIONS I. Data and Assumptions Used to Estimate Radioactive Source from Postulated Accidents A. Power Level 3527 3527 B. Burnup NA NA C. Fission Product Released None None from Fuel (fuel damaged)

D. Release of Activity by Table 15.7-4 Table 15.7-5 Nuclide E. Iodine Fractions

1. Organic NA NA

2. Elemental NA NA

3. Particulate NA NA F. Reactor Coolant Activity NA NA before the Accident II. Data and Assumptions Used to Estimate Activity Released A. Primary Containment Leak NA NA Rate (%/day)

B. Secondary Containment Release NA NA Rate (%/day)

C. Valve Movement Times NA NA D. Adsorption and Filtration NA NA Efficiencies

1. Organic iodine NA NA

2. Elemental iodine NA NA

3. Particulate iodine NA NA

4. Particulate fission NA NA products E. Recirculation System NA NA Parameters

1. Flow rate NA NA

2. Mixing efficiency NA NA

3. Filter efficiency NA NA F. Containment Spray Parameters NA NA (flow rate, drop size, etc.)

G. Containment Volumes NA NA H. All Other Pertinent Data Section Section and Assumptions 15.7.1.1.5 15.7.1.1.5 CHAPTER 15 15.7-20 REV. 13, SEPTEMBER 2006

LGS UFSAR Table 15.7-2 (Cont'd)

DESIGN REALISTIC BASIS BASIS ASSUMPTIONS ASSUMPTIONS III. Dispersion Data A. EAB/LPZ distances (m) 731/2043 731/2043 B. X/Qs for EAB(2 hr) 2.9x10-4 1.2x10-4 LPZ(8 hr) 4.0x10-5 2.0x10-5 IV. Dose Data A. Method of Dose Calculation Section Reference 15.7-1 B. Dose Conversion Assumptions Section Reference 15.10 15.7-1 C. Peak Activity Concentrations NA NA in Containment D. Doses Table Table 15.7-9(b) 15.7-9(b)

CHAPTER 15 15.7-21 REV. 13, SEPTEMBER 2006

LGS UFSAR Table 15.7-3 OFFGAS EQUIPMENT FAILURE RELEASE ASSUMPTIONS:

RELEASE FRACTIONS ASSUMED FOR DESIGN BASIS AND REALISTIC ANALYSIS EQUIPMENT NOBLE GASES SOLID DAUGHTERS RADIOIODINE Charcoal Guard 1.0/1.0 NA NA Bed Charcoal Adsorbers 1.0/1.0 NA NA Afterfilter 1.00/1.00 NA NA CHAPTER 15 15.7-22 REV. 13, SEPTEMBER 2006

LGS UFSAR Table 15.7-7 FAILURE OF STEAM JET AIR EJECTOR LINES: PARAMETERS TABULATED FOR POSTULATED ACCIDENT ANALYSES DESIGN REALISTIC BASIS BASIS ASSUMPTIONS ASSUMPTIONS I. Data and Assumptions Used to Estimate Radioactive Source from Postulated Accidents A. Power Level 3527 3527 B. Burnup NA NA C. Fission Product from NA NA Fuel (fuel damaged)

D. Release of Activity by NA None Nuclide E. Iodine Fractions NA NA

1. Organic NA NA

2. Elemental NA NA

3. Particulate NA NA F. Reactor Coolant Activity NA NA before the Accident II. Data and Assumptions Used to Estimate Activity Released A. Primary Containment Leak NA NA Rate (%/day)

B. Secondary Containment Release NA NA Rate (%/day)

C. Valve Movement Times NA NA D. Adsorption and Filtration NA NA Efficiencies

1. Organic iodine NA NA

2. Elemental iodine NA NA

3. Particulate iodine NA NA

4. Particulate fission NA NA products E. Recirculation System NA NA Parameters

1. Flow rate NA NA

2. Mixing efficiency NA NA

3. Filter efficiency NA NA F. Containment Spray Parameters NA NA (flow rate, drop size, etc.)

G. Containment Volumes NA NA CHAPTER 15 15.7-26 REV. 13, SEPTEMBER 2006

LGS UFSAR Table 15.7-7 (Cont'd)

DESIGN REALISTIC BASIS BASIS ASSUMPTIONS ASSUMPTIONS H. All Other Pertinent Data Section Section and Assumptions 15.7.1.3.5 15.7.1.3.5 III. Dose Data A. Method of Dose Calculation Section Reference 15.10 15.7-1 B. Dose Conversion Assumptions Section Reference 15.10 15.7-1 C. Peak Activity Concentrations NA NA in Containment D. Doses Table Table 15.7-9(a) 15.7-9(a)

CHAPTER 15 15.7-27 REV. 13, SEPTEMBER 2006

LGS UFSAR Table 15.7-8 FAILURE OF STEAM JET AIR EJECTOR LINES:

ACTIVITY RELEASED TO THE ENVIRONMENT DESIGN BASIS ANALYSIS Activity Isotope (Ci)

Kr-83m 4.19x10+1 Kr-85m 3.91x10+1 Kr-85 2.52x10-1 Kr-87 2.41x10+2 Kr-88 2.47x10+2 Kr-89 5.56x10+2 Xe-131m 1.87x10-1 Xe-133m 3.60 Xe-133 1.04x10+2 Xe-135m 2.61x10+2 Xe-135 2.75x10+2 Xe-137 7.71x10+2 Xe-138 8.74x10+2 REALISTIC ANALYSIS Activity Isotope (Ci)

Kr-83m 7.18 Kr-85m 6.70 Kr-85 4.32x10-2 Kr-87 4.13x10+1 Kr-88 4.23x10+1 Kr-89 9.53x10+1 Xe-131m 3.21x10-2 Xe-133m 6.16x10-1 Xe-133 1.79x10+1 Xe-135m 4.48x10+1 Xe-135 4.72x10+1 Xe-137 1.32x10+2 Xe-138 1.50x102 CHAPTER 15 15.7-28 REV. 13, SEPTEMBER 2006

LGS UFSAR Table 15.7-9(a)

FAILURE OF STEAM JET AIR EJECTOR LINES:

RADIOLOGICAL EFFECTS DESIGN BASIS ANALYSIS TOTAL BODY DOSE (rem)

Exclusion Area Boundary 2.3x10-1 (731 meters - 2 hr(1) dose)

Low Population Zone 3.1x10-2 (2043 meters - 2 hr(1) dose)

REALISTIC ANALYSIS TOTAL BODY DOSE (rem)

Exclusion Area Boundary 1.6x10-2 (731 meters - 2 hr(1) dose)

Low Population Zone 2.7x10-3 (2043 meters - 2 hr(1) dose)

(1)

Duration of accident is 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months CHAPTER 15 15.7-29 REV. 13, SEPTEMBER 2006

LGS UFSAR Table 15.7-9(b)

MAIN CONDENSER OFFGAS TREATMENT SYSTEM FAILURE: RADIOLOGICAL EFFECTS DESIGN BASIS ANALYSIS TOTAL BODY DOSE (rem)

Exclusion Area Boundary 4.96x10-1 (731 meters - 2 hr dose)

Low Population Zone 6.82x10-2 (2043 meters - 2 hr(1) dose)

REALISTIC ANALYSIS TOTAL BODY DOSE (rem)

Exclusion Area Boundary 3.90x10-2 (731 meters - 2 hr dose)

Low Population Zone 6.40x10-3 (2043 meters - 2 hr(1) dose)

(1)

Duration of accident is 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months CHAPTER 15 15.7-30 REV. 13, SEPTEMBER 2006

LGS UFSAR Table 15.7-10 SEQUENCE OF EVENTS:

LIQUID RADWASTE TANK FAILURE TIME (min) SEQUENCE OF EVENTS 0.0 Event begins - failure occurs 1.0 (approx) Area radiation alarms alert plant personnel

<10.0 Operator action begins CHAPTER 15 15.7-31 REV. 13, SEPTEMBER 2006

LGS UFSAR Table 15.7-11 LIQUID RADWASTE TANK FAILURE: PARAMETERS TABULATED FOR POSTULATED ACCIDENT ANALYSES DESIGN REALISTIC BASIS BASIS ASSUMPTIONS ASSUMPTIONS I. Data and Assumptions Used to Estimate Radioactive Source from Postulated Accidents A. Power Level NA NA B. Burnup NA NA C. Fission Products Released NA NA from Fuel (fuel damaged)

D. Release of Activity by NA None Nuclide E. Iodine Partition Factors Table 15.7-12 Table 15.7-13

1. Organic 0.01 0.01

2. Elemental 0.01 0.01

3. Particulate 0.01 0.01 F. Reactor Coolant Activity NA NA before the Accident II. Data and Assumptions Used to Estimate Activity Released A. Containment Leak Rate (%/day) NA NA B. Secondary Containment Release NA NA Rate (%/day)

C. Valve Movement Times NA NA D. Adsorption and Filtration NA NA Efficiencies

1. Organic iodine NA NA

2. Elemental iodine NA NA

3. Particulate iodine NA NA

4. Particulate fission NA NA products E. Recirculation System NA NA Parameters

1. Flow rate NA NA

2. Mixing efficiency NA NA

3. Filter efficiency NA NA F. Containment Spray Parameters NA NA (flow rate, drop size, etc.)

G. Containment Volumes NA NA H. All Other Pertinent Data and Assumptions

1. Dilution factor afforded NA NA by public waterway CHAPTER 15 15.7-32 REV. 13, SEPTEMBER 2006

LGS UFSAR Table 15.7-11 (Cont'd)

DESIGN REALISTIC BASIS BASIS ASSUMPTIONS ASSUMPTIONS

2. Dilution of liquid NA NA ingestion

3. Aquatic life consumed NA NA (qms)

III. Dose Data A. Method of Dose Calculation Section Reference 15.10 15.7-1 B. Dose Conversion Assumptions Section Reference 15.10 15.7-1 C. Peak Activity Concentrations NA NA in Containment D. Doses Table 15.7-14 Table 15.7-14 CHAPTER 15 15.7-33 REV. 13, SEPTEMBER 2006

LGS UFSAR Table 15.7-12 LIQUID RADWASTE TANK FAILURE (RWCU PHASE SEPARATOR): ACTIVITY RELEASED TO THE ENVIRONMENT DESIGN BASIS ANALYSIS ACTIVITY ISOTOPE (Ci)

I-131 1.52x10+1 I-132 2.49x10+1 I-133 1.10x10+1 I-134 1.23x10+0 I-135 5.27x10+0 TOTAL 5.76x101 CHAPTER 15 15.7-34 REV. 13, SEPTEMBER 2006

LGS UFSAR Table 15.7-13 LIQUID RADWASTE TANK FAILURE (RWCU PHASE SEPARATOR): ACTIVITY RELEASED TO THE ENVIRONMENT REALISTIC ANALYSIS ACTIVITY ISOTOPE (Ci)

I-131 2.17 I-132 3.55 I-133 1.58 I-134 0.174 I-135 0.754 TOTAL 8.23 CHAPTER 15 15.7-35 REV. 13, SEPTEMBER 2006

LGS UFSAR Table 15.7-14 LIQUID RADWASTE TANK FAILURE (RWCU PHASE SEPARATOR): RADIOLOGICAL EFFECTS DESIGN BASIS ANALYSIS WHOLE BODY THYROID DOSE (rem) DOSE (rem)

Exclusion Area Boundary 5.41x10-3 2.91 (731 meters - 2 hr dose)

Low Population Zone 7.47x10-4 4.03x10-1 (2043 meters - 2 hr(1) dose)

REALISTIC ANALYSIS WHOLE BODY THYROID DOSE (rem) DOSE (rem)

Exclusion Area Boundary 3.2x10-4 1.72x10-1 (731 meters - 2 hr dose)

Low Population Zone 5.34x10-5 2.87x10-2 (2043 meters - 2 hr(1) dose)

(1)

Duration of accident is 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months CHAPTER 15 15.7-36 REV. 13, SEPTEMBER 2006

LGS UFSAR Table 15.7-15 SEQUENCE OF EVENTS FOR FUEL HANDLING ACCIDENT TIME (min) EVENT 0 Fuel assembly is being handled by refueling equipment. The fuel assembly and fuel grapple assembly drop onto the top of the core.

0 Some of the fuel rods in both the dropped assembly and reactor core are damaged, resulting in the release of gaseous fission products to the reactor coolant and eventually to the refueling area atmosphere.

<1 The refueling area ventilation radiation monitoring system alarms to alert plant personnel.

<5 Operator actions begin.

CHAPTER 15 15.7-37 REV. 14, SEPTEMBER 2008

LGS UFSAR Table 15.7-19 Table 15.7-19 Deleted CHAPTER 15 15.7-41 REV. 16, SEPTEMBER 2012

LGS UFSAR Table 15.7-20 Table 15.7-20 Deleted CHAPTER 15 15.7-42 REV. 14, SEPTEMBER 2008

LGS UFSAR Table 15.7-21 Deleted CHAPTER 15 15.7-43 REV. 14, SEPTEMBER 2008

LGS UFSAR Table 15.7-22 POTENTIAL ENERGY OF LIGHT LOADS TO BE HANDLED OVER SPENT FUEL Approximate Combined Weight, Potential Energy, Handling Tool (ft-lb)

Plus Load Normal Maximum Load (lb) Height Height

a. New fuel bundle or 700 21,000 29,000 dummy bundle (Reactor enclosure crane relative to spent fuel pool)

b. In-Vessel storage 600 21,000 33,000 rack (Refueling platform hoist relative to core)

CHAPTER 15 15.7-44 REV. 13, SEPTEMBER 2006

LGS UFSAR 15.8 ANTICIPATED TRANSIENTS WITHOUT SCRAM 15.8.1 REQUIREMENTS The LGS plant incorporates many features and systems designed to mitigate ATWS events.

These features were originally incorporated into LGS in response to NRC concerns. They were based on extensive assessments of ATWS mitigation and are consistent with Alternate 3A (Reference 15.8-1). These features and systems, which meet the current ATWS requirements of 10CFR50.62, are described briefly below.

15.8.2 PLANT CAPABILITIES The LGS design uses diverse, redundant, and reliable scram systems. This includes the normal scram systems plus the electrically diverse alternate rod insertion system. Each of these systems is frequently tested and would insert the control rods even if multiple component failures should occur, thus making the probability of an ATWS event extremely remote.

The ATWS-RPT feature prevents reactor vessel overpressure and possible short-term fuel damage for the most limiting postulated ATWS event by reducing reactor power. Subsequent to an ATWS event for which the ARI system does not insert the control rods, the long-term shutdown of the reactor can be accomplished by either manual insertion of the control rods or injection of sodium pentaborate solution into the vessel by the SLCS.

15.8.3 EQUIPMENT DESCRIPTION This section describes the equipment and control logic added or modified exclusively for ATWS prevention or mitigation. The description covers design and functional requirements and references that contain more detailed information. The dynamic and environmental qualifications are described in Sections 3.9, 3.10, and 3.11.

15.8.3.1 Redundant Reactivity Control System The RRCS determines that a transient is under way that exceeds expected operating parameters.

After deciding that ATWS mitigation is the appropriate action, the RRCS activates ATWS prevention equipment and then ATWS mitigation equipment. The RRCS uses transient detection sensors for high vessel dome pressure and low vessel water level and the actuation logic to initiate ARI, RPT, SLCS injection, and feedwater runback.

The RRCS consists of two completely redundant divisions. Each division is initiated automatically by the ATWS detection sensors, which are independent of the RPS sensors, or manually by switches that require the same type of operator actions as manual scram.

Additional information on the RRCS is contained in Sections 7.1 and 7.6.

15.8.3.2 Alternate Rod Insertion The ARI is designed to provide a parallel path for actuation of the scram valves, which results in control rod insertion. ARI consists of the redundant valves on the scram valve pilot air headers that are actuated by the RRCS logic. The RRCS logic is designed so that successful ARI performance will avoid subsequent ATWS mitigation action (feedwater runback and SLCS initiation).

CHAPTER 15 15.8-1 REV. 17, SEPTEMBER 2014

LGS UFSAR Additional information on the ARI system is contained in Sections 7.1 and 7.6.

15.8.3.3 Recirculation Pump Trip The recirculation pump motors are tripped by the RRCS logic. The purpose of the RPT is to reduce core flow and create core voids to decrease power generation, thus limiting any power or pressure disturbance. The RPT function is single failure proof and is provided with in service test capability (except for the action of the final breakers).

Additional information on the RPT function of the RRCS is contained in Sections 7.1 and 7.6.

15.8.3.4 Feedwater Runback Upon the receipt of a high pressure signal from the RRCS and after a specified time-delay, if core power is not reduced as evidenced by the APRMs reading downscale (not low water level),

feedwater flow would be automatically limited by the RRCS, thereby reducing power and steam discharge to the suppression pool. The system provides for manual operation to be returned to the operator after a time-delay to allow an increase in feedwater flow if needed.

Additional information on the feedwater runback function of the RRCS is contained in Sections 7.1 and 7.6.

15.8.3.5 Standby Liquid Control System The SLCS is automatically actuated by the RRCS or manually initiated by an operator in the main control room upon indication of a failure to scram and in accordance with plant operating procedures. The system is designed to inject sodium pentaborate solution through a core spray sparger. Simultaneous operation of at least two of the three pumps at full capacity allows adequate margin to control the power production. The system can be periodically tested without affecting its ability to respond to an actuation signal.

Additional information on the SLCS is provided in Sections 3.9, 7.1, 7.4, and 9.3.5.

15.8.3.6 Scram Discharge Volume The SDV of the CRD system minimizes the potential for a common mode failure of the scram function. Redundant instrument volume water level sensors for the CRDs and instrument line piping ensure the availability of sufficient capacity to receive water from a full reactor scram. The design employs redundant Class 1E sensors and redundant vent and drain valves. Performance of the safety functions is assured in the event of a single active failure or the bypass of the sensors during plant operation.

Additional information on the SDV is contained in Section 4.6. Instrumentation is described in Chapter 7.

15.8.3.7 HPCI Flow Split Modification LGS, although a BWR/4, shares some design characteristics in common with BWR/5 reactors.

The HPCI system has been split into two components. About one-half of the flow goes into the core spray sparger, similar to the high pressure core spray system of a BWR/5. The remaining portion is routed to the feedwater sparger as is typical of BWR/4s. Also, as mentioned in Section CHAPTER 15 15.8-2 REV. 17, SEPTEMBER 2014

LGS UFSAR 15.8.3.5, the SLCS flow is injected via the core spray sparger, which is also typical of BWR/5s.

The flow split modification maintains proper HPCI flow mixing with the reactor coolant and avoids encountering localized fuel channel hydrodynamic effects that might cause local power peaking, if an adjacent control rod should fail to fully insert. Drawing E41-1020-G-002 shows flow rates at the ATWS condition.

The additional HPCI flow split equipment consist of cross-tie piping between the HPCI and feedwater injection lines, an MOV with associated control logic and equipment, and two flow balancing orifices as shown on drawings M-55 and M-56.

15.8.3.8 Steam Flow Induced Process Measurement Error An additional steam flow induced process measurement error (SFIE) in the Level 3 (L3) scram was evaluated by GE in Reference 15.8-2 for the ATWS event and it was concluded that it is not affected by a change in the L3 analytical limit (AL) as there is no L3 function directly credited by the ATWS events. However since there is no scram there is bypass steam flow in the annular region outside the dryer, which causes an SFIE induced error in the L2 trip.

For the limiting A TWS events, the scenario involves pressurization due to the MSIV closure. The reactor isolation leads to a recirculation pump trip (ATWS APT) very early in the transient and the trip is usually reached at about the same time the MSIVs are full closed. The ATWS APT rapidly reduces power and steaming rate and is the key feature that reduces the steaming rate to be within the capacity of the Safety I Relief Valves. The post APT power level is on the order of 50 to 55% power and by the time the level is near the Level 2 AL, the power and steaming rate is below 50%.

With the reactor steaming rate reduced to 50%, the error will be significantly reduced, and the SFIE effect with be approximately 1/4 of the effect at rated conditions. This would reduce the SFIE of 6 inches, for example, at rated power to about 1.5 inches at these conditions. Since the RCIC I HPCI initiation at this water level for ATWS is not critical to the event mitigation, this error and delay to L2 is considered insignificant.

A small delay for the RCIC I HPCI initiation would be slightly beneficial as the water level would be lower during a portion of the transient and would result in a reduced reactor power and reduced steaming rate to the suppression pool.

The long-term mitigation of these events involves controlling water level to low levels in the vessel. Again the small error at these conditions (< 2 inches) is insignificant for water level control and power generation compared to the analysis.

Non-limiting ATWS events that may initiate the Level 2 ATWS-RPT or other L2 functions for ATWS would also be affected by L3 analytical limit error. An example would be the LOFW event. This event would result in recirculation runback associated with the loss of flow and low level (e.g., level 4). This would reduce the power and steaming rate. The power would also reduce due to the reduced subcooling associated with the loss of feedwater flow. The combined effect would reduce the error to approximately half of the condition at rated power (based on an estimated power and steaming rate reduced to 70% prior to level 2). As events that trip ATWS-RPT on low level are power and pressure reduction events, they do not challenge the ATWS acceptance criteria and therefore a low level ATWS APT delay due CHAPTER 15 15.8-3 REV. 17, SEPTEMBER 2014

LGS UFSAR to L3 scram error is not significant for compliance to the ATWS acceptance criteria.

Therefore, the expected SFIE (approximately half of the error at rated conditions) will have no significant effect on the power and pressure events, and these events will remain far from limiting.

15.

8.4 REFERENCES

15.8-1 Assessment of BWR Mitigation of ATWS (NUREG-0460 Alternate 3, Volume 4 [for comment]), NEDE-24222, GE, (1979).

15.8-2 GE-Hitachi Nuclear Energy, 0000-0077-4603-R1, "BWR Owners Group Evaluation of Steam Flow Induced Error (SFIE) Impact on the L3 Setpoint Analytic Limit," October 2008.

CHAPTER 15 15.8-4 REV. 17, SEPTEMBER 2014

LGS UFSAR 15.9 PLANT NUCLEAR SAFETY OPERATIONAL ANALYSIS (A SYSTEM LEVEL/QUALITATIVE-TYPE PLANT FMEA) 15.9.1 OBJECTIVES The objectives of the nuclear safety operational analysis are listed below:

a. Essential Protective Sequences: Identify and demonstrate that the essential protection sequences needed to accommodate normal plant operations, anticipated and abnormal operational transients, and DBAs are available and adequate. Each event considered in Chapter 15 is further examined and analyzed. Specific essential protective sequences are identified. The appropriate sequence is discussed for all BWR operating modes.

b. Design Basis Adequacy: Identify and demonstrate that the safety design basis of the various structures, systems, or components needed to satisfy the plant essential protection sequences are appropriate, available, and adequate. Each protective sequence identifies the specific structures, systems, or components performing safety or power generation functions. Interrelationships between primary systems and secondary (or auxiliary equipment) in providing these functions are shown.

The individual design bases (identified throughout the UFSAR for each structure, system, or component) are brought together by the analysis in this section. In addition to the individual equipment design bases, the plant-wide design bases are examined and presented here.

c. System Level/Qualitative-Type FMEA: Identify a system level/qualitative-type FMEA of essential protective sequences to show compliance with the single active component failure or single operator error criteria. Each protective sequence entry is evaluated relative to single active component failure or single operator error criteria. Safety classification aspects and interrelationships between systems are also considered.

d. NSOA Criteria Relative to Plant Safety Analysis: Identify the systems, equipment, or components' operational conditions and requirements which are essential to satisfy the nuclear safety operational criteria utilized in the Chapter 15 plant events.

e. Technical Specification Operational Basis: Establish limiting operating conditions, testing, and surveillance bases relative to plant Technical Specification operational requirements.

15.9.2 APPROACH TO OPERATIONAL NUCLEAR SAFETY 15.9.2.1 Classification of Plant Events The specified measures of safety used in this analysis are referred to as "unacceptable consequences." They are analytically determinable limits on the consequences of different classifications of plant events. The NSOA is thus an evaluation oriented to "event consequence."

Refer to Figure 15.9-1 for a description of the systematic process by which these unacceptable results are converted so as to conform to safety requirements.

CHAPTER 15 15.9-1 REV. 20, SEPTEMBER 2020

LGS UFSAR 15.9.2.2 NSOA Development The following guidelines are used to develop the NSOA:

15.9.2.2.1 Scope and Classification Of Plant Events The scope and classification of the situations analyzed include the following:

a. Normal Operations Normal operations are those under planned conditions without significant abnormalities. Operations subsequent to an incident (transient, accident, or special event) are not considered planned operations until the procedures being followed or equipment being used are identical to those used during any one of the defined planned operations. Specific events are listed in Table 15.9-1.

b. Anticipated Operational Transients Anticipated operational transients are deviations from normal conditions that are expected to occur with moderate frequency and, as such, the design should include capability to withstand the conditions without operational impairment. Included are incidents that result from a single operator error, a control malfunction. These and other incidents are listed in Table 15.9-2.

c. Abnormal Operational Transients Abnormal operational transients are deviations from normal conditions that occur infrequently. The design should include a capability to withstand these conditions without operational impairment. Refer to Table 15.9-3 which lists events included within this classification.

d. Design Basis Accident A DBA is an hypothesized accident, whose characteristics and consequences are utilized in the design of those systems and components pertinent to the preservation of radioactive material barriers and the restriction of radioactive material release from the barriers. The potential radiation exposures resulting from a DBA are greater than for any similar accident postulated from the same general accident assumptions. DBAs are listed in Table 15.9-4.

e. Special Events Special events are postulated to demonstrate some special capability of the plant in accordance with NRC requirements. For analyzed events within this classification, see Table 15.9-5.

15.9.2.2.2 Safety and Power Generation Safety functions include:

a. Accommodation of abnormal operational transients and postulated DBAs CHAPTER 15 15.9-2 REV. 20, SEPTEMBER 2020

LGS UFSAR

b. Maintenance of containment integrity

c. Assurance of ECCS

d. Continuance of RCPB Safety classified aspects are related to Regulatory Guide 1.183 and 10CFR50.67 dose limits, infrequent and low probability occurrences, single active component failure criteria, worst case operating conditions and initial assumptions, automatic (less than 10 minutes) corrective action, significant unacceptable dose and environmental effects, and the involvement of other coincident (mechanistic or nonmechanistic) plant and environmental situations.

Power generation classified considerations are related to continued plant power generation operation, equipment operational matters, component availability aspects, and long-term offsite public effects.

Power generation functions include:

a. Accommodation of planned operations and anticipated operational transients.

b. Minimization of radiological releases to appropriate levels.

c. Assurance of safe and orderly reactor shutdown and/or return to power generation operation.

d. Continuance of plant equipment design conditions to ensure long-term reliable operation.

Power generation is related to 10CFR20, 10CFR50, Appendix I, moderate and high probability occurrences, nominal operating conditions and initial assumptions, allowable immediate operator manual actions, and environmental effects.

15.9.2.2.3 Frequency of Events Consideration of the frequency of the initial (or initiating) event is reasonably straightforward.

Added considerations (e.g., further failures or operator errors) influence the classification grouping.

The events in this Section are grouped according to initiating frequency occurrence. The imposition of additional failures necessitates further classification to a lower frequency category.

The introduction of single active component failure or single operator error into the examination of planned operation, anticipated operational transients, or abnormal operational transient evaluations has not been previously considered a design basis or evaluation prerequisite. It is included and provided here to demonstrate the plant's capability to accommodate this requirement.

CHAPTER 15 15.9-3 REV. 20, SEPTEMBER 2020

LGS UFSAR 15.9.2.2.4 Conservative Analysis Margins The unacceptable consequences established in this section relative to public health and safety are in strict and conservative conformance to regulatory requirements.

15.9.2.2.5 Safety Function Definition The essential protective sequences shown for an event in this section list the minimum structures and systems that are required to satisfy the single active component failure or single operator error evaluation of the event. Protective success paths other than those shown exist in some cases. Not all the events involve the same natural, environmental, or plant conditional assumptions. In Event 40, control rod-drop accident is not assumed to be associated with any SSE or OBE occurrence.

Therefore, seismic safety function requirements are not considered for Event 40. Some of the safety function equipment associated with the Event 40 protective sequence are also capable of more limiting events, such as Event 42.

The primary containment may perform a safety function for some events (when uncontained radiological release would be unacceptable), but for other events, it may not be applicable (e.g.,

during refueling). The requirement to maintain the containment in postaccident recovery is needed to limit doses to less than 10CFR50.67 and Regulatory Guide 1.183 limits. After radiological sources are depleted with time, the further use of primary containment is unnecessary. Thus, the "time domain" and "need for" aspects of a function should be, and are, taken into account when evaluating events.

The operation of ESF equipment for normal operational events should not be misunderstood to mean that ESF equipment requirements apply to this event category. Also, the interpretation of the use of ESF single active component failure capable systems for anticipated operational transient protective sequences should not imply that these equipment requirements (seismic, redundancy, diversity, testable, IEEE, etc.) are appropriately required for anticipated operational transients.

15.9.2.2.6 Envelope and Actual Event Analyses Study of the actual plant occurrences, their frequency, and their actual impact are reflected in their categorization in this section. This places the plant safety evaluations into a better perspective by focusing attention on the envelope analysis.

15.9.2.2.7 Analysis Consistency Figure 15.9-2 illustrates three inconsistencies. Panel A shows the possible inconsistency resulting from operational requirements being placed on separated levels of protection for one event. If the second and sixth levels of protection are important enough to warrant operational requirements, then so are the third, fourth, and fifth levels. Panel B shows the possible inconsistency resulting from operational requirements being arbitrarily placed on some action thought to be important to safety. In the case shown, scram represents different protection levels for two similar events in one category; if the fourth level of protection for Event B is important enough to warrant an operational requirement, then so is the fourth level for Event A.

Thus, to simply place operational requirements on all equipment needed for some action (scram, isolation, etc.) could be inconsistent and unreasonable if different protection levels are represented. Panel C shows the possible inconsistency resulting from operational requirements being placed on some arbitrary level of protection for any and all postulated events. Here, the CHAPTER 15 15.9-4 REV. 20, SEPTEMBER 2020

LGS UFSAR inconsistency is not recognizing and accounting for different event categories based upon cause or expected frequency of occurrence.

Inconsistencies of the types illustrated in Figure 15.9-2 are avoided in the NSOA by directing the analysis to event consequences oriented aspects. Analytical inconsistencies are avoided by treating all the events of a category under the same set of functional rules, by applying another set of functional rules to another category, and by having a consistent set of rules between categories.

Thus, it is valid to compare the results of the analyses of the events in any one category and invalid to compare events of a different categories (with different rules). An example of this is the different rules (limits, assumptions, etc.) of accidents compared to anticipated transients.

15.9.2.3 Comprehensiveness of the Analysis The method of analysis must be sufficiently comprehensive so that all plant hardware and the full range of plant operating conditions are considered. The tendency to be preoccupied with "worst cases" (those that appear to give the most severe consequences) is recognized; however, the protection sequences essential to lesser cases may be different (more or less restrictive) from the worst case sequence. To assure that operational and design basis requirements are defined and appropriate for all equipment essential to attaining acceptable consequences, all essential protection sequences must be identified for each of the plant safety events examined. Only in this way is a comprehensive level of safety attained. Thus, the NSOA is also protection sequence oriented.

15.9.2.4 Systematic Approach of the Analysis In summary, the systematic method utilized in this analysis contributes to both the consistency and comprehensiveness of the analysis mentioned above. The desired characteristics representative of a systematic approach to selecting BWR operational requirements are as follows:

a. Specify measures of safety/unacceptable consequences.

b. Consider all normal operations.

c. Systematic event selection.

d. Common treatment analysis of all events of any one type.

e. Systematic identification of plant actions and systems essential to avoid unacceptable consequences.

f. Emergence of operational requirements and limits from system analysis.

Figure 15.9-1 illustrates the systematic process by which the operational and design basis nuclear safety requirements and technical specifications are derived. The process involves the evaluation of carefully selected plant events relative to the unacceptable consequences (specified measures of safety). Those limits, actions, systems, and components found to be essential to achieving acceptable consequences are the subjects of operational requirements.

CHAPTER 15 15.9-5 REV. 20, SEPTEMBER 2020

LGS UFSAR 15.9.2.5 Relationship of Nuclear Safety Operational Analysis to Safety Analyses of Chapter 15 One of the main objectives of the operational analysis is to identify all essential protection sequences and establish the detailed equipment conditions essential to satisfy the nuclear safety operational criteria. The spectrum of events examined in Chapter 15 represent a complete set of plant safety considerations. The main objective of the earlier analyses of Chapter 15 was to provide detailed worst case (limiting or envelope) analyses of plant events. The worst cases are correspondingly analyzed and treated in this section. However, here the frequency of occurrence, unacceptable consequences, assumption categories, etc are taken into account.

Tables 15.9-1 through 15.9-5 provide cross-correlation between the NSOA event, its protection sequence diagram, and its safety evaluation in Chapter 15.

15.9.2.6 Relationship Between NSOA and Operational Requirements, Technical Specifications, Design Bases, and Single Active Component Failure Aspects By definition, an "operational requirement" is a requirement or restriction (limit) on either the value of a plant variable or the operability condition associated with a plant system. Such requirements must be observed during all modes of plant operation (not just at full power) to assure that the plant is operated safely to avoid unacceptable results. There are two kinds of operational requirements for plant hardware:

a. Limiting condition for operation: the required condition for a system while the reactor is operating in a specified state.

b. Surveillance requirements: the nature and frequency of tests required to ensure that the system is capable of performing its essential functions.

Operational requirements are systematically selected for one of two basic reasons:

a. To ensure that unacceptable consequences are mitigated following specified plant events by examining and challenging the system design.

b. To ensure the consequences of a transient or accident are acceptable with the existence of a single active component failure or single operator error.

The individual structures and systems that perform a safety function are required to do so under design basis conditions including environmental considerations and under single active component failure assumptions. The NSOA confirms the previous examination of the individual equipment (Section 15.0.3) requirement conformance analyses.

15.9.2.7 Unacceptable Consequences Criteria Tables 15.9-6 through 15.9-10 identify the unacceptable consequences associated with different event categories. In order to prevent or mitigate them, they are recognized as the major bases for identifying system operational requirements as well as the bases for all other safety analysis criteria throughout the UFSAR.

CHAPTER 15 15.9-6 REV. 20, SEPTEMBER 2020

LGS UFSAR 15.9.2.8 General Nuclear Safety Operational Criteria The following general nuclear safety operational criteria are used to select operational requirements:

Applicability Nuclear Safety Operational Criteria Planned operation The Plant shall be operated so as to anticipated, abnormal avoid unacceptable consequences.

operational transients, DBAs, additional special plant capability events Anticipated and abnormal The plant shall be operated such that no single active operational transients and component failure can prevent the safety actions DBA. essential to avoid the unacceptable consequences associated with anticipated or abnormal operational transients or DBAs. However, this requirement is not applicable during structure, system, or component repair if the availability of the safety action is maintained either by restricting the allowable repair time or by more frequent testing of a redundant structure, system, or component.

The unacceptable consequences associated with the different categories of plant operation and events are dictated by:

a. Probability of occurrence.

b. Allowable limits (per the probability) related to radiological, structural, environmental, etc., aspects.

c. Coincidence of other related or unrelated disturbances.

d. Time domain of event and consequences consideration.

15.9.3 METHOD OF ANALYSIS 15.9.3.1 General Approach The NSOA is performed on the plant as designed. The end products of the analysis are the nuclear safety operational requirements and the restrictions on plant hardware and its operation that must be observed both to satisfy the nuclear safety operational criteria and to show compliance of the plant safety and power generation systems with plant wide requirements. Figure 15.9-1 shows the process used in the analysis. The following inputs are required for the analysis of specific plant events:

a. Unacceptable consequences criteria (Section 15.9.2.7).

b. General nuclear safety operational criteria (Section 15.9.2.8).

CHAPTER 15 15.9-7 REV. 20, SEPTEMBER 2020

LGS UFSAR

c. Definition of BWR operating states (Section 15.9.3.2).

d. Selection of events for analysis (Section 15.9.3.3).

e. Guidelines for event analysis (Section 15.9.3.5).

With the above information, each selected event can be evaluated systematically to determine the actions, systems, and limits essential to avoid unacceptable consequences. The essential plant components and limits so identified are then considered to be in agreement with, and subject to, nuclear operational design basis requirements and Technical Specification restrictions.

15.9.3.2 BWR Operating States The four BWR operating states in which the reactor can exist are defined in Section 15.9.6.2.4 and summarized in Table 15.9-11.

The main objective in selecting operating states is to divide the BWR operating spectrum into sets of initial conditions to facilitate consideration of various events in each state.

Each operating state includes a wide spectrum of values for important plant parameters. Within each state, these parameters are considered over their entire range to determine the limits on their values necessary to satisfy the nuclear safety operational criteria. Such limitations are presented in the sections of the UFSAR that describe the systems associated with the parameter limit. The plant parameters to be considered in this manner include the following:

a. Reactor coolant temperature

b. Reactor vessel water level

c. Reactor vessel pressure

d. Reactor vessel water quality

e. Reactor coolant forced circulation flow rate

f. Reactor power level (thermal and neutron flux)

g. Core neutron flux distribution

h. Feedwater temperature

i. Primary containment temperature and pressure

j. Suppression pool water temperature and level

k. Control rod worth CHAPTER 15 15.9-8 REV. 20, SEPTEMBER 2020

LGS UFSAR 15.9.3.3 Selection of Events for Analysis 15.9.3.3.1 Normal Operations Operations subsequent to an incident (transient, accident, or additional plant capability event) are not considered planned operations until the actions taken or equipment used in the plant are identical to those that would be used had the incident not occurred. As defined, planned operations can be considered in the following chronological sequence: refueling outage, achieving criticality, heatup, power operation, achieving shutdown, cooldown, refueling outage.

For the analyses in Section 15.9, the normal operations events are defined as follows:

a. Refueling Outage: Includes all the planned operations associated with a normal refueling outage except those tests in which the reactor is taken critical and returned to the shutdown condition. The following planned operations are included in a refueling outage:

1. Planned, physical movement of core components (fuel, control rods, etc.)

2. Refueling test operations (except criticality and shutdown margin tests)

3. Planned maintenance

4. Required inspection

b. Achieving Criticality: Includes all plant actions normally accomplished in bringing the plant from a condition in which all control rods are fully inserted to a condition in which nuclear criticality is achieved and maintained.

c. Heatup: Begins when achieving criticality ends and includes all plant actions normally accomplished in approaching nuclear system rated temperature and pressure by using nuclear power (reactor critical). Heatup extends through warmup and synchronization of the main turbine-generator.

d. Power Operation: Begins when heatup ends and includes continued plant operation at power levels in excess of heatup power.

e. Achieving Shutdown: Begins when the main generator is unloaded and includes all plant actions normally accomplished in achieving nuclear shutdown (more than one rod subcritical) following power operation.

f. Cooldown: Begins when achieving nuclear shutdown ends and includes all plant actions normal to the continued removal of decay heat and the reduction of reactor temperature and pressure.

The exact point at which some of the planned operations end and others begin cannot be precisely determined. It will be shown later that such precision is not required, because the protection requirements are adequately defined in passing from one state to the next. Dependence of several planned operations on the one rod subcritical condition provides an exact point on either side of which protection (especially scram) requirements differ. Thus, where a precise boundary between planned operations is needed, the definitions provide the needed precision.

CHAPTER 15 15.9-9 REV. 20, SEPTEMBER 2020

LGS UFSAR Together, BWR operating states and planned operations define the full spectrum of conditions from which transients, accidents, and special events are initiated. The BWR operating states define only the physical condition (pressure, temperature, etc.) of the reactor; the planned operations define the condition of the plant. The separation of physical conditions from the operation being performed is deliberate and facilitates careful consideration of all possible initial conditions from which incidents may occur.

15.9.3.3.2 Anticipated Operational Transients To select anticipated operational transients, eight nuclear system parameter variations are considered as potential initiating causes of threats to the fuel and the RCPB. The parameter variations are as follows:

a. Reactor coolant pressure increase

b. Reactor coolant (moderator) temperature decrease

c. Control rod withdrawal

d. Reactor coolant inventory decrease

e. Reactor coolant flow decrease

f. Reactor coolant flow increase

g. Reactor coolant temperature increase

h. Reactor coolant inventory increase These parameter variations, if uncontrolled, could result in damage to the reactor fuel or RCPB or both. A nuclear system pressure increase threatens to rupture the RCPB from internal pressure. A pressure increase also collapses voids in the moderator, causing an insertion of positive reactivity that threatens fuel damage as a result of overheating. A reactor coolant temperature decrease results in an insertion of positive reactivity as density increases. This could lead to fuel overheating. Positive reactivity insertions are possible from causes other than nuclear system pressure or moderator temperature changes; such reactivity insertions threaten fuel damage caused by overheating. Both reactor coolant inventory decrease and a reduction in coolant flow through the core threaten the integrity of the fuel. An increase in coolant flow through the core reduces the void content of the moderator and results in an insertion of positive reactivity. Core coolant temperature increase threatens the integrity of the fuel; such a variation could be the result of a heat exchanger malfunction during operation in the shutdown cooling mode. An excess of coolant inventory could be the result of malfunctioning water level control equipment; such a malfunction can result in a turbine trip, which causes an expected increase in nuclear system pressure and power.

Anticipated operational transients are defined as transients resulting from an single active component failure or single operator error that can be reasonably expected (moderate probability of occurrence, once per day to once in 20 years) during any mode of plant operation. Examples of single operational failures or operator errors in this range of probability are:

CHAPTER 15 15.9-10 REV. 20, SEPTEMBER 2020

LGS UFSAR

a. Opening or closing any single valve (a check valve is not assumed to close against normal flow).

b. Starting or stopping any single component.

c. Malfunction or maloperation of any single control device.

d. Any single electrical failure.

e. Any single operator error.

An operator error is defined as an active deviation from nuclear plant standard operating practices.

A single operator error is the set of actions that is a direct consequence of a single reasonably expected erroneous decision. The set of actions is limited as follows:

a. Those that could be performed by only one person.

b. Those that would have constituted a correct procedure had the initial decision been correct.

c. Those that are subsequent to the initial operator error and that affect the designed operation of the plant, but are not necessarily directly related to the operator error.

Examples of single operator errors are as follows:

a. An increase in power above the established flow control power limits by control rod withdrawal in the specified sequences while observing all normal core power distribution related fuel thermal limits.

b. The selection and complete withdrawal of a single control rod out-of-sequence.

c. An incorrect calibration of an APRM.

d. Manual isolation of the main steam lines caused by operator misinterpretation of an alarm or indication.

The various types of single active component failure or single operator error are applied to various plant systems, with consideration for a variety of plant conditions, to discover events directly resulting in an undesired parameter variation. Once discovered, each event is evaluated for the threat it poses to the integrity of the radioactive material barriers.

15.9.3.3.3 Abnormal Operational Transients To select abnormal operational transients, eight nuclear system parameter variations are considered as potential initiating causes of gross corewide fuel failures and threats to the RCPB.

The parameter variations are as follows:

a. Reactor coolant pressure increase

b. Reactor coolant (moderator) temperature decrease CHAPTER 15 15.9-11 REV. 20, SEPTEMBER 2020

LGS UFSAR

c. Control rod withdrawal

d. Reactor coolant inventory decrease

e. Reactor coolant flow decrease

f. Reactor coolant flow increase

g. Reactor coolant temperature increase

h. Reactor coolant inventory increase The eight parameter variations listed above include all effects within the nuclear system caused by abnormal operational transients that threaten gross corewide reactor fuel integrity, or seriously affect the reactor coolant pressure boundary. Variation of any one parameter may cause a change in another listed parameter; however, for analysis purposes, threats to barrier integrity are evaluated by groups according to the parameter variation originating the threat.

Abnormal operational transients are defined as incidents resulting from single or multiple equipment failures and/or single or multiple operator errors that are not reasonably expected (less than one event in 20 years to one in 100 years) during any mode of plant operation. Examples of single or multiple operational failures and/or single or multiple operator errors are:

a. Failure of major power generation equipment components.

b. Multiple electrical failures.

c. Multiple operator errors.

d. Combinations of equipment failure and an operator error.

Operator error is defined as an active deviation from nuclear plant standard operating practices. A multiple operator error is the set of actions that is a direct consequence of several unexpected erroneous decisions.

An example of multiple operator errors is inadvertent loading of a fuel assembly in an improper position and operating with the fuel assembly in an improper position.

The various types of single errors and/or single malfunctions are applied to various plant systems, with consideration for a variety of plant conditions, to discover events directly resulting in an undesired parameter variation. Once discovered, each event is evaluated for the threat it poses to the integrity of the various radioactive material barriers.

CHAPTER 15 15.9-12 REV. 20, SEPTEMBER 2020

LGS UFSAR 15.9.3.3.4 Design Basis Accidents Accidents are defined as hypothesized events that affect the radioactive material barriers and are not expected during plant operations. These are plant events, equipment failures, and combinations of initial conditions that are of extremely low probability (once in 100 years to once in 10,000 years). The postulated accident types considered are as follows:

a. Mechanical failure of a single component leading to the release of radioactive material from one or more barriers. The components referred to here are not those that act as radioactive material barriers. An example of mechanical failure is the breakage of the coupling between a CRD and the control rod.

b. Arbitrary rupture of any single pipe up to, and including, complete severance of the largest pipe in the RCPB. This kind of accident is considered only under conditions in which the nuclear system is pressurized.

For purposes of analysis, accidents are categorized as those events that result in releasing radioactive material (Tables 15.9-4 and 15.9-5):

a. From the fuel with the RCPB and reactor enclosure initially intact (Event 40).

b. Directly to the primary containment (Event 42).

c. Directly to the reactor, or turbine enclosures, with the primary containment initially intact (Events 40, 43, 44, 45, 50).

d. Directly to the reactor enclosure with the primary containment not intact (Events 41, 50).

e. Directly to the spent fuel-containing facilities (Events 41, 50).

f. Directly to the turbine enclosure (Events 46, 47).

g. Directly to the environs (Events 48, 49).

The effects of various accident types are investigated, with consideration for the full spectrum of plant conditions, to examine events that result in the release of radioactive material.

15.9.3.3.5 Special Events A number of additional events are evaluated to demonstrate plant capabilities relative to special arbitrary nuclear safety criteria. These special events involve extremely low probability situations.

As an example, the adequacy of the redundant reactivity control system is demonstrated by evaluating the special event: "reactor shutdown without control rods." Another similar example, the capability to perform a safe shutdown from outside the main control room, is demonstrated by evaluating the special event: "reactor shutdown from outside the main control room."

CHAPTER 15 15.9-13 REV. 20, SEPTEMBER 2020

LGS UFSAR 15.9.3.4 Applicability of Events to Operating States The first step in performing an operational analysis for a given incident (transient, accident, or special event) is to determine in which operating states the incident can occur. An incident is considered applicable within an operating state if the incident can be initiated from the physical conditions that characterize the operating state. Applicability of the "normal operations" to the operating states follows from the definitions of planned operations. A planned operation is considered applicable within an operating state if the planned operation can be conducted when the reactor exists under the physical conditions defining the operating state.

15.9.3.5 Guidelines for Event Analysis Functional guidelines followed in performing single active component failure, operational, and design basis analyses for the various plant events are listed below:

a. An action, system, or limit shall be considered essential only if it is essential to avoid an unacceptable result or satisfy the nuclear safety operational criteria.

b. The full range of initial conditions (as defined in (c) below) shall be considered for each event analyzed so that all essential protection sequences are identified.

Consideration is not limited to worst cases, because lesser cases sometimes may require more restrictive actions or systems different from those of the worst cases.

c. The initial conditions for transients, accidents, and special events shall be limited to conditions that would exist during planned operations in the applicable operating state.

d. For normal operations, consideration shall be made only for actions, limits, and systems essential to avoid the unacceptable consequences during operation in that state (as opposed to transients, accidents, and special events that are followed through to completion). Normal operations are treated differently from other events, because the transfer from one state to another during planned operations is deliberate. For events other than normal operations, the transfer from one state to another may be unavoidable.

e. Limits shall be derived only for those essential parameters that are continuously available for monitoring. Parameter limits associated with the required performance of an essential system are considered to be included in the requirement for the operability of the system. Limits on frequently monitored process parameters are called "envelope limits," and limits on parameters associated with the operability of a safety system are called "operability limits." Systems associated with the control of the envelope parameters are considered nonessential if it is possible to place the plant in a safe condition without using the system in question.

f. For transients, accidents, and special events, consideration shall be made for the entire duration of the event and aftermath until some planned operation is resumed.

Normal operation is considered resumed when the procedures being followed or equipment being used are identical to those used during any one of the defined planned operations. Where extended core cooling is an immediate integral part of the event, it will be included in the protection sequence. Where it may be an CHAPTER 15 15.9-14 REV. 20, SEPTEMBER 2020

LGS UFSAR eventual part of the event, it will not be directly added but can be implied to be available.

g. Credit for operator action shall be taken on a case-by- case basis depending on the conditions that would exist at the time operator action would be required. Because transients, accidents, and special events are considered through the entire duration of the event until normal operation is resumed, manual operation of certain systems is sometimes required following the more rapid or automatic portions of the event.

Credit for operator action is taken only when the operator can reasonably be expected to accomplish the required action under the existing conditions.

h. For transients, accidents, and special events, only those actions, limits, and systems shall be considered essential for which there arises a unique requirement as a result of the event. For instance, if a system that was operating prior to the event (during planned operation) is to be employed in the same manner following the event, and if the event did not affect the operation of the system, then the system would not appear on the protection sequence diagram.

i. The operational analyses shall identify all the support or auxiliary systems essential to the functioning of the front-line safety systems. Safety system auxiliaries whose failure results in safe failure of the front line safety systems shall be considered nonessential.

j. A system or action that plays a unique role in the response to a transient, accident, or special event shall be considered essential unless (1) the effects of the system or action are not included in the detailed analysis of the event or (2) unless failure of the system or action results in an overall event probability less frequent than that within which the initiating event is categorized.

15.9.3.6 Steps in an Operational Analysis All information needed to perform an operational analysis for each plant event has been presented (Figure 15.9-1). The procedure followed in performing an operational analysis for a given event (selected according to the event selection criteria) is as follows:

a. Determine the BWR operating states in which the event is applicable.

b. Identify all the essential protection sequences (safety actions and front-line safety systems) for the event in each applicable operating state.

c. Identify all the auxiliary systems essential to the functioning of the front-line safety systems.

The preceding three steps are performed in Section 15.9.6. To derive the operational requirements and Technical Specifications for the individual components of a system included in any essential protection sequence, the following steps are taken:

a. Identify all the essential actions within the system (intrasystem actions) necessary for the system to function to the degree necessary to avoid the unacceptable consequences.

CHAPTER 15 15.9-15 REV. 20, SEPTEMBER 2020

LGS UFSAR

b. Identify the minimum hardware conditions necessary for the system to accomplish the minimum intrasystem actions.

c. If the single failure criterion applies, identify the additional hardware conditions necessary to achieve the plant safety actions (scram, pressure relief, isolation, cooling, etc.) in spite of single failures. This step gives the nuclear safety operational requirements for the plant components so identified.

d. Identify surveillance requirements and allowable out-of- service times for the essential plant hardware (Section 15.9.5).

e. Simplify the operational requirements determined in steps (c) and (d), so that Technical Specifications may be obtained that encompass the true operational requirements and are easily used by plant operations and management personnel.

15.9.4 DISPLAY OF OPERATIONAL ANALYSIS RESULTS 15.9.4.1 General To fully identify and establish the requirements, restrictions, and limitations that must be observed during plant operation, plant systems and components must be related to the needs for their actions in satisfying the nuclear safety operational criteria. This section displays these relationships in a series of block diagrams.

Tables 15.9-1 through 15.9-5 and Table 15.9-11 indicate in which operating states each event is applicable. For each event, a block diagram is presented showing the conditions and systems required to achieve each essential safety action. The block diagrams show only those systems necessary to provide the safety actions so that the nuclear safety operational and design basis criteria are satisfied. The total plant capability to provide a safety action generally is not shown; only the minimum capability essential to satisfy the operational criteria is shown. Only enough protective equipment is cited in the diagram to provide the necessary action. Many events can utilize many more paths to success than are shown. Operational analyses involve the minimum equipment needed to prevent or avert an unacceptable consequence. Thus, the diagrams depict all essential protection sequences for each event with the least amount of protective equipment needed. Once all of the these protection sequences are identified in block diagram form, system requirements are derived by considering all events in which the particular system is employed.

The analysis considers the following conceptual aspects:

a. The BWR operating state.

b. Types of operations or events that are possible within the operating state.

c. Relationships of certain safety actions to the unacceptable consequences and to specific types of operations and events.

d. Relationships of certain systems to safety actions, and to specific types of operations and events.

e. Supporting or auxiliary systems essential to the operation of the front-line safety systems.

CHAPTER 15 15.9-16 REV. 20, SEPTEMBER 2020

LGS UFSAR

f. Functional redundancy. (The single failure criterion applied at the safety action level. This is, in effect, a qualitative system level, FMEA-type analysis.)

Each block in the sequence diagrams represents a finding of essentiality for the safety action, system, or limit under consideration. Essentiality in this context means that the safety action, system, or limit is needed to satisfy the nuclear safety operational criteria. Essentiality is determined through an analysis in which the safety action, system, or limit being considered is completely disregarded in the analyses of the applicable operations or events. If the nuclear safety operational criteria are satisfied without the safety action, system, or limit, then the safety action, system, or limit is not essential, and no operational nuclear safety requirement would be indicated.

When disregarding a safety action, system, or limit results in violating one or more nuclear safety operational criteria, the safety action, system, or limit is considered essential, and the resulting operational nuclear safety requirements can be related to specific criteria and unacceptable consequences.

15.9.4.2 Protection Sequence and Safety System Auxiliary Diagrams Block diagrams illustrate essential protection sequences for each event requiring unique safety actions. These protection sequence diagrams show only the required front-line safety systems.

The format and conventions used for these diagrams are shown in Figure 15.9-4.

The auxiliary systems essential to the correct functioning of the front-line safety systems are shown on safety system auxiliary diagrams. The format used for these diagrams is shown in Figure 15.9-5. The diagram indicates that auxiliary systems A, B, and C are required for proper operation of front-line safety system X.

With these three types of diagrams, it is possible to determine for each system the detailed functional requirements and conditions to be observed regarding system hardware in each operating state. The detailed conditions to be observed regarding system hardware include such nuclear safety operational requirements as test frequencies and the number of components that must be operable.

15.9.5 BASES FOR TECHNICAL SPECIFICATIONS 15.9.5.1 Surveillance Test Requirements After the nuclear safety systems and engineered safeguards have been identified by applying the nuclear safety operational criteria, surveillance requirements are established for the safety systems. The purpose of surveillance requirements is to assure, at appropriate intervals, that a failure or failures have not occurred in a safety system while that system is in the standby mode.

The appropriate surveillance interval is determined by consideration of the effect of system unavailability on plant safety and the effect of testing on plant safety.

15.9.5.2 Limiting Condition for Operation Required operating conditions for safety systems, including number of operable channels, minimum or maximum setpoints, and other performance factors are established. If a safety system is found to be in a Limiting Condition for Operation, specified corrective action must be taken.

CHAPTER 15 15.9-17 REV. 20, SEPTEMBER 2020

LGS UFSAR 15.9.5.3 Maximum Allowable Out-of-Service Time When a safety system does not meet the specified Limiting Condition for Operation, the system should be repaired, retested, and returned to service as quickly as possible consistent with good maintenance practice. A maximum allowable out-of-service time is specified, after which time the specified corrective action must be taken to place the plant in a safer mode of operation. If the nature of the failed condition is such that it is apparent that repair will require longer than the allowable out-of-service time, the specified action should be taken immediately. The maximum allowable out-of-service time is determined by consideration of the effect of the out-of-service condition on plant safety and the effect of the specified corrective action on plant safety. As a general rule, the reactor should not be scrammed for an out-of-service condition, and the maximum allowable out-of-service time should be at least 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months if the specified corrective action is plant shutdown. Other considerations include the need for a reasonable time for repair based on experienced or projected mean time to repair and resources involved in taking the specified corrective action.

15.9.6 OPERATIONAL ANALYSES Results of the operational analyses are discussed in the following paragraphs and displayed in Figures 15.9-7 through 15.9-12 and Tables 15.9-1 through 15.9-5.

15.9.6.1 Safety System Auxiliaries Figures 15.9-7 and 15.9-8 show the safety system auxiliaries essential to the functioning of each front-line safety system.

15.9.6.2 Normal Operations 15.9.6.2.1 General Requirements for the normal or planned operations normally involve limits (L) on certain key process variables and restrictions (R) on certain plant equipment. The control block diagrams for each operating state (Figures 15.9-9 through 15.9-12) show only those controls necessary to avoid unacceptable safety consequences 1-1 through 1-4 of Table 15.9-6.

Following is a description of the planned operations (Events 1 through 6) as they pertain to each of the four operating states. The description of each operating state contains a definition of that state, a list of the planned operations that apply to that state, and a list of the safety actions that are required to avoid the unacceptable safety consequences.

15.9.6.2.2 Event Definitions

a. Event 1 - Refueling Outage Refueling outage includes all the planned operations associated with a normal refueling outage except those tests in which the reactor is made critical and returned to the shutdown condition. The following planned operations are included in refueling outage:

1. Planned, physical movement of core components (fuel, control rods, etc.)

CHAPTER 15 15.9-18 REV. 20, SEPTEMBER 2020

LGS UFSAR

2. Refueling test operations (except criticality and shutdown margin tests)

3. Planned maintenance

4. Required inspection

b. Event 2 - Achieving Criticality Achieving criticality includes all the plant actions normally accomplished in bringing the plant from a condition in which all control rods are fully inserted to a condition in which nuclear criticality is achieved and maintained.

c. Event 3 - Heatup Heatup begins where achieving criticality ends and includes all plant actions normally accomplished in approaching nuclear system-rated temperature and pressure by using nuclear power (reactor critical). Heatup extends through warmup and synchronization of the main turbine-generator.

d. Event 4 - Power Operation Power operation begins where heatup ends and includes plant operation at power levels in excess of heatup power and at steady-state operation. It also includes plant maneuvers such as:

1. Electrical load reduction and recoveries

2. Electrical grid frequency control adjustment

3. Control rod movements

4. Power generation surveillance testing involving:

(a) Turbine stop valve closing (b) Turbine control valve adjustments (c) MSIV exercising

e. Event 5 - Achieving Shutdown Achieving shutdown begins where the main generator is unloaded and includes all plant actions normally accomplished in achieving nuclear shutdown (more than one rod subcritical) following power operation.

f. Event 6 - Reactor Cooldown Cooldown begins where achieving shutdown ends and includes all plant actions normal to the continued removal of decay heat and the reduction of nuclear system temperature and pressure.

CHAPTER 15 15.9-19 REV. 20, SEPTEMBER 2020

LGS UFSAR 15.9.6.2.3 Required Safety Actions/Related Unacceptable Consequences The following paragraphs describe the safety actions for planned operations. Each description includes a selection of the operating states that apply to the safety action, the plant system affected by limits or restrictions, and the unacceptable consequence that is avoided. The four operating states are defined in Table 15.9-11. The unacceptable consequences criteria are tabulated in Table 15.9-6.

15.9.6.2.3.1 Radioactive Material Release Control Radioactive materials may be released to the environs in any operating state; therefore, radioactive material release control is required in all operating states. Because of the significance of preventing excessive release of radioactive materials to the environs, this is the only safety action for which monitoring systems are explicitly shown. Limits are expressed on the gaseous, liquid, and solid radwaste systems, so that the planned releases of radioactive materials comply with the limits given in 10CFR20, 10CFR50, and 10CFR71 (related unacceptable safety result 1-1).

15.9.6.2.3.2 Core Coolant Flow Rate Control In State D, when above approximately 10% rated power, the core coolant flow rate must be maintained above certain minimums (i.e., limited) to maintain the integrity of the fuel cladding (1-2) and ensure the validity of the plant safety analysis (1-4).

15.9.6.2.3.3 Core Power Level Control The plant safety analyses of accidental positive reactivity additions have assumed as an initial condition that the neutron source level is above a specified minimum. Because a significant positive reactivity addition can only occur when the reactor is less than one rod subcritical, the assumed minimum source level need be observed only in States B and D. The minimum source level assumed in the analyses has been related to the counts/sec readings on the SRMs; thus, this minimum power level limit on the fuel is expressed as a required SRM count level. Observing the limit ensures the validity of the plant safety analysis (1-4). The count rate limit is conservatively applied to the ALL RODS INSERTED condition prior to initial control rod withdrawal. Any expected ALL RODS INSERTED count rate within the SRM monitoring range will fully satisfy the safety analysis criteria for noncritical initiating conditions. Maximum core power limits are also expressed for operating States B and D to maintain fuel integrity (1-2) and remain below the maximum power levels assumed in the plant safety analysis (1-4).

15.9.6.2.3.4 Core Neutron Flux Distribution Control Core neutron flux distribution must be limited in State D; otherwise, core power peaking could result in fuel failure (1-2). Additional limits are expressed in this state, because the core neutron flux distribution must be maintained within the envelope of conditions considered by plant safety analysis (1-4).

15.9.6.2.3.5 Reactor Vessel Water Level Control In any operating state, the reactor vessel water level could, unless controlled, drop to a level that will not provide adequate core cooling; therefore, reactor vessel water level control applies to all operating states. Observation of the RPV water level limits protects against fuel failure (1-2) and ensures the validity of the plant safety analysis (1-4).

CHAPTER 15 15.9-20 REV. 20, SEPTEMBER 2020

LGS UFSAR 15.9.6.2.3.6 Nuclear System Pressure Control System pressure control is not needed in States A and B, because vessel pressure cannot be increased above atmospheric pressure. In State C, a limit is expressed on the reactor vessel to ensure that it is not hydrostatically tested until the temperature is above the NDTT plus 60F; this prevents excessive stress (1-3). Also, in States C and D a limit is expressed on the RHR system to ensure that it is not operated in the shutdown cooling mode when the RPV pressure is greater than the RHR shutdown cooling interlock pressure; this prevents excessive stress (1-3). In States C and D, a limit on the RPV pressure is necessitated by the plant safety analysis (1-4).

15.9.6.2.3.7 Nuclear System Temperature Control In operating States C and D, a limit is expressed on the reactor vessel to prevent the reactor vessel head bolting studs from being in tension when the temperature is less than the minimum bolt-up temperature to avoid excessive stress (1-3) on the reactor vessel flange. This limit does not apply in States A and B, because the head will not be bolted in place during criticality tests or refueling.

In all operating states, a limit is expressed on the reactor vessel to prevent an excessive rate of change of the reactor vessel temperature to avoid excessive stress (1-3). In States C and D, where it is planned operation to use the feedwater system, a limit is placed on the reactor fuel, so that the feedwater temperature is maintained within the envelope of conditions considered by the plant safety analysis (1-4). For State D, a limit is placed on the temperature difference between the recirculation system and the reactor vessel to prevent the starting of the recirculation pumps when a large differential temperature exists. This operating restriction and limit prevents excessive stress in the reactor vessel (1-3).

15.9.6.2.3.8 Nuclear System Water Quality Control In all operating states, water of improper chemical quality could produce excessive stress as a result of chemical corrosion (1-3). Therefore, a limit is placed on reactor coolant chemical quality in all operating states. For all operating states where the nuclear system can be pressurized (States C and D), an additional limit on reactor coolant activity ensures the validity of the analysis of the main steam line break accident (1-4).

15.9.6.2.3.9 Nuclear System Leakage Control Because excessive nuclear system leakage could occur only while the reactor vessel is pressurized, limits are applied only to the reactor vessel in States C and D. Observing these limits prevents vessel damage due to excessive stress (1-3) and ensures the validity of the plant safety analysis (1-4).

15.9.6.2.3.10 Core Reactivity Control In State A, during refueling outages, a limit is imposed on core loading (fuel) to ensure that core reactivity is maintained within the envelope of conditions considered by the plant safety analysis (1-4). In all states, limits are imposed on the control rod drive system to ensure adequate control of core reactivity, so that core reactivity remains within the envelope of conditions considered by the plant safety analysis (1-4).

CHAPTER 15 15.9-21 REV. 20, SEPTEMBER 2020

LGS UFSAR 15.9.6.2.3.11 Control Rod Worth Control Any time the reactor is not shut down and is generating less than the low power setpoint (State D),

a limit is imposed on the control rod pattern to ensure that control rod worth is maintained within the envelope of conditions considered by the analysis of the control rod-drop accident (1-4).

15.9.6.2.3.12 Refueling Restriction By definition, planned operation Event 1 (refueling outage) applies only to State A. Observing the restrictions on the reactor fuel and on the operation of the CRD system within the specified limit maintains plant conditions within the envelope considered by the plant safety analysis (1-4).

15.9.6.2.3.13 Primary Containment Pressure and Temperature Control In States C and D, limits are imposed on the primary containment pressure and suppression pool temperature to maintain pressure and temperature within the envelope considered by plant safety analysis (1-4). These limits ensure an environment in which instruments and equipment can operate correctly within the drywell. Limits on the pressure-suppression pool apply to the water temperature and water level to ensure that it has the capability of absorbing the energy discharged during an SRV blowdown or a LOCA.

15.9.6.2.3.14 Stored Fuel Shielding, Cooling, and Reactivity Control Because both new and spent fuel will be stored during all operating states, stored fuel shielding, cooling, and reactivity control apply to all operating states. Limits are imposed on the spent fuel pool storage positions, water level, fuel handling procedures, and water temperature. Observing the limits on fuel storage positions ensures that spent fuel reactivity remains within the envelope of conditions considered by the plant safety analysis (1-4). Observing the limits on water level ensures shielding in order to maintain conditions within the envelope of conditions considered by the plant safety analysis (1-4), and provides the fuel cooling necessary to avoid fuel damage (1-2).

Observing the limit on water temperature avoids excessive fuel pool stress (1-3).

15.9.6.2.4 Operational Safety Evaluations

a. State A In State A, the reactor is in a shutdown condition, the vessel head is off, and the vessel is at atmospheric pressure. The applicable events for planned operations are refueling outage, achieving criticality, and cooldown (Events 1, 2, and 6, respectively).

Figure 15.9-9 shows the necessary safety actions for planned operations, corresponding plant systems, and the event for which these actions are necessary.

As indicated in the diagram, the required safety actions are as follows:

1. Radioactive material release control

2. Reactor vessel water level control

3. Nuclear system temperature control CHAPTER 15 15.9-22 REV. 20, SEPTEMBER 2020

LGS UFSAR

4. Nuclear system water quality control

5. Core reactivity control

6. Refueling restrictions

7. Stored fuel shielding, cooling, and reactivity control

b. State B In State B, the reactor vessel head is off, the reactor is not shutdown, and the vessel is at atmospheric pressure. Applicable planned operations are achieving criticality and shutdown (Events 2 and 5, respectively).

Figure 15.9-10 relates the necessary safety actions for planned operations, plant systems, and the event for which the safety actions are necessary. The required safety actions for planned operation in State B are as follows:

1. Radioactive material release control

2. Core power level control

3. Reactor vessel water level control

4. Nuclear system temperature control

5. Nuclear system water quality control

6. Core reactivity control

7. Rod worth control

8. Stored fuel shielding, cooling, and reactivity control

c. State C In State C, the reactor vessel head is on and the reactor is shut down. Applicable planned operations are achieving criticality and cooldown (Events 2 and 6, respectively).

Sequence diagrams relating safety actions for planned operations, plant systems, and applicable events are shown in Figure 15.9-11. The required safety actions for planned operation in State C are as follows:

1. Radioactive material release control

2. Reactor vessel water level control

3. Nuclear system pressure control

4. Nuclear system temperature control CHAPTER 15 15.9-23 REV. 20, SEPTEMBER 2020

LGS UFSAR

5. Nuclear system water quality control

6. Nuclear system leakage control

7. Core reactivity control

8. Primary containment pressure and temperature control

9. Stored fuel shielding, cooling, and reactivity control

d. State D In State D, the reactor vessel head is on and the reactor is not shut down.

Applicable planned operations are achieving criticality, heatup, power operation, and shutdown (Events 2, 3, 4, and 5, respectively).

Figure 15.9-12 relates safety actions for planned operations, corresponding plant systems, and events for which the safety actions are necessary. The required safety actions for planned operation in State D are as follows:

1. Radioactive material release control

2. Core coolant flow rate control

3. Core power level control

4. Core neutron flux distribution control

5. Reactor vessel water level control

6. Nuclear system pressure control

7. Nuclear system temperature control

8. Nuclear system water quality control

9. Nuclear system leakage control

10. Core reactivity control

11. Rod worth control

12. Primary containment pressure and temperature control

13. Stored fuel shielding, cooling, and reactivity control CHAPTER 15 15.9-24 REV. 20, SEPTEMBER 2020

LGS UFSAR 15.9.6.3 Anticipated Operational Transients 15.9.6.3.1 General The safety requirements and protection sequences for anticipated operational transients are described in the following paragraphs for Events 7 through 29. The protection sequence block diagrams show the sequence of front-line safety systems. (Figures 15.9-13 through 15.9-34 and 15.9-36). The auxiliaries for the front-line safety system are indicated in the auxiliary diagrams (Figures 15.9-7 and 15.9-8).

15.9.6.3.2 Required Safety Actions/Related Unacceptable Consequences Safety actions for anticipated operational transients that mitigate or prevent the unacceptable safety consequences are listed below. Refer to Table 15.9-7 for the unacceptable consequences criteria.

Related Unacceptable Consequence Safety Action Criteria Reason Action Required Scram and/or RPT 2-2 To prevent fuel damage and limit 2-3 nuclear system pressure rise Pressure relief 2-3 To prevent excessive nuclear system pressure rise Core and 2-1 To prevent fuel and primary primary 2-2 containment damage in the event containment 2-4 that normal cooling is cooling interrupted Reactor 2-2 To prevent fuel damage by reducing the outflow of vessel steam and water from the reactor vessel, thereby isolation limiting the decrease in reactor vessel water level Restore ac 2-2 To prevent fuel damage by restoring ac power power to systems essential to other safety actions Prohibit rod 2-2 To prevent exceeding fuel limits during transients motion Primary 2-1 To minimize radiological effects containment 2-4 isolation 15.9.6.3.3 Event Definitions and Operational Safety Evaluations

a. Event 7 - Manual and Inadvertent Scram The deliberate manual or inadvertent automatic scram due to single operator error is an event that can occur under any operating condition. Although assumed to CHAPTER 15 15.9-25 REV. 20, SEPTEMBER 2020

LGS UFSAR occur here for examination purposes, multiple operator error or action is necessary to initiate such an event.

While all the safety criteria apply, no unique safety actions are required to control the planned operation-like event after effects of the subject initiation actions. In all operating states, therefore, the safety criteria are met through the basic design of the plant systems. Figure 15.9-13 identifies the protection sequences for this event.

b. Event 8 - Loss of Plant Instrument/Service Air System Loss of the plant instrument and service air systems causes reactor shutdown and the closure of MSIVs. Although these actions occur, they are not a requirement to prevent unacceptable consequences in themselves. Multiple equipment failures would be necessary to cause the deterioration of the subject system to the point that the components supplied with instrument or service air would cease to operate normally and/or fail-safe. The resulting actions are identical to Event 14 described later.

Isolation of the main steam lines can result in a transient for which some degree of protection is required only in operating States C and D. In operating States A and B, the main steam lines are normally isolated.

The effect of isolation of all main steam lines is most severe in operating State D during power operation.

Figures 15.9-14 and 15.9-21 show how scram is accomplished by main steam line isolation through the actions of the RPS and CRD system. The MSRV system provides pressure relief. Pressure relief, combined with loss of feedwater flow, causes reactor vessel water level to fall. Either HPCI or RCIC supplies water to maintain water level and protect the core until normal steam flow (or other planned operation) is established.

Adequate reserve pneumatic supplies are maintained exclusively for the continual operation of the ADS SRVs until reactor shutdown is accomplished.

c. Event 9 - Inadvertent NSSS Pump Start (Moderator Temperature Decrease)

An inadvertent pump start (temperature decrease) is defined as an unintentional start of any NSSS pump that adds sufficient cold water to the reactor coolant inventory to cause a measurable decrease in moderator temperature. This event is considered in all operating states, because it can potentially occur under any operating condition. Since the HPCI pump operates over nearly the entire range of the operating states and delivers by far the greatest amount of cold water to the vessel, the following analysis will describe its inadvertent operation rather than other NSSS pumps (e.g., RCIC, RHR, core spray).

While all the safety criteria apply, no unique safety actions are required to control the adverse effects of such a pump start (i.e., pressure increase and temperature decrease in States A and C). In these operating states, the safety criteria are met through the basic design of the plant systems, and no safety action is specified. In States B and D, where the reactor is not shut down, the operator or the plant's CHAPTER 15 15.9-26 REV. 20, SEPTEMBER 2020

LGS UFSAR normal control system can control any power changes in the normal manner of power control.

Figure 15.9-15 illustrates the protection sequence for the subject event. Single failures to the plant's normal control system pressure regulator or the feedwater controller systems will result in further protection sequences. These are shown in Events 22 and 23. The single failure aspects of their protection sequences will, of course, not be required.

d. Event 10 - Startup of Idle Recirculation Pump The cold loop startup of an idle recirculation pump can occur in any state. The attendant reactivity insertion effects are most severe and rapid for those operating states in which the reactor may be critical (States B and D). If the reactivity insertion is sufficient to require safety action, a high neutron flux signal (IRM or APRM) that exceeds the specified trip setpoint will occur.

As shown in Figure 15.9-16, the required safety action is accomplished through the combined actions of the NMS, RPS, and CRD system.

e. Event 11 - Recirculation Flow Control Failure (Increasing Flow)

A recirculation flow control failure causing increased flow is applicable in States C and D. In State D, the resulting increase in power level is limited by a reactor scram. As shown in Figure 15.9-17, the required safety action is accomplished through the combined actions of the NMS, RPS, and CRD system.

f. Event 12 - Recirculation Flow Control Failure (Decreasing Flow)

This recirculation flow control malfunction causes a decrease in core coolant flow.

This event is not applicable to States A and B, because the reactor vessel head is off and the recirculation pumps normally would not be in use.

The number and type of flow controller failure modes determine the protection sequence for the event. ASD controller failures (for one or both ASD trains will result in a transient bounded by the previous transient associated with the original configuration for the MG set controller failures (a transient bounded by one or two RPT transients (Figure 15.9-18)).

g. Event 13 - Trip of One or Both Recirculation Pumps The trip of one recirculation pump produces a milder transient than does the simultaneous trip of two recirculation pumps.

The transient resulting from this two-loop trip is not severe enough to require any unique safety action. The transient is compensated for by the inherent nuclear stability of the reactor. This event is not applicable in States A and B, because the reactor vessel head is off and the recirculation pumps normally would not be in use.

Figure 15.9-19 provides the protection sequence for the event for one or both pump trip actuations for States C and D.

CHAPTER 15 15.9-27 REV. 20, SEPTEMBER 2020

LGS UFSAR This event constitutes an acceptable operational technique to reduce or minimize the effects of other event conditions. To this end, an engineered recirculation pump trip capability is included in the plant design to reduce pressure and thermal-hydraulic transient effects.

A two-pump trip can result in a high water level trip of the main turbine, which further causes a stop valve closure and its subsequent scram actuation.

Containment isolation occurs and RCIC/HPCI systems initiate on low water level.

Relief valve actuation will follow.

h. Event 14 - Isolation of One or All Main Steam Lines Isolation of the main steam lines can result in a transient for which some degree of protection is required only in operating States C and D. In operating States A and B, the main steam lines are normally isolated.

Isolation of all main steam lines is most severe and rapid in operating State D during power operation.

Figure 15.9-20 shows how a scram is initiated by main steam line isolation triggering the actions of the RPS and CRD systems. The MSRV system provides pressure relief. Pressure relief, combined with loss of feedwater flow, causes reactor vessel water level to fall and either HPCI or RCIC supply water to maintain water level and protect the core until adequate long-term cooling is established.

Isolation of one main steam line causes a significant transient only in State D during operation above approximately 90% power. If the feedwater system and main condenser remain in operation following the event, no unique requirement arises for core cooling.

As shown in Figure 15.9-21, the required safety action is accomplished.

i. Event 15 - Inadvertent Opening of an MSRV The inadvertent opening of an MSRV is only possible in operating States C and D.

In State C the water level cannot be lowered far enough to threaten fuel damage; therefore, no safety actions are required. The protection sequences in State D are shown in Figure 15.9-22.

In State D, there is a slight decrease in reactor pressure following the event. The pressure regulator closes the main turbine control valves enough to stabilize pressure at a level slightly below the initial value. There are no unique safety system requirements for this event.

j. Event 16 - Control Rod Withdrawal Error For Refueling and Startup Operations Because a control rod withdrawal error resulting in an increase of positive reactivity can occur under any operating condition, it must be considered in all operating states. For this specific event situation, only States A and B apply.

CHAPTER 15 15.9-28 REV. 20, SEPTEMBER 2020

LGS UFSAR

1. Refueling No unique safety action is required in operating State A for the withdrawal of one control rod, because the core is more than one control rod subcritical.

Withdrawal of more than one control rod is precluded by the protection sequence shown in Figure 15.9-23. During core alterations, the mode switch is normally in the REFUEL position, which allows the refueling equipment to be positioned over the core and also inhibits control rod withdrawal. Therefore, this transient applies only to operating State A.

No safety action is required, because the total worth (positive reactivity) of one fuel assembly or control rod is not adequate to cause criticality.

Moreover, mechanical design of the control rod assembly prevents physical removal without removing the adjacent fuel assemblies.

2. Startup During low power operation, the NMS via the RPS will initiate scram if necessary (Figure 15.9-23).

k. Event 17 - Control Rod Withdrawal Error (During Power Operation)

Because a control rod withdrawal error resulting in an increase of positive reactivity can occur under any operating condition, it must be considered in all operating states. For this specific event situation, only States C and D apply.

During power operation (State D), a number of plant protective devices of various designs prohibit the control rod motion before critical levels are reached (Figure 15.9-24).

Below the low power setpoint, the selection of an out- of-sequence rod movement is prevented by the RWM which uses banked position withdrawal sequences. In addition, the movement of the rod is monitored and limited within acceptable intervals either by neutronic effects or actual rod motion. The RBM provides movement surveillance. Beyond these rod motion control limits are the fuel/core scram protection systems.

While in State C, no protection action is needed.

l. Event 18 - Loss of Shutdown Cooling The loss of RHR system shutdown cooling can occur only during the low pressure portion of a normal reactor shutdown and cooldown.

As shown in Figure 15.9-25, for most single failures that could result in primary loss of shutdown cooling capabilities, no unique safety actions are required; in these cases, shutdown cooling is simply re-established using redundant shutdown cooling equipment. In the cases where the RHR shutdown cooling suction line becomes inoperative, a unique arrangement for cooling arises. In States A and B, in which the reactor vessel head is off, the LPCI and CS can be used to maintain RPV water level. In State C, in which the reactor vessel head is on and the system can be CHAPTER 15 15.9-29 REV. 20, SEPTEMBER 2020

LGS UFSAR pressurized, the ADS or manual operation of relief valves in conjunction with any of the ECCS and the RHR suppression pool cooling mode (both manually operated) can be used to maintain water level and remove decay heat. Suppression pool cooling is actuated to remove heat energy from the suppression pool system.

m. Event 19 - RHR Shutdown Cooling - Increased Cooling An RHR shutdown cooling malfunction causing a moderator temperature decrease must be considered in all operating states. However, this event is not considered in States C and D if nuclear system pressure is too high to permit operation of the RHR shutdown cooling (Figure 15.9-26). No unique safety actions are required to avoid the unacceptable safety consequences for transients as a result of a reactor coolant temperature decrease induced by misoperation of the shutdown cooling heat exchangers.

In States B and D, where the reactor is at or near critical, the slow power increase resulting from the cooler moderator temperature would be controlled by the operator in the same manner normally used to control power in the source or intermediate power ranges.

n. Event 20 - Loss of All Feedwater Flow A loss of feedwater flow results in a net decrease in the coolant inventory available for core cooling. A loss of feedwater flow can occur in States C and D. Appropriate responses to this transient include a reactor scram on low water level and restoration of reactor vessel water level by HPCI and RCIC.

As shown in Figure 15.9-27, the RPS and CRD systems effect a scram on low water level. The PCRVICS acts to isolate the containment. Either the RCIC or HPCI system can maintain adequate water level for initial core cooling and to restore and maintain water level.

The requirements for operating State C are the same as for State D, except that the scram initiation is not required in State C.

o. Event 21 - Loss of a Feedwater Heater Loss of a feedwater heater must be considered with regard to the nuclear safety operational criteria only in operating State D, because significant feedwater heating does not occur in any other operating state.

A loss of feedwater heating transient causes a neutron flux increase that might reach the scram setpoint depending upon the degree of feedwater heating loss. As shown in Figure 15.9-28 required safety action is accomplished through actions of the NMS, RPS, and CRD system.

p. Event 22 - Feedwater Controller Failure (Maximum Demand)

A feedwater controller failure, causing an excess of coolant inventory in the reactor vessel, is possible in all operating states. Feedwater controller failures considered are those that would give failures of automatic or manual level controls. In CHAPTER 15 15.9-30 REV. 20, SEPTEMBER 2020

LGS UFSAR operating States A and B, no safety actions are required, since the vessel head is removed and the moderator temperature is low. In operating State D, any positive reactivity effects responses by the reactor caused by cooling of the moderator can be mitigated by a scram. As shown in Figure 15.9-29, scram is accomplished through the combined actions of the neutron monitoring, reactor protection, and CRD systems. Pressure relief is required in States C and D and is achieved through the operation of the MSRV system. Initial restoration of the core water level is by the RCIC and HPCI systems. Planned operations will proceed to achieve long-term cooling.

q. Event 23 - Pressure Regulator Failure (Open Direction)

A pressure regulator failure in the open direction, causing the opening of a turbine control or bypass valve, applies only in operating States C and D, because in other states the pressure regulator is not in operation. A pressure regulator failure is most severe and rapid in operating State D at low power.

The various protection sequences giving the safety actions are shown in Figure 15.9-30. Depending on plant conditions existing prior to the event, scram will be initiated either on main steam line isolation, main turbine trip or reactor vessel low water level. The sequence resulting in reactor vessel isolation also depends on initial conditions. With the mode switch in RUN, isolation is initiated when main steam line pressure drops below the low turbine inlet pressure setpoint. After isolation is completed, decay heat will cause nuclear system pressure to increase until limited by the operation of the relief valves. Core cooling following isolation can be provided by RCIC or HPCI. Shortly after reactor vessel isolation, normal core cooling can be re-established via the main condenser and feedwater systems or, if prolonged isolation is necessary, extended core and containment cooling will be manually actuated.

r. Event 24 - Pressure Regulator Failure (Closed Direction)

A pressure regulator failure in the closed direction, causing the closing of turbine control valves, applies only in operating States C and D, because in other states the pressure regulator is not in operation.

A single pressure regulator failure would result in little or no effect on the plant operation. The second pressure regulator would provide control. Failure of the second unit, which would result in the worst situation, is much less severe than Events 25, 27, 30, and 31. The dual pressure regulator failures are most severe and rapid in operating State D at high power.

The various protection sequences giving the safety actions are shown in Figure 15.9-31. Upon failure of one pressure regulator, normally a backup regulator will maintain the plant in the normal status. An additional failure of the backup regulator will result in a high flux or pressure scram, containment isolation, and subsequent HPCI/RCIC actuations. Closure of the turbine stop valve and bypass valves effectively isolates the reactor vessel.

CHAPTER 15 15.9-31 REV. 20, SEPTEMBER 2020

LGS UFSAR

s. Event 25 - Main Turbine Trips With Bypass System Operation A main turbine trip can occur only in operating State D (during heatup or power operation). A turbine trip during heatup is not as severe as a trip at full power, because operation of the turbine bypass system minimizes the effects of the transient, enabling return to planned operations. For a turbine trip above the bypass capacity, a scram as well as RPT will occur via turbine stop valve closure.

Subsequent relief valve actuation will occur. Eventual containment isolation and RCIC and HPCI system initiation will result from low water level. Figure 15.9-32 depicts the protection sequences required for main turbine trips. Main turbine trip and main generator trip are similar anticipated operational transients, and the required safety actions are the same.

t. Event 26 - Loss of Main Condenser Vacuum (Turbine Trip)

A loss of vacuum in the main turbine condenser can occur any time steam pressure is available and the condenser is in use; it is applicable to operating States C and D. This nuclear system pressure increase transient is the most severe of the pressure increase transients. However, scram protection in State C is not needed, since the reactor is not coupled to the turbine system.

For State D, above the turbine stop valve closure scram bypass setpoint, loss of condenser vacuum will initiate a turbine trip with its attendant stop valve closures (which lead to scram and an RPT). RCIC and HPCI are initiated on low water level.

Below the turbine stop valve closure scram bypass setpoint (State D), scram is initiated by a high neutron flux signal. Figure 15.9-33 shows the protection sequences. Decay heat will necessitate extended core and suppression pool cooling. When the RPV depressurizes sufficiently, the low pressure core cooling systems provide core cooling until a planned operation via RHR shutdown cooling is achieved.

u. Event 27 - Main Generator Trip With Bypass System Operation A main generator trip with bypass system operation can occur only in operating State D (during heatup or power operation). Fast closure of the main turbine control valves is initiated whenever an electrical grid disturbance occurs, which results in significant loss of electrical load on the generator. The turbine control valves are required to close as rapidly as possible to prevent excessive overspeed of the main turbine-generator rotor. Closure of the turbine control valves will cause a sudden reduction in steam flow, which results in an increase in system pressure. Above the turbine control valve closure scram bypass setpoint, scram and RPT will occur as a result of fast control valve closure. Subsequently, containment isolation will result, and pressure relief and initial core cooling by RCIC and HPCI will take place.

Planned operation can be resumed to achieve shutdown. A generator trip during heatup is not severe when the turbine bypass system can accommodate decoupling the reactor and the turbine-generator unit. Figure 15.9-34 depicts the protection sequences required for a main generator trip. Main generator trip and main turbine trip are similar anticipated operational transients, and the required safety actions for both are the same sequence.

CHAPTER 15 15.9-32 REV. 20, SEPTEMBER 2020

LGS UFSAR

v. Event 28 - Loss of Auxiliary Power Transformers There are a variety of possible plant electrical component failures that could affect the reactor system. The total loss of ac auxiliary power is the most severe. The loss of auxiliary power results in a sequence of events similar to that resulting from a loss of all connections to the grid. The most severe situation occurs in State D during power operation. This event requires the same protection sequences as shown for Event 29 in Figure 15.9-36.

w. Event 29 - Loss of Offsite Power - Grid Loss There are a variety of plant grid electrical component failures that can affect reactor operation. The total loss of ac auxiliary power is the most severe. The loss of all auxiliary power sources results in a sequence of events similar to that resulting from a main generator trip with bypass (Event 27), with respect to response of reactor systems. The most severe case occurs in State D during power operation. Figure 15.9-36 shows the safety actions required for a total loss of offsite power in all States (A, B, C, and D).

Scram and RPT will be initiated by turbine control valve fast closure. Loss of condenser circulating water will reduce condenser vacuum, which will close the turbine bypass valves and MSIVs. After the MSIVs close, system pressure rises to the lowest relief valve setting. Pressure is relieved by the MSRV system. After the reactor is isolated and feedwater flow has been lost, decay heat continues to increase nuclear system pressure, periodically causing relief valves to lift and, therefore, causing reactor water level to decrease. The core and containment cooling sequence shown in Figure 15.9-36 shows the sequence for achieving adequate cooling.

15.9.6.4 Abnormal Operational Transients 15.9.6.4.1 General The safety requirements and protection sequences for abnormal operational transients are described in the following paragraphs for Events 30 through 37. The protection sequence block diagrams show the sequence of front-line safety systems (Figures 15.9-37 through 15.9-39). The auxiliaries for the front-line safety systems are indicated in the auxiliary diagrams (Figures 15.9-7 and 15.9-8).

15.9.6.4.2 Required Safety Actions/Related Unacceptable Consequences The following list relates the safety actions for abnormal operational transients to mitigate or prevent the unacceptable safety consequences cited in Table 15.9-8.

Related Unacceptable Safety Action Consequence Reason Action Required Scram and/or RPT 3-2 To limit gross core-wide fuel damage and 3-3 to limit nuclear system pressure rise 3-5 CHAPTER 15 15.9-33 REV. 20, SEPTEMBER 2020

LGS UFSAR Pressure relief 3-3 To prevent excessive nuclear system 3-5 pressure rise Core, suppression 3-2 To limit further fuel and containment pool, and primary 3-4 damage if normal cooling is interrupted containment cooling Reactor vessel 3-2 To limit further fuel damage by reducing the isolation outflow of steam and water from the reactor vessel, thereby limiting the decrease in reactor vessel water level Restore ac power 3-2 To limit initial fuel damage by restoring ac power to systems essential to other safety actions Primary containment 3-1 To limit radiological effects isolation 15.9.6.4.3 Event Definition and Operational Safety Evaluation

a. Event 30 - Main Generator Trip Without Bypass System Operation A main generator trip without bypass system operation can occur only in operating State D (during heatup or power operation). The thermal-hydraulic effects on the core are more severe than with the bypass operating (Event 27).

Figure 15.9-37 depicts the protection sequences required for a main generator trip with bypass failure. If the turbine control valve closure scram bypass setpoint is exceeded, a turbine control valve fast closure signal will initiate RPS and RPT.

Containment isolation, relief valve actuation, and RCIC and HPCI operation will follow. Turbine control valve closure with bypass valve failure effectively isolates the reactor. Prolonged shutdown will necessitate extended core and containment/suppression pool cooling.

The load rejection and turbine trip are similar abnormal operational transients, and the required safety actions are the same.

b. Event 31 - Main Turbine Trip Without Bypass System Operation A main turbine trip without bypass can occur only in operating State D (during heatup or power operation). Figure 15.9-38 depicts the protection sequences required for main turbine trips. Turbine stop valve closure with bypass valve failure effectively isolates the reactor.

Turbine trips without bypass system operations result in severe thermal-hydraulic effects on the reactor core.

c. Event 32 - Inadvertent Loading and Operation with Assembly in Improper Position CHAPTER 15 15.9-34 REV. 20, SEPTEMBER 2020

LGS UFSAR Operation with a fuel assembly in the improper position is shown in Figure 15.9-39 and can occur in all operating states. No protection sequences are necessary relative to this event. Calculated results of worst fuel bundle loading error will not cause fuel cladding integrity damage. It requires three independent equipment/operator errors to allow this situation to develop.

d. Events 33 through 37 - (Not Used) 15.9.6.5 Design Basis Accidents 15.9.6.5.1 General The safety requirements and protection sequences for accidents are described in the follow paragraphs for Events 38 through 49. The protection sequence block diagrams show the safety actions and the sequence of front-line safety systems used for the accidents (refer to Figures 15.9-40 through 15.9-49). The auxiliaries for the front-line safety systems are indicated in the auxiliary diagrams (Figures 15.9-7 and 15.9-8).

15.9.6.5.2 Required Safety Actions/Unacceptable Consequences The following list relates the safety actions for design basis accident to mitigate or prevent the unacceptable consequences cited in Table 15.9-9.

Related Unacceptable Safety Action Consequence Reason Action Required Scram 4-2 To prevent fuel cladding failure(1) and 4-3 prevent excessive nuclear system pressures Pressure relief 4-3 To prevent excessive nuclear system pressure Core cooling 4-2 To prevent fuel cladding failure Reactor vessel 4-1 To limit radiological effect to not exceed the isolation values of 10CFR50.67 and Regulatory Guide 1.183 Establish primary 4-1 To limit radiological effects to not exceed the containment values of 10CFR50.67 and Regulatory Guide 1.183 Primary containment 4-4 To prevent excessive pressure in the cooling containment when containment is required.

Prevent control 4-2 To prevent fuel cladding failure rod ejection Restrict loss of 4-2 To prevent fuel cladding failure reactor coolant (passive)

Main control room 4-5 To prevent overexposure to radiation of CHAPTER 15 15.9-35 REV. 20, SEPTEMBER 2020

LGS UFSAR environmental plant personnel in the control room control Limit reactivity 4-2 To prevent fuel cladding failure and insertion rate 4-3 excessive nuclear system pressure (passive)

(1)

Failure of fuel barrier includes fuel cladding fragmentation (LOCA) and excessive fuel enthalpy (control rod-drop accident).

15.9.6.5.3 Event Definition and Operational Safety Evaluations

a. Event 38 - Recirculation Pump Seizure A recirculation pump seizure event considers the instantaneous stoppage of the pump motor shaft of one recirculation loop pump. The case involves operation at design power in State D. It assumed that a main turbine trip will occur as reactor vessel water level swell exceeds the turbine trip setpoint. This results in a scram and an RPT when the turbine stop valves close. Relief valve opening will occur to control pressure level and temperatures. RCIC or HPCI system will maintain vessel water level.

The protection sequence for this event is given in Figure 15.9-40. If reactor vessel swell does not exceed the turbine trip setpoint, then no safety actions are required.

b. Event 39 - Recirculation Pump Shaft Break A recirculation pump shaft break event considers the degraded, delayed stoppage of the pump motor shaft of one recirculation loop pump. The case involves operation at design power in State D. It is assumed that a main turbine trip will occur as reactor vessel water level swell exceeds the turbine trip setpoint. This results in a scram and an RPT when the turbine stop valves close. Relief valve opening will occur to control pressure and temperature. RCIC or HPCI systems will maintain vessel water level.

The production sequence for this event is given in Figure 15.9-41. If reactor vessel swell does not exceed the turbine trip setpoint, then no safety actions arre required.

c. Event 40 - Control Rod-Drop Accident The control rod-drop accident results from an assumed failure of the control rod-to-drive mechanism coupling after the control rod (very reactive rod) becomes stuck in its fully inserted position. It is assumed that the control rod drive is then fully withdrawn before the stuck rod falls out of the core. The control rod velocity limiter, an engineered safeguard, limits the control rod-drop velocity. The resultant radioactive material release is maintained far below the values of 10CFR50.67 and Regulatory Guide 1.183.

CHAPTER 15 15.9-36 REV. 20, SEPTEMBER 2020

LGS UFSAR No safety actions are required in States A or C where the plant is in a shutdown state by more than the reactivity worth of one rod prior to the accident. The control rod-drop accident is applicable only in States B and D. In State B the low fission product inventory assures inconsequential radiological releases should a control rod-drop accident occur. Direct radiation dose to personnel on the refueling floor is maintained acceptable by the shielding provided by water above the core and by administrative procedures controlling personnel access. For State B, control rod worth is limited by the RWM system such that damage to the reactor coolant pressure boundary is prevented. Under most instances fuel failures are not expected. Therefore, the only safety response required in State B is scram.

Figure 15.9-42 presents the different protection sequences for the control rod-drop accident. As shown in Figure 15.9-42, the reactor is automatically scrammed and, in some cases, isolated. For all design basis cases, the NMS, RPS, and CRD system will provide a scram from high neutron flux. Because LGS utilizes the banked position withdrawal sequence which mitigates rod-drop consequences, no fuel failures are expected.

After the reactor has been scrammed and isolated, the pressure relief system allows the steam (produced by decay heat) to be directed to the suppression pool.

Initial core cooling is accomplished by either the RCIC or HPCI or the normal feedwater system. With prolonged isolation, as indicated in Figure 15.9-42, the reactor operator initiates the RHR/suppression pool cooling mode and depressurizes the vessel with the manual mode of the ADS or via normal manual relief valve operation. The RHR/shutdown cooling mode accomplishes extended core cooling.

d. Event 41 - Fuel Handling Accident Because a fuel handling accident can potentially occur any time when fuel assemblies are being manipulated, either over the reactor core or in a spent fuel pool, this accident is considered in all operating states. Considerations include mechanical fuel damage caused by drop impact and a subsequent release of fission products. The protection sequences pertinent to this accident are shown in Figure 15.9-43. Refueling area isolation and SGTS operation are automatically initiated by the ventilation radiation monitoring systems.

e. Event 42 - LOCAs Resulting from Postulated Piping Breaks Within RCPB Inside Containment (DBA LOCA)

Pipe breaks inside the containment are considered only when the nuclear system is significantly pressurized (States C and D). The result is a release of steam and water into the containment. Consistent with NSOA criteria, the protection requirements consider all size line breaks, from large liquid recirculation loop piping breaks down to small steam instrument line breaks. The most severe cases are the circumferential break of the largest (liquid) recirculation system pipe and the circumferential break of the largest main steam line.

As shown in Figure 15.9-44, in operating State C (reactor shutdown, but pressurized), a pipe break accident up to the DBA can be accommodated within the nuclear safety operational criteria through the various operations of the main steam CHAPTER 15 15.9-37 REV. 20, SEPTEMBER 2020

LGS UFSAR line isolation valves, emergency core cooling systems (HPCI, ADS, LPCI, and CS),

PCRVICS, containment, reactor enclosure, SGTS, control room heating, cooling and ventilation system, ESW and RHRSW systems, hydrogen control system, equipment cooling systems, and the incident detection circuitry. For small pipe breaks inside the containment, pressure relief is effected by the MSRV system, which transfers decay heat to the suppression pool. For large breaks, depressurization takes place through the break itself. In State D (reactor not shut down, but pressurized), the same equipment is required as in State C but, in addition, the RPS and the CRD system must operate to scram the reactor. The limiting items, upon which the operation of the above equipment is based, are the allowable fuel cladding temperature and the containment pressure capability. The CRD housing supports are considered necessary whenever the system is pressurized to prevent excessive control rod movement through the RPV following the postulated rupture of one CRD housing (a lesser case of the design basis LOCA and a related preventive of a postulated rod ejection accident).

After completion of the automatic action of the above equipment, manual operation of the RHR system (suppression pool cooling mode) or relief valves and ADS (controlled depressurization) is required to maintain containment pressure and fuel cladding temperature within limits during extended core cooling.

f. Events 43, 44, 45 - Piping Breaks Outside Containment Pipe break accidents outside the containment are assumed to occur any time the nuclear system is pressurized (States C and D). This accident is most severe during operation at high power (State D). In State C, this accident becomes a subset of the State D sequence.

The protection sequences for the various possible pipe breaks outside the containment are shown in Figure 15.9-45. For small breaks, the reactor operator can use a large number of process indications to identify and isolate the break.

In operating State D (reactor not shut down, but pressurized), scram is accomplished through operation of the RPS and the CRD system. Reactor vessel isolation is accomplished through operation of the MSIVs and the PCRVICS.

For a main steam line break, initial core cooling is accomplished by HPCI, RCIC, ADS, or manual relief valve operation in conjunction with CS and LPCI. These systems provide parallel paths to effect initial core cooling, thereby satisfying the single failure criterion. Extended core cooling is accomplished by the single failure proof, parallel combination of CS and LPCI. The ADS or relief valve system operation and the RHR suppression pool cooling mode (both manually operated) are required to maintain containment pressure and fuel cladding temperature within limits during extended core cooling.

g. Event 46 - Gaseous Radwaste System Leak or Failure It is assumed that the line leading to the SJAE fails near the main condenser. This results in activity normally processed by the offgas treatment system being discharged directly to the turbine enclosure and subsequently through the ventilation system to the environment. This failure is indicated by a lack of flow in CHAPTER 15 15.9-38 REV. 20, SEPTEMBER 2020

LGS UFSAR the offgas discharge line. This event can be considered only under States C and D and is shown in Figure 15.9-46.

The reactor operator initiates shutdown of the SJAEs/offgas system to reduce the gaseous activity being discharged. A loss of main condenser vacuum will result (timing depending on main condenser air inleakage rate) in a main turbine trip and ultimately a reactor shutdown. Refer to Event 26 for reactor protection sequence (Figure 15.9-33).

h. Event 47 - Augmented Offgas Treatment System Failure An evaluation of those events that could cause a gross failure in the offgas system has resulted in the identification of a postulated seismic event, more severe than the one for which the system is designed, as the only conceivable event that could cause significant damage.

The gross failure of this system requires a manual isolation of the system from the main condenser. The isolation results in a loss of main condenser vacuum (timing dependent on air inleakage rate). Protection sequences for this event are shown in Figure 15.9-47.

i. Event 48 - Liquid Radwaste System Leak or Failure Releases that could occur inside and outside of the containment, not covered by Events 38 through 47, include small spills and equipment leaks of radioactive materials inside structures housing the subject process equipment. Conservative values for leakage have been assumed and evaluated in the plant under routine releases (Section 11.2). The offsite dose that results from any small spill that could occur outside containment will be negligible in comparison to the dose resulting from the accountable (expected) plant leakages.

The protective sequences for this event are provided in Figure 15.9-48.

j. Event 49 - Liquid Radwaste System - Storage Tank Failure Refer to Section 2.4 for a discussion of liquid tank failures.

The protective sequences for this event are provided in Figure 15.9-49.

15.9.6.6 Special Events 15.9.6.6.1 General Additional special events are postulated to demonstrate that the plant is capable of accommodating off-design occurrences. (refer to Events 50 through 53). As such, these events are beyond the safety requirements of the other event categories. The safety actions shown in the sequence diagrams (Figures 15.9-50 through 15.9-53) for the additional special events follow directly from the requirements cited in the demonstration of the plant's capability.

Auxiliary systems are shown in Figures 15.9-7 and 15.9-8.

CHAPTER 15 15.9-39 REV. 20, SEPTEMBER 2020

LGS UFSAR 15.9.6.6.2 Required Safety Action/Unacceptable Consequences The following list relates the safety actions for special events to prevent the unacceptable consequences cited in Table 15.9-10.

Related Unacceptable Safety Action Consequence Reason For Action Available Main Control Room Considerations Manually initiate 5-1 Local panel control has been provided all shutdown 5-2 and is available outside main control controls from room remote shutdown panel or local panels Manually initiate SLCS -3 SLCS to control reactivity to cold shutdown available 15.9.6.6.3 Event Definitions and Operational Safety Evaluation

a. Event 50 - Shipping Cask-Drop Due to the redundant nature of the plant crane, the cask-drop accident is not believed to be a credible accident. However, the accident is hypothetically assumed to occur as a consequence of an unspecified failure of the cask-lifting mechanism, thereby allowing the cask to fall.

It is assumed that an ISFSI transfer cask and/or spent fuel shipping cask containing irradiated fuel assemblies is in the process of being moved with the cask suspended from the crane above the rail car. The fuel assemblies have been out of the reactor for at least 90 days.

Through some unspecified failure, the cask is released from the crane and falls onto the rail car. Some of the coolant in the outer cask structure may leak from the cask.

The reactor operator will ascertain the degree of cask damage and, if possible, make the necessary repairs and refill the cask coolant to its normal level if coolant has been lost.

It is assumed that if the coolant is lost from the external cask shield, the operator will establish forced cooling of the cask by introducing water into the outer structure annulus or by spraying water on the cask exterior surface. Maintaining the cask in a cool condition will, therefore, ensure no fuel damage as a result of a temperature increase due to decay heat.

Because the cask is still within the refueling area volume, any activity postulated to be released can be accommodated by the SGTS.

CHAPTER 15 15.9-40 REV. 20, SEPTEMBER 2020

LGS UFSAR The protective sequences for this event are provided in Figure 15.9-50.

b. Event 51 - Reactor Shutdown, Anticipated Transient Without Scram Reactor shutdown from a plant transient occurrence without the use of control rods is applicable in State D only. The protection sequences for this extremely improbable class of events in shown in Figure 15.9-51.

On initiation of the plant transient situation by a turbine trip, for example, a scram is automatically initiated, but no control rods are assumed to move; the operator may attempt to insert control rods manually. The recirculation pumps are tripped as a consequence of the initial turbine trip. If the nuclear system becomes isolated from the main condenser, heat can be transferred from the reactor to the suppression pool via the relief valves; the HPCI and RCIC are initiated on low water level and then maintain reactor vessel water level. The RRCS, on detecting high pressure or low water level in the reactor, will also attempt to insert control rods by actuation of the ARI valves of the CRD system and will also initiate a recirculation pump trip (which has previously occurred for this transient). If the reactor power is still significant after appropriate time delays, the RRCS automatically initiates feedwater runback and SLCS operation. Operation of the SLCS results in a transition from low power neutron heat to decay heat. The RHR suppression pool cooling mode is used to remove the low power neutron and decay heat from the suppression pool as required. After attaining hot shutdown, further depressurization to the suppression pool and use of the RHR shutdown cooling mode results in achieving a cold shutdown condition.

c. Event 52 - Reactor Shutdown From Outside Control Room Reactor shutdown from outside the control room is an event investigated to evaluate the capability of the plant to be safely shut down and cooled to the cold shutdown state from outside the control room.

Figure 15.9-52 shows the protection sequences for this event in operating States B, C and D. In State A, no sequence is shown, because the reactor is already in the condition finally required for the event. In State C, only cooldown is required, since the reactor is already shut down.

A scram from outside the control room can be achieved by opening the ac supply breakers for the RPS. Reactor pressure will be controlled and decay heat transferred to the suppression pool via the relief valves. Reactor water level will be maintained by the RCIC system, and the suppression pool will be cooled using the RHR suppression pool cooling mode. When system pressure is sufficiently reduced, the RHR shutdown cooling mode will be used for long-term cooling.

d. Event 53 - Reactor Shutdown Without Control Rods Reactor shutdown without control rods is an event requiring an alternate method of reactivity control: the SLCS. By definition, this event can occur only when the reactor is not already shut down. Therefore, this event is considered only in operating States B and D.

CHAPTER 15 15.9-41 REV. 20, SEPTEMBER 2020

LGS UFSAR The SLCS must operate to meet capability demonstration requirement 5-3. The design bases for the SLCS result from these operating criteria when applied under the most severe conditions (State D at rated power). As indicated in Figure 15.9-53, the SLCS is manually initiated and controlled in States B and D.

15.9.7

SUMMARY

AND CONCLUSIONS With the information presented in the protection sequence block diagrams and the auxiliary diagrams, it is possible to examine the functional and hardware requirements for each system.

This is done by considering the events in which the systems are employed and deriving sets of operational requirements. This limiting set of operational requirements establishes the lowest acceptable level of performance for a system or component, or the minimum number of components or portions of a system that must be operable so that plant operation may continue, as indicated in Section 15.9.5.

Safety actions to maintain core cooling are, in general, automatically controlled by NSSS ESF systems. Required manual actions are limited to RHR system adjustment to control suppression pool temperatures.

For LOCA events, all short-term (t = 0 through 10 minutes) safety functions are automatically initiated and controlled. All safety actions to provide adequate core cooling over the long-term (t =

10 minutes to 30 days) are automatically provided by the necessary NSSS ESF systems. Control of LOCA suppression pool thermal response, however, may require the operator to place one loop of the containment cooling system (RHR) into operation, but no such action is required earlier than 10 minutes into the event. Extended long-term NSSS ESF manual actions would be centered around RHR shutdown cooling aspects.

For anticipated operational transient events, no operator action is required in less than 10 minutes to mitigate the consequences of the event or to achieve a steady reactor condition or a controlled shutdown mode. Most events involve automatic process control systems (e.g., feedwater or pressure controls that are usually in operation). Some events allow operator manual control adjustments (e.g., control rod insertion) prior to an automatic protection action, but in no case will the failure or error of the operator manual action negate any protective function or cause a radiological safety problem. Operator actions may improve the course of a transient, but no credit is taken (ahead of 10 minutes) in the current safety evaluation analyses.

When the initial stages of these events are completed and the operator has taken over manual control, the EOPs govern all actions taken.

The operational requirements derived using the above process may be complicated functions of operating states, parameter ranges, and hardware conditions. The final step is to translate these results into technical specifications that encompass the operational requirements and can be used by plant operations and management personnel.

It is concluded that the nuclear safety operational and plant design basis criteria are satisfied when the plant is operated in accordance with the nuclear safety operational requirements determined by the method presented in this section.

CHAPTER 15 15.9-42 REV. 20, SEPTEMBER 2020

LGS UFSAR Table 15.9-1 NORMAL OPERATION NSOA NSOA EVENT UFSAR BWR OPERATING STATE EVENT NO. EVENT DESCRIPTION FIGURE NO. SECTION NO. A B C D 1 Refueling 15.9-9 - X

- Initial

- Reload 2 Achieving Criticality 15.9-9 through - X X X X 15.9-12 3 Heatup 15.9-12 X 4 Power Operation - Generation 15.9-12 - X

- Steady state

- Daily load reduction & recovery

- Grid frequency control response

- Control rod sequence exchanges

- Power generation surveillance Testing

Turbine stop valve surveillance tests

Turbine control valve surveillance tests

MSIV surveillance tests 5 Achieving Shutdown 15.9-10 and 15.9-12 - X X 6 Cooldown 15.9-9 and 15.9-11 X X CHAPTER 15 15.9-43 REV. 13, SEPTEMBER 2006

LGS UFSAR Table 15.9-2 ANTICIPATED OPERATIONAL TRANSIENTS NSOA NSOA EVENT UFSAR BWR OPERATING STATE EVENT NO. EVENT DESCRIPTION FIGURE NO. SECTION NO. A B C D 7 Manual or inadvertent scram 15.9-13 7.2 X X X X 8 Loss of plant instrument and 15.9-14 9.3.1 X X X X service air systems 9 Inadvertent startup of NSSS pump 15.9-15 15.5.1 X X X X 10 Inadvertent startup of idle 15.9-16 15.4.4 X X X X recirculation loop pump 11 Recirculation loop flow control 15.9-17 15.4.5 X X failure with increasing flow 12 Recirculation loop flow control 15.9-18 15.3.2 X X failure with decreasing flow 13 Recirculation loop pump trip 15.9-19 15.3.1 X X

- With one pump

- With two pumps 14 Inadvertent MSIV closure 15.2.4

- All main steam lines isolated 15.9-20 X X

- One main steam line isolated 15.9-21 X X 15 Inadvertent opening of an MSRV 15.9-22 15.6.1 X X 16 Control rod withdrawal error 15.9-23 15.4.1

- During startup X

- During refueling X 17 Control rod withdrawal rod error at power 15.9-24 15.4.2 X X 18 RHR shutdown cooling failure loss of cooling 15.9-25 15.2.9 X X X CHAPTER 15 15.9-44 REV. 13, SEPTEMBER 2006

LGS UFSAR Table 15.9-2 (Cont'd)

NSOA NSOA EVENT UFSAR BWR OPERATING STATE EVENT NO. EVENT DESCRIPTION FIGURE NO. SECTION NO. A B C D 19 RHR shutdown cooling failure 15.9-26 15.1.6 X X X X increased cooling 20 Loss of all feedwater flow 15.9-27 15.2.7 X X 21 Loss of feedwater heater 15.9-28 15.1.1 X 22 Feedwater controller failure 15.9-29 15.1.2 X X X X maximum demand 23 Pressure regulator failure 15.9-30 15.1.3 X X

- open 24 Pressure regulator failure 15.9-31 15.2.1 X X

- closed 25 Main turbine trip with bypass 15.9-32 15.2.3 X system operation 26 Loss of main condenser vacuum 15.9-33 15.2.5 X X 27 Main generator trip with bypass 15.9-34 15.2.2 X system operation 28 Loss of auxiliary transformers 15.9-36 15.2.6 X X X X 29 Loss of plant normal offsite 15.9-36 15.2.6 X X X X ac power - grid connection failure CHAPTER 15 15.9-45 REV. 13, SEPTEMBER 2006

LGS UFSAR Table 15.9-3 ABNORMAL OPERATIONAL TRANSIENTS NSOA NSOA EVENT UFSAR BWR OPERATING STATE EVENT NO. EVENT DESCRIPTION FIGURE NO. SECTION NO. A B C D 30 Main generator trip with bypass 15.9-37 15.2.2 X system failure 31 Main turbine trip with bypass 15.9-38 15.2.3 X system failure 32 Inadvertent loading and 15.9-39 15.4.7 X X X X operation of a fuel assembly in an improper position 33 Not Used - -

34 Not Used - -

35 Not Used - -

36 Not Used - -

37 Not Used - -

CHAPTER 15 15.9-46 REV. 13, SEPTEMBER 2006

LGS UFSAR Table 15.9-4 DESIGN BASIS ACCIDENTS NSOA NSOA EVENT UFSAR BWR OPERATING STATE EVENT NO. EVENT DESCRIPTION FIGURE NO. SECTION NO. A B C D 38 Recirculation Pump Seizure 15.9-40 15.3.3 X 39 Recirculation Pump Shaft Break 15.9-41 15.3.4 X 40 Control rod-drop accident 15.9-42 15.4.9 X X 41 Fuel handling accident 15.9-43 15.7.4 X X X X 42 LOCA resulting from spectrum 15.9-44 15.6.5 X X of postulated piping breaks within the RCPB inside containment 43 Piping breaks outside containment 15.9-45 15.6.4 X X 44 Instrument line break outside 15.9-45 15.6.2 X X drywell 45 Feedwater line break outside 15.9-45 15.6.6 X X containment 46 Gaseous radwaste system leak or 15.9-46 15.7.1 X X failure 47 Augmented offgas treatment 15.9-47 15.7.1 X X system failure 48 Liquid radwaste system leak or 15.9-48 15.7.2 X X X X failure 49 Liquid radwaste system storage 15.9-49 15.7.3 X X X X tank failure CHAPTER 15 15.9-47 REV. 13, SEPTEMBER 2006

LGS UFSAR Table 15.9-5 SPECIAL EVENTS NSOA NSOA EVENT UFSAR BWR OPERATING STATE EVENT NO. EVENT DESCRIPTION FIGURE NO. SECTION NO. A B C D 50 ISFSI Transfer Cask and/or 15.9-50 15.7.5 X X X X Shipping cask-drop

- Solid radwaste

- Spent fuel

- New fuel 51 Reactor shutdown from 15.9-51 15.8 X ATWS 52 Reactor shutdown 15.9-52 7.4.1.4 X X X from outside control room 53 Reactor shutdown 15.9-53 9.3.5 X X without control rods CHAPTER 15 15.9-48 REV. 16, SEPTEMBER 2012

LGS UFSAR Table 15.9-6 UNACCEPTABLE CONSEQUENCES CRITERIA PLANT EVENT CATEGORY - NORMAL OPERATION Unacceptable Consequences 1-1 Release of radioactive material to the environs that exceeds the limits of either 10CFR20 or 10CFR50.

1-2 Fuel failure to such an extent that were the freed fission products released to the environs via the normal discharge paths for radioactive material, the limits of 10CFR20 would be exceeded.

1-3 Nuclear system stress in excess of that allowed for planned operation by applicable industry codes.

1-4 Existence of a plant condition not considered by plant safety analyses.

CHAPTER 15 15.9-49 REV. 13, SEPTEMBER 2006

LGS UFSAR Table 15.9-7 UNACCEPTABLE CONSEQUENCES CRITERIA - PLANT EVENT CATEGORY - ANTICIPATED OPERATIONAL TRANSIENTS Unacceptable Consequences 2-1 Release of radioactive material to the environs that exceeds the limits of 10CFR20.

2-2 Reactor operation induced cladding failure.

2-3 Nuclear system stress in excess of that allowed for the transient classification by applicable industry codes.

2-4 Containment stresses in excess of that allowed for the transient classification by applicable industry codes when containment is required.

CHAPTER 15 15.9-50 REV. 13, SEPTEMBER 2006

LGS UFSAR Table 15.9-8 UNACCEPTABLE CONSEQUENCES CRITERIA PLANT EVENT CATEGORY - ABNORMAL OPERATIONAL TRANSIENTS Unacceptable Consequences 3-1 Release of radioactivity which results in dose consequences that exceed a small fraction of 10CFR100; 3-2 Failure of fuel cladding which could cause changes in core geometry such that core cooling would be inhibited; 3-3 Generation of a condition that results in consequential loss of function of the reactor coolant system; 3-4 Generation of a condition that results in a consequential loss of function of a necessary containment barrier; and 3-5 Nuclear system stresses in excess of those allowed for the accident classification by applicable industry codes.

CHAPTER 15 15.9-51 REV. 13, SEPTEMBER 2006

LGS UFSAR Table 15.9-9 UNACCEPTABLE CONSEQUENCES CRITERIA PLANT EVENT CATEGORY - DESIGN BASIS ACCIDENTS Unacceptable Consequences 4-1 Radioactive dose consequence exceeding the values of 10CFR50.67 and Regulatory Guide 1.183; 4-2 Failure of fuel cladding which could cause sufficient changes in core geometry such that core cooling would be inhibited; 4-3 Nuclear system stresses in excess of those allowed for the accident classification by applicable industry codes; 4-4 Containment stresses in excess of those allowed for the accident classification by applicable industry codes when containment is required; and 4-5 Radiation exposure to plant operations personnel in the main control room in excess of 5 rem whole body, 30 rem inhalation, and 75 rem skin.

CHAPTER 15 15.9-52 REV. 14, SEPTEMBER 2008

LGS UFSAR Table 15.9-10 UNACCEPTABLE CONSEQUENCES CONSIDERATIONS PLANT EVENT CATEGORY - SPECIAL EVENTS Special Events Considered A. Reactor shutdown from outside control room.

B. Reactor shutdown without control rods.

C. Reactor shutdown with ATWS.

D. ISFSI Transfer Cask and/or Shipping Cask-Drop.

Capability Demonstration 5-1 Ability to shut down reactor by manipulating controls and equipment outside the main control room.

5-2 Ability to bring the reactor to the cold shutdown condition from outside the main control room.

5-3 Ability to shut down the reactor independent of control rods.

5-4 Ability to contain radiological contamination.

5-5 Ability to limit radiological exposure.

CHAPTER 15 15.9-53 REV. 16, SEPTEMBER 2012

LGS UFSAR Table 15.9-11 BWR OPERATING STATES(1)

States Conditions(2) A B C D Reactor vessel head X X Reactor vessel head on X X Shut down X X Not shut down X X (1)

Further discussion is provided in Section 15.9.6.2.4.

(2)

Shutdown: Keff sufficiently less than 1 that the full withdrawal of any one control rod could not produce criticality under the most restrictive potential conditions of temperature, pressure, core age, and fission product concentrations.

CHAPTER 15 15.9-54 REV. 14, SEPTEMBER 2008

LGS UFSAR 15.10 ACCIDENT DOSE MODEL DESCRIPTIONS 15.10.1 OFFSITE DOSE MODEL This discussion identifies the models used to calculate offsite radiological doses that would result from releases of radioactivity due to various postulated accidents.

The following assumptions are basic to both the model for the whole body dose from immersion in a cloud of radioactivity and the model for the thyroid dose from inhalation of radioactivity:

a. Direct radiation from the source point is negligible compared with whole body radiation due to submersion in the radioactivity leakage cloud.

b. All radioactivity releases are treated as ground level releases regardless of the point of discharge.

c. The dose receptor is a standard man, as defined by the International Commission on Radiological Protection (Reference 15.10-1).

d. Isotopic data, such as decay constants, are taken from the Table of Isotopes (Reference 15.10-2). Table 15.10-1 lists those values.

e. Dose conversion factors are taken from TID-14844 (Reference 15.10-3), Federal Guidance Report 11 (Reference 15.10-16) and from Regulatory Guide 1.109.

Gamma and beta dose conversion factors are found by using the method of Meteorology and Atomic Energy (Reference 15.10-4). Table 15.10-1 lists those values.

15.10.1.1 Whole Body Gamma Dose Calculation of the gamma dose from an extended source, such as a cloud, starts with the consideration that the radiation received by the receptor from a differential area or volume is the same as if it came from a point source. If the dimensions of a homogeneous cloud of gamma-emitting material are large compared with the distance that the gamma rays travel, an equilibrium condition occurs, provided the receptor volume is small. A cloud with these dimensions acts as though the plume were an infinite source of gamma-emitting material. For a receptor at ground level, only half the passing cloud contributes to the gamma dose of the receptor.

The semi-infinite whole body gamma dose as described in Reference 15.10-4 is given by the following equation:

N D = X/Q (DCFi) Qi (EQ. 15.10-1) i=1 where:

D = gamma dose from semi-infinite cloud, rem DCFi = gamma dose conversion factor for isotope (i), rem-m3/Ci-sec CHAPTER 15 15.10-1 REV. 13, SEPTEMBER 2006

LGS UFSAR Qi = source strength for isotope (i), Ci X/Q = atmospheric dilution factor, sec/m3 15.10.1.2 Thyroid Inhalation Dose Assuming the atmospheric dilution factors given in Table 2.3.4-4, the thyroid dose for a given time is obtained from the following equation:

N DT = (X/Q) B Qi DCFi (EQ. 15.10-2) i=1 where:

DT = thyroid inhalation dose, rem X/Q = atmospheric dilution factor, sec/m3 N = number of isotopes B = breathing rate, m3/sec Qi = total activity of iodine isotope (i) released, Ci DCFi = dose conversion factor for iodine isotope (i), rem/Ci The isotopic data and breathing rates are given in Tables 15.10-1 and 15.10-3, respectively.

15.10.1.3 Beta Skin Dose Assuming the atmospheric dilution factor given in Table 2.3.4-4, the dose in air for a semi-infinite cloud of beta radiation is given by:

N D = (X/Q) Qi DCFi (EQ. 15.10-3) i=1 where:

D = beta dose from a semi-infinite cloud, rem X/Q = atmospheric dilution factor, sec/m3 N = number of isotopes Q = source strength for isotope (), Ci DCF1 = dose conversion factor, rem-m3/Ci-sec CHAPTER 15 15.10-2 REV. 13, SEPTEMBER 2006

LGS UFSAR 15.10.2 CONTROL ROOM DOSES 15.10.2.1 Calculation of Control Room X/Q This section describes the governing atmospheric dispersion modeling equations and assumptions in accordance with Draft Regulatory Guide 1111 (Reference 15.10-6). Estimates of atmospheric diffusion (X/Q) are made at the control room intake for releases from the North and South Stacks for periods of 2, 8, and 16 hours1.851852e-4 days 0.00444 hours 2.645503e-5 weeks 6.088e-6 months and for 3 and 26 days. The NRC recommended model, ARCON96, in Reference 15.10-5 is utilized. Since the North and South Stacks are not 2.5 times the height of the adjacent structures, they do not qualify as an elevated release per DG-1111, therefore, ARCON96 is executed in vent release mode. With an assumed zero (0) vertical exit velocity, vent releases are treated as ground-level releases by ARCON96.

15.10.2.1.1 Diffusion Model (excerpted from NUREG/CR-6331 Rev. 1)

The ARCON96 code implements a straight-line Gaussian diffusion model. The basic model for a ground-level release is X 1 y 2

= exp -0.5 (15.10-4a)

Q' yzU y X/Q' = relative concentration (concentration divided by release rate) [(ci/m3)/(ci/s)]

y, z = diffusion coefficients (m)

U = wind speed (mls)

Y = distance from the center of the plume (m)

This equation assumes that the release is continuous, constant, and of sufficient duration to establish a representative mean concentration. It also assumes that the material being released is reflected by the ground. Diffusion coefficients are typically determined from atmospheric stability and distance from the release point using empirical relationships. A diffusion coefficient parameterization from the NRC PAYAN (Reference 15.10-6) and XOQDOQ (Reference 15.10-

7) codes is used for y and z.

The diffusion coefficients have the general form

= axb + c were x is the distance from the release point, in meters, and a , b, and c are parameters that are functions of stability. The parameters are defined for 3 distance ranges - 0 to 100 m, 100 to 1000 m, and greater than 1000 m. The parameter values may be found in the listing of Subroutine NSIGMA1 in Appendix A of NUREG/CR-6331 Rev. 1.

Diffusion coefficient adjustments for wakes and low wind speeds are incorporated as follows:

To estimate diffusion in building wakes, composite wake diffusion coefficients, y and z, replace y and z. The composite wake diffusion coefficients are defined by CHAPTER 15 15.10-3 REV. 13, SEPTEMBER 2006

LGS UFSAR 1/2 y = 2 y + y1 2

+ y2 2

(15.10-4b) 1/2 z = z2 + z12 + z22 (15.10-4c)

Where y and z are the normal diffusion coefficients, y1 and z1 are the low wind speed corrections, and y2 and z2 are the building wake corrections. These corrections are described and evaluated in Ramsdall and Fosmire (Reference 15.10-8). The form of the low wind speed corrections is x -x y12 = 9.13 x 105 1 - 1 + exp (15.10-4d) 1000U 1000U x -x z12 = 6.67 x 102 1 - 1 + exp (15.10-4e) 100U 100U Where x is the distance from the release point to the receptor, in meters, and U is the wind speed in meters per second. It is appropriate to use the slant range distance for x because these corrections are made only when the release is assumed to be at the ground level and the receptor is assumed to be on the axis of the plume. The diffusion coefficients corrections that account for enhanced diffusion in the wake have a similar form. These corrections are x -x y22 = 5.24 x 10-2U2A 1 - 1 + exp (15.10-4f) 10A 10A x -x z22 = 1.17 x 10-2U2A 1 - 1 + exp (15.10-4g) 10A 10A Where A is the cross-sectional area of the building.

An upper limit is placed on y as a conservative measure. This limit is the standard deviation associated with a concentration uniformly distributed across a sector with width equal to the circumference of a circle with radius to the distance between the source and receptor. This value is 2x ymax =

12 CHAPTER 15 15.10-4 REV. 13, SEPTEMBER 2006

LGS UFSAR 1.81x (15.1-4h) 15.10.2.1.2 Meteorological Input The 1996-2000 meteorological database utilized in ARCON96 consists of Tower 1 hourly meteorological data observations of 30 and 175 foot wind speed and direction, and 171-26 foot Delta Temperature Stability Class from Tower 2 data were used only for substitution of any missing Tower 1 data as follows:

Instrument Elevations (above tower grade)

Tower 1 (primary) Tower 2 (backup)

(Grade: 250 ft msl) Grade: 121 ft msl)

Wind Speed:

Elevation 1 30 ft 159 ft Elevation 2 175 ft 304ft Wind Direction:

Elevation 1: 30 ft 159 ft Elevation 2: 175ft 304 ft Meteorological Evaluation Services Co., Inc. (MES) illustrated that the Tower 2 delta temperature data are sufficiently representative to be substituted for the Tower 1 delta temperature data; however, since the Tower 1 and Tower 2 delta temperature height intervals differ from each other somewhat, and also since for all years shown, the primary Tower 1 has data recovery rates well above the NRC's 90 percent requirements, it was deemed unnecessary to make such substitutions.

The designation of 'calm' is made to all wind speed observations 0.5 mph or less. The higher of the starting speeds of the Climatronics wind vane and anemometer equipment on each of the towers (i.e., 0.5 mph) was used as the threshold for calm winds, per Regulatory Guide 1.145, Section 1.1 Reference 15.10-9.

15.10.2.1.3 Model Input Parameters The parameters that were input into the ARCON96 model for use in calculating the Control Room X/Q are summarized below:

North Stack South Stack Release Height (m) 61 61 Intake Height (m) 37.8 37.8 Horizontal Distance from 16.5 64.8 Intake to Stack (m)

Elevation Difference between Stack Grade and 0 0 Intake Grade (m)

Building Area (m2) 5851 5851 Direction from Intake to 180 180 Stack (o)

CHAPTER 15 15.10-5 REV. 13, SEPTEMBER 2006

LGS UFSAR Vertical Velocity (m/s) 0 0 Stack Flow (m3/s) 0 0 Stack Radius (m) 0 0 15.10.2.1.4 Control Room X/Q Results A summary of the atmospheric diffusion estimates at the Control Room Intake for releases from the North and South Stacks is shown in Table 15.10-2.

15.10.2.2 Control Room Dose Model The design basis for control room ventilation and shielding design is to limit exposures received by control room operating personnel to 5 rem total effective dose equivalent (TEDE) per 10CFR50.67.

This basis is consistent with GDC 19.

The control room shielding is designed to reduce gamma radiation shine from normal and postaccident radiation sources to levels consistent with the requirements of 10CFR20 and GDC 19.

The postaccident ventilation system is designed to preclude entrance of unfiltered air to the control room, and to maintain outleakage of air from this zone with respect to other plant ventilation zones and the air outside the plant.

Details of control room postaccident ventilation system design and instrumentation are discussed in Sections 9.4.1 and 6.4.

During postaccident ventilation system operation, approximately 525 cfm of filtered outside air is supplied to the control room if airborne radioactivity is present outside the control room. If a high radiation accident occurs with the control room in the chlorine isolation mode for testing purposes or as required by the Action statement of an associated Technical Specifications Limiting Condition of Operation, automatic isolation of the control room for high radiation would not occur. Analysis of the event where the MCR HVAC is in a Chlorine Isolation has determined that the MCR HVAC can be in a chlorine isolation for the first seven hours, before it must be transferred into a Radiation Isolation Mode. This analysis assumes 0 scfm filtered air is supplied to the control room for the first seven hours.

In addition to the intake of air through the filter system, some air may enter the control room from inleakage through duct-work and other sources. An infiltration rate of 225 scfm (215 scfm unfiltered inleakage plus 10 scfm due to control room ingress/egress) has been assumed for these unfiltered sources. An assumed inleakage of 10 scfm through the control room doors has been justified by the use of a MCR door seal. The door seal is designed to be erected when thyroid dose in the Turbine Enclosure reaches 10 Rem/Hr. The design of the MCR door seal ensures a minimum cross sectional area through the door way during egress and ingress to ensure air velocity out of the MCR is sufficient to maintain a clean room environment.

Under accident conditions, radiation doses to control room personnel may come from several sources. While in the control room, personnel are exposed to beta and gamma radiation from gaseous fission products that enter after an accident through the ventilation system, or from unfiltered air entering the control room. In addition, personnel are subject to gamma shine dose CHAPTER 15 15.10-6 REV. 13, SEPTEMBER 2006

LGS UFSAR from fission products in the containment, and from fission products in the atmosphere outside the control room.

To evaluate the capability of the control room ventilation system and shielding to keep personnel doses within the specified criteria, an estimate of the average cloud activity concentration by time period prior to intake into the control room ventilation system was made. Since the plume is released as leakage from the containment, the released fission products were assumed to mix in the structure wake. The atmospheric dilution factors were determined using the assumptions and methods described in Reference 15.10-12.

The time-dependent concentration of activity outside the control structure is found by the following equation:

Co = A (X/Q) (EQ. 15.10-5) where:

A = activity release rate as a function of time, Ci/sec X/Q = atmospheric dilution factor, sec/m3 The activity in the control room is equal to the amount that enters during a given time, plus the amount present at the beginning of the period. The rate at which activity enters the control structure is given by:

Q = 1.7 (F (1.0-E) + F01)Co (EQ. 15.10-6) where:

Q = activity intake rate, Ci/hr F = ventilation flow rate of air into the control room (525 cfm) (0 cfm when control room HVAC system is in chlorine isolation mode)

E = efficiency of the intake filter (95% for iodine, 0% for the noble gases)

F01 = unfiltered air inleakage rate into the control room (225 scfm) (215 scfm unfiltered leakage plus 10 scfm for control room ingress/egress) 1.7 = conversion factor (cfm - 1.7 m3/hr)

Activity buildup in the control room is given by:

dA = Q - (60F + 60F01 + R + O)A (EQ. 15.10-7) dt V V where:

Q = activity intake rate, Ci/hr A = activity present in control room, Ci CHAPTER 15 15.10-7 REV. 13, SEPTEMBER 2006

LGS UFSAR V = control room free volume, ft3 R = Recirculation rate

filter efficiency V

= (FR)(ER)

60 V

O = isotopic decay constant, hrs -1 FR = recirculation rate = 2475 cfm (3000 cfm when control room HVAC is in chlorine isolation mode)

ER = recirculation filter efficiency (95% for iodine, 0% for noble gases)

Equation 15.10-7 can be solved analytically to obtain the activity as a function of time in the control room, A(t), and this integrated over a time period to obtain the time integrated activity inventory in the control room, (I). The time integrated concentration (c) for a given time period is calculated by dividing the inventory (I) by the control room volume. Dose rates in the control room can then be computed by time period.

The whole body dose model for operators inside the control room assumes that the operator is at the center of a finite hemispherical cloud of uniform concentration, whose volume is the same as that of the control room. For a point gamma source, the whole body dose is given by:

Df = D/GF (EQ. 15.10-8) where:

Df = whole body gamma dose, rem/hr D = gamma dose from semi-infinite cloud given by Equation 15.10-10 GF = geometry factor of control room GF = Dose from an infinite cloud (EQ. 15.10-9)

Dose from a cloud of volume (V)

= 1173 V0.338 (Reference 15.10-12)

V = volume of control room, ft3 Whole body doses are given by the equation:

N D = 3600 DCFi Ci (EQ. 15.10-10)

CHAPTER 15 15.10-8 REV. 13, SEPTEMBER 2006

LGS UFSAR i=1 where:

DCFi = whole body gamma dose conversion factor, rem-m3/Ci-sec Ci = activity for isotope (i), Ci-hr/m3 Skin doses from beta radiation are given by the equation:

N Ds = 3600 Ci DCFi (EQ. 15.10-11) i=1 where:

Ds = beta skin dose, rem Ci = activity concentration, Ci-hr/m3 DCFi = beta dose conversion factor, rem-m3/Ci-sec 3600 = conversion from hrs to seconds The beta dose conversion factors are based on the work done by Berger (Reference 15.10-13),

and include the effect of attenuation by the layer of dead skin. Values for these dose conversion factors are given in Table 15.10-1.

The thyroid dose for a given time period is given by the equation:

N Dt = 3600 B Ci DCFi (EQ. 15.10-12) i=1 CHAPTER 15 15.10-9 REV. 13, SEPTEMBER 2006

LGS UFSAR where:

Dt = thyroid inhalation dose, rem B = breathing rate = 3.47x10-4 m3/sec DCFi = thyroid dose conversion factors, rem/Ci Ci = average iodine concentration, Ci-hr/m3 3600 = conversion from hrs to seconds 15.

10.3 REFERENCES

15.10-1 "Report of ICRP Committee II Permissible Dose for Internal Radiation (1959),"

Health Physics, Vol 3, pp 30, 146-153, (1960).

15.10-2 C.M. Leadered, et al, "Table of Isotopes", 6th ed, (1968) (or other recognized references).

15.10-3 J.J. Dinunno, et al, "Calculation of Distance Factors for Power and Test Reactor Sites", TID-14844, (March 1962).

15.10-4 D.H. Slade, ed, "Meteorology and Atomic Energy", TID-2419C, (1968).

15.10-5 "Atmospheric Relative Concentrations in Building Wakes"; NUREG/CR-6331, PNNL-10521, Rev. 1; prepared by J. V. Ramsdell, Jr., C. A. Simmons, Pacific Northwest National Laboratory; prepared for U.S. Nuclear Regulatory Commission; May 1997 (Errata, July 1997).

15.10-6 "Atmospheric Dispersion Code System for Evaluating Accidental Radioactivity Releases from Nuclear Power Stations", PAVAN, Version 2, Oak Ridge National Laboratory, U.S. Nuclear Regulatory Commission, December 1997.

15.10-7 "XOQDOQ: Computer Program for the Meteorological Evaluation of Routine Releases at Nuclear Power Stations"; NUREG/CR-2919; J. F. Sagendorf, J. T.

Goll, and W. F. Sandusky, U.S. Nuclear Regulatory Commission; Washington, D.C; 1982.

15.10-8 "Atmospheric Dispersion Estimates in the Vicinity of Buildings"; J. V. Ramsdell and C. J. Fosmire, Pacific Northwest Laboratory; 1995.

15.10-9 NRC, Regulatory Guide 1.145, "Atmospheric Dispersion Models for Potential Accident Consequence Assessments at Nuclear Power Plants (Revision 1)",

November 1982.

15.10-10 No longer used.

CHAPTER 15 15.10-10 REV. 13, SEPTEMBER 2006

LGS UFSAR 15.10-11 No longer used.

15.10-12 K.G. Murphy and K.M. Campe, "Nuclear Power Plant Control Room Ventilation System Design for Meeting General Criterion 19", 13th AEC Air Cleaning Conference.

15.10-13 M.J. Berger, "Beta Ray Dose in Tissue-Equivalent Material Immersed in a Radioactive Cloud", Health Physics, pp 1-12, (January 1974).

15.10-14 D.S. Duncan and A.B. Speir, "GRACE II - A Program for Computing Gamma Ray Attenuation and Heating in Cylindrical and Spherical Geometrics", Atomics International, (1959).

15.10-15 D.S. Duncan and A.B. Speir, "GRACE I - A Program Designed for Computing Gamma Ray Attenuation and Heating in Reactor Shields", Atomic International, (1959).

15.10-16 Federal Guidance Report Number 11, "Limiting Values of Radionuclides Intake and Air Concentration and Dose Conversion Factor for Inhalation, Submersion and Ingestion, "Office of Radiation Programs USEPA", 1989.

15.10-17 Federal Guidance Report Number 12, "External Exposure to Radionuclides in Air, Water, and Soil", 1993.

CHAPTER 15 15.10-11 REV. 13, SEPTEMBER 2006

LGS UFSAR Table 15.10-2 ACCIDENT ATMOSPHERIC DILUTION FACTORS - X/Q TIME NORTH STACK SOUTH STACK PERIOD X/Q X/Q (hrs) (sec/m3) (sec/m3) 0-2 6.88x10-3 1.26x10-3 2-8 5.17x10-3 9.64x10-4 8-24 2.04x10-3 3.80x10-4 24-96 1.29x10-3 2.39x10-4 96-720 9.63x10-3 1.80x10-4 CHAPTER 15 15.10-13 REV. 14, SEPTEMBER 2008

LGS UFSAR Table 15.10-3 BREATHING RATES FOR OFFSITE DOSE CALCULATIONS TIME PERIOD BREATHING RATE (hr) (m3/sec) 0-8 3.47x10-4 8-24 1.75x10-4 24-720 2.32x10-4 CHAPTER 15 15.10-14 REV. 13, SEPTEMBER 2006

LGS UFSAR 15.11 PROBABILISTIC RISK ASSESSMENT The LGS Probabilistic Risk Assessment was performed as requested by the NRC in its May 6, 1980 letter from D.G. Eisenhut (NRC) to E.G. Bauer, Jr. (PECo). The licensee submitted the PRA to the NRC in its March 17, 1981 letter from E.J. Bradley (PECo) to H.R. Denton (NRC).

CHAPTER 15 15.11-1 REV. 13, SEPTEMBER 2006

LGS UFSAR 15.12 STATION BLACKOUT 15.12.1 REQUIREMENTS AND LIMERICK RESPONSE 10 CFR 50.63 Loss of All Alternating Current Power defines the requirements for the Station Blackout and requires each light-water-cooled nuclear power plant licensed to operate to be able to withstand and recover from a station blackout as defined in 10 CFR 50.2. In 1988, the NRC issued Regulatory Guide 1.155, Station Blackout which describes a means acceptable to the NRC for meeting the requirements of 10 CFR 50.63. This regulatory guide endorses the document issued by the Nuclear Utility Management and Resources Council, NUMARC 87-00, Guidelines and Technical Bases for NUMARC Initiatives Addressing Station Blackout at Light Water Reactors.

LGS Units 1 and 2 were evaluated in accordance with the requirements of the Station Blackout Rule using guidance from NUMARC 87-00, except where RG 1.155 takes precedence. The results of the Limerick analyses and assessments are documented in letters to the NRC (References 15.12-2, 15.12-3, 15.12-4, and 15.12-5). The NRC acceptance of the Limerick responses to the Station Blackout Rule is documented in Safety Evaluation Reports -

(References 15.12-6, and 15.12-7).

15.12.2 DETERMINATION OF REQUIRED COPING DURATION 10CFR50.63 requires that the plant be capable of maintaining core cooling and appropriate containment integrity for the station blackout duration. Section 50.63 further requires the following Information:

A proposed station blackout duration including a justification for the selection based on the redundancy and reliability of the onsite emergency AC power sources, the expected frequency of the loss of offsite power (LOOP), and the probable time needed to restore offsite power;

A description of the procedures that will be implemented for station blackout events for the duration (as determined in the paragraph above) and for recovery there from; and a list and proposed schedule for any needed modifications to equipment and associated procedures necessary for the specified SBO duration.

The required coping duration category is based upon the following factors:

1. Offsite Power Design - NUMARC 87-00 distinguishes between sites having particular susceptibilities to losing off-site power to plant-centered, grid-related, and weather-related events. Three off-site power design groups are provided and are designed to be mutually exclusive. Of the three groups P2 includes those sites whose off-site power sources are less redundant or independent, or that are more susceptible to extended offsite power losses due to weather-initiated events or more frequent losses due to plant-centered events.

Based upon NUMARC 87-00 guidance, Limerick Generating Station is determined to be in AC Power Design Characteristic Group, P2. This determination is based upon the following criteria of NUMARC 87-00.

a) The expected frequency of grid-related loss of offsite power (LOOP) does not exceed once per twenty years. As discussed in Limerick Generating Station UFSAR Section 15.2.6, the loss of all grid connections is categorized as an incident of moderate frequency.

CHAPTER 15 15.12-1 REV. 16, SEPTEMBER 2012

LGS UFSAR b) Sites are categorized in groups based upon the estimated frequency of LOOPs due to Extremely Severe Weather. The estimated frequency of loss of off-site power due to ESW is determined by the annual expectation of storms at the site with wind velocities greater than or equal to 125 mph. It has been determined that Limerick Generating Station falls within Extremely Severe Weather Group 3. This was determined utilizing Table 3-1, Extremely Severe Weather Groups Table and Table Extremely Severe Weather Data provided in NUMARC 87-00.

c) The estimated frequency of LOOPs due to severe weather places Limerick Generating Station in Severe Weather Group 2 based on site specific factors. This was determined utilizing Table 3-3, Severe Weather Data and Table 3-4, Severe Weather Group Table provided in NUMARC 87-00.

d) The potential for long duration loss of off-site power events can have a significant impact on station blackout risk and required coping duration. Long duration LOOP events are associated with grid failures due to severe weather conditions or unique transmission system features. Shorter duration LOOP events tend to be associated with specific switchyards features, in particular:

1) The independence of the off-site power source constituting the preferred power supply to the shutdown buses on-site, and

2) The power transfer schemes when the normal source of AC power is lost.

Limerick Generating Station has two off-site power systems that provide the preferred AC electrical power to all Class 1E loads as discussed in UFSAR Chapter 8 (NUMARC 87-00 Group A).

Limerick Generating Station also has two electrically-connected switchyards, and all safe shutdown busses are automatically transferred to the alternate power source on loss of the preferred source (NUMARC-87-00 Group 1 1/2).

2. Onsite Emergency AC (EAC) Power Configuration - After the likelihood of losing off-site power, the redundancy of the emergency AC power system is the next most important contributor to station blackout risk. With greater EAC system redundancy, the potential for station blackout diminishes, as does the likelihood of core damage. Each Limerick unit is equipped with four emergency diesel generators (EDG). Anyone of the EDGs is necessary to operate safe-shutdown equipment at either unit following a loss of offsite power for an extended period.

It is noted that the total shutdown-load requirements for both units combined is greater than the continuous rating of one EDG in each unit and that a minimum of three EDGs are required to support simultaneous shutdown of the two units. Limerick credits excess capacity from the non-blacked out (NBO) unit as the alternate AC (AAC) power source for the blacked out (BO) unit.

Limerick does not rely on a single EDG from the NBO unit as the AAC source for the BO unit.

Also, a limited amount of operator actions are credited to initiate cross-ties between electrical power sources in order to justify the excess capacity from the NBO unit's EDGs. Shutdown-load requirements are such that the capacity of three EDGs is needed to shutdown the two units following a LOOP. For any Individual unit, the shutdown loads will require the capacity of more than one EDG. Thus, two are the minimum required number of EDGs per unit. Since two of the CHAPTER 15 15.12-2 REV. 16, SEPTEMBER 2012

LGS UFSAR four EDGs per unit are needed for shutdown, making the EAC classification of EAC Group B per NUMARC 87-00, Table 3-7.

a) Calculated EDG Reliability - The target emergency diesel generator reliability for Limerick Station is selected to be 0.95. The selection of this value is consistent with NUMARC 87-00 and is based upon having a nuclear unit average reliability for the last 100 demands greater than 0.95.

b) Allowed EDG Reliability - An EDG reliability program has been established to monitor and maintain the EDG target reliability of 0.95 utilizing guidance in RG 1.155, Regulatory Position C.1.2. If the EDG performance falls below the target reliability level of 0.95, action will be taken as required by the EDG reliability program to restore the affected EDG to the target reliability level.

In summary, using the above factors, LGS is a four hour coping duration plant per Table 3-8 in NUMARC 87-00 (Table 2 in RG 1.155).

15.12.3 USE OF ALTERNATE AC SOURCE The LGS offsite power supplies, the station auxiliary power system, and the onsite 4 kV Safeguard Power System are shown in Drawings E-1, E-15 and E-16. At Limerick, Station Blackout is supported by the use of the diesel generators (excess capacity on non-blacked out unit) as an alternate ac (AAC) power source required to be available within one hour from the initiation of a station blackout event to support safe shutdown and decay heat removal from the blacked out unit for the required four hour coping duration. The potential for excess EAC power sources to be used as AAC is directly related to the existing level of EAC redundancy.

Each Limerick unit is equipped with four emergency diesel generators (EDGs). Any one of the EDGs is necessary to operate safe-shutdown equipment at either unit following a loss of offsite power for an extended period. It is noted that the total shutdown-load requirements for both units combined is greater than the continuous rating of one EDG in each unit and that minimum of three EDGs are required to support simultaneous shutdown of the two units. The AAC design at Limerick Generating Station uses a limited amount of operator actions to initiate electrical cross-ties between power sources in order for the blacked-out (BO) unit to utilize the excess capacity from the NBO EDGs.

There are a number of mechanical systems at LGS whose functions are normally shared between units (e.g., Residual Heat Removal Service Water (RHRSW), and Emergency Service Water (ESW)). Accordingly, the loads for certain of these systems were assumed to be powered by the adjacent unit's power source. Due to the assumed loss of one of the NBO diesels, there is some likelihood that the failed EDG will power an ESW pump and that only one ESW loop will be available in the initial few minutes of the SBO event. The ESW loop will be restored during the cross-tie of the NBO 4kV busses. After the busses are cross-tied, ESW will be restored and the third diesel on the NBO can be restarted to support the BO unit shutdown loads. This is intended to be performed during the first 60 minutes of the SBO event.

For LGS Units 1 and 2, the AAC power source satisfies the requirements for station blackout in conformance with Regulatory Guide 1.155.

15.12.4 ASSESSMENT OF ABILITY TO COPE WITH A STATION BLACKOUT CHAPTER 15 15.12-3 REV. 16, SEPTEMBER 2012

LGS UFSAR Coping with station blackout using the AAC approach entails a short period of time in an ac-independent state (up to one hour) while the operators initiate power from the AAC source.

Once AAC power is available, the plant transitions to the AAC source which provides decay heat removal until offsite or EAC power becomes available. Therefore, the LGS coping assessments must address the four hour coping duration but certain safe shutdown equipment such as RHR pumps, air compressors, and battery chargers can be repowered after the first hour and used for the remainder of the coping duration. Coping assessments were performed in the following areas: condensate inventory, Class 1E battery capacity, compressed air, loss of ventilation, and containment isolation. In each case, capability to successfully cope with blackout for the four hour period was demonstrated.

15.12.4.1 Condensate Inventory for Decay Heat Removal A supply of 92,100 gallons of water is required for decay-heat removal during a SBO 4-hour coping period. A calculation was performed to show that the Condensate Storage Tank (CST) provides 138,800 gallons of water, which exceeds the required quantity for coping with a four-hour station blackout. A leakage rate of 25 gpm per recirculation pump was assumed in the calculated analysis. Since the AAC power source will be available within one hour, the residual heat removal (RHR) system would be powered to provide suppression pool cooling. Therefore, the CST inventory will not be required at any time during the four-hour duration of the SBO event. The calculation demonstrates the acceptability of using only the suppression pool inventory for reactor pressure vessel (RPV) makeup and reactor heat removal. No credit for the water volume has been taken in the SBO analysis and the CST inventory is available as an additional heat removal source.

15.12.4.2 Class 1E Battery Capacity The Class 1E battery bank has sufficient capacity to independently supply the required loads for a design basis accident for 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months . The SBO loads are a subset of the design basis accident loads, the station battery capacity is sufficient to meet SBO shutdown requirements for 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months .

At 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months into the SBO event, with the AAC power source available, the ability to power selected battery chargers is available.

15.12.4.3 Compressed Gas The AAC power source is capable of energizing an instrument air compressor and an instrument gas compressor within one hour of a station blackout. The only air-operated valves relied upon during a station blackout are the Automatic Depressurization System (ADS) valves.

These valves have sufficient backup gas supplies to cope with a station blackout for the entire event and sufficient local gas supply is available such that reliance of the air compressor after an hour is not needed. Valves requiring manual operation or that need backup sources will be identified in station procedures.

15.12.4.4 Effects of Loss Of Ventilation Reasonable assurance of operability is established if the following criteria are met:

1) The temperature in the Dominant Area of Concern (DAC) are calculated to be equal to or less than 120, or CHAPTER 15 15.12-4 REV. 16, SEPTEMBER 2012

LGS UFSAR

2) The system in the DAC is assumed to operate no longer than 10 minutes after the onset of the blackout, or

3) The methodology outlined in Appendix F of NUMARC 87-00 indicates that no components in the DAC have operability limits below the calculated bulk room temperature.

At Limerick Generating Station, the AAC power supply does not power cooling loads to some plant areas that contain station blackout response equipment during the hour after the onset of the station blackout event. Evaluation of the following specific areas was performed Units 1 and 2 APRM Inverters (Aux Equip Rm), Unit 2 RPS computer and Inverter rooms, RCIC Pump Room, Drywell and Main Control Room. These areas have been evaluated to establish reasonable assurance of operability for station blackout event.

15.12.4.5 Containment Isolation The station list of containment isolation valves has been reviewed to verify that the valves which must be capable of being closed or that must be operated (cycled) under station blackout conditions can be positioned (with indication) independent at the preferred and black-out unit's Class 1E power supplies.

No plant modifications were determined to be required to ensure that appropriate containment integrity can be provided under SSO conditions. Limerick Generating Station procedures include all actions necessary to assure containment integrity.

15.12.4.6 Reactor Coolant Inventory Adequate reactor coolant system (RCS) inventory is maintained to ensure core cooling for 4-hour duration. HPCI and RCIC system are capable at supplying sufficient inventory to keep the core covered. RCS makeup is necessary to remove decay heat, to compensate for RCS cool down, and to replenish an assumed RCS inventory loss of 50 gpm due to the reactor coolant pump seal leakage (25 gpm per pump) and to provide for Technical Specification maximum allowable leakage (30 gpm). The RCIC pump, which is steam-driven, injects at a rate of 600 gpm, which exceeds the average water injection rate necessary for decay heat removal and the 80 gpm leak rate.

The AAC source powers the necessary make-up systems within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months to maintain adequate RCS inventory to ensure that the core is cooled for the required coping duration. The expected rates of reactor coolant inventory loss under SBO conditions do not result in uncovering the core in an SBO of four hours.

15.12.5 PROCEDURES FOR SBO Limerick Generating Station procedures comply with the guidelines of NUMARC 87-00, Section

4. SBO response guidelines provide for operator actions to be taken in a SBO event; guidance is provided to operations and load dispatcher personnel for actions to restore AC power in a station blackout; and guidance is given for operators to determine the proper actions due to the onset severe weather. During the SBO event, for the NBO unit, excess capacity is not attained by load shedding. This ensures that there is no degradation of the normally available shutdown capability for the LOOP condition. Additionally, there is no load switching or disablement of information readouts or alarms in the main control room that would degrade the normal CHAPTER 15 15.12-5 REV. 16, SEPTEMBER 2012

LGS UFSAR shutdown capability for a LOOP in the NBO unit. Limerick Generating Station procedures incorporate these guidelines and are described as follows:

Procedure E Loss of All AC Power (Station Blackout)

Procedure E-10/20 - Loss of Offsite Power Verifies Containment Isolation Valves Procedure SE Preparation for Severe Weather 15.

12.6 REFERENCES

15.12-1 NUMARC 87-00, "Guidelines and Technical Bases for NUMACR initiatives Addressing Station Blackout at Light Water Reactors."

15.12-2 Letter to NRC Document Control Desk from G. A. Hunger dated April 17, 1989, Limerick Generating Station, Units 1 and 2, Response to 10CFR50.63, "Loss of All Alternating Current Power" (DCS Sequence # 2890013820).

15.12-3 Letter to NRC Document Control Desk from G. A. Hunger dated April 9, 1990, Limerick Generating Station, Units 1 and 2, 10CFR50.63, "Loss of All Alternating Current Power" Supplemental Information (DCS Sequence # 2906110880).

15.12-4 Letter to NRC Document Control Desk from G.J. Beck dated September 4, 1991, Limerick Generating Station, Units 1 and 2, 10CFR50.63, "Loss of All Alternating Current", Response to NRC Safety Evaluation (DCS Sequence # 2916033730).

15.12-5 Letter to NRC Document Control Desk from G.J. Beck dated February 14, 1992, Limerick Generating Station, Units 1 and 2, 10CFR50.63, "Loss of All Alternating Current, Response to NRC Concerns (DCS Sequence # 2924001490).

15.12-6 Safety Evaluation by the Office of Nuclear Reactor Regulation, Station Blackout Safety Evaluation, Philadelphia Electric Company, Limerick Generating Station, Units 1 and 2, Docket Nos. 50-352/353, dated June 3, 1991 (DCS Sequence #

2916024860).

15.12-7 Supplemental Safety Evaluation by the Office of Nuclear Reactor Regulation, Station Blackout Rule (10CFR50.63), Philadelphia Electric Company, Limerick Generating Station, Units 1 and 2, Docket Nos. 50-352/353, dated June 10, 1992 (DCS Sequence # 2920013850).

CHAPTER 15 15.12-6 REV. 16, SEPTEMBER 2012

ML21253A062

Contents

Text

6.8 REFERENCES

7.7 REFERENCES

8.4 REFERENCES

SUMMARY

10.3 REFERENCES

12.6 REFERENCES

Navigation menu

ML21253A062

Text

6.8 REFERENCES

7.7 REFERENCES

8.4 REFERENCES

SUMMARY

10.3 REFERENCES

12.6 REFERENCES

Navigation menu

Search