ML21286A555

Amendment 29 to Updated Final Safety Analysis Report, Chapter 14, Section 14.5, Analyses of Abnormal Operational Transients

ML21286A555
Person / Time
Site:	Browns Ferry
Issue date:	10/04/2021
From:	Tennessee Valley Authority
To:	Office of Nuclear Reactor Regulation
Shared Package
ML21286A574	List: ML21277A142 ML21286A195 ML21286A196 ML21286A197 ML21286A198 ML21286A199 ML21286A200 ML21286A201 ML21286A204 ML21286A205 ML21286A206 ML21286A210 ML21286A211 ML21286A212 ML21286A213 ML21286A216 ML21286A217 ML21286A218 ML21286A219 ML21286A220 ML21286A221 ML21286A222 ML21286A223 ML21286A224 ML21286A225 ML21286A226 ML21286A227 ML21286A229 ML21286A230 ML21286A231 ML21286A232 ML21286A233 ML21286A234 ML21286A235 ML21286A236 ML21286A237 ML21286A238 ML21286A239 ML21286A240 ML21286A241 ML21286A242 ML21286A243 ML21286A244 ML21286A245 ML21286A246 ML21286A247 ML21286A248 ML21286A249 ML21286A250 ML21286A252 ... further results
References
Download: ML21286A555 (37)

Text

BFN-29 14.5 ANALYSES OF ABNORMAL OPERATIONAL TRANSIENTS 14.5.1 Objective This section contains general descriptions of abnormal operational transients analyzed for BFN Units 1, 2, and 3.

The results of these analyses may change with subsequent core reloads. The bounding transients are re-analyzed for each fuel reload and subsequent operating cycle to determine which is most limiting. Events for which a newer fuel reload specific analysis need to be performed are noted. These results can be found in the appropriate reload licensing document.

BFN Units 1, 2, and 3 have a similar system geometry, reactor protection system (RPS) configuration and mitigation functions (as described in earlier sections of the UFSAR). Additionally, BFN Units 1, 2, and 3 have similar thermal-hydraulic and transient behavior characteristics. Therefore, trends are expected to be the same for all units. Consequently, the transient analyses described in this chapter were performed for BFN Unit 3 and used as the representative unit to quantify trends for the other unit. Potentially limiting transients were analyzed in support of Extended Power Uprate licensing. These analyses were re-evaluated in support of MELLLA+

licensing, and only those events that were found to be clearly more limiting in the MELLLA+ domain have been updated. Cycle specific transient analysis results are documented in Appendix N.

The analyses are based on the core loading characteristics of BFN 24-month fuel equilibrium cycle with AREVA ATRIUM-10XM. This is considered to be representative of future cycles, because specific fuel operating limits will continue to be calculated for each fuel cycle according to current reload practice. For the non-limiting transient events not re-analyzed on a reload specific basis, the 24-month cycle exposure assumption is also applicable to shorter fuel cycle length, since the fuel exposure variation has a negligible impact on the transient results and will not cause the severity trend to change significantly.

14.5.1.1 Transient Events Classification The transient analyses that have been analyzed in this document are classified into seven categories of events. These seven categories and the transient events which they include are:

14.5-1

BFN-28 A) Events Resulting in a Nuclear System Pressure Increase:

1. Generator Load Reject

2. Loss of Condenser Vacuum

3. Turbine Trip

4. Turbine Bypass Valve Malfunction

5. Main Steam Isolation Valve Closure

6. Pressure Regulator Downscale Failure B) Events Resulting in a Reactor Vessel Water Temperature Decrease:

1. Loss of a Feedwater Heater

2. Shutdown Cooling (Residual Heat Removal System)

Malfunction-Decreasing Temperature

3. Inadvertent Pump Start C) Events Resulting in a Positive Reactivity Insertion:

1. Continuous Control Rod Withdrawal During Power Range Operation

2. Continuous Rod Withdrawal During Reactor Startup

3. Control Rod Removal Error During Refueling

4. Fuel Assembly Insertion Error During Refueling D) Events Resulting in a Reactor Vessel Coolant Inventory Decrease:

1. Pressure Regulator Failure Open

2. Inadvertent Opening of a Main Steam Relief Valve

3. Loss of Feedwater Flow

4. Loss of Auxiliary Power E) Events Resulting in a Core Coolant Flow Decrease:

1. Recirculation Flow Control Failure - Decreasing Flow

2. Trip of One Recirculation Pump

3. Trip of Two Recirculation Pumps

4. Recirculation Pump Seizure F) Events Resulting in a Core Coolant Flow Increase:

1. Recirculation Flow Controller Failure - Increasing Flow

2. Startup of Idle Recirculation Pump G) Events Resulting in Excess of Coolant Inventory:

1. Feedwater Control Failure - Maximum demand 14.5-2

BFN-28 14.5.1.2 Transient Events Conditions for UFSAR Analysis Computer Codes NRC approved computer models have been used for the analysis of each event.

The computer codes used in the different transient events analyses are AREVA codes unless otherwise noted, and are summarized as follows:

14.5-3

BFN-28 Transient Event Description Computer Code Used for Analysis Generator Trip (TCV Fast Closure) With Bypass Valves COTRANSA2 Failure XCOBRA XCOBRA-T RODEX2 RODEX4 Load Rejection No Bypass/EOC-RPT-OOS COTRANSA2 XCOBRA XCOBRA-T RODEX2 RODEX4 Bypass Valves Failure Following Turbine Trip, High COTRANSA2 Power XCOBRA XCOBRA-T RODEX2 RODEX4 Closure of All Main Steam Line Isolation Valves COTRANSA2 Closure of One Main Steam Line Isolation Valve COTRANSA2 Loss of a Feedwater Heater MICROBURN-B MICROBURN-B2 3-D Inadvertent Pump Start COTRANSA1/XCOBRA/XCOBRA-T Continuous Rod Withdrawal During Power Range CASMO-4/MICROBURN-B2 Operation Pressure Regulator Failure Open COTRANSA2 Loss of Feedwater Flow COTRANSA2 Recirculation Flow Control Failure-Decreasing Flow CONTRANSA2/XCOBRA-T Recirculation Pump Seizure COTRANSA2 XCOBRA XCOBRA-T RODEX2 RODEX4 Recirculation Flow Control Failure-Increasing Flow CASMO-4/MICROBURN-B2 XCOBRA Startup of Idle Recirculation Loop COTRANSA2 XCOBRA XCOBRA-T RODEX2 RODEX4 Feedwater Control Failure- Maximum Demand COTRANSA2 XCOBRA XCOBRA-T RODEX2 RODEX4 Feedwater Control Failure- Maximum COTRANSA2 Demand/EOC-RPT-OOS XCOBRA XCOBRA-T RODEX2 RODEX4 Feedwater Control Failure- Maximum Demand/TBP- COTRANSA2 OOS XCOBRA XCOBRA-T RODEX2 RODEX4 The AREVA codes COTRANSA2, RODEX2 and CASMO-4/MICROBURN-B2 are the major codes used in the Overpressurization Analysis as described in the THERMEX methodology. COTRANSA2, reactor transient analysis code is currently being used for Browns Ferry reload analysis which includes Overpressurization analysis designs. The overpressurization was modeled by MSIV closure, TSV closure, and TCV closure (without bypass). The analyses were performed with the AREVA plant simulator code COTRANSA2 for 102% and 87.5% of 3952 MWt, and are performed on a cycle specific basis to demonstrate the adequacy of the pressure relief system. The plant response for transition cores will be similar to the plant response for a full core of ATRIUM 10XM fuel. Cycle-specific analyses reflecting the actual core configuration will be performed 14.5-4

BFN-28 as part of the reload licensing analysis. Core and fuel operating limits will be revised to ensure all licensing criteria are met.

For reload licensing analyses, the AREVA 3-D core simulator code MICROBURN-B2 is used for quasi steady-state analyses such as the RWE and LFWH. For the slow recirculation flow run-up event for setting MCPRf limits, the XCOBRA steady state core thermal hydraulics code is used. For fast transient (e.g.,

overpressurization) events, the one-dimensional kinetic thermal-hydraulic COTRANSA2 code is used for the reactor system analysis, with the XCOBRA/XCOBRA-T codes evaluating the initial and transient hot channel hydraulics and delta-CPR. All of these analyses are performed at the nominal reactor power conditions; the application methodology provides conservatism by accounting for uncertainties in the computed results.

Fuel pellet-to-cladding gap conductance values are evaluated using RODEX2. The ACE/ATRIUM 10XM critical power correlation is used to evaluate the thermal margin for the ATRIUM 10XM fuel. Safety Limit MCPR analyses use the SAFLIM3D code and associated methodology. RODEX4 is used to determine ATRIUM 10XM LHGRFACp multipliers.

The heat transfer coefficients used in the transient analysis are calculated using the NRC-approved code RODEX2 at each cycle exposure where analyses are required.

The heat transfer coefficients are calculated for a core average value, used in COTRANSA2, and for a hot channel fuel model, used in XCOBRA-T.

14.5-5

BFN-29 Reload Analysis Scope:

The bounding transients are re-analyzed for each fuel reload and subsequent operating cycle to determine which is most limiting. The results of these specific analyses may change with subsequent core reloads. These results can be found in the appropriate reload licensing document. Events for which a cycle-specific reload analysis are performed are the following:

a. Generator Load Reject (TCV Fast Closure) with Turbine Bypass Valve Failure (LRNBP)

b. Turbine Bypass Valve Failure Following Turbine Trip, High Power (TTNBP)

c. Feedwater Controller Failure Maximum Demand (FWCF)

d. LFWH or Inadvertent Pump Start

e. Continuous Rod Withdrawal During Power Range Operation (RWE)

f. Pump Seizure during Single Loop Operation If the thermal limits that result from any of the above events are clearly bounded by another event then that event is not analyzed.

14.5.1.3 Reactor Operating Domain The power/flow map is shown in FSAR Chapter 3. It includes operation in the Maximum Extended Load Line Limit (MELLL) domain, which allows plant operation with core flow as low as 99 percent of rated at 3952 MWt. This boundary maintains the same maximum control rod load line as OLTP operation (i.e., 75 percent core flow at 3293 MWt) and is consistent with the generic guidelines provided in the GE Nuclear Energy Licensing Topical Report, Constant Pressure Power Uprate, NEDC-33004P-A, Revision 4, July 2003. The Increased Core Flow (ICF) domain is bounded by the constant recirculation pump speed line corresponding to 105% core flow at 3458 MWt. Above 3458 MWt, core flow is limited to a maximum of 105% of rated core flow. The power/flow map also includes operation in the MELLLA+

domain, which allows plant operation with core flow as low as 85% of rated at 3952 MWt.

14.5.1.4 Reactor Heat Balance The reactor heat balance defines the thermal-hydraulic parameter input and output within the vessel boundary at a selected core thermal power. These thermal-hydraulic parameters also initialize the conditions assumed for the plant safety analysis. The heat balance at 3952 MWt is shown in FSAR Chapter 1.

A computer program (ISCOR for GE analyses) is utilized to obtain heat balance parameters for operation at 100 and 102 percent power level (for events which require a 2 percent power uncertainty) and other power/flow points considered for transient analyses on the operating domain power/flow map.

14.5-6

BFN-29 14.5.1.5 Reactor Operating Flexibility Features As previously stated, the BFN operating features include:

1) MELLL and average power range monitor (APRM)/rod block monitor (RBM) Technical Specification (ARTS) Improvements Program

[NEDC-32433-P, "Maximum Extended Load Line Limit and ARTS Improvement Program Analyses for Browns Ferry Nuclear Plant Units 1, 2, and 3", April 1995].

2) ICF up to 105 percent of rated core flow individually or combined with Final Feedwater Temperature Reduction (FFWTR), corresponding to a 55 degrees F reduction in feedwater temperature at rated conditions.

Additional analysis allows further reductions in feedwater temperature at low power with additional thermal limit penalties. It is not permissible to operate above the specified power with more than 55 degrees F reduction in feedwater temperature. It is also nott permissible to operate in the MELLLA+ domain with a feedwater heater out of service resulting in more than a 10°F reduction in feedwater temperature below the design feedwater temperature of 394.5°F. [NEDO-22135, "Safety Review of Browns Ferry Nuclear Plant Unit No. 1 at Core Flow Conditions above Rated Flow During Cycle 5," October 1982; NEDO-22245, "Safety Review of Browns Ferry Nuclear Plant Unit No. 2 at Core Flow Conditions above Rated Flow During Cycle 5," October 1982; NEDO-22149, "Safety Review of Browns Ferry Nuclear Plant Unit No. 3 at Core Flow Conditions above Rated Flow During Cycle 5," June 1982; (b) Safety Review for Browns Ferry Unit 2 Cycle 7 Final Feedwater Temperature Reduction, NEDC-32356P, June 1994; Memo, J. M. Moose to A. W. Will, Evaluation of Thermal Margin During Startup With Reduced Feedwater Temperature-Phase 2, Revision 1, AWW:06:077R1, May 16, 2006; NEDC-33877P, Safety Analysis Report for Browns Ferry Nuclear Plant Units 1, 2, and 3 Maximum Extended Load Lime Limit Analysis Plus, February, 2018].

3) Turbine Bypass Out-of-Service (TBP-OOS) [NEDC-32774P, Rev 1, "Safety Analyses for Browns Ferry NP Units 1, 2, and 3. Turbine Bypass and End-of-Cycle Recirculation Pump Trip Out-of-Service",

September 1997.

4) End-of-Cycle Recirculation Pump Trip Out-of-Service (EOC-RPT-OOS) [NEDC-32774P, Rev 1, "Safety Analyses for Browns Ferry NP Units 1, 2, and 3. Turbine Bypass and End-of-Cycle Recirculation Pump Trip Out-of-Service", September 1997.

14.5-7

BFN-29

5) 24 Month Fuel Cycle.

6) Main Safety/Relief Valves Setpoint Tolerance Relaxation (+3 percent) and One Main Safety/Relief Valve Out-of-Service (1 MSRV-OOS).

7) Improved Standard Technical Specifications.

8) Limiting transients with PLU-OOS

9) Maximum Extended Load Line Limit Analysis Plus (MELLLLA+)

These operating flexibility options have been included as part of the analyses assumptions for the BFN licensing analyses (NEDC-33877P, Safety Analysis report for Browns Ferry Nuclear Plant Units 1, 2, and 3 Maximum Extended Load Line Limit Analysis Plus, GE Hitachi Nuclear Energy, February 2018 and ANP-33551P, AREVA MELLLA+ Safety Analysis Report for Browns Ferry Units 1, 2, and 3, AREVA Inc., December 2017). The EOC-RPT-OOS mode of operation eliminates the automatic Recirculation Pump Trip signal when Turbine Trip or Load Rejection occurs. As such, the core flow decreases at a slower rate following the recirculation pump trip due to the anticipated transient without scram (ATWS) High Pressure recirculation system trip, thus increasing the severity of the transient responses.

This EOC-RPT-OOS option will only be analyzed for the limiting events, LRNBP, TTNBP, and FWCF. These limiting events bound the UFSAR events described in this section, even when it comes to applicability of these equipment OOS (EOOS) and setpoint relaxation options.

The Turbine Bypass Out-of-Service (TBP-OOS) contingency mode of operation produces a different evolution in the pressurization phases of the transients. The overpressurization is faster because the bypass system is not operable, thus the pressure setpoints are reached earlier. However, the positive reactivity insertion due to moderator void collapse is more severe; and this results in a higher delta-critical power ratio (delta-CPR) and, subsequently, a higher operating limit minimum critical power ratio (OLMCPR). The FWCF assumes that turbine bypass system is functional while other limiting transients do not. Consequently, this transient is strongly affected by TBP-OOS.

This option will only be analyzed for the FWCF transient which bounds the UFSAR events described in this section even when it comes to applicability of these EOOS and setpoint relaxation options.

The Main Steam Relief Valve (MSRV) Setpoint Tolerance Relaxation option is assumed for all the transients analyzed as long as the MSRV actuation (mainly for events resulting in a nuclear system pressure increase) results in a more severe transient response with these EOOS and setpoint relaxation options.

14.5-8

BFN-29 The off-rated power dependent MAPLHGR(P) and MCPR(P) limits and the off-rated flow dependent MAPLHGR(F) and MCPR(F) limits for these flexibility options are included in the Core Operating Limits Report (COLR). The current COLR for each BFN unit is included in Appendix B of the corresponding Technical Requirements Manual (TRM). To ensure fuel protection during postulated transients at off-rated power and flow conditions, these calculations include extensive transient analyses at various off-rated state points.

Off-rated power/flow conditions were assumed in the references mentioned above such that the entire power/flow map is bounded by the results obtained for the chosen conditions. Power/flow state points outside the power/flow map were analyzed in order to include extra conservatism in the calculations. Other operating flexibility features as listed above were also included in the transients analyses assumptions. Therefore, the transients analyzed in this chapter are protected by these off-rated limits (MAPLHGR(P), MCPR(P), MAPLHGR(F), and MCPR(F)) in the entire power flow map domain.

For reload analyses, off-rated thermal limits are calculated on a cycle-specific basis.

14.5.1.6 Transient Input Parameters The range of system input parameters for transient analysis mainly consist of heat balance information, core characteristics, and reactor protection specifications. The inputs include the initial power and flow conditions, core pressure drop, void fraction, nuclear dynamic parameters (Doppler, void and scram reactivity coefficients), and plant operating configuration (such as scram speed, safety/relief valves setpoints, reactor scram setpoints, recirculation/feedwater pump trip).

Table 14.5-2 shows the analysis basis values of key parameters of BFN operation.

14.5.1.7 Transient Power/Flow/Exposure Conditions The following rated thermal power and core flow conditions from the BFN power/flow map are selected as representative for the standard (STD), MELLL, and ICF regions:

1. 100P/99F (MELLL domain)

2. 100P/100F (standard domain)

3. 100P/105F (ICF domain)

4. 100P/85F (MELLLA+ domain) 14.5-9

BFN-29 The 100P is defined as 100 percent of rated power or 3952 MWt. The 100F is defined as 100 percent of rated core flow or 102.5 E6 lbm/hr; 99F and 105F are defined as 99 percent and 105 percent of rated core flow, respectively, and 85°F is defined as 85% of rated core flow. As previously discussed, some transients are analyzed at 4031 MWt or 102 percent of rated power (i.e., 102P).

The UFSAR transient analyses have considered the full spectrum of core conditions from the beginning, middle, and end of the cycle (BOC, MOC, EOC), whichever is more limiting for the transient event under consideration. A bounding 24-month fuel cycle length is also included in the cycle exposure calculations.

14.5.2 Events Resulting in a Nuclear System Pressure Increase Events that result directly in significant nuclear system pressure increases are those that result in a sudden reduction of steam flow while the reactor is operating at power. A survey of the plant systems has been made to identify events within each system that could result in the rapid reduction of steam flow. The following events were identified:

a. Generator Load Reject

b. Loss of Condenser Vacuum

c. Turbine Trip

d. Turbine Bypass Valve Malfunction

e. Closure of Main Steam Isolation Valve

f. Pressure Regulator Malfunction 14.5.2.1 Generator Load Reject (Turbine Control Valve [TCV] Fast Closure) 14.5.2.1.1 Transient Description A loss of generator electrical load from high power conditions produces the following transient sequence:

a. Turbine-generator power/load unbalance circuitry operates the control valve fast acting solenoid valves to initiate turbine control valve (TCV) fast closure (minimum response time of TCV fast closure: 0.15 seconds),

b. Turbine control valve fast closure is sensed by the reactor protection system, which initiates a scram and simultaneous recirculation pump trip (for initial power levels above 26 percent rated),

14.5-10

BFN-28

c. The turbine bypass valves are opened simultaneously with turbine control valve closure, and reroute the vessel steam flow to the condenser.

d. Reactor vessel pressure rises to the MSRV setpoints, causing them to open for a short period of time.

e. The steam passed by the MSRVs is discharged into the suppression pool, and

f. The turbine bypass valve (TBV) system controls nuclear system pressure after the MSRVs close.

Below 26 percent of rated power, the TBV system will transfer steam around the turbine and thereby avoid reactor scram. This transient is not analyzed as it is bounded by the Generator Trip (TCV Fast Closure) With Turbine Bypass Valve Failure transient described in Section 14.5.2.2.

14.5.2.2 Generator Load Reject (TCV Fast Closure) with Turbine Bypass Valve Failure (LRNBP) 14.5.2.2.1 Transient Description The most severe transient for a full-power generator trip occurs if the turbine bypass valves fail to operate. Although the TCV fast closure time is slightly longer than that of the turbine stop valves, the control valves are considered to be partially closed initially. This results in the generator trip steam supply shutoff being faster than the turbine stop valve steam shutoff.

A generator trip from high power conditions produces a transient sequence similar to the sequence described in Section 14.5.2.1 except the turbine bypass valves are assumed to remain closed. The LRNBP event is caused by the fast closure of all turbine control valves (TCVs) due to significant loss of electrical load on the generator. This will cause a sudden reduction in steam flow that results in significant vessel pressurization. The turbine bypass system is conservatively assumed to be inoperable for this event. A reactor scram signal is initiated by the TCVs closure.

The LRNBP event is identified as one of the most limiting abnormal operational transients for the BFN licensing analyses (assuming all equipment in service).

Therefore, this event is analyzed to determine the operating limits and to verify the plant safety margins.

14.5-11

BFN-28 This abnormal operating transient is evaluated for each reload core to determine if this event could potentially alter the previous cycle MCPR operating limit. The analyses of this event for the most recent reload cycle is contained in the unit-specific and cycle-specific Reload Licensing Report.

14.5.2.2.2 Initial Conditions and Assumptions The reload analysis described in this section was performed with the AREVA models/computer codes COTRANSA2, XCOBRA, XCOBRA-T, RODEX2, and RODEX4, at the limiting power/flow conditions at normal operation: 100 percent rated power (consistent with the current licensing methodology) and maximum core flow (ICF) conditions. For bounding purposes, normal feedwater temperature (as opposed to reduced feedwater temperature) is assumed since the reactor steam generation would be lower with a reduced feedwater temperature.

14.5.2.2.3 Interpretation of Transient Results Figures 14.5-5a, b, and c show the plant-specific response to the generator load rejection without bypass at 100 percent rated power and 105 percent flow conditions. The neutron flux peaks at 333 percent of rated; the average heat flux peaks at 124 percent of rated. The peak pressure at the bottom of the vessel is 1321 psia which is well below the ASME upset code transients limit of 1375 psig while the peak steam line pressure is 1329 psia. The calculated delta-CPR at the stated conditions is 0.31 for AREVA fuel; this result is representative but not bounding for other fuel types.

At rated power, the delta-CPR for the LRNBP event is one of the most severe resulting from any other pressurization event. As power is reduced, the severity of the transient increases; but the fuel integrity is protected by the power-flow dependent thermal limits (see Section 14.5.8).

14.5.2.2.4 Generator Load Reject with Turbine Bypass Valve Failure with EOC-RPT-OOS The EOC-RPT-OOS condition eliminates the automatic Recirculation Pump Trip signal when Load Rejection occurs increasing the severity of the transient response.

At power levels below 26 percent of rated power (Pbypass), the RPT is always bypassed in conjunction with the scram on TSVs/TCVs closure. Therefore, these low power cases are not affected by the EOC-RPT-OOS condition.

Figures 14.5-6a, b, and c show the transient results for the 100 percent of rated power and 105 percent of rated core flow case. EOC exposure and normal feedwater temperature conditions have been assumed for this transient analysis.

14.5-12

BFN-28 The neutron flux peaks at 392 percent of rated, the average heat flux peaks at 130 percent of rated. The peak pressure at the bottom of the vessel is 1339 psia which is well below the ASME upset code transients limit of 1375 psig while the peak steam line pressure is 1304 psia. The calculated delta-CPR of this transient at the stated conditions is 0.38.

The penalty associated with EOC-RPT-OOS is about 0.07 in delta-CPR. At less than rated core flow, the penalty is smaller because of the relatively reduced beneficial effect of EOC-RPT.

Power-dependent LHGR(P) multipliers are used. Power and flow dependent MAPLHGR, LHGR, and MCPR limits are developed on a cycle-specific basis.

14.5.2.3 Loss of Condenser Vacuum (LCV) 14.5.2.3.1 Transient Description This case is a severe abnormal operational transient resulting directly in a nuclear system pressure increase. It represents the events that would follow an assumed instantaneous loss of vacuum; main and feedwater turbines trip when their vacuum protection setpoints are reached, main turbine trip (TT) initiates reactor scram, recirculation pump trip (RPT), and turbine bypass opening. Later in the transient, the condenser vacuum is assumed to drop to the setpoints for closure of TBVs. This event is bounded by the TTNBP event.

14.5.2.4 Turbine Trip (TSV Closure) 14.5.2.4.1 Transient Description A turbine trip is the result of a turbine or reactor system malfunction which results in a TSV fast closure (0.1 second closure time). This event represents a fast steam flow shutoff; and therefore, the potential for one of the most severe pressure-induced transients. Position switches on the stop valves provide the means of sensing the trip and initiating immediate reactor scram (for initial power levels above 26 percent of 3952 MWt). The bypass valves are opened by the control system upon a turbine trip. The bypass system regulates reactor pressure during reactor shutdown.

Although the TCV fast closure time is slightly longer (0.15 second) than that of the TSV (0.1 second), the control valves are considered to be partially closed initially.

This results in the generator trip steam supply shutoff being faster than the turbine stop valve steam shutoff while the protection system response is almost the same for each case (see Section 14.5.2.1).

This event is bounded by the TTNBP event.

14.5-13

BFN-28 14.5.2.5 Turbine Bypass Valves Failure Following Turbine Trip, High Power (TTNBP) 14.5.2.5.1 Transient Description This event is included to illustrate that a single failure could prevent the turbine bypass valves from opening in conjunction with a turbine trip.

The turbine trip with no bypass (TTNBP) event is similar to the LRNBP event. Even though the TTNBP has been shown to be bounded by the LRNBP, it is analyzed in the UFSAR for completeness.

14.5.2.5.2 Initial Conditions and Assumptions The calculation of this transient has been performed with the AREVA models/computer codes COTRANSA2, XCOBRA, XCOBRA-T, RODEX2, and RODEX4, at the most limiting conditions: 100 percent of rated power, 105 percent of rated core flow, EOC exposure conditions, and normal feedwater temperature. The EOC exposure has been used because the top peaked axial power shape degrades the effectiveness of rod insertion during the reactor scram. The turbine bypass system is assumed to be inoperable.

14.5.2.5.3 Interpretation of Transient Results Figures 14.5-9a, b, and c illustrate this transient. This transient evolves in a similar way to the TTBP event, although the bypass failure produces a more severe transient. Peak neutron flux reaches 332 percent of rated power while peak heat flux reaches 124 percent of rated power. Peak steam line pressure and peak vessel pressure reach 1329 and 1321 psia, respectively.

The results show a delta-CPR of 0.31 for this event. This trend is similar to that observed above for the LRNBP event. The TTNBP event is bounded by the LRNBP event. The TTNBP event is reanalyzed each cycle to evaluate the required core thermal operating limits (i.e., MCPR).

14.5.2.6 (Deleted) 14.5-14

BFN-28 14.5.2.7 Main Steam Isolation Valve (MSIV) Closure Automatic circuitry or operator action can initiate closure of the main steam isolation valves. Position switches on the valves provide reactor scram if valve(s) in three or more main steam lines are less than 90 percent open, and the mode switch is in the Run position. However, protection system logic does permit the test closure of one valve without initiating scram from the position switches. Inadvertent closure of one or all of the isolation valves from reactor scrammed conditions (such as Appendix G) will produce no significant transient. Closures during plant heatup will be less severe than the maximum power cases (maximum stored and decay heat) which follow.

14.5.2.7.1 Closure of All Main Steam Isolation Valves 14.5.2.7.1.1 Transient Description This transient represents the simultaneous isolation of all MSIVs while the reactor is operating at power. Reactor scram is initiated by the MSIVs position switches before the valves have traveled more than 10 percent from the initial open position.

The closure of all MSIVs causes an abrupt pressure increase in the reactor vessel.

The system pressure increase is mitigated by the actuation of the MSRVs.

The closure of all MSIVs event with direct scram failure (reactor scram on high neutron flux signal) is the design basis event to demonstrate compliance to the ASME vessel overpressure protection criteria (upset condition). The MSIVF (Flux Scram) is included in every cycle-specific reload licensing process to ensure that the ASME code allowable value for peak vessel pressure (1375 psig) is not exceeded.

14.5.2.7.1.2 Initial Conditions and Assumptions This transient has been run with the CONTRANSA2 computer code at 102 percent power, 105 percent core flow, normal feedwater temperature, EOC exposure conditions, and 1 MSRV-OOS. The EOC exposure has been used because the top peaked axial power shape degrades the effectiveness of rod insertion during the reactor scram.

The MSIV closure event is analyzed with 12 out of 13 MSRVs in-service (with one of the MSRVs with lowest opening setpoint assumed out-of-service) and 3 percent setpoint tolerance. The reduced relief capacity also increases the severity of the reactor vessel pressure transient. The fastest MSIV closure curve has been considered for this analysis (3 second closure time) which represents the bounding closure characteristics.

14.5-15

BFN-28 14.5.2.7.1.3 Interpretation of Transient Results Figures 14.5-11a, b, c, and d illustrate the transient results. Scram is initiated very early into the event, before any significant steam flow interruption occurs; therefore, no fuel center temperature or fuel surface heat flux peaks take place. A small neutron flux peak occurs near 0.5 seconds. All 12 operable MSRVs open when pressure reaches the lowest setpoint at about 4 seconds after the start of the isolation. They close sequentially as the stored heat is being dissipated and continues to intermittently discharge the decay heat. The fuel delta CPR resulting from this event is bounded by other more limiting pressurization event, such as the TTNBP event.

The calculated peak bottom vessel pressure is 1349 psig for BFN specific MSIV closure characteristics and is still below the 1375 psig ASME overpressure limit.

14.5.2.7.2 Closure of One Main Steam Isolation Valve 14.5.2.7.2.1 Transient description Full closure of only one isolation valve without scram is permitted for testing purposes.

Normal procedures for such a test will normally require an initial power reduction to less than or equal to 75 percent in order to avoid high flux or pressure scram or high steam flow isolation from the active steam lines. During the transient from full power, the steam flow disturbance may raise vessel pressure and reactor power resulting in a high neutron flux scram.

14.5.2.7.2.1 Initial Conditions and Assumptions This transient has been analyzed with CONTRANSA2, XCOBRA, and XCOBRA-T at 100 percent of rated power, 105 percent of rated core flow (ICF conditions), and BOC exposure.

A value of 62.7 psid pressure drop in the steam line is assumed in the analysis. An increase in the steam line pressure drop has a small impact on the results and does not require a re-analysis of this event as long as this event remains a non limiting transient.

14.5.2.7.2.1 Interpretation of Transient Results Figures 14.5-12a, b, and c illustrate this transient. The steam flow disturbance raises vessel pressure and reactor power; the peak neutron flux reaches 121 percent of rated. The peak surface heat flux reaches about 107 percent of rated. Peak steam line pressure (1082 psia) remains below the setting of the lowest MSRVs. Peak vessel pressure (1138 psia) 14.5-16

BFN-29 remains below the 1375 psig ASME overpressure limit. The peak fuel parameters are well below those from the limiting pressurization transient (LRNBP).

14.5.2.8 Pressure Regulator Failure Approval to remove the pressure regulator downscale failure (PRDF) event as an abnormal operational transient was approved by license Amendment Nos. 244, 281, and 239 to Facility Operating Licenses Nos. DPR-33, DPR-52, and DPR-68 by NRC on April 4, 2003, based on the installation of a fault-tolerant electro-hydraulic turbine control system on Units 2 and 3, and a commitment to similarly modify Unit 1 prior to return to power operation. The reliability of the upgraded electro-hydraulic control system is such that a system failure that results in the simultaneous closure of all turbine control valves is not an anticipated failure and, hence, the PRDF transient no longer merits evaluation as an AOT.

14.5.3 Events Resulting in a Reactor Vessel Water Temperature Decrease Events that result directly in a reactor vessel water temperature decrease are those that either increase the flow of cold water to the vessel or reduce the temperature of water being delivered to the vessel. The events that result in the most severe transients in this category are the following:

a. Loss of a Feedwater Heater

b. Shutdown Cooling (RHR) Malfunction - Decreasing Temperature

c. Inadvertent pump start The most limiting conditions for these type of transients have been assumed, i.e. the lowest licensed core flow at rated power. Normal feedwater temperature is also assumed as the larger void coefficient produces a more severe transient.

14.5.3.1 Loss of Feedwater Heater (LFWH) 14.5.3.1.1 Transient Description The purpose of evaluating this event is to determine the impact on the delta-CPR and on the fuel thermal and mechanical design limits. The LFWH event for BFN assumes a feedwater temperature reduction of 100 degrees F (from 394.8 degrees F to 294.8 degrees F).

The LFWH transient may be initiated by the accidental closure of the feedwater steam extraction shut-off valves or by bypassing feedwater around the feedwater heater. In either case, the feedwater temperature falls below its rated value; therefore, increasing the subcooling to the reactor core. The negative void reactivity coefficient results in an increase in core power, change in power distribution, and 14.5-17

BFN-29 decrease in bundle CPR. In the first case, a gradual subcooling transient is produced since there is stored heat in the heat exchanger. In the second case, a more abrupt subcooling transient is initiated due to the instantaneous removal of all feedwater heating. The maximum feedwater temperature loss (100 degrees F) due to a single equipment failure is the worst condition analyzed for BFN using this procedure.

Analyses performed for AREVA cores utilize the NRC approved methodology of ANF-1358(P)(A) Revision 3, The Loss of Feedwater Heating Transient in Boiling Water Reactors. This approved methodology is based on the use of MICROBURN reactor simulator code due to the quasi steady-state nature of the event.

For AREVA cores, the NRC approved methodology of ANF-1358(P)(A), The Loss of Feedwater Heating Transient in Boiling Water Reactors, is utilized to evaluate the LFWH event for each reload. This methodology uses results obtained from the NRC approved MICROBURN-B and MICROBURN-B2 3-D reactor simulator codes. The LFWH results are included in the Reload Analysis Report for each operating cycle.

Previous cycle-specific AREVA analyses have been performed at 3458 MWt including fuel types through ATRIUM-10XM (also including ATRIUM-11 LTAs in the Unit 2 core). Analyses have also been performed supporting extended power uprate and MELLLA+ at 3952 MWt. Similar to the original GE analyses, the delta-CPR in all cases remains significantly nonlimiting. ANP-3551P, Revision 0, AREVA MELLLA+

Safety Analysis Report for Browns Ferry Units 1, 2, and 3, included as part of the MELLLA+ license amendment request, reported the following rated power results for the current ATRIUM 10XM fuel design.

Power Level Description (MWt) CPR LFWH - CLTP Rated Power 3458 0.14 LFWH - EPU/MELLLA+ Rated Power 3952 0.14 Therefore based upon the above, the LFWH is not a significant threat to fuel thermal margins; the Operating Limit CPR is established by other more limiting transients.

The average power range monitors provide an alarm to the operator at about 20 seconds after the cooler feedwater reaches the reactor vessel. Because nuclear system pressure remains essentially constant during this transient, the nuclear system process barrier is not threatened by high internal pressure. All fuel parameters remain bounded by the results of other limiting pressurization transients.

14.5-18

BFN-28 For AREVA cores, the approved methodology results in higher delta-CPRs for off-rated cases. Although the calculated percentage increase in power may be similar to the rated power case the higher CPR margin and lower initial void content in the core at offrated conditions results in the larger calculated change in CPR. This is addressed with power dependent delta-CPRs that are provided in the Reload Analysis Report each cycle. Even though the delta-CPRs increase with decreasing initial power, the LFWH event remains non-limiting versus the pressurization transients at off-rated power conditions.

14.5.3.2 Shutdown Cooling (RHR) Malfunction-Decreasing Temperature A shutdown cooling malfunction leading to a moderator temperature decrease could result from misoperation of the controls for the Residual Heat Removal (RHR) system heat exchangers. The resulting temperature decrease causes a slow insertion of positive reactivity into the core. If the reactor were critical or near critical, a very slow reactor power increase could result. If no operator action were taken to control the power level, a high neutron flux reactor scram would terminate the transient without fuel damage and without any measurable nuclear system pressure increase.

14.5.3.3 Inadvertent Pump Start 14.5.3.3.1 Transient Description Several systems are available for providing high pressure supplies of cold water to the vessel for normal or emergency functions. The control rod drive system and the makeup water system, normally in operation, can be postulated to fail in the high flow direction introducing the possibility of increased power due to higher core inlet subcooling. The same type of transient would be produced by inadvertent startup of either the reactor core isolation cooling (RCIC) or the high pressure core injection (HPCI) System. In all of these cases, the normal feedwater flow would be correspondingly reduced by the water level controls. A portion of the feedwater flow (at rated power condition) is replaced with a colder HPCI flow, and the net result is a mixed feedwater flow at a reduced temperature.

Since a single failure can only initiate one of the cold water systems, the system with the highest flow rate is usually analyzed. The severity of the resulting transient is highest for the largest of these abnormal events; for BFN, this is the inadvertent startup of the large, 5000 gpm, HPCI System.

This transient is evaluated to determine the MCPR response to a decrease in feedwater temperature due to the inadvertent startup of the HPCI system. This event is qualitatively reviewed as part of the reload licensing analysis to verify its non-limiting trend versus the cycle specific operating limits.

14.5-19

BFN-28 Since the startup of the steam-turbine driven pump takes approximately 25 seconds, the transient that occurs is very similar to the loss of feedwater heater transient described above. As in that case, the most threatening transient would occur where minimum initial fuel thermal margins exist during power operation.

14.5.3.3.2 Initial Conditions and Assumptions This transient was analyzed by AREVA using the COTRANSA1/XCOBRA/XCOBRAT methodology. This analysis considered various cycle exposures and initial core flows.

As explained above, the inadvertent startup of the large, 5000 gpm, HPCI has been considered. The HPCI pump setpoint was conservatively assumed to be higher than this value to ensure that the actual HPCI setpoint is bounded. During the initiation and acceleration transient for the HPCI, the pump flow can overshoot the rated flow making the event more severe. The water temperature of the HPCI was assumed to be 40ºF.

The system was assumed to be in manual flow control, which results in higher flux, pressure and level peaks.

For an inadvertent HPCI start, the water level may rise to the L8 setpoint. All logic associated with this setpoint such as turbine, feedwater, HPCI trips, and RPT/ATWS options was considered.

14.5.3.3.3 Interpretation of Transient Results The introduction of subcooled water due to the inadvertent HPCI startup causes an increase in reactor power, neutron and surface heat fluxes. Pressure and water level show a small increase. The power increase raises turbine steam flow slightly.

The flux scram setpoint is not reached during this event.

The plant eventually reaches a steady state condition at an increased power level but with no significant threat to the fuel thermal margins. The AREVA analysis found the delta-CPR result for inadvertent HPCI startup was 0.13. Therefore, the event has considerable margin to the limiting generator load rejection without bypass and feedwater controller failure events. No fuel clad barrier damage results for the malfunction or inadvertent startup of HPCI or other auxiliary cold water supply systems.

14.5-20

BFN-29 14.5.4 Events Resulting in a Positive Reactivity Insertion Events that result directly in positive reactivity insertions are the results of rod withdrawal errors and errors during refueling operations. The following events result in a positive reactivity insertion:

a. Continuous Rod Withdrawal During Power Range Operation

b. Continuous Rod Withdrawal During Reactor Startup

c. Control Rod Removal Error During Refueling

d. Fuel Assembly Insertion Error During Refueling 14.5.4.1 Continuous Rod Withdrawal During Power Range Operation 14.5.4.1.1 Transient Description The RWE event is initiated by an operator erroneously selecting and continuously withdrawing a single high worth control rod.

Control rod withdrawal errors are considered over the entire power range from any normally expected rod pattern. The continuous withdrawal from any normal rod pattern of the maximum worth rod results in a very mild core transient. The system will stabilize at a higher power level with neither fuel damage nor nuclear system process barrier damage.

The limiting control rod withdrawal error during power range operation is examined each reload cycle. NRC approved methodology CASMO-4/MICROBURN-B2 is used for licensing analysis performed by AREVA. The result is presented in the Reload Licensing Report.

As part of the RBM system modification included in the ARTS Improvement program

[NEDC-32433-P, "Maximum Extended Load Line Limit and ARTS Improvement Program Analyses for Browns Ferry Nuclear Plant Units 1, 2 and 3", April 1995 and "Browns Ferry Units 1, 2, and 3 EPU/MELLLA+ Task Report - Transient Analysis, FS1-0029289, Revision 1, July 2017, the fuel thermal-mechanical protection for a postulated RWE event is provided by the RBM power-dependent setpoints. The RWE event is re-analyzed every cycle to confirm the applicability of these ARTS generic limits and to verify the thermal-mechanical protection.

14.5.4.1.2 Initial Conditions and Assumptions The core nuclear dynamic parameters are based on the cycle peak hot excess reactivity, and the control rod pattern used to simulate the RWE are assumed to be at nominal conditions. The analysis assumes the error rod is withdrawn 14.5-21

BFN-28 continuously from its initial position. During this event, the core average power increases until the event is terminated by a rod block signal.

14.5.4.1.3 Interpretation of Transient Results A cycle specific RWE analysis is performed by AREVA. The RWE analysis is a bounding analysis that evaluates the withdrawal of maximum reactivity worth rods with conservative starting control rod patterns. The starting control rod patterns are conservatively selected to place the fuel near the fully inserted error rod at or near thermal limits. The analysis assumes that the reactor operator ignores the LPRM and RBM alarms and continues to withdraw the error rod until the motion is stopped by the RBM trip. The RBM trip setpoints for the cycle are selected to ensure that the RWE is not limiting compared to the limiting plant transients. The power dependent RMB trip setpoints are documented in the cycle specific COLR.

14.5.4.2 Continuous Rod Withdrawal during Reactor Startup 14.5.4.2.1 Transient Description Control rod withdrawal errors are considered when the reactor is at a power level below the power range involving the startup range of the power/flow operating map.

The most severe case occurs when the reactor is just critical at room temperature, and an out-of-sequence rod is continuously withdrawn. The rod worth minimizer would normally prevent withdrawal of such a rod. It is assumed that the Intermediate Range Neutron Monitoring (IRM) channels are in the worst conditions of allowed bypass. The scaling arrangement of the IRMs is such that for unbypassed IRM channels a scram signal is generated before the detected neutron flux has increased by more than a factor of ten. In addition, a high neutron flux scram is generated by the APRM at 13 percent and at 120 percent of rated power depending on the initial power level.

The original licensed thermal power (3293 MWt) UFSAR analysis was performed for a 2.5 percent delta-k control rod withdrawal at the rod drive speed of 0.3 ft/sec starting from an average moderator temperature of 82 degrees F.

The results of these analyses indicate a maximum fuel temperature well below the melting point of UO2 and a maximum fuel clad temperature which is less than the normal operating temperature of the clad. The possible failure of the fuel clad due to strain was analyzed using the following conservative assumptions:

1 The total volume expansion of UO2 is in the radial direction,

2. There is no thermal expansion of the fuel cladding, and

3. The fuel is assumed to be incompressible.

14.5-22

BFN-28 The results of these analyses indicate a maximum radial strain analogous to a radial expansion of 0.6 mils, which is much less than the postulated cladding damage limit of 1 percent plastic strain, which corresponds to 3.3 mils radial expansion.

Thus, no fuel damage will occur due to a continuous rod withdrawal during reactor startup.

The Continuous Rod Withdrawal during Reactor Startup transient does not need to be re-analyzed for 3458 MWt or 3952 MWt rated power, as the licensing basis criteria for fuel failure is that the fuel enthalpy must not exceed 170 cal/gm. At the above power levels, it is possible that a slightly higher fuel enthalpy above 60 cal/gm (reported in the previous analysis) can be reached due to the higher enrichment or other changes; but due to the considerable margin that exists to the 170 cal/gm limit, the result will be well below 170 cal/gm should a new analysis be performed. There existed several conservatisms in the original design basis analysis, such as:

1. The furthest possible distance between a control rod being withdrawn and a scram initiating IRM detector is used.

2. The rod shape function depicts the control rod being withdrawn at 0.3 ft/sec until the entire rod is withdrawn, but, in reality, the rod is withdrawn only 2.44 feet before the scram starts to reinsert the rod.

3. The RBM is assumed to fail to block the continuous withdrawal of an out-of-sequence rod.

4. No power flattening due to Doppler feedback is assumed.

Therefore, a re-analysis is not needed for the UFSAR at the rated power levels of 3458 or 3952 MWt.

14.5.4.3 Control Rod Removal Error During Refueling The nuclear characteristics of the core ensure that the reactor is subcritical even in its most reactive condition with the most reactive control rod fully withdrawn during refueling.

When the mode switch is in Refuel, only one control rod can be withdrawn.

Selection of a second rod initiates a rod block, thereby preventing the withdrawal of more than one rod at a time.

Therefore, the refueling interlocks will prevent any condition which could lead to inadvertent criticality due to a control rod withdrawal error during refueling when the mode switch is in the Refuel position.

In addition, the design of the control rod, incorporating the velocity limiter, does not physically permit the upward removal of the control rod without the simultaneous or 14.5-23

BFN-27 prior removal of the four adjacent fuel assemblies, thus, eliminating any hazardous condition.

14.5.4.4 Fuel Assembly Insertion Error During Refueling The core is designed such that it can be made subcritical under the most reactive conditions with the strongest control rod fully withdrawn. Therefore, any single fuel assembly can be positioned in any available location without violating the shutdown criteria, providing all the control rods are fully inserted. The refueling interlocks require that all control rods must be fully inserted before a fuel bundle may be inserted into the core.

14.5.5 Events Resulting in a Reactor Vessel Coolant Inventory Decrease Events that result directly in a decrease of reactor vessel coolant inventory are those that either restrict the normal flow of fluid into the vessel or increase the removal of fluid from the vessel. Four events have been considered in this category:

a. Pressure Regulator Failure Open

b. Inadvertent Opening of a MSRV

c. Loss of Feedwater Flow

d. Loss of Auxiliary Power Normal feedwater temperature and minimum reactor water level have been assumed for these types of transients. The smaller initial water inventory in the vessel and the larger steam flow maximizes the inventory loss.

14.5.5.1 Pressure Regulator Failure Open 14.5.5.1.1 Transient Description Should the pressure regulation function of the Turbine Control System fail in an open direction, the turbine admission valves can be fully opened with the turbine bypass valves partially or fully opened. This condition results in an initial decrease in the coolant inventory in the reactor vessel as the mass flow of steam leaving the vessel exceeds the mass flow of water entering the vessel. The total steam flow rate resulting from a pressure regulation malfunction is limited by the turbine controls to about 130 percent of rated flow.

The reactor water level swelling due to the decreasing reactor vessel pressure may reach the high level L8 setpoint initiating a TSV closure. Following this action, feedwater pumps trip, recirculation pumps trip, and reactor scram will take place. If L8 is not reached, the vessel depressurizes and the turbine header pressure may drop to the low pressure setpoint for reactor isolation (843 psig); the MSIVs will then close, and a reactor scram will be initiated.

14.5-24

BFN-28 There is no significant threat to the fuel thermal margins, but there is a small but rapid decrease in the saturated temperature to which the reactor system components are exposed, which might affect the hardware components.

14.5.5.1.2 Initial Conditions and Assumptions Per Reference 2, AREVA has concluded that this event is non-limiting with respect to CPR limits. The analysis in Reference 2 evaluates, using the CONTRANSA2 code, if the LPIS for the MSIVs is adequate to support the low steam dome pressure safety limit being maintained during the time that the reactor is above 25% rated themal power during the PRFO event.

The Reference 2 analysis considers sensitivities to multiple power/flow statepoints, variations in feedwater temperature and dome pressure, MSIV closure times between 3.0 and 5.0 seconds, multiple cycle exposure values, multiple scram insertion speeds, and variations in core average gap conductance.

The physical LPIS setpoint for the MSIVs has been set to 843 psig, which will result in a less severe depressurization than the allowed value of 825 psig.

14.5.5.1.3 Interpretation of Transient Results The analysis in Reference 2 yields the following results:

Initial conditions of low core flow are more conservative than high core flow.

Lower feedwater temperatures (feedwater heaters out-of-service) and the corresponding lower dome pressure values are conservative.

Slow MSIV closure time (5 seconds vs. 3 seconds) is conservative.

Minimum pressure during the PRFO event is relatively insensitive to cycle exposure.

Faster scram times provide a lower minimum steam dome pressure during the event.

High core average gap conductance provides a lower minimum steam dome pressure during the event.

Results from the Reference 2 case yielding the lowest steam dome pressure values are shown in Figure 14.5-15a and 14.5-15b.

Reference 2 concludes that the lowest pressure calculated for BFN does not change the low pressure safety limit value of 585 psig. The Reference 2 evaluation assumed a rated power level of 3458 MWt. The results of the evaluation demonstrated that the initial reactor power that produces the limiting minimum vessel pressure during the depressurization is an intermediate power level of 60% of the 3458 MWt value. Higher initial power levels were shown to produce a less limiting vessel pressure results. An evaluation of the event for Extended Power Uprate (EPU) (i.e., 3952 MWt) was performed in Reference 3. The evaluation for EPU 14.5-25

BFN-28 concluded that the limiting minimum pressure value results from intermediate initial power levels, having comparable margins to the low pressure safety limit as the Reference 2 non-EPU evaluation.

References:

1. GE 10 CFR Part 21 Communications SC05-03, Potential to Exceed Low Pressure Technical Specification Safety Limit, GE Nuclear, March 2005.

2. ANP-32459 Revision 1, Browns Ferry Evaluation of PRFO Low Pressure Tecnical Specification Value, AREVA NP, February 2014.

3. FS1-0019612, Browns Ferry EPU FUSAR - Dispositions, Revision 1, AREVA NP.

14.5.5.2 Inadvertent Opening of a MSRV (IORV) 14.5.5.2.1 Transient Description The opening of a MSRV on the main steam line allows steam to be discharged into the primary containment. The sudden increase in the rate of steam flow leaving the reactor vessel causes the reactor vessel coolant (mass) inventory to decrease. The result is a mild depressurization transient. The turbine pressure regulator senses the pressure decrease and drops turbine flow to maintain pressure control. The reactor settles out at nearly the initial power.

The peak heat flux does not exceed the initial power and no specified acceptable fuel design limits are challenged. Therefore, this event is non-limiting relative to thermal operating limits.

Because pressure decreases throughout the transient, the nuclear system process barrier is not threatened by high internal pressure. The small amounts of radioactivity discharged with the steam are contained inside the primary containment; the situation is not significantly different, from a radiological viewpoint, from that normally encountered in cooling the plant using the relief valves to remove decay heat.

14.5.5.3 Loss of Feedwater Flow A loss of feedwater flow results in a situation where the mass of steam leaving the reactor vessel exceeds the mass of water entering the vessel, resulting in a net decrease in the coolant inventory available to cool the core.

14.5-26

BFN-29 For this event, adequate transient core cooling is provided by maintaining the water level inside the core shroud above the top of active fuel (TAF). A loss of all feedwater flow was performed for BFN to support operation at 3952 MWt in the MELLLA+

domain. This analysis assumed failure of the high pressure coolant injection (HPCI) system and used only the reactor core isolation cooling (RCIC) system to restore the reactor water level.

Operator action is only needed for long-term plant shutdown. The results of the LOFW analysis for BFN show that the minimum water level is 63 inches above the TAF at 3952 MWt. After the water level is restored, the operator manually controls the water level, reduces reactor pressure, and initiates residual heat removal (RHR) shutdown cooling. This sequence of events does not require any new operator actions or shorter operator response times.

This transient has been run by AREVA with the COTRANSA2 code. The following is the general sequence of events in the analysis. The reactor is assumed to be at 4031 MWt power level when the LOFW occurs. The initial level in the model is conservatively set at the low-level scram setpoint and reactor feedwater is instantaneously isolated at event initiation. Scram is initiated at the start of the event.

When the level decreases to the low-low level setpoint, the RCIC system is initiated.

The RCIC flow to the vessel begins at 144 seconds into the event, minimum level is reached at 1015 seconds and level is recovered after that point. Only RCIC flow is credited to recover the reactor water level. There are no additional failures assumed beyond the failure of the HPCI system.

The other key analysis assumption for the LOFW analysis was the assumed decay heat level of ANS 5.1-1979 with a two-sigma uncertainty. The assumed decay heat level for the analysis was ANS 5.1-1979 decay heat +10%, which bounds ANS 5.1-1979 + two sigma.

This LOFW analysis is performed to demonstrate acceptable RCIC system performance. The design basis criterion for the RCIC system is confirmed by demonstrating that it is capable of maintaining the water level inside the shroud above the TAF during the LOFW transient. The minimum level is maintained at least 63 inches above the TAF, thereby demonstrating acceptable RCIC system performance. There are no applicable equipment out of service assumptions for this transient.

An operational requirement is that the RCIC system restores the reactor water level while avoiding automatic depressurization system (ADS) timer initiation and MSIV closure activation functions associated with the low-low-low reactor water level setpoint (Level 1). This requirement is intended to avoid unnecessary initiations of safety systems. This requirement is not a safety-related function. The results of the LOFW analysis for BFN also show that the nominal Level 1 setpoint trip is avoided.

14.5-27

BFN-28 14.5.5.4 Loss of Auxiliary Power Loss of auxiliary power is defined as an event which de-energizes all electrical buses that supply power to the unit auxiliary equipment such as recirculation, feedwater, and condenser circulating water pumps. The reactor is subjected to a complex sequence of events when the plant loses all auxiliary power. This can occur if all external grid connections are lost or if faults occur in the auxiliary power system itself causing, therefore, two types of transients: Loss of Auxiliary Power Transformers and Loss of Auxiliary Power Grids.

14.5.5.4.1 Transient Description Estimates of the responses of the various reactor systems to loss of auxiliary power provided the following simulation sequence:

a. All pumps are tripped at 0 seconds. Normal coastdown times were used for the recirculation and feedwater pumps.

b. At 5 seconds, the reactor protection system instrumentation power is lost. This initiates closure of the MSIVs which also produces a scram signal.

The trip of the main condenser circulating water pumps causes the loss of the condenser vacuum. When vacuum protection setpoints are reached, turbine trip and closure of the TBVs take place.

For the Loss of Auxiliary Power Grids, the same sequence as above would be followed except that the reactor would also experience a generator load rejection and its associated scram at the beginning of the transient.

By about 20 seconds after the simulated loss of power, both transients look essentially identical. Pressure is cycling at approximately the lowest MSRV setpoint, and water level is dropping gradually until RCIC (or HPCI) operation restores water level control. The long-term water level transient is bounded by the Loss of Feedwater Flow long-term water level transient analyzed in Section 14.5.5.3. The delta-CPR and vessel pressure for these events are bounded by the LRNBP event.

14.5.6 Events Resulting in a Core Coolant Flow Decrease Events that result directly in a core coolant flow decrease are those that affect the reactor recirculation system. Transients beginning from operating state F are the most severe since only in this state do power levels approach fuel thermal limits.

The following events have been analyzed:

a. Recirculation Flow Control Failure-Decreasing Flow

b. Trip of One Recirculation Pump 14.5-28

BFN-28

c. Trip of Two Recirculation Pumps

d. Recirculation Pump Seizure 14.5.6.1 Recirculation Flow Control Failure - Decreasing Flow 14.5.6.1.1 Transient Description VFD Speed Control:

Several varieties of recirculation flow control malfunctions can cause a decrease in core coolant flow. The manual runback controller could malfunction in such a way to continually command both VFDs to decelerate at the normal runback rate until both pumps are stopped. This event is less severe than the simultaneous tripping of both recirculation pumps as evaluated in paragraph 14.5.6.3.

The remaining recirculation flow controller malfunction is one in which a single flow controller fails and applies a braking action to a single recirculation pump. The pump speed reduction is slower than a recirculation pump seizure as evaluated in paragraph 14.5.6.4.

14.5.6.1.2 Initial Conditions and Assumptions In support of AREVAs introduction of ATRIUM-10 fuel at 3458 MWt conditions, this event was analyzed with COTRANSA2/XCOBRAT for TLO conditions at 100 percent of rated power, 105 percent of rated core flow and at SLO conditions at 82 percent of rated power, 58 percent of rated core flow 14.5.6.1.3 Interpretation of Transient Results VFD speed control:

For the AREVA analysis performed at 3458 MWt conditions, the peak neutron and heat fluxes do not increase above initial conditions. The calculated delta-CPR is 0.03, well below that for other types of transients analyzed; therefore, no impact on fuel integrity occurs.

For the AREVA analysis performed at SLO 3458 MWt conditions, the peak neutron and heat fluxes do not increase above initial conditions. The calculated delta-CPR is 0.19, well below that for other types of transients analyzed; therefore, no impact on fuel integrity occurs.

Since the peak neutron and heat fluxes do not increase above initial conditions and no impact on fuel integrity occurs, AREVA has qualitatively dispositioned this event as non limiting at 3952 MWt.

14.5-29

BFN-28 14.5.6.2 Trip of One Recirculation Pump 14.5.6.2.1 Transient Description Normal trip of one VFD driven recirculation loop is accomplished through trip of the VFD or VFD supply breaker. Coastdown with only pump and motor inertia occurs.

An abrupt reduction in core flow due to the trip of one of the recirculation pumps increases the core void fraction and, thereby, increases water level and reduces reactor power. This event is bounded by the TTNBP event.

14.5.6.3 Trip of Two Recirculation Pumps 14.5.6.3.1 Transient Description VFD speed control:

This two-loop trip provides the evaluation of the fuel thermal margins maintained by the rotating inertia of the recirculation drive equipment. With the VFDs, all two recirculation pump trips will only have the pump and motor inertia during coastdown.

Other than loss of auxiliary power covered in Section 14.5.5.4, loss of Raw Cooling Water (RCW) or an inadvertent RPT System trip could cause a trip to the power of both recirculation pumps. This event is bounded by the TTNBP event.

14.5.6.4 Recirculation Pump Seizure 14.5.6.4.1 Transient Description for Two Loop Operation This case represents an assumed instantaneous seizure of the pump motor shaft of one recirculation pump. Flow through the affected loop is rapidly reduced due to the large hydraulic resistance introduced by the stopped rotor. This causes the core thermal power to decrease and reactor water level to swell. The sudden decrease in core coolant flow while the reactor is at power results in a degradation of core heat transfer which could result in fuel damage. This event is bounded by the LRNBP and FWCF events.

14.5.6.4.2 Transient Description for Single Loop Operation This case represents an assumed instantaneous seizure of the pump motor shaft of the operating recirculating pump during single loop operation (SLO). Flow through the affected loop is rapidly reduced due to the large hydraulic resistance introduced by the stopped rotor. With both recirculation loops idle, the core transitions to natural convection cooling. This sudden decrease in core coolant flow while the reactor is at power results in a degradation of core heat transfer, which could result in fuel damage.

14.5-30

BFN-28 The SLO pump seizure is potentially more severe than the two loop case due to the complete loss of recirculation drive flow.

For AREVA designed fuel cycles, the SLO pump seizure transient is analyzed on a cycle specific basis to determine if this event could set the MCPR operating limit for SLO conditions. The results of this analysis for the most recent reload cycle are reflected in the unit-specific and cycle-specific reload safety analysis report.

14.5.7 Events Resulting in a Core Coolant Flow Increase Events that result directly in a core coolant flow increase are those that affect the reactor recirculation system. The following events have been analyzed:

a. Recirculation Flow Control Failure - Increasing Flow

b. Startup of Idle Recirculation Pump For both transients, no credit is conservatively taken for the APRM flow-biased flux scram occurrence.

14.5.7.1 Recirculation Flow Controller Failure - Increasing Flow 14.5.7.1.1 Transient Description VFD speed control:

In this event, it is postulated that a single flow controller fails and signals the VFD to increase the pump speed. (The VFD controls are designed such that expected failures only affect one pump.) The maximum pump run-up rate is defined by using the maximum pump motor torque. The maximum pump motor torque is defined by the breakdown torque (maximum torque the motor develops under increasing load without abruptly loosing speed). The breakdown torque is applied to the pump, and the transient model determines the resultant pump run-up rate. The average run-up rate, for the first second, is 745 rpm/sec. At about 2.4 sec the pump speed reaches 1725 rpm. A pump trip is nominally designed to occur at the frequency (57.5Hz) associated with this speed. No credit is taken for this trip. The rapid increase in core inlet flow causes a large neutron flux peak which may exceed the high flux scram setpoint.

14.5.7.1.2 Initial Conditions and Assumptions VFD speed control:

This transient was analyzed with CASMO-4/MICROBURN-B2/XCOBRA starting from the power level and flow corresponding to the lower end of the normal design flow 14.5-31

BFN-28 control range on the maximum control rod line when the reactor is initially at 66 percent of 3952 MWt and core flow is at 52 percent of rated.

One recirculation pump is driven with the physical maximum torque-breakdown torque. The high frequency pump trip is conservatively not credited. However, to assess the control system responses, a pump trip is simulated to occur at 3 seconds, which is after the time of MCPR.

14.5.7.1.3 Interpretation of Transient Results VFD speed control:

Figures 14.5-24c through -24f illustrate this transient. At a time of one second, upward failure of the speed controller causes the VFD to increase the frequency at a rate such that the pump-motor operates at breakdown torque continuously. The resulting increase in core flow causes an increase in reactor power. No credit is conservatively taken for the APRM flow-flow biased flux scram. High flux scram setpoint is reached at 2.04 seconds. The rapid increase in core flow causes the void fraction to initially decrease and the water level to drop. As the system pressure decreases, following the reactor scram, the reactor water level rises but does not reach the high level L8 setpoint. Subsequently, the water level turns around but does not decrease to the low level L2 setpoint.

The changes in the nuclear system pressure are not significant with regard to overpressure. The pressure decreases over most of the transient. Peak steam line pressure reaches 1021 psia while peak vessel pressure reaches 1058 psia. Peak neutron flux reaches 211 percent of rated. The maximum heat flux is 89 percent of rated. The calculated delta-CPR is 0.13. Cycle-specific fuel thermal limits are determined for each reload.

14.5.7.2 Startup of Idle Recirculation Loop 14.5.7.2.1 Transient Description The normal procedure for the startup of an idle recirculation loop requires the warm up of the idle drive loop water to within 50 degrees F of the active drive loop water by permitting the pressure head by the active jet pumps to cause reverse flow through the idle loop. This transient considers the failure wherein the loop drive water has been allowed to cool down to near ambient temperature, and the idle recirculation loop starts up without warming the drive loop water. The thermal-hydraulic perturbation will cause a spike in core thermal power.

14.5-32

BFN-28 14.5.7.2.2 Initial Conditions and Assumptions VFD speed control:

The transient has been analyzed by AREVA with the COTRANSA2, XCOBRA, and XCOBRA-T codes. The following initial conditions were assumed:

a. One recirculation loop is idle and filled with cold water (100 degrees F minimum).

b. The active recirculation pump is operating at a speed that produces about 130 percent of normal rated jet pump diffuser flow in the active jet pumps.

c. The core is receiving 51.6 percent of its normal rated flow; the remainder of the coolant flows in the reverse direction through the inactive jet pumps.

d. The initial core power level is 75% of 3458 MWt. This power level is the highest anticipated power for single loop operation. No high flux scram is anticipated with the VFDs; therefore, the 75% power case is the limiting condition.

e. Startup acceleration rate is 150 rpm/sec.

f. Startup maximum pump speed is 400 rpm.

g. The idle recirculation pump suction valve is open, the pump discharge valve is closed.

h. No credit is given to the functionality of the APRM flow-biased flux scram. Only the high neutron flux scram is assumed in the analysis.

The loop startup transient sequence is:

a. The idle loop pump is started at 0 seconds, with a startup rate of 150 rpm/sec.

b. The pump reaches maximum speed of 400 rpm in less than 4 seconds.

c. The pump discharge valve is assumed to be fully open, coincident with the startup of the idle loop pump at 0 seconds. (Normal procedure would delay valve opening to separate the two portions of the flow 14.5-33

BFN-28 transient and make sure the idle loop water is properly mixed with the hot water in the vessel.)

14.5.7.2.3 Interpretation of Transient Results VFD speed control:

Figures 14.5-25c through -25f illustrate this transient.

An early neutron flux peak, in response to the rapid core flow increase, of 89% of rated occurs at 4 seconds. The peak neutron flux of 93% of rated occurs at 38.3 seconds (time at which the cooler water is finally discharged from the idle loop).

The corresponding peak heat flux is 93% of rated. Peak steam line and vessel pressures are 1030 and 1058 psia, occurring at 32.4 and 32.9 seconds, respectively.

No damage occurs to the clad barrier. The power increase is terminated once all of the cooler water is discharged from the idle loop.

The event was most severe at BOC. There is significant MCPR margin and adequate LHGRFAC/MAPFAC margin.

The results show that this event is non-limiting for fuel thermal limits.

In addition, AREVA has dispositioned this event as non-limiting at 3952 MWt.

14.5.8 Events Resulting in Excess of Coolant Inventory 14.5.8.1 Feedwater Controller Failure Maximum Demand (FWCF) 14.5.8.1.1 Transient Description An event which can cause directly an excess of coolant inventory is one in which makeup water flow is increased without changing other core parameters. The FWCF is the limiting event of the excess coolant inventory type. The FWCF to maximum demand is one of several potentially limiting events normally included in the cycle-specific reload licensing analyses to establish the MCPR operating limits.

The analysis results for the FWCF to Maximum Demand event are present in the Reload Licensing Report for each cycle.

The FWCF event is a direct failure of a control device which results in the feedwater controller being forced to its upper limit, creating the maximum flow demand.

Increases in feedwater flow result in increases in the core inlet subcooling and in the reactor water level. When the high water level setpoint is reached, the main turbine and feedwater pumps are tripped; and scram occurs due to the turbine stop valves closure.

14.5-34

BFN-28 14.5.8.1.2 Input Data and Assumptions For the reload analysis, AREVA used the following models/computer codes:

COTRANSA2, XCOBRA, XCOBRA-T, RODEX2, RODEX4.

The FWCF event was analyzed at 100% power (3952 MWt) and at 77.6% power (3067 MWt) as a typical off-rated operating condition. Since the ICF condition produces top peaked axial power shapes which degrade scram effectiveness, ICF was assumed for both power levels (e.g., 100P/105F and 77.6P/109F). Normal feedwater temperature was assumed for the rated power condition while reduced feedwater temperature was assumed for the off-rated power case for a maximum subcooling effect on the off-rated transient response. The EOC exposure was assumed to maximize the transient severity because the scram effectivity is reduced with the all-rods-out condition and the top peak power shape.

Normal feedwater temperature conditions, at 100 percent power, were found to be more limiting than reduced temperature conditions because of the large pressurization component of delta-CPR caused by the reduced steam line pressure drop. The large pressurization component of delta-CPR dominates over the subcooling component of delta-CPR; therefore, the case with larger steam flow was more severe.

The FWCF event assumed a feedwater flow runout of 22.79 million pounds-mass per hour at 1050 psia feedwater design pressure. The feedwater runout flow will be adjusted as needed for reload licensing analyses to reflect updated equipment performance information.

14.5.8.1.3 Interpretation of Transient Results A plant-specific response of the BFN plant to a FWCF event is shown in Figures 14.5-28a, b, and c. The transient was initiated from 77.6P/109F as a typical off-rated operating state point. The feedwater pumps are assumed to accelerate to the maximum capability.

Sensed and actual water level increase during the initial part of the transient to about 38.1 inches. The high water level (L8) main turbine trip and feedwater turbine trip is initiated at 12.3 seconds preventing excessive carryover from damaging the turbines. The EOC-RPT is tripped simultaneously with the high reactor water level trip signals. A reactor scram occurs following the turbine trip event, limiting the neutron flux peak (298 percent of rated), surface heat flux peak (105 percent of rated), and fuel thermal transient excursion (delta-CPR = 0.43). Cycle-specific fuel thermal limits are determined for each reload. The power and flow dependent MAPLHGR, LHGR, and MCPR limits are developed on a cycle-specific bases.

14.5-35

BFN-28 The turbine bypass system opens to limit the pressure rise. The lower set relief valves open only momentarily and no excessive overpressure of the nuclear system process barrier occurs (peak steam line pressure 1206 psia). The bypass valves close later bringing the pressure in the vessel (peak vessel pressure 1223 psia) under control during reactor shutdown.

For 100P/105F, a peak neutron flux of 332 percent of rated and a peak heat flux of 129 percent of rated are reached. Peak steam line pressure reaches a value of 1265 psia while peak vessel pressure reaches a value of 1276 psia. No fuel damage occurs (delta-CPR = 0.34) with the application of the adequate operating limit CPR associated with this limiting transient.

At rated power, the delta-CPR resulting from the LRNBP and FWCF events is more severe than the delta-CPR resulting from any other pressurization events. As power is reduced to 87.5 percent of rated power or less, the delta-CPR resulting from the FWCF event continues to be higher than the delta-CPR resulting from any other pressurization event. For the FWCF, the power decrease results in a greater mismatch between runout and initial feedwater flow resulting in an increase in reactor subcooling and a more severe change in thermal limits during the event.

Therefore, this transient along with the LRNBP defines the MCPR(P) and MAPLHGR(P) or LHGR(P) curves which protect the fuel integrity for low power.

For power operation below the Pbypass, the transient characteristics change due to the bypass of the direct scram on the closure of the TCVs or TSVs. The high neutron flux scram signal is conservatively bypassed, and the high pressure scram is delayed until the vessel pressure reaches this setpoint. The relatively large differences in delta-CPR between the LRNBP and FWCF which are seen between 87.5 percent and 26 percent rated are significantly reduced below Pbypass.

14.5.8.2 Feedwater Control Failure/Maximum Demand with EOC-RPT-OOS Figures 14.5-30a, b, and c show the transient results for the 100 percent of rated power and 105 percent of rated core flow event. EOC exposure and normal feedwater temperature have been the conditions assumed for this transient analysis, the same as in the transient analysis with EOC-RPT in service described above.

The neutron flux peaks at 382 percent of rated, the average heat flux peaks at 134 percent of rated. The peak pressure at the bottom of the vessel is 1306 psia which is well below the ASME upset code limit transients limit of 1375 psig while the peak steam line pressure is 1275 psia. The calculated delta-CPR of this transient at the stated conditions is 0.32.

At off-rated power/flow conditions, such as the 77.6P/109F point, the delta-CPR is 0.40.

14.5-36

BFN-28 Cycle-specific RPT-OOs fuel thermal limits are determined for each reload.

14.5.8.3 Feedwater Control Failure/Maximum Demand with TBP-OOS The Turbine Bypass Out-of-Service produces a different evolution in the limiting overpressurization transients. The overpressurization is faster because the bypass system is not operable, thus the pressure setpoints are reached earlier. The positive reactivity insertion due to moderator void collapse is more severe, and this results in a higher delta-CPR and, subsequently, a higher OLMCPR.

The FWCF event normally assumes that turbine bypass system is functional, and therefore, this transient is strongly affected by TBP-OOS.

Figures 14.5-3a, b, and c show the transient response at 100 percent of rated power and 105 percent of rated core flow. EOC exposure and normal feedwater temperature have been the conditions assumed for this transient analysis.

The neutron flux peaks at 368 percent of rated; the average heat flux peaks at 132 percent of rated. The peak pressure at the bottom of the vessel is 1323 psia which is well below the ASME upset code limit transients limit of 1375 psig while the peak steam line pressure is 1324 psia. The calculated delta-CPR of this transient at the stated conditions is 0.38. At rated power the impact on delta-CPR caused by TBP-OOS is approximately 0.04.

Cycle-specific TBP-OOS fuel thermal limits are determined for each reload.

14.5.9 Loss of Habitability of the Control Room Loss of habitability of the control room is arbitrarily postulated as a special event to demonstrate the ability to safely shutdown the reactor from outside the control room.

(For additional information, see Section 7.18 - Backup Control System.)

14.5-37