ML23319A080

1 to Updated Final Safety Analysis Report, Chapter 15, Accident Analyses

ML23319A080
Person / Time
Site:	Farley
Issue date:	10/31/2023
From:	Southern Nuclear Operating Co
To:	Office of Nuclear Reactor Regulation
Shared Package
ML23318A074	List: ML23318A067 ML23318A070 ML23319A062 ML23319A063 ML23319A064 ML23319A065 ML23319A066 ML23319A067 ML23319A068 ML23319A069 ML23319A071 ML23319A073 ML23319A075 ML23319A076 ML23319A077 ML23319A078 ML23319A079 ML23319A080 ML23319A082 ML23319A083 ML23319A084 NL-23-0806, Technical Requirements Manual
References
NL-23-0806
Download: ML23319A080 (1)

Text

FNP-FSAR-15 15.0 ACCIDENT ANALYSES TABLE OF CONTENTS Page 15.1 CONDITION I - NORMAL OPERATION ................................................................ 15.1-4 15.1.1 Optimization of Control Systems .......................................................... 15.1-6 15.1.1.1 Setpoint Study ...................................................................................... 15.1-6 15.1.1.2 End of Life Coastdown ......................................................................... 15.1-6 15.1.2 Initial Power Conditions Assumed in Accident Analyses ..................... 15.1-7 15.1.2.1 Power Distribution ................................................................................ 15.1-8 15.1.3 Trip Points and Time Delays to Trip Assumed in Accident Analyses... 15.1-8 15.1.4 Instrumentation Drift and Calorimetric Errors ....................................... 15.1-9 15.1.5 Rod Cluster Control Assembly Insertion Characteristic ....................... 15.1-9 15.1.6 Reactivity Coefficients ........................................................................ 15.1-10 15.1.7 Fission Product Inventories ................................................................ 15.1-12 15.1.7.1 Activities in the Core .......................................................................... 15.1-12 15.1.7.2 Core Inventory Release Fractions ..................................................... 15.1-12 15.1.8 Residual Decay Heat. ........................................................................ 15.1-13 15.1.8.1 Decay Heat Model for Non-LOCA Analyses. ..................................... 15.1-13 15.1.8.2 Distribution of Decay Heat Following Loss-of-Coolant Accident ........ 15.1-13 15.1.9 Computer Codes Utilized ................................................................... 15.1-13 15.1.9.1 FACTRAN. ......................................................................................... 15.1-13 15.1.9.2 LOFTRAN .......................................................................................... 15.1-14 15.1.9.3 LEOPARD .......................................................................................... 15.1-15 15.1.9.4 TURTLE. ............................................................................................ 15.1-15 15.1.9.5 TWINKLE. .......................................................................................... 15.1-15 15.1.9.6 VIPRE ................................................................................................ 15.1-15 15.1.9.7 ANC ................................................................................................... 15.1-16 15.1.9.8 RETRAN. ........................................................................................... 15.1-16 15-i REV 30 10/21

FNP-FSAR-15 TABLE OF CONTENTS Page 15.1.10 Fission Product Barriers Assumed in Accident Analysis .................... 15.1-17 15.2 CONDITION II - INCIDENTS OF MODERATE FREQUENCY ............................... 15.2-1 15.2.1 Uncontrolled RCCA Bank Withdrawal From a Subcritical Condition.... 15.2-2 15.2.1.1 Identification of Causes and Accident Description ............................... 15.2-2 15.2.1.2 Analysis of Effects and Consequences ................................................ 15.2-3 15.2.1.3 Conclusions ......................................................................................... 15.2-5 15.2.2 Uncontrolled RCCA Bank Withdrawal at Power................................... 15.2-6 15.2.2.1 Identification of Causes and Accident Description ............................... 15.2-6 15.2.2.2 Analysis of Effects and Consequences ................................................ 15.2-7 15.2.2.3 Conclusions ....................................................................................... 15.2-10 15.2.3 RCCA Misalignment ........................................................................... 15.2-11 15.2.3.1 Identification of Causes and Accident Description ............................. 15.2-11 15.2.3.2 Analysis of Effects and Consequences .............................................. 15.2-12 15.2.3.3 Conclusions ....................................................................................... 15.2-14 15.2.4 Uncontrolled Boron Dilution ............................................................... 15.2-14 15.2.4.1 Identification of Causes and Accident Description ............................. 15.2-14 15.2.4.2 Analysis of Effects and Consequences .............................................. 15.2-15 15.2.4.3 Conclusions ....................................................................................... 15.2-19 15.2.5 Partial Loss of Forced Reactor Coolant Flow..................................... 15.2-19 15.2.5.1 Identification of Causes and Accident Description ............................. 15.2-19 15.2.5.2 Analysis of Effects and Consequences .............................................. 15.2-20 15.2.5.3 Conclusions ....................................................................................... 15.2-21 15.2.6 Startup of an Inactive Reactor Coolant Loop ..................................... 15.2-21 15.2.6.1 Identification of Causes and Accident Description ............................. 15.2-21 15.2.6.2 Sequence of Events and Systems Operations................................... 15.2-22 15.2.6.3 Conclusions ....................................................................................... 15.2-22 15.2.7 Loss of External Electrical Load and/or Turbine Trip ......................... 15.2-22 15-ii REV 30 10/21

FNP-FSAR-15 TABLE OF CONTENTS Page 15.2.7.1 Identification of Causes and Accident Description ............................. 15.2-22 15.2.7.2 Analysis of Effects and Consequences .............................................. 15.2-23 15.2.7.3 Conclusions .......................................................................................15-2-26 15.2.8 Loss of Normal Feedwater ................................................................. 15.2-26 15.2.8.1 Identification of Causes and Accident Description ............................. 15.2-26 15.2.8.2 Analysis of Effects and Consequences .............................................. 15.2-27 15.2.8.3 Conclusions ....................................................................................... 15.2-29 15.2.9 Loss of All ac Power to the Station Auxiliaries ................................... 15.2-30 15.2.9.1 Identification of Causes and Accident Description ............................. 15.2-30 15.2.9.2 Analysis of Effects and Consequences .............................................. 15.2-31 15.2.9.3 Conclusions ....................................................................................... 15.2-33 15.2.9.4 Environmental Consequences of a Postulated Loss of ac Power to the Plant Auxiliaries.................................................... 15.2-33 15.2.10 Excessive Heat Removal Due to Feedwater System Malfunctions ..... 5.2-35 15.2.10.1 Identification of Causes and Accident Description ............................. 15.2-35 15.2.10.2 Analysis of Effects and Consequences .............................................. 15.2-36 15.2.10.3 Conclusions ....................................................................................... 15.2-38 15.2.11 Excessive Load Increase Incident ..................................................... 15.2-39 15.2.11.1 Identification of Causes and Accident Description ............................. 15.2-39 15.2.11.2 Analysis of Effects and Consequences .............................................. 15.2-39 15.2.11.3 Conclusions ....................................................................................... 15.2-41 15.2.12 Accidental Depressurization of the RCS ............................................ 15.2-41 15.2.12.1 Identification of Causes and Accident Description ............................. 15.2-41 15.2.12.2 Analysis of Effects and Consequences .............................................. 15.2-42 15.2.12.3 Conclusions ....................................................................................... 15.2-43 15.2.13 Accidental Depressurization of the Main Steam System ................... 15.2-43 15.2.13.1 Identification of Causes and Accident Description ............................. 15.2-43 15.2.13.2 Analysis of Effects and Consequences .............................................. 15.2-44 15.2.13.3 Conclusions ....................................................................................... 15.2-46 15-iii REV 30 10/21

FNP-FSAR-15 TABLE OF CONTENTS Page 15.2.14 Inadvertent Operation of ECCS During Power Operation .................. 15.2-46 15.2.14.1 Identification of Causes and Accident Description ............................. 15.2-46 15.2.14.2 Analysis of Effects and Consequences .............................................. 15.2-47 15.2.14.3 Conclusions ....................................................................................... 15.2-51 15.3 CONDITION III - INFREQUENT INCIDENTS ......................................................... 15.3-1 15.3.1 Loss of Reactor Coolant From Small Ruptured Pipes or From Cracks in Large Pipes Which Actuate Emergency Core Cooling System. .......................................................................... 15.3-1 15.3.1.1 Identification of Causes and Accident Description ............................... 15.3-1 15.3.1.2 Analysis of Effects and Consequences ................................................ 15.3-3 15.3.1.3 Conclusions ......................................................................................... 15.3-7 15.3.2 Minor Secondary System Pipe Breaks................................................. 15.3-8 15.3.2.1 Identification of Causes and Accident Description ............................... 15.3-8 15.3.2.2 Analysis of Effects and Consequences ................................................ 15.3-8 15.3.2.3 Conclusions ......................................................................................... 15.3-8 15.3.3 Inadvertent Loading of a Fuel Assembly Into an Improper Position..... 15.3-8 15.3.3.1 Identification of Causes and Accident Description ............................... 15.3-8 15.3.3.2 Analysis of Effects and Consequences ................................................ 15.3-9 15.3.3.3 Conclusions ....................................................................................... 15.3-10 15.3.4 Complete Loss of Forced Reactor Coolant Flow ............................... 15.3-11 15.3.4.1 Identification of Causes and Accident Description ............................. 15.3-11 15.3.4.2 Method of Analysis ............................................................................. 15.3-11 15.3.4.3 Results ............................................................................................... 15.3-12 15.3.4.4 Conclusions ....................................................................................... 15.3-12 15.3.5 Waste Gas Decay Tank Rupture ....................................................... 15.3-12 15.3.5.1 Accident Description .......................................................................... 15.3-12 15.3.5.2 Environmental Consequences ........................................................... 15.3-13 15-iv REV 30 10/21

FNP-FSAR-15 TABLE OF CONTENTS Page 15.3.6 Single RCCA Withdrawal at Full Power ............................................. 15.3-14 15.3.6.1 Accident Description .......................................................................... 15.3-14 15.3.6.2 Conclusions ....................................................................................... 15.3-16 15.4 CONDITION IV - LIMITING FAULTS ..................................................................... 15.4-1 15.4.1 Major Reactor Coolant System Pipe Ruptures (Loss-of-Coolant Accidents) ................................................................. 15.4-1 15.4.1.1 Identification of Causes and Frequency Classification......................... 15.4-1 15.4.1.2 Sequence of Events and Systems Operations..................................... 15.4-2 15.4.1.3 Description of a Large Break LOCA Transient ..................................... 15.4-3 15.4.1.4 Analysis of Effects and Consequences ................................................ 15.4-5 15.4.1.5 Uncertainty Evaluation and Results ................................................... 15.4-12 15.4.1.6 Hydrogen Production and Accumulation ............................................ 15.4-17 15.4.1.7 Environmental Consequences of Postulated Loss-of-Coolant Accident ................................................................... 15.4-22 15.4.1.8 Radiological Consequences to Control Room ................................... 15.4-25 15.4.1.9 Environmental Consequences of Containment Purging to Control Hydrogen After a Loss-of-Coolant Accident .......................... 15.4-26 15.4.1.10 Conclusions ....................................................................................... 15.4-27 15.4.2 Major Secondary System Pipe Rupture ............................................. 15.4-27 15.4.2.1 Rupture of Main Steam Line ............................................................. 15.4-27 15.4.2.2 Major Rupture of a Main Feedwater Pipe .......................................... 15.4-37 15.4.3 Steam Generator Tube Rupture ........................................................ 15.4-42 15.4.3.1 Accident Description .......................................................................... 15.4-42 15.4.3.2 Analysis of Effects and Consequences .............................................. 15.4-43 15.4.3.3 Conclusions ....................................................................................... 15.4-46 15.4.3.4 Environmental Consequences of a Postulated Steam Generator Tube Rupture ........................................................ 15.4-46 15.4.4 Single Reactor Coolant Pump Locked Rotor ..................................... 15.4-49 15.4.4.1 Identification of Causes and Accident Description ............................. 15.4-49 15.4.4.2 Analysis of Effects and Consequences .............................................. 15.4-49 15.4.4.3 Conclusions ....................................................................................... 15.4-52 15-v REV 30 10/21

FNP-FSAR-15 TABLE OF CONTENTS Page 15.4.4.4 Environmental Consequences of a Single Reactor Coolant Pump Locked Rotor .............................................................. 15.4-53 15.4.4.5 Radiological Consequences to Control Room ................................... 15.4-53 15.4.5 Fuel Handling Accident ...................................................................... 15.4-53 15.4.5.1 Identification of Causes and Accident Description ............................. 15.4-53 15.4.5.2 Analysis of Effects and Consequences .............................................. 15.4-54 15.4.5.3 Environmental Consequences of a Fuel Handling Accident .............. 15.4-56 15.4.6 Rupture of a Control Rod Drive Mechanism (CRDM)

Housing (RCCA Ejection) .................................................................. 15.4-56 15.4.6.1 Identification of Causes and Accident Description ............................. 15.4-56 15.4.6.2 Analysis of Effects and Consequences .............................................. 15.4-58 15.4.6.3 Conclusions ....................................................................................... 15.4-63 15.4.6.4 Environmental Consequences of a Postulated Rod Ejection Accident ........................................................................ 15.4-63 15.5 ANTICIPATED TRANSIENTS WITHOUT SCRAM ................................................ 15.5-1 APPENDIX 15A Heat Transfer Coefficients Used in the LOCTA-R2 Core Thermal Analysis ................................................................ (DELETED)

APPENDIX 15B Dose Models Used to Evaluate the Environmental Consequences of Accidents APPENDIX 15C DELETED 15-vi REV 30 10/21

FNP-FSAR-15 LIST OF TABLES 15.1-1 Nuclear Steam Supply System Power Ratings 15.1-2A Summary of Initial Conditions and Computer Codes Used 15.1-2B Nominal Values of Pertinent Plant Parameters Used in the Accident Analyses 15.1-3 Trip Points and Time Delays to Trip Assumed in Accident Analyses 15.1-4 Core Inventory Fraction Released into Containment 15.1-5 (Deleted) 15.1.6 Fission Product Barriers 15.2-1 Time Sequence of Events for Condition II Events 15.2-2 Summary of Boron Dilution Analysis Results and Analysis Assumptions 15.2-3 Parameters Used in Loss of ac Power Analyses 15.3-1 Time Sequence of Events for Condition III Events 15.3-2 Plant Input Parameters Used in Small Break LOCA Analysis for 17 x 17 VANTAGE 5 Fuel 15.3-3 Parameters Used in Waste Gas Decay Tank Rupture Analyses 15.3-4 Waste Gas Decay Tank Inventory 15.3-5A Safety Injection Flowrate 15.3-5B Safety Injection Flowrate 15.4-1 Key LOCA Parameters and Initial Transient Assumptions (Units 1 and 2) 15.4-2 Results From Confirmatory Studies for Farley Units 1 and 2 15.4-3 Best Estimate Large Break LOCA Results 15.4-4 Plant Operating Range Allowed by the Best-Estimate Large-Break LOCA Analysis (Units 1 & 2) 15.4-5 Time Sequence of Events for Condition IV Events 15-vii REV 30 10/21

FNP-FSAR-15 LIST OF TABLES 15.4-6 Large Break LOCA Containment Data Used for COCO Calculation of Containment Pressure 15.4-7 Corrosion Rate Used in Post-Accident Containment Hydrogen Generation Analysis 15.4-8 Postaccident Containment Temperature Transient Used in the Calculation of Aluminum and Zinc Corrosion 15.4-8A Deleted 15.4-9 Core Fission Product Energy After 830 Full-Power Days 15.4-10 Fission Product Decay Deposition in Sump Solution 15.4-11 Deleted 15.4-12 Parameters Used in the Analysis of the Rod Cluster Control Assembly Ejection Accident 15.4-13 Farley Hydrogen Generation - NRC Basis 15.4-14 Parameters Used in the LOCA Analysis 15.4-14a Parameters Used in the Small Break LOCA Analysis 15.4-15 Offsite Doses From LOCA 15.4-16 Parameters Used in Analysis of Post-LOCA Control Room Doses 15.4-17 Control Room Doses Following a LOCA 15.4-18 Parameters Used in the Analyses of Hydrogen Purging Following a LOCA 15.4-19 Offsite Doses From Containment Purging to Control Hydrogen Following a LOCA 15.4-20 (Deleted) 15.4-21 (Deleted) 15.4-22 (Deleted) 15.4-23 Parameters Used in Steam Line Break Analyses 15.4-23a Parameters Used in Analysis of Main Steam Line Break Control Room Doses 15-viii REV 30 10/21

FNP-FSAR-15 LIST OF TABLES 15.4-24 Parameters Used in Steam Generator Tube Rupture Analyses 15.4-24a Parameters Used in Analysis of Steam Generator Tube Rupture Accident Control Room Doses 15.4-25A Summary of Results for the Locked Rotor Transient 15.4-25B Parameters Used in RCP Locked Rotor Analyses 15.4-26 Release Activities for Fuel Handling Accident 15.4-27 Parameters Used in Fuel Handling Accident Analysis 15.4-28 (Deleted) 15.4-29 Doses From Fuel Handling Accident in Spent Fuel Pool 15.4-30 Doses From Fuel Handling Accident Inside Containment 15.4-31 Parameters Used in Rod Ejection Accident Analyses 15-ix REV 30 10/21

FNP-FSAR-15 LIST OF FIGURES 15.1-1A Overpower and Overtemperature T Protection 15.1-1B Overtemperature T Setpoint F(I) Penalty 15.1-2 Rod Position Versus Time on Reactor Trip 15.1-3 Normalized Rod Worth Versus Fraction Insertion 15.1-4 Normalized RCCA Bank Reactivity Worth Versus Time After Trip 15.1-5 Doppler Power Coefficient Bounded by Accident Analyses 15.1-6 1979 ANS Decay Heat 15.1-7 Fuel Rod Cross-Section 15.1-8 Deleted.

15.2-1 Startup From Subcritical for 3-Loop, 17 x 17 Plant Nuclear Power 15.2-2 Startup From Subcritical for 3-Loop, 17 x 17 Plant FACTRAN Heat Flux 15.2-3 Uncontrolled Rod Withdrawal From a Subcritical Condition - Temperature Versus Time 15.2-4 Transient Response for Uncontrolled Rod Withdrawal From Full Power Terminated by High Neutron Flux Trip 15.2-5 Transient Response for Uncontrolled Rod Withdrawal From Full Power Terminated by High Neutron Flux Trip 15.2-6 Transient Response for Uncontrolled Rod Withdrawal From Full Power Terminated by Overtemperature T Trip 15.2-7 Transient Response for Uncontrolled Rod Withdrawal From Full Power Terminated by Overtemperature T Trip 15.2-7A Transient Response for Uncontrolled Rod Withdrawal From At Power Conditions (Limiting Overpressure Case) 15.2-8 Effect of Reactivity Insertion Rate on Minimum DNBR for a Rod Withdrawal Accident From 100-Percent Power 15-x REV 30 10/21

FNP-FSAR-15 LIST OF FIGURES 15.2-9 Effect of Reactivity Insertion Rate on Minimum DNBR for a Rod Withdrawal Accident From 60-Percent Power 15.2-10A Effect of Reactivity Insertion Rate on Minimum DNBR for a Rod Withdrawal Accident From 10-Percent Power 15.2-10B Effect of Reactivity Insertion Rate and Initial Power Level on Peak RCS Pressure for a Rod Withdrawal Accident 15.2-10C Effect of Reactivity Insertion Rate and Initial Power Level on Peak RCS Trip Function for a Rod Withdrawal Accident (Overpressure Case) 15.2-11 Transient Response to Dropped Rod Cluster Control Assembly 15.2-12 All Loops Initially Operating, One Loop Coasting Down - Flow Coastdowns Versus Time 15.2-13 All Loops Initially Operating, One Loop Coasting Down - Nuclear Power Versus Time 15.2-14 All Loops Initially Operating, One Loop Coasting Down - Pressurizer Pressure Versus Time 15.2-15 Deleted 15.2-16 All Loops Initially Operating, One Loop Coasting Down - Hot Channel Heat Flux Versus Time 15.2-17 All Loops Initially Operating, One Loop Coasting Down - DNBR Versus Time 15.2-18 (Deleted) 15.2-19 Loss-of-Load Accident Minimum DNBR Case 15.2-20 Loss-of-Load Accident Peak MSS Pressure Case 15.2-21 Loss-of-Load Accident RCS Peak Pressure Case 15.2-22 Deleted 15.2-23 Deleted 15.2-24 Deleted 15-xi REV 30 10/21

FNP-FSAR-15 LIST OF FIGURES 15.2-25 Deleted 15.2-26 (sh 1) Loss of Normal Feedwater - Pressurizer Pressure and Water Volume Versus Time 15.2-26 (sh 2) Loss of Normal Feedwater - Nuclear Power and Core Heat Flux Versus Time 15.2-26 (sh 3) Loss of Normal Feedwater - Loop 1, 2, and 3 Hot and Cold Leg Temperatures Versus Time 15.2-26 (sh 4) Loss of Normal Feedwater - Steam Generator Pressure and Level Versus Time 15.2-27 (sh 1) Loss of All ac Power to the Station Auxiliaries - Pressurizer Pressure and Water Volume Versus Time 15.2-27 (sh 2) Loss of All ac Power to the Station Auxiliaries - Nuclear Power and Core Heat Flux Versus Time 15.2-27 (sh 3) Loss of All ac Power to the Station Auxiliaries - Loop 1, 2, and 3 Hot and Cold Leg Temperatures Versus Time 15.2-27 (sh 4) Loss of All ac Power to the Station Auxiliaries - Steam Generator Pressure and Level Versus Time 15.2-28 (sh 1) Feedwater Control Valve Malfunction - Nuclear Power and Core Heat Flux Versus Time 15.2-28 (sh 2) Feedwater Control Valve Malfunction - Pressurizer Pressure and Loop T Versus Time 15.2-28 (sh 3) Feedwater Control Valve Malfunction - Core Average Temperature and DNBR Versus Time 15.2-29 Excessive Load Increase Without Control Action - BOL - DNBR, Nuclear Power, and Pressurizer Pressure as a Function of Time 15.2-30 Excessive Load Increase Without Control Action - BOL - Tavg and Pressurizer Volume as a Function of Time 15.2-31 Excessive Load Increase Without Control Action - EOL - DNBR, Nuclear Power, and Pressurizer Pressure as a Function of Time 15.2-32 Excessive Load Increase Without Control Action - EOL - Tavg and Pressurizer Volume as a Function of Time 15-xii REV 30 10/21

FNP-FSAR-15 LIST OF FIGURES 15.2-33 Excessive Load Increase With Reactor Control - BOL - DNBR, Nuclear Power, and Pressurizer Pressure as a Function of Time 15.2-34 Excessive Load Increase With Reactor Control - BOL - Tavg and Pressurizer Volume as a Function of Time 15.2-35 Excessive Load Increase With Reactor Control - EOL - DNBR, Nuclear Power, and Pressurizer Pressure as a Function of Time 15.2-36 Excessive Load Increase With Reactor Control - EOL - Tavg and Pressurizer Volume as a Function of Time 15.2-37 Accidental RCS Depressurization - Nuclear Power Versus Time 15.2-38 Accidental RCS Depressurization - Tavg and Pressurizer Pressure Versus Time 15.2-39 Accidental RCS Depressurization - DNBR Versus Time 15.2-40 (sh 1) Variation of Keff With Core Temperature 15.2-40 (sh 2) Doppler Power Feedback 15.2-41 Safety Injection Flowrate Versus RCS Pressure 15.2-42 Steam Line Break Transient Credible Break, Failed Open Valve 15.2-43 Spurious Actuation of the SI System Nuclear Power and Steam Flow Versus Time 15.2-44 Spurious Actuation of the SI System Pressurizer Pressure and Pressurizer Water Volume Versus Time 15.2-45 Deleted 15.2-46 (Deleted) 15.3-1 Code Interface Description for Small Break Model 15.3-2 Small Break Hot Rod Power Shape 15.3-3A Small Break Safety Injection Flowrate - 1 High-Head Safety Injection Pump 15-xiii REV 30 10/21

FNP-FSAR-15 LIST OF FIGURES 15.3-3B Small Break Safety Injection Flowrate - 1 High-Head Safety Injection Pump and 1 RHR Pump 15.3-4A RCS Depressurization Transient - Unit 1 (Upflow, High Tavg) (3-in. Break) 15.3-4B RCS Depressurization Transient - Unit 2 (Low Tavg) (3-in. Break) 15.3-4C RCS Depressurization Transient - Unit 1 (Upflow, High Tavg) (2-in. Break) 15.3-4D RCS Depressurization Transient - Unit 1 (Upflow, High Tavg) (4-in. Break) 15.3-4E RCS Depressurization Transient - Unit 1 (Upflow, High Tavg) (6-in. Break) 15.3-4F RCS Depressurization Transient - Unit 1 (Upflow, Low Tavg) (3-in. Break) 15.3-4G RCS Depressurization Transient - Unit 2 (High Tavg) (3-in. Break) 15.3-5A Core Mixture Level - Unit 1 (Upflow, High Tavg) (3-in. Break) 15.3-5B Core Mixture Level - Unit 2 (Low Tavg) (3-in. Break) 15.3-5C Core Mixture Level - Unit 1 (Upflow, High Tavg) (2-in. Break) 15.3-5D Core Mixture Level - Unit 1 (Upflow, High Tavg) (4-in. Break) 15.3-5E Core Mixture Level - Unit 1 (Upflow, High Tavg) (6-in. Break) 15.3-5F Core Mixture Level - Unit 1 (Upflow, Low Tavg) (3-in. Break) 15.3-5G Core Mixture Level - Unit 2 (High Tavg) (3-in. Break) 15.3-6A Clad Average Temperature - Hot Rod - Unit 1 (Upflow, High Tavg) (3-in. Break) 15.3-6B Clad Average Temperature - Hot Rod - Unit 2 (Low Tavg) (3-in. Break) 15.3-6C Clad Average Temperature - Hot Rod - Unit 1 (Upflow, High Tavg) (2-in. Break) 15.3-6D Clad Average Temperature - Hot Rod - Unit 1 (Upflow, High Tavg) (4-in. Break) 15-xiv REV 30 10/21

FNP-FSAR-15 LIST OF FIGURES 15.3-6E Clad Average Temperature - Hot Rod - Unit 1 (Upflow, High Tavg) (6-in. Break) 15.3-6F Clad Average Temperature - Hot Rod - Unit 1 (Upflow, Low Tavg) (3-in. Break) 15.3-6G Clad Average Temperature - Hot Rod - Unit 2 (High Tavg) (3-in. Break) 15.3-7A Core Exit Steam Flow - Unit 1 (Upflow, High Tavg) (3-in. Break) 15.3-7B Deleted 15.3-8A Heat Transfer Coefficient - Hot Spot Rod Surface - Unit 1 (Upflow, High Tavg)

(3-in. Break) 15.3-8B Deleted 15.3-9A Fluid Temperature - Hot Spot - Unit 1 (Upflow, High Tavg) (3-in. Break) 15.3-9B Deleted 15.3-10A Cold Leg Break Mass Flow - Unit 1 (Upflow, High Tavg) (3-in. Break) 15.3-10B Deleted 15.3-11A ECCS Pumped Safety Injection - Unit 1 (Upflow, High Tavg) (3-in. Break) 15.3-11B Deleted 15.3-12 (Deleted) 15.3-13 (Deleted) 15.3-14 (Deleted) 15.3-15 Interchange Between Region 1 and Region 3 Assembly 15.3-16 Interchange Between Region 1 and 2 Assembly, Burnable Poison Rods Being Retained by the Region 2 Assembly 15.3-17 Interchange Between Region 1 and Region 2 Assembly, Burnable Poison Rods Being Transferred to the Region 1 Assembly 15.3-18 Enrichment Error - A Region 2 Assembly Loaded Into the Core Central Position 15-xv REV 30 10/21

FNP-FSAR-15 LIST OF FIGURES 15.3-19 Loading a Region 2 Assembly Into a Region 1 Position Near Core Periphery 15.3-20 All Loops Operating, Frequency Decay to All Loops - Reactor Vessel Flow Versus Time 15.3-21 All Loops Operating, Frequency Decay to All Loops - Nuclear Power Versus Time 15.3-22 All Loops Operating, Frequency Decay to All Loops - Pressurizer Pressure Versus Time 15.3-23 Deleted 15.3-24 All Loops Operating, Frequency Decay to All Loops - Hot Channel Heat Flux Versus Time 15.3-25 All Loops Operating, Frequency Decay to All Loops - DNBR Versus Time 15.3-26 2-in. Break, No SI, RCS Pressure 15.3-27 2-in. Break, No SI, Core Mixture Height 15.3-28 Small Break 15.3-29 2-in. Break, No SI, Pressurizer Level (ft) 15.4-1 Large Break LOCA Sequence of Events for Reference Transient 15.4-2 Peak Cladding Temperature and Elevation (Reference DECLG Transient) 15.4-3 Break Flow (Vessel Side) 15.4-4 Break Flow (Loop Side) 15.4-5 Intact Loop Pump Inlet Void Fraction 15.4-6 Broken Loop Pump Inlet Void Fraction 15.4-7 Flowrate at Top, Middle, and Bottom of Core during Blowdown 15.4-8 Pressurizer Pressure 15.4-9 Lower Plenum Collapsed Liquid Level 15-xvi REV 30 10/21

FNP-FSAR-15 LIST OF FIGURES 15.4-10 Vessel Fluid Mass 15.4-11 Accumulator Liquid Flow 15.4-12 Safety Injection Flow 15.4-13 Core Channels Collapsed Liquid Level 15.4-14 Downcomer Channels Collapsed Liquid Level 15.4-15 Cladding Temperature at Various Elevations (Hot Rod) 15.4-15A Peak Cladding Temperature (Reference Split Transient) 15.4-15B Break Flow (Split Break) 15.4-15C Flowrate at Top, Middle, and Bottom of Core During Blowdown 15.4-15D Intact Loop Pump Inlet Void Fraction 15.4-15E Flowrate at Bottom of Broken DC Channel 15.4-15F Accumulator Liquid Flow 15.4-15G Pressurizer Pressure 15.4-15H Downcomer Channels Collapsed Liquid Level 15.4-15I Lower Plenum Collapsed Liquid Level 15.4-15J Vessel Fluid Mass 15.4-15K Core Channels Collapsed Liquid Level 15.4-15L Safety Injection Flow 15.4-15M Cladding Temperature at Various Elevations (Hot Rod) 15.4-15N Farley Reference Split Break - CD = 1.0 Peak Cladding Temperature Hot Rod 15.4-15P Farley Reference Split Break - CD = 1.0 Average Core Liquid Level - Ch 10, 11, 12, 13 15-xvii REV 30 10/21

FNP-FSAR-15 LIST OF FIGURES 15.4-16 PBOT/PMID Limits Used in Best-Estimate LOCA Analysis 15.4-17 COCO Containment Pressure Used in Best-Estimate LOCA Analysis 15.4-18 Aluminum Corrosion in DBA Environment 15.4-19 Results of Westinghouse Capsule Irradiation Tests 15.4-20 (Deleted) 15.4-21 (Deleted) 15.4-22 (Deleted) 15.4-23 Break and Injected Mass Flows 15.4-24 (Deleted) 15.4-25 (Deleted) 15.4-26 (Deleted) 15.4-27 (Deleted) 15.4-28 Steam Line Break Transient With Offsite Power 1.069 ft2 Double-Ended Rupture 15.4-29 Steam Line Break Transient With Offsite Power 1.069 ft2 Double-Ended Rupture 15.4-30 Steam Line Break Transient Without Offsite Power 1.069 ft2 Double-Ended Rupture 15.4-31 Steam Line Break Transient Without Offsite Power 1.069 ft2 Double-Ended Rupture 15.4-32 (sh 1) Major Rupture of a Main Feedwater Pipe With Offsite Power Always Available -

Pressurizer Pressure and Water Volume Versus Time (Case A) 15.4-32 (sh 2) Major Rupture of a Main Feedwater Pipe With Offsite Power Always Available -

Intact and Faulted Loop Temperature Versus Time (Case A) 15.4-32 (sh 3) Major Rupture of a Main Feedwater Pipe Without Offsite Power - Pressurizer Pressure and Water Volume Versus Time (Case B) 15-xviii REV 30 10/21

FNP-FSAR-15 LIST OF FIGURES 15.4-32 (sh 4) Major Rupture of a Main Feedwater Pipe Without Offsite Power - Intact and Faulted Loop Temperature Versus Time (Case B) 15.4-32 (sh 5) Major Rupture of a Main Feedwater Pipe Without Offsite Power - Pressurizer Pressure and Water Volume Versus Time (Case B) 15.4-32 (sh 6) Major Rupture of a Main Feedwater Pipe Without Offsite Power - Intact and Faulted Loop Temperature Versus Time (Case B) 15.4-33 All Loops Initially Operating, One Locked Rotor - Reactor Coolant System Pressure 15.4-34 All Loops Initially Operating, One Locked Rotor - Total RCS Flow and Faulted Loop Flow 15.4-35 All Loops Initially Operating, One Locked Rotor - Nuclear Power 15.4-36 Deleted 15.4-37 Deleted 15.4-38 All Loops Initially Operating, One Locked Rotor - Clad Inner Temperature 15.4-39 (Deleted) 15.4-40 Nuclear Power Transient BOL Hot Full-Power Rod Ejection Accident 15.4-41 Hotspot Fuel and Clad Temperature Versus Time - BOL Hot Full-Power Rod Ejection Accident 15.4-42 Nuclear Power Transient EOL Hot Zero-Power Rod Ejection Accident 15.4-43 Hotspot Fuel and Clad Temperature Versus Time - EOL Hot Zero-Power Rod Ejection Accident 15.4-44 (Deleted) 15.4-45 (Deleted) 15.4-46 (Deleted) 15.4-47 (Deleted) 15-xix REV 30 10/21

FNP-FSAR-15 LIST OF FIGURES 15.4-48 (Deleted) 15.4-49 (Deleted) 15.4-50 Depiction of the Downflow Barrel Baffle Design Configuration 15.4-51 Depiction of the Upflow Barrel Baffle Design Configuration 15-xx REV 30 10/21

FNP-FSAR-15 15.0 - ACCIDENT ANALYSES The accident analyses for the Farley plant have been done using the American Nuclear Society (ANS) classification of plant conditions which divides plant conditions into four categories in accordance with anticipated frequency of occurrence and potential radiological consequences to the public. The four categories are as follows:

A. Condition I - Normal operation and operational transients.

B. Condition II - Faults of moderate frequency.

C. Condition III - Infrequent faults.

D. Condition IV - Limiting faults.

The basic principle applied in relating design requirements to each of the conditions is that the most frequent occurrences must yield little or no radiological risk to the public and that those extreme situations having the potential for the greatest risk to the public shall be those least likely to occur. Where applicable, reactor trip system and engineered safeguards functioning is assumed to the extent allowed by considerations such as the single-failure criterion in fulfilling this principle. Specific considerations are listed in the analysis of each accident.

In evaluating radiological consequences associated with initiation of a spectrum of accident conditions, numerous assumptions must be postulated. In many instances, these assumptions are a product of extremely conservative judgments. This is due to the fact that many physical phenomena, in particular fission product transport under accident conditions, are presently not understood to the extent that accurate predictions can be made. Therefore, the set of assumptions postulated would predominantly determine the accident classification.

This chapter addresses itself to the accident conditions listed on pages 15T-1, 15T-2, and 15T-3 of the NRC Guide, Standard Format and Content of Safety Analysis Reports for Nuclear Power Plants (Revision 1), as they apply to the Farley plant.

The events listed in table 15-1 of the NRC Guide and the FSAR sections which address these events are cross-referenced as follows:

Item 1 - See subsection 15.2.1.

Item 2 - See subsection 15.2.2.

Item 3 - See subsections 15.2.3 and 15.3.6.

Item 4 - See subsection 15.2.4.

Item 5 - See subsections 15.2.5, 15.3.4, and 15.4.4.

Item 6 - See subsection 15.2.6.

15.1-1 REV 30 10/21

FNP-FSAR-15 Item 7 - See subsection 15.2.7.

Item 8 - See subsection 15.2.8.

Item 9 - See subsection 15.2.9.

Item 10 - There are no pressure regulators or regulating instruments in the Farley design whose failure could cause heat removal greater than heat generation.

Item 11 - The reactor coolant flow controller is not a feature of the Farley design.

Treatment of the performance of the reactivity controller in a number of accident conditions is offered in this chapter.

• Item 12 - The analysis of specific effects of internal and external events, such as major and minor fires, floods, storms, or earthquake, are discussed in appropriate sections of chapters 2, 3, and 8.

An extensive fire protection system is provided for onsite fires as described in subsection 9.5.1. Floods and flood protection are discussed extensively in sections 2.4 and 3.4.

Storms, probable frequency of occurrence, wind and tornado loadings, and missile protection (against tornado-generated missiles) are discussed in sections 2.3, 3.3, and 3.5.

Earthquake analysis is discussed in subsection 3.2.1 and in section 3.7.

The reactor coolant system (RCS) components whose failure could cause a Condition III or Condition IV loss-of-coolant accident (LOCA) are Safety Class I components designed to withstand consequences of the safe shutdown earthquake (SSE) occurrence. In the analysis of the Condition IV maximum credible accident, a rupture of the largest pipe in the RCS is assumed to occur in conjunction with an earthquake occurrence which may result in the loss of offsite power.

Item 13 - See subsections 15.2.12, 15.3.1, and 15.4.1.

Item 14 - See subsections 15.2.13, 15.3.2, and 15.4.2.

Item 15 - See subsection 15.3.3.

Item 16 - See subsection 15.3.5.

Item 17 - Applicable to boiling water reactors (BWRs) only.

Item 18 - See subsection 15.4.3.

Item 19 - Applicable to BWRs only.

15.1-2 REV 30 10/21

FNP-FSAR-15 Item 20 - See subsection 15.4.6.

Item 21 - Applicable to BWRs only.

Item 22 - No instrument lines from the RCS boundary in the Westinghouse pressurized-water reactor (PWR) design penetrate the containment.(a)

Item 23 - See subsection 15.4.5.

Item 24 - Small spills or leaks of radioactive material outside the containment are events which release relatively small amounts of radioactive material into the environment.

Accidents for which dose analyses are presented in this report are those which release significant amounts of radioactive material and which therefore provide an acceptable basis for demonstrating the adequacy of the Farley design to prevent undue risk to the health and safety of the public.

Item 25 - See subsections 15.4.1 and 15.4.6. Dose analyses assuming steam generator leakage are performed for all accidents which cause fuel damage.

Item 26 - See subsection 15.4.1. Section 7.4 contains an analysis showing that the plant can be brought to hot shutdown and maintained in that condition from outside the control room.

Item 27 - The residual heat removal (RHR) is protected from inadvertent overpressurization by ASME code relief valves. Two main control board annunciator windows are installed to alert the operators when the RHR suction/isolation valve(s) is not fully closed and the RCS pressure exceeds the alarm setpoint. Power is removed from RHR suction/isolation valves when in Modes 1, 2, and 3.

Leak testing is performed on the isolation valves as described in the technical specifications.

The operability of the RHR isolation valves and associated interlocks is assured by strict administrative controls.

Item 28 - Loss of condenser vacuum is considered in the analyses of subsection 15.2.7, Loss of External Electrical Load and/or Turbine Trip.

Item 29 - Same as item 28 above.

a. For the definition of the RCS boundary, refer to ANS 18.2 Section 5, Nuclear Safety Criteria for the Design of Stationary BWR Plants.

15.1-3 REV 30 10/21

FNP-FSAR-15 Item 30 - The service water system is designed to preclude complete loss of service water as discussed in subsection 9.2.1.

Item 31 - Loss of one (redundant) dc system is considered in subsection 8.3.2.

Item 32 - See subsection 15.2.14.

Item 33 - The effects of turbine trip on the RCS are presented in subsection 15.2.7.

Equipment described in subsection 8.2.1.2 will handle the consequences of a turbine trip with failure of the generator breaker to open.

Item 34 - Loss of instrument air is considered in chapter 9.

Item 35 - Malfunction of the turbine gland sealing system is only of significance in BWRs.

Accident analyses presented in this chapter were originally applicable to the first fuel cycle.

These analyses have been updated to remain bounding for current cycles and are typical of expected values for cycles through the equilibrium cycle. They include the maximum expected core average burnup for an equilibrium cycle based on Westinghouse design methods and reload fuel.

The operator action times assumed in this chapter include conservative actions to provide an adequate safety margin for the purpose of nuclear safety system design and nuclear safety analysis of the design basis events. However, they are not intended to serve as a basis for actual operator action times in procedures or training. The assumed time periods are considered in the basis of plant design to permit credit for operator actions. The Westinghouse Owners Group (WOG) Emergency Response Guidelines (ERGs) provide a basis for operator actions in response to design basis accidents.

15.1 CONDITION I - NORMAL OPERATION Condition I occurrences are those which are expected frequently or regularly in the course of power operation, refueling, maintenance, or maneuvering of the plant. As such, Condition I occurrences are accommodated with a margin between any plant parameter and the value of that parameter which would require either automatic or manual protective action. Inasmuch as Condition I occurrences occur frequently or regularly, they must be considered from the point of view of affecting the consequences of fault conditions (Conditions II, III, and IV). In this regard, analysis of each fault condition described is generally based on a conservative set of initial conditions corresponding to the most adverse set of conditions which can occur during Condition I operation.

The NRC acceptance criteria for ensuring that Condition I occurrences will not result in fuel rod failures is that the minimum departure from nucleate boiling ratio (DNBR DNBR design limit as described in section 4.4.1.1) satisfies the 95/95 criterion. That is, there is at least 95-percent probability at a 95-percent confidence level (95/95 probability/confidence) that DNB will not occur on the limiting fuel rod. In addition, there is also a 95/95 probability/confidence that the peak kW/ft fuel rods will not exceed the melting temperature of uranium dioxide, refer to 15.1-4 REV 30 10/21

FNP-FSAR-15 section 4.4. The NRC acceptance criterion used to ensure that the reactor coolant pressure boundary integrity is maintained is that the reactor coolant pressure remains below the ASME Section III Code pressure limit (2750 psia).

A typical list of Condition I events is listed below:

A. Steady-state and shutdown operations

1. Power operation ( 15 to 100 percent of full power)

2. Startup or standby (critical, 0 to 15 percent of full power)

3. Hot shutdown (subcritical, RHR system isolated)

4. Cold shutdown (subcritical, RHR system in operation)

5. Refueling B. Operation with permissible deviations Various deviations which may occur during continued operation as permitted by the plant technical specifications must be considered in conjunction with other operational modes. These include:

1. Operation with components or systems out of service (such as power operation with a reactor coolant pump out of service)

2. Leakage from fuel with cladding defects

3. Activity in the reactor coolant

a. Fission products

b. Corrosion products

c. Tritium

4. Operation with steam generator leaks up to the maximum allowed by technical specifications C. Operational transients

1. Plant heatup and cooldown (up to 100°F/h for the reactor coolant system; 200°F/h for the pressurizer)

2. Step load changes (up to + 10 percent)

3. Ramp load changes (up to 5 percent/min) 15.1-5 REV 30 10/21

FNP-FSAR-15

4. Load rejection up to and including design load rejection transient

(~ 50-percent steam dump capability) 15.1.1 OPTIMIZATION OF CONTROL SYSTEMS 15.1.1.1 Setpoint Study A setpoint study has been performed in order to simulate performance of the reactor control and protection systems. Emphasis was placed on the development of a control system which will automatically maintain prescribed conditions in the plant even under the most conservative set of reactivity parameters with respect to both system stability and transient performance.

For each mode of plant operation, a group of optimum controller setpoints was determined. In areas where the resultant setpoints are different, compromises based on the optimum overall performance were made and verified. A consistent set of control system parameters for power levels between 15 and 100 percent was derived satisfying plant operational requirements throughout the cycle life. The study comprised an analysis of the following control systems: rod cluster control (RCC), assembly control, steam dump, steam generator level, pressurizer pressure, and pressurizer level.

15.1.1.2 End of Life Coastdown Coastdowns at the end of an operating cycle may be performed by a power reduction on the normal temperature program (power coastdown), or by a combination of RCS temperature reduction (temperature coastdown) followed by a power coastdown. In the latter case, RCS temperature and power may initially be reduced by maintaining a constant turbine control valve position and allowing the temperature feedback of the reactor core to control the rate of temperature and power reduction. If the valves are not at the valves wide open position when depletion of reactivity is reached at the end of an operating cycle, the valves can be gradually opened as temperature and power begin to decrease.

In order to perform a power coastdown on the normal temperature program, no specific adjustments to the control or protection system settings are required.

For the combination of a temperature coastdown followed by a power coastdown, the steam dump load rejection controller must be reset with trip open bistable and gain settings corresponding to a full-load reference temperature. This ensures that the steam dumps provide adqequate heat removal for load rejections as described in sections 7.7 and 10.4, and that the requirements of no challenges to the pressurizer PORVs are met for a turbine trip without a reactor trip below the P-9 setpoint, as described in paragraph 7.2.1.1.1.F. This method of steam dump control may be used for any combination of temperature coastdown followed by a power coastdown within the analyzed range of temperature programs. No changes to the plant trip controller settings are required. To improve the reactor control system response to transients, and to provide the operators with a target temperature for manual control and trip recovery, the programmed reference temperature should be reset periodically during the 15.1-6 REV 30 10/21

FNP-FSAR-15 temperature coastdown. Once a final temperature program is reached, no further changes are required during the subsequent power coastdown. The overtemperature (OTDT) and overpower (OPDT) setpoint reference temperatures may remain at their corresponding pre-coastdown settings for the duration of the coastdown.

15.1.2 INITIAL POWER CONDITIONS ASSUMED IN ACCIDENT ANALYSES Table 15.1-1 lists the principal power rating values assumed in analyses performed in this chapter. The rating values listed in table 15.1-1 are based on the nuclear steam supply system (NSSS) thermal power output which includes the thermal power generated by the reactor coolant pumps (RCPs) and other sources.

The thermal power attributed to the RCPs and other sources is the total RCS heat addition less the heat loss from the RCS.

For most accidents which are DNB limited, nominal values of the initial conditions are assumed.

The uncertainty allowances on power, temperature, pressure, and RCS flow are included on a statistical basis and are included in the limit DNBR value, as described in reference 18. This procedure is known as the Revised Thermal Design Procedure (RTDP). For accidents analyses which are not DNB limited, or for which RTDP is not employed, the initial conditions are obtained by applying the maximum steady-state errors to rated values (this procedure is commonly known as Standard Thermal Design Procedure or STDP).

The following steady-state errors are considered in the analyses:

A. Core power - +/- 2-percent allowance for calorimetric error (note that this error is conservatively applied in the positive direction in non-LOCA accident analyses).

Transient analyses explicitly performed for the measurement uncertainty recapture (MUR) uprate considered a core power that includes a bounding calorimetric error.

B. Average RCS temperature - +/- 6°F allowance dead band and system measurement error, including -1°F bias due to cold leg streaming.

C. Pressurizer pressure - +/- 50-psi allowance for steady-state fluctuations and measurement errors.

Accidents employing RTDP assume a minimum measured flow (MMF); accidents employing STDP assume a thermal design flow (TDF). In addition to being the flow used in the DNB analysis for RTDP methodology, the MMF is specified in the technical specifications as the flow that must be confirmed or exceeded by the flow measurements obtained during plant startup.

Table 15.1-2A summarizes the initial conditions and computer codes used in the accident analyses. The values of other pertinent plant parameters used in the accident analyses are given in table 15.1-2B.

During steady-state operation over the life of the core, the buildup of oxides and crud on the fuel rod surface causes the cladding surface temperature to increase due to the onset of nucleate 15.1-7 REV 30 10/21

FNP-FSAR-15 boiling. Allowance is made in the fuel center melt evaluation for this temperature rise throughout operation.

Since the thermal hydraulic design basis limits departure from nucleate boiling (DNB), adequate heat transfer is provided between the fuel cladding and the reactor coolant so that the core thermal output is not limited by considerations of the cladding temperature. These temperatures are calculated using the Westinghouse fuel rod model(1) which has been reviewed and approved by the NRC.

15.1.2.1 Power Distribution The transient response of the reactor system is dependent on the initial power distribution. The nuclear design of the reactor core minimizes adverse power distribution through the placement of fuel assemblies and control rods and by operation instructions. The power distribution may be characterized by the radial peaking factor FH and the total peaking factor FQ. The peaking factor limits are given in the Core Operating Limits Report.

For transients which may be DNB limited, the radial peaking factor is of importance. The radial peaking factor increases with decreasing power level due to rod insertion. This increase in FH is included in the core limits illustrated in figure 15.1-1A. All transients that may be DNB limited are assumed to begin with a FH consistent with (or greater than) the initial power level defined in the Technical Specifications.

The axial power shape used in the DNB calculation is the 1.70 chopped cosine as discussed in paragraph 4.4.3.2.2.

For transients which may be overpower limited, the total peaking factor FQ is of importance.

The value of FQ may increase with decreasing power level such that full-power, hotspot heat flux is not exceeded, i.e., FQ x power = design hotspot heat flux. All transients that may be overpower limited are assumed to begin with a value of FQ consistent with (or greater than) the initial power level as defined in the Technical Specifications.

The value of peak kW/ft can be directly related to fuel temperature determined by the Westinghouse fuel rod model (Reference 1), which includes transients that are slow with respect to the fuel rod thermal time constant. For transients which are fast with respect to the fuel rod thermal time constant, e.g., rod ejection, a detailed heat transfer calculation is made.

15.1.3 TRIP POINTS AND TIME DELAYS TO TRIP ASSUMED IN ACCIDENT ANALYSES Limiting trip setpoints assumed in accident analyses and the time delay assumed for each trip function are given in table 15.1-3.

A reactor trip signal acts to open two trip breakers connected in series which feed power to the control rod drive mechanisms (CRDMs). The loss of power to the mechanism coils causes the 15.1-8 REV 30 10/21

FNP-FSAR-15 mechanisms to release the rod cluster control assemblies (RCCAs) which then fall by gravity into the core. There are various instrumentation delays associated with each trip function, including delays in signal actuation, in opening the trip breakers, and in the release of the rods by the mechanisms. The total delay to trip is defined as the time delay from when the monitored parameter reaches the trip setpoint until the rods are free and begin to fall.

Table 15.1-3 refers to the overtemperature and overpower T trip shown in figure 15.1-1A.

These trip setpoints bound mixed LOPAR/VANTAGE 5 cores and a full core of VANTAGE 5 fuel within the requirements of the technical specifications. The associated OTT f(I) penalty is shown in figure 15.1-1B.

For all the reactor trips, the difference between the trip setpoints assumed in the analysis and the nominal trip setpoints account for instrumentation channel error and setpoint error. The plant technical specifications specify the nominal trip setpoints. Response time limits for the reactor trip systems are maintained in table 7.2-5. The calibration of protection system channels and the periodic determination of instrument response times are in accordance with the plant technical specifications.

15.1.4 INSTRUMENTATION DRIFT AND CALORIMETRIC ERRORS The VANTAGE 5 fuel design features, the modified safety analysis assumptions, and the application of new methodologies (i.e., RTDP, WRB-1, and WRB-2) as discussed in section 4.4 (with respect to the changes associated with the instrument uncertainties for the NSSS control parameters of power, pressure, temperature, and flow) are covered in reference 2 and reference 19.

Westinghouse Technical Bulletin, ESBU-TB-92-14-R1, Decalibration Effects of Calorimetric Power Level Measurements on the NIS High Power Reactor Trip at Power Levels Less Than 70% RTP, identified a potential non-conservative bias which could be introduced if NIS channel indicated power is adjusted in the decreasing power direction based on a part power calorimetric. To assure a reactor trip below the safety analysis limit, the Power Range Neutron Flux - High bistables are set 85% RTP: 1) whenever the NIS channel indicated power is adjusted in the decreasing power direction due to a part power calorimetric below 50% RTP; and 2) for a post refueling startup. Before the Power Range Neutron Flux - High bistables are reset 109% RTP, the NIS channel calibration must be confirmed based on a calorimetric performed 50% RTP (reference 19).

15.1.5 ROD CLUSTER CONTROL ASSEMBLY INSERTION CHARACTERISTIC The negative reactivity insertion following a reactor trip is a function of the acceleration of the RCCAs and the variation in rod worth as a function of rod position. With respect to accident analyses, the critical parameter is the time from the start of insertion up to the dashpot entry or approximately 85 percent of the rod cluster travel. For accident analyses, it is conservatively assumed that the insertion time to dashpot entry is 2.7 seconds. The RCCA position versus time assumed in accident analyses is shown in figure 15.1-2.

15.1-9 REV 30 10/21

FNP-FSAR-15 Figure 15.1-3 shows the fraction of total negative reactivity insertion for a core where the axial distribution is skewed to the lower region of the core. An axial distribution which is skewed to the lower region of the core can arise from a xenon oscillation or can be considered as representing a transient axial distribution which would exist after the rod cluster control assembly bank has already traveled some distance after trip. This curve has been conservatively selected to bound future reloads, which can include axial blankets of natural uranium.

There is inherent conservatism in the use of this curve in that it is based on a skewed distribution which would exist relatively infrequently. For cases other than those associated with xenon oscillations, significant negative reactivity would have been inserted due to the more favorable axial distribution existing prior to trip.

The normalized RCCA negative reactivity insertion versus time is shown in figure 15.1-4. The curve shown in this figure was obtained from figures 15.1-2 and 15.1-3. A total negative reactivity insertion following trip of 4.8-percent k/k is assumed in the transient analyses except where specifically noted otherwise. This assumption is conservative with respect to the calculated trip reactivity worth available as shown in table 4.3-3. Both the trip reactivity and reactivity insertion rate are verified to be conservative with respect to the core design as part of the reload design process (reference 3).

The normalized RCCA negative reactivity insertion versus time curve for an axial power distribution skewed to the bottom (figure 15.1-4) is used in transient analyses. Where special analyses require use of three-dimensional or axial one-dimensional core models, the negative reactivity insertion resulting from reactor trip is calculated directly by the reactor kinetic code and is not separable from other reactivity feedback effects. In this case, the rod cluster control assembly position versus time of reactor trip (figure 15.1-2) is used as code input.

15.1.6 REACTIVITY COEFFICIENTS The transient response of the reactor system is dependent on reactivity feedback effects, in particular the moderator temperature coefficient and the Doppler power coefficient. These reactivity coefficients and their values are discussed in detail in chapter 4.

The use of a slightly positive moderator temperature coefficient was initially incorporated into the core design by Amendments 37 and 27 to the Operating Licenses for Units 1 and 2, respectively. Subsequently, the moderator temperature coefficient technical specification unit was increased by Amendments 92 and 85 for Units 1 and 2, respectively. These amendments were the result of the reanalysis of those transients which are sensitive to a positive moderator temperature coefficient. In general, these are transients which cause an increase in the reactor coolant temperature such as an uncontrolled RCCA withdrawal, partial loss of forced reactor coolant flow, loss of external electrical load and/or turbine trip, accidental depressurization of the reactor coolant system, complete loss of forced reactor coolant flow, single reactor coolant pump locked rotor, and RCCA ejection. In all cases, the results indicated that the safety criteria and the NRC acceptance criteria are met. That is, peak fuel and clad temperatures remained 15.1-10 REV 30 10/21

FNP-FSAR-15 acceptable, the DNB design basis is met, and/or reactor coolant system pressure remained below 110 percent of design pressure.

In the analysis of certain events, conservatism requires the use of large reactivity coefficient values, whereas in the analysis of other events, conservatism requires the use of small reactivity coefficient values (see figure 15.1-5). Some analyses, such as loss of reactor coolant from cracks or ruptures in the RCS, do not depend on reactivity feedback effects.

The values used are given in table 15.1-2A. The justification for use of conservatively large versus small reactivity coefficient values is treated on an event-by-event basis. To facilitate comparison, individual sections in which justification can be found for the use of large or small reactivity coefficient values are referenced below:

Condition II Events Subsection A. Uncontrolled RCCA bank withdrawal from a 15.2.1 subcritical condition B. Uncontrolled RCCA bank withdrawal at power 15.2.2 C. RCCA misalignment 15.2.3 D. Uncontrolled boron dilution 15.2.4 E. Partial loss of forced reactor coolant flow 15.2.5 F Startup of an inactive reactor coolant loop 15.2-6 G. Loss of external electrical load and/or turbine trip 15.2.7 H. Loss of all ac power to the station auxiliaries 15.2.9 I. Excessive heat removal due to feedwater system 15.2.10 malfunctions J. Excessive load increase incident 15.2.11 K. Accidental depressurization of RCS 15.2.12 L. Accidental depressurization of main steam system 15.2.13 M. Inadvertent operation of emergency core cooling 15.2.14 system (ECCS) during power operation 15.1-11 REV 30 10/21

FNP-FSAR-15 Condition III Events A. Complete loss of forced reactor coolant flow 15.3.4 B. Single RCCA withdrawal at full power 15.3.6 Condition IV Events A. Rupture of a steam line 15.4.2.1 B. Rupture of a feed line 15.4.2.2 C. Single reactor coolant pump locked rotor 15.4.4.3 D. Rupture of a control rod drive mechanism housing 15.4.6.3 (RCCA ejection) 15.1.7 FISSION PRODUCT INVENTORIES 15.1.7.1 Activities in the Core Fuel burnup and fission product values were modeled via the ORIGEN2 code(15,16). ORIGEN2 is a versatile point-depletion and radioactive decay computer code for use in simulating nuclear fuel cycles and calculating nuclide compositions. This code takes into account the transmutation of all isotopes in the material. For the relatively high fluxes in the core region, burn-in and burn-out of isotopes can have an important effect, particularly when high burnup cases are being considered.

15.1.7.2 Core Inventory Release Fractions The core inventory release fractions, by radionuclide groups, for the gap release and early in-vessel damage phases for DBA LOCAs are in accordance with Table 2 of Regulatory Guide (RG) 1.183 Regulatory Position 3.2. For non-LOCA events, the fractions of the core inventory assumed to be in the gap for the various radionuclides are given in Table 3 of RG 1.183 Regulatory Position 3.2. These gap fractions are provided in table 15.1.4. The release fractions are used in conjunction with the fission product inventory calculated with the maximum core radial peaking factor. These fractions are applied to the equilibrium core inventory described in FSAR paragraph 15.1.7.1.

15.1-12 REV 30 10/21

FNP-FSAR-15 15.1.8 RESIDUAL DECAY HEAT 15.1.8.1 Decay Heat Model for Non-LOCA Analyses For the non-LOCA analyses, conservative core residual heat generation based on long-term operation at the initial power level preceding the trip is assumed. The 1979 ANS decay heat standard (reference 8) plus uncertainty was used for calculation of residual decay heat levels.

Figure 15.1-6 presents a bounding decay heat curve as a function of time after shutdown.

15.1.8.2 Distribution of Decay Heat Following Loss-of-Coolant Accident During a LOCA, the power generation in the core decreases rapidly due to void formation or RCCA insertion, or both. A large fraction of the remaining heat generation comes from fission product decay gamma rays. This heat is not distributed in the same manner as steady-state fission power. During steady-state operation, as high as 97.4 percent of the hot rod power is generated directly in the pellets and cladding. When the fission power is reduced due to void formation and/or RCCA insertion, more of the hot rod power is redistributed. In the small break LOCA analysis, this is accounted for by reducing the power generated directly in the hot rod power from 97.4 to 95%. In the large break Best Estimate LOCA analysis, a detailed model is used to calculate the energy redistribution as a function of time, as described in Section 8.0 of reference 17.

15.1.9 COMPUTER CODES UTILIZED Summaries of some of the principal computer codes used in transient analyses are given below.

Other codes, in particular very specialized codes in which the modeling has been developed to simulate one given accident such as the BE WCOBRA/TRAC code as in the analysis of the RCS pipe rupture (section 15.4) and which consequently have a direct bearing on the analysis of the accident itself, are summarized in their respective accident analyses sections. The codes used in the analyses of each transient are listed in table 15.1-2.

15.1.9.1 FACTRAN FACTRAN calculates the transient temperature distribution in a cross-section of a metal-clad UO2 fuel rod (LOPAR or VANTAGE 5 -see figure 15.1-7) and the transient heat flux at the surface of the clad using as input the nuclear power and the time-dependent coolant parameters (pressure, flow, temperature, density). The code uses a fuel model which exhibits the following features simultaneously:

A. A sufficiently large number of radial space increments to handle fast transients such as rod ejection accidents.

15.1-13 REV 30 10/21

FNP-FSAR-15 B. Material properties which are functions of temperature and a sophisticated fuel to clad gap heat transfer calculation.

C. The necessary calculations to handle post-DNB transients (film boiling heat transfer correlations, zircaloy-water reaction, and partial melting of the materials).

The gap heat transfer coefficient is calculated according to an elastic pellet model (figure 15.1-7). The thermal expansion of the pellet is calculated as the sum of the radial (one-dimensional) expansions of the rings.

Each ring is assumed to expand freely. The cladding diameter is calculated based on thermal expansion and internal and external pressures.

If the outside radius of the expanded pellet is smaller than the inside radius of the expanded clad, there is no fuel clad contact and the gap conductance is calculated on the basis of the thermal conductivity of the gas contained in the gap. If the pellet outside radius so calculated is larger than the clad inside radius (negative gap), the pellet and the clad are pictured as exerting a pressure upon each other sufficiently important to reduce the gap to zero by elastic deformation of both. This contact pressure determines the gap heat transfer coefficient.

The effects of IFBA are implicitly included in the fuel model by appropriately modifying the initial fuel temperatures.

FACTRAN is further discussed in reference 9.

15.1.9.2 LOFTRAN The LOFTRAN program is used for studies of transient response of a PWR system to specified perturbations in process parameters. LOFTRAN simulates up to a 4-loop system by modeling the reactor vessel, hot and cold leg piping, steam generators (tube and shell sides), and pressurizer. The pressurizer heaters' spray, relief, and safety valves are also considered in the program. Point model neutron kinetics and reactivity effects of the moderator, fuel, boron, and rods are included. The secondary sides of the steam generators utilize a homogeneous, saturated mixture for the thermal transients, and a water level correlation for indication and control. The reactor protection system is simulated to include reactor trips on neutron flux, overpower and overtemperature reactor coolant delta T, high and low pressure, low flow, and high-pressurizer level. Control systems, including rod control, steam dump, feedwater control, and pressurizer pressure control are also simulated. The safety injection system (SIS),

including the accumulators, are also modeled.

LOFTRAN is a versatile program suited to accident evaluation and control studies as well as parameter sizing.

15.1-14 REV 30 10/21

FNP-FSAR-15 LOFTRAN also has the capability of calculating the transient value of the DNBR based on the input from the core limits illustrated in figure 15.1-1A. The core limits represent the combination of the safety analysis DNBR exit boiling and exit quality limits as calculated for a typical or thimble cell.

LOFTRAN is further discussed in reference 10.

15.1.9.3 CROSS-SECTION GENERATION COMPUTER CODE The lattice codes which have been used for the generation of group constants needed in the spatial two-group diffusion codes are described in chapter 4.

15.1.9.4 SPATIAL TWO-GROUP DIFFUSION CALCULATION CODE Spatial few-group diffusion calculations are described in chapter 4.

15.1.9.5 TWINKLE The TWINKLE program is a multidimensional spatial neutron kinetics code patterned after steady-state codes presently used for reactor core design. The code uses an implicit finite-difference method to solve the two-group transient neutron diffusion equations in one, two, and three dimensions. The code uses six delayed neutron groups and contains a detailed multiregion, fuel-clad, coolant heat transfer model for calculating, by point, Doppler and moderator feedback effects. The code handles up to 8000 spatial points and performs its own steady-state initialization. Aside from basic cross-section data and thermal hydraulic parameters, the code accepts as input basic driving functions such as inlet temperature, pressure, flow, boron concentration, control rod motion, and others. Various edits provide channel power, axial offset, enthalpy, volumetric surge, point power, fuel temperatures, and so on.

The TWINKLE code is used to predict the kinetic behavior of a reactor for transients that cause a major perturbation in the spatial neutron flux distribution.

TWINKLE is further described in reference 13.

15.1.9.6 VIPRE The VIPRE program performs thermal-hydraulic calculations. This code calculates density, mass velocity, enthalpy, void fractions, static pressure and DNBR distributions along flow channels within the reactor core. The VIPRE code is described in Reference 25.

15.1-15 REV 30 10/21

FNP-FSAR-15 15.1.9.7 ANC ANC is an advanced nodal code capable of two-dimensional and three-dimensional neutronics calculations. ANC is the reference model for all safety analysis calculations, power distributions, peaking factors, critical boron concentrations, control rod worths, reactivity coefficients, etc. In addition, three-dimensional ANC validates one-dimensional and two-dimensional results and provides information about radial (x-y) peaking factors as a function of axial position. It can calculate discrete pin powers from nodal information as well.

ANC is further discussed in reference 14.

15.1.9.8 RETRAN In addition to LOFTRAN, the RETRAN program is used for studies of the transient response of a PWR system to specified perturbations in process parameters. RETRAN is a one-dimensional, best estimate, thermal hydraulic analysis computer code developed under the sponsorship of the Electric Power Research Institute to provide for the analysis of light water reactor systems. The EPRI RETRAN code was approved by the USNRC in references 21 and 22.

The RETRAN code is a variable nodalization code; therefore, the user builds the desired plant model by defining the control volumes and flow paths (i.e., junctions) with heat slabs (i.e., conductors) to account for heat transfer in both the primary and secondary elements.

The RETRAN code allows either point neutron kinetics or one-dimensional space time kinetics to be used for the neutronics. Various component models are available, including a two-region nonequilbrium pressurizer, centrifugal pumps, valves, and non-conduction heat exchanges. In addition, special purpose models include a subcooled void fit, bubble rise, trips, and a flexible control system which allows the user to implement a wide range of auxiliary calculations/systems.

The Westinghouse RETRAN model consists of a point kinetics core model, a multi-node vessel model, which provides flexibility to address a wide range of upper and lower plenum mixing characteristics and asymmetric flow transitions, explicit models of each reactor coolant loop, multi-node steam generator models, and detailed models of the protection and control systems.

Details of the NRC-approved Westinghouse RETRAN model are documented in reference 23 and 24.

15.1-16 REV 30 10/21

FNP-FSAR-15 15.1.10 FISSION PRODUCT BARRIERS ASSUMED IN ACCIDENT ANALYSES One objective of Title 10 of the Code of Federal Regulations is to establish requirements directed toward protecting the health and safety of the public from an uncontrolled release of radioactivity. The design of the Farley Nuclear Plant applies defense-in-depth by providing adequate physical barriers to maintain uncontrolled releases of radioactivity within the guidelines of 10 CFR 100 and NUREG-0800. Physical barriers to the uncontrolled release of fission products credited in each of the analyses of the events as described in the updated FSAR are listed in table 15.1-6.

15.1-17 REV 30 10/21

FNP-FSAR-15 REFERENCES

1. Linsuain, O., et al., Westinghouse Performance Analysis and Design Model (PAD5),

WCAP-17642-P-A, Revision 1, November 2017.

2. Phillips, B. T., et al., Westinghouse Revised Thermal Design Procedure Instrument Uncertainty Methodology for Alabama Power Farley Nuclear Plant Units 1 and 2 (Model 54F Steam Generators and 2785 MWt NSSS Power), WCAP-12771-P, (Proprietary)

Revision 5.

3. Davidson, S. L. ed., et al., "Westinghouse Reload Safety Evaluation Methodology,"

WCAP-9272-P-A, July 1985.

4. DiNunno, J. J., et al., "Calculation of Distance Factors for Power and Test Reactor Sites,"

TID-14844, March 1962.

5. Meek, M. E. and Rider, B. F., "Summary of Fission Product Yields for U-235, U-238, Pu-239, and Pu-241 at Thermal Fission Spectrum and 14 MeV Neutron Energies,"

APED-5398, March 1968.

6. Toner, D. F. and Scott, J. S., "Fission Product Release From UO2," Nuclear Safety 3 No.2, pp 15-20, December 1961.

7. Belle, J., "Uranium Dioxide, Properties and Nuclear Applications," Naval Reactors, Division of Reactor Development, NRC, 1961.

8. ANSI/ANS-5.1-1979, "Decay Heat Power In Light Water Reactors," August 29, 1979.

9. Hargrove, H. G., "FACTRAN - A Fortran IV Code for Thermal Transients in a UO2 Fuel Rod," WCAP-7908-A, December 1989.

10. Burnett, T. W. T., et al., "LOFTRAN Code Description,"WCAP-7907-P-A (Proprietary),

WCAP-7907-A (Nonproprietary), April 1984.

11. No longer used.

12. No longer used.

13. Barry, R. F. and Risher, D. H., Jr., "TWINKLE - A Multidimensional Neutron Kinetics Computer Code," WCAP-7979-P-A (Proprietary), and WCAP-8028-A (Nonproprietary),

January 1975.

14. Liu, Y. S., et al., "ANC - A Westinghouse Advanced Nodal Computer Code," WCAP-10965-P-A (Proprietary), WCAP-10966-A (Nonproprietary), September 1986.

15. CCC-371/ORIGEN2 Version 2.1 15.1-18 REV 30 10/21

FNP-FSAR-15

16. Croff, A. G., A Users Manual for the ORIGEN2 Computer Code, ORNL/TM-7175, July, 1980.

17. Bajorek, S. M., et al., Code Qualification Document for Best Estimate LOCA Analysis, Volume I: Models and Correlations, WCAP-12945-P (Proprietary), Volume 1, Revision 1, June 1992.

18. Friedland, A. J. And Ray, S., Revised Thermal Design Procedure, WCAP-11397-P-A (Proprietary), April 1989.

19. NRC letter to SNC, Joseph M. Farley Nuclear Plant, Units 1 and 2 Re: Issuance of Amendments - NIS Power Range Channel Daily Surveillance Requirements (TAC Nos.

MA4153 and MA4154), October 1, 1999, Unit 1 Amendment No. 144 and Unit 2 Amendment No. 135.

20. Andre, S. V., et al., RCS Flow Verification Using Elbow Taps at Westinghouse 3-Loop PWRs, WCAP-14750-P-A, (Proprietary), Rev. 1, September 1999.

21. Letter from C. O. Thomas (USNRC) to T. W. Schnatz (UGRA), Acceptance for Referencing of Licensing Topical Reports EPRI CCM-5, RETRAN-A Program for One Dimensional Transient Thermal Hydraulic Analysis of Complex Fluid Flow Systems, and C. E. Patterson, et al., RETRAN-02-A Program for Transient Thermal-Hydraulic Analysis of Complex Fluid Flow Systems, EPRI NP-1850-CCM, Rev. 6, December 1995.

22. Letter from A. C. Thandani to W. J. Boatwright (TU Electric), Acceptance for Use of RETRAN MOD005.0, November 1, 1991.

23. Huegel, D. S., et al., RETRAN-02 Modeling and Qualification for Westinghouse Pressurized Water Reactor Non-LOCA Safety Analysis, WCAP-14882-P-A, (Proprietary), WCAP-15234-A, (Non-proprietary) April 1999.

24. Higby, W. D., et al., RETRAN-02 Modeling and Qualification for Westinghouse Pressurized Water Reactor Non-LOCA Safety Analysis, Supplement 1 - Thick Metal Mass Heat Transfer Model and NOTRUMP-Based Steam Generator Mass Calculation Method, WCAP-14882-S1-P-A, (Proprietary), WCAP-15234-A, (Non-proprietary)

October 2005.

25. Sung, Y. X., et al., VIPRE-01 Modeling and Qualification for Pressurized Water Reactor Non-LOCA ,Thermal Hydraulic Safety Analysis, WCAP-14565-P-A (Proprietary) and WCAP-14565-A (Non-Proprietary), October 1999.

15.1-19 REV 30 10/21

FNP-FSAR-15 TABLE 15.1-1 NUCLEAR STEAM SUPPLY SYSTEM POWER RATINGS Item Rating (MWt)

Core thermal power (MWt) (a) 2831 Thermal power generated by the RCPs (c) (nominal) 10(b)

Engineered safety features (ESF) design rating 2831 Thermal power generated by the RCPs(c) (ESF, nominal) 10(b)

Thermal power generated by the RCPs(c) (ESF, maximum) 15(b)

a. For the MUR power uprate, the safety analyses considered a conservative maximum core thermal power, inclusive of power uncertainty, of 2831 MWt. This corresponds to a maximum NSSS power of 2841 MWt.

b. Nominal pump heat is considered to be 10 MWt for the NSSS power of 2841 MWt. The non-LOCA analyses assume a conservative maximum of 15 MWt for those transients in which larger values of pump heat are conservative. For transients in which pump heat would provide a transient benefit, no (zero) pump heat is assumed.

c. Analytical representation of Total Net Heat Input into the RCS from all sources.

REV 30 10/21

FNP-FSAR-15 TABLE 15.1-2A (SHEET 1 OF 4)

SUMMARY

OF INITIAL CONDITIONS AND COMPUTER CODES USED Reactivity Coefficients Assumed BOL Moderator Initial NSSS Thermal Computer Codes Temperature EOL Moderator Power Output Faults Utilized (pcm/°F) Density (k/g/cm3) Doppler Assumed (MWt)

Condition II Uncontrolled RCCA bank withdrawal TWINKLE, + 7.0 -- Coefficient is 0 (subcritical)(e) from a sub-critical condition FACTRAN, consistent with a VIPRE defect of -960 pcm Uncontrolled RCCA bank withdrawal at LOFTRAN 0.0(g) + 7.0, 70% 0.50 Lower and upper 284.1, power DNB transient RTP Ramping to 0 at (see figure 15.1-5) 1704.6, and 100% RTP 2841(a,f)

Uncontrolled RCCA bank withdrawal at LOFTRAN 0.0(g) + 7.0, 70% -- Lower Varies from 223 to power pressure transient RTP Ramping to 0 at (see figure 15.1-5) 2841 (a,e) 100% RTP RCCA misalignment VIPRE, ANC, - -- - 2841(b,f)

LOFTRAN Uncontrolled boron dilution NA NA NA NA N/A Partial loss of forced reactor coolant LOFTRAN, VIPRE 0.0(g) -- Upper 2841(a,f) flow (see figure 15.1-5)

Startup of an inactive RCP NA NA NA NA NA Loss of external electrical load and/or RETRAN 0.0(g) -- Lower 2841(e,f) turbine trip (see figure 15.1-5)

Loss of normal feedwater RETRAN 0.0(g) Ramping to 0 at -- Upper 2841(c,e) 100% RTP (see figure 15.1-5)

REV 30 10/21

FNP-FSAR-15 TABLE 15.1-2A (SHEET 2 OF 4)

Reactivity Coefficients Assumed BOL Moderator Initial NSSS Thermal Computer Codes Temperature EOL Moderator Power Output Faults Utilized (pcm/°F) Density (k/g/cm3) Doppler Assumed (MWt)

Loss of all ac power to the station RETRAN 0.0(g) -- Upper 2841(a,e) auxiliaries (see figure 15.1-5)

Excessive heat removal due to LOFTRAN - 0.50 Lower 2841(b,f) feedwater system malfunctions (see figure 15.1-5)

Excessive load increase LOFTRAN 0.0(g) 0.50 Upper and lower 2831(b,f)

(see figure 15.1-5)

Accidental depressurization of the LOFTRAN 0.0(g) -- Lower 2841(a,f)

RCS (see figure 15.1-5)

Accidental depressurization of the LOFTRAN Function of -- See figure 15.2-40 0 (subcritical)(e) main steam system moderator density Sh. 2 (see subsection 15.2.13 and figure 15.2-40 Sh. 1)

Inadvertent operation of the ECCS LOFTRAN -- 0.50 Upper 2841(c,e) during power operation (see figure 15.1-5)

Condition III Loss of reactor coolant from small NOTRUMP, -- -- -- 2831(b,i) ruptured pipes or from cracks in large LOCTA-IV pipe which actuate emergency core cooling Inadvertant loading of a fuel assembly LEOPARD, TURTLE -- -- -- 2775 into an improper position REV 30 10/21

FNP-FSAR-15 TABLE 15.1-2A (SHEET 3 OF 4)

Reactivity Coefficients Assumed BOL Moderator Initial NSSS Thermal Computer Codes Temperature EOL Moderator Power Output Faults Utilized (pcm/°F) Density (k/g/cm3) Doppler Assumed (MWt)

Complete loss of forced reactor LOFTRAN, 0.0(g) -- Upper 2841(a,f) coolant flow VIPRE (see figure 15.1-5)

Waste gas decay tank rupture -- -- -- -- --

Single RCCA withdrawal at full power ANC -- -- -- 2775(b)

Condition IV Major rupture of pipes containing WCOBRA/TRAC Function of -- Function of fuel 2775(b) reactor coolant up to and including HOTSPOT, COCO moderator density temperature double-ended rupture of the largest (see subsection (see subsection pipe in the RCS (LOCA) 15.4.1) 15.4.1)

Major secondary system pipe rupture RETRAN, Function of -- See figure 0(subcritical)(e) up to and including double- ended VIPRE moderator density 15.2-40 Sh. 2 rupture of a steam pipe (see paragraph 15.4.2.1 and figure 15.2-40 Sheet 1)

Major rupture of a main feedwater pipe RETRAN -- -- -- --

Offsite Power Always RETRAN -- 0.50 Upper (see figure 2841(c,e)

Available 15.1-5)

Loss of Offsite Power RETRAN 0.00 -- Lower (see figure 2841(a,e) 15.1-5)

Steam generator tube rupture -- -- -- -- 2775(b,j)

REV 30 10/21

FNP-FSAR-15 TABLE 15.1-2A (SHEET 4 OF 4)

Reactivity Coefficients Assumed BOL Moderator Initial NSSS Thermal Computer Codes Temperature EOL Moderator Power Output Faults Utilized (pcm/°F) Density (k/g/cm3) Doppler Assumed (MWt)

RCP shaft seizure (locked rotor) peak LOFTRAN, 0.0(g) -- Upper 2841(a,e) clad temperature/peak RCS pressure VIPRE (see figure 15.1-5) transient RCP shaft seizure (locked rotor) LOFTRAN, 0.0(g) -- Upper 2841(a,f) rods-in-DNB transient VIPRE (see figure 15.1-5)

Fuel handling accident -- -- -- -- 2831 Spectrum of RCCA ejection accidents TWINKLE, Refer to Section - Coefficient is 0 and 2831(b,e)

FACTRAN, THINC 15.4.6.2.2.3 consistent with a defect of:

- 954 pcm (BOL HZP)

- 954 pcm (BOL HFP)

- 909 pcm (EOL HZP)

- 909 pcm (EOL HFP)

a. Nominal pump heat of 10 MWt is assumed.

b. No pump heat (core thermal power) assumed.

c. Maximum pump heat of 15 MWt is assumed.

d. Not used

e. STDP with a TDF of 86,000 gal/min/loop assumed.

f. RTDP with a MMF of 91,300 gal/min/loop assumed.

g. The BOL MTC used in the safety analysis is defined as + 7 pcm/°F 70% RTP Ramping to 0 pcm/°F at 100% RTP. An MTC of 0.0 pcm/°F at full power conditions is more limiting than a positive MTC at part-power conditions.

h. Not used

i. MUR conditions have been assessed which allow a maximum core power of 2831 MWt, including uncertainties, to be utilized.

j. An increase in core power to 2831 MWt has been evaluated.

REV 30 10/21

FNP-FSAR-15 TABLE 15.1-2B NOMINAL VALUES OF PERTINENT PLANT PARAMETERS USED IN THE ACCIDENT ANALYSES Parameter STDP Value RTDP Value Maximum NSSS thermal output analysed for the MUR power 2841 2841 uprate (includes 10 MWt generated by RCPs, MWt)

Steam generator tube plugging (%) 20 20 Vessel average temperature (°F)

High Tavg 577.2(c) 577.2 Low Tavg 567.2(c) 567.2 Core inlet temperature (°F)

At High Tavg 540.5(c) 542.2 At Low Tavg 529.9(c) 531.8 Pressurizer pressure (psia) 2250(c) 2250 Reactor coolant flow, loop (gpm) 86,000(a) 87,800(b)(d)

Steam flow at 2841 MWt, total (lbm/hr)

At High Tavg 12,510,000 12,510,000 At Low Tavg 12,490,000 12,490,000 Steam pressure at steam generator outlet (psia)

At High Tavg 716 716 At Low Tavg 648 648 Maximum steam moisture content (%) 0.10 0.10 Feedwater temperature at steam generator inlet (°F) 446.0 446.0 Average core heat flux (Btu/h-ft2)

VANTAGE 5 fuel 201,129.4 201,129.4

a. TDF assumed in the non-LOCA analyses.

b. MMF assumed in the non-LOCA analyses.

c. Does not include uncertainties. See the appropriate accident sections.

REV 30 10/21

FNP-FSAR-15 TABLE 15.1-3 TRIP POINTS AND TIME DELAYS TO TRIP ASSUMED IN ACCIDENT ANALYSES Trip Function Limiting Trip Point Assumed in Analyses Time Delay (s)

Power range high neutron flux, high setting 118% of RTP 0.5 Power range high neutron flux, low setting 35% of RTP 0.5 Power range high positive neutron flux rate 9% of RTP 0.65 2 seconds lag time constant Variable (See figure 15.1-1A & 1B) (a)

OTT (a)

OPT Variable (See figure 15.1-1A)

High pressurizer pressure 2425 psig 1.0 Low pressurizer pressure 1831 psig 2.0 Low reactor coolant flow 85% loop flow 1.0 (from loop flow detectors)

Low-low steam generator water level 0% of narrow range level span 2.0 (Feedline rupture event)(d) 19% of narrow range level span 2.0 (Loss of normal feedwater event and Loss of offsite power event)(d)

High-high steam generator water level trip 100% of narrow range(d) level span 7.0(b) of the closure of feedwater closure of feedwater system valves and turbine trip 2.5(c)

Reactor trip (following turbine trip) NA 1.0

a. The response time test criteria provided in chapter 7 are based on the FSAR chapter 15 analyses which model the channel response time. The specific safety analyses channel time delay is a function of the transient and code model. The model includes:

i) a first order lag for the 5-s RTD time constant ii) a first order lag for the 6-s filters on measured T and Tavg iii) dynamic Tavg/T signal compensation as defined by the Technical Specifications iv) a 2-s pure time delay. This 2-s pure delay accounts for the channel electronics delay and the trip logic circuit delay, plus the time for the reactor breakers to open and the time for the CRDM stationary grippers to disengage (gripper release time).

b. From time setpoint is reached to feedwater isolation.

c. From time setpoint is reached to turbine trip.

d. Narrow range level span is from 375 to 587 in. above the top of the tube sheet.

REV 30 10/21

FNP-FSAR-15 TABLE 15.1-4 CORE INVENTORY FRACTION RELEASED INTO CONTAINMENT LOCA Group Gap Release Phase Early In-Vessel Phase Total Noble Gases 0.05 0.95 1.0 Halogens 0.05 0.35 0.4 Alkali Metals 0.05 0.25 0.3 Tellurium Metals 0.00 0.05 0.05 Ba, Sr 0.00 0.02 0.02 Noble Metals 0.00 0.0025 0.0025 Cerium Group 0.00 0.0005 0.0005 Lanthanides 0.00 0.0002 0.0002 Non-LOCA Group Fraction I-131 0.08 Kr-85 0.10 Other Noble Gases 0.05 Other Halogens 0.05 Alkali Metals 0.12 REV 28 10/18

FNP-FSAR-15 TABLE 15.1-5 DELETED REV 28 10/18

FNP-FSAR-15 TABLE 15.1-6 (SHEET 1 OF 7)

FISSION PRODUCT BARRIERS Accident Description (FSAR Section) Fission Product Barrier Design Basis Limit Reference(s)

Accidental Releases of Fuel Cladding, None credited N/A Liquid Effluents in RCS Pressure Boundary, Ground and Surface Containment Water (2.4.13.3)

RCS Pressure Control Fuel Cladding None credited N/A During Low-Temperature Operation RCS Pressure Boundary RCS within ASME stress limits FSAR 3.1.27, 3A-1.65 (5.2.2.4) (Appendix G, heatup/cooldown) 5.2.2, 5.2.4, 5.4.2, PTLR Containment None credited N/A Uncontrolled RCCA Fuel Cladding DNBR DNBR Design Limit FSAR 15.2.1.3, 4.4.1.1 Withdrawal from Fuel centerline temperature is FSAR 15.2.1.2.2, Subcritical Condition fuel melt limit Table 4.1-1, Table 4.4-1 (15.2.1)

RCS Pressure Boundary RCS pressure 2750 psia FSAR 15.2.1, Table 5.2-19 Containment None credited N/A Uncontrolled RCCA Fuel Cladding DNBR DNBR Design Limit FSAR 15.2.2.3, 4.4.1.1 Bank Withdrawal At Fuel centerline temperature is FSAR 15.2.2.1C, 15.2, Power fuel melt limit Table 4.1-1, Table 4.4-1 (15.2.2)

RCS Pressure Boundary RCS pressure 2750 psia FSAR 15.2.2, Table 5.2-19 Containment None credited N/A RCCA Misalignment Fuel Cladding DNBR DNBR Design Limit FSAR 15.2.3.3, 4.4.1.1 (15.2.3) Fuel centerline temperature is FSAR 15.2.3.2.2C, fuel melt limit Table 4.1-1, Table 4.4-1 RCS Pressure Boundary RCS pressure 2750 psia FSAR 15.2, Table 5.2-19 Containment None credited N/A REV 30 10/21

FNP-FSAR-15 TABLE 15.1-6 (SHEET 2 OF 7)

Accident Description (FSAR Section)

Fission Product Barrier Design Basis Limit Reference(s)

Uncontrolled Boron Fuel Cladding, RCS Bounded by 15.2.2 FSAR 15.2.4.2.5 Dilution Pressure Boundary (15.2.4)

Containment None credited N/A Partial Loss of Forced Fuel Cladding DNBR DNBR Design Limit FSAR 15.2.5.3, 4.4.1.1 Reactor Coolant Flow Fuel centerline temperature is FSAR 15.2, Table 4.1-1, (15.2.5) fuel melt limit Table 4.4-1 RCS Pressure Boundary RCS pressure 2750 psia FSAR 15.2, Table 5.2-19 Containment None credited N/A Startup of Inactive Fuel Cladding DNBR DNBR Design Limit FSAR 15.2.6.3, 4.4.1.1 RCS Loop Fuel centerline temperature is FSAR 15.2, Table 4.1-1, (15.2.6) fuel melt limit Table 4.4-1 RCS Pressure Boundary RCS pressure 2750 psia FSAR 15.2, Table 5.2-19 Containment None credited N/A Loss of External Fuel Cladding DNBR DNBR Design Limit FSAR 15.2.7.3, 4.4.1.1 Electrical Load and/or Fuel centerline temperature is FSAR 15.2, Table 4.1-1, Turbine Trip fuel melt limit Table 4.4-1 (15.2.7)

RCS Pressure Boundary RCS pressure 2750 psia FSAR 15.2.7.3, Table 5.2-19 Containment None credited N/A Loss of Normal Fuel Cladding DNBR DNBR Design Limit FSAR 15.2.8.3, 4.4.1.1, Feedwater Fuel centerline temperature is FSAR 15.2, (15.2.8) fuel melt limit Table 4.1-1,Table 4.4-1 RCS Pressure Boundary RCS pressure 2750 psia FSAR 15.2.8.3, Table 5.2-19 Pressurizer H2O vol. < 1400 ft3 FSAR 15.2.8.3, Table 5.5-9 Containment None credited N/A REV 30 10/21

FNP-FSAR-15 TABLE 15.1-6 (SHEET 3 OF 7)

Accident Description (FSAR Section)

Fission Product Barrier Design Basis Limit Reference(s)

Loss of All ac Power to Fuel Cladding DNBR DNBR Design Limit FSAR 15.2.9.3 the Station Auxiliaries Fuel centerline temperature is FSAR 15.2.9.3, (15.2.9) fuel melt limit Table 4.1-1,Table 4.4-1 I2 spike 60 Ci/gm FSAR 15.2.9.4, Table 15.2-3 RCS Pressure Boundary RCS pressure 2750 psia FSAR 15.2.9.3, Table 5.2-19 RCS-to-SG leak 1 gpm FSAR 15.2.9.4, Table 15.2-3 Containment None credited N/A Excessive Heat Fuel Cladding DNBR bounded by 15.2.1 and FSAR 15.2.10.3 Removal due to 15.2.11 Feedwater System Malfunctions DNBR DNBR Design Limit FSAR 15.2.10.3, 4.4.1.1 (15.2.10) Fuel centerline temperature is FSAR 15.2.10.2, fuel melt limit Table 4.1-1, Table 4.4-1 RCS Pressure Boundary RCS pressure 2750 psia FSAR 15.2, Table 5.2-19 Containment None credited N/A Excess Load Increase Fuel Cladding DNBR DNBR Design Limit FSAR 15.2.11.3, 4.4.1.1 (15.2.11) Fuel centerline temperature is FSAR 15.2, Table 4.1-1, fuel melt limit Table 4.4-1 RCS Pressure Boundary RCS pressure 2750 psia FSAR 15.2, Table 5.2-19 Containment None credited N/A Accidental Fuel Cladding DNBR DNBR Design Limit FSAR 15.2.12.2, 4.4.1.1 Depressurization of the Fuel centerline temperature is FSAR 15.2, Table 4.1-1, RCS fuel melt limit Table 4.4-1 (15.2.12)

RCS Pressure Boundary RCS pressure 2750 psia FSAR 15.2, Table 5.2-19 Containment None credited N/A REV 30 10/21

FNP-FSAR-15 TABLE 15.1-6 (SHEET 4 OF 7)

Accident Description (FSAR Section)

Fission Product Barrier Design Basis Limit Reference(s)

Accidental Fuel Cladding DNBR DNBR Design Limit FSAR 15.2.13.3, 4.4.1.1 Depressurization of the Fuel centerline temperature is FSAR 15.2, Table 4.1-1, Main Steam System fuel melt limit Table 4.4-1 (15.2.13)

RCS Pressure Boundary RCS pressure 2750 psia FSAR 15.2.13.3, Table 5.2-19 Containment None credited N/A Inadvertent ECCS Fuel Cladding DNBR DNBR Design Limit FSAR 15.2.14.3, 4.4.1.1 During Power Operation Fuel centerline temperature is FSAR 15.2, Table 4.1-1, (15.2.14) fuel melt limit Table 4.4-1 RCS Pressure Boundary RCS pressure 2750 psia FSAR 15.2, Table 5.2-19 Przr H2O volume < 1400 ft3 FSAR 15.2.14.3, Table 5.5-9.

Containment None credited N/A Loss of Reactor Coolant Fuel Cladding PCT < 2200°F FSAR 15.3.1.3 from Small Ruptured Pipes RCS Pressure Boundary RCS pressure 2750 psia FSAR 15.3, Table 5.2-19 (15.3.1)

Containment Leak rate 0.15% / day FSAR 15.3, Table 6.2-1 Minor Secondary Fuel Cladding, Bounded by 15.4.2.1 FSAR 15.3.2.3 System Pipe Breaks RCS Pressure Boundary, (15.3.2) Containment Misloaded Fuel Fuel Cladding, None credited N/A Assembly (15.3.3) RCS Pressure Boundary, Containment Complete Loss of RCS Fuel Cladding DNBR DNBR Design Limit FSAR 15.3.4.4, 4.4.1.1, Flow (15.3.4) Fuel centerline temperature is Table 4.1-1 fuel melt limit RCS Pressure Boundary RCS pressure 2750 psia FSAR 15.3, Table 5.2-19 Containment None credited N/A REV 30 10/21

FNP-FSAR-15 TABLE 15.1-6 (SHEET 5 OF 7)

Accident Description (FSAR Section)

Fission Product Barrier Design Basis Limit Reference(s)

Gas Decay Tank Fuel Cladding, None credited N/A Rupture (15.3.5)

RCS Pressure Boundary, Containment Single RCCA Fuel Cladding 5 % fuel rods exceed DNBR FSAR 15.3.6.2 Withdrawal at Power (15.3.6) RCS Pressure Boundary RCS pressure 2750 psia FSAR 15.3, Table 5.2-19 Containment None credited N/A LOCA (15.4.1) Fuel Cladding PCT 2200°F FSAR 15.4.1.5.4.1 Clad oxidation 17% locally FSAR 15.4.1.5.4.2 RCS Pressure Boundary ECCS leakage outside FSAR 15.4.1.10, containment is 40,000 cm3/h Table 15.4.14 RCS meets limits in Tables 5.2- FSAR 15.4.1.1D and 3 through 5.2-7 E5.2.1.10 Containment Stress limits in tables FSAR 3.8.1.5 (including pressure 54 psig FSAR Table 6.2-1 and temperature 280°F)

Containment leakage FSAR 15.4.1.7.3B, 0.15% / day Table 15.4-14 H2 concentration < 4 v/o FSAR 15.4.1.6.5 Minipurge close 6 seconds FSAR Table 15.4-15 Steam Line Break Fuel Cladding DNBR DNBR Design Limit FSAR 15.4.2.1.1.2, 4.4.1.1 (15.4.2.1) Fuel centerline temperature is FSAR 15.4.2.1.2.2, fuel melt limit Table 4.1-1, Table 4.4-1 I2 spike 60 Ci/gm and 500 x FSAR 15.4.2.1.4E, normal appearance rate Table 15.4-23 RCS Pressure Boundary RCS pressure 2750 psia FSAR 15.4.2.1.1.1, Table 5.2-19 RCS-to-SG leak 1 gpm total FSAR Table 15.4-23 (0.65 gpm to intact SG/0.35 gpm to faulted SG)

Containment None credited N/A REV 30 10/21

FNP-FSAR-15 TABLE 15.1-6 (SHEET 6 OF 7)

Accident Description (FSAR Section)

Fission Product Barrier Design Basis Limit Reference(s)

Feedwater Line Fuel Cladding Core stays water covered FSAR 15.4.2.2.4 Break (15.4.2.2)

RCS Pressure Boundary RCS pressure 2750 psia FSAR 15.4.2.2.4, See additional criteria Table 5.2-19 for FSAR sections 15.2.8 and 15.4.2.1 Containment None credited N/A SGTR Fuel Cladding I2 spike 30 Ci/gm and 335 x FSAR Table 15.4-24 (15.4.3) normal appearance rate Core stays water covered FSAR 15.4.3.2.2 RCS Pressure Boundary RCS stress limits in Tables FSAR 15.4.3.3, 5.2.1.10 5.2-3 through 5.2-7 RCS-to-SG leak 1 gpm total FSAR 15.4.3.4, (0.65 gpm to intact SG/0.35 Table 15.4-24 gpm to faulted SG)

Containment None credited N/A Locked Rotor Fuel Cladding 20% fuel rods exceed DNBR FSAR 15.4.4.3C (15.4.4) PCT 2700°F (ZIRLO) PCT FSAR 15.4.4.3B 2375°F (Optimized ZIRLO)

RCS Pressure Boundary RCS stress limits in Tables FSAR 15.4.4.3A, 5.2.1.10 5.2-3 through 5.2-7 RCS-to-SG leak 1 gpm FSAR 15.4.4.4, Table 15.4-25A Containment None credited N/A FHA Fuel Cladding Pool water depth elevation FSAR 9.1.3 and support (15.4.5) 153-3 documentation for Amendments 137/129 RCS Pressure Boundary None credited N/A Containment None credited N/A REV 30 10/21

FNP-FSAR-15 TABLE 15.1-6 (SHEET 7 OF 7)

Accident Description (FSAR Section)

Fission Product Barrier Design Basis Limit Reference(s)

RCCA Ejection Fuel Cladding Avg. fuel enthalpy < 200 cal/g FSAR 15.4.6.1.2A, (15.4.6) 3A-1.183 10% fuel rods exceed DNBR FSAR 15.4.6.4.3.A 10% fuel melt FSAR 15.4.6.4.3.C.2 RCS Pressure Boundary RCS stress limits in Tables FSAR 15.4.6.1.2B 5.2-3 through 5.2-7 RCS-to-SG leakage 1 gpm FSAR 15.4.6.4.2A, for all generators Table 15.4-31 Containment Containment leakage FSAR 15.4.6.4.3G 0.15% / day Table 15.4-31 REV 30 10/21

REV 30 10/21 OVEROWER AND OVERTEMPERATURE JOSEPH M. FARLEY NUCLEAR PLANT DELTA-T PROTECTION UNIT 1 AND UNIT 2 FIGURE 15.1-1A

REV 30 10/21 OVERTEMPERATURE DELTA-T SETPOINT JOSEPH M. FARLEY NUCLEAR PLANT F-DELTA-I PENALTY UNIT 1 AND UNIT 2 FIGURE 15.1-1B

REV 21 5/08 ROD POSITION VERSUS TIME JOSEPH M. FARLEY NUCLEAR PLANT ON REACTOR TRIP UNIT 1 AND UNIT 2 FIGURE 15.1-2

REV 21 5/08 NORMALIZED ROD WORTH JOSEPH M. FARLEY NUCLEAR PLANT VERSUS FRACTION INSERTION UNIT 1 AND UNIT 2 FIGURE 15.1-3

REV 21 5/08 NORMALIZED RCCA BANK REACTIVITY JOSEPH M. FARLEY NUCLEAR PLANT WORTH VERSUS TIME AFTER TRIP UNIT 1 AND UNIT 2 FIGURE 15.1-4

REV 30 10/21 DOPPLER POWER COEFFICIENT JOSEPH M. FARLEY NUCLEAR PLANT BOUNDED BY ACCIDENT ANALYSES UNIT 1 AND UNIT 2 FIGURE 15.1-5

REV 21 5/08 JOSEPH M. FARLEY 1979 ANS DECAY HEAT NUCLEAR PLANT UNIT 1 AND UNIT 2 FIGURE 15.1-6

REV 21 5/08 JOSEPH M. FARLEY FUEL ROD CROSS-SECTION NUCLEAR PLANT UNIT 1 AND UNIT 2 FIGURE 15.1-7

FNP-FSAR-15 15.2 CONDITION II - INCIDENTS OF MODERATE FREQUENCY These faults at worst result in reactor shutdown with the plant being capable of returning to operation. By definition, these faults (or events) do not propagate to cause a more serious fault; i.e., a Condition III or IV event. In addition, Condition II events are not expected to result in fuel rod failures or reactor coolant system (RCS) overpressurization. The NRC acceptance criterion for ensuring that Condition II events will not result in fuel rod failures is that the minimum departure from nucleate boiling ratio (DNBR DNBR design limit as described in paragraph 4.4.1.1) satisfies the 95/95 criterion. That is, there is at least a 95-percent probability at a 95-percent confidence level (95/95 probability/confidence) that departure from nucleate boiling (DNB) will not occur on the limiting fuel rod. In addition, there is also a 95/95 probability/confidence that the peak kW/ft fuel rods will not exceed the melting temperature of uranium dioxide refer to section 4.4. The NRC acceptance criterion used to ensure that the reactor coolant pressure boundary integrity is maintained is that the reactor coolant pressure remains below the ASME Section III Code pressure limit (2750 psia). For the purposes of this report, the following faults have been grouped into this category:

A. Uncontrolled rod cluster control assembly (RCCA) bank withdrawal from a subcritical condition.

B. Uncontrolled RCCA bank withdrawal at power.

C. RCCA misalignment.

D. Uncontrolled boron dilution.

E. Partial loss of forced reactor coolant flow.

F. Startup of an inactive reactor coolant loop.

G. Loss of external electrical load and/or turbine trip.

H. Loss of normal feedwater.

I. Loss of all ac power to the station auxiliaries.

J. Excessive heat removal due to feedwater system malfunctions.

K. Excessive load increase.

L. Accidental depressurization of the RCS.

M. Accident depressurization of the main steam system.

N. Inadvertent operation of the emergency core cooling system (ECCS) during power operation.

15.2-1 REV 31 10/23

FNP-FSAR-15 The Farley design incorporates a solid-state reactor protection system (RPS). Reference 1 describes the techniques used to evaluate the reliability of relay protection logic and demonstrates that the likelihood of no trip following initiation of Condition II events is extremely small (2 x 10-7 for random component failures). The solid-state RPS design has been evaluated by the same methods as those used to evaluate the relay protection system design, and the same order of magnitude of reliability has been demonstrated.

The time sequence of events during each Condition II fault is shown in table 15.2-1.

15.2.1 UNCONTROLLED RCCA BANK WITHDRAWAL FROM A SUBCRITICAL CONDITION 15.2.1.1 Identification of Causes and Accident Description A RCCA withdrawal accident is defined as an uncontrolled addition of reactivity to the reactor core caused by withdrawal of RCCAs resulting in a power excursion. Such a transient could be caused by a malfunction of the reactor control or control rod drive systems. This could occur with the reactor either subcritical, at hot zero power, or at power. The at-power case is discussed in subsection 15.2.2.

Although the reactor is normally brought to power from a subcritical condition by means of RCCA withdrawal, initial startup procedures with a clean core call for boron dilution. The maximum rate of reactivity increase in the case of boron dilution is less than that assumed in this analysis (see subsection 15.2.4, Uncontrolled Boron Dilution).

The RCCA drive mechanisms are wired into preselected bank configurations. These circuits prevent the assemblies from being withdrawn in other than their respective banks. Power supplied to the banks is controlled such that no more than two banks can be withdrawn at the same time. The RCCA drive mechanisms are of the magnetic latch type; coil actuation is sequenced to provide variable speed travel. The maximum reactivity insertion rate analyzed in the detailed plant analysis is that occurring with the simultaneous withdrawal of the combination of the two control banks having the maximum combined worth at maximum speed.

The neutron flux response to a continuous reactivity insertion is characterized by a very fast rise terminated by the reactivity feedback effect of the negative Doppler coefficient. This self-limitation of the power burst is of primary importance since it limits the power to a tolerable level during the delay time for protective action. Should a continuous RCCA withdrawal accident occur, the transient will be terminated by the following automatic features of the RPS:

A. Source Range High Neutron Flux Reactor Trip This trip function is automatically actuated when either of two independent source range channels indicates a neutron flux level above a preselected, manually-adjustable setpoint. This trip function may be manually bypassed when either intermediate range flux channel indicates a flux level above a specified level. It is 15.2-2 REV 31 10/23

FNP-FSAR-15 automatically reinstated when both intermediate range channels indicate a flux level below a specified level.

B. Intermediate Range High Neutron Flux Reactor Trip This trip function is automatically actuated when either of two independent intermediate range channels indicates a flux level above a preselected, manually-adjustable setpoint. This trip function may be manually bypassed when two of the four power range channels are reading above approximately 10 percent of full power. It is automatically reinstated when three of the four channels indicate a power level below this value.

C. Power Range High Neutron Flux Reactor Trip (Low Setting)

This trip function is automatically actuated when two of the four power range channels indicate a power level above approximately 25 percent of full power.

This trip function may be manually bypassed when two of the four power range channels indicate a power level above approximately 10 percent of full power. It is automatically reinstated when three of the four channels indicate a power level below this value.

D. Power Range High Neutron Flux Reactor Trip (High Setting)

This trip function is automatically actuated when two of the four power range channels indicate a power level above a preset setpoint. This trip function is always active.

E. High Positive Nuclear Flux Rate Reactor Trip The high nuclear flux rate reactor trip is actuated when the positive rate of change of neutron flux on two-out-of-four nuclear power range channels indicates a rate above the preset setpoint. This trip function is always active.

In addition, control rod stops on a high intermediate range flux level (one of two) and a high power range flux level (one of four) serve to discontinue rod withdrawal and prevent the need to actuate the intermediate range flux level trip and the power range flux level trip, respectively.

15.2.1.2 Analysis of Effects and Consequences 15.2.1.2.1 Method of Analysis The analysis of the uncontrolled RCCA bank withdrawal from subcritical accident is performed in three stages: First a spatial neutron kinetics computer code, TWINKLE (reference 2), is used to calculate the core average nuclear power transient, including the various core feedback effects, i.e., Doppler and moderator reactivity. FACTRAN (reference 3) uses the average nuclear power calculated by TWINKLE and performs a fuel rod transient heat transfer calculation to determine the average heat flux and temperature transients. Finally, the average heat flux calculated by FACTRAN is used in VIPRE for transient DNBR calculations.

15.2-3 REV 31 10/23

FNP-FSAR-15 In order to give conservative results for a startup accident, the following assumptions are made.

A. Since the magnitude of the power peak reached during the initial part of the transient for any given rate of reactivity insertion is strongly dependent on the Doppler power reactivity coefficient, a conservatively low (absolute magnitude) value for the Doppler power defect is used (960 pcm). (Note: Although this value of Doppler power defect is larger than that given in figure 15.1-5, it is still a conservatively low value for the Farley units.)

B. The contribution of the moderator reactivity coefficient is negligible during the initial part of the transient because the heat transfer time constant between the fuel and the moderator is much larger than the neutron flux response time constant.

However, after the initial neutron flux peak, the succeeding rate of power increase is affected by the moderator reactivity coefficient. The analysis assumes a moderator temperature coefficient which is +7 pcm/°F at the zero power nominal temperature.

C. The reactor is assumed to be at hot zero power. This assumption is more conservative than that of a lower initial system temperature. The higher initial system temperature yields a larger fuel-water heat transfer coefficient, a larger initial fuel and water stored energy, and a less negative (smaller absolute magnitude) Doppler coefficient. The less negative Doppler coefficient reduces the Doppler feedback effect, thereby increasing the nuclear flux peak. The high neutron flux peak combined with a high fuel specific heat and larger heat transfer coefficient yields a larger peak heat flux. The initial effective multiplication factor is assumed to be 1.0 since this results in the maximum nuclear power peak.

D. Reactor trip is assumed to be initiated by power range high neutron flux (low setting). The most adverse combination of instrument and setpoint errors, as well as delays for trip signal actuation and RCCA release, is taken into account.

A 10-percent increase is assumed for the power range flux trip setpoint, raising it from the nominal value of 25 percent to 35 percent; no credit is taken for the source and intermediate range protection. Figure 15.2-1 shows that the rise in nuclear flux is so rapid that the effect of error in the trip setpoint on the actual time at which the rods release is negligible. In addition, the total reactor trip reactivity is based on the assumption that the highest worth RCCA is stuck in its fully withdrawn position. (See subsection 15.1.5 for RCCA insertion characteristics.)

E. The maximum positive reactivity insertion rate assumed is greater than that for the simultaneous withdrawal of the two sequential control banks having the greatest combined worth at a conservative speed (45 in./min, which corresponds to 72 steps/min).

F. The DNB analysis assumes the most limiting axial and radial power shapes possible during the fuel cycle associated with having the two highest combined worth banks in their high worth position.

15.2-4 REV 31 10/23

FNP-FSAR-15 G. The analysis assumes the initial power level to be below the power level expected for any shutdown condition (10-9 fraction of nominal power). The combination of highest reactivity insertion rate and low initial power produces the highest peak heat flux.

H. The analysis assumes two reactor coolant pumps (RCPs) to be in operation (Mode 3 Technical Specification allowed operation). This is conservative with respect to the DNB transient.

I. The accident analysis employs the Standard Thermal Design Procedure (STDP) methodology. The use of STDP stipulates that the RCS flowrates will be based on a fraction of the thermal design flow for two RCPs operating and that the RCS pressure is 50 psi below nominal. Since the event is analyzed from hot zero power, the steady-state non-RTDP uncertainties on core power and RCS average temperature are not considered in defining the initial conditions.

15.2.1.2.2 Results Figures 15.2-1 through 15.2-3 show the transient behavior for the indicated reactivity insertion rate with the accident terminated by reactor trip at 35-percent nominal power. This insertion rate is greater than that for the two highest worth control banks, both assumed to be in their highest incremental worth region.

Figure 15.2-1 shows the neutron flux transient. The neutron flux overshoots the full-power nominal value but this occurs for only a very short time period. Hence, the energy release and the fuel temperature increases are relatively small. The thermal flux response, of interest for DNB considerations, is shown in figure 15.2-2. The beneficial effect on the inherent thermal lag in the fuel is evidenced by a peak heat flux less than the full-power nominal value. Figure 15.2-3 shows the response of the hot spot average fuel and clad inner temperatures. The hot spot average fuel temperature increases to a value lower than the nominal full-power value. The analysis demonstrates that the DNB design basis is met.

15.2.1.3 Conclusions In the event of an RCCA withdrawal accident from the subcritical condition, the core and the RCS are not adversely affected since the combination of thermal power and coolant temperature continue to meet the DNB design basis. Thus, no fuel or clad damage is predicted as a result of this transient.

Note that this event was evaluated for the increased power level associated with the measurement uncertainty recapture (MUR) power uprate. The evaluation also considered the effects of fuel thermal conductivity degradation with burnup consistent with the PAD5 fuel performance code (Reference 17). The aforementioned conclusions remain valid.

15.2-5 REV 31 10/23

FNP-FSAR-15 15.2.2 UNCONTROLLED RCCA BANK WITHDRAWAL AT POWER 15.2.2.1 Identification of Causes and Accident Description Uncontrolled RCCA bank withdrawal at power results in an increase in the core heat flux. Since the heat extraction from the steam generator lags behind the core power generation until the steam generator pressure reaches the relief or safety valve setpoint, there is a net increase in the reactor coolant temperature. Unless terminated by manual or automatic action, the power mismatch and resultant coolant temperature rise would eventually result in fuel cladding damage and/or RCS overpressurization. Therefore, in order to avert damage to the fuel and/or fuel cladding, the RPS is designed to terminate any such transient before the DNBR falls below the limit value or the allowable fuel linear heat generation rate is exceeded. The RPS and pressurizer safety valves are designed to preclude the RCS pressure boundary safety limit.

The automatic features of the RPS which prevent core damage and preclude RCS overpressurization during the postulated accident include the following:

A. Power range neutron flux instrumentation actuates a reactor trip if two of four channels exceed an overpower setpoint. (This trip is credited for the reactor core protection and RCS overpressure analyses.)

B. Reactor trip is actuated if any two of three T channels exceed an overtemperature T (OTT) setpoint. This setpoint is automatically varied with axial power imbalance, coolant temperature, and pressure to protect against DNB.

C. Reactor trip is actuated if any two of three T channels exceed an overpower T (OPT) setpoint. This setpoint is automatically varied with coolant average temperature to ensure that the allowable fuel linear heat generation rate is not exceeded.

D. A high-pressurizer pressure reactor trip is actuated from any two of three pressure channels set at a fixed point. This set pressure is less than the set pressure for the PSVs.

E. A high-pressurizer water level reactor trip is actuated from any two of three level channels set at a fixed point.

F. Power range neutron flux instrumentation actuates a reactor trip if two of four channels exceed a specified positive flux rate setpoint. (This trip is credited in the RCS overpressure analyses. It is not credited in the reactor core protection analyses.)

In addition to the above listed reactor trips, there are the following RCCA withdrawal blocks:

A. High neutron flux (one of four).

15.2-6 REV 31 10/23

FNP-FSAR-15 B. OPT (two of three).

C. OTT (two of three).

The manner in which the combination of OPT and OTT trips provide protection over the full range of RCS conditions is described in chapter 7. This description is illustrated by figures 15.1-1A and 15.1-1B, which present the OPT and OTT safety analysis limits for the combination of allowable reactor coolant loop average temperatures and Ts for the design power distribution and flow. The OTT safety analysis limits are also varied as a function of primary coolant pressure. The boundaries of operation defined by the OPT trip and the OTT trip are represented as "protection lines" on this diagram. The protection lines are drawn to include all adverse instrumentation and setpoint errors so that under nominal conditions, trip would occur well within the area bounded by these lines. The utility of this diagram is in the fact that the limit imposed by any given DNBR can be represented as a line. The DNB lines represent the locus of conditions for which the DNBR equals the safety analysis limit value. All points below and to the left of a DNB line for a given pressure have a DNBR greater than the limit. The diagram shows that DNB is prevented for all cases if the area enclosed with the maximum protection lines is not traversed by the applicable DNBR line at any point.

The area of permissible operation (power, pressure, and temperature) is bound by the combination of reactor trips: high neutron flux (fixed setpoint), high pressure (fixed setpoint), low pressure (fixed setpoint), OPT and OTT (variable setpoints).

The pressurizer safety valves are required to provide overpressure protection. The pressurizer safety valves, which have water filled loop seals, open to allow steam relief and thus RCS pressure relief when the pressurizer pressure exceeds the respective lift setpoint for each pressurizer safety valve. The main steam safety valves open to allow secondary pressure relief, thus increasing the heat removal capability of the secondary side when the steam generator pressure exceeds the respective lift setpoint for each main steam safety valve.

15.2.2.2 Analysis of Effects and Consequences 15.2.2.2.1 Method of Analysis The reactor core protection and RCS overpressure transients are analyzed by the LOFTRAN(4) code. This code simulates the neutron kinetics, RCS, pressurizer, pressurizer relief and safety valves, pressurizer spray, steam generator, and steam generator safety valves. The code computes pertinent plant variables, including temperatures, pressures, and power level. The core limits, as illustrated in figures 15.1-1A and 15.1-1B, are used as input to LOFTRAN to conservatively estimate the minimum DNBR during the transient. For the most limiting DNB cases, analysis statepoints were generated by LOFTRAN as input to the VIPRE computer code (Reference 16) for the DNB calculations.

15.2-7 REV 31 10/23

FNP-FSAR-15 The following assumptions are made for the DNB analysis in order to obtain conservative values of DNBR.

A. This accident is analyzed with the RTDP as described in WCAP-11397-P-A (reference 5). Therefore, initial reactor power, pressure, and RCS temperatures are assumed to be at their nominal values. Uncertainties in initial conditions are included in the limit DNBR as described in reference 5.

B. For reactivity coefficients, two cases are analyzed, reflecting minimum or maximum feedback conditions, that are described in table 15.1-2A.

C. The reactor trip on high neutron flux is assumed to be actuated at a conservative value as defined in table 15.1-3. The T trips include all adverse instrumentation and setpoint errors, while the delays for the trip signal actuation are assumed at their maximum values.

D. The RCCA trip insertion characteristic is based on the assumption that the highest worth RCCA is stuck in its fully withdrawn position.

E. The maximum reactivity insertion rate is greater than that for the simultaneous withdrawal of the combination of the two control banks having the maximum combined worth at a conservative speed (45 in./min, which corresponds to 72 steps/min).

F. The impact of a full power RCS Tavg window was considered for the uncontrolled RCCA bank withdrawal at power analysis. The maximum Tavg value, which is limiting with respect to the calculated minimum DNBR.

G. Consistent with the PAD5 fuel performance code (Reference 17), the effects of fuel thermal conductivity degradation with burnup are conservatively accounted for in the analysis.

The effect of RCCA movement on the axial core power distribution is accounted for by causing a decrease in the overtemperature trip setpoint proportional to a decrease in margin to DNB (see figure 15.1-1B).

For the RCS overpressure transient, a conservative analysis was performed to demonstrate that the RCS overpressure safety limit will not be exceeded for an uncontrolled rod withdrawal during power operation (reference 15). A range of initial reactor power levels were analyzed from 8% to 102% of the pre-MUR NSSS power (i.e., up to 2840.7 MWt): this range bounds the actual MUR uprated NSSS power level. In addition, consistent with the PAD5 fuel performance code (Reference 17), the effects of fuel thermal conductivity degradation with burnup have been shown to have an insignificant impact on the peak pressure results as presented. The following assumptions are made in order to obtain conservative values of RCS pressure:

15.2-8 REV 31 10/23

FNP-FSAR-15 A. This accident is analyzed using the STDP. Therefore, initial power, pressure, and RCS temperatures are assumed to be within their respective allowable operating ranges with uncertainties applied in the conservative directions.

B. A range of initial reactor power levels are analyzed.

C. A range of reactivity insertion rates (from 15 pcm/s to 110 pcm/s) are analyzed.

The largest reactivity insertion rate considered (110 pcm/s) is greater than that for the simultaneous withdrawal of the combination of the two control banks having the maximum combined worth at a conservative speed (45 in./min, which corresponds to 72 steps/min).

D. Minimum reactivity feedback conditions are modeled as described in table 15.1-2A.

E. Reactor trips on high neutron flux, high pressurizer pressure, and power range high positive neutron flux rate are assumed to be actuated at conservative values which are defined in table 15.1-3.

F. Pressurizer heaters are conservatively modeled with setpoints appropriately modified based on the initial pressurizer pressure modeled. Pressurizer sprays are not modeled as the operation of the pressurizer spray valves is nonconservative for the overpressure transient.

G. Pressurizer safety valves are modeled with an opening delay to account for water-filled loop seals and the opening setpoint as the design pressure plus a set pressure shift. Pressurizer power operated relief valves are not modeled as their operation is nonconservative for the overpressure transient.

H. The main steam safety valves are modeled with bounding opening pressures in order to conservatively prolong the mismatch between core heat generation and secondary heat removal capability.

15.2.2.2.2 Results DNB Case:

Figures 15.2-4 and 15.2-5 show the transient response for a rapid RCCA bank withdrawal incident starting from full power with minimum feedback. Reactor trip on high neutron flux occurs shortly after the start of the accident. Because of the rapid reactor trip with respect to the thermal time constants of the plant, small changes in Tavg and pressure result, and margin to DNB is maintained.

The transient response for a slow RCCA bank withdrawal from full power with minimum feedback is shown on figures 15.2-6 and 15.2-7. Reactor trip on OTT occurs after a longer 15.2-9 REV 31 10/23

FNP-FSAR-15 period and the rise in temperature and pressure is consequently larger than for rapid RCCA bank withdrawal. Again, the minimum DNBR is greater than the limit value.

Figure 15.2-8 shows the minimum DNBR as a function of reactivity insertion rate from initial full-power operation for both minimum and maximum reactivity feedback. It can be seen that the high neutron flux and OTT reactor trip functions provide DNB protection over the range of reactivity insertion rates considered. The DNB design basis is met for all cases. Figures 15.2-9 and 15.2-10 show the minimum DNBR as a function of reactivity insertion rate for RCCA bank withdrawal incidents starting at 60-percent and 10-percent power, respectively. The results are similar to the 100-percent power case; however, as the initial power level decreases, the range over which the OTT trip is effective is increased. The calculated sequence of events for the DNB cases are shown on table 15.2-1.

Overpressure Case:

The results of the overpressure analysis demonstrated that protection against overpressure was maintained for all analyzed conditions. The MUR uprate conditions thermal conductivity degradation with burnup were evaluated and demonstrate an insignificant impact on the results and conclusions of the overpressure analysis are presented here. The calculated sequence of events for the overpressure analysis is shown in table 15.2-1. The transient response for the most limiting set of conditions is shown on figures 15.2-7A and 15.2-7B. Protection for the most limiting case is provided by the high pressurizer pressure reactor trip function, which occurs shortly after the start of the accident.

Figure 15.2-10A shows the peak RCS pressure as a function of reactivity insertion rate and initial power levels. Figure 15.2-10B illustrates the effect of reactivity insertion rate and initial power level on the RPS trip function. It can be seen that the high pressurizer pressure, high neutron flux, and power range high positive neutron flux rate trip functions provide RCS overpressure protection over the range of conditions considered. The peak RCS pressure is never greater than the overpressure safety limit value.

With the reactor tripped, the plant eventually returns to a stable condition. The plant may subsequently be cooled down further by following normal plant shutdown procedures.

15.2.2.3 Conclusions The high neutron flux and OTT trip channels provide adequate protection over the entire range of possible reactivity insertion rates; i.e., the analysis demonstrates that the DNB design basis is met. Thus, there will be no cladding damage and no release of fission products to the RCS.

For overpressure cases, the high pressurizer pressure, high neutron flux, and power range high positive neutron flux rate trip functions along with the pressurizer safety valves and steam generator safety valves provide adequate protection over the entire range of possible reactivity insertion rates and initial conditions analyzed; i.e., the analysis demonstrates that the integrity of the RCS pressure boundary is maintained as the maximum transient pressure does not exceed the RCS pressure boundary safety limit.

15.2-10 REV 31 10/23

FNP-FSAR-15 15.2.3 RCCA MISALIGNMENT 15.2.3.1 Identification of Causes and Accident Description RCCA misalignment accidents include:

A. One or more dropped full-length assemblies.

B. A dropped full-length assembly bank.

C. A statically misaligned full-length assembly.

Each RCCA has a position indicator channel which displays the position of the assembly. The displays of assembly positions are grouped for the operator's convenience. Fully inserted assemblies are further indicated by a rod bottom signal which actuates a local alarm and a control room annunciator. Group demand position is also indicated. RCCAs move in preselected banks, and the banks always move in the same preselected sequence. Each bank of RCCAs consists of two groups. The rods comprising a group operate in parallel through multiplexing thyristors. The two groups in a bank move sequentially such that the first group is always within one step of the second group in the bank. A definite schedule of actuation (or deactuation) of the stationary gripper, movable gripper, and lift coils of the control rod drive mechanism withdraws the RCCA held by the mechanism. Mechanical failures are in the direction of insertion or immobility.

A dropped assembly or assembly banks may be detected by:

A. A sudden drop in the core power level as seen by the nuclear instrumentation system.

B. An asymmetric power distribution as seen on out-of-core neutron detectors.

C. Rod bottom signal.

D. A rod deviation alarm.

E. A rod position indication.

Misaligned assemblies may be detected by:

1. An asymmetric power distribution as seen on out-of-core neutron detectors.

2. A rod deviation alarm.

3. Rod position indicators.

15.2-11 REV 31 10/23

FNP-FSAR-15 The deviation alarm alerts the operator to rod deviation with respect to group demand position in excess of 5 percent of span. If the rod deviation alarm is not operable, the operator is required to log the RCCA positions in a prescribed time sequence to confirm alignment.

If one or more rod position indicator channels should be out of service, detailed operating instructions shall be followed to ensure the alignment of the nonindicated assemblies.

15.2.3.2 Analysis of Effects and Consequences 15.2.3.2.1 Method of Analysis A. One or More Dropped RCCAs From the Same Group The LOFTRAN computer code (reference 4) calculates the transient system response for the evaluation of the dropped RCCA event. The code simulates the neutron kinetics, RCS, pressurizer, pressurizer relief and safety valves, pressurizer spray, steam generators, and steam generator safety valves. The code computes pertinent plant variables including temperatures, pressures, and power level.

Transient reactor statepoints (temperature, pressure, and power) are calculated by LOFTRAN, and nuclear models are used to obtain a hot channel factor consistent with the primary system conditions and reactor power. By incorporating the primary conditions from the transient analysis and the hot channel factor from the nuclear analysis, the DNB design basis is shown to be met using the VIPRE code.

The transient response analysis, nuclear peaking factor analysis, and performance of the DNB design basis confirmation are performed in accordance with the methodology described in reference 7.

B. Dropped RCCA Bank A dropped RCCA bank results in a symmetric power change in the core. As discussed in reference 7, assumptions made for the dropped RCCA(s) analysis provide a bounding analysis for the dropped RCCA bank.

C. Statically Misaligned RCCA Steady-state power distributions are analyzed using appropriate nuclear physics computer codes. The analysis examines the case of the worst rod withdrawn from bank D inserted at the insertion limit with the reactor initially at full power. The analysis assumes this incident to occur at BOL since this results in the minimum value of the moderator temperature coefficient (least negative). This assumption maximizes the power rise and minimizes the tendency of the large moderator temperature coefficient (most negative) to flatten the power distribution.

The VIPRE code is used to confirm that the DNB design basis is met for the peaking factors associated with the statically misaligned RCCA.

15.2-12 REV 31 10/23

FNP-FSAR-15 15.2.3.2.2 Results A. One or More Dropped RCCAs Single or multiple dropped RCCAs within the same group result in a negative reactivity insertion. The core is not adversely affected during this period since power is decreasing rapidly. Either reactivity feedback or control bank withdrawal will reestablish power.

Following a dropped rod event in manual rod control, the plant will establish a new equilibrium condition. Without control system interaction, a new equilibrium is achieved at a reduced power level and reduced primary temperature. Thus, the automatic rod control mode of operation is the limiting case.

For a dropped RCCA event in the automatic rod control mode, the rod control system detects the drop in power and initiates control bank withdrawal. Power overshoot may occur due to this action by the automatic rod controller, after which the control system will insert the control bank to restore program conditions.

Figure 15.2-11 shows a typical transient response to a dropped RCCA (or RCCAs) in the automatic rod control mode. In all cases, the DNB design basis is met.

Following plant stabilization, the operator may manually retrieve the RCCA by following approved operating procedures.

B. Dropped RCCA Bank A dropped RCCA bank results in a negative reactivity insertion greater than 500 pcm. The core is not adversely affected during the insertion period since power is decreasing rapidly. The transient will proceed as described in part A; however, the return to power will be less due to the greater worth of the entire bank. The power transient for a dropped RCCA bank is symmetric. Following plant stabilization, normal procedures are followed.

C. Statically Misaligned RCCA The most severe misalignment situations with respect to DNBR at significant power levels arise from cases in which one RCCA is fully inserted or where bank D is fully inserted with one RCCA fully withdrawn. Multiple independent alarms, including a bank insertion limit alarm, alert the operator well before the transient approaches the postulated conditions.

The insertion limits in the Core Operating Limits Report may vary from time to time depending on several limiting criteria. The full-power insertion limits on control bank D must be chosen to be above that position which meets the minimum DNBR and peaking factors. The full-power insertion limit is usually dictated by other 15.2-13 REV 31 10/23

FNP-FSAR-15 criteria. Detailed results will vary from cycle to cycle depending on fuel arrangement.

The DNB design basis is met for the RCCA misalignment with bank D inserted to its full-power insertion limit and one RCCA fully withdrawn. The analysis of this case assumes that the initial reactor power, pressure, and RCS temperature are at the nominal values, with the increased radial peaking factor associated with the misaligned RCCA.

The DNB design basis is met for the RCCA misalignment with one RCCA fully inserted. The analysis of this case assumes that initial reactor power, pressure, and RCS temperatures are at the nominal values, with the increased radial peaking factor associated with the misaligned RCCA.

DNB does not occur for the RCCA misalignment incident; thus, there is no reduction in the ability of the primary coolant to remove heat from the fuel rod. The peak fuel temperature corresponds to a linear heat generation rate based on the radial peaking factor penalty associated with the misaligned RCCA and the design axial power distribution. The resulting linear heat generation rate is well below that which would cause fuel melting.

After identifying an RCCA group misalignment condition, the operator must take action as required by the plant Technical Specifications and operating instructions.

15.2.3.3 Conclusions The DNB design basis is met for cases of dropped RCCAs or dropped banks. For all cases of any RCCA fully inserted, or bank D inserted to its rod insertion limits with any single RCCA in that bank fully withdrawn (static misalignment), the DNB design basis is met.

Note that this event was evaluated for the increased power level associated with the measurement uncertainty recapture (MUR) power uprate. The evaluation also considered the effects of fuel thermal conductivity degradation with burnup consistent with the PAD5 fuel performance code (Reference 17). The aforementioned conclusions remain valid.

15.2.4 UNCONTROLLED BORON DILUTION 15.2.4.1 Identification of Causes and Accident Description Reactivity can be added to the core by feeding primary grade water into the RCS via the reactor makeup portion of the chemical and volume control system (CVCS). Boron dilution is a manual operation under strict administrative controls with operating procedures limiting the total amount of dilution allowed. A boric acid blend system is provided to permit the operator to match the boron concentration of reactor coolant makeup water during normal charging to that in the RCS.

The CVCS is designed to limit, even under various postulated failure modes, the potential rate 15.2-14 REV 31 10/23

FNP-FSAR-15 of dilution to a value which, after indication through alarms and instrumentation, provides the operator sufficient time to correct the situation in a safe and orderly manner.

The opening of the primary water makeup control valve provides makeup to the RCS which can dilute the reactor coolant.

Inadvertent dilution from this source can be readily terminated by closing the control valve. In order for makeup water to be added to the RCS at pressure, at least one charging pump must be running in addition to a primary makeup water pump. The rate of addition of unborated makeup water to the RCS when it is not at pressure is limited by the capacity of the primary water makeup pumps. The maximum addition rate in this case is 300 gal/min with both pumps running. The 300 gal/min reactor makeup water delivery rate is based on a pressure drop calculation comparing the pump curves with the system resistance curve. This is maximum delivery based on the unit piping layout. Normally, only one primary water supply pump is operating.

The boric acid from the boric acid tank is blended with primary grade water in the blender and the composition is determined by the preset flowrates of boric acid and primary grade water on the control board.

With the exception of dilution by chemical addition, two separate operations are required in order to dilute the RCS. The operator must switch from the automatic makeup mode to the dilute mode, and the start button must be depressed. Omitting either step would prevent dilution. Dilution by chemical addition does not affect the maximum dilution rates assumed for this accident.

Information on the status of the reactor coolant makeup is continuously available to the operator. Lights are provided on the control board to indicate the operating condition of the pumps in the CVCS. Alarms are actuated to warn the operator if boric acid or makeup water flowrates deviate from preset values as a result of system malfunction. The signals initiating these alarms will also cause the closure of control valves terminating the addition to the RCS.

15.2.4.2 Analysis of Effects and Consequences 15.2.4.2.1 Method of Analysis Plant operation during refueling, cold and hot shutdown, startup, and power operation are considered in this analysis. Table 15.2-1 contains the time sequence of events for this accident.

Table 15.2-2 presents results of the boron dilution analysis for power, startup, and refueling operations. Also included in this table are pertinent analysis assumptions. Perfect mixing is assumed in the analysis. This assumption results in a conservative rate of RCS boron dilution.

15.2.4.2.2 Dilution During Refueling During refueling, the following assumptions are made:

15.2-15 REV 31 10/23

FNP-FSAR-15 A. One residual heat removal (RHR) pump is operating to ensure continuous mixing in the reactor vessel.

B. The seal injection water supply to the reactor coolant pumps is isolated.

C. The valves on the suction side of the charging pumps are adjusted for addition of concentrated boric acid solution.

D. The boron concentration in the refueling water is approximately 2200 ppm(a),

corresponding to a shutdown margin of at least 5-percent k with all RCCAs in; periodic sampling ensures that this concentration is maintained.

E. The source range detectors outside the reactor vessel are active and provide an audible count rate.

A minimum water volume of 3285 ft3 in the RCS is considered. This corresponds to the volume necessary to fill the reactor vessel above the nozzles to ensure mixing via the RHR loop. A maximum dilution flow of 300 gal/min, limited by the capacity of the two primary water makeup pumps, and uniform mixing are assumed.

The operator has prompt and definite indication of any boron dilution from the audible count rate instrumentation. High count rate is alarmed in the reactor containment. In addition, a high source range flux level is alarmed in the control room. The count rate increase is proportional to the subcritical multiplication factor.

For dilution during refueling, the boron concentration must be reduced from greater than 2200 ppm(a) to approximately 1750 ppm before the reactor will go critical. This would take at least 18 min. Within this time, the operator must recognize the high count rate signal and isolate the primary water makeup source by closing any one of several valves and stopping the reactor makeup water pumps.

The safety analyses for the refueling (Mode 6) uncontrolled boron dilution event use very conservative initial (2200 ppm) and critical (1750 ppm) boron concentrations, and assume all rods (control and shutdown) are inserted, to determine a limiting time for operator action to terminate an uncontrolled boron dilution event. The higher (i.e., greater than the Mode 6 limit) initial boron concentration assumed in the safety analyses results in a faster dilution of the boron in the RCS, compared to lower (such as those associated with the Mode 6 limit contained in the COLRs) boron concentrations, for a given dilution flowrate and active RCS volume. Thus, the lower Technical Specification values contained in the COLR for the Mode 6 boron concentration associated with maintaining a keff of 0.95 as discussed above, are bounded by the conservative assumptions made for the Mode 6 uncontrolled boron dilution analyses presented in FSAR paragraph 15.2.4.2.2.

The Mode 6 boron dilution accident described above assumes a maximum unborated water flow of 300 gal/min from the primary water makeup pumps. Isolation of the unborated water source 15.2-16 REV 31 10/23

FNP-FSAR-15 from the RCS will preclude the analyzed accident described above. The isolation of the unborated water source to prevent a boron dilution is consistent with Required Action C.1 of

a. The minimum refueling water storage tank (RWST) boron concentration is 2300 ppm. The 2200-ppm value bounds the case of an initial boron concentration of 2300 ppm (see table 15.2-2).

Technical Specification 3.9.2, Nuclear Instrumentation, which is applicable for the condition where the audible count rate is not available. Required Action C.1 specifies that the unborated water sources be isolated. The Bases for this Required Action explain that this action will ensure an inadvertent dilution of the RCS is prevented.

15.2.4.2.3 Dilution During Shutdown A plant-specific evaluation of the boron dilution event during plant shutdown (hot and cold) was performed. This evaluation is based upon the operating procedure outlined in reference 8. The operating procedure is based upon a generic boron dilution analysis assuming active RCS and RHR volumes which are conservative with respect to the Farley units. Additionally, the operating procedure accommodates mid-loop cold shutdown operation. The operating procedure is applicable for maximum dilution flowrates up to 300 gal/min and minimum RHR flowrates of 1000 gal/min. Current plant procedures require one reactor makeup water pump to be secured when no reactor coolant pumps are running, limiting the maximum dilution flowrate to 150 gal/min. In the event of a boron dilution accident during plant shutdown, use of the operating procedure provides the plant operator with sufficient information to maintain an appropriate boron concentration to conservatively assure at least 15 min will be available for operator action to terminate the dilution prior to the reactor reaching a critical condition.

15.2.4.2.4 Dilution During Startup In this mode, the plant is being taken from one long-term mode of operation, hot standby, to another, power. Typically, the plant is maintained in the startup mode only for the purpose of startup testing at the beginning of each cycle. During this mode of operation, rod control is in manual. All normal actions required to change power level, either up or down, require operator initiation. Conditions assumed for the analysis are as follows:

A. The dilution flow is the maximum capacity of the two primary water makeup pumps, 300 gal/min.

B. A minimum RCS water volume of 7706 ft3, corresponding to the active RCS volume minus the pressurizer and surge line.

C. An initial boron concentration of 2100 ppm (see table 15.2-2), corresponding to a critical hot zero power condition, rods to insertion limits, and no xenon.

15.2-17 REV 31 10/23

FNP-FSAR-15 D. A critical boron concentration of 1800 ppm following reactor trip. This represents the maximum boron concentration at which the core can obtain critical conditions with all control rods inserted (less the most-reactive RCCA stuck out of the core),

at hot zero power conditions. The 300-ppm change from the initial condition noted above is a conservative minimum value.

The startup mode of operation is a transitory operational mode in which the operator intentionally dilutes and withdraws control rods to take the plant critical. During this mode, the plant is in manual control with the operator required to maintain a high awareness of the plant status. For a normal approach to criticality, the operator must manually initiate a limited dilution and subsequently manually withdraw the control rods, a process that takes several hours. The Technical Specifications require that the operator determine the estimated critical position of the control rods prior to approaching critically, thus ensuring that the reactor does not go critical with the control rods below the insertion limits. Once critical, the power escalation must be sufficiently slow to allow the operator to manually block the source range reactor trip after receiving P-6 from the intermediate range (nominally at 105 cps). Too fast of a power escalation (due to an unknown dilution) would result in reaching P-6 unexpectedly, leaving insufficient time to manually block the source range reactor trip, and the reactor would immediately shut down.

However, in the event of an unplanned approach to criticality or dilution during power escalation while in the startup mode, the plant status is such that minimal impact will result. The plant will slowly escalate in power until the power range high neutron flux low setpoint is reached and a reactor trip occurs. From the time of reactor trip, a time period > 15 min is available for operator action prior to return to criticality. (See table 15.2-2.)

15.2.4.2.5 Dilution at Power In this mode, the plant may be operated in either automatic or manual rod control. Conditions assumed for this analysis are the following:

A. With the units at power and the RCS at pressure, the dilution rate is limited by the capacity of the charging flow control valve. Although only one charging pump is normally in operation, the analysis is performed assuming the dilution flow is the maximum capacity of two charging pumps at power operation conditions.

Although the dilution flowrate is less, a conservatively large dilution flowrate of 300 gal/min. is assumed in this analysis. This flowrate is the maximum deliverable dilution flowrate and can be assumed to include seal injection water.

B. A minimum RCS water volume of 7706 ft3, corresponding to the active RCS volume minus the pressurizer.

C. An initial boron concentration of 2100 ppm, corresponding to a critical hot full-power condition, with the rods at their insertion limits.

D. A critical boron concentration of 1800 ppm following reactor trip. This represents the maximum boron concentration at which the core can obtain critical conditions at hot zero power conditions with all control rods inserted (less the most reactive 15.2-18 REV 31 10/23

FNP-FSAR-15 RCCA stuck out of the core). No credit is taken for xenon. The 300-ppm change from the initial condition noted above is a conservative minimum value.

With the reactor in automatic rod control, the power and temperature increase from the boron dilution results in insertion of the control rods and a decrease in available shutdown margin.

The rod insertion limit alarms (low and low-low settings) alert the operator at least 15 min. prior to criticality. (See table 15.2-2.) This is sufficient time to determine the cause of dilution, isolate the reactor makeup source, and initiate boration before the available shutdown margin is lost.

With the reactor in manual control, a rod stop alarm is initiated 3 percent below the OTT reactor trip setpoint, which would alert the operator. If no operator action is taken, however, the power and temperature rise will cause the reactor to reach the OTT trip setpoint resulting in a reactor trip. The boron dilution transient in this case is essentially the equivalent to an uncontrolled RCCA bank withdrawal at power. The maximum reactivity insertion rate for a boron dilution is within the range of insertion rates analyzed. Thus, the effects of dilution prior to reactor trip are bounded by the uncontrolled RCCA bank withdrawal at power analysis (FSAR subsection 15.2.2). Following reactor trip, there are greater than 15 min. prior to criticality. (See table 15.2-2.) This is sufficient time for the operator to determine the cause of dilution, isolate the reactor water makeup source, and initiate boration before the available shutdown margin is lost.

15.2.4.3 Conclusions Because of the procedures involved in the dilution process, an erroneous dilution is considered incredible. Nevertheless, if an unintentional dilution of boron in the reactor coolant does occur, numerous alarms and indications are available to alert the operator to the conditions. The maximum reactivity addition due to the dilution is slow enough to allow the operator sufficient time to determine the cause of the addition and take corrective action before shutdown margin is lost.

15.2.5 PARTIAL LOSS OF FORCED REACTOR COOLANT FLOW 15.2.5.1 Identification of Causes and Accident Description A partial loss-of-coolant flow accident can result from a mechanical or electrical failure in a RCP, or from a fault in the power supply to the pump. If the reactor is at power at the time of the accident, the immediate effect of loss-of-coolant flow is a rapid increase in the coolant temperature. This increase could result in DNB with subsequent fuel damage if the reactor is not tripped promptly.

Normal power for the RCPs is supplied through separate buses from a transformer connected to the generator. When a generator trip occurs, the buses are automatically transferred to a transformer supplied from external power lines so that the pumps will continue to provide forced coolant flow to the core. Following any turbine trip where there are no electrical faults which 15.2-19 REV 31 10/23

FNP-FSAR-15 require tripping the generator from the network, the generator remains connected to the network for approximately 30 s after reactor trip before any transfer is made. Since each pump is on a separate bus, a single bus fault will not result in the loss of more than one pump. The simultaneous loss of power to all the RCPs (subsection 15.3.4) is a highly unlikely event.

The necessary protection against a partial loss-of-coolant flow accident is provided by the low primary coolant flow reactor trip which is actuated by two of three low flow signals in any reactor coolant loop. Above the P-8 setpoint (see table 7.2-2), low flow in any loop will actuate a reactor trip. Between approximately 10% power (P-7 setpoint) and the P-8 setpoint, low flow in any two loops will actuate a reactor trip. Reactor trip on low flow is blocked below P-7.

A reactor trip signal from OPDT and OTDT provide backup protection to the low flow signal.

15.2.5.2 Analysis of Effects and Consequences 15.2.5.2.1 Method of Analysis A loss of one pump with three loops operating has been analyzed. The lost pump is assumed to be coasting down.

This transient is analyzed by two digital computer codes. First, the LOFTRAN(4) code is used to calculate the loop and core flow during the transient, the time of reactor trip based on the flows, the primary system pressure and temperature transients, and the nuclear power transient following reactor trip. Next, the VIPRE(16) code is used to calculate the heat flux transient and the minimum DNBR during the transient based on the nuclear power and flow from LOFTRAN.

The DNBR transients presented represent the minimum of the typical or thimble cell.

Also consistent with the PAD5 fuel performance code (Reference 17), the effects of fuel thermal conductivity degradation with burnup are conservatively accounted for in the analysis.

15.2.5.2.2 Initial Conditions The accident is analyzed using the RTDP. Initial core power, reactor coolant temperature, and pressure are assumed to be at their nominal values consistent with steady-state full-power operation. Uncertainties in initial conditions are included in the limit DNBR as described in WCAP-11397 (reference 5).

15.2.5.2.3 Reactivity Coefficients A conservatively large absolute value of the Doppler-only power coefficient is used. The total integrated Doppler reactivity from 0- to 100-percent power is assumed to be -0.016 k.

15.2-20 REV 31 10/23

FNP-FSAR-15 A conservative moderator temperature coefficient (0 pcm/°F) is assumed since this results in the maximum core power and hotspot heat flux during the initial part of the transient when the minimum DNBR is reached.

15.2.5.2.4 Flow Coastdown The flow coastdown analysis is based on a momentum balance around each reactor coolant loop and across the reactor core. This momentum balance is combined with the continuity equation, a pump momentum balance, and the as-built pump characteristics; it is based on high estimates of system pressure losses.

15.2.5.2.5 Results Figures 15.2-12 through 15.2-14 and 15.2-16 through 15.2-17 show the transient response for the loss of one reactor coolant pump with three loops initially in operation. The figures include trends of the core flow, loop flow, nuclear power, and core heat flux. The reactor is tripped on a low loop flow signal. Figure 15.2-17 shows that the DNB design basis is met.

For the case analyzed, since DNB does not occur, the ability of the primary coolant to remove heat from the fuel rod is not significantly reduced. Thus, the average fuel and clad temperatures do not increase far above the respective initial values.

The calculated sequence of events is shown in table 15.2-1. The affected RCP will continue to coast down, and the core flow will reach a new equilibrium value corresponding to the number of pumps still in operation (two RCPs). With the reactor tripped, a stable plant condition will eventually be attained. Normal plant shutdown may then proceed.

15.2.5.3 Conclusions The analysis shows that the DNB design basis is met during the transient. Thus, there will be no cladding damage and no release of fission products to the RCS.

15.2.6 STARTUP OF AN INACTIVE REACTOR COOLANT LOOP 15.2.6.1 Identification of Causes and Accident Description If the plant were to operate with one pump out of service, there would be reverse flow through the inactive loop due to the pressure difference across the reactor vessel. The cold leg temperature in an inactive loop is identical to the cold leg temperature of the active loops (the reactor core inlet temperature). If the reactor is operated at power with an inactive loop, and assuming the secondary side of the steam generator in the inactive loop is not isolated, there is a temperature drop across the steam generator in the inactive loop. With the reverse flow, the hot leg temperature of the inactive loop is lower than the reactor core inlet temperature.

15.2-21 REV 31 10/23

FNP-FSAR-15 Starting an idle reactor coolant pump without first bringing the inactive loop hot leg temperature close to the core inlet temperature would result in the injection of cold water into the core, which would cause a reactivity excursion and subsequent power increase due to the moderator density reactivity feedback effect.

Based on the expected frequency of occurrence, the Startup of an Inactive Loop event is classified as a Condition II event (an incident of moderate frequency) as defined by the American Nuclear Society Nuclear Safety Criteria for the Design of Stationary PWR Plants.

15.2.6.2 Sequence of Events and Systems Operation Following the startup of the inactive reactor coolant pump, the flow in the inactive loop will accelerate to full flow in the forward direction over a period of several seconds. Since the Technical Specifications require all reactor coolant pumps to be operating while in Modes 1 and 2, the maximum initial core power level for the Startup of an Inactive Loop transient is approximately 0 MWt. Under these conditions, there can be no significant reactivity insertion because the RCS is initially at a nearly uniform temperature. Furthermore, the reactor will initially be subcritical by the Technical Specification requirement. Thus, there will be no increase in core power and no automatic or manual protective action is required.

15.2.6.3 Conclusions The Startup of an Inactive Coolant Loop event results in an increase in reactor vessel flow while the reactor remains in a subcritical condition. No analysis is required to show that the minimum DNBR is satisfied for this event.

15.2.7 LOSS OF EXTERNAL ELECTRICAL LOAD AND/OR TURBINE TRIP 15.2.7.1 Identification of Causes and Accident Description Major load loss on the plant can result from either a loss of external electrical load or from a turbine trip. A loss of external electrical load may result from an abnormal variation in network frequency or other adverse network operating condition. For either case, offsite power is available for the continued operation of plant components such as the RCPs. The case of loss of all ac power is analyzed in subsection 15.2.9.

For a loss of external electrical load without subsequent turbine trip, no direct reactor trip signal would be generated. The plant is designed to accept a step loss of load from 100-percent to 50-percent load without actuating a reactor trip with all NSSS control systems in automatic (reactor control system, pressurizer pressure and level, steam generator water level control, and steam dumps). The automatic steam dump system with 40-percent dump capacity to the condenser, together with the reactor control system, is able to accommodate the load rejection. Reactor power is reduced to a new equilibrium value consistent with the capability of the rod control 15.2-22 REV 31 10/23

FNP-FSAR-15 system. The pressurizer power-operated relief valves (PORVs) may be actuated but the PSVs and the steam generator safety valves do not lift for the 50-percent load rejection with steam dump.

For a turbine or generator trip, such as would result from a loss of condenser vacuum, the reactor would be tripped directly (unless it is below P-9, approximately 50-percent power) from a signal derived from the turbine autostop oil pressure and/or turbine stop valves. The automatic steam dump system accommodates the excess steam generation. Reactor coolant temperatures and pressure do not significantly increase if the steam dump system and pressurizer pressure control system are functioning properly. If the turbine condenser was not available, the excess steam generation would be dumped to the atmosphere, and main feedwater flow would be lost. For this situation, steam generator level would be maintained by the auxiliary feedwater (AFW) system to ensure adequate residual and decay heat removal.

In the event the steam dump valves fail to open following a large loss of load, the steam generator safety valves may lift and the reactor may be tripped by the high-pressurizer pressure signal, the high-pressurizer water level signal, the OTT signal, or the low-low steam generator water level signal.

The steam generator shell-side pressure and reactor coolant temperatures will increase rapidly.

The PSVs and steam generator safety valves are, however, sized to protect the RCS and steam generator against overpressure for all load losses without assuming operation of the steam dump system, pressurizer spray, pressurizer PORVs, automatic RCCA control, or the direct reactor trip on turbine trip.

The steam generator safety valve capacity is sized to remove the steam flow at the engineered safeguard design rating (105 percent of nominal full-power steam flow) from the steam generator without exceeding 110 percent of the steam system design pressure. The pressurizer safety valve capacity is sized based on a complete loss-of-heat sink with the plant initially operating at the maximum calculated turbine load along with operation of the steam generator safety valves. The PSVs are then able to maintain the RCS pressure within 110 percent of the RCS design pressure without a direct reactor trip on turbine trip action.

The Farley RPS and primary and secondary system designs preclude overpressurization. A more complete discussion of overpressure protection can be found in reference 6.

15.2.7.2 Analysis of Effects and Consequences 15.2.7.2.1 Method of Analysis In this analysis, the behavior of the unit is evaluated for a complete loss of steam load from full power without a direct reactor trip. This assumption is made to show the adequacy of the pressure-relieving devices and to demonstrate core protection margins; it delays reactor trip until conditions in the RCS result in a trip due to other signals. Thus, the analysis assumes a worst-case transient. In addition, no credit is taken for steam dump. Main feedwater flow is 15.2-23 REV 31 10/23

FNP-FSAR-15 terminated at the time of turbine trip, with no credit taken for AFW (except for long-term recovery) to mitigate the consequences of the transient. Also consistent with the PAD5 fuel performance code (Reference 17), the effects of fuel thermal conductivity degradation with burnup are conservatively accounted for in the analysis.

The total loss of load transient is analyzed with the RETRAN (references 12, 13, and 14) computer code. The program simulates the neutron kinetics, RCS, pressurizer, pressurizer relief and safety valves, pressurizer spray, steam generators, and main steam safety valves.

The program computes pertinent plant variables including temperatures, pressures, and power level.

Major assumptions are summarized below.

A. For the minimum DNB case considerations, the accident is analyzed using the RTDP. Initial core power, reactor coolant temperature, and pressure are assumed to be at their nominal values consistent with steady-state full-power operation (see table 15.1-2B). Uncertainties in initial conditions are included in the DNBR limit as described in WCAP-11397.(5)

B. The total loss of load transient is analyzed with minimum reactivity feedback (BOL) conditions. The cases analyzed model a least-negative moderator temperature coefficient and least-negative Doppler coefficient as indicated in table 15.1-2A.

Historically, cases modeling EOL reactivity feedback conditions were also performed; however, analyses have demonstrated that this event is limiting at BOL conditions. Therefore, a bounding analysis at BOL conditions is performed.

C. From the standpoint of the maximum pressures attained, it is conservative to assume that the reactor is in manual rod control. If the reactor were in automatic rod control, the control rod banks would move prior to trip and reduce the severity of the transient.

D. The pressurizer spray and PORVs are conservatively modeled in the minimum DNBR and peak Main Steam System (MSS) pressure cases. The pressurizer spray and PORVs minimize the primary pressure transient and delay reactor trip.

For the peak RCS pressure case, no credit is taken for the pressurizer spray and PORVs.

E. Main feedwater flow to the steam generators is assumed to be lost at the time of turbine trip. No credit is taken for AFW flow since a stabilized plant condition will be reached before AFW initiation is normally assumed to occur.

F. Only the OTT and high pressurizer pressure reactor trips are assumed operable for the purpose of this analysis. No credit is taken for a reactor trip on high pressurizer level or the direct reactor trip on turbine trip.

G. No credit is taken for the operation of the steam dump system or steam generator PORVs. This assumption maximizes secondary pressure. The main steam safety 15.2-24 REV 31 10/23

FNP-FSAR-15 valve model includes allowances for safety valve setpoint uncertainty and accumulation.

H. The analysis value for the pressurizer safety valve set pressure includes a

+1.9/-3.0 percent uncertainty. For the minimum DNBR and peak MSS pressure cases the uncertainty is applied in the negative direction, thus reducing the safety analysis set pressure. For the peak RCS pressure case, the uncertainty is applied in the positive direction. The peak RCS pressure case also considers a 1.6-s water purge time due to the pressurizer safety valve loop seals. Steam relief occurs following the 1.6-s purge time.

15.2.7.2.2 Results Three cases were analyzed for a total loss of load from 100 percent of NSSS power.

A. Minimum DNBR.

B. Peak MSS pressure.

C. Peak RCS pressure.

The calculated sequence of events for each case is presented in table 15.2-1.

Minimum DNBR Case Figure 15.2-19 shows the transient response for the total loss of steam load event under BOL conditions, including a 0 pcm/°F moderator temperature coefficient, with pressure control. The reactor is tripped on OTT. The neutron flux remains essentially constant at full power until the reactor is tripped, and although the DNBR value decreases below the initial value, it remains well above the design basis limit throughout the entire transient. The pressurizer relief valves and sprays maintain primary pressure below 110 percent of the design value. The main steam safety valves are also actuated and maintain secondary pressure below 110 percent of the design value.

Peak MSS Pressure Case Figure 15.2-20 shows the transient response for the total loss of steam load event under BOL conditions, including the zero pcm/°F moderator temperature coefficient, with pressure control.

The reactor is tripped on OTT. The neutron flux remains essentially constant at full power until the reactor is tripped. The PSVs are actuated and maintain primary pressure below 110 percent of the design value. The main steam safety valves are also actuated and maintain secondary pressure below 110 percent of the design value.

15.2-25 REV 31 10/23

FNP-FSAR-15 Peak RCS Pressure Case Figure 15.2-21 shows the transient response for the total loss of steam load event under BOL conditions, including a zero moderator temperature coefficient without pressure control. The reactor is tripped on high pressurizer pressure. The neutron flux remains essentially constant at full power until the reactor is tripped. The PSVs are actuated and maintain primary pressure below 110 percent of the design value. The main steam safety valves are also actuated and maintain secondary pressure below 110 percent of the design value.

15.2.7.3 Conclusions The results of this analysis show that the plant design is such that a total loss of external electrical load without a direct reactor trip presents no hazards to the integrity of the RCS or the main steam system. The analysis demonstrates that the DNB design basis is met. The peak primary and secondary system pressures remain below 110 percent of design at all times.

15.2.8 LOSS OF NORMAL FEEDWATER 15.2.8.1 Identification of Causes and Accident Description A loss of normal feedwater (from pump failures, pipe breaks, valve malfunctions, or loss of offsite ac power) results in a reduction in capability of the secondary system to remove the heat generated in the reactor core. If the reactor were not tripped during this accident, core damage would possibly occur from a sudden loss-of-heat sink. If an alternate supply of feedwater were not supplied to the plant, residual heat following reactor trip would heat the primary system water to the point where water relief from the pressurizer occurs. Loss of significant water from the RCS could conceivably lead to core damage. Since the plant is tripped well before the steam generator heat transfer capability is reduced, the core does not approach a DNB condition.

The following provide the necessary protection against a loss of normal feedwater:

A. Reactor trip on low-low water level in any steam generator.

B. Two motor-driven auxiliary feedwater pumps which are started automatically on one of the following:

1. Low-low water level in any steam generator.

2. Loss of both main feedwater pumps.

3. Any SI signal.

4. Loss of offsite power (automatic transfer to diesel generators).

15.2-26 REV 31 10/23

FNP-FSAR-15 The motor-driven auxiliary feedwater pumps can also be started manually from the control room.

C. One turbine-driven auxiliary feedwater pump which is started automatically on one of the following:

1. Low-low water level in any two of three steam generators.

2. Undervoltage on any two of three reactor coolant pump buses.

The turbine-driven auxiliary feedwater pump can also be started manually from the control room.

The motor-driven AFW pumps are connected to vital buses which are powered by diesel generators if a loss of offsite power occurs. The turbine-driven pump utilizes steam from the secondary system. The controls are designed to start both types of pumps within 60 s, even if a loss of all ac power occurs simultaneously with loss of normal feedwater. The AFW pumps are normally aligned to take suction from the condensate storage tank for delivery to the steam generators. A backup source of water for the pumps is provided by the safety-related portion of the service water system (see section 6.5). The RPS and AFW system designs ensure that reactor trip and AFW flow will occur following any loss of normal feedwater.

The analysis shows that, following a loss of normal feedwater, the AFW system is capable of removing the stored and residual heat, thus preventing overpressurization of the RCS, overpressurization of the secondary side, or uncovery of the reactor core. Consequently, the plant is able to return to a safe condition.

15.2.8.2 Analysis of Effects and Consequences 15.2.8.2.1 Method of Analysis A detailed analysis using the RETRAN-02 (references 12, 13, and 14) computer code is performed in order to determine the plant transient following a loss of normal feedwater. The code describes the core neutron kinetics; RCS, including natural circulation, pressurizer, pressurizer PORV heaters and sprays, steam generators, and main steam safety valves; and the AFW system, and computes pertinent variables, including the pressurizer pressure, pressurizer water level, and reactor coolant temperatures.

The following assumptions are made in the analysis.

A. The plant is initially operating at the upper bound of the NSSS power (2841 MWt) with all three RCPs in operation providing a constant reactor coolant volumetric flow equal to the thermal design. A conservatively high RCP heat addition of 15 MWt (5 MWt/pump) is assumed. It is assumed that the operator manually trips two of three RCPs 10 min after reactor trip (rod motion). At this time the RCP heat addition is reduced from 15 MWt to 5 MWt.

15.2-27 REV 31 10/23

FNP-FSAR-15 B. An uncertainty of + 6°F on the initial reactor vessel average coolant temperature is conservatively assumed to account for the temperature uncertainty on nominal temperature and also includes a -1.0°F bias due to cold leg streaming. The initial pressurizer pressure uncertainty is +50 psi.

C. Reactor trip occurs on steam generator low-low water level at 19% of narrow range span.

D. It is assumed that two motor-driven AFW pumps are available to supply a minimum of 350 gal/min to three steam generators, 60 s following a low-low steam generator water level signal. The worst single failure, for this analysis, is the loss of the turbine-driven AFW pump.

E. The AFW system is actuated by a low-low steam generator water level signal at 19% of narrow range span. AFW flow begins following a 60-s delay. The AFW line purge volume is conservatively assumed to be the maximum value for either unit of 140 ft3, and the initial AFW enthalpy is assumed to be 80.83 Btu/lbm.

F. The pressurizer sprays are assumed operable. The pressurizer PORVs are not.

This maximizes the pressurizer water volume. If the spray valves and/or the pressurizer pressure system did not operate, the PSVs would prevent the RCS pressure from exceeding the RCS design pressure limit during this transient.

G. The pressurizer proportional and backup heaters are assumed operable. The proportional heaters output is modulated by the master pressure PI controller to maintain the reference pressure of 2,235 psig. Maximum output is provided when the pressurizer pressure decreases below the reference pressure (equivalent error of -15 psi). The capacity of the proportional heaters is 0.375 MWt. The backup heaters are also actuated on decreasing pressure (equivalent error of -25 psi) or on a pressurizer water level in-surge greater than 5% span above the programmed reference level. The capacity of the backup heaters is 1.025 MWt. The total capacity of the pressurizer heaters is 1.4 MWt. This represents an addition to the RCS energy which must be removed by the AFW system.

H. Secondary system steam relief is achieved through the self-actuated main steam safety valves. Note that steam relief will, in fact, be through the steam generator atmospheric relief valves or condenser dump valves for most cases of loss of normal feedwater. However, since the condenser dump valves and controls are not safety grade and their availability would lessen the consequences of the event, they have been assumed unavailable.

I. The main steam safety valves are modeled assuming a 3% tolerance and a conservative accumulation model (3% accumulation for Banks 1, 2, and 3; 2%

accumulation for Bank 4, and 10-psi accumulation for Bank 5, respectively, beginning with the safety valve with the lowest setpoint).

15.2-28 REV 31 10/23

FNP-FSAR-15 J. Core residual heat generation is based on the 1979 version of ANS 5.1 (reference 9). ANSI/ANS-5.1-1979 is a conservative representation of the decay energy release rates. Long-term operation at the initial power level preceding the trip is assumed.

K. This analysis bounds steam generator tube plugging levels of 0% to 20%.

The assumptions detailed above are designed to minimize the heat removal capability of the secondary system and to maximize the potential for water relief from the RCS by maximizing the expansion of the primary system fluid.

Note that the analysis assumption addressing the securing of 2 of 3 RCPs is met by incorporating a continuous action step in the EOPs to secure 2 of 3 RCPs if steam dump is not effective at controlling RCS temperature following a reactor trip. The time constraint of 10 min is an analysis input assumption. The procedure action is sufficient to ensure that the analysis remains bounding even if the RCPs are not secured within 10 min.

Consistent with the PAD5 fuel performance code (Reference 17), the effects of fuel thermal conductivity degradation are conservatively accounted for in the analysis.

15.2.8.2.2 Results Figure 15.2-26 shows plant parameters following a loss of normal feedwater with the assumptions listed in the previous subsection. Following the reactor and turbine trip from full load, the water level in the steam generators will fall due to reduction of the steam generator void fraction and because steam flow through the safety valves continues to dissipate the stored and generated heat. One minute following the initiation of the low-low level trip, the motor-driven AFW pumps automatically start; consequently, reducing the rate at which the steam generator water level is decreasing.

The capacity of the motor-driven AFW pumps is such that sufficient heat transfer is available to dissipate core residual heat without water relief through the RCS pressurizer relief or safety valves. From figure 15.2-26, sheet 1, it can be seen that at no time does the pressurizer water volume exceed the capacity of the pressurizer (1400 ft3). Therefore, at no time is there water relief from the pressurizer. If the AFW delivered is > 350 gal/min, or the initial reactor power is less than the maximum NSSS rating, or the steam generator water level in one or more steam generators is above the conservatively low 19% narrow-range span level assumed for the low-low steam generator setpoint or if the steam dump is effective at controlling RCS temperature following reactor trip, the results for this transient will be bounded by the analysis presented.

The calculated sequence of events for this accident is listed in table 15.2-1.

15.2.8.3 Conclusions Results of the analysis show that a loss of normal feedwater does not adversely affect the core, the RCS, or the steam system since the AFW capacity is such that the reactor coolant water is not relieved from the pressurizer relief or safety valves. In addition to the NRC acceptance criteria for Condition II events described in section 15.2, the analysis of the loss of normal 15.2-29 REV 31 10/23

FNP-FSAR-15 feedwater event meets the NRC acceptance criteria specific to a loss of normal feedwater event. That is, the analysis demonstrates that there is no overpressurization of the primary or secondary side. In addition, the Westinghouse criterion that the pressurizer does not go water solid is also satisfied.

15.2.9 LOSS OF ALL AC POWER TO THE STATION AUXILIARIES 15.2.9.1 Identification of Causes and Accident Description A complete loss of nonemergency ac power will result in a loss of power to the plant auxiliaries, i.e., the RCPs, condensate pumps, etc. The loss of power may be caused by a complete loss of the offsite grid accompanied by a turbine generator trip or by a loss of the onsite ac distribution system. The events following a loss of ac power with turbine and reactor trip are described in the sequence listed below.

A. The emergency diesel generators will start on a loss of voltage on the plant emergency buses and begin to supply plant vital loads.

B. Plant vital instruments are supplied by emergency power sources.

C. As the steam system pressure rises following the trip, the steam system PORVs are automatically opened to the atmosphere. Steam dump to the condenser is assumed not to be available. If the PORVs are not available, the self-actuated main steam safety valves will lift to dissipate the sensible heat of the fuel and coolant plus the residual heat produced in the reactor.

D. As the no-load temperature is approached, the steam system PORVs (or the self-actuated safety valves, if the PORVs are not available) are used to dissipate the residual heat and to maintain the plant at the hot standby condition.

The following provide the necessary protection against a loss of all ac power.

A. Reactor trip on low-low water level in any steam generator.

B. Two motor-driven AFW pumps that are started on:

1. Low-low water level in any steam generator.

2. Trip of both main feedwater pumps.

3. Any SI signal.

4. Loss of offsite power (automatic transfer to diesel generators).

5. Manual actuation.

15.2-30 REV 31 10/23

FNP-FSAR-15 C. One turbine-driven auxiliary feedwater pump that is started on:

1. Low-low water level in any two steam generators.

2. Undervoltage on any two RCP buses.

3. Manual actuation.

The AFW system is initiated as discussed in the loss of normal feedwater analysis (subsection 15.2.8). The turbine-driven pump utilizes steam from the secondary system and exhausts it to the atmosphere. The motor-driven AFW pumps are supplied by power from the diesel generators. The AFW pumps are normally aligned to take suction from the condensate storage tank for delivery to the steam generators. A backup source of water for the pumps is provided by the safety-related portion of the service water system (see section 6.5). The RPS and AFW system designs ensure that reactor trip and AFW flow will occur following any loss of normal feedwater, including from a loss of ac power to the station auxiliaries.

Heat removal is maintained by natural circulation in the RCS loops. Following the RCP coastdown, the natural circulation capability of the RCS will remove decay heat from the core, aided by the AFW flow in the secondary system. Demonstrating that acceptable results can be obtained for this event proves that the resultant natural circulation flow in the RCS is adequate to remove decay heat from the core.

The first few seconds after the loss of ac power to the RCPs will closely resemble a simulation of the complete loss of flow event (subsection 15.3.4, where it is demonstrated that the DNB design basis is satisfied). Therefore, the DNB aspects for the station blackout event are not explicitly evaluated in this analysis. The analysis shows that, following a loss of all ac power to the station auxiliaries, RCS natural circulation and the AFW system are capable of removing the stored and residual heat, consequently preventing overpressurization of the RCS, overpressurization of the secondary side, or uncovery of the reactor core. The plant is, therefore, able to return to a safe condition.

15.2.9.2 Analysis of Effects and Consequences 15.2.9.2.1 Method of Analysis A detailed analysis using the RETRAN-02 (references 12, 13, and 14) computer code is performed in order to determine the plant transient following a loss of all ac power. The code describes the core neutron kinetics; RCS, including natural circulation, pressurizer, pressurizer PORV heaters and sprays, steam generators, and main steam safety valves; and the AFW system; and computes pertinent variables, including the pressurizer pressure, pressurizer water level, and reactor coolant temperatures.

The major assumptions used in this analysis are identical to those used in the loss of normal feedwater analysis (subsection 15.2.8) with the following exceptions. Note that with the exception of the number of steam generators provided with AFW, the remaining AFW system 15.2-31 REV 31 10/23

FNP-FSAR-15 modeling assumptions (items D and E, below) are consistent with those used in the loss of normal feedwater.

A. The plant is initially operating at the upper bound NSSS power (2841 MWt) with all three RCPs in operation providing a constant reactor coolant volumetric flow equal to the thermal design flow. A nominal RCP heat addition of 10 MWt is assumed.

B. Loss of ac power is assumed to occur at the time of reactor trip on low-low SG water level. No credit is taken for the immediate insertion of the control rods as a result of the loss of ac power to the station auxiliaries.

C. Power is assumed to be lost to the RCPs. To maximize the amount of stored energy in the RCS, the power to the RCPs is not assumed to be lost until after the start of rod motion.

D. It is assumed that two motor-driven AFW pumps are available to supply a minimum of 350 gal/min to two steam generators, 60 s after reaching the low-low steam generator water level setpoint. The worst single failure, for this analysis, is the loss of the turbine-driven AFW pump.

E. The AFW system is actuated by a low-low steam generator water level signal at 19.0% of narrow range span. AFW flow begins 60-s after reaching the low-low steam generator water level setpoint. The AFW line purge volume is conservatively assumed to be the maximum value for either unit of 140 ft3, and the initial AFW enthalpy is assumed to be 80.83 Btu/lbm.

Plant characteristics and initial conditions are further discussed in section 15.1. Consistent with the loss of normal feedwater analysis, the most-limiting single failure occurs in the AFW system.

Consistent with the PAD5 fuel performance code (Reference 17), the effects of fuel thermal conductivity degradation are conservatively accounted for in the analysis.

15.2.9.2.2 Results Figure 15.2-27 shows plant parameters following a loss of offsite power with the assumptions listed above.

The first few seconds after the loss of ac power to the RCPs will closely resemble a simulation of the complete loss of flow incident, i.e., core damage due to rapidly increasing core temperatures is prevented by the reactor trip on the low-low steam generator water level signal.

After the reactor trip, stored and residual heat must be removed to prevent damage to either the RCS or the core. The RETRAN code results show that the natural circulation flow available is sufficient to provide adequate core decay heat removal following reactor trip and RCP coastdown.

The capacity of the motor-driven AFW pumps is such that sufficient heat transfer is available to dissipate core residual heat without water relief through the RCS pressurizer relief or safety 15.2-32 REV 31 10/23

FNP-FSAR-15 valves. From figure 15.2-27, sheet 1, it can be seen that at no time does the pressurizer water volume exceed the capacity of the pressurizer (1400 ft3). Therefore, at no time is there water relief from the pressurizer.

The calculated sequence of events for this accident is listed in table 15.2-1.

15.2.9.3 Conclusions Results of the analysis show that, for the loss of offsite power to the station auxiliaries event, all safety criteria are met. The DNBR transient is bounded by the complete loss of flow event (subsection 15.3.4) and remains above the safety analysis limit value. AFW capacity is sufficient to prevent water relief through the pressurizer relief and safety valves. The RCS and main steam system pressures remain within their respective pressure limits.

Analysis of the natural circulation capability of the RCS demonstrates that sufficient long-term heat removal capability exists following RCP pump coastdown to prevent fuel or clad damage.

In addition to the NRC acceptance criteria for Condition II events described in section 15.2, the analysis of the loss of all ac power to station auxiliaries meets the NRC acceptance criteria specific to the loss of all ac power to station auxiliaries event. That is, the analysis demonstrates that (1) there is no overpressurization of the primary or secondary side and (2) the natural circulation capacity of the RCS provides sufficient heat removal capability to prevent fuel or clad damage following reactor coolant pump coastdown. In addition, the Westinghouse criteria that the pressurizer does not go water solid are also satisfied.

15.2.9.4 Environmental Consequences of a Postulated Loss of ac Power to the Plant Auxiliaries The postulated incidents involving release of steam from the secondary system will not result in a release of radioactivity unless there is leakage from the RCS to the secondary system in the steam generator. A conservative analysis of the potential offsite doses resulting from this accident is presented with steam generator leakage. This analysis incorporates assumptions of defective fuel and steam generator leakage prior to the postulated accident for a time sufficient to establish equilibrium specific activity levels in the primary and secondary systems.

Parameters used in the analysis are listed in table 15.2-3.

The conservative assumptions used to determine the equilibrium concentrations of isotopes in the secondary system are as follows:

A. The primary to secondary leakage in steam generators occurs when the reactor starts up and the leakage remains constant during plant operation.

B. The primary to secondary leakage is evenly distributed in steam generators.

15.2-33 REV 31 10/23

FNP-FSAR-15 C. Primary coolant noble gas activity is associated with 1-percent defective fuel given in table 11.1-2 and iodine activity at 1.0 Ci/gm DEI131. The secondary side concentration of iodine is assumed to be at 0.1 Ci/gm DEI131.

D. The iodine partition factor is as follows:

amount of iodine/ unit mass steam

= 0.1 in the steam generators amount of iodine / unitl mass liquid E. No noble gas is dissolved or contained in the steam generator water; i.e., all noble gas leaked to the secondary system is continuously released with steam from the steam generators through the condenser off-gas system.

The following conservative assumptions and parameters are used to calculate the activity releases and offsite doses for the postulated loss of ac power to the plant auxiliaries:

A. Offsite power is lost; main steam condensers are not available for steam dump.

B. Eight hours after the accident, the RHR system starts operation to cool down the plant.

C. After 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> following the accident, no steam and activity are released to the environment.

D. There is no air ejector release and no steam generator blowdown during the accident.

E. The primary to secondary leakage is evenly distributed in steam generators.

F. An iodine spike of 60 Ci/gm DEI131 is assumed to exist previous to the accident.

G. No noble gas is dissolved in the steam generator water.

H. The iodine partition factor is as follows:

amount of iodine/ unit mass steam

= 0.1 in the steam generators (a) amount of iodine / unitl mass liquid I. During the postulated accident, iodine carryover from the primary side is uniformly mixed with the water in the steam generators and is diluted by the incoming feedwater.

J. The steam release for cooling down the plant is equally contributed by all steam generators.

15.2-34 REV 31 10/23

FNP-FSAR-15 K. The 0 to 2- and 2 to 8-h atmospheric diffusion factors given in appendix 15B and the 0 to 8-h breathing rate of 3.47 x 10-4 m3/s are applicable.

The steam releases to the atmosphere for the loss of ac power are given in table 15.2-3.

The gamma, beta, and thyroid doses for the loss of ac power to the plant auxiliaries for the conservative analysis at the site boundary and the low-population zone are a small fraction of the limits as defined in 10 CFR 100 (25-rem whole body and 300-rem thyroid) as shown in table 15.2-3.

The potential for uncovery of the steam generator tubes during the event has also been evaluated for impact on doses. The tube uncovery was assumed to exist for the first 1/2 h of the accident and the tube leakage locations were assumed to all be near the top of the tube bundle and, thus, subject to the uncovery. With the primary to secondary leakage entering the vapor space, no credit was taken for mixing with the secondary coolant, nor was credit taken for a partition factor within the steam generator (i.e., the primary coolant was assumed to be released directly to the environment). The uncovery does not impact the release of noble gases to the environment; thus, the gamma and beta doses are not affected. The uncovery does result in an increase in the accident releases of iodine, but the thyroid dose remains well within the limits as defined in 10 CFR 100.

15.2.10 EXCESSIVE HEAT REMOVAL DUE TO FEEDWATER SYSTEM MALFUNCTIONS 15.2.10.1 Identification of Causes and Accident Description Reductions in feedwater temperature or additions of excessive feedwater are means of increasing core power above full power. Such transients are attenuated by the thermal capacity of the secondary plant and of the RCS. The overpower-overtemperature protection (high neutron flux, OPT, and OTT trips) prevents any power increase which could lead to a DNBR less than the safety analysis limit value.

An example of excessive heat removal from the RCS is excessive feedwater flow due to full opening of a feedwater control valve. The valve opening may be due to a feedwater control system malfunction or an operator error. At power, this excess flow causes a greater load demand on the RCS due to increased subcooling in the steam generator. With the plant at no-load conditions, the addition of cold feedwater will cause a decrease in RCS temperature and thus a reactivity insertion due to the effects of the negative moderator coefficient of reactivity.

A second example of excessive heat removal from the primary system is the transient associated with the accidental opening of the high pressure heater bypass valve which diverts flow around the number six feedwater heaters. In the event of an accidental opening of the high pressure heater bypass valve, there is a sudden reduction in inlet feedwater temperature to the steam generators. This increased subcooling will create a greater load demand on the RCS.

15.2-35 REV 31 10/23

FNP-FSAR-15 The steam generator high-high level trip is provided to prevent the continuous addition of excessive feedwater to a steam generator.

15.2.10.2 Analysis of Effects and Consequences 15.2.10.2.1 Method of Analysis The excessive heat removal due to a feedwater system malfunction transient is analyzed with the LOFTRAN (reference 4) computer code. This code simulates a multiloop system, neutron kinetics, the pressurizer, pressurizer relief and safety valves, pressurizer spray, steam generators, and main steam safety valves. The code computes pertinent plant variables including temperatures, pressures, and power level.

The system is analyzed to demonstrate acceptable consequences in the event of a feedwater system malfunction. Feedwater temperature reduction due to number six heater bypass in conjunction with second stage reheater drains dumped to the condenser is considered.

Additionally, excessive feedwater addition due to a control system malfunction or operator error that allows a feedwater control valve to open fully is considered.

Two excessive feedwater flow cases are analyzed as follows:

A. Accidental opening of one feedwater control valve with the reactor in manual rod control at full power.

B. Accidental opening of one feedwater control valve with the reactor in automatic rod control at full power.

The feedwater system malfunction event is analyzed with the following assumptions:

A. This accident is analyzed with the RTDP as described in WCAP-11397-P-A (reference 5); therefore, initial reactor power, pressure, and RCS temperatures are assumed to be at their nominal values. The analysis modeled an initial NSSS power of 2841 MWt, which bounds the MUR uprated power level. Uncertainties in initial conditions are included in the limit DNBR described in reference 5.

B. For the feedwater control valve accident at full power, one feedwater control valve is assumed to malfunction resulting in a step increase to 184 percent of nominal feedwater flow to one steam generator.

C. For the feedwater control valve accident at zero-load condition, a feedwater valve malfunction could occur that results in an increase in flow to one steam generator from zero to the nominal full-load value for one steam generator. The cooldown and resulting positive reactivity insertion associated with this event would be less than the Rupture of the Main Steam Line event analyzed at zero load conditions in Section 15.4.2.1. As such, the results of this case are not presented.

15.2-36 REV 31 10/23

FNP-FSAR-15 D. The initial water level in all the steam generators is at the nominal level.

E. No credit is taken for the heat capacity of the RCS and steam generator thick metal in attenuating the resulting plant cooldown.

F. No credit is taken for the heat capacity of the steam and water in the unaffected steam generators.

G. The feedwater flow resulting from a fully open control valve is terminated by the steam generator high-high water level signal that closes all feedwater main control and feedwater control-bypass valves, indirectly closes all feedwater isolation valves, and trips the main feedwater pumps and turbine generator.

H. Consistent with the PAD5 fuel performance code (Reference 17), the effects of fuel thermal conductivity degradation are conservatively accounted for in the analysis.

Normal reactor control systems and engineered safety systems (e.g., SI) are not required to function. The RPS may actuate to trip the reactor due to an overpower condition. No single active failure in any system or component required for mitigation will adversely affect the consequences of this event. The steam generator overfill protection system meets the requirements of Generic Letter 89-19.

15.2.10.2.2 Results Opening of the high pressure heater bypass valve and dump of the reheater drain causes a reduction in feedwater temperature which increases the thermal load on the primary system.

The reduction in feedwater temperature is < 65°F, resulting in an increase in heat load on the primary system of < 10 percent of full power. The increased thermal load due to the opening of the high pressure heater bypass valve thus would result in a transient very similar (but of reduced magnitude) to that presented in subsection 15.2.11 for an excessive load increase incident, which evaluates the consequences of a 10-percent step-load increase. Therefore, the results of analyses are not presented.

In the case of an accidental full opening of one feedwater control valve with the reactor at zero power, the cooldown and resulting positive reactivity insertion associated with this event would be less than the Rupture of the Main Steam Line event analyzed at zero load conditions in Section 15.4.2.1. As such, the results of this case are not presented. It should be noted that if the incident occurs with the unit just critical at no load, the reactor may be tripped by the power range high neutron flux trip (low setting) set at approximately 25 percent.

The full-power case with manual rod control results in a slightly larger power increase than the case modeling automatic rod control. A turbine trip, which results in a reactor trip, is actuated when the steam generator water level in the affected steam generator reaches the high-high level setpoint.

For all cases of excessive feedwater flow, continuous addition of cold feedwater is prevented by automatic closure of all feedwater control valves, closure of manual feedwater bypass valves, a 15.2-37 REV 31 10/23

FNP-FSAR-15 trip of the feedwater pumps, and a turbine trip on high-high steam generator water level. In addition, the feedwater isolation valves will automatically close upon receipt of the feedwater pump trip signal.

Following turbine trip, the reactor will automatically be tripped either directly due to the turbine trip or due to one of the reactor trip signals discussed in subsection 15.2.7 (Loss of External Electrical Load). If the reactor were in automatic control, the control rods would be inserted at the maximum rate following the turbine trip, and the resulting transient would not be limiting in terms of peak RCS pressure.

The results of the manual rod control case are presented, which are slightly more limiting than the automatic rod control case. Transient results (see figure 15.2-28) show the core heat flux, pressurizer pressure, core average temperature, and DNBR, as well as the increase in nuclear power and loop T associated with the increased thermal load on the reactor. Steam generator water level rises until the feedwater addition is terminated as a result of the high-high steam generator water level trip. The analysis demonstrates that the DNB design basis is met.

Since the power level rises during this event, the fuel temperature will also rise until the reactor trip occurs. The core heat flux lags behind the neutron flux due to the fuel rod thermal time constant and, as a result, the peak core heat flux value does not exceed 120 percent of nominal. Thus, the peak fuel temperature will remain well below the fuel melting point.

The calculated sequence of events is shown in table 15.2-1. The transient results show that DNB does not occur at any time during the feedwater flow increase transient; thus, the ability of the primary coolant to remove heat from the fuel rods is not reduced. Therefore, the fuel cladding temperature does not rise significantly above its initial value during the transient.

15.2.10.3 Conclusions The decrease in feedwater temperature transient due to an opening of a heater bypass valve is less severe than the excessive load increase event (see subsection 15.2.11). Based on the results presented in subsection 15.2.11, the applicable acceptance criteria for the decrease in feedwater temperature event have been met.

For the excessive feedwater addition at power transient, the results show that the DNB ratios encountered are above the safety analysis limit value; hence, no fuel damage is predicted.

Additionally, the cooldown and resulting positive reactivity insertion following an excessive feedwater addition at no-load conditions is bounded by the rupture of the main steam line analysis performed at no-load conditions.

15.2-38 REV 31 10/23

FNP-FSAR-15 15.2.11 EXCESSIVE LOAD INCREASE INCIDENT 15.2.11.1 Identification of Causes and Accident Description An excessive load increase incident is defined as a rapid increase in the steam flow that causes a power mismatch between the reactor core power and the steam generator load demand. The RCS is designed to accommodate a 10-percent step-load increase or a 5-percent per minute ramp-load increase in the range of 15 to 100 percent of full power, taking credit for all control systems in automatic. Any loading rate in excess of these values may cause a reactor trip actuated by the RPS.

This accident could result from either an administrative violation such as excessive loading by the operator or an equipment malfunction in the steam dump control or turbine speed control.

For excessive loading by the operator or by system demand, the turbine load limiter function in the DEH control system keeps maximum turbine load demand at 100-percent rated load.

During power operation, steam dump to the condenser is controlled by comparing the RCS temperature (median Tavg) to a reference temperature based on turbine power, where a high temperature difference in conjunction with a loss of load or a plant trip indicates a need for steam dump. A single controller or control signal malfunction does not cause steam dump valves to open. Interlocks are provided to block the opening of the valves unless a large turbine load decrease or a plant trip has occurred. In addition, the reference temperature and loss of load signals are developed by independent sensors.

Protection against an excessive load increase accident is provided by the following RPS signals:

A. OPT.

B. OTT.

C. Power range high neutron flux.

D. Low pressurizer pressure.

15.2.11.2 Analysis of Effects and Consequences 15.2.11.2.1 Method of Analysis Four cases are analyzed to demonstrate the plant behavior following a 10-percent step-load increase from rated load. These cases are as follows:

A. Manually-controlled reactor with BOL (minimum moderator) reactivity feedback.

15.2-39 REV 31 10/23

FNP-FSAR-15 B. Manually-controlled reactor with EOL (maximum moderator) reactivity feedback.

C. Reactor in automatic control with BOL (minimum moderator) reactivity feedback.

D. Reactor in automatic control with EOL (maximum moderator) reactivity feedback.

This accident is analyzed using the LOFTRAN(4) code. The code simulates the neutron kinetics, RCS, pressurizer, pressurizer relief and safety valves, pressurizer spray, feedwater system, steam generators, and steam generator safety valves. The code computes pertinent plant variables, including temperatures, pressures, and power level.

At BOL minimum moderator feedback, the core has the least-negative moderator temperature coefficient of reactivity and the least-negative Doppler only power coefficient curve, and therefore, the least-inherent transient response capability. Since a positive moderator temperature coefficient would provide a transient benefit, a zero moderator temperature coefficient was assumed in the minimum feedback cases. For the EOL maximum moderator feedback cases, the moderator temperature coefficient of reactivity has its most-negative value and the most-negative Doppler only power coefficient curve. This results in the largest amount of reactivity feedback due to changes in coolant temperature.

Normal reactor control systems and engineered safety systems are not required to function. A conservative limit on the turbine valve opening is assumed. The analysis does not take credit for the operation of the pressurizer heaters. The cases which assume automatic rod control are analyzed to ensure that the worst case is presented. The automatic function is not required.

The RPS is assumed to be operable; however, reactor trip is not encountered for most cases due to the error allowances assumed in the setpoints. No single active failure in any system or component required for mitigation will adversely affect the consequences of this accident.

This accident is analyzed with the RTDP as described in WCAP-11397-P-A (reference 5). Initial reactor power, RCS pressure, and temperature are assumed to be at their nominal values.

Uncertainties in initial conditions are included in the limit DNBR as described in reference 5.

15.2.11.2.2 Results Figures 15.2-29 through 15.2-32 illustrate the transient with the reactor in the manual control mode. As expected, for the BOL case, there is a slight power increase, and the average core temperature shows a large decrease. This results in a DNBR which increases (after a slight decrease) above its initial value. For the EOL manually-controlled case, there is a much larger increase in reactor power due to the moderator feedback. A minimum DNBR is reached does not violate the DNB design basis.

Figures 15.2-33 through 15.2-36 illustrate the transient assuming the reactor is in the automatic control mode. Both the BOL and the EOL cases show that core power increases, thereby reducing the rate of decrease in coolant average temperature and pressurizer pressure. The minimum DNBR for the BOL case and for the EOL case does not violate the DNB design basis.

15.2-40 REV 31 10/23

FNP-FSAR-15 The calculated time sequence of events for the excessive load increase event is shown on table 15.2-1. Note that a reactor trip signal was not generated for any of the four cases.

15.2.11.3 Conclusions It has been demonstrated that for an excessive load increase, the minimum DNBR during the transient will not go below the safety analysis limit value and thus will neither affect fuel cladding integrity nor result in the release of fission products to the RCS.

Note that this event was evaluated for the increased power level associated with the measurement uncertainty recapture (MUR) power uprate. The evaluation also considered the effects of fuel thermal conductivity degradation with burnup consistent with the PAD5 fuel performance code (Reference 17). The aforementioned conclusions remain valid.

15.2.12 ACCIDENTAL DEPRESSURIZATION OF THE RCS 15.2.12.1 Identification of Causes and Accident Description An accidental depressurization of the RCS could occur as a result of an inadvertent opening of a pressurizer relief or safety valve. Since a pressurizer safety valve is sized to relieve approximately twice the steam flowrate of a relief valve and will allow a much more rapid depressurization upon opening, the most-severe core conditions resulting from an accidental depressurization of the RCS are associated with an inadvertent opening of a pressurizer safety valve. Initially, the event results in a rapidly decreasing RCS pressure, which could reach hot leg saturation conditions without RPS intervention. If saturated conditions are reached, the rate of depressurization is slowed considerably; however, the pressure continues to decrease throughout the event. The effect of the pressure decrease is to increase power via the moderator density feedback; however, if the plant is in the automatic mode, the rod control system functions to maintain the power essentially constant throughout the initial stages of the transient. The average coolant temperature remains approximately the same, but the pressurizer level increases until reactor trip because of the decreased reactor coolant density.

The reactor will be tripped by the following RPS signals:

A. Pressurizer low pressure.

B. Overtemperature T.

15.2-41 REV 31 10/23

FNP-FSAR-15 15.2.12.2 Analysis of Effects and Consequences 15.2.12.2.1 Method of Analysis The accidental depressurization of the RCS is analyzed by the detailed digital computer code LOFTRAN.(4) The code simulates the neutron kinetics, RCS, pressurizer, pressurizer relief and safety valves, pressurizer spray, steam generators, and steam generator safety valves. The code computes pertinent plant variables, including temperatures, pressures, and power level.

In calculating the DNBR, the following conservative assumptions are made:

A. The accident is analyzed using the RTDP. Initial core power, reactor coolant temperature, and pressure are assumed to be at their nominal values consistent with steady-state full-power operation (see table 15.1-2B). Uncertainties in initial conditions are included in the DNBR limit as described in WCAP-11397 (reference 5). The analysis modeled an initial NSSS power of 2841 MWt, which bounds the MUR uprated power level.

B. A zero moderator temperature coefficient of reactivity (table 15.1-2A) is assumed, such that the resultant amount of negative reactivity is conservatively low due to changes in the moderator temperature.

C. A small (absolute value) Doppler coefficient of reactivity is assumed, such that the resultant amount of negative feedback is conservatively low.

D. The spatial effect of voids resulting from local or subcooled boiling is not considered in the analysis with respect to reactivity feedback or core power shape.

In fact, it should be noted that the power peaking factors are kept constant at their design values, while the void formation and resulting core feedback effects would result in considerable flattening of the power distribution. Although this would significantly increase the calculated DNBR, no credit is taken for this effect.

E. Consistent with the PAD5 fuel performance code (Reference 17), the effects of fuel thermal conductivity degradation are conservatively accounted for in the analysis.

15.2.12.2.2 Results The system response to an inadvertent opening of a pressurizer safety valve is shown in figures 15.2-37 through 15.2-39. Figure 15.2-37 illustrates the nuclear power transient following the depressurization. Nuclear power increases slowly until reactor trip occurs on low pressurizer pressure. The pressure decay and core average temperature transients following the accident are given in figure 15.2-38. The DNBR decreases initially, but increases rapidly following the reactor trip as shown in figure 15.2-39. The analysis demonstrates that the DNB design basis is met.

The calculated sequence of events is shown in table 15.2-1.

15.2-42 REV 31 10/23

FNP-FSAR-15 15.2.12.3 Conclusions The results of the analysis show that the pressurizer low pressure and OTT RPS signals provide adequate protection against the RCS depressurization event. Thus, there will be no cladding damage or release of fission products to the RCS.

15.2.13 ACCIDENTAL DEPRESSURIZATION OF THE MAIN STEAM SYSTEM 15.2.13.1 Identification of Causes and Accident Description The most severe core conditions resulting from an accidental depressurization of the main steam system, which is classified as an ANS Condition II event, result from an inadvertent opening of a single steam dump, relief, or safety valve. The analyses performed assuming a rupture of a main steam pipe, which is classified as an ANS Condition IV event, are given in section 15.4.

The steam released as a consequence of this accidental depressurization results in an initial increase in steam flow, which decreases during the accident as the steam pressure falls. The energy removal from the RCS causes a reduction in coolant temperature and pressure. In the presence of a negative moderator temperature coefficient, the cooldown results in an insertion of positive reactivity and subsequent reduction of core shutdown margin.

For an accidental depressurization of the main steam system, the radiation releases must remain within the requirements of 10 CFR Part 20.1 - 20.601. This is the ANSI N18.2 criterion for Condition II events, "Faults of Moderate Frequency." Although the plant may return to criticality, the above limit can be met by showing there is not consequential damage, i.e., that the DNB design basis is met. Therefore, the analysis is performed to demonstrate that the following criterion is satisfied:

Assuming a stuck RCCA and a single failure in the engineered safety features (ESF), the limit DNBR value will be met after reactor trip for a steam release equivalent to the spurious opening, with failure to close, of the largest of any single steam dump, power-operated relief or safety valve.

The following systems provide the necessary protection against an accidental depressurization of the main steam system:

A. Safety injection system (SIS) actuation from any of the following:

1. Two of three low-pressurizer pressure signals.

2. High steam line differential pressure.

15.2-43 REV 31 10/23

FNP-FSAR-15 B. The overpower reactor trips (neutron flux and T) and the reactor trip occurring in conjunction with receipt of the SI signal.

C. Redundant isolation of the main feedwater lines; sustained high feedwater flow would cause additional cooldown. Therefore, an SI signal will rapidly close all feedwater control valves, trip the main feedwater pumps, and indirectly close the feedwater isolation valves (2/2 steam generator feedwater pump tripped).

15.2.13.2 Analysis of Effects and Consequences 15.2.13.2.1 Method of Analysis The following analyses of a secondary system steam release are performed for this section:

A. A full plant digital computer simulation using LOFTRAN(4) to determine RCS temperature and pressure during cooldown.

B. An analysis to ascertain that the DNB design basis is met.

The following conditions are assumed to exist at the time of a secondary system depressurization incident:

A. EOL shutdown margin at no load, equilibrium xenon conditions, and with the most reactive RCCA assembly stuck in its fully withdrawn position. Operation of RCCA banks during core burnup is restricted in such a way that addition of positive reactivity due to a secondary system break accident will not lead to a more adverse condition than the case analyzed.

B. A negative moderator coefficient corresponding to the EOL rodded core with the most reactive RCCA in the fully withdrawn position. The variation of the coefficient with temperature and pressure is included. The keff versus temperature at 1000 lb/in.2 corresponding to the negative moderator temperature coefficient plus the Doppler temperature effect used is shown on figure 15.2-40, sheet 1. The effect of power generation in the core on overall reactivity is shown in figure 15.2-40, sheet 2.

C. Minimum capability for injection of concentrated boric acid solution corresponding to the most restrictive single failure in the SIS. The injection curve assumed is shown in figure 15.2-41. This corresponds to the flow delivered by one charging pump delivering its full contents to the cold leg header. No credit has been taken for the low-concentration boric acid which must be swept from the SI lines downstream of the RWST prior to the delivery of concentrated boric acid (2300 ppm from the RWST to the reactor coolant loops.

D. The case studied consists of a steam flow of 224.3 lb/s at 1004 psia from one steam generator with offsite power available. This is the calculated maximum 15.2-44 REV 31 10/23

FNP-FSAR-15 capacity of any single steam dump or safety valve. Initial hot standby conditions with minimum required shutdown margin at no load Tavg are assumed since this represents the most conservative initial condition. The conclusions of this case are valid for the limiting steam flow from any single steam dump or safety valve as specified in tables 10.3-1 and 10.3-2 (i.e., 890,000 lb/h at 1085 psig) since this case is less limiting than the rupture of a main steam pipe case presented in section 15.4 which also satisfies the acceptance criteria for accidental depressurization of the main steam system.

fL E. In computing the steam flow, the Moody Curve for = 0 is used.

D F. Perfect moisture separation in the steam generator is assumed.

G. A boric acid solution of 0 ppm in the high head injection lines and the equivalent volume of the boron injection tank (BIT), which has been deleted, is assumed.

15.2.13.2.2 Results Since it is postulated that all of the conditions described above occur simultaneously, the results presented are a conservative indication of the events which would occur ssuming a secondary system steam release.

Figure 15.2-42 shows the transients arising as the result of a steam release having an initial steam flow of 224.3 lb/s at 1004 psia with steam release from one steam generator. The assumed steam release is that for the maximum capacity of any single steam dump or safety valve. In this case, SI is initiated automatically by low-pressurizer pressure. Operation of one centrifugal charging pump is assumed. Boron solution at 2300 ppm enters the RCS from the RWST, providing sufficient negative reactivity to prevent core damage. The calculated transient is quite conservative with respect to cooldown, since no credit is taken for the energy stored in the system metal other than that of the fuel elements or the energy stored in the other steam generators. Since the transient occurs over a period of about 5 min, the neglected stored energy will have a significant effect in slowing the cooldown.

Following blowdown of the faulted steam generator, the plant can be brought to a stabilized hot standby condition through control of auxiliary feedwater flow and SI flow, as described by plant operating procedures. The operating procedures would call for operator action to limit RCS pressure and pressurizer level by terminating SI flow, and to control steam generator level and RCS coolant temperature using the AFW system. Any action required of the operator to maintain the plant in a stabilized condition will be in a time frame in excess of 10 min following SI actuation.

The calculated time sequence of events for this accident is listed in table 15.2-1.

15.2-45 REV 31 10/23

FNP-FSAR-15 15.2.13.3 Conclusions The analysis has shown that the criterion stated earlier in this section is satisfied. For an accidental depressurization of the main steam system, (where the boron concentration in the high head injection line and the equivalent volume of the BIT, which has been deleted is 0 ppm),

the minimum DNBR remains well above the limiting value and no system design limits are exceeded. This case is less limiting than the rupture of a main steam pipe case presented in section 15.4.

15.2.14 INADVERTENT OPERATION OF ECCS DURING POWER OPERATION 15.2.14.1 Identification of Causes and Accident Description Inadvertent operation of the ECCS at power could be caused by operator error, test sequence error, or a false electrical actuation signal. A spurious signal initiated after the logic circuitry in one solid-state protection system train for any of the following Engineered Safety Feature (ESF) functions could cause this incident by actuating the ESF equipment associated with the affected train:

A. High containment pressure.

B. Low pressurizer pressure.

C. High steam line differential pressure.

D. Low steam line pressure.

Following the actuation signal, the suction of the coolant charging pumps diverts from the volume control tank (VCT) to the RWST. Simultaneously, the valves isolating the high head injection lines from the charging pumps automatically open and the normal charging line isolation valves close. The charging pumps force the borated water from the RWST through the pump discharge header, the injection line, and into the cold leg of each loop. The passive accumulator tank SI and low-head system are available; however, they do not provide flow when the RCS is at normal pressure.

An SI signal normally results in a direct reactor trip and a turbine trip; however, any single fault that actuates the ECCS will not necessarily produce a reactor trip. If an SI signal generates a reactor trip, the operator should determine if the signal is spurious. If the SI signal is determined to be spurious, the operator should terminate SI and maintain the plant in the hot-standby condition as determined by appropriate recovery procedures. If repair of the ESF actuation system instrumentation is necessary, future plant operation will be in accordance with the technical specifications.

If the RPS does not produce an immediate trip as a result of the spurious SI signal, the reactor experiences a negative reactivity excursion due to the injected boron, which causes a decrease in reactor power. The power mismatch causes a drop in Tavg and consequent coolant 15.2-46 REV 31 10/23

FNP-FSAR-15 shrinkage. The pressurizer pressure and water level decrease. Load decreases due to the effect of reduced steam pressure on load after the turbine throttle valve is fully open. If automatic rod control is used, these effects will lessen until the rods have moved out of the core.

The transient is eventually terminated by the RPS low pressurizer pressure trip or by manual trip.

The time to trip is affected by initial operating conditions. These initial conditions include the core burnup history which affects initial boron concentration, rate of change of boron concentration, and Doppler and moderator coefficients.

15.2.14.2 Analysis of Effects and Consequences 15.2.14.2.1 Method of Analysis Inadvertent operation of the ECCS is analyzed using the LOFTRAN(4) computer code. The code simulates the neutron kinetics, RCS, pressurizer, pressurizer relief and safety valves, pressurizer spray, feedwater system, steam generators, and steam generator safety valves.

The code computes pertinent plant variables, including temperatures, pressures, and power level.

Inadvertent operation of the ECCS at power is classified as a Condition II event, a fault of moderate frequency. The criteria established for Condition II events include the following:

a. Pressure in the reactor coolant and main steam systems should be maintained below 110% of the design values,

b. Fuel cladding integrity shall be maintained by ensuring that the minimum DNBR remains above the 95/95 DNBR limit for PWRs, and,

c. An incident of moderate frequency should not generate a more serious plant condition without other faults occurring independently.

It is easy to conclude that criterion (c) is met if it can be demonstrated that the pressurizer does not become water solid in the minimum allowable operator action time. However, if ECCS flow is not terminated before the pressurizer becomes water solid, it is more difficult to demonstrate that this Condition II event does not lead to a more serious plant condition.

ANS 51.1/N18.2-1973 (reference 11), lists Example (15) of a Condition II event as a minor reactor coolant system leak which would not prevent orderly reactor shutdown and cooldown assuming makeup is provided by normal makeup systems only. In reference 11, normal makeup systems are defined as those systems normally used to maintain reactor coolant inventory under respective conditions of startup, hot standby, power operation, or cooldown, using onsite power. Since the cause of the water relief is the ECCS flow, the magnitude of the leak will be less than or equivalent to that of the ECCS (i.e., operation of the ECCS maintains RCS inventory during the postulated event and establishes the magnitude of the subject leak).

15.2-47 REV 31 10/23

FNP-FSAR-15 Therefore, the above example of a Condition II event is met provided orderly reactor shutdown is also met.

To ensure orderly reactor shutdown can occur, the RCS pressure boundary must ultimately be isolatable once the source of the ECCS flow is terminated. To ensure the RCS pressure boundary can be isolated, the pressurizer safety relief valves (PSRVs) must function as designed and the power-operated relief and/or block valves must be available to the operator (after the minimum allowable operator action time) to provide isolation functions.

The capability of the PSRVs to function properly following the discharge of significantly subcooled water through the PSRVs has not been demonstrated and, therefore, is not certain.

Hence, for continued conservatism in the safety analysis methodology, it is assumed the PSRVs must not pass water in order to ensure their integrity and continued availability. With one or more PORVs available, the PSRV setpoint will not be reached.

Any water discharge from the RCS would be through the PORV(s). Isolation of the RCS following operator action to terminate ECCS flow would then be obtainable via the PORV block valves(s).

Therefore, to address criterion (c), the analysis uses the criterion that a water-solid pressurizer condition be precluded when the pressurizer is at or above the set pressure of the PSRVs. For the potential condition of the plant operating with all the PORVs blocked, either action to terminate the ECCS flow to avert a water-solid condition or to confirm that at least one PORV is unblocked and available for water relief prior to reaching a water-solid condition must be taken.

This addresses any concerns regarding subcooled water relief through the plant PSRVs.

Should water relief through the pressurizer PORVs occur, the PORV block valves would be available to isolate the RCS.

The Inadvertent Operation of ECCS at Power event is only analyzed to determine maximum pressurizer water volume (or minimum time to a pressurizer water-solid condition). Because of the power and temperature reduction during the transient, this event is not limiting with respect to DNB or pressures in the reactor coolant and main steam systems.

For maximizing the potential for pressurizer filling, the most limiting case is a maximum reactivity feedback condition with an immediate reactor trip, and subsequent turbine trip, on the initiating SI signal.

The analysis assumptions are as follows:

A. Initial Operating Conditions Initial conditions (see table 15.1-2B) with maximum uncertainties on power (+2%),

vessel average temperature (-6°F), and pressurizer pressure (-50 psia) are assumed; the initial NSSS power (102% power of 2785 MWt = 2840.7 MWt) covers the measurement uncertainty recapture (MUR) uprate.

15.2-48 REV 31 10/23

FNP-FSAR-15 B. Moderator and Doppler Coefficients of Reactivity Maximum reactivity feedback is modified with a most-negative moderator temperature coefficient and a most-negative Doppler power coefficient representative of EOL Conditions.

C. Reactor Control The reactor is assumed to trip at the time of the SI signal. Thus, the reactor control mode is of no consequence.

D. Pressurizer Pressure Control Pressurizer spray is assumed available in order to minimize the RCS pressure.

Minimizing the RCS pressure conservatively maximizes the incoming SI flow. The pressurizer heaters are assumed operable since this maximizes the heat addition to the pressurizer water, thus maximizing the fluid expansion, resulting in an earlier time to pressurizer filling.

PORVs are not assumed as an automatic pressure control function. Automatic pressure control operation with one or more PORVs would preclude the pressurizer pressure from reaching the PSRV set-pressure and, hence, preclude water discharge through the PSRVs. If one or more PORVs are available and water relief through a PORV occurs, operator action to manually block the PORV (after the operator terminates the ECCS flow) ensures the integrity of the RCS pressure boundary is maintained. Also, permissive P-11 automatically interlocks the PORVs closed on decreasing pressure.

E. Boron Injection At the initiation of the event, two charging pumps inject borated water into the cold leg of each loop. The analysis assumes zero injection line purge volume for calculational simplicity; thus, the boration transient begins immediately in the analysis.

F. Turbine Load The reactor and turbine both trip at the time of SI actuation with the turbine load dropping to zero simultaneously.

G. Reactor Trip An immediate reactor trip on the initiating SI signal is assumed.

H. Decay Heat The availability of decay heat and its expansion effects on the RCS liquid volume have been taken into account. Core residual heat generation is based on the 1979 15.2-49 REV 31 10/23

FNP-FSAR-15 version of ANS 5.1 (reference 9). ANSI/ANS-5.1-1979 is a conservative representation of the decay energy release rates. Long-term operation at the initial power level preceding the trip is assumed.

I. Operator Action Time The PSRVs must not be exposed to subcooled liquid discharge as a result of reaching a water solid pressurizer condition. Consequently, PORV availability must be assured by manually opening a block valve to allow a PORV to actuate on demand. Per ANSI/ANS-58.8-1984 (reference 10), the operator action times for event indication are based on specific time tests. Inadvertent ECCS Actuation at Power is a Condition II event per ANSI N18.2-1973 which relates to a Plant Condition II event per ANSI/ANS-58.8-1984. For a Plant Condition II event time test 1 requires 5 min and time test 2 requires 1 + n

• 1 min where n signifies the number of discrete manipulations required. PORVs would be expected to be available unless they were blocked due to a leaking PORV condition. Therefore, any operator action associated with assuring PORV availability consists of manually opening a block valve to allow it to actuate on demand. The appropriate time to assume initial operator action is 7 min. This consists of 5 min to evaluate the incident and decide upon corrective measures plus 1-min fixed time delay to receive simple readout information, i.e., status of PORV block valves, and 1 min to begin the appropriate action.

J. Pressurizer Safety Valves The safety valves are conservatively assumed to open at a pressure of 2425 psia which corresponds to a tolerance of -3% relative to the set pressure of 2500 psia.

The valves are assumed to close at a pressure of 2300 psia, which corresponds to a blowdown of 5% below the opening pressure of 2425 psia.

15.2.14.2.2 Results The transient responses for the DNB and pressurizer filling cases are shown in figures 15.2-43 through 15.2-44. Table 15.2-1 shows the calculated sequence of events.

Reactor trip occurs at event initiation followed by a rapid initial cooldown of the RCS. Coolant contraction results in a short-term reduction in pressurizer pressure and water level. The combination of the RCS heatup, due to residual RCS heat generation, and ECCS injected flow causes the pressure and level transients to rapidly turn around. Pressurizer water level then increases throughout the transient. At 7 min, the analysis assumes that the operatorf takes action to open a PORV (i.e., opens PORV block valve). A 40.0-s delay is assumed from initial operator action until the time one PORV is fully open. At this point in the transient, the operational PORV begins relieving water and steam from the pressurizer. This occurs prior to the pressurizer reaching a water-solid condition. Pressurizer pressure never rises above the PSV setpoint during the transient. Thus the analysis demonstrates that water relief through the PSVs is precluded.

15.2-50 REV 31 10/23

FNP-FSAR-15 15.2.14.3 Conclusions Results of the analysis show that the pressurizer will not reach a water-solid condition prior to the operator opening a PORV block valve and PORV and the RCS pressure dropping to the pressure where the PSRVs reseat, thereby precluding water relief through the PSVs.

15.2-51 REV 31 10/23

FNP-FSAR-15 REFERENCES

1. Gangloff, W. C., "An Evaluation of Anticipated Operational Transients in Westinghouse Pressurized-Water Reactors," WCAP-7468, May 1971.

2. Risher, D. H., Jr. and Barry, R. F., "TWINKLE - A Multi-Dimensional Neutron Kinetics Computer Code," WCAP-7979-A (Proprietary) and WCAP-8028-A (Nonproprietary),

January 1975.

3. Hargrove, H. G., "FACTRAN - A Fortran-IV Code for Thermal Transients in a UO2 Fuel Rod," WCAP-7908-A, December 1989.

4. Burnett, T. W. T., et al., "LOFTRAN Code Description," WCAP-7907-P-A (Proprietary) and WCAP-7907-A (Nonproprietary), April 1984.

5. Friedland, A. J. and Ray, S., "Revised Thermal Design Procedure," WCAP-11397-P-A, April 1989.

6. Mangan, M. A., "Overpressure Protection for Westinghouse Pressurized-Water Reactors," WCAP-7769 Rev. 1, June 1972.

7. Haessler, R. L., et al., "Methodology for the Analysis of the Dropped Rod Event," WCAP-11394-P-A (Proprietary) and WCAP-11395-A (Nonproprietary), January 1990.

8. 90AP*-G-0041, Letter from D. E. McKinnon to L. K. Mathews, "Joseph M. Farley Nuclear Plant, Units 1 and 2 Operating Procedure for Mode 4/5 Boron Dilution," with attachments, July 6, 1990.

9. ANSI/ANS-5.1-1979, "Decay Heat Power in Light Water Reactors," August 29, 1979.

10. ANSI/ANS-58.8-1984, Time Response Design Criteria for Nuclear Safety Related Operator Actions.

11. ANS-51.1/N18.2-1973, Nuclear Safety Criteria for the Design of Stationary Pressurized Water Reactor Plants.

12. Letter from C. O. Thomas (USNRC) to T. W. Schnatz (UGRA), Acceptance for Referencing of Licensing Topical Reports EPRI CCM-5, RETRAN-A Program for One Dimensional Transient Thermal Hydraulic Analysis of Complex Fluid Flow Systems, and C. E. Peterson, et al., RETRAN-02-A Program for Transient Thermal-Hydraulic Analysis of Complex Fluid Flow Systems, EPRI NP-1850-CCM, Rev. 6, December 1995.

13. Letter from A. C. Thandani to W. J. Boatwright (TU Electric), Acceptance for Use of RETRAN MOD005.0, November 1, 1991.

14. Huegel, D. S., et al., RETRAN-02 Modeling and Qualification for Westinghouse Pressurized Water Reactor Non-LOCA Safety Analyses, WCAP-14882-P-A (Proprietary), WCAP-15234-A, (Non-proprietary) April 1999.

15.2-52 REV 31 10/23

FNP-FSAR-15

15. Westinghouse Project letter ALA-09-121 dated 11/10/2009.

16. Sung, Y. X., et al., VIPRE-01 Modeling and Qualification for Pressurized Water Reactor Non-LOCA ,Thermal Hydraulic Safety Analysis, WCAP-14565-P-A (Proprietary) and WCAP-14565-A (Non-Proprietary), October 1999.

17. Linsuain, O., et al., Westinghouse Performance Analysis and Design Model (PAD5),

WCAP-17642-P-A, Revision 1, November 2017.

15.2-53 REV 31 10/23

FNP-FSAR-15 TABLE 15.2-1 (SHEET 1 OF 6)

TIME SEQUENCE OF EVENTS FOR CONDITION II EVENTS Accident Event Time (s)

Uncontrolled RCCA withdrawal Initiation of uncontrolled rod withdrawal 0.0 from a subcritical condition (78.75 pcm/s) reactivity insertion rate from 10-9 fraction of nominal power Power range high neutron flux low setpoint 9.6 reached Peak nuclear power occurs 9.7 Rods begin to fall into core 10.1 Peak heat flux occurs 11.4 Peak average clad temperature occurs 12.0 Peak average fuel temperature occurs 12.5 Uncontrolled RCCA bank withdrawal at power (full power with minimum feedback), DNB cases Case A Initiation of uncontrolled RCCA withdrawal at 0.0 maximum insertion rate (110 pcm/s)

Power range high neutron flux high setpoint 1.0 reached Rods begin to fall into core 1.5 Minimum DNBR occurs 2.7 Case B Initiation of uncontrolled RCCA withdrawal at 0.0 a small reactivity insertion rate (2 pcm/s)

OTT reactor trip setpoint reached 54.6 Rods begin to fall into core 57.3 Minimum DNBR occurs 56.6 REV 30 10/21

FNP-FSAR-15 TABLE 15.2-1 (SHEET 2 OF 6)

Accident Event Time (s)

Uncontrolled RCCA bank withdrawal at power (limiting overpressure case)

Initiation of uncontrolled RCCA withdrawal at 0.0 a small reactivity insertion rate (27 pcm/s)

High pressurizer pressure reactor trip setpoint 10.17 reached Rods begin to fall into the core 11.17 Maximum RCS pressure occurs 13.50 Uncontrolled boron dilution Dilution during refueling Dilution begins 0 Shutdown margin lost (if dilution continues) > 1100 Dilution during startup Power range - low setpoint reactor trip due to 0 dilution Shutdown margin lost (if dilution continues) > 900 Dilution during full-power operation Automatic reactor control Operator receives low-low rod insertion limit 0 alarm due to dilution Shutdown margin lost (if dilution continues) > 900 Manual reactor control Reactor trip on OTT due to dilution 0 Shutdown margin is lost (if dilution continues) > 900 Partial loss of forced reactor coolant flow All pumps initially in One pump begins coasting down 0.0 operation, one pump coasting down Low flow reactor trip 1.9 REV 30 10/21

FNP-FSAR-15 TABLE 15.2-1 (SHEET 3 OF 6)

Accident Event Time (s) 2.9 Rods begin to drop 2.9 Minimum DNBR occurs 3.7 Loss of external electrical load Minimum DNBR Case Loss of electrical load 0.0 Initiation of steam release from steam 10.8 generator safety valves OTT reactor trip setpoint reached 16.3 Rods begin to drop 18.3 Minimum DNBR occurs 19.0 Peak MSS Pressure Case Loss of electrical load 0.0 Initiation of steam release from steam 6.6 generator safety valves OTT reactor trip setpoint reached 15.0 Rods begin to drop 17.0 Peak MSS pressure occurs 21.3 Peak RCS Pressure Case Loss of electrical load 0.0 High pressurizer pressure reactor trip setpoint 6.5 reached Rods begin to drop 7.5 Peak RCS pressure occurs 9.7 Initiation of steam release from steam 10.4 generator safety valves Minimum DNBR occurs N/A REV 30 10/21

FNP-FSAR-15 TABLE 15.2-1 (SHEET 4 OF 6)

Accident Event Time (s)

Loss of normal feedwater Main feedwater flow stops 100.0 Low-low steam generator water level reactor 142.4 trip 19% NRS Rods begin to drop 144.4 Two motor-driven pumps begin to deliver 202.4 AFW (350 gpm)

Operator action to trip two RCPs 744.4 Core decay heat decreases to auxiliary 2300 feedwater heat removal capacity Peak water level in pressurizer occurs (post 2384 reactor trip)

Loss of all ac power to the Main feedwater flow stops 100 station auxiliaries Low-low steam generator water level reactor 142.4 trip 19% NRS Rods begins to drop 144.4 ac power is lost and RCPs begin to coast 146.4 down Two motor-driven pumps powered by diesel 202.4 generators, begin to deliver AFW (350 gpm)

Core decay heat decreases to auxiliary ~1800.0 feedwater heat removal capacity Peak water level in pressurizer occurs (post 2956.5 reactor trip)

REV 30 10/21

FNP-FSAR-15 TABLE 15.2-1 (SHEET 5 OF 6)

Accident Event Time (s)

Excessive feedwater flow at full One main feedwater control valve fails fully 0.0 power open High-high steam generator water level signal 46.9 generated Turbine trip occurs due to high-high steam 49.4 generator water level Minimum DNBR occurs 49.5 Reactor trip due to turbine trip (rod motion 51.4 begins)

Feedwater control valves fully closed 53.9 Excessive load increase 10% step-load increase 0.0 Manual reactor control (BOL) Equilibrium conditions reached 140.0 (approximate time)

Manual reactor control (EOL) 10% step-load increase 0.0 Equilibrium conditions reached 75.0 (approximate time)

Automatic reactor control 10% step-load increase 0.0 (BOL)

Equilibrium conditions reached 250.0 (approximate time)

Automatic reactor control 10% step-load increase 0.0 (EOL)

Equilibrium conditions reached 75.0 (approximate time)

REV 30 10/21

FNP-FSAR-15 TABLE 15.2-1 (SHEET 6 OF 6)

Accident Event Time (s)

Accidental depressurization of Inadvertent opening of one RCS safety valve 0.0 the RCS Low pressurizer pressure reactor trip setpoint 27.0 reached Rods begin to drop 29.0 Minimum DNBR occurs 29.6 Accidental depressurization of Inadvertent opening of one main steam 0.0 the main steam system safety or relief valve Borated water from the RWST reaches the 252.7 core Pressurizer empties 263.7 Criticality reached 445.7 Inadvertent operation of ECCS during power operation SI pumps begin injecting borated water, rods 0.0 begin drop Operator action to confirm one PORV 420.0 available One PORV is fully open 460.0 Pressurizer becomes water solid 461.5 REV 30 10/21

FNP-FSAR-15 TABLE 15.2-2

SUMMARY

OF BORON DILUTION ANALYSIS RESULTS AND ANALYSIS ASSUMPTIONS Flowrate Dilution Operator Mode of Operation (gal/min) Active Volume (ft3) Action Time (min)

Power operation Auto rod control 300 7706 21.1 Manual rod control 300 7706 19.6 Startup 300 7706 22.0 Refueling 300 3285.0 18.4 Other Important Analysis Assumptions Average Core Mode of Assumed Initial Assumed Critical Coolant Operation Boron Conc. (ppm) Boron Conc. (ppm) Temperature(°F)

Power operation Auto rod control 2100 1800 583.2 Manual rod control 2100 1800 583.2 Startup 2100 1800 554.5 Refueling 2200 1750 140.0 REV 30 10/21

FNP-FSAR-15 TABLE 15-2.3 PARAMETERS USED IN LOSS OF ac POWER ANALYSES Core thermal power 2831 MWt Steam generator tube leak rate prior to and during accident 1 gpm Offsite power Lost Fuel defects 1%(a)

Iodine partition factor in steam generators prior to and 0.1 during accident Secondary side iodine activity 0.1 Ci/gm dose equivalent I131 Duration of plant cooldown by secondary system after 8h accident Steam release from three steam generators 538,000 lb (0-2 h) 875,000 lb (2-8 h)

Feedwater flow to three steam generators 728,000 lb (0-2 h) 887,000 lb (2-8 h)

Meteorology Accident (see appendix 15)

OFFSITE DOSES FROM LOSS OF ac POWER Thyroid Dose (Rem) Whole Body Dose (Rem) B-skin Dose (Rem)

Site boundary (0-2 hour) 1.2 2 x 10-3 2 x 10-3 Low Population Zone (0-8 hour) 0.89 1 x 10-3 1 x 10-3

a. A pre-existing iodine spike of 60 Ci/gm dose equivalent I131 is assumed.

REV 21 5/08

REV 21 5/08 STARTUP FROM SUBCRITICAL JOSEPH M. FARLEY FOR 3-LOOP, 17 X 17 PLANT NUCLEAR PLANT NUCLEAR POWER UNIT 1 AND UNIT 2 FIGURE 15.2-1

REV 21 5/08 STARTUP FROM SUBCRITICAL FOR JOSEPH M. FARLEY 3-LOOP, 17 X 17 PLANT FACTRAN NUCLEAR PLANT HEAT FLUX UNIT 1 AND UNIT 2 FIGURE 15.2-2

REV 21 5/08 UNCONTROLLED ROD WITHDRAWAL JOSEPH M. FARLEY FROM A SUBCRITICAL CONDITION -

NUCLEAR PLANT TEMPERATURE VERSUS TIME UNIT 1 AND UNIT 2 FIGURE 15.2-3

REV 30 10/21 TRANSIENT RESPONSE FOR UNCONTROLLED JOSEPH M. FARLEY ROD WITHDRAWAL FROM FULL POWER NUCLEAR PLANT TERMINATED BY HIGH NEUTRON FLUX TRIP UNIT 1 AND UNIT 2 FIGURE 15.2-4

REV 30 10/21 TRANSIENT RESPONSE FOR UNCONTROLLED JOSEPH M. FARLEY ROD WITHDRAWAL FROM FULL POWER NUCLEAR PLANT TERMINATED BY HIGH NEUTRON FLUX TRIP UNIT 1 AND UNIT 2 FIGURE 15.2-5

REV 30 10/21 TRANSIENT RESPONSE FOR UNCONTROLLED JOSEPH M. FARLEY ROD WITHDRAWAL FROM FULL POWER NUCLEAR PLANT TERMINATED BY OVERTEMPERATURE DELTA-T TRIP UNIT 1 AND UNIT 2 FIGURE 15.2-6

REV 30 10/21 TRANSIENT RESPONSE FOR UNCONTROLLED JOSEPH M. FARLEY ROD WITHDRAWAL FROM FULL POWER NUCLEAR PLANT TERMINATED BY OVERTEMPERATURE DELTA-T TRIP UNIT 1 AND UNIT 2 FIGURE 15.2-7

REV 30 10/21 TRANSIENT RESPONSE FOR UNCONTROLLED JOSEPH M. FARLEY ROD WITHDRAWAL FROM AT POWER NUCLEAR PLANT CONDITIONS (LIMITING OVERPRESSURE CASE)

UNIT 1 AND UNIT 2 FIGURE 15.2-7A

REV 30 10/21 EFFECT OF REACTIVITY INSERTION JOSEPH M. FARLEY RATE ON MINIMUM DNBR FOR A ROD NUCLEAR PLANT WITHDRAWAL ACCIDENT FROM 100% POWER UNIT 1 AND UNIT 2 FIGURE 15.2-8

REV 30 10/21 EFFECT OF REACTIVITY INSERTION JOSEPH M. FARLEY RATE ON MINIMUM DNBR FOR A ROD NUCLEAR PLANT WITHDRAWAL ACCIDENT FROM 60% POWER UNIT 1 AND UNIT 2 FIGURE 15.2-9

REV 30 10/21 EFFECT OF REACTIVITY INSERTION JOSEPH M. FARLEY RATE ON MINIMUM DNBR FOR A ROD NUCLEAR PLANT WITHDRAWAL ACCIDENT FROM 10% POWER UNIT 1 AND UNIT 2 FIGURE 15.2-10A

REV 30 10/21 EFFECT OF REACTIVITY INSERTION JOSEPH M. FARLEY RATE AND INITIAL POWER LEVEL ON PEAK RCS NUCLEAR PLANT PRESSURE FOR A ROD WITHDRAWAL ACCIDENT UNIT 1 AND UNIT 2 FIGURE 15.2-10B

REV 30 10/21 EFFECT OF REACTIVITY INSERTION JOSEPH M. FARLEY RATE AND INITIAL POWER LEVEL ON PEAK RCS TRIP FUNCTION NUCLEAR PLANT FOR A ROD WITHDRAWAL ACCIDENT (OVERPRESSURE CASE)

UNIT 1 AND UNIT 2 FIGURE 15.2-10C

REV 21 5/08 TRANSIENT RESPONSE TO A DROPPED ROD JOSEPH M. FARLEY NUCLEAR PLANT CLUSTER CONTROL ASSEMBLY UNIT 1 AND UNIT 2 FIGURE 15.2-11

REV 30 10/21 ALL LOOPS INITIALLY OPERATING, JOSEPH M. FARLEY ONE LOOP COASTING DOWN -

NUCLEAR PLANT FLOW COASTDOWNS VERSUS TIME UNIT 1 AND UNIT 2 FIGURE 15.2-12

REV 30 10/21 ALL LOOPS INITIALLY OPERATING, JOSEPH M. FARLEY ONE LOOP COASTING DOWN -

NUCLEAR PLANT NUCLEAR POWER VERSUS TIME UNIT 1 AND UNIT 2 FIGURE 15.2-13

REV 30 10/21 ALL LOOPS INITIALLY OPERATING, JOSEPH M. FARLEY ONE LOOP COASTING DOWN -

NUCLEAR PLANT PRESSURIZER PRESSURE VERSUS TIME UNIT 1 AND UNIT 2 FIGURE 15.2-14

DELETED REV 30 10/21 ALL LOOPS INITIALLY OPERATING, JOSEPH M. FARLEY ONE LOOP COASTING DOWN - AVERAGE NUCLEAR PLANT UNIT 1 AND UNIT 2 CHANNEL HEAT FLUX VERSUS TIME FIGURE 15.2-15

REV 30 10/21 ALL LOOPS INITIALLY OPERATING, ONE JOSEPH M. FARLEY LOOP COASTING DOWN - HOT CHANNEL NUCLEAR PLANT HEAT FLUX VERSUS TIME UNIT 1 AND UNIT 2 FIGURE 15.2-16

REV 30 10/21 ALL LOOPS INITIALLY OPERATING, JOSEPH M. FARLEY ONE LOOP COASTING DOWN -

NUCLEAR PLANT DNBR VERSUS TIME UNIT 1 AND UNIT 2 FIGURE 15.2-17

REV 21 5/08 STARTUP OF AN INACTIVE REACTOR JOSEPH M. FARLEY NUCLEAR PLANT COOLANT LOOP - 17 X 17 CORE UNIT 1 AND UNIT 2 FIGURE 15.2-18 (SHEET 1 OF 3)

REV 21 5/08 STARTUP OF AN INACTIVE REACTOR JOSEPH M. FARLEY NUCLEAR PLANT COOLANT LOOP - 17 X 17 CORE UNIT 1 AND UNIT 2 FIGURE 15.2-18 (SHEET 2 OF 3)

REV 21 5/08 STARTUP OF AN INACTIVE REACTOR JOSEPH M. FARLEY NUCLEAR PLANT COOLANT LOOP - 17 X 17 CORE UNIT 1 AND UNIT 2 FIGURE 15.2-18 (SHEET 3 OF 3)

REV 30 10/21 JOSEPH M. FARLEY LOSS-OF-LOAD ACCIDENT MINIMUM DNBR CASE NUCLEAR PLANT UNIT 1 AND UNIT 2 FIGURE 15.2-19 (SHEET 1 OF 3)

REV 30 10/21 JOSEPH M. FARLEY LOSS-OF-LOAD ACCIDENT MINIMUM DNBR CASE NUCLEAR PLANT UNIT 1 AND UNIT 2 FIGURE 15.2-19 (SHEET 2 OF 3)

REV 30 10/21 JOSEPH M. FARLEY LOSS-OF-LOAD ACCIDENT MINIMUM DNBR CASE NUCLEAR PLANT UNIT 1 AND UNIT 2 FIGURE 15.2-19 (SHEET 3 OF 3)

REV 30 10/21 JOSEPH M. FARLEY LOSS-OF-LOAD ACCIDENT PEAK MSS PRESSURE CASE NUCLEAR PLANT UNIT 1 AND UNIT 2 FIGURE 15.2-20 (Sheet 1 of 3)

REV 30 10/21 JOSEPH M. FARLEY LOSS-OF-LOAD ACCIDENT PEAK MSS PRESSURE CASE NUCLEAR PLANT UNIT 1 AND UNIT 2 FIGURE 15.2-20 (Sheet 2 of 3)

REV 30 10/21 JOSEPH M. FARLEY LOSS-OF-LOAD ACCIDENT PEAK MSS PRESSURE CASE NUCLEAR PLANT UNIT 1 AND UNIT 2 FIGURE 15.2-20 (Sheet 3 of 3)

REV 30 10/21 JOSEPH M. FARLEY LOSS-OF-LOAD ACCIDENT RCS PEAK PRESSURE CASE NUCLEAR PLANT UNIT 1 AND UNIT 2 FIGURE 15.2-21 (SHEET 1 OF 3)

REV 30 10/21 JOSEPH M. FARLEY LOSS-OF-LOAD ACCIDENT RCS PEAK PRESSURE CASE NUCLEAR PLANT UNIT 1 AND UNIT 2 FIGURE 15.2-21 (SHEET 2 OF 3)

REV 30 10/21 JOSEPH M. FARLEY LOSS-OF-LOAD ACCIDENT RCS PEAK PRESSURE CASE NUCLEAR PLANT UNIT 1 AND UNIT 2 FIGURE 15.2-21 (SHEET 3 OF 3)

DELETED REV 30 10/21 LOSS-OF-LOAD ACCIDENT WITHOUT JOSEPH M. FARLEY PRESSURIZER SPRAY AND NUCLEAR PLANT POWER-OPERATED RELIEF VALVE - BOL UNIT 1 AND UNIT 2 FIGURE 15.2-22

DELETED REV 30 10/21 LOSS-OF-LOAD ACCIDENT WITHOUT JOSEPH M. FARLEY PRESSURIZER SPRAY AND NUCLEAR PLANT POWER-OPERATED RELIEF VALVE - BOL UNIT 1 AND UNIT 2 FIGURE 15.2-23

DELETED REV 30 10/21 LOSS-OF-LOAD ACCIDENT WITHOUT JOSEPH M. FARLEY PRESSURIZER SPRAY AND NUCLEAR PLANT POWER-OPERATED RELIEF VALVE - BOL UNIT 1 AND UNIT 2 FIGURE 15.2-24

DELETED REV 30 10/21 LOSS-OF-LOAD ACCIDENT WITHOUT JOSEPH M. FARLEY PRESSURIZER SPRAY AND NUCLEAR PLANT POWER-OPERATED RELIEF VALVE - BOL UNIT 1 AND UNIT 2 FIGURE 15.2-25

REV 30 10/21 LOSS OF NORMAL FEEDWATER JOSEPH M. FARLEY PRESSURIZER PRESSURE AND WATER NUCLEAR PLANT VOLUME VERSUS TIME UNIT 1 AND UNIT 2 FIGURE 15.2-26 (SHEET 1 OF 4)

REV 30 10/21 LOSS OF NORMAL FEEDWATER JOSEPH M. FARLEY NUCLEAR POWER AND CORE HEAT FLUX NUCLEAR PLANT VERSUS TIME UNIT 1 AND UNIT 2 FIGURE 15.2-26 (SHEET 2 OF 4)

REV 30 10/21 LOSS OF NORMAL FEEDWATER JOSEPH M. FARLEY LOOP 1, 2, AND 3 HOT AND COLD LEG NUCLEAR PLANT TEMPERATURES VERSUS TIME UNIT 1 AND UNIT 2 FIGURE 15.2-26 (SHEET 3 OF 4)

REV 30 10/21 LOSS OF NORMAL FEEDWATER JOSEPH M. FARLEY STEAM GENERATOR PRESSURE AND LEVEL NUCLEAR PLANT VERSUS TIME UNIT 1 AND UNIT 2 FIGURE 15.2-26 (SHEET 4 OF 4)

REV 30 10/21 LOSS OF ALL AC POWER TO THE STATION JOSEPH M. FARLEY AUXILIARIES - PRESSURIZER PRESSURE NUCLEAR PLANT AND WATER VOLUME VERSUS TIME UNIT 1 AND UNIT 2 FIGURE 15.2-27 (SHEET 1 OF 4)

REV 30 10/21 LOSS OF ALL AC POWER TO THE STATION JOSEPH M. FARLEY AUXILIARIES NUCLEAR POWER AND NUCLEAR PLANT CORE HEAT FLUX VERSUS TIME UNIT 1 AND UNIT 2 FIGURE 15.2-27 (SHEET 2 OF 4)

REV 30 10/21 LOSS OF ALL AC POWER TO THE STATION JOSEPH M. FARLEY AUXILIARIES LOOP 1, 2, & 3 HOT AND NUCLEAR PLANT COLD LEG TEMPERATURES VERSUS TIME UNIT 1 AND UNIT 2 FIGURE 15.2-27 (SHEET 3 OF 4)

REV 30 10/21 LOSS OF ALL AC POWER TO THE STATION JOSEPH M. FARLEY AUXILIARIES STEAM GENERATOR NUCLEAR PLANT PRESSURE AND LEVEL VERSUS TIME UNIT 1 AND UNIT 2 FIGURE 15.2-27 (SHEET 4 OF 4)

REV 30 10/21 FEEDWATER CONTROL VALVE MALFUNCTION-JOSEPH M. FARLEY NUCLEAR POWER AND CORE HEAT FLUX NUCLEAR PLANT VERSUS TIME UNIT 1 AND UNIT 2 FIGURE 15.2-28 (SHEET 1 OF 3)

REV 30 10/21 FEEDWATER CONTROL VALVE JOSEPH M. FARLEY MALFUNCTION-PRESSURIZER PRESSURE NUCLEAR PLANT AND LOOP T VERSUS TIME UNIT 1 AND UNIT 2 FIGURE 15.2-28 (SHEET 2 OF 3)

REV 30 10/21 FEEDWATER CONTROL VALVE MALFUNCTION-JOSEPH M. FARLEY CORE AVERAGE TEMPERATURE AND NUCLEAR PLANT DNBR VERSUS TIME UNIT 1 AND UNIT 2 FIGURE 15.2-28 (SHEET 3 OF 3)

REV 21 5/08 EXCESSIVE LOAD INCREASE WITHOUT CONTROL JOSEPH M. FARLEY ACTION - BOL - DNBR, NUCLEAR POWER, AND NUCLEAR PLANT PRESSURIZER PRESURE AS A FUNCTION OF TIME UNIT 1 AND UNIT 2 FIGURE 15.2-29

REV 21 5/08 EXCESSIVE LOAD INCREASE WITHOUT CONTROL JOSEPH M. FARLEY ACTION - BOL - TAVG AND PRESSURIZER NUCLEAR PLANT VOLUME AS A FUNCTION OF TIME UNIT 1 AND UNIT 2 FIGURE 15.2-30

REV 21 5/08 EXCESSIVE LOAD INCREASE WITHOUT CONTROL JOSEPH M. FARLEY ACTION - EOL - DNBR, NUCLEAR POWER AND NUCLEAR PLANT PRESSURIZER PRESSURE AS A FUNCTION OF TIME UNIT 1 AND UNIT 2 FIGURE 15.2-31

REV 21 5/08 EXCESSIVE LOAD INCREASE WITHOUT CONTROL JOSEPH M. FARLEY ACTION - EOL - TAVG AND PRESSURIZER NUCLEAR PLANT VOLUME AS A FUNCTION OF TIME UNIT 1 AND UNIT 2 FIGURE 15.2-32

REV 21 5/08 EXCESSIVE LOAD INCREASE WITH REACTOR JOSEPH M. FARLEY CONTROL - BOL - DNBR, NUCLEAR POWER, AND NUCLEAR PLANT PRESSURIZER PRESSURE AS A FUNCTION OF TIME UNIT 1 AND UNIT 2 FIGURE 15.2-33

REV 21 5/08 EXCESSIVE LOAD INCREASE WITH REACTOR JOSEPH M. FARLEY CONTROL - BOL - TAVG AND PRESSURIZER NUCLEAR PLANT VOLUME AS A FUNCTION OF TIME UNIT 1 AND UNIT 2 FIGURE 15.2-34

REV 21 5/08 EXCESSIVE LOAD INCREASE WITH REACTOR CONTROL -

JOSEPH M. FARLEY EOL - DNBR, NUCLEAR POWER, AND PRESSURIZER NUCLEAR PLANT PRESSURE AS A FUNCTION OF TIME UNIT 1 AND UNIT 2 FIGURE 15.2-35

REV 21 5/08 EXCESSIVE LOAD INCREASE WITH REACTOR JOSEPH M. FARLEY CONTROL - EOL - TAVG AND PRESSURIZER NUCLEAR PLANT VOLUME AS A FUNCTION OF TIME UNIT 1 AND UNIT 2 FIGURE 15.2-36

REV 30 10/21 ACCIDENTAL RCS DEPRESSURIZATION JOSEPH M. FARLEY NUCLEAR PLANT NUCLEAR POWER VERSUS TIME UNIT 1 AND UNIT 2 FIGURE 15.2-37

REV 30 10/21 ACCIDENTAL RCS DEPRESSURIZATION JOSEPH M. FARLEY TAVG AND PRESSURIZER PRESSURE NUCLEAR PLANT VERSUS TIME UNIT 1 AND UNIT 2 FIGURE 15.2-38

REV 30 10/21 ACCIDENTAL RCS DEPRESSURIZATION JOSEPH M. FARLEY NUCLEAR PLANT DNBR VERSUS TIME UNIT 1 AND UNIT 2 FIGURE 15.2-39

REV 21 5/08 VARIATION OF KEFF WITH CORE JOSEPH M. FARLEY NUCLEAR PLANT TEMPERATURE UNIT 1 AND UNIT 2 FIGURE 15.2-40 (SHEET 1 OF 2)

REV 21 5/08 JOSEPH M. FARLEY DOPPLER POWER FEEDBACK NUCLEAR PLANT UNIT 1 AND UNIT 2 FIGURE 15.2-40 (SHEET 2 OF 2)

REV 21 5/08 SAFETY INJECTION FLOWRATE JOSEPH M. FARLEY NUCLEAR PLANT VS. RCS PRESSURE UNIT 1 AND UNIT 2 FIGURE 15.2-41

REV 21 5/08 STEAM LINE BREAK TRANSIENT CREDIBLE JOSEPH M. FARLEY NUCLEAR PLANT BREAK, FAILED OPEN VALVE UNIT 1 AND UNIT 2 FIGURE 15.2-42 (SHEET 1 OF 3)

REV 21 5/08 STEAM LINE BREAK TRANSIENT CREDIBLE JOSEPH M. FARLEY NUCLEAR PLANT BREAK, FAILED OPEN VALVE UNIT 1 AND UNIT 2 FIGURE 15.2-42 (SHEET 2 OF 3)

REV 21 5/08 STEAM LINE BREAK TRANSIENT CREDIBLE JOSEPH M. FARLEY NUCLEAR PLANT BREAK, FAILED OPEN VALVE UNIT 1 AND UNIT 2 FIGURE 15.2-42 (SHEET 3 OF 3)

REV 30 10/21 SPURIOUS ACTUATION OF THE SI SYSTEM JOSEPH M. FARLEY NUCLEAR POWER AND STEAM FLOW NUCLEAR PLANT VERSUS TIME UNIT 1 AND UNIT 2 FIGURE 15.2-43

REV 30 10/21 SPURIOUS ACTUATION OF THE SI SYSTEM JOSEPH M. FARLEY PRESSURIZER PRESSURE AND PRESSURIZER WATER NUCLEAR PLANT VOLUME VERSUS TIME UNIT 1 AND UNIT 2 FIGURE 15.2-44

DELETED REV 30 10/21 SPURIOUS ACTUATION OF THE SI SYSTEM JOSEPH M. FARLEY CORE Tavg AND DNBR VERSUS TIME NUCLEAR PLANT UNIT 1 AND UNIT 2 FIGURE 15.2-45

REV 21 5/08 SPURIOUS ACTUATION OF SAFETY JOSEPH M. FARLEY NUCLEAR PLANT INJECTION SYSTEM AT ZERO POWER UNIT 1 AND UNIT 2 FIGURE 15.2-46

FNP-FSAR-15 15.3 CONDITION III - INFREQUENT INCIDENTS By definition, Condition III occurrences are faults which may occur very infrequently during the life of the plant. The NRC acceptance criteria for Condition III events are that (1) only a small fraction of the fuel rods will fail, although sufficient fuel damage might occur to preclude resumption of the operation for a considerable outage time and (2) the release of radioactivity will not be sufficient to interrupt or restrict public use of these areas beyond the exclusion radius (i.e., 10 CFR 100 limits are not exceeded). A Condition III fault will not, by itself, generate a Condition IV fault or result in a consequential loss of function of the reactor coolant system (RCS) or containment barriers. The latter acceptance criteria require, in part, maintaining the RCS 2750 psia and containment leak rate 0.15% per day, respectively. For the purposes of this report, the following faults have been grouped into this category:

A. Loss of reactor coolant from small ruptured pipes or from cracks in large pipes which actuate emergency core cooling system (ECCS).

B. Minor secondary system pipe break.

C. Inadvertent loading of a fuel assembly into an improper position.

D. Complete loss of forced reactor coolant flow.

E. Waste gas decay tank rupture.

F. Single rod cluster control assembly (RCCA) withdrawal at full power.

15.3.1 LOSS OF REACTOR COOLANT FROM SMALL RUPTURED PIPES OR FROM CRACKS IN LARGE PIPES WHICH ACTUATE EMERGENCY CORE COOLING SYSTEM This section presents results of the small break loss-of-coolant accident (LOCA) which are in conformance with the NRC acceptance criteria found in 10 CFR 50.46 (reference 1) and Appendix K of 10 CFR 50.

15.3.1.1 Identification of Causes and Accident Description A LOCA is defined as a rupture of the RCS piping or of any line connected to the system.

Ruptures of small cross-sections will cause expulsion of the coolant at a rate which can be accommodated by the high-head SI pumps and which would maintain an operational water level in the pressurizer permitting the operator to execute an orderly shutdown. The coolant which would be released to the containment contains the fission products existing in it.

The maximum break size for which the normal makeup system can maintain the pressurizer level can be obtained by comparing the calculated flow from the RCS through the postulated break against the high-head SI makeup flow at normal RCS pressure; i.e., 2250 psia.

15.3-1 REV 30 10/21

FNP-FSAR-15 A small break, as considered in this section, is defined as a rupture of the RCS piping with a cross-sectional area < 1.0 ft2, in which the normally operating charging system flow is not sufficient to sustain pressurizer level and pressure.

For small break LOCAs, the most limiting single active failure is the one that results in the minimum ECCS flow delivered to the RCS. This has been determined to be the loss of an emergency power train which results in the loss of one complete train of ECCS components.

This means that credit can be taken for only one high-head SI pump and one residual heat removal (RHR) (low-head) pump. During the small break transient, one ECCS train is assumed to start and deliver flow through the injection lines (one for each loop). For the 2-in., 2.25-in.,

2.5-in., 2.75-in., 3-in., 3.25-in., and 4-in. small break LOCA analysis cases, the broken loop injection line is assumed to spill to RCS backpressure. For the 6-in. small break LOCA analysis case, which has the break larger than the SI line (inner diameter = 5.189 in.), the broken loop injection line is assumed to spill to containment backpressure.

Should a small break LOCA occur, depressurization of the RCS causes fluid to flow into the loops from the pressurizer, resulting in a pressure and level decrease in the pressurizer. The reactor trip signal subsequently occurs when the pressurizer low pressure trip setpoint is reached. Loss-of-offsite-power, including a loss of ac power to the station auxiliaries (LOOP), is assumed to occur coincident with reactor trip on the affected unit. A safety injection (SI) signal is generated when the pressurizer low pressure SI setpoint is reached. After the SI setpoint is reached, an additional 27-s delay ensues. This delay conservatively models the 2-s instrumentation delay, the full 15-s diesel generator start time, plus the up to 10 s necessary to align the appropriate valves and increase the pumps to full speed (diesel generator start on the SI signal versus LOOP is a conservative modeling assumption). These countermeasures will limit the consequences of the accident in two ways:

A. Reactor trip and borated water injection supplement void formation in causing rapid reduction of nuclear power to a residual level corresponding to the delayed fission and fission product decay. No credit is taken in the LOCA analysis for the boron content of the injection water; however, an average RCS/sump mixed boron concentration is calculated to ensure that the post-LOCA core remains subcritical.

In addition, in the small break LOCA analysis, credit is taken for the insertion of RCCAs subsequent to the reactor trip signal, while assuming the most reactive RCCA is stuck in the full-out position.

B. Injection of borated water ensures sufficient flooding of the core to prevent excessive clad temperatures.

Before the break occurs, the plant is assumed to be in an equilibrium condition, i.e., the heat generated in the core is being removed via the secondary system. During the earlier part of the small break transient, the effect of the break flow is not strong enough to overcome the flow maintained by the reactor coolant pumps (RCPs) through the core as the pumps coast down following LOOP. Upward flow through the core is maintained; however, the core flow is not sufficient to prevent a partial core uncovery. Subsequently, the ECCS provides sufficient core flow to cover the core.

15.3-2 REV 30 10/21

FNP-FSAR-15 During blowdown, heat from fission product decay, hot internals, and the vessel continue to be transferred to the RCS. The heat transfer between the RCS and the secondary system may be in either direction depending on the relative temperatures. In this case, continued heat addition to the secondary results in increased secondary system pressure which leads to steam relief via the atmospheric relief valve and/or safety valves. Makeup to the secondary is automatically provided by the auxiliary feedwater (AFW) pumps. The SI signal isolates normal feedwater flow by closing the main feedwater control and bypass valves. LOOP, assumed concurrent with reactor trip, initiates AFW flow by starting the AFW pumps. The secondary flow aids in the reduction of RCS pressure. However, this analysis conservatively models AFW delivery 60 s following SI. Also due to the LOOP assumption, the RCPs are assumed to be tripped at the time of reactor trip during the accident and the effects of pump coastdown are included in the blowdown analyses.

When the RCS depressurizes to approximately 600 psia, the cold leg accumulators begin to inject borated water into the reactor coolant loops; however, the vessel mixture level starts to increase to cover the fuel with ECCS pumped injection before the accumulator injection for most breaks.

15.3.1.2 Analysis of Effects and Consequences 15.3.1.2.1 Method of Analysis For small breaks (< 1.0 ft2) the NOTRUMP digital computer code (references 2, 3, and 13) is employed to calculate the transient depressurization of the RCS as well as to describe the mass and energy of the fluid flow through the break. The NOTRUMP computer code is a one-dimensional general network code incorporating a number of advanced features. Among these are calculation of thermal nonequilibrium in all fluid volumes, flow regime-dependent drift flux calculations with counter-current flooding limitations, mixture level tracking logic in multiple-stacked fluid nodes, and regime-dependent heat transfer correlations. Also, SI into the broken loop is modeled using the COSI condensation model (reference 13). The NOTRUMP small break LOCA ECCS evaluation model was developed to determine the RCS response to design basis small break LOCAs and to address NRC concerns expressed in NUREG-0611 (reference 4), "Generic Evaluation of Feedwater Transients and Small Break Loss-of-Coolant Accidents in Westinghouse-Designed Operating Plants."

The RCS model is nodalized into volumes interconnected by flowpaths. The broken loop is modeled explicitly, while the intact loops are lumped into a second loop. Transient behavior of the system is determined from the governing conservation equations of mass, energy, and momentum. The multinode capability of the program enables explicit, detailed spatial representation of various system components which, among other capabilities, enable a proper calculation of the behavior of the loop seal during a LOCA. The reactor core is represented as heated control volumes with associated phase separation models to permit transient mixture height calculations. Detailed descriptions of the NOTRUMP code and the evaluation model are provided in references 2, 3, and 13.

15.3-3 REV 30 10/21

FNP-FSAR-15 Peak clad temperature calculations are performed with the LOCTA-IV code (reference 5) using the NOTRUMP calculated core pressure, fuel rod power history, uncovered core steam flow, and mixture heights as boundary conditions (see figure 15.3-1). Figure 15.3-2 depicts the hot rod axial power shape used to perform the small break LOCA analysis. This shape was chosen because it represents a distribution with power concentrated in the upper regions of the core.

Such a distribution is limiting for small break LOCAs because it minimizes coolant level swell while maximizing vapor superheating and fuel rod heat generation at the uncovered elevations.

The small break LOCA analysis assumes the core continues to operate at full power until the control rods are completely inserted; however, for conservatism, it is assumed that the most reactive RCCA does not insert.

After the small break LOCA is initiated, reactor trip occurs due to a low pressurizer pressure signal (1840 psia). Soon after the reactor trip signal is generated, the SI actuation signal is generated due to a low pressurizer pressure (1700 psia). SI systems consist of gas pressurized accumulator tanks and pumped injection systems. The small break LOCA analysis assumed nominal accumulator water volume with a cover gas pressure of 600 psia (the minimum pressure allowed by the Technical Specifications). Minimum ECCS availability is assumed for the analysis at the maximum reactor water storage tank (RWST) temperature. Assumed pumped SI characteristics as a function of RCS pressure used as boundary conditions in the analysis are shown in figure 15.3-3A and table 15.3-5A (2-in., 2.25-in., 2.5-in., 2.75-in., 3-in.,

3.25-in., and 4-in. cases) and figure 15.3-3B and table 15.3-5B (6-in. case). The SI flowrates presented are based on pump performance curves degraded 10 percent from the design head and an assumed charging system branch line cold leg imbalance of 20 (-5, +15) gal/min. The effect of flow from the RHR pumps is not considered in the 2-in., 2.25-in., 2.5-in., 2.75-in., 3-in.,

3.25-in., and 4-in. cases since their shutoff head is lower than the RCS pressure during the time portion of the transients considered here. SI is delayed 27 s after the occurrence of the low pressure condition. This accounts for signal initiation (2 s), diesel generator startup, and emergency power bus loading consistent with the assumed LOOP with reactor trip (15 s), as well as the delay involved in aligning the valves and bringing the pumps up to speed (10 s). The small break LOCA analysis also assumed that the rod drop time is 2.7 s.

On the secondary side, a main feedwater isolation signal is conservatively assumed to be generated in conjunction with a reactor trip with a 2-s signal delay and a 5-s valve closure time.

(At Farley, feedwater isolation is initiated by the SI signal.) The AFW pumps are assumed to start and deliver full flow (one turbine-driven and one motor-driven pump) 60 s after SI. (At Farley, the motor-driven AFW pump is started by the ESF bus loss of voltage (i.e., LOSP signal), and the turbine-driven AFW pump is started by the RCP bus loss of voltage.) The AFW enthalpy is assumed to be that of the main feedwater until after an additional bounding feedwater purge volume (140 ft3/loop) has been displaced.

15.3.1.2.2 Results 15.3.1.2.2.1 Limiting Break Case. This section presents results of the limiting small break LOCA analysis (as determined by the highest calculated peak clad temperature) from a range of break sizes and RCS average temperatures at full power.

15.3-4 REV 30 10/21

FNP-FSAR-15 NUREG-0737 (reference 6),Section II.K.3.31, required a plant-specific small break LOCA analysis using an evaluation model revised per Section II.K.3.30. In accordance with NRC Generic Letter 83-35 (reference 7), generic analyses using NOTRUMP (references 2 and 3) were performed and are presented in WCAP-11145 (reference 8). Those results demonstrate that in a comparison of cold leg, hot leg, and pump suction leg break locations, the cold leg break location is limiting. An eight-break spectrum analysis performed at high RCS average temperature demonstrates that the limiting break is a 2.75-in. diameter cold leg break. This conclusion is also applicable at low RCS average temperature. The results of the 2-in., 2.25-in.,

2.5-in., 2.75-in., 3-in., 3.25-in., and 4-in. breaks are based on the Unit 2 analysis, while the results of the 6-in. break are based on the Unit 1 analysis. However, the results and conclusions apply to both units since the two units are hydraulically similar. A list of input assumptions used in the analyses is provided in table 15.3-2. The results of the analyses are summarized in table 15.3-2A, while the key transient event times are listed in table 15.3-2B.

The peak clad temperature in a small break LOCA is largely a function of the depth of core uncovery which in turn is dependent on the overall mass inventory and, ultimately, the primary side pressure.

Figures 15.3-4A through 15.3-11A show the following parameters, respectively, for the limiting 2.75-in. break transient for high RCS average temperature.

• RCS pressure.

• Core mixture level.

• Clad temperature transient at peak clad temperature elevation.

• Core exit steam flow.

• Clad surface heat transfer coefficient at the peak clad temperature elevation.

• Fluid temperature at the peak clad temperature elevation.

• Cold leg break mass flowrate.

• ECCS pumped injection flowrate.

During the initial period of the small break transient the effect of the break flowrate is not strong enough to overcome the flowrate maintained by the RCPs as the pumps coast down following LOOP. Normal upward flow is maintained through the core and core heat is adequately removed. At the low heat generation rates following reactor trip, the fuel rods continue to be well cooled as long as the core is covered by a two-phase mixture level. From the clad temperature transient for the limiting break (2.75-in. break) calculation shown in figure 15.3-6A, it is seen that the peak clad temperature occurs near the time when the core is most deeply uncovered and the top of the core is steam cooled. This time is accompanied by the highest vapor superheating above the mixture level. The peak clad temperature attained during the transient at RSG conditions with high RCS average temperature was 1903.6°F. This result is applicable to both Units 1 and 2 since both units are hydraulically similar. At the time the 15.3-5 REV 30 10/21

FNP-FSAR-15 transient was terminated, the safety mass flowrate that was delivered to the RCS exceeded the mass flowrate that was delivered to the RCS exceeded the mass flowrate out the break in each case, with the exception of the 4-in. and 6-in. break cases. For these breaks the clad temperature transient has ended and the RCS mass inventory is increasing. Although the core mixture level has not yet covered the entire core (see figure 15.3-5A), there is no longer a concern of exceeding the 10 CFR 50.46 criteria since the RCS pressure is gradually decaying and there is a net mass inventory gain. The decreasing RCS pressure results in greater SI flow as well as reduced break flow. As the RCS inventory continues to gradually increase, the core mixture level will continue to increase and the fuel clad temperatures will continue to decline.

Additionally, only one core channel is modeled in the NOTRUMP computer code since the core flowrate during a small break LOCA is relatively slow. This provides enough time to maintain flow equilibrium between fuel assemblies (i.e., no crossflow). Therefore, hydraulic resistance mismatch is not a factor for small break LOCA, it is not necessary to perform a small break LOCA evaluation for transition cores, and it is sufficient to reference the small break LOCA for the complete core of the VANTAGE 5 fuel design as bounding for all transition cycles. Further, the results documented herein pertain to both Zirc-4 and ZIRLO clad fuel (see reference 12).

However, a minimum burnup of 6000 MWD/MTU was assumed for Zirc-4 clad fuel to ensure it remains nonlimiting.

Reference 14 concluded that the LOCA ZIRLO models are acceptable to Optimized ZIRLO cladding in small break analyses, and that no additional calculations are necessary for evaluating the use of Optimized ZIRLO cladding provided plant specific ZIRLO calculations were previously performed.

15.3.1.2.2.2 Additional Break Cases. Studies documented in reference 3 determined that the limiting small break size occurred for breaks < 10 in. in diameter. To ensure that the worst possible small break size has been identified, calculations were performed for a spectrum of breaks (2.0, 2.25, 2.5, 3.0, 3.25, 4, and 6 in.) in addition to the limiting 2.75-in. break. (The 6-in.

break case conservatively models a break in the SI line (inner diameter = 5.189 in.)) The results of these calculations are shown in the Results table (15.3-2A) and the Sequence of Events table (15.3-2B).

For all cases analyzed, plots of the following transient parameters are presented:

• RCS pressure.

• Core mixture level.

• Clad temperature transient at peak clad temperature elevation.

The plots at high RCS average temperature are shown in figures 15.3-4B through 15.3-6B for the 2-in. break, figures 15.3-4C through 15.3-6C for the 2.25-in. break, figures 15.3-4D through 15.3-6D for the 2.5-in. break, figures 15.3-4E through 15.3-6E for the 3-in. break, figures 15.3-4F through 15.3-6F for the 3.25-in. break, figures 15.3-4G through 15.3-6G for the 4-in. break, and figures 15.3-4H through 15.3-6H for the 6-in. break. As seen in table 15.3-2A, the peak clad temperatures in all cases were calculated to be less than that for the 2.75-in. break at high 15.3-6 REV 30 10/21

FNP-FSAR-15 RCS average temperature. The plots for the Unit 2 3-in. break at high RCS average temperature are shown in figures 15.3-4G through 15.3-6G. As seen in table 15.3-2A, the peak clad temperature in this case was calculated to be less than that for the Unit 2 3-inch break at low RCS average temperature.

15.3.1.3 Conclusions Analyses presented in this subsection show that one high-head SI pump and one residual heat removal pump, together with the accumulators, provide sufficient core flooding to keep the calculated peak clad temperatures below the NRC acceptance criteria of 2200 ºF, as specified by 10 CFR 50.46. Adequate protection is, therefore, afforded by the ECCS in the event of a small break LOCA.

15.3.1.3.1 Breaks During Startup and Shutdown During startup and shutdown, studies have shown that for breaks < 2 in., manual initiation of SI may be required. The studies also show that ample time exists for the operator to take such action (see figures 15.3-26, 15.3-27, 15.3-28, and 15.3-29).

15.3.1.3.2 NUREG-0737 Item II.K.3.30 of NUREG-0737 outlines the commission requirements for the industry to demonstrate that its small break LOCA methods continue to comply with the NRC acceptance criteria of Appendix K to 10 CFR 50. The technical issues to be addressed were listed in NUREG-0611, including comparison with semiscale experimental test results.

In response to Item II.K.3.30, the Westinghouse Owners Group (WOG) elected to reference the NOTRUMP code as the new licensing basis for the small break LOCA model. The NOTRUMP code and methodology are described in WCAP-10079(2) and WCAP-10054(3). The NRC staff reviewed and approved NOTRUMP as the new licensing tool for calculating small break LOCA response for Westinghouse plant designs. The NRC staff further concluded that the WOG actions had met the requirements of Item II.K.3.30 of NUREG-0737 and that the responses to NUREG-0611 concerns, as calculated in the NRC's TMI Action Item II.K.3.30 SER, were found acceptable.

Item II.K.3.31 of NUREG-0737 required that each license holder or applicant submit a new small break analysis using the model approved under Item II.K.3.30. NRC Generic Letter 83-35 dated November 2, 1983, provided clarification of the requirements of Item II.K.3.31 by allowing license holders and applicants to comply on a generic basis by demonstrating that the WFLASH analyses are conservative when compared to analyses performed using NOTRUMP. As a result, the WOG submitted WCAP-11145(8) which contained generic comparisons to WFLASH analyses for various plant types, including comparisons for 3-loop plants of the design similar to Plant Farley. Initially, Alabama Power Company chose to reference WCAP-11145 to resolve Item II.K.3.31 and received NRC approval by letter dated January 16, 1987. However, the small break LOCA was reanalyzed using the NOTRUMP code, in conjunction with the transition to 15.3-7 REV 30 10/21

FNP-FSAR-15 VANTAGE-5 fuel, and was found acceptable by the NRC as documented in their SER dated March 11, 1992. The small break LOCA was again reanalyzed using the NOTRUMP code in conjunction with the uprate in core power to 2775 MWt, and was again found to be acceptable by the NRC as documented in their SER dated April 29, 1998. Finally, the small break LOCA was reanalyzed using the NOTRUMP code in conjunction with Model 54F replacement steam generators and was found to be acceptable by the NRC as documented in NRC SER dated December 29, 1999.

15.3.2 MINOR SECONDARY SYSTEM PIPE BREAKS 15.3.2.1 Identification of Causes and Accident Description Included in this grouping are ruptures of secondary system lines which would result in steam release rates equivalent to a 6-in. diameter break or smaller.

15.3.2.2 Analysis of Effects and Consequences Minor secondary system pipe breaks must be accommodated with the failure of only a small fraction of the fuel elements in the reactor. Since the results of analysis presented in subsection 15.4.2 for a major secondary system pipe rupture also meet these criteria, separate analysis for minor secondary system pipe breaks is not required.

The analyses of the more probable accidental opening of a secondary system steam dump, relief, or safety valve are presented in subsection 15.2.13. These analyses are illustrative of a pipe break equivalent in size to a single valve opening.

15.3.2.3 Conclusions The analysis presented in paragraph 15.4.2.1 demonstrates that the consequences of a minor secondary system pipe break are acceptable since a departure from nucleate boiling ratio (DNBR) of less than the limit value does not occur even for a more critical major secondary system pipe break.

15.3.3 INADVERTENT LOADING OF A FUEL ASSEMBLY INTO AN IMPROPER POSITION 15.3.3.1 Identification of Causes and Accident Description Fuel and core loading errors such as can arise from the inadvertent loading of one or more fuel assemblies into improper positions, the loading a fuel rod during manufacture with one or more pellets of the wrong enrichment, or the loading of a full fuel assembly during manufacture with pellets of the wrong enrichment will lead to increased heat fluxes if the error results in placing 15.3-8 REV 30 10/21

FNP-FSAR-15 fuel in core positions calling for fuel of lesser enrichment. Also included among possible core loading errors is the inadvertent loading of one or more fuel assemblies requiring burnable poison rods into a new core without burnable poison rods.

Any error in enrichment, beyond the normal manufacturing tolerances, can cause power shapes which are more peaked than those calculated with the correct enrichments. There is a 5-percent uncertainty margin included in the design value of the power peaking factor assumed in the analysis of Condition I and Condition II transients. The incore system of moveable flux detectors which is used to verify power shapes at the start of life is capable of revealing any assembly enrichment error or loading error which causes power shapes to be peaked in excess of the design value.

To reduce the probability of core loading errors, each fuel assembly is marked with an identification number and loaded in accordance with a core loading diagram. During core loading, the identification number will be checked before each assembly is moved into the core.

Serial numbers read during fuel movement are subsequently recorded on the loading diagram as a further check on proper placement after the loading is completed.

The power distortion due to any combination of misplaced fuel assemblies would significantly raise peaking factors and would be readily observable with incore flux monitors. In addition to the flux monitors, thermocouples are located at the outlet of about one-third of the fuel assemblies in the core. There is a high probability that these thermocouples would also indicate any abnormally high coolant enthalpy rise. Incore flux measurements are taken during the startup subsequent to every refueling operation.

15.3.3.2 Analysis of Effects and Consequences 15.3.3.2.1 Method of Analysis Power distribution in the x-y plane of the core and resulting thermal hydraulic conditions are analyzed with the steady-state computer programs briefly discussed in chapter 4. A discrete representation is used wherein each individual fuel rod is described by a mesh interval. The assembly power distributions in the x-y plane for a correctly loaded core are also given in chapter 4 based on enrichments given in that chapter.

For each core loading error case analyzed, the percent deviations from detector readings for a normally loaded core are shown at all incore detector locations (see figures 15.3-15 through 15.3-19).

15.3.3.2.2 Results The following core loading error cases have been analyzed:

15.3-9 REV 30 10/21

FNP-FSAR-15 A. Case A In this case, a region 1 assembly is interchanged with a region 3 assembly. The particular case considered was the interchange of two adjacent assemblies near the periphery of the core (see figure 15.3-15).

B. Case B In this case, a region 1 assembly is interchanged with a neighboring region 2 fuel assembly. Two analyses have been performed for this case (see figures 15.3-16 and 15.3-17).

1. In case B-1, the interchange is assumed to take place with the burnable poison rods transferred with the region 2 assembly mistakenly loaded into region 1.

2. In case B-2, the interchange is assumed to take place closer to core center and with burnable poison rods located in the correct region 2 position but in a region 1 assembly mistakenly loaded into the region 2 position.

C. Case C This is an enrichment error case in which a region 2 fuel assembly is loaded in the core central position (see figure 15.3-18).

D. Case D In this case, a region 2 fuel assembly, instead of a region 1 assembly, is loaded near the core periphery (see figure 15.3-19).

15.3.3.3 Conclusions Fuel assembly enrichment errors would be prevented by administrative procedures implemented in fabrication.

In the event that a single pin or pellet has a higher enrichment than the nominal value, the consequences in terms of reduced DNBR and increased fuel and clad temperatures will be limited to the incorrectly loaded pin or pins.

Fuel assembly loading errors are prevented by administrative procedures implemented during core loading. In the unlikely event that a loading error occurs, analyses in this section confirm that resulting power distribution effects will either be readily detected by the incore moveable detector system or will cause a sufficiently small perturbation to be acceptable within the uncertainties allowed between nominal and design power shapes.

15.3-10 REV 30 10/21

FNP-FSAR-15 15.3.4 COMPLETE LOSS OF FORCED REACTOR COOLANT FLOW 15.3.4.1 Identification of Causes and Accident Description A complete loss of forced reactor coolant flow may result from a simultaneous loss of electrical supplies to all reactor coolant pumps. If the reactor is at power at the time of the accident, the immediate effect of loss of coolant flow is a rapid increase in the coolant temperature. This increase could result in a departure from nucleate boiling (DNB) with subsequent fuel damage if the reactor were not tripped promptly.

The following signals provide the protection against a complete loss of flow accident.

A. Low reactor coolant loop flow B. Undervoltage or underfrequency on RCP power supply buses (Unit 2 only)

The loss of measured loop flow is the primary trip credited in accident analysis. The RCP bus undervoltage and underfrequency trips are backups to the low flow trip (even though they perform in an anticipatory fashion).

The reactor trip on low primary coolant loop flow is provided as the primary trip to protect against loss of flow conditions. This function is generated by two-out-of-three low flow signals per reactor coolant loop. Above permissive P-8, low flow in any loop will actuate a reactor trip.

Between approximately 10% power (permissive P-7) and the power level corresponding to permissive P-8, low flow in any two loops will actuate a reactor trip.

The reactor trip on reactor coolant pump undervoltage is provided as an anticipatory trip to protect against conditions which can cause a loss of voltage to all RCPs, i.e., loss of offsite power. This function is blocked below approximately 10% power (permissive P-7). See FSAR table 7.2.2 for a definition of permissive setpoints.

The RCP underfrequency function is provided as an anticipatory trip to trip the reactor for an underfrequency condition resulting from frequency disturbances on the power grid.

The RCP underfrequency reactor trip function is blocked below P-7. In addition, the underfrequency function will open all RCP breakers whenever an underfrequency condition occurs (no P-7 or P-8 interlock) to ensure adequate RCP pump coastdown.

15.3.4.2 Method of Analysis This transient is analyzed by two digital computer codes. First, the LOFTRAN (reference 9) code is used to calculate the loop and core flow transients, the nuclear power transient, and the primary system pressure and temperature transients. The VIPRE (reference 15) code is then used to calculate the heat flux transient and the DNBR during the transient based on the nuclear 15.3-11 REV 30 10/21

FNP-FSAR-15 power and the flow from LOFTRAN. The DNBR transient presented represents the minimum of the typical and thimble cells.

Also consistent with the PAD5 fuel performance code (Reference 17), the effects of fuel thermal conductivity degradation with burnup are conservatively accounted for in the analysis.

Two cases have been analyzed:

1. Complete loss of all three RCPs with three loops in operation;

2. Frequency decay event (5 Hz/sec frequency decay rate) resulting in a complete loss of forced reactor coolant flow.

The method of analysis and the assumptions made regarding initial operating conditions and reactivity coefficients are identical to those discussed in section 15.1, except that following the loss of power supply to all pumps at power, a reactor trip is actuated by low reactor coolant flow.

(Note: With respect to the reactivity coefficient assumptions, the analysis conservatively applies a moderator temperature coefficient of 0 pcm/°F at full power.)

The accident is analyzed using the Revised Thermal Design Procedure (RTDP). Initial core power, reactor coolant temperature, and pressure are assumed to be at their nominal values consistent with steady-state full-power operation. Uncertainties in initial conditions are included in the limit DNBR as described in WCAP-11397 (reference 11).

15.3.4.3 Results The calculated sequence of events for the limiting case (Frequency Decay) is shown in table 15.3-1. Figures 15.3-20 through 15.3-22 and 15.2-24 through 15.3-25 also show the transient response for this limiting loss of flow event. The reactor is assumed to be tripped on a low flow signal. Figure 15.3-25 represents the general DNBR trend for the limiting cell type.

15.3.4.4 Conclusions The analysis performed has demonstrated that for the complete loss of forced reactor coolant flow, the DNB design basis is met during the transient; thus, there is no clad damage or release of fission products to the RCS.

15.3.5 WASTE GAS DECAY TANK RUPTURE 15.3.5.1 Accident Description The gaseous waste processing system (GWPS), discussed in chapter 11, is designed to remove fission product gases from the reactor coolant. The system consists of a closed loop 15.3-12 REV 30 10/21

FNP-FSAR-15 with waste gas compressors, hydrogen recombiners, waste gas decay tanks for service at power, and other waste gas decay tanks for service at shutdown and startup.

The accident is defined as an unexpected and uncontrolled release of radioactive xenon and krypton fission product gases stored in a waste decay tank as a consequence of a failure of a single gas decay tank or associated piping.

15.3.5.1.1 Method of Analysis Nonvolatile fission product concentrations are greatly reduced as the coolant is passed through the purification demineralizers. An iodine removal factor of 10 is expected in the mixed-bed demineralizers, and an iodine partition factor of the order of 10,000 is expected between the liquid and vapor phases. Based on the above analysis and operating experience at Yankee-Rowe and Saxton, activity stored in a gas decay tank consists of that from the noble gases released from the processed coolant and only negligible quantities of less volatile isotopes.

The maximum noble gas activities in the waste gas decay tanks and the assumptions on which the calculations are based are given in chapter 11.

15.3.5.2 Environmental Consequences The GWPS is designed to be operated in such a manner that the maximum activity in any one gas decay tank is such that the offsite doses resulting from a rupture of the tank will be well within (25% of) 10 CFR 100 guidelines for accidents with the plant operating at the design fuel defect level of 1%. The system is equipped with a radiation monitor which is installed so that it always indicates activity level in the tank onstream at the time. The monitor will alarm at the waste panel when the activity level in the onstream tank reaches a predetermined level. The initiation of the alarm on the waste panel also initiates a general alarm in the control room.

When the alarm is received in the control room, the operator will go to the gas decay tank valving area and manually isolate the high-activity tank and open another tank to receive gaseous radioactive waste. The gaseous activity in the high-activity tank will then decay while the other tanks in the system are being filled with gaseous radioactivity. The order of filling the gas decay tanks will be such that the tank being filled (or to be filled) has the lowest quantity of radioactivity stored in it at the time filling of the tank begins.

Therefore, the maximum activity that could be released as a result of a gas decay rupture is the activity stored in one gas decay tank immediately after it has been isolated from the GWPS.

Parameters used for the analysis are listed in table 15.3-3. The conservative evaluation of the radiation doses resulting from the postulated rupture of a gas decay tank is based on the following assumptions:

A. The maximum content of the decay tank assumed to fail is used for the purpose of computing the noble gas inventory released. The noble gas inventory of the tank is given in table 15.3-4. The inventory is based on the maximum inventory allowed by the Technical Requirements Manual.

15.3-13 REV 30 10/21

FNP-FSAR-15 B. The tank rupture is assumed to occur immediately after isolation of the tank from the GWPS, releasing the entire contents of the tank at ground level to the outside atmosphere. The assumption of the release of the noble gas inventory from only a single tank is based on the fact that the valving of the decay tanks in the GWPS has been designed such that a release from one gas decay tank due to any means will not result in any additional release of radioactivity stored in any of the other gas decay tanks.

C. The 0- to 2-h atmospheric diffusion factor given in appendix 15B is applicable.

These offsite doses are substantially below (< 0.5-rem whole body in accordance with NUREG 0133) the limits for accidents as defined in 10 CFR 100, as shown in table 15.3-3.

15.3.6 SINGLE RCCA WITHDRAWAL AT FULL POWER 15.3.6.1 Accident Description No single electrical or mechanical failure in the rod control system could cause the accidental withdrawal of a single RCCA from the inserted bank at full-power operation. The event analyzed must result from multiple wiring failures, multiple significant operator errors, or subsequent and repeated operator disregard of event indication. The probability of such a combination of conditions is low so that the limiting consequences may include slight fuel damage.

Each bank of RCCAs in the system is divided into two groups of four mechanisms each. The rods comprising a group operate in parallel through multiplexing thyristors. The two groups in a bank move sequentially such that the first group is always within one step of the second group in the bank. A definite schedule of actuation (or deactuation) of the stationary gripper, movable gripper, and lift coils associated with the four RCCAs of a rod group are required to drive the RCCAs. The RCCAs in a group are driven in parallel. Any single failure which would cause withdrawal would affect a minimum of one group, or four RCCAs. Mechanical failures are in the direction of insertion or immobility. (Note: The operator can deliberately withdraw a single RCCA in a control or shutdown bank since this feature is necessary in order to retrieve an assembly should one be accidentally dropped.)

In the unlikely event of simultaneous electrical failures which could result in single RCCA withdrawal, the plant annunciator will display both the rod deviation and rod control urgent failure, and the rod position indicators will indicate the relative positions of the RCCAs in the bank. The urgent failure alarm also inhibits automatic rod motion in the group in which it occurs.

Withdrawal of a single RCCA by operator action, whether deliberate or by a combination of errors, would result in activation of the same alarm and the same visual indication. The overtemperature T (OTT) reactor trip provides automatic protection for this event, although due to the increase in local power density, it is not possible to always provide assurance that the core safety limits will not be exceeded.

15.3-14 REV 30 10/21

FNP-FSAR-15 15.3.6.1.1 Method of Analysis Power distributions are analyzed using appropriate nuclear physics computer codes. The DNB evaluation conservatively assumes that any fuel rod with an FH above the Core Operating Limits Report limit is in DNB and fails. The analysis examines the case of the worst rod withdrawn from bank D, inserted at the insertion limit with the reactor initially at full power.

15.3.6.1.2 Results Two cases have been considered as follows:

A. If the reactor is in the manual control mode, continuous withdrawal of a single RCCA results in an increase in core power and coolant temperature and an increase in the local hot channel factor in the area of the withdrawing RCCA. In terms of the overall system response, this case is similar to those presented in subsection 15.2.2; however, the increased local power peaking in the area of the withdrawn RCCA results in lower minimum DNBRs than for the withdrawn bank cases. Depending on initial bank insertion and location of the withdrawn RCCA, automatic reactor trip may not occur sufficiently fast to prevent the minimum core DNBR from falling below the safety analysis limit value. Evaluation of this case at the power and coolant conditions at which the OTT trip would be expected to trip the plant shows that an upper limit for the number of rods with a DNBR less than the safety analysis limit value is 5%.

B. If the reactor is in the automatic rod control mode, the multiple failures that result in the withdrawal of a single RCCA cause immobility of the other RCCAs in the controlling bank. The transient will then proceed in the same manner as case A, described above. For such cases, reactor trip will ultimately ensue, although not quickly enough in all cases to prevent a minimum DNBR in the core of less than the safety analysis limit value. Following reactor trip, normal shutdown procedures are followed.

15.3.6.2 Conclusions For the condition of one RCCA fully withdrawn with the reactor in the automatic or manual control mode and initially operating at full power with bank D at the insertion limit, an upper bound of the number of fuel rods experiencing DNB is 5% of the total fuel rods in the core.

For both cases discussed, the indicators and alarms mentioned would function to alert the operator to the malfunction before DNB would occur. For case B discussed above, the insertion limit alarms (low and low-low alarms) would also serve in this regard.

15.3-15 REV 30 10/21

FNP-FSAR-15 REFERENCES

1. "Acceptance Criteria for Emergency Core Cooling Systems for Light Water-Cooled Nuclear Power Reactors," Federal Register 39:3, 10 CFR 50.46 and 10 CFR 50, Appendix K, January 4, 1974, including 10 CFR 50.46 as amended September 16, 1988.

2. Meyer, P. E., "NOTRUMP - A Nodal Transient Small Break and General Network Code,"

WCAP-10079-P-A, August 1985.

3. Lee, N., et al., "Westinghouse Small Break ECCS Evaluation Model Using the NOTRUMP Code," WCAP-10054-P-A, August 1985.

4. Generic Evaluation of Feedwater Transients and Small-Break Loss-of-Coolant Accidents in Westinghouse-Designed Operating Plants," NUREG 0611, January 1980.

5. Bordelon, F. M., et al., "LOCTA-IV Program: Loss of Coolant Transient Analysis,"

WCAP-8305, June 1974.

6. "Clarification of TMI Action Plan Requirements," NUREG-0737, November 1980.

7. NRC Generic Letter 83-35 from D. G. Eisenhut, "Clarification of TMI Action Plan Item II.K.3.31," November 2, 1983.

8. "Westinghouse Small Break LOCA ECCS Evaluation Model Generic Study with the NOTRUMP Code," WCAP-11145-P-A, October 1986.

9. Burnett, T. W. T., et al., "LOFTRAN Code Description," WCAP-7907-P-A (Proprietary),

WCAP-7907-A (Nonproprietary), April 1984.

10. Hargrove, H. G., "FACTRAN, A FORTRAN-IV Code for Thermal Transients in a UO2 Fuel Rod," WCAP-7908-A, December 1989.

11. Friedland, A. J. and Ray, S., "Revised Thermal Design Procedure," WCAP-11397-P-A, April 1989.

12. Kachmar, M. P., et al., LOCA NOTRUMP Evaluation Model: ZIRLOTM Modifications and Accident Evaluations, LOCA Plant Specific, Appendices F and G to WCAP-12610, December 1990.

13. Thompson, C. M., et al., Addendum to the Westinghouse Small Break ECCS Evaluation Model Using the NOTRUMP Code: Safety Injection into the Broken Loop and COSI Condensation Model, WCAP-10054-P-A, Addendum 2, Revision 1, July 1997.

14. Shah, H. H., et al., Addendum 1 to WCAP-126-P-A and CENPD-404-P-A Optimized ZIRLO, February 2003.

15.3-16 REV 30 10/21

FNP-FSAR-15

15. Sung, Y. X., et al., VIPRE-01 Modeling and Qualification for Pressurized Water Reactor Non-LOCA ,Thermal Hydraulic Safety Analysis, WCAP-14565-P-A (Proprietary) and WCAP-14565-A (Non-Proprietary), October 1999.

16. Linsuain, O., et al, Westinghouse Performance Analysis and Design Model (PAD5),

WCAP-17642-P-A, Revision 1, November 2017.

15.3-17 REV 30 10/21

FNP-FSAR-15 TABLE 15.3-1 TIME SEQUENCE OF EVENTS FOR CONDITION III EVENTS Accident Event Time (s)

Complete loss of forced Frequency decay begins 0.0 reactor coolant flow (Underfrequency)

Low reactor coolant flow trip setpoint 1.9 reached Rods begin to drop 2.9 Minimum DNBR occurs 4.9 REV 30 10/21

FNP-FSAR-15 TABLE 15.3-2 PLANT INPUT PARAMETERS USED IN SMALL BREAK LOCA ANALYSIS FOR 17 X 17 VANTAGE 5 FUEL Core power(b) 102% of 2775 MWt Total core peaking factor (FQ) 2.50 Enthalpy rise peaking factor (FH) 1.70 Steam generator tube plugging level 20% (peak uniform)

Accumulator conditions:

Cover gas pressure 600 psia Water volume(a) 980 ft3 Total volume 1450 ft3 RCS initial conditions:

Core Tavg 583.2 °F (high) / 561.2 °F (low)

Pressure 2300 psia Vessel flowrate 258,000 gal/min Reactor trip signal 1840 psia Signal delay time 2.0 s Safety injection signal 1700 psia Safety injection delay time 27 s Rod drop time 2.7 s MFW isolation time Delay time 2.0 s Valve closure time 5.0 s

a. The initial accumulator water volume does not include the undeliverable piping volume of 45 ft3.

b. MUR conditions have been assessed which allow the core power level to be defined up to a maximum of 2831 MWt including uncertainties.

REV 30 10/21

FNP-FSAR-15 TABLE 15.3-3 PARAMETERS USED IN WASTE GAS DECAY TANK RUPTURE ANALYSES Plant load factor 1.00 Activity released from GWPS Contents of one tank Tank Contents See Table 15.3-4 Number of tanks (normal operation) 6.00 Iodine partition factor in volume control tank 0.01 Time of accident Immediately after isolation of tank from GWPS Meteorology Accident (see appendix 15B)

OFFSITE DOSES FROM WASTE GAS DECAY TANK RUPTURE Whole Body Dose (Rem) B-Skin Dose (Rem)

Site Boundary 0.30 0.57 Low Population Zone 0.11 0.21 REV 21 5/08

FNP-FSAR-15 TABLE 15.3-4 WASTE GAS DECAY TANK INVENTORY (Technical Requirements Manual Limit for Conservative Analysis)

Isotope Activity (Ci)

Xe-133 6.77 x 104 Xe-133m 1.02 x 103 Xe-135 6.77 x 102 Xe-135m 2.88 x 100 Xe-138 2.63 x 10-1 Kr-85 (a)

Kr-85m 8.03 x 101 Kr-87 9.15 x 100 Kr-88 8.53 x 101 (a) The dose conversion factor for Kr-85 is much less than the other isotopes, and it accumulates much slower than the other isotopes, thus it is conservatively ignored.

REV 21 5/08

FNP-FSAR-15 TABLE 15.3-5A (a)

SAFETY INJECTION FLOWRATE Intact Loop SI Flowrate Broken Loop SI Flowrate RCS Pressure (psia) (spill to RCS) (lb/s) (spill to RCS) (lb/s) 14.7 45.8 25.3 114.7 44.8 24.7 214.7 43.8 24.2 314.7 42.6 23.5 414.7 41.5 22.9 514.7 40.3 22.2 614.7 39.1 21.6 714.7 37.8 20.9 814.7 36.5 20.2 914.7 35.2 19.5 1014.7 33.9 18.7 1114.7 32.6 18.0 1214.7 31.2 17.2 1314.7 29.8 16.5 1414.7 28.3 15.6 1514.7 26.7 14.8 1614.7 25.1 13.9 1714.7 23.3 12.9 1814.7 21.4 11.8 1914.7 19.5 10.8 2014.7 17.3 9.6 2114.7 14.8 8.2 2214.7 11.0 6.1 2314.7 2.4 1.3 2414.7 0.0 0.0

a. This table assumes flow from one high-head safety injection pump.

REV 21 5/08

FNP-FSAR-15 TABLE 15.3-5B SAFETY INJECTION FLOWRATE(a)

Intact Loop SI Intact Loop RHR Flowrate Flowrate (spill to containment) (spill to containment) Total Intact Loop RCS Pressure (psia) (lb/s) (lb/s) ECCS Flow (lb/s) 14.70 45.00 352.90 397.90 34.70 43.70 309.90 353.60 54.70 43.70 264.60 308.30 74.70 43.70 212.80 256.50 94.70 43.70 155.30 199.00 114.70 43.70 88.30 132.00 134.70 42.10 5.00 47.10 154.70 42.10 0.00 42.10 214.70 42.10 0.00 42.10 314.70 40.40 0.00 40.40 414.70 38.70 0.00 38.70 514.70 36.90 0.00 36.90 614.70 35.10 0.00 35.10 714.70 33.30 0.00 33.30 814.70 31.30 0.00 31.30 914.70 29.30 0.00 29.30 1014.70 27.00 0.00 27.00 1114.70 24.30 0.00 24.30 1214.70 21.60 0.00 21.60 1314.70 18.70 0.00 18.70 1414.70 15.60 0.00 15.60 1514.70 12.40 0.00 12.40 1614.70 9.00 0.00 9.00 1714.70 5.00 0.00 5.00 1814.70 0.40 0.00 0.40 1914.70 0.00 0.00 0.00

a. This table assumes flow from one high-head safety injection pump and one RHR pump.

REV 21 5/08

REV 21 5/08 CODE INTERFACE DESCRIPTION JOSEPH M. FARLEY NUCLEAR PLANT FOR SMALL BREAK MODEL UNIT 1 AND UNIT 2 FIGURE 15.3-1

REV 21 5/08 JOSEPH M. FARLEY SMALL BREAK HOT ROD POWER SHAPE NUCLEAR PLANT UNIT 1 AND UNIT 2 FIGURE 15.3-2

REV 21 5/08 SMALL BREAK SAFETY INJECTION JOSEPH M. FARLEY FLOWRATE - 1 HIGH-HEAD NUCLEAR PLANT SAFETY INJECTION PUMP UNIT 1 AND UNIT 2 FIGURE 15.3-3A

REV 21 5/08 SMALL BREAK SAFETY INJECTION JOSEPH M. FARLEY FLOWRATE - 1 HIGH-HEAD SAFETY NUCLEAR PLANT INJECTION PUMP & 1 RHR PUMP UNIT 1 AND UNIT 2 FIGURE 15.3-3B

REV 23 5/11 JOSEPH M. FARLEY RCS PRESSURE TRANSIENT (2.75-IN. BREAK)

NUCLEAR PLANT UNIT 1 AND UNIT 2 FIGURE 15.3-4A

REV 23 5/11 RCS PRESSURE JOSEPH M. FARLEY NUCLEAR PLANT (2.0-IN. BREAK)

UNIT 1 AND UNIT 2 FIGURE 15.3-4B

REV 23 5/11 RCS PRESSURE TRANSIENT JOSEPH M. FARLEY NUCLEAR PLANT (2.25-IN. BREAK)

UNIT 1 AND UNIT 2 FIGURE 15.3-4C

REV 23 5/11 JOSEPH M. FARLEY RCS PRESSURE TRANSIENT (2.5-IN. BREAK)

NUCLEAR PLANT UNIT 1 AND UNIT 2 FIGURE 15.3-4D

REV 23 5/11 JOSEPH M. FARLEY RCS PRESSURE TRANSIENT (3.0-IN. BREAK)

NUCLEAR PLANT UNIT 1 AND UNIT 2 FIGURE 15.3-4E

REV 23 5/11 RCS PRESSURE TRANSIENT JOSEPH M. FARLEY NUCLEAR PLANT (3.25-IN. BREAK)

UNIT 1 AND UNIT 2 FIGURE 15.3-4F

REV 23 5/11 RCS PRESSURE TRANSIENT JOSEPH M. FARLEY NUCLEAR PLANT (4.0-IN. BREAK)

UNIT 1 AND UNIT 2 FIGURE 15.3-4G

REV 23 5/11 CORE MIXTURE LEVEL JOSEPH M. FARLEY NUCLEAR PLANT (2.75-IN. BREAK)

UNIT 1 AND UNIT 2 FIGURE 15.3-5A

REV 23 5/11 CORE MIXTURE LEVEL JOSEPH M. FARLEY NUCLEAR PLANT (2.0-IN. BREAK)

UNIT 1 AND UNIT 2 FIGURE 15.3-5B

REV 23 5/11 CORE MIXTURE LEVEL JOSEPH M. FARLEY NUCLEAR PLANT (2.25-IN. BREAK)

UNIT 1 AND UNIT 2 FIGURE 15.3-5C

REV 23 5/11 CORE MIXTURE LEVEL JOSEPH M. FARLEY NUCLEAR PLANT (2.5-IN. BREAK)

UNIT 1 AND UNIT 2 FIGURE 15.3-5D

REV 23 5/11 CORE MIXTURE LEVEL JOSEPH M. FARLEY NUCLEAR PLANT (3.0-IN. BREAK)

UNIT 1 AND UNIT 2 FIGURE 15.3-5E

REV 23 5/11 CORE MIXTURE LEVEL JOSEPH M. FARLEY NUCLEAR PLANT (3.25-IN. BREAK)

UNIT 1 AND UNIT 2 FIGURE 15.3-5F

REV 23 5/11 CORE MIXTURE LEVEL JOSEPH M. FARLEY NUCLEAR PLANT (4.0-IN. BREAK)

UNIT 1 AND UNIT 2 FIGURE 15.3-5G

REV 23 5/11 CLAD TEMPERATURE TRANSIENT AT PEAK JOSEPH M. FARLEY NUCLEAR PLANT TEMPERATURE ELEVATION (2.75-IN. BREAK)

UNIT 1 AND UNIT 2 FIGURE 15.3-6A

REV 21 5/11 CLAD TEMPERATURE TRANSIENT AT PEAK JOSEPH M. FARLEY NUCLEAR PLANT TEMPERATURE ELEVATION (2.0-IN. BREAK)

UNIT 1 AND UNIT 2 FIGURE 15.3-6B

REV 23 5/11 CLAD TEMPERATURE TRANSIENT AT PEAK JOSEPH M. FARLEY NUCLEAR PLANT TEMPERATURE ELEVATION (2.25-IN. BREAK)

UNIT 1 AND UNIT 2 FIGURE 15.3-6C

REV 23 5/11 CLAD TEMPERATURE TRANSIENT AT PEAK JOSEPH M. FARLEY NUCLEAR PLANT TEMPERATURE ELEVATION (2.5-IN. BREAK)

UNIT 1 AND UNIT 2 FIGURE 15.3-6D

REV 23 5/11 CLAD TEMPERATURE TRANSIENT AT PEAK JOSEPH M. FARLEY NUCLEAR PLANT TEMPERATURE ELEVATION (3.0-IN. BREAK)

UNIT 1 AND UNIT 2 FIGURE 15.3-6E

REV 23 5/11 CLAD TEMPERATURE TRANSIENT AT PEAK JOSEPH M. FARLEY NUCLEAR PLANT TEMPERATURE ELEVATION (3.25-IN. BREAK)

UNIT 1 AND UNIT 2 FIGURE 15.3-6F

REV 23 5/11 CLAD TEMPERATURE TRANSIENT AT PEAK JOSEPH M. FARLEY NUCLEAR PLANT TEMPERATURE ELEVATION (4.0-IN. BREAK)

UNIT 1 AND UNIT 2 FIGURE 15.3-6G

REV 23 5/11 JOSEPH M. FARLEY CORE EXIT STEAM FLOW (2.75-IN. BREAK)

NUCLEAR PLANT UNIT 1 AND UNIT 2 FIGURE 15.3-7A

THIS FIGURE HAS BEEN DELETED.

REV 23 5/11 CORE EXIT STEAM FLOW - UNIT 2 JOSEPH M. FARLEY NUCLEAR PLANT (LOW TAVG) (3-IN. BREAK)

UNIT 1 AND UNIT 2 FIGURE 15.3-7B

REV 23 5/11 CLAD SURFACE HEAT TRANSFER COEFFICIENT AT PCT JOSEPH M. FARLEY NUCLEAR PLANT ELEVATION (2.75-IN. BREAK)

UNIT 1 AND UNIT 2 FIGURE 15.3-8A

THIS FIGURE HAS BEEN DELETED.

REV 23 5/11 HEAT TRANSFER COEFFICIENT - HOT SPOT ROD JOSEPH M. FARLEY NUCLEAR PLANT SURFACE - UNIT 2 (LOW TAVG) (3-IN. BREAK)

UNIT 1 AND UNIT 2 FIGURE 15.3-8B

REV 23 5/11 FLUID TEMPERATURE AT PCT ELEVATION JOSEPH M. FARLEY NUCLEAR PLANT (2.75-IN. BREAK)

UNIT 1 AND UNIT 2 FIGURE 15.3-9A

THIS FIGURE HAS BEEN DELETED.

REV 23 5/11 FLUID TEMPERATURE - HOT SPOT - UNIT 2 JOSEPH M. FARLEY NUCLEAR PLANT (LOW TAVG) (3-IN. BREAK)

UNIT 1 AND UNIT 2 FIGURE 15.3-9B

REV 23 5/11 JOSEPH M. FARLEY COLD LEG BREAK MASS FLOW (2.75-IN. BREAK)

NUCLEAR PLANT UNIT 1 AND UNIT 2 FIGURE 15.3-10A

THIS FIGURE HAS BEEN DELETED.

REV 23 5/11 COLD LEG BREAK MASS FLOW - UNIT 2 JOSEPH M. FARLEY NUCLEAR PLANT (LOW TAVG) (3-IN. BREAK)

UNIT 1 AND UNIT 2 FIGURE 15.3-10B

REV 23 5/11 JOSEPH M. FARLEY ECCS PUMPED SAFETY INJECTION (2.75-IN. BREAK)

NUCLEAR PLANT UNIT 1 AND UNIT 2 FIGURE 15.3-11A

THIS FIGURE HAS BEEN DELETED.

REV 23 5/11 ECCS PUMPED SAFETY INJECTION - UNIT 2 JOSEPH M. FARLEY NUCLEAR PLANT (LOW TAVG) (3-IN. BREAK)

UNIT 1 AND UNIT 2 FIGURE 15.3-11B

REV 21 5/08 CORE MIXTURE HEIGHT JOSEPH M. FARLEY NUCLEAR PLANT (4-IN.)

UNIT 1 AND UNIT 2 FIGURE 15.3-12

REV 21 5/08 CLAD TEMPERATURE TRANSIENT JOSEPH M. FARLEY NUCLEAR PLANT (3-IN.)

UNIT 1 AND UNIT 2 FIGURE 15.3-13

REV 21 5/08 CLAD TEMPERATURE TRANSIENT JOSEPH M. FARLEY NUCLEAR PLANT (4-IN.)

UNIT 1 AND UNIT 2 FIGURE 15.3-14

REV 21 5/08 INTERCHANGE BETWEEN REGION 1 JOSEPH M. FARLEY NUCLEAR PLANT AND REGION 3 ASSEMBLY UNIT 1 AND UNIT 2 FIGURE 15.3-15

REV 21 5/08 INTERCHANGE BETWEEN REGION 1 AND 2 JOSEPH M. FARLEY ASSEMBLY, BURNABLE POISON RODS BEING NUCLEAR PLANT RETAINED BY THE REGION 2 ASSEMBLY UNIT 1 AND UNIT 2 FIGURE 15.3-16

REV 21 5/08 INTERCHANGE BETWEEN REGION 1 AND REGION 2 ASSEMBLY, BURNABLE POISON JOSEPH M. FARLEY NUCLEAR PLANT RODS BEING TRANSFERRED TO THE UNIT 1 AND UNIT 2 REGION 1 ASSEMBLY FIGURE 15.3-17

REV 21 5/08 ENRICHMENT ERROR - A REGION 2 ASSEMBLY JOSEPH M. FARLEY NUCLEAR PLANT LOADED INTO THE CORE CENTRAL POSITION UNIT 1 AND UNIT 2 FIGURE 15.3-18

REV 21 5/08 LOADING A REGION 2 ASSEMBLY JOSEPH M. FARLEY INTO A REGION 1 POSITION NEAR CORE NUCLEAR PLANT PERIPHERY UNIT 1 AND UNIT 2 FIGURE 15.3-19

REV 30 10/21 ALL LOOPS OPERATING, FREQUENCY DECAY JOSEPH M. FARLEY TO ALL LOOPS -

NUCLEAR PLANT REACTOR VESSEL FLOW VERSUS TIME UNIT 1 AND UNIT 2 FIGURE 15.3-20

REV 30 10/21 ALL LOOPS OPERATING, FREQUENCY DECAY JOSEPH M. FARLEY TO ALL LOOPS -

NUCLEAR PLANT NUCLEAR POWER VERSUS TIME UNIT 1 AND UNIT 2 FIGURE 15.3-21

REV 30 10/21 ALL LOOPS OPERATING, FREQUENCY DECAY JOSEPH M. FARLEY TO ALL LOOPS -

NUCLEAR PLANT PRESSURIZER PRESSURE VERSUS TIME UNIT 1 AND UNIT 2 FIGURE 15.3-22

DELETED REV 30 10/21 ALL LOOPS OPERATING, FREQUENCY DECAY JOSEPH M. FARLEY TO ALL LOOPS - AVERAGE CHANNEL NUCLEAR PLANT HEAT FLUX VERSUS TIME UNIT 1 AND UNIT 2 FIGURE 15.3-23

REV 30 10/21 ALL LOOPS OPERATING, FREQUENCY DECAY JOSEPH M. FARLEY TO ALL LOOPS - HOT CHANNEL NUCLEAR PLANT HEAT FLUX VERSUS TIME UNIT 1 AND UNIT 2 FIGURE 15.3-24

REV 30 10/21 ALL LOOPS OPERATING, FREQUENCY DECAY JOSEPH M. FARLEY TO ALL LOOPS -

NUCLEAR PLANT DNBR VERSUS TIME UNIT 1 AND UNIT 2 FIGURE 15.3-25

REV 21 5/08 2-IN. BREAK, JOSEPH M. FARLEY NUCLEAR PLANT NO SI, RCS PRESSURE UNIT 1 AND UNIT 2 FIGURE 15.3-26

REV 21 5/08 2-IN. BREAK, JOSEPH M. FARLEY NUCLEAR PLANT NO SI, CORE MIXTURE HEIGHT UNIT 1 AND UNIT 2 FIGURE 15.3-27

REV 21 5/08 JOSEPH M. FARLEY SMALL BREAK NUCLEAR PLANT UNIT 1 AND UNIT 2 FIGURE 15.3-28

REV 21 5/08 2-IN. BREAK, NO SI, JOSEPH M. FARLEY NUCLEAR PLANT PRESSURIZER LEVEL (FT)

UNIT 1 AND UNIT 2 FIGURE 15.3-29

FNP-FSAR-15 15.4 CONDITION IV - LIMITING FAULTS Condition IV occurrences are faults which are not expected to take place, but are postulated because their consequences would include the potential for the release of significant amounts of radioactive material. They are the most drastic occurrences which must be designed against and thus represent limiting design cases. The Nuclear Regulatory Commission (NRC) acceptance criterion for Condition IV faults is that doses outside of the plant exclusion boundary will be less than the limits established in 10 CFR 50.67 in order to ensure that there will be no undue risk to the health and safety of the public. A single Condition IV fault is not to cause a consequential loss of required functions of systems needed to cope with the fault, including those of the emergency core cooling system (ECCS) and the containment as described in sections 6.3 and 6.2 respectively.

For the purposes of this report, the following faults have been classified in this category:

A. Major rupture of pipes containing reactor coolant up to and including double-ended rupture of the largest pipe in the reactor coolant system (RCS) [loss-of-coolant accident (LOCA)].

B. Major secondary system pipe rupture up to and including double-ended rupture (rupture of a steam pipe).

C. Steam generator tube rupture.

D. Single reactor coolant pump locked rotor.

E. Fuel handling accident (FHA).

F. Rupture of a control rod mechanism housing (rod cluster control assembly (RCCA) ejection).

15.4.1 MAJOR REACTOR COOLANT SYSTEM PIPE RUPTURES (LOSS-OF-COOLANT ACCIDENTS) 15.4.1.1 Identification of Causes and Frequency Classification A LOCA is the result of a pipe rupture of the RCS pressure boundary. For the analyses reported here, a major pipe break (large break) is defined as a rupture with a total cross-sectional area 1.0 ft2. This event is considered a Condition IV event (a limiting fault) because it is not expected to occur during the lifetime of the plant but is postulated as a conservative design basis.

For large break LOCAs, the most limiting single failure is the one which produces the lowest containment pressure. The lowest containment pressure would be obtained only if all containment spray pumps and fan coolers operated subsequent to the postulated LOCA.

Therefore, for the purposes of large break LOCA analyses, the most limiting single failure would only be the loss of one residual heat removal (RHR) pump with full operation of the spray 15.4-1 REV 30 10/21

FNP-FSAR-15 pumps and fan coolers (with the lowest containment pressure). However, the large break LOCA analyses conservatively assume both maximum containment safeguards (lowest containment pressure) and minimum ECCS safeguards (the loss of one complete train of ECCS components which includes one RHR pump and one high-head safety injection (SI) pump), which results in the minimum delivered ECCS flow available to the RCS. Minimum ECCS flow has been shown to be a conservative assumption for best-estimate large break LOCA (reference 7). The NRC acceptance criteria for the LOCA are described in 10 CFR 50.46 (reference 1) as follows:

A. The calculated maximum fuel element cladding temperature shall not exceed 2200°F.

B. The calculated total oxidation of the cladding does not exceed 17% of the total cladding thickness before oxidation.

C. The calculated total amount of hydrogen generated from the chemical reaction of the cladding with water or steam does not exceed 1% of the hypothetical amount that would be generated if all of the metal in the cladding cylinders surrounding the fuel, excluding the cladding surrounding the plenum volume, were to react.

D. Calculated changes in core geometry are such that the core remains amenable to cooling.

E. After any calculated successful initial operation of the ECCS, the calculated core temperature is maintained at an acceptable low value and decay heat is removed for an extended period of time required by the long-lived radioactivity.

These criteria were established to provide significant margin in ECCS performance following a LOCA. WASH-1400 (reference 2) presents a study in regards to the probability of occurrences of RCS pipe ruptures.

15.4.1.2 Sequence of Events and Systems Operations Should a major break occur, depressurization of the RCS would result in a pressure decrease in the pressurizer. The reactor trip signal would subsequently occur when the pressurizer low-pressure trip setpoint is reached. An SI signal is generated when the appropriate setpoint (high containment pressure or low pressurizer pressure) is reached. These countermeasures will limit the consequences of the accident in two ways:

A. Reactor trip and borated water injection supplement void formation in causing rapid reduction of power to the residual level corresponding to fission product decay heat. An average RCS/sump mixed boron concentration is calculated to ensure that the post-LOCA core remains subcritical. In addition, the insertion of control rods to shut down the reactor is neglected in the large break analysis.

B. Injection of borated water provides for heat transfer from the core and prevents excessive clad temperatures.

15.4-2 REV 30 10/21

FNP-FSAR-15 In the present Westinghouse design, the most limiting large break single failure is the loss of one high-head pump and one low-head pump. This assumption is consistent with the current procedure for large break analyses.

For the large break analysis, one ECCS train, including one high-head SI pump and one RHR (low-head) pump, starts and delivers flow through the injection lines (one for each loop) with one branch injection line spilling to the containment backpressure. However, both emergency diesel generators (EDGs) are assumed to start in the modeling of the containment fan coolers and spray pumps. Modeling full containment heat removal systems operation is required by 10 CFR 50 Appendix K and Branch Technical Position CSB 6-1 and is conservative for the large break LOCA.

To minimize delivery to the reactor, the branch line chosen to spill is selected as the one with the minimum resistance. In addition, both the high-head SI pump and the RHR pump performance curves were degraded by 10% and a 20 gal/min (-5, +15) flow imbalance was assumed for the high-head SI pumps.

In the large break ECCS analysis presented here, single failure is conservatively accounted for via the loss of an ECCS train, the spilling of the minimum resistance injection line, and by assuming all containment spray pumps and fan coolers are available. Therefore, the analysis assumed one high-head pump, one RHR pump, two containment spray pumps, and four fan coolers are operating.

15.4.1.3 Description of Large Break LOCA Transient The RCS is assumed to be operating normally at full power. Before the break occurs, the unit is in an equilibrium condition, i.e., the heat generated in the core is being removed by the secondary system. A large cold leg break is assumed to open nearly instantaneously in one of the main coolant pipes. Calculations where the location and size of the break have been varied indicate that a break in the cold leg between the pump and the vessel leads to the most severe transient. For the break location, a rapid depressurization occurs, along with a core flow reversal as subcooled liquid flows out of the vessel into the broken cold leg. Boiling begins in the core, and the reactor core begins to shut down. Within approximately 2 s, the core is highly voided, and core fission is terminated. The cladding temperature rises rapidly as heat transfer from the fuel rods is reduced.

Within approximately 5 s, the pressure in the pressurizer has fallen to the point where reactor trip and SI signals are initiated. It is highly likely that these signals will have been initiated sooner as a result of a high containment pressure signal. Along with the SI signal, the containment isolation signal is also initiated.

15.4-3 REV 30 10/21

FNP-FSAR-15 In the first 5 s, the coolant in all regions of the vessel begins to flash. In addition, the break flow becomes saturated and is substantially reduced. This reduces the depressurization rate, and may also lead to a period of positive core flow or reduced downflow as the reactor coolant pumps in the intact loops continue to supply water to the vessel, and as flashing continues in the vessel lower plenum and downcomer. Cladding temperatures may be reduced, and some portions of the core may rewet during this period.

The positive core flow or reduced downflow period ends as two-phase conditions occur in the reactor coolant pumps, reducing their effectiveness. Once again, the core flow reverses as most of the vessel mass flows out through the broken cold leg. Core cooling occurs as a result of the reverse flow.

At approximately 10 s after the break, the pressure falls to the point where accumulators begin injecting cold water into the cold legs. Because the break flow is still high, much of the injected ECCS water, which flows into the downcomer of the vessel, is bypassed out to the break.

Approximately 25 s after the break, most of the original RCS inventory has been ejected or boiled off. The system pressure and break flow are reduced and the ECCS water, which has been filling the downcomer, begins to fill the lower plenum of the vessel. Additional ECCS water pumped from the RWST begins to flow into the vessel. During this time, core heat transfer is relatively poor and cladding temperatures increase.

The blowndown phase of the transient ends when the RCS pressure (initially assumed at 2250 psia) falls to a value approaching that of the containment atmosphere. Prior to or at the end of the blowndown, termination of bypass occurs and refill of the reactor vessel lower plenum begins. Refill is completed when ECCS water has filled the lower plenum of the reactor vessel, which is bounded by the bottom of the fuel rods (called bottom of core (BOC) recovery time).

Approximately 35 s after the break, the lower plenum has re-filled, and ECCS water enters the core. The flow into the core is oscillatory, as cold water rewets hot fuel cladding, generating steam. The steam and entrained water must pass through the vessel upper plenum, the hot legs, the steam generator, and the reactor coolant pump before it can be vented out the break.

The resistance of this flow path of the steam flow is balanced by the driving force of water filling the downcomer. Shortly after reflood begins, the accumulators exhaust their inventory of water, and begin to inject the nitrogen gas which was used to pressurize the accumulators. This results in a short period of improved heat transfer as the nitrogen forces water from the downcomer into the core. When the accumulators have exhausted their supply of nitrogen, the reflood rate may be reduced and peak cladding temperatures may again rise. This heatup may continue until the core has reflooded to several feet. Approximately 3 min after the break, all locations in the core begin to cool. The core is completely quenched within 10 min, and long-term cooling and decay heat removal begin. Long-term cooling for the next several minutes is characterized by continued boiling in the vessel as decay power and residual heat in the reactor structures are removed.

Continued operation of the ECCS pumps supplies water during long-term cooling. Core temperatures would be reduced to long-term steady-state levels associated with the dissipation of residual heat generation. After the water level of the RWST reaches a minimum allowable value, coolant for long-term cooling of the core is obtained by switching to the cold leg 15.4-4 REV 30 10/21

FNP-FSAR-15 recirculation mode of operation in which spilled borated water is drawn from the containment sump by the RHR pumps and returned to the RCS cold legs. The containment spray pumps are manually aligned to the containment emergency sumps and continue to operate to further reduce containment pressure and temperature.

At 7.5 h after initiation of the LOCA, the ECCS is realigned to supply water to the RCS hot legs and cold legs in order to control the boric acid concentration in the reactor vessel. Long-term cooling includes long-term criticality control. To achieve long-term criticality control, a mixed-mean sump boron concentration is determined and verified against core design margins to assure core subcriticality, without credit for RCCA insertion. A mixed-mean sump boron concentration is calculated based on minimum volumes for boron sources and maximum volumes for dilution sources. The calculated mixed-mean sump boron concentration is verified against available core design margins on a cycle-specific basis. The current Technical Specifications range is 2300 to 2500 ppm boron for the RWST and 2200 to 2500 ppm for the accumulators.

The sequence of events described above is summarized in figure 15.4-1.

15.4.1.4 Analysis of Effects and Consequences 15.4.1.4.1 Method of Analysis When the final acceptance criteria (FAC) governing the LOCA for light water reactors was issued in Appendix K of 10 CFR 50.46 (reference 1), both the NRC and the industry recognized that the rule was highly conservative. That is, using the then accepted analysis methods, the performance of the ECCS would be conservatively underestimated, resulting in predicted peak clad temperatures (PCTs) much higher than expected. At that time, however, the degree of conservatism in the analysis could not be quantified. As a result, the NRC began a large-scale confirmatory research program with the following objectives:

1. Identify, through separate effects and integral effects experiments, the degree of conservatism in those models permitted in the Appendix K rule. In this fashion, those areas in which a purposely prescriptive approach was used in the Appendix K rule could not be quantified with additional data so that a less prescriptive future approach might be allowed.

2. Develop improved thermal-hydraulic computer codes and models so that more accurate and realistic accident analysis calculations could be performed. The purpose of this research was to develop an accurate predictive capability so that the uncertainties in the ECCS performance and the degree of conservatism with respect to the Appendix K limits could be quantified.

Since that time, the NRC and the nuclear industry have sponsored reactor safety research programs directed at meeting the above two objectives. The overall results have quantified the conservatism in the Appendix K rule for LOCA analysis and confirmed that some relaxation of the rule can be made without a loss in safety to the public. It was also found that some plants 15.4-5 REV 30 10/21

FNP-FSAR-15 were being restricted in operating flexibility by overly conservative Appendix K requirements. In recognition of the Appendix K conservatism that was being quantified by the research programs, the NRC adopted an interim approach for evaluation methods. This interim approach is described in SECY-83-472 (reference 55). The SECY-83-472 approach retained those features of Appendix K that were legal requirements, but permitted applicants to use best-estimate thermal-hydraulic models in their ECCS evaluation model. Thus, SECY-83-472 represented an important step in basing licensing decisions on realistic calculations, as opposed to those calculations prescribed by Appendix K.

In 1988, as a result of the improved understanding of LOCA thermal-hydraulic phenomena gained by extensive research programs, the NRC staff amended the requirements of 10 CFR 50.46 and Appendix K, ECCS Evaluation Models, so that a realistic evaluation model may be used to analyze the performance of the ECCS during a hypothetical LOCA (reference 3). Under the amended rules, best estimate thermal-hydraulic models may be used in place of models with Appendix K features. The rule change also requires, as part of the analysis, an assessment of the uncertainty of the best estimate calculations. It further requires that this analysis uncertainty be included when comparing the results of the calculations to the prescribed acceptance limits. Further guidance for the use of best estimate codes was provided in Regulatory Guide 1.157 (reference 4).

To demonstrate use of the revised ECCS rule, the NRC and its consultants developed a method called the Code Scaling, Applicability, and Uncertainty (CSAU) evaluation methodology (reference 5). This method outlined an approach for defining and qualifying a best estimate thermal-hydraulic code and quantifying the uncertainties in a LOCA analysis.

A LOCA evaluation methodology for three- and four-loop PWR plants based on the revised 10 CFR 50.46 rules was developed by Westinghouse with the support of EPRI and Consolidated Edison and was recently approved by the NRC (reference 6). The methodology is documented in WCAP-12945, Code Qualification Document (CQD) for Best Estimate LOCA Analysis (reference 7).

More recently, Westinghouse developed an alternative uncertainty methodology called ASTRUM, which stands for Automated Statistical TReatment of Uncertainly Method (reference 56). This method is still based on the CQD methodology and follows the steps in the CSAU methodology. However, the uncertainty analysis (Element 3 in the CSAU) is replaced by a technique based on order statistics. The ASTRUM methodology replaces the response surface technique with a statistical sampling method where the uncertainty parameters are simultaneously sampled for each case. The ASTRUM methodology has received NRC approval for referencing in licensing calculations (reference 57).

The three 10 CFR 50.46 criteria (PCT, maximum local oxidation, and core-wide oxidation) are satisfied by running a sufficient number of WCOBRA/TRAC calculations (sample size). In particular, the statistical theory predicts that 124 calculations are required to simultaneously bound the 95 percentile of three parameters with a 95% confidence level.

15.4-6 REV 30 10/21

FNP-FSAR-15 15.4.1.4.2 Best-Estimate Large Break LOCA Evaluation Model The thermal-hydraulic computer code which was reviewed and approved for the calculation of fluid and thermal conditions in the PWR during a large break LOCA is WCOBRA/TRAC Version MOD7A Revision 1 (WCAP-12945-P-A, reference 7). Since its approval, the code has been upgraded to Revision 6. WCOBRA/TRAC MOD7A Revision 6 is an evolution of Revision 1.

The differences between these frozen versions include logic to facilitate the automation aspects of ASTRUM, user conveniences, and error corrections. WCOBRA/TRAC MOD7A Revision 6 is documented in reference 56.

WCOBRA/TRAC combines two-fluid, three-field, multidimensional fluid equations used in the vessel with one-dimensional drift-flux equations used in the loops to allow a complete and detailed simulation of a PWR. This best-estimate computer code contains the following features.

• Ability to model transient three-dimensional flows in different geometries inside the vessel;

• Ability to model thermal and mechanical nonequilibrium between phases;

• Ability to mechanistically represent interfacial heat, mass, and momentum transfer in different flow regimes;

• Ability to represent important reactor components such as fuel rods, steam generators, reactor coolant pumps, etc.

The two-fluid formulation uses a separate set of conservation equations and constitutive relations for each phase. The effects of one phase on another are accounted for by interfacial friction and heat and mass transfer interaction terms in the equations. The conservation equations have the same form for each phase; only the constitutive relations and physical properties differ. Dividing the liquid phase into two fields is a convenient and physically accurate way of handling flows where the liquid can appear in both film and droplet form. The droplet field permits more accurate modeling of thermal-hydraulic phenomena such as entrainment, de-entrainment, fallback, liquid pooling, and flooding.

WCOBRA/TRAC also features a two-phase, one-dimensional hydrodynamics formulation. In this model, the effect of phase slip is modeled indirectly via a constitutive relationship which provides the phase relative velocity as a function of fluid conditions. Separate mass and energy conservation equations exist for the two-phase mixture and for the vapor.

The reactor vessel is modeled with the three-dimensional, three-field model, while the loop, major loop components, and SI points are modeled with the one-dimensional model.

15.4-7 REV 30 10/21

FNP-FSAR-15 All geometries modeled using the three-dimensional model are represented as a matrix of cells.

The number of mesh cells used depends on the degree of detail required to resolve the flow field, the phenomena being modeled, and practical restrictions such as computing costs and core storage limitations.

The equations for the flow field in the three-dimensional model are solved using a staggered difference scheme on the Eulerian mesh. The velocities are obtained at a mesh cell faces, and the state variables (e.g., pressure, density, enthalpy, and phasic volume fractions) are obtained at the cell center. This cell is the control volume for the scalar continuity and energy equations.

The momentum equations are solved on a staggered mesh with the momentum cell centered on the scalar cell face.

The basic building block for the mesh is the channel, a vertical stack of single-mesh cells.

Several channels can be connected together by gaps to model a region of the reactor vessel.

Regions that occupy the same level form a section of the vessel. Vessel sections are connected axially to complete the vessel mesh by specifying channel connections between sections. Heat transfer surfaces and solid structures that interact significantly with the fluid can be modeled with rods and unheated conductors.

One-dimensional components are connected to the vessel. The basic scheme used also employs the staggered-mesh cell. Special purpose components exist to model specific components such as the steam generator and pump.

A typical calculation using WCOBRA/TRAC begins with the establishment of a steady-state, initial condition with all loops intact. The input parameters and initial conditions for this steady-state calculation are discussed in the next section.

Following the establishment of an acceptable steady-state condition, the transient calculation is initiated by introducing a break into one of the loops. The evolution of the transient through blowdown, refill, and reflood follows continuously, using the same computer code (WCOBRA/TRAC) and the same modeling assumptions. Containment pressure is modeled with the BREAK component of the loop model using a time-dependent pressure table.

Containment pressure is calculated using the COCO code (references 9 and 11) and mass and energy releases from the WCOBRA/TRAC calculation.

The methods used in the application of WCOBRA/TRAC to the large break LOCA with ASTRUM are described in references 6, 7, 56, and 58. A detailed assessment of the computer code WCOBRA/TRAC was made through comparisons to experimental data. These assessments were used to develop quantitative estimates of the codes ability to predict key physical phenomena in a PWR large break LOCA. Modeling of a PWR introduces additional uncertainties which are identified and quantified in the plant-specific analysis (reference 58).

15.4-8 REV 30 10/21

FNP-FSAR-15 The final step of the best-estimate methodology, in which all uncertainties of the LOCA parameters are accounted for to estimate a PCT, local maximum oxidation (LMO), and core-wide oxidation (CWO) at 95% probability, is described in the following sections.

1. Plant Model Development In this step, a WCOBRA/TRAC model of the plant is developed. A high level of noding detail is used in order to provide an accurate simulation of the transient.

However, specific guidelines are followed to assure that the model is consistent with models used in the code validation. This results in a high level of consistency among other plant models, except for specific areas dictated by hardware differences such as in the upper plenum of the reactor vessel or the ECCS injection configuration.

2. Determination of Plant Operating Conditions In this step, the expected or desired operating range of the plant to which the analysis applies is established. The parameters considered are based on a key LOCA parameters list which was developed as part of the methodology. A set of these parameters, at mostly nominal values, is chosen for input as initial conditions to the plant model. A transient is run utilizing these parameters and is known as the initial transient. Next, several confirmatory runs are made, which vary a subset of the key LOCA parameters over their expected operating range in one-at-a-time sensitivities. Because certain parameters are not included in the uncertainty analysis, these parameters are set at their bounding condition. This analysis is commonly referred to as the confirmatory analysis. The most limiting input conditions, based on these confirmatory runs, are then combined into the model that will represent the limiting state for the plant, which is the starting point for the assessment of uncertainties.

3. Assessment of Uncertainty The ASTRUM methodology is based on order statistics. The technical basis of the order statistics is described in Section 11 of reference 56. The determination of the PCT uncertainty, LMO uncertainty, and CWO uncertainty relies on a statistical sampling technique. According to the statistical theory, 124 WCOBRA/TRAC calculations are necessary to assess against the three 10 CFR 50.46 criteria (PCT, LMO, and CWO).

The uncertainty contributors are sampled randomly from their respective distributions for each of the WCOBRA/TRAC calculations. The list of uncertainty parameters, which is randomly sampled for each WCOBRA/TRAC calculation, includes initial conditions, power distributions, and model uncertainties. The time in the cycle, break type (slip or double-ended guillotine), and break size for the split break are also sampled as uncertainty contributors within the ASTRUM methodology.

15.4-9 REV 30 10/21

FNP-FSAR-15 Results from the 124 calculations are tallied by ranking the PCT from highest to lowest. A similar procedure is repeated for LMO and CWO. The highest rank of PCT, LMO, and CWO will bound 95% of their respective populations with 95%

confidence level.

4. Plant Operating Range The plant operating range over which the uncertainty evaluation applies is defined.

Depending on the results obtained in the above uncertainty evaluation, this range may be the desired range or may be narrower for some parameters to gain additional margin.

15.4.1.4.3 Analytical Input Assumption Differences Between Units 1 and 2 The WCOBRA/TRAC models for Farley Units 1 and 2 were originally developed for the power uprate (reference 10). Two models were utilized in the original Analysis of Record (AOR),

mainly because Unit 1 had an upflow barrel/baffle (B/B), whereas Unit 2 had a downflow B/B. A parametric study was performed at that time to determine the limiting unit. Unit 2 was determined to be the limiting unit at that time. Therefore, the Unit 2 model was utilized for the subsequent steps of the original application of the best-estimate large break LOCA evaluation model.

Subsequent to the original analysis, replacement steam generators (RSGs) have been implemented, and Unit 2 has been converted to an upflow B/F configuration. These changes were incorporated into the ASTRUM analysis. Moreover, investigations revealed that the remaining differences in the vessels were small enough to justify the use of a single WCOBRA/TRAC geometric model for both Units 1 and 2. Consequently, there are no WCOBRA/TRAC model differences between the two units at this time.

15.4.1.4.4 Farley Units 1/2 Model Results A series of WCOBRA/TRAC calculations was performed, using the Farley Unit 1/2 plant input model, to determine the effect of variations in several key LOCA parameters on the PCT. From these studies, an assessment was made of the parameters which had a significant effect, as described in the following sections. These parameters, once established, become the bounding conditions of the reference transient. The peak clad temperature (PCT) curve of the reference transient is presented in figure 15.4-2.

15.4.1.4.4.1 Units 1/2 Reference Transient Description. The Units 1/2 initial transient is a double-ended cold leg guillotine break which used the conditions listed in table 15.4-1. Since many of these parameters are at their bounded values, the calculated results of the reference transient of table 15.4-2 are a conservative representation of the response to a large break LOCA.

15.4-10 REV 30 10/21

FNP-FSAR-15 The LOCA transient can be divided into time periods in which specific phenomena are occurring. A convenient way to divide the transient is in terms of the various heatup and cooldown transients that the hot assembly undergoes. For each of these phases, specific phenomena and heat transfer regimes are important, as discussed below. Results of the initial transient are shown on figures 15.4-3 to 15.4-14. In these figures, the transient starts at 0 s.

Critical Heat Flux (CHF) Phase Immediately following the cold leg rupture, the break flowrates are subcooled and high. The regions of the RCS with the hottest initial temperatures (core, upper plenum, upper head, and hot legs) begin to flash to steam within the first 0.5 s following the break. Flow in the core reverses, and the fuel rods begin to go through departure from nucleate boiling (DNB). Voiding in the core also causes the fission power to drop rapidly. The discharge flowrates decrease sharply as the break flows become two-phase (figures 15.4-3 and 15.4-4). This phase is terminated when the water in the lower plenum and downcomer (DC) begin to flash.

Upward Core Flow Phase For three-loop plants, double-ended cold leg guillotine (DECLG) breaks exert a strong downflow pull on core flow, such that for the larger breaks, there is no evidence of an upward core flow phase. Flashing in the lower plenum and pumped flow supplied by the intact loops reduces the magnitude of the core downflow. The degradation of the pump head due to voiding and the large outflow at the vessel-side broken cold leg increases the magnitude of the downward core flow. This phase ends as the lower plenum mass is depleted, the loops become two-phase, and the pump head degrades.

Downward Core Flow Phase Downward flow into the core increases as the pump head continues to be degraded and upward flow in the DC is firmly established (figure 15.4.7).

Due to the downflow during this phase, the cladding temperature was turned around at about 6 s after the initiation of the transient. As the system pressure continues to fall (figure 15.4-8),

the break flow and, consequently, the core flow are reduced. The vessel pressure reaches the containment pressure at the end of this phase, which occurs about 22 s after the initiation of the transient. The core begins to heat up as the system reaches containment pressure, and the vessel begins to fill with ECCS water.

Refill Phase The refill period is characterized by a rapid increase in the lower plenum liquid level and the vessel fluid mass (figures 15.4-9 and 15.4-10). In this period, the cladding temperature at all elevations increases rapidly due to the lack of liquid and steam flow in the core region and resulting poor cooling (figure 15.4-2). This phase ends when the lower plenum fills with water (figure 15.4-9) and the ECCS water enters the core (bottom of core recovery, BOC). This initiates the reflood phase, where entrainment begins, with a resulting improvement in heat transfer.

15.4-11 REV 30 10/21

FNP-FSAR-15 Reflood Phase At the beginning of this phase, the accumulators empty around 30 s after the transient begins (figure 15.4-11) and nitrogen enters the system, which causes a surge of water into the core (figure 15.4-13) and a temporary cooldown (figure 15.4-2). The early part of this period is characterized by a significant vapor generation as the lower elevations of the core quench. This temporarily increases the core pressure, reversing the core inlet flow. As the steam generated in the core is vented through the loops and the DC level rises further, the DC pressure increases above the core pressure and positive core flow is reestablished. The resulting core/DC level oscillations can be seen in the core and DC liquid level plots (figures 15.4-13 and 15.4-14). At approximately 130 s after the transient begins, ECCS water accumulated in the lower plenum starts to boil, causing a reduction in the core and DC liquid levels and the vessel mass (figure 15.4-10), as the two-phase level swell pushes water out the break (figure 15.4-3).

15.4.1.4.4.2 Units 1/2 Confirmatory Studies. A few sensitivity studies were performed to establish the limiting conditions for the uncertainty evaluation. In the sensitivity studies performed, key LOCA parameters are varied over a range and the impact on the peak clad temperature is assessed.

The results for the sensitivity studies are summarized in table 15.4-2. A full report on the results is included in Section 4 of reference 58. In summary, the limiting conditions for the plant at the time the design basis accident is postulated to occur are reflected in the final reference transient. They are as follows:

• Loss of offsite power.

• High RCS average temperature.

• High steam generator tube plugging (SGTP) of 10%.

• Low average power fraction in the assemblies on the core periphery (fraction of power in outer assemblies (PLOW) = 0.2).

15.4.1.5 Uncertainty Evaluation and Results 15.4.1.5.1 Uncertainty Evaluation The ASTRUM methodology (reference 56) differs from the previously approved Westinghouse best-estimate methodology (reference 7), primarily in the statistical technique used to make a singular probabilistic statement with regard to the conformance of the system under analysis to the regulatory requirement of 10 CFR 50.46.

The ASTRUM methodology applies a nonparametric statistical technique to generate output (e.g., PCT, LMO, and CWO from a combination of WCOBRA/TRAC and HOTSPOT (reference 15.4-12 REV 30 10/21

FNP-FSAR-15

56) calculations. These calculations are performed by applying a direct, random Monte Carlo sampling to generate the input for the WCOBRA/TRAC and HOTSPOT computer codes.

This approach allows the formulation of a simple singular statement of uncertainty in the form of a tolerance interval for the numerical acceptance criteria of 10 CFR 50.46. Based on the nonparametric statistical approach, the number of Monte Carlo runs is only a function of the tolerance interval and associated confidence level required to meet the desired level of safety.

The singular statement of uncertainty chosen in the ASTRUM methodology is based on a 95%

tolerance interval with a 95% confidence level for each of the 10 CFR 50.45 criteria, (b)(1), (2),

and (3), i.e., PCT, LMO, and CWO, respectively. This requires 124 large break LOCA calculations (reference 57).

The uncertainty attributes have been divided into the following categories; initial conditions uncertainty, power distribution uncertainty, global model uncertainty, and local model uncertainty. Each category is discussed in greater detail in Section 5 of reference 59. The results for Farley Units 1 and 2 are given in table 15.4.3.

15.4.1.5.3 Additional Evaluations COCO Evaluation The ASTRUM methodology (reference 56, Section 11-3-1) designates that the containment pressure utilized in the analysis will be conservatively low and based on the mass and energy releases from the reference transient. The mass and energy releases from the updated reference transient were utilized in the execution of a COCO minimum pressure study that demonstrated that the containment backpressure inputs used in the updated reference transient were conservative. The updated reference transient extends to 280 s. The same containment backpressure inputs to 280 s were used in the confirmatory suite and the 124-case ASTRUM runset. However, the ASTRUM runset extends to 500 transient seconds. During the period from 280 to 500 s, the as-executed containment pressure remained the same as the last value to that point. It was subsequently determined that the as-executed runset was nonconservative in the time period from 340 to 500 s. The majority of the transients, however, had already quenched by 340 s and would not be expected to be impacted. The WCOBRA/TRAC PCT for all 124 ASTRUM transients occurs prior to 340 s and is not anticipated to be impacted. The oxidation is anticipated to be marginally impacted, since during the timeframe of the discrepancy, the PCT is significantly reduced. For completeness, a case was reexecuted to 500 s and incorporated an updated backpressure curve (the updated values were extrapolated).

The HOTSPOT PCT, HOTSPOT LMO, and WCOBRA/TRAC hot assembly rod 2 total oxidation were completely unchanged. Hence, the overall analysis results are deemed to remain valid.

15.4-13 REV 30 10/21

FNP-FSAR-15 RHR Miniflow WCOBRA/TRAC does not currently have enough flexibility to precisely model the timing and delivery characteristics of the plant RHR miniflow open and closed configuration.

Westinghouses approach is to sanction a bounding RHR delivery approach that would only credit RHR delivery flow once the miniflow valve is fully closed.

Quarterly RHR Test Configuration Evaluation RHR pump test procedures are performed regularly for the Farley units. This test configuration includes degraded RHR injection, but credits two charging SI pumps, whereas the SI performance in the ASTRUM analysis credits only one charging/SI pump. Both SI performance configurations utilize broken loop spill to 10 psig, and the test configuration yields approximately 6% SI reduction in the low pressure range of interest to LBLOCA analyses. The ASTRUM analysis program consideration of the test configuration is not included in the ASTRUM analysis proper, but is evaluated subsequently by analyzing a larger SI reduction during the early and middle Reflood portion of the transient. The PCT results of this study led to a net PCT penalty of 25°F. See table 15.4-3 for the application of this penalty.

Reactor Coolant Pump Inputs Error Several errors were discovered in the pump two-phase degraded homologous curve. In addition, minor errors were also found in the pump inputs resulting in a slight loop-to-loop asymmetry. The corrected pump inputs have been evaluated. The result from the plant-specific WCOBRA/TRAC runs yielded an estimated PCT increase of 18°F. See table 15.4-3 for the application of this penalty.

Evaluation of Fuel Pellet Thermal Conductivity Degradation and Peaking Factor Burndown Fuel pellet thermal conductivity degradation (TCD) and peaking factor burndown were not explicitly considered in the best estimate large break loss-of-coolant accident (BE LBLOCA)

AOR. A quantitative evaluation was performed to assess the PCT effect of fuel pellet TCD and peaking factor burndown on the BE LBLOCA analysis and concluded that the estimated PCT impact is 150°F. See table 15.4-3 for the application of this penalty.

Revised Heat Transfer Multiplier Distributions Several changes and error corrections were made to WCOBRA/TRAC and the impacts of these changes on the heat transfer multiplier uncertainty distributions were investigated. During this investigation, errors were discovered in the development of the original multiplier distributions, including errors in the grid locations specified in the WCOBRA/TRAC models for the G2 Refill and G2 Reflood tests and errors in processing test data used to develop the reflood heat transfer multiplier distribution. Therefore, the blowdown heatup, blowdown cooling, refill, and reflood heat transfer multiplier distributions were redeveloped. For the reflood heat transfer multiplier development, the evaluation time windows for each set of test experimental data and each test simulation were separately defined based on the time at which the test or simulation exhibited dispersed flow film boiling heat transfer conditions characteristic of the reflood time period. The revised heat transfer multiplier distributions have been evaluated for impact on 15.4-14 REV 30 10/21

FNP-FSAR-15 existing analyses. A plant transient calculation representative of Farley Units 1 and 2 transient behavior was performed with the latest version of WCOBRA/TRAC. Using this transient, a matrix of HOTSPOT calculations was performed to estimate the effect of the heat transfer multiplier distribution changes. Using these results and considering the heat transfer multiplier uncertainty attributes from limiting cases for Farley Units 1 and 2 resulted in an estimated PCT effect of -40°F. See table 15.4-3 for the application of this penalty.

Changes to Grid Blockage Ratio and Porosity A change in the methodology used to calculate grid blockage ratio and porosity for Westinghouse fuel resulted in a change to the grid inputs used in the LBLOCA analysis. Grid inputs affect heat transfer in the core during a LBLOCA. The estimated penalty associated with the changes is 24°F. See table 15.4-3 for the application of this penalty.

Error in Burst Strain Application An error in the application of the burst strain was discovered in HOTSPOT. Correction of the erroneous calculation results in thinner cladding at the burst node and more fuel relocating into the burst node, leading to an increase in PCT at the burst node. The estimated penalty associated with this error is 21°F. See table 15.4-3 for the application of this penalty.

15.4.1.5.4 Deleted 15.4.1.5.5 10 CFR 50.46 Requirements It must be demonstrated that there is a high probability that the limits set forth by 10 CFR 50.46 (reference 4) will not be exceeded. The demonstration that these limits are met for Farley Units 1 and 2 are as follows:

1. The limiting PCT corresponds to a bounding estimate of the 95th percentile PCT at the 95% confidence level. Since the resulting PCT (including changes/errors discovered subsequent to the AOR model development) for the limiting case is 2013°F, the analysis confirms that 10 CFR 50.46 acceptance criterion (b)(1), i.e.,

Peak Clad Temperature less than 2200°F, is demonstrated. The results are shown in table 15.4-3.

2. The maximum cladding oxidation corresponds to a bounding estimate of the 95th percentile LMO at the 95% confidence level. Since the resulting LMO for the limiting case is 2.9%, the analysis confirms that 10 CFR 50.46 acceptance criterion (b)(2), i.e., Local Maximum Oxidation of the cladding less that 70 percent, is demonstrated. The results are shown in table 15.4.3.

3. The limiting core-wide oxidation corresponds to a bounding estimate of the 95th percentile CWO at the 95% confidence level. The limiting hot assembly rod (HAR) total maximum oxidation is 0.22%. A detailed CWO calculation takes advantage of the core power census that includes many lower power assemblies. Because 15.4-15 REV 30 10/21

FNP-FSAR-15 there is significant margin to the regulatory limit, the CWO calculation is, therefore, not needed because the outcome will always be < 0.22%. Since the resulting CWO is 0.22%, the analysis confirms that 10 CFR 50.46 acceptance criterion (b)(3), i.e., Core-Wide Oxidation less than 1 percent, is demonstrated. The results are shown in table 15.4-3.

4. 10 CFR 50.46 acceptance criterion (b)(4) requires that the calculated changes in core geometry are such that the core remains amenable to cooling. This criterion has historically been satisfied by adherence to criteria (b)(1) and (b)(2) and by assuring that fuel deformation due to combined LOCA and seismic loads is specifically addressed. It has been demonstrated that the PCT and maximum cladding oxidation limits remain in effect for best-estimate LOCA applications. The approved methodology (reference 7) specifies that effects of LOCA and seismic loads on core geometry do not need to be considered unless grid crushing extends beyond the 28 assemblies in the low-power channel. This situation has not been calculated to occur in Farley Units 1 and 2. Therefore, acceptance criterion (b)(4) is satisfied.

5. 10 CFR 50.46 acceptance criterion (b)(5) requires that long-term core cooling be provided following the successful initial operation of the ECCS. The approved Westinghouse position on this criterion is that this requirement is satisfied if a coolable core geometry is maintained, and the core remains subcritical following the LOCA (reference 59). This position is unaffected by the use of best-estimate LOCA methodology.

15.4.1.5.6 Plant Operating Range The expected PCT and its uncertainty developed previously are valid for a range of plant operating conditions. The range of variation of the operating parameters has been accounted for in the uncertainty evaluation. Table 15.4-4 summarizes the operating ranges for Farley Units 1/2 as defined for the proposed operating conditions, which are supported by the best-estimate LBLOCA analysis. Table 15.4-6 summarizes the LBLOCA containment data used for calculating containment pressure. It should be noted that other non-LBLOCA analyses may not support these ranges. If operation is maintained within these ranges, the LBLOCA results developed in this report using WCOBRA/TRAC are considered to be valid. Note that some of these parameters vary over their range during normal operation (accumulator temperature) and other ranges are fixed for a given operational condition (Tavg).

Note that the LBLOCA analysis was performed with ZIRLO cladding. However, reference 61 concluded that the LOCA ZIRLO models are acceptable for application to Optimized ZIRLO cladding in large break analyses. No additional calculations are necessary for evaluating the use of Optimized ZIRLO cladding provided plant specific ZIRLO calculations were previously performed.

15.4-16 REV 30 10/21

FNP-FSAR-15 15.4.1.6 Hydrogen Production and Accumulation Hydrogen accumulation in the containment atmosphere following the design basis accident (DBA) can be the result of production from several sources. The potential sources of hydrogen are the zirconium-water reaction, corrosion of construction materials, and radiolytic decomposition of the emergency core cooling solution. The latter source, solution radiolysis, includes both core solution radiolysis and sump solution radiolysis.

15.4.1.6.1 Method of Analysis The quantity of zirconium which reacts with the core cooling solution depends on the performance of the ECCS. The criteria for evaluation of the ECCS require that the zircaloy-water reaction be limited to 1% by weight of the total quantity of zirconium in the core. ECCS calculations have shown the zircaloy-water reaction to be < 0.6%, much less than required by the criteria.

The use of aluminum and zinc inside the containment is limited, and is not used in safety-related components which are in contact with the recirculating core cooling fluid. Aluminum and zinc are more reactive with the containment spray alkaline borate solution than with other plant materials such as carbon and stainless steel, copper, and copper-nickel alloys. By limiting the use of aluminum and zinc, the aggregate source of hydrogen over the long term is essentially restricted to that arising from radiolytic decomposition of core and sump water. The upper limit rate of such decomposition can be predicted with ample certainty to permit the design of effective countermeasures.

During the recirculation phase, trisodium phosphate dissolved in the sump maintains a pH of 7.0 to 10.5; thus, hydrogen production due to aluminum and zinc corrosion is minimized.

It should be noted that the zirconium-water reaction and aluminum and zinc corrosion with containment spray are chemical reactions and, thus, essentially independent of the radiation field inside the containment following a LOCA. Radiolytic decomposition of water is dependent on the radiation field intensity.

The radiation field inside the containment is calculated for the maximum credible accident in which the fission product activities given in TID-14844(19) are used.

The hydrogen generation calculation is performed; one using the Westinghouse model discussed below, the other using the NRC model discussed in Regulatory Guide 1.7.(26) As described in subsection 6.2.5, the resultant hydrogen concentrations from the NRC release model were used in the development of the design criteria for the containment combustible gas control systems.

15.4.1.6.2 Assumptions The following discussion outlines the assumptions used in the calculations:

15.4-17 REV 30 10/21

FNP-FSAR-15 A. Zirconium-Water Reaction The zirconium-water reaction is described by the chemical equation:

Zr + 2 H 2 O ZrO 2 + 2 H 2 + Heat The hydrogen generation due to this reaction will be completed during the first day following the LOCA. The Westinghouse model assumes a 2% zirconium-water reaction and the NRC model assumes a 5% zirconium-water reaction. The hydrogen generated is assumed to be released immediately into the containment atmosphere.

B. Corrosion of Plant Materials Oxidation of metals in aqueous solution results in the generation of hydrogen gas as one of the corrosion products. Extensive corrosion testing has been conducted to determine the behavior of the various metals used in the containment in the emergency core cooling solution at DBA conditions. Metals tested include zircaloy, inconel, aluminum alloys, cupronickel alloys, carbon steel, galvanized carbon steel, and copper. Tests conducted at Oak Ridge National Laboratory (ORNL)(21)(22) have also verified the compatibility of the various materials (exclusive of aluminum) with alkaline borate solution. As applied to the quantitative definition of hydrogen production rates, the results of the corrosion tests have shown that only aluminum and zinc corrode at a rate that may significantly add to the hydrogen accumulation in the containment atmosphere.

The corrosion of aluminum may be described by the overall reaction:

2 Al + 3 H 2 O Al 2 O 3 + 3 H 2 Therefore, three moles of hydrogen are produced for every two moles of aluminum that are oxidized. (Approximately 20 sf3 of hydrogen for each pound of aluminum corroded.)

Corrosion of zinc may be described by the overall reaction:

Zn + 2 H 2 O Zn ( OH ) 2 + H 2 One mole of hydrogen gas is produced for each mole of zinc that is oxidized.

Approximately 6 sf3 of hydrogen gas is produced for each pound of zinc corroded.

The time temperature cycle (table 15.4-8) considered in the calculation of aluminum and zinc corrosion is based on a conservative step representation of the postulated post-accident containment transient. The corrosion rates at the various steps were determined from the aluminum corrosion rate design curve shown in figure 15.4-18. The corrosion rate for zinc at various temperatures is shown in table 15.4-7. These corrosion rates and the zinc inventory described in section 6A.2 were used in the hydrogen generation calculation. Aluminum and zinc 15.4-18 REV 30 10/21

FNP-FSAR-15 corrosion data points include the effects of temperature, alloy, and spray solution conditions. Based on these corrosion rates and the aluminum inventory given in drawing A-508597 (Farley Unit 1) and A-508928 (Farley Unit 2), the contribution of aluminum corrosion to hydrogen accumulation in the containment following the DBA has been calculated. For conservative estimation, no credit was taken for protective shielding effects of insulation or enclosures from the spray, and complete and continuous immersion was assumed.

Drawing A-508597 (Farley Unit 1) and A-508928 (Farley Unit 2) depict the basis for maximum aluminum inventory in containment used in the calculation of post-LOCA hydrogen generation. Table 15.4-13, hydrogen release and generation analyses, is based on aluminum inventory described in drawings A-508597 (Farley Unit 1) and A-508928 (Farley Unit 2) and the zinc inventory as described in section 6A.2. The current aluminum inventory in the containments of Unit 1 and Unit 2 is documented and tracked by these drawings.

The above calculation based on Regulatory Guide 1.7 was performed by allowing an increased corrosion rate during the final step of the post-accident containment temperature transient (table 6A-1) corresponding to 200 mil/yr (15.7 mg/dm2/h) for aluminum and 5 mils/yr (0.395 mg/dm2/h) for zinc. The corrosion rates earlier in the accident sequence are the higher rates determined from figure 15.4-18.

C. Radiolysis of Core and Sump Water Water radiolysis is a complex process involving reactions of numerous intermediates. However, the overall radiolytic process may be described by the reaction:

1 H2O H2 + O2 2

Of interest here is the quantitative definition of the rates and extent of radiolytic hydrogen production following the DBA.

An extensive program has been conducted by Westinghouse to investigate the radiolytic decomposition of the core cooling solution following the DBA. In the course of this investigation, it became apparent that two separate radiolytic environments exist in the containment at DBA. In one case, radiolysis of the core cooling solution occurs as a result of the decay energy of fission products in the fuel. In the other case, the decay of dissolved fission products that have escaped from the core results in the radiolysis of the sump solution. The results of these investigations are discussed in reference 22.

15.4-19 REV 30 10/21

FNP-FSAR-15 15.4.1.6.3 Core Solution Radiolysis As the emergency core cooling solution flows through the core, it is subjected to gamma radiation by decay of fission product in the fuel. This energy deposition results in solution radiolysis and the production of molecular hydrogen and oxygen. The initial production rate of these species will depend on the rate of energy absorption and the specific radiolytic yields.

The energy absorption rate in solution can be assessed from knowledge of the fission products contained in the core and a detailed analysis of the dissipation of the decay energy between core materials and the solution. The results of Westinghouse studies show essentially all of the beta energy will be absorbed within the fuel and cladding; this represents approximately 50% of the total beta-gamma decay energy. This study further shows that, of the gamma energy, a maximum of 7.4% will be absorbed by the solution incore. Thus, an overall absorption factor of 3.7% of the total core decay energy ( + ) is used to compute solution radiation dose rates and the time-integrated dose. Table 15.4-9 presents the total decay energy ( + ) of a reactor core, which assumes a full-power operating time of 830 days prior to the accident. For the maximum credible accident case, the contained decay energy in the core accounts for the assumed TID-14844 release of 50% halogens and 1% other fission products. To be conservative, the noble gases have been assumed by the TID-14844 model to escape to the containment vapor space where little or no water radiolysis would result from decay of these nuclides.

The radiolysis yield of hydrogen in solution has been studied extensively by Westinghouse and Oak Ridge National Laboratory (ORNL). The results of static capsule tests conducted by Westinghouse indicate that hydrogen yields much lower than the maximum of 0.44 molecules per 100 eV would be the case incore. With little gas space to which the hydrogen formed in solution can escape, the rapid back reactions of molecular radiolytic products in solution to reform water are sufficient to result in very low net hydrogen yields.

However, it is recognized that there are differences between the static capsule tests and the dynamic condition incore where the core cooling fluid is continuously flowing. Such flow is reasoned to disturb the steady-state conditions which are observed in static capsule tests, and while the occurrence of back reactions would still be significant, the overall net yield of hydrogen would be somewhat higher in the flowing system.

The study of radiolysis in dynamic systems was initiated by Westinghouse, which formed the basis for experimental work performed at ORNL. Both studies clearly illustrate the reduced yields in hydrogen from core radiolysis; i.e., reduced from the maximum yield of 0.44 molecules per 100 Ev. These results were recently published.(24)(25)

For the purposes of this analysis, the calculations of hydrogen yield from core radiolysis are performed with the very conservative value of 0.44 molecules per 100 Ev. That this value is conservative and a maximum for this type of aqueous solution and gamma radiation is confirmed by many published works. The Westinghouse results from the dynamic studies show 0.44 to be a maximum at very high solution flowrates through the gamma radiation field. The referenced ORNL(23) work also confirms this value as a maximum at high flowrates. Allen(24) presents a very comprehensive review of work performed to confirm the primary hydrogen yield to be a maximum of 0.44 to 0.45 molecules per 100 Ev.

15.4-20 REV 30 10/21

FNP-FSAR-15 On the foregoing basis, the production rate and total hydrogen produced from core radiolysis as a function of time has been conservatively estimated for the maximum credible accident case.

Calculations based on Regulatory Guide 1.7 assume a hydrogen yield value of 0.5 molecules per 100 Ev, 10 percent of the gamma energy produced from fission products in the fuel rods is absorbed by the solution in the region of the core, and the noble gases escape to the containment vapor space.

15.4.1.6.4 Sump Solution Radiolysis Another potential source of hydrogen assumed for the post-accident period arises from water contained in the reactor containment sump being subjected to radiolytic decomposition by fission products. In this consideration, an assessment must be made as to the decay energy deposited in the solution and the radiolytic hydrogen yield, much in the same manner as given above for core radiolysis.

The energy deposited in solution is computed using the following basis:

A. For the maximum credible accident, a TID-14844 release model(19) is assumed where 50% of the total core halogens and 1% of all other fission products, excluding noble gases, are released from the core to the sump solution.

B. The quantity of fission product release is equal to that from a reactor operating at full power for 830 days prior to the accident.

C. The total decay energy from the released fission products, both beta and gamma, is assumed to be fully absorbed in the solution.

Within the assessment of energy release by fission products in water, account is made of the decay of halogens and a separate accounting for the slower decay of the 1% other fission products. To arrive at the energy deposition rate and time-integrated energy deposited, the contribution from each individual fission product class was computed. The overall contribution from each of the two classes of fission products is shown in table 15.4-10.

The yield of hydrogen from sump solution radiolysis is most nearly represented by the static capsule tests performed by Westinghouse and ORNL with the alkaline sodium borate solution.

The differences between these tests and the actual conditions for the sump solution, however, are important and render the capsule tests conservative in their predictions of radiolytic hydrogen yields.

In this assessment, the sump solution will have considerable depth, which inhibits the ready diffusion of hydrogen from solution, as compared to the case with shallow-depth capsule tests.

This retention of hydrogen in solution will have a significant effect in reducing the hydrogen yields to the containment atmosphere. The buildup of hydrogen concentration in solution will enhance the back reaction to formation of water and lower the net hydrogen yield in the same manner as a reduction in gas-to-liquid volume ratio will reduce the yield. This is illustrated by 15.4-21 REV 30 10/21

FNP-FSAR-15 the data presented in figure 15.4-19 for capsule tests with various gas-to-liquid volume ratios.

The data show a significant reduction in the apparent or net hydrogen yield from the published primary maximum yield of 0.44 molecules per 100 Ev. Even at the very highest ratios, where capsule solution depths are very low, the yield is < 0.30 with the highest scatter data point at 0.39 molecules per 100 Ev.

With these considerations taken into account, a reduced hydrogen yield is a reasonable assumption to make for the case of sump radiolysis. While it can be expected that the yield will be on the order of 0.1 or less, a conservative value of 0.30 molecules per 100 Ev has been used in the maximum credible accident case.

Calculations based on Regulatory Guide 1.7 do not take credit for a reduced hydrogen yield in the case of sump radiolysis and a hydrogen yield value of 0.5 molecules per 100 Ev has been used.

15.4.1.6.5 Results Table 15.4-13 shows the results of the calculations for hydrogen production and accumulation from the following sources for the Reg. Guide 1.7 model:

A. Zirconium-water reaction.

B. Aluminum and zinc corrosion.

C. Radiolytic decomposition of core and sump solution.

Table 15.4-13 shows the total hydrogen production rate as a function of time following a LOCA for core and sump radiolytic decomposition and the total quantity of hydrogen accumulated in the containment due to all sources as a function of time for the maximum credible accident case up to 100 days.

The hydrogen generation resulting from the zirconium-water reaction, as described previously, is considered an instantaneous input to the containment and represented as the quantity at zero time. Hydrogen from the other sources is reflected in the overall time function.

These results show that the post-LOCA hydrogen concentration inside containment will not reach 4% by volume with one hydrogen recombiner placed in service 1 day after the start of LOCA (see figure 6.2-94).

15.4.1.7 Environmental Consequences of Postulated Loss-of-Coolant Accident The results of the analysis presented in this section demonstrate that the amounts of radioactivity released to the environment in the event of a LOCA do not result in doses which exceed the NRC acceptance criteria specified in 10 CFR 50.67 The analysis is based on the use of the alternative source term (AST) methodology in Regulatory Guide 1.183(27).

15.4-22 REV 30 10/21

FNP-FSAR-15 The parameters used in the analysis are listed in table 15.4-14. There are four release pathways to the environment modeled in the LOCA analysis: a release during containment purge, direct leakage from containment, ESF leakage outside containment, and leakage from the RWST. The RADTRAD (Version 3.10) code is used in this analysis to calculate the immersion and inhalation dose contributions to both the onsite and offsite radiological dose consequences. Tables 15B-2 and 15B-3 provide the offsite and control room atmospheric dispersion factors used in the radiological dose consequence analysis.

15.4.1.7.1 Containment Purge Pathway The containment mini-purge system normally operates during modes 1, 2, 3, and 4 to provide an acceptable working environment inside containment. Following a LOCA, the mini-purge system isolates prior to the onset of the gap release (as described in Table 4 of RG 1.183), so only those nuclides in the RCS source term are available for release.

For the containment purge release, the entire RCS inventory is assumed to be instantaneously and thoroughly mixed throughout the containment and no sprays or iodine deposition are credited. Since the containment is well mixed with no iodine removal, it is modeled as a single compartment with a volume of 2,030,000 ft3.

The mini-purge exhaust fan discharges to the plant vent through the containment purge filtration unit. For conservatism, no credit is taken for this filtration unit in this analysis. The containment mini-purge system is assumed to be in operation with a fan flow rate of 2850 ft3/min and terminates within 30 s of the start of the event. Atmospheric dispersion factors for the plant vent are applied.

15.4.1.7.2 Containment Leakage Pathway The RADTRAD model used to evaluate the dose contribution due to leakage from the containment includes four compartments and seven pathways between those compartments.

The volume of the sprayed region of containment is the fraction of the total volume covered by containment sprays (82.2% of 2,030,000 ft3). The source term is distributed uniformly throughout the containment; therefore, the source fraction applicable to this compartment is equal to the 82.2% sprayed fraction. Removal of elemental iodine and aerosols by both containment sprays and natural deposition is modeled in this compartment.

The unsprayed region of containment is 17.8% of the total 2,030,000 ft3 containment volume.

The source term fraction is set equal to the sprayed volume fraction. Elemental iodine and aerosol removal by wall deposition is credited in this compartment.

The mixing rate attributed to natural convection between sprayed and unsprayed regions of the containment corresponds to two turnovers of the unsprayed regions per hour. Containment spray flow begins at 90 s and is terminated after 8 h. Circulation flow is not credited between the sprayed and unsprayed region when the containment sprays are secured. The leakage from each of the sprayed and unsprayed regions of containment to the environment is 0.15%

per day, which is reduced to 0.075% per day after 24 h.

15.4-23 REV 30 10/21

FNP-FSAR-15 15.4.1.7.3 ESF Leakage Pathway ESF leakage is the leakage of sump fluid through valve packing, pump seals, and similar components into the auxiliary building. The ESF leakage RADTRAD model is represented by four compartments and five pathways.

With the exception of noble gases, all the fission products released from the fuel to the containment are assumed to be instantaneously and homogeneously mixed in the primary sump water. The containment sump is modeled as a single compartment with a volume of 49,200 ft3.

The release is due to ESF leakage egress to the penetration room and is treated by the penetration room filtration system (PRFS) prior release to the plant vent. No credit is provided for holdup or dilution in the auxiliary building.

Sump fluid release to the environment begins with the start of ECCS recirculation, which occurs at 20 min. The leakage rate is analyzed as 50,000 cc/h in the LOCA dose calculation. The flashing fraction applied to the ESF leakage is 10%. With the exception of iodine, all radioactive materials in the recirculating liquid are assumed to be retained in the liquid phase.

The PRFS is aligned to filter the release 30 min after the start of the LOCA. The PRFS filter efficiencies are 89.5% for particulates and all forms of iodine.

15.4.1.7.4 RWST Release Pathway The ESF leakage pathways include those through valves that isolate containment sump water from interfacing systems. Seat leakage past valves which isolate recirculation flow to the RWST is included. The adjusted leakage rate from the sump, through the RWST, to the environment is modeled as a direct connection between the sump and the environment. All of the radioactive materials in the recirculating liquid with the exception of the iodines are assumed to be retained in the liquid phase, as the leakage path to the RWST is below the RWST waterline.

15.4.1.7.5 Discussion of Results The atmospheric dispersion factors that were used in calculating the offsite radiological dose consequences are listed in table 15B-2. The total effective dose equivalent (TEDE) from the LOCA at the site boundary and low-population zone are given in table 15.4-15. The dose limits for this accident are defined in 10 CFR 50.67, as shown in table 15.4-15. The doses for this conservatively analyzed accident are within the 10 CFR 50.67 requirements. The doses from a LOCA with all safeguards operating as designed would be several orders of magnitude lower than the doses presented in table 15.4-15.

15.4.1.7.6 Radiological Consequences of a Small Break LOCA For this evaluation, a small break LOCA is defined as the release of 100 percent of the activity in the fuel-clad gas gap. The input parameters are as shown in table 15.4-14. The whole body, 15.4-24 REV 30 10/21

FNP-FSAR-15 skin, and thyroid doses from a small break LOCA at the site boundary and low-population zone meet NRC acceptance criteria; i.e., they are within the 10 CFR 100 guidelines.

15.4.1.8 Radiological Consequences to Control Room A conservative analysis is performed to determine the radiological consequences to control room personnel following the postulated LOCA. The parameters used are summarized in table 15.4-16.

15.4.1.8.1 Control Room Ventilation System The design of the control room air-conditioning and filtration system is described in subsection 9.4.1. Actuation logic for the emergency pressurization system is described in paragraph 9.4.1.5.

Following the postulated LOCA, the control room will be pressurized by a nominal flow of 300,

+75-30 ft3/min of filtered air into the control room. However, 10 ft3/min of unfiltered outside air inleakage is conservatively assumed to account for opening and closing of the control room doors and 200 ft3/min unfiltered outside air inleakage is assumed for the control room envelope.

Filtered recirculation of control room air occurs at a nominal rate of 3000, +/- 300 ft3/min (2700 ft3/min, the conservative rate, is used in the analysis).

15.4.1.8.2 Atmospheric Dilution Factors The atmospheric dilution factors (X/Q) were computed at the control room intakes for each hour of meteorological data from January 2000 through December 2004 using ARCON96 as described in Regulatory Guide 1.194. Values were determined for Unit 1 and Unit 2 containment vent stack and RWST release points and the most conservative values were used in calculating radiological consequences to the control room. Table 15.B-2 gives the bounding values for each averaging time. The higher values resulted from a Unit 2 release point.

15.4.1.8.3 Discussion of Results The TEDE to the occupants of the control room for the duration of the LOCA are given in table 15.4-17.

The dose limit applicable to personnel in the control room is 5 rem TEDE, as specified in 10 CFR 50.67.

15.4-25 REV 30 10/21

FNP-FSAR-15 15.4.1.9 Environmental Consequences of Containment Purging to Control Hydrogen After a Loss-of-Coolant Accident Post-LOCA containment purging provides a backup method to the electric recombiners for controlling the potential hydrogen accumulation in the containment.

Two analyses of environmental consequences of purging are performed: a realistic analysis and an analysis based on Regulatory Guide 1.7.(26) The parameters used for each of the analyses are listed in table 15.4-18.

The purging system requires a differential pressure between the containment and the outside atmosphere in order to permit purging. The Regulatory Guide 1.7 analysis is based on a pressure of 2 psig in the containment. If required, the containment is pressurized to 2 psig with diluent air when the hydrogen reaches 3.5 volume percent after the LOCA in the conservative analysis. The hydrogen concentration is reduced by this pressurization. Purging is thus delayed until the next days hydrogen concentration in the containment has been estimated to exceed 3.5 volume percent.

The 3.5% hydrogen level was selected as the point of starting the purge because of the following factors:

A. This level allows a sufficient margin of safety below the lower flammability limit of 4%.

B. It provides a sufficient margin so that purging could be delayed a few days if so desired.

C. The optimum starting time for the purge, from the standpoint of minimizing the doses, is the latest time.

This level allows sufficient margin of safety below the lower flammability limit of 4.1%.

The optimum starting time for the purge, from the standpoint of minimizing the doses, is the latest time. For power uprate the purge begins at approximately 18 days and continues for this duration of the accident.

The purge rate was selected to match the rate of hydrogen generation at the time of initiation of the purge. The hydrogen concentration in the containment will be maintained below 4% as purging continues.

The dose analysis is based on the activity released from the containment after the time of the postulated LOCA until 30 days. The thyroid and whole body doses as a function of distance from the plant due to activity release from containment leakage following the postulated LOCA are computed using the activity release model described in paragraph 15.4.1.7. Additionally, the dose analysis is based on 100% of the noble gases and 50% of the iodines released to the containment. This is due to the containment spray system and plateout reducing the amount of iodine available for release to the environment.

15.4-26 REV 30 10/21

FNP-FSAR-15 For the Regulatory Guide 1.7 analysis, containment purge system filter efficiencies of 89.5%,

30%, and 98.5% are used for the removal of elemental, methyl, and particulate iodines, respectively, which have been reduced by 0.5% for bypass leakage.

The dose models discussed and the atmospheric diffusion factors given in appendix 15B are used in determining doses.

The beta, gamma, and thyroid doses due to containment purging at the low-population zone are given in table 15.4-19 and meet the NRC acceptance criteria. That is, the calculated doses for the post-LOCA containment purging are well within (25% of) the guidelines of 10 CFR 100.

15.4.1.10 Conclusions For breaks up to and including the double-ended severance of a reactor coolant pipe, the ECCS will meet the NRC acceptance criteria as presented in 10 CFR 50.46. That is as follows:

A. The calculated maximum fuel element cladding temperature does not exceed 2200°F.

B. The calculated total oxidation of the cladding does not exceed 17% of the total cladding thickness before oxidation.

C. The calculated total amount of hydrogen generated from the chemical reaction of the cladding with water or steam does not exceed 1% of the hypothetical amount that would be generated if all of the metal in the cladding cylinders surrounding the fuel, excluding the cladding surrounding the plenum volume, were to react.

D. Calculated changes in core geometry are such that the core remains amenable to cooling.

E. After any calculated successful initial operation of the ECCS, the calculated core temperature is maintained at an acceptably low value and decay heat is removed for an extended period of time required by the long-lived radioactivity.

15.4.2 MAJOR SECONDARY SYSTEM PIPE RUPTURE 15.4.2.1 Rupture of Main Steam Line 15.4.2.1.1 Identification of Causes and Accident Description The steam release arising from a rupture of a main steam line would result in an initial increase in steam flow which decreases during the accident as the steam pressure decreases. The energy removal from the RCS causes a reduction of coolant temperature and pressure. In the presence of a negative moderator temperature coefficient, the cooldown results in a reduction of 15.4-27 REV 30 10/21

FNP-FSAR-15 core shutdown margin. If the most reactive RCCA is assumed stuck in its fully withdrawn position after reactor trip, there is an increased possibility that the core will become critical and return to power. A return to power following a steam pipe rupture is a potential problem, mainly because of the high power peaking factors that would exist assuming the most-reactive RCCA to be stuck in its fully withdrawn position. The core is ultimately shut down by the boric acid delivered by the ECCS.

For a double-ended rupture of a main steam line, the radiation releases must remain within the requirements of 10 CFR 50.67. These are the ANSI N18.2 criteria for Condition IV events, "Limiting Faults." The criteria are conservatively met by demonstrating that the DNB design basis is met, a criterion typically used for Condition II events. Therefore, the analysis of a main steam line rupture is performed to demonstrate that the following criteria are satisfied:

1. Assuming a stuck RCCA (with or without offsite power), and assuming a single failure in the ESF, there is no consequential damage to the primary system and the core remains in place and intact. Radiation doses do not exceed the guidelines of 10 CFR 100. Note: Conformance to Part 100 is superseded by the radiological limits of 10 CFR 50.67 for the Farley main steam line break accident.

2. Although DNB and possible cladding perforation following a steam pipe rupture are not necessarily unacceptable, the following analysis, in fact, shows that no DNB occurs for any rupture assuming the most reactive RCCA stuck in its fully withdrawn position.

The rupture of a major steam line, which is classified as an ANS Condition IV event, is the most limiting cooldown transient. It is analyzed at zero power with no decay heat since decay heat would retard the cooldown, thereby reducing the return to power. A detailed discussion of this transient with the most limiting break size, (a double-ended rupture), is presented here.

The following functions provide the necessary protection against a steam pipe rupture:

A. Safety injection system actuation from any of the following:

1. Two out of three low-pressurizer pressure signals.

2. High steam line differential pressure.

3. Low main steam line pressure in two out of three steam lines.

4. Two out of three high containment pressure signals.

B. The overpower reactor trips and the reactor trip occurring in conjunction with receipt of the SI signal.

C. Redundant isolation of the main feedwater lines to prevent sustained high feedwater flow which would cause additional cooldown. Therefore, in addition to the normal control action which will close the main feedwater valves, a safety 15.4-28 REV 30 10/21

FNP-FSAR-15 injection signal will rapidly close all feedwater control valves, trip the main feedwater pumps, and indirectly close the feedwater isolation valves that back up the control valves. In addition, trip of the steam generator feedwater pumps results in automatic closure of the respective pump discharge isolation valve.

D. Trip of the fast-acting main steam line isolation valves (MSIVs, assumed to close in < 10 s) or main steam line isolation bypass valves (MSIBVs, assumed to close in < 10 s) after receipt of an ECCS or main steam line isolation signal on:

1. High steam flow in two out of three main steam lines (one of two per line) in coincidence with two out of three low-low RCS average temperature signals.

2. Low steam line pressure signal in any two out of three steam lines.

3. Two out of three high-high (hi-2) containment pressure signals.

For breaks downstream of the isolation valves, closure of all valves will completely terminate the blowdown. For any break, in any location, no more than one steam generator would experience an uncontrolled blowdown even if one of the isolation valves fails to close. Circuit design assures that the MSIBVs are closed whenever the MSIVs are closed.

Following a steam line break, only one steam generator can blow down completely. Each main steam line is provided with two isolation valves located outside of the containment immediately downstream of the steam line safety valves. The isolation valves are signal-actuated valves which close to prevent flow in the normal (forward) flow direction. The valves on all three steam lines will be driven closed and isolate the other steam generators. Thus, only one steam generator can blow down, minimizing the potential steam release and resultant RCS cooldown.

In addition, the remaining two steam generators will still be available for dissipation of any decay heat after the initial transient is over. In the case of LOSP, this heat is removed to the atmosphere via the atmospheric dump valves which have been sized to handle this situation.

Steam flow is measured by monitoring pressure difference between pressure taps in the steam drum and downstream of the integral flow restrictor nozzles. The effective throat diameter of flow restrictors is 14 in., of considerably smaller diameter than the main steam pipe. These restrictors are located in the steam generators outlet nozzle and serve to limit the maximum steam flow for any break at any location.

15.4.2.1.2 Analysis of Effects and Consequences 15.4.2.1.2.1 Method of Analysis. The analysis of the steam pipe rupture has been performed to determine:

A. The core heat flux and RCS temperature and pressure resulting from the cooldown following the steam line break. The RETRAN-02(52, 53, 54) code has been used.

15.4-29 REV 30 10/21

FNP-FSAR-15 B. The thermal and hydraulic behavior of the core following the steam line break. A detailed thermal and hydraulic digital computer code, VIPRE, has been used to determine if DNB occurs for the core conditions computed in A above.

The following conditions were assumed to exist at the time of the main steam line break accident:

A. End of life (EOL) shutdown margin at no load, equilibrium xenon conditions, and the most reactive RCCA stuck in its fully withdrawn position. Operation of the control rod banks during core burnup is restricted in such a way that addition of positive reactivity in a steam line break accident will not lead to a more adverse condition than the case analyzed.

B. The negative moderator coefficient corresponding to the EOL rodded core with the most reactive RCCA in the fully withdrawn position. The variation of the coefficient with temperature and pressure has been included. The keff versus average coolant temperature at 1000 lb/in.2 corresponding to the negative moderator temperature coefficient plus the Doppler temperature effect used is shown in figure 15.2-40, along with the effect of power generated in the core on overall reactivity.

The core properties associated with the sector nearest the affected steam generator and those associated with the remaining sectors were conservatively combined to obtain average core properties for reactivity feedback calculations.

Further, it was conservatively assumed that the core power distribution was uniform. These two conditions cause underprediction of the reactivity feedback in the high-power region near the stuck rod. To verify the conservatism of this method, the reactivity, as well as the power distribution, was checked. These core analyses considered the Doppler reactivity from the high fuel temperature near the stuck RCCA, moderator feedback from the hot-water enthalpy near the stuck RCCA, power redistribution, and nonuniform core inlet temperature effects. For cases in which steam generation occurs in the high-flux regions of the core, the effect of void formation was also included. It was determined that the reactivity employed in the kinetics analysis was always larger than the true reactivity verifying conservatism, i.e., underprediction of negative reactivity feedback from power generation.

C. Minimum capability for injection of high concentration boric acid solution (2300 ppm from the RWST) corresponding to the most restrictive single failure in the ECCS.

The 2300-ppm boron solution corresponds to the minimum boron concentration in the RWST. A boric acid solution of 0 ppm is assumed in the high-head injection lines and the equivalent volume of the boron injection tank (BIT), which has been deleted. No credit has been taken for the low concentration of boric acid that must be swept from the ECCS lines downstream of the RWST isolation valves prior to the delivery of the concentrated boric acid (2300 ppm from the RWST) to the reactor coolant loops.

15.4-30 REV 30 10/21

FNP-FSAR-15 The SI curve assumed is shown in figure 15.2-41. The flow corresponds to that delivered by one charging pump delivering full flow to the cold leg header. The variation of the mass flowrate due to water density changes is included in the calculations, as is the variation in flowrate in the ECCS due to changes in the RCS pressure. The ECCS flow calculation includes the line losses as well as the SI pump head curve. The modeling of the ECCS in the Westinghouse PWR RETRAN model is described in reference 54.

The boric acid solution from the ECCS is assumed to be uniformly delivered to the three reactor coolant loops. The boron in the loops is then delivered to the inlet plenum where the coolant (and boron) from each loop is mixed and delivered to the core. The calculation assumes the boric acid is mixed with and diluted by the water flowing in the RCS prior to entering the core. The concentration after mixing depends on the relative flowrates of the RCS and the ECCS. The stuck RCCA is conservatively assumed to be located in the core sector near the faulted steam generator.

For the cases where offsite power is assumed, the sequence of events in the ECCS is as follows. After the generation of the SI signal (appropriate delays for instrumentation, logic, and signal transport included), the appropriate valves begin to operate and the high-head injection pump starts. In 27 s, the valves are assumed to be in their final position and the pump is assumed to be at full speed and to be drawing suction from the RWST. The 27 s can be assumed to include 2 s for electronic delay, 10 s for the RWST valve to open, and 15 s for the VCT valve to close. The SI system piping is assumed to contain no boron (0 ppm). This delays the 2300-ppm boron concentration RWST water from reaching the RCS.

This delay in the 2300-ppm solution reaching the RCS is inherently included in the RETRAN model.

In cases where offsite power is not available, an additional 15-s delay is assumed to start the diesels and to reenergize the ESF electrical buses. That is, after a total of 42 s following the time an SI setpoint is reached at the sensor, the ECCS is assumed to be capable of delivering flow to the RCS.

D. To maximize primary-to-secondary heat transfer, 0% steam generator tube plugging is assumed.

E. Since the steam generators are provided with integral flow restrictors with a 1.069-ft2 throat area, any rupture with a break area greater than 1.069 ft2, regardless of location, would have the same effect on the nuclear steam supply system (NSSS) as the 1.069 ft2 break. The following cases have been considered in determining the core power and RCS transients:

1. Complete severance of a pipe, with the plant initially at no-load conditions, and full reactor coolant flow with offsite power available.

15.4-31 REV 30 10/21

FNP-FSAR-15

2. Complete severance of a pipe with the plant initially at no-load conditions with offsite power unavailable. Loss-of-offsite power (LOSP) results in coolant pump coastdown.

F. Power-peaking factors corresponding to one stuck RCCA and nonuniform core inlet coolant temperatures are determined at end of core life. The coldest core inlet temperatures are assumed to occur in the sector with the stuck rod. The power peaking factors account for the effect of the local void in the region of the stuck control assembly during the return to power phase following the steam line break. This void, in conjunction with the large negative moderator coefficient, partially offsets the effect of the stuck assembly. The power peaking factors depend upon the core power, operating history, temperature, pressure, and flow, and thus are different for each case studied.

Both cases assume initial hot-standby conditions at event initiation since this represents the most conservative initial condition.

Should the reactor be just critical or operating at power at the time of a steam line break, the reactor will be tripped by the normal overpower protection when the power level or T reaches a trip setpoint. Following a trip at power, the RCS contains more stored energy than at no-load, the average coolant temperature is higher than at no-load, and there is appreciable energy stored in the fuel. Thus, the additional stored energy is removed via the cooldown caused by the steam line break before the no-load conditions of RCS temperature and shutdown margin assumed in the analyses are reached. After the additional stored energy has been removed, the cooldown and reactivity insertions proceed in the same manner as in the analysis which assumes no-load condition at time zero. In addition, since the initial steam generator water inventory is greatest at no load, the magnitude and duration of the RCS cooldown are less for steam line break occurring at power.

G. In computing the steam flow during a steam line break, the Moody Curve (reference 25) for fl/D = 0 is used. The moody multiplier is 1 with a discharge at dry saturated steam conditions.

H. Perfect moisture separation in the steam generator is assumed unless the mixture level reaches the top of the steam generator. The assumption leads to conservative results since, in fact, considerable water would be discharged. Water carryover would reduce the magnitude of the temperature decrease in the core.

I. The maximum feedwater flow is assumed. Increasing the feedwater flowrate aggravates cooldown accidents like steam line rupture. All main and auxiliary feedwater (AFW) pumps are assumed to be operating at full capacity when the rupture occurs. The analysis of the RCS and main steam system transients, presented in figures 15.4-28 through 15.4-31, assumes an AFW flow of 1000 gal/min delivered to the faulted steam generator with total flow to all steam generators not to exceed 2200 gal/min.

15.4-32 REV 30 10/21

FNP-FSAR-15 J. The effect of heat transferred from thick metal in the pressurizer and reactor vessel upper head is not included in the cases analyzed. Studies previously performed show that the heat transferred from these sources is a net benefit in DNBR and RCS energy when the effect of the extra heat on reactivity and peak power is considered.

15.4.2.1.2.2 Results. The time sequence of events for postulated steam line rupture accidents with and without offsite power is presented in table 15.4-5. The results presented are a conservative indication of the events that would occur assuming a steam line rupture since it is postulated that all of the conditions described in the prior section occur simultaneously.

Figures 15.4-28 and 15.4-29 show the RCS transients and core heat flux following a main steam pipe rupture. Offsite power is assumed to be available such that full reactor coolant flow exists. The transient shown assumes an uncontrolled steam release from only one steam generator.

As can be seen, the core attains criticality with RCCAs inserted (with the design shutdown margin assuming one stuck RCCA) just after the boric acid solution at 2300 ppm enters the RCS from the ECCS which is drawing from the RWST. The delay time consists of the time to receive and actuate the SI signal, to start the high-head SI (HHSI) pumps, and to completely align valve trains in the ECCS lines. The HHSI pumps are then ready to deliver flow. At this stage, a further delay is incurred before 2300-ppm boron solution can be injected to the RCS due to the low concentration solution being swept from the SI lines. Should a partial LOSP occur such that power is lost to the ESF functions, an additional SI delay of 15 s would occur while the diesel generators start up and reenergize the ESF buses. Allowing for these delays, a peak core power well below the nominal full-power value is attained.

Should the core be critical at near zero power when the rupture occurs, the initiation of the SI signal by high steam line differential pressure, low steam line pressure, or high containment pressure will trip the reactor. Steam release from more than one steam generator will be prevented by automatic closure of the isolation valves in the steam lines by low steam line pressure, a high steam flow signal in coincidence with low-low RCS temperature, or high-high containment pressure. The main steam isolation valves (MSIVs) and the MSIBVs are assumed to be fully closed in < 10 s after receipt of a closure signal. Complete steam line isolation occurs when both the MSIVs and MSIBVs are fully closed.

Figures 15.4-30 and 15.4-31 show the responses of the salient parameters for the case discussed above with a total LOSP at the time of the rupture. This assumption results in a coastdown of the reactor coolant pumps (RCPs). In this case, the core power increases at a slower rate and reaches a lower peak value than in the case in which offsite power is available to the RCPs. The ability of the emptying steam generator to extract heat from the RCS is reduced by the decreased flow in the RCS.

It should be noted that following a steam line break, only one steam generator blows down completely. Thus, the remaining steam generators are still available for dissipation of decay heat after the initial transient is over. In case of a LOSP, this heat is removed to the atmosphere via the steam line safety valves.

15.4-33 REV 30 10/21

FNP-FSAR-15 Following blowdown of the faulted steam generator, the plant can be brought to a stabilized hot-standby condition through control of the AFW flow and SI flow as described by plant operating procedures. The operating procedures would call for operator action to limit RCS pressure and pressurizer level by terminating SI flow and to control steam generator level and RCS coolant temperature using the AFW system. Any action required of the operator to maintain the plant in a stabilized condition will be in a time frame in excess of 10 min following SI.

In conjunction with analyses supporting a relaxed setpoint for the overpower T reactor trip function, an analysis of the steam line break event initiated from full power conditions was performed. This event was also analyzed to support the Model 54F steam generators.

Reactor protection in the limiting case is explicitly provided via a reactor trip on the overpower T function. The appropriate reactor trip delays are modeled as indicated in table 15.1-3. The analysis results demonstrate that the minimum DNBR does not go below the limit value and that core power generation does not reach that which would result in fuel damage.

15.4.2.1.3 Conclusions The analysis has shown that the criteria stated earlier in the accidental depressurization of the secondary system section are satisfied. Although preventing clad damage is not necessary for Condition IV events, the results show that the DNB design basis is met. The dose evaluation, as shown in paragraph 15.4.2.1.4, continues to demonstrate that the Condition IV accident criteria are satisfied.

Additionally, the NRC acceptance criteria contained in IE Bulletin 80-84 are met relative to the core transient (reactivity increase) for a main steam line rupture with continued feedwater addition. All potential sources of water were identified. Although a reactor return-to-power is predicted, there is no violation of specified acceptable fuel design limits. The conclusions of this analysis remain valid.

Note that this event was evaluated for the increased power level associated with the measurement uncertainty recapture (MUR) power uprate. The evaluation also considered the effects of fuel thermal conductivity degradation with burnup consistent with the PAD5 fuel performance code (Reference 47). The aforementioned conclusions remain valid.

15.4.2.1.4 Environmental Consequences of a Postulated Steam Line Break The postulated accidents involving release of steam from the secondary system will not result in a release of radioactivity unless there is leakage from the RCS to the secondary system in the steam generators. A conservative analysis of the potential offsite doses resulting from a steam line break outside containment is presented. This analysis incorporates assumptions of defective fuel and steam generator leakage prior to the postulated accident for a time sufficient to establish equilibrium specific activity levels in the secondary system. Parameters used in the analysis are listed in table 15.4-23.

15.4-34 REV 30 10/21

FNP-FSAR-15 The conservative assumptions used to determine the equilibrium concentrations of isotopes in the secondary system are as follows:

A. The primary to secondary leakage in steam generators occurs when the reactor starts up; leakage remains constant during plant operation.

B. The primary to secondary leakage is evenly distributed in steam generators.

C. Primary coolant noble gas activity is associated with 1% defective fuel given in table 11.1-2 and a limiting concurrent iodine spike activity is 0.5 Ci/gm DEI131.

The secondary side concentration of iodine is assumed to be 0.1 Ci/gm DEI131.

D. No noble gas is dissolved or contained in the steam generator water; i.e., all noble gas leaked to the secondary system is continuously released with steam from the steam generators through the condenser off-gas system.

The following conservative assumptions and parameters are used to calculate the activity releases and offsite doses for a steam line break:

A. Prior to the accident, an equilibrium activity of fission products exists in the primary and secondary systems due to a primary to secondary leakage in steam generators.

B. Offsite power is lost, and main steam condensers are not available for steam dump.

C. Eight hours after the accident, the RHR system starts operation to cool down the plant.

D. The primary to secondary leakage is 0.35 gpm in the faulted steam generator and 0.65 gpm in the intact steam generators.

E. A preaccident iodine spike or an accident initiated iodine spike is assumed.

F. Twenty-four hours following the accident, no steam and activity are released to the environment.

G. There is no air ejector release and no steam generator blowdown during the accident.

H. No noble gas is dissolved in the steam generator water.

I. In the intact steam generators, the iodine partition factor is 100. The alkali partition factor is 1000.

15.4-35 REV 30 10/21

FNP-FSAR-15 J. During the postulated accident, iodine carryover from the primary side in the two intact steam generators is diluted in the incoming feedwater.

K. In the faulted steam generator, all the water boils off and releases through the break immediately after the accident. The partition factor for the iodine released is assumed to be 1.0. After this initial release, further iodine is released due to the primary to secondary leakage in the affected steam generator. A partition factor of 1.0 is also assumed for this iodine release.

L. The primary pressure remains constant at 2235 psig for 0 to 2 h and decreases linearly to atmospheric from 2235 psig during the period of 2 to 24 h.

M. The 0- to 2-h, 2- to 8-h, and 8- to 24-h atmospheric diffusion factors given in appendix 15B, and the 0- to 8-h and 8- to 24-h breathing rates of 3.5 x 10-4 m3/s and 1.8 x 10-4 m3/s respectively are applicable.

The steam releases to the atmosphere for the steam line break are given in table 15.4-23.

The TEDE doses for the steam line break accident for the conservative analysis at the site boundary and the low-population zone are given in table 15.4-23. The doses from this accident are within the NRC acceptance criteria described in Regulatory Guide 1.183.

The potential for uncovery of the tubes in the intact steam generators during the event has previously been evaluated for impact on doses and has not been updated for the implementation of 10 CFR 50.67. The tube uncovery was assumed to exist for the first 1/2 h of the accident, and the tube leakage locations were assumed to all be near the top of the tube bundle and, thus, subject to the uncovery. With the primary to secondary leakage entering the vapor space, no credit was taken for mixing with the secondary coolant, nor was credit taken for a partition factor within the steam generator (i.e., the primary coolant was assumed to be released directly to the environment). The uncovery does not impact the release of noble gases to the environment; thus, the gamma and beta doses are not affected. The uncovery does result in an increase in the accident releases of iodine. The effect on the conservative thyroid dose at the site boundary (assuming a primary to secondary leak rate of 1 gal/min is that this dose remains well within the limits as defined in 10 CFR 100.

15.4.2.1.5 Radiological Consequences to Control Room A conservative analysis is performed to determine the radiological consequences to control room personnel following the postulated main steam line break. Parameters used in the analysis and radiological dose result are listed in table 15.4.23a.

15.4-36 REV 30 10/21

FNP-FSAR-15 15.4.2.2 Major Rupture of a Main Feedwater Pipe 15.4.2.2.1 Identification of Causes and Accident Description A major feedwater line rupture is defined as a break in a feedwater pipe large enough to prevent the addition of sufficient feedwater to the steam generators to maintain shell-side fluid inventory in the steam generators.

If the break is postulated in a feedline between the check valve and the steam generator, fluid from the steam generator may also be discharged through the break. Further, a break in this location could preclude the subsequent addition of AFW to the affected steam generator.

(A break upstream of the feedline check valve would affect the NSSS only as a loss of feedwater. This case is covered by the evaluation in subsection 15.2.8).

Depending upon the size of the break and the plant operating conditions at the time of the break, the break could cause either a RCS cooldown (by excessive energy discharge through the break), or a RCS heatup. Potential RCS cooldown resulting from a secondary pipe rupture is evaluated in paragraph 15.4.2.1, Rupture of Main Steam Line. Therefore, only the RCS heatup effects are evaluated for a feedline rupture.

A feedline rupture reduces the ability to remove heat generated by the core from the RCS because of the following reasons:

A. Feedwater to the steam generators is reduced. Since feedwater is subcooled, its loss may cause reactor coolant temperatures to increase prior to reactor trip.

B. Liquid in the faulted loop steam generator may be discharged through the break, and would then not be available for decay heat removal after trip.

C. The break may be large enough to prevent the addition of any main feedwater.

The AFW system is designed to ensure that adequate feedwater will be available to provide heat removal such that:

A. No substantial overpressurization of the RCS shall occur.

B. Liquid in the RCS shall be sufficient to cover the fuel assemblies in the reactor core at all times.

The following provide the necessary protection against a main feedwater rupture:

A. A reactor trip on any of the following conditions:

1. High-pressurizer pressure.

2. Overtemperature T (OTT).

15.4-37 REV 30 10/21

FNP-FSAR-15

3. Low-low steam generator water level in any steam generator.

SI signal from any of the following:

a. Two of three low-pressurizer pressure signals.

b. Two of three high-differential pressure signals between any steam line and remaining steam lines.

c. Low main steam line pressure signals in any two of three lines.

d. Two of three high containment pressure signals.

(Refer to chapter 7 for a description of the actuation system.)

B. An AFW system to provide an assured source of feedwater to the steam generators for decay heat removal. (Refer to chapter 6 for a description of the AFW system.)

15.4.2.2.2 Analysis of Effects and Consequences 15.4.2.2.2.1 Method of Analysis A detailed analysis using the RETRAN-02(52, 53, 54, 64) computer code model is performed to determine the plant transient conditions following a feedwater system pipe rupture. The code models the core neutron kinetics, RCS, including natural circulation, pressurizer, steam generators, safety injection system, and the AFW system. The code computes pertinent parameters, including the core heat flux, RCS temperature, and RCS pressure.

Consistent with the PAD5 fuel performance code (Reference 47), the effects of fuel thermal conductivity degradation with burnup are conservatively accounted for in the analysis.

The RETRAN-02 code is used to calculate the course of the system transient through the time that the AFW system heat removal capacity exceeds decay heat generation.

The primary assumptions for all of the cases analyzed in the major feedwater line rupture analysis are as follows:

A. The plant is initially operating at 100% of the bounding (including uncertainty) NSSS power of 2841 MWt. Maximum RCP heat (15 MWt) is applied in the case that models offsite power always available, while the nominal RCP heat (10 MWt) is applied in the feedwater line rupture cases that model a loss of offsite power.

B. Uncertainties on initial operating conditions (RCS temperature and pressurizer pressure) are applied in the limiting direction.

15.4-38 REV 30 10/21

FNP-FSAR-15 C. The pressurizer spray control system and high pressurizer pressure reactor trip are not modeled.

D. The pressurizer power operated relief valves are assumed to be operable.

E. A conservative break discharge quality is calculated by the RETRAN-02 computer code. The quality changes as a function of the conditions in the steam generator.

F. The low-low steam generator water level reactor protection function is credited when the water level reaches 0% narrow-range span (NRS) in the faulted loop steam generator.

G. The worst possible break area is modeled (0.200 ft2); i.e., one that effectively empties the affected steam generator and causes a reactor trip on low-low steam generator water level. This minimizes the steam generator fluid inventory at the time of trip, and thereby, maximizes the resultant heatup of the reactor coolant. A break area spectrum study was performed to confirm the limiting break size.

H. The enhanced thick metal mass heat transfer model method of Reference 64 was applied.

With this model, credit is taken for some of the primary system heat being absorbed by the RCS metal, which reduces the severity of the heatup transient.

I. Charging and letdown are not modeled.

J. Steam Generator heat transfer area decreases as the shell-side liquid inventory decreases.

K. The ANS-5.1-1979 standard residual decay heat plus 2 uncertainty model (Reference 32) is applied based on long-term operation at the initial power level preceding the trip.

L. The following describes inputs that are specific to each of Cases A and B.

Case A A. Assuming operator action to isolate the faulted loop, AFW is initiated to the steam generators of the two intact loops 10 minutes after the reactor trip at a total rate of 350 gpm.

The cold AFW is mixed with the hotter water occupying the AFW purge lines until a homogeneous temperature distribution in the purge lines is achieved for each time step. This produces a conservatively slow transition to the cold AFW.

B. Analyses are performed both with and without offsite electrical power available. When a loss of offsite electrical power is assumed after the reactor trip, the reactor coolant pumps trip and the reactor coolant flow decreases to natural circulation.

C. Limiting reactivity coefficients reflecting maximum feedback are applied for the case that models offsite power always available. For the case that models a loss of offsite power, limiting reactivity coefficients reflecting minimum feedback are applied.

D. Main feedwater to all steam generators is assumed to stop at the time the break occurs (i.e., all main feedwater spills out through the break).

15.4-39 REV 30 10/21

FNP-FSAR-15 Case B An analysis has also been performed to demonstrate that the operator has at least 30 minutes to increase AFW flow to the intact steam generators without hot leg boiling prior to transient turnaround. The major analysis-specific assumptions are as follows:

A. AFW is automatically initiated to the steam generators of the two intact loops after the reactor trip at a total rate of 105 gpm after a 60-second delay for AFW pump startup. After operator action to isolate the faulted loop 30 minutes after reactor trip, AFW increases to 350 gpm.

B. Analysis is performed with a loss of offsite electrical power assumed as a result of the reactor trip. When a loss of offsite electrical power is assumed after the reactor trip, the reactor coolant pumps trip and the reactor coolant flow decreases to natural circulation.

C. Limiting reactivity coefficients reflecting minimum feedback are assumed.

D. Main feedwater to the faulted steam generator is assumed to stop at the time the break occurs. With the smallest break size (0.200 ft2), some main feedwater is expected to reach the intact steam generators, as observed in Reference 65, p. 5-10 and Figure 5-20. A conservatively low 30% of the initial main feedwater flow is assumed to continue to be delivered to the two intact steam generators just until the time of reactor trip (rod motion) in the 0.200 ft2 break size case.

E. The ANS 5.1-1979 decay heat standard plus 2 uncertainty was modeled, but with a reduction in the permissible fuel burnup and enrichment combinations comprising the overall decay heat contribution that is typically input to the standard RETRAN-02 model.

F. Following the method of Reference 64, the analysis takes credit for a more realistic initial steam generator water mass and steam generator water mass at the low-low steam generator level reactor trip setpoint than predicted with the models described in Reference 54. Consistent with Reference 64, the more realistic steam generator water masses were subsequently reduced to provide additional conservatism. As described in Reference 64, the analysis also uses the steam generator mass as the trip parameter instead of the less accurate steam generator level determined by the RETRAN-02 model.

15.4.2.2.3 Results Case A - Offsite Power Available Figure 15.4-32 (sheets 1 and 2) shows the calculated plant parameters following a feedline rupture for Case A with offsite power always available. The results show that the applied AFW flow rate is capable of removing decay heat approximately 3088 seconds after reactor trip. After this time, core decay heat decreases below the AFW heat removal capacity and reactor coolant temperatures and pressures decrease. The calculated time sequence of events for this case is presented in Table 15.4-5.

15.4-40 REV 30 10/21

FNP-FSAR-15 Case A - Loss of Offsite Power Figure 15.4-32 (sheets 3 and 4) shows the calculated plant parameters following a feedline rupture for Case A with a loss of offsite power. The results show that the applied AFW flow rate is capable of removing decay heat approximately 1577 seconds after reactor trip. After this time, core decay heat decreases below the AFW heat removal capacity and reactor coolant temperatures and pressures decrease. The calculated time sequence of events for this case is presented in Table 15.4-5.

Case B - Loss of Offsite Power Figure 15.4-32 (sheets 5 and 6) show the calculated plant parameters following a feedline rupture for Case B. The results show that the applied AFW flow rate is capable of removing decay heat approximately 1908 seconds after reactor trip. After this time, core decay heat decreases below the AFW heat removal capacity and reactor coolant temperatures and pressures decrease. The calculated time sequence of events for Case B is presented in Table 15.4-5.

The system response following the feedwater line rupture is similar for both Case A and Case B.

Pressurizer pressure increases until the reactor trip occurs on low-low steam generator narrow range level. Pressure then decreases, due to the loss of heat input, until the SI system is actuated on low steam line pressure in the ruptured loop for Case A and low-pressurizer pressure for Case B. Coolant expansion occurs due to reduced heat transfer capability in the steam generators. The pressurizer power-operated relief valves open to maintain primary pressure at an acceptable value. Addition of the SI flow aids in cooling down the primary and helps to ensure that sufficient fluid exists to keep the core covered with water.

The reactor core remains covered with water throughout the transient, as water relief due to thermal expansion is limited by the heat removal capability of the AFW and makeup is provided by the SI system. Bulk boiling does not occur in the RCS at any time in the transient before the AFW system is capable of removing decay heat and the event turns around (i.e., pressurizer pressure, hot leg temperatures, and cold leg temperatures begin to decrease).

15.4.2.2.4 Conclusion Results of the analysis show that for the postulated feedline rupture, the assumed AFW system capacity is adequate to remove decay heat, to prevent overpressurizing the RCS and main steam system, and to prevent uncovering the reactor core. The analysis results also verify that the natural circulation capacity of the RCS provides sufficient heat removal capacity following reactor coolant pump coastdown. In addition to the NRC Acceptance Criteria for Condition IV events described in paragraph 15.4, the analysis of the feedwater system pipe break meets the NRC acceptance criteria specific to feedwater system pipe breaks. That is, the primary and secondary side pressures do not exceed allowable limits and the core remains adequately covered.

15.4-41 REV 30 10/21

FNP-FSAR-15 15.4.3 STEAM GENERATOR TUBE RUPTURE 15.4.3.1 Accident Description The bounding accident examined is the complete severance of a single steam generator tube.

The accident is assumed to take place at power with the reactor coolant contaminated with fission products corresponding to continuous operation with a limited amount of defective fuel rods. The accident leads to an increase in contamination of the secondary system due to leakage of radioactive coolant from the RCS. In the event of a coincident LOSP or failure of the condenser dump system, discharge of activity to the atmosphere takes place via the steam generator safety and/or PORVs.

In view of the fact that the steam generator tube material is Inconel 600 and is a highly-ductile material, it is considered that the assumption of a complete severance is somewhat conservative. The more probable mode of tube failure would be one or more minor leaks of undetermined origin. Activity in the steam and power conversion system is subject to continual surveillance, and an accumulation of minor leaks which exceed the limits established in the Technical Specifications is not permitted during the unit operation.

The operator is expected to determine that a steam generator tube rupture has occurred, and to identify and isolate the affected steam generator on a restricted time scale in order to minimize contamination of the secondary system and ensure termination of radioactive release to the atmosphere from the affected unit. The recovery procedure can be carried out on a time scale which ensures that break flow to the secondary system is terminated before water level in the affected steam generator rises into the main steam pipe. Sufficient indications and controls are provided to enable the operator to carry out these functions satisfactorily.

Consideration of the indications provided at the control board, together with the magnitude of the break flow, leads to the conclusion for a complete severance of a single steam generator tube, that the isolation procedure can be completed within 30 min of accident initiation.

Assuming normal operation of the various plant control systems, the following events are initiated following the complete severance of a single steam generator tube:

A. Pressurizer low-pressure and low-level alarms are actuated and charging pump flow increases in an attempt to maintain pressurizer level. On the secondary side, there is a steam flow/feedwater flow mismatch alarm as feedwater flow to the affected steam generator is reduced due to the additional break flow which is now being supplied to that unit.

B. Continued loss of reactor coolant inventory leads to a reactor trip signal generated by low-pressurizer pressure or overtemperature T. Resultant plant cooldown following reactor trip leads to a rapid change of pressurizer level; the SI signal, initiated by low-pressurizer pressure, follows soon after the reactor trip. The SI signal automatically terminates normal feedwater supply and initiates AFW feedwater addition. Although the original design bases do not consider a single failure, the analyses prepared for power uprate and thereafter consider the failure 15.4-42 REV 30 10/21

FNP-FSAR-15 of the steam-driven auxiliary feedwater pump. This failure is not the most limiting single failure; however, the consideration of this single failure is more conservative than was required by the original design and is acceptable (reference 51).

C. The secondary side radiation monitors will alarm, indicating a sharp increase in radioactivity in the secondary system, and will isolate steam generator sample and blowdown lines as shown in table 11.4-2.

D. The reactor trip automatically trips the turbine and if offsite power is available, the steam dump valves open permitting steam dump to the condenser. In the event of a coincident LOSP, the steam dump valves would automatically close to protect the condenser. In this case, the steam generator pressure would rapidly increase, resulting in steam discharge to the atmosphere through the steam generator safety and/or PORVs.

E. Following reactor trip, the continued action of AFW supply and borated SI flow (supplied from the RWST) provide a heat sink which absorbs some of the decay heat. Thus, steam bypass to the condenser, or in the case of LOSP, steam relief to atmosphere, is attenuated during the 30 min in which the recovery procedure leading to isolation is being carried out.

F. SI flow results in increasing pressurizer water level. The time after trip at which the operator can clearly see returning level in the pressurizer is dependent upon the amount of operating auxiliary equipment.

15.4.3.2 Analysis of Effects and Consequences 15.4.3.2.1 Method of Analysis In estimating the mass transfer from the RCS through one completely severed tube, the following conservative assumptions are made:

A. Reactor trip and SI injection occur automatically as a result of low-pressurizer pressure SI setpoint actuation.

B. Following the initiation of the SI, all centrifugal charging/SI pumps are actuated and continue to deliver flow for 30 min.

C. After reactor trip, the break flow reaches equilibrium at the point where incoming SI flow is balanced by outgoing break flow as shown in figure 15.4-23. The resultant break flow persists from plant trip until 30 min beyond initiation of the accident.

D. The steam generators are controlled at the safety valve setting minus 3% main steam safety valve (MSSV) tolerance rather than at the PORV setting. The lowest safety valve setpoint is modeled with 13% blowdown.

15.4-43 REV 30 10/21

FNP-FSAR-15 E. The operator identifies the accident type and terminates break flow to the affected steam generator within 30 min of accident initiation.

Mass and energy balance calculations are performed to determine primary to secondary mass release and to determine the amount of steam vented from each of the steam generators.

15.4.3.2.2 Recovery Procedure Immediately apparent symptoms of a tube rupture accident, such as falling pressurizer pressure and level and increased charging pump flow, are also symptoms of small steam line breaks and LOCAs. It is therefore important for the operator to determine that the accident is a rupture of a steam generator tube in order that he may carry out the correct recovery procedure. The steam generator tube rupture may be identified by a secondary side radiation monitor (see table 11.4-

2) indication or alarm; and the operator will proceed with the following recovery procedures only if at least one of these alarms is received. In the event of a relatively large rupture, it will be clear soon after trip that the level in one steam generator is rising more rapidly than in the others. This too is a unique indication of a tube rupture accident.

The operator normally carries out the following major actions subsequent to a reactor trip:

1. Identify the affected steam generator.

The affected steam generator can be identified by an unexpected increase in steam generator narrow range level or a high radiation indication on the corresponding radiation monitor or sample. In some cases, the affected steam generator may be obvious prior to reactor trip due to steam flow/feed flow mismatch or steam generator level deviation alarms. For larger tube failures, rapidly increasing water level should be evident soon after trip. However, sampling/monitoring for high activity may be necessary to locate smaller tube failures. This response provides confirmation of an SGTR event and also identifies the affected steam generator.

2. Isolate the affected steam generator from the intact steam generators and isolate feedwater to the affected steam generator.

Once a tube rupture has been identified, recovery actions begin by isolating steam flow from and stopping feedwater flow to the affected steam generator. In addition to minimizing radiological releases, this also reduces the possibility of overfilling the affected steam generator.

3. Cool down the RCS using the intact steam generators.

After isolation of the affected steam generator, the RCS is cooled as rapidly as possible to less than the saturation temperature corresponding to the affected steam generator pressure by dumping steam from the intact steam generators.

This ensures adequate subcooling in the RCS after depressurization to the affected steam generator pressure in subsequent actions. If offsite power is 15.4-44 REV 30 10/21

FNP-FSAR-15 available, the normal steam dump system to the condenser can be used to perform this cooldown. However, if offsite power is lost or the normal steam dump system is unavailable, the RCS is cooled using the power-operated relief valves PORVs on the intact steam generators.

4. Depressurize the RCS to restore reactor coolant inventory.

When the cooldown is completed, RCS pressure must be reduced to stop primary to secondary leakage. The RCS depressurization is performed using normal pressurizer spray if the reactor coolant pumps (RCPs) are running. However, if offsite power is lost or the RCPs are not running for some other reason, normal pressurizer spray is not available. In this event, RCS depressurization can be performed using a pressurizer PORV or auxiliary pressurizer spray.

5. Terminate SI to stop primary to secondary leakage.

The previous actions will have established adequate RCS subcooling, a secondary side heat sink, and sufficient reactor coolant inventory to ensure that SI flow is no longer needed. When these actions have been completed, SI flow must be stopped to terminate primary to secondary leakage. Primary to secondary leakage will continue after SI flow is stopped until RCS and affected steam generator pressures equalize. Charging flow, letdown, and pressurizer heaters will then be controlled to prevent repressurization of the RCS and reinitiation of leakage into the affected steam generator.

6. Prepare for cooldown to cold shutdown.

Following SI termination, the plant conditions will be stabilized, the primary to secondary break flow will be terminated, and all immediate safety concerns will have been addressed. At this time, a series of operator actions are performed to prepare the plant for cooldown to cold shutdown conditions. Subsequently, actions are performed to cool down and depressurize the RCS to cold shutdown conditions and to depressurize the affected steam generator.

After the RHR system is placed in operation, the condensate accumulated in the secondary system can be examined and processed as required.

Figure 15.4-24 gives estimated primary and secondary system pressure histories which could be expected to occur during a steam generator tube rupture transient and subsequent recovery.

Injected flow equals or exceeds leakage flow at the time of SI actuation. It is conservatively assumed that steam venting through the affected steam generator safety valves occurs until 30 min after the accident. Normally, the operator would isolate the affected steam generator as soon as possible after identifying the accident.

Paragraph 15.4.3.1 describes the accident sequence as analyzed. The flow from a severed tube is assumed to reach an equilibrium at the point where SI flow is balanced by break flow.

This break flow is conservatively assumed to persist until 30 min following accident initiation, at which time the operator will have terminated the break flow to the affected steam generator.

15.4-45 REV 30 10/21

FNP-FSAR-15 Paragraph 15.4.3.2 outlines those operations which the operator could perform to terminate flow to the affected steam generator and prepare for cooldown to cold shutdown. The core will remain completely covered by liquid throughout the accident. Thus, clad temperatures will remain very near the saturation temperature of the coolant, even if DNB were postulated to occur.

There is ample time available to carry out the above recovery procedures such that isolation of the affected steam generator is established before water level rises into the main steam pipes.

The available time scale is improved by the termination of AFW flow in the affected steam generator. Normal operator vigilance therefore assures that excessive water level will not be attained.

15.4.3.2.3 Results Figure 15.4-23 illustrates the break flowrate following reactor trip/SI that would result through the severed steam generator tube. The previous assumptions lead to a conservative upper-limit estimate of 158,000 lb for the total amount of reactor coolant transferred to the secondary side of the affected steam generator as a result of a tube rupture accident. The amount of steam released from the affected steam generator is shown in table 15.4-24 15.4.3.3 Conclusions A steam generator tube rupture will cause no subsequent damage to the RCS or the reactor core. An orderly recovery from the accident can be completed, even assuming simultaneous LOSP. Offsite dose consequences may be calculated based on a conservative estimate of 158,000 lb of reactor coolant transferred to the secondary side of the affected steam generator following the accident. The amount of steam released from the affected steam generator is shown in table 15.4-24.

15.4.3.4 Environmental Consequences of a Postulated Steam Generator Tube Rupture The postulated accidents involving release of steam from the secondary system will not result in a release of radioactivity unless there is leakage from the RCS of the secondary system in the steam generators. A conservative analysis of the postulated steam generator tube rupture assumes the LOSP and hence involves the release of steam from the secondary system. A conservative analysis of the potential offsite doses resulting from this accident is presented.

This analysis incorporates assumptions of defective fuel and steam generator leakage prior to the postulated accident for a time sufficient to establish equilibrium specific activity levels in the secondary system.

Parameters used in the conservative analyses are listed in table 15.4-24.

The conservative assumptions used to determine the equilibrium concentrations of isotopes in the secondary system are as follows:

15.4-46 REV 30 10/21

FNP-FSAR-15 A. The primary to secondary leakage in steam generators occurs when the reactor starts up; leakage remains constant during plant operation.

B. The primary to secondary leakage is evenly distributed in steam generators.

C. Primary coolant noble gas activity is associated with 1% defective fuel given in table 11.1-2 and a limiting pre-accident iodine activity of 30.0 Ci/gm DEI131. The secondary side concentration of iodine is assumed to be 0.1 Ci/gm DEI131.

D. No noble gas is dissolved or contained in the steam generator water; i.e., all noble gas leaked to the secondary system is continuously released with steam from the steam generators through the condenser off-gas system.

The following conservative assumptions and parameters are used to calculate the activity releases and offsite doses for the postulated steam generator tube rupture:

A. Prior to the accident, an equilibrium activity of fission products exists in the primary and the secondary systems due to a primary to secondary leakage in steam generators.

B. Offsite power is lost, and main steam condensers are not available for steam dump.

C. Eight hours after the accident, the RHR system starts operation to cool down the plant.

D. The primary to secondary leakage is 0.35 gpm in the faulted steam generator and 0.65 gpm in the intact steam generators.

E. A preaccident iodine spike or an accident initiated concurrent iodine spike is assumed.

F. Eight hours following the accident, no steam and activity are released to the environment.

G. There is no air ejector release after reactor trip and no steam generator blowdown during the accident.

H. No noble gas is dissolved in the steam generator water.

I. In the intact steam generators, the iodine partition factor is 100. The alkali partition factor is 1000.

J. During the postulated accident, iodine carryover from the primary side in the two intact steam generators is diluted in the incoming feedwater.

15.4-47 REV 30 10/21

FNP-FSAR-15 K. Steam release to atmosphere and the associated activity release from the intact steam generators is terminated at 8 h after the accident, when the RHR system takes over in cooling down the plant.

L. Thirty minutes after the accident the pressure between the ruptured steam generator and the primary system is equalized. The ruptured steam generator is isolated. No steam and fission product activities are released from the ruptured steam generator thereafter.

M. The 0- to 2- and 2- to 8-h atmospheric diffusion factors given in appendix 15B and the 0- to 8-h breathing rate of 3.5 x 10-4 m3/s are applicable.

The steam releases to the atmosphere for the steam generator tube rupture are given in table 15.4-24.

Results For the conservative analysis, doses at the site boundary and at the low population zone are shown in Table 15.4-24. The doses are within the NRC acceptance criteria described in Regulatory Guide 1.183.

The potential for uncovery of the steam generator tubes during the event has also been evaluated for impact on doses. The tube uncovery was assumed to exist for the first 30 min of the accident, and the tube rupture location was assumed to all be near the top of the tube bundle and, thus, subject to the uncovery. With the primary to secondary leakage entering the vapor space, no credit was taken for mixing with the secondary coolant, nor was credit taken for a partition factor within the steam generator (i.e., the primary coolant was assumed to be released directly to the environment). The uncovery does not impact the release of noble gases to the environment; thus, the gamma and beta doses are not affected. The uncovery does result in an increase in the accident releases of iodine. The effect on the conservative thyroid dose at the site boundary (assuming a primary to secondary leak rate of 500 gal/day per intact steam generator) is that this dose meets the NRC acceptance criteria. That is, the doses from the accident are a small fraction (10 percent) of the limits as defined in 10 CFR 100.

15.4.3.5 Radiological Consequences to Control Room A conservative analysis is performed to determine the radiological consequences to control room personnel following the postulated steam generator tube rupture accident. Additional parameters used in the analysis and radiological dose result are listed in table 15.4.24a.

15.4-48 REV 30 10/21

FNP-FSAR-15 15.4.4 SINGLE REACTOR COOLANT PUMP LOCKED ROTOR 15.4.4.1 Identification of Causes and Accident Description The accident postulated is an instantaneous seizure of a RCP rotor (such as is discussed in subsection 5.5.1) or the sudden break of the shaft of a RCP. Flow through the affected reactor coolant loop is rapidly reduced, leading to an initiation of a reactor trip on a low flow signal.

Following initiation of the reactor trip, heat stored in the fuel rods continues to be transferred to the coolant causing the coolant to expand. At the same time, heat transfer to the shell side of the steam generators is reduced, first because the reduced flow results in a decreased tube-side film coefficient and then because the reactor coolant in the tubes cools down while the shell-side temperature increases (turbine steam flow is reduced to zero upon plant trip due to turbine trip on reactor trip). The rapid expansion of the coolant in the reactor core, combined with reduced heat transfer in the steam generators, causes an insurge into the pressurizer and a pressure increase throughout the RCS. The insurge into the pressurizer compresses the steam volume, actuates the automatic spray system, opens the PORVs, and opens the pressurizer safety valves, in that sequence. The two PORVs are designed for reliable operation and would be expected to function properly during the accident. However, for conservatism, their pressure-reducing effect, as well as the pressure-reducing effect of the spray, is not included in the analysis.

The consequences of a locked rotor (i.e., an instantaneous seizure of a pump shaft) are very similar to those of a pump shaft break. The initial rate of reduction of coolant flow is slightly greater for the locked rotor event. However, with a failed shaft, the impeller could conceivably be free to spin in the reverse direction. The effect of such reverse spinning is to decrease the steady-state core flow when compared to the locked rotor scenario. Only one analysis is performed, representing the most limiting condition for the locked rotor and pump shaft break accidents.

15.4.4.2 Analysis of Effects and Consequences 15.4.4.2.1 Method of Analysis Two digital computer codes are used to analyze this transient. The LOFTRAN(30) code is used to calculate the resulting loop and core coolant flow following the pump seizure, the time of reactor trip (based on the loop flow transient), nuclear power following reactor trip, and to determine the peak RCS pressure. The thermal behavior of the fuel located at the core hotspot and DNBR are investigated using the VIPRE(63) code which uses the core flow and the nuclear power calculated by LOFTRAN. Also consistent with the PAD5 fuel performance code (Reference 47), the effects of fuel thermal conductivity degradation with burnup are conservatively accounted for in the analysis.

Two cases are analyzed: a peak RCS pressure / peak clad temperature (PCT) case and a rods-in-DNB case. In each case, one locked rotor/shaft break with three loops in operation is 15.4-49 REV 30 10/21

FNP-FSAR-15 modeled. The accident is evaluated without offsite power available. Power is assumed to be lost to the unaffected pumps 2 s after rod motion following a reactor trip on low RCS flow.

15.4.4.2.2 Initial Operating Conditions At the beginning of the postulated locked rotor accident, the plant is assumed to be operating under the most-adverse steady-state operating conditions. These include the maximum steady-state power level, pressure, and coolant average temperature. The reactivity coefficients assumed in the analysis (table 15.1-2A) include a conservative moderator temperature coefficient of 0 pcm/°F (+7 70% RTP ramping to 0 at 100% RTP) and a conservatively large (absolute value) of the Doppler-only power coefficient. The total integrated Doppler reactivity from 0 to 100% power is assumed to be -0.016 k. For this analysis, the curve of trip reactivity versus time (figure 15.1-4) was used with a 4.8% k trip reactivity which includes the most-reactive RCCA stuck out of the core.

15.4.4.2.3 Evaluation of the Pressure Transient After pump seizure, the neutron flux is rapidly reduced by control rod insertion effect. Rod motion is assumed to begin 1 s after the flow in the affected loop reaches 85% of nominal flow.

No credit is taken for the pressure-reducing effect of the pressurizer relief valves, pressurizer spray, steam dump, or controlled feedwater flow after plant trip.

Although these systems are expected to function and would result in a lower peak pressure, an additional degree of conservatism is provided by ignoring their effect.

The pressurizer safety valves are actuated at 2550 psia. This includes 2% uncertainty over the nominal setpoint of 2500 psia. Additionally, the flow through the pressurizer safety valves was modeled with 5-psi accumulation, i.e., the flow ramps from zero to full-rated flow (steam relief of 287.5 lbm/s) over the range of 2550 to 2555 psia.

15.4.4.2.4 Evaluation of PCT and Zirconium-Water Reaction During the Accident For this accident, DNB is assumed to occur in the core; at the initiation of the transient in order to conservatively predict the peak clad temperature. Therefore, an evaluation of the consequences with respect to fuel rod thermal transients is performed. Results obtained from analysis of this hotspot condition represent the upper limit with respect to clad temperature and zirconium-water reaction.

In the evaluation, the rod power at the hotspot is assumed to be 2.5 times the average rod power at the initial core power level.

15.4-50 REV 30 10/21

FNP-FSAR-15 15.4.4.2.5 Film Boiling Coefficient The film boiling coefficient is calculated using the Bishop-Sandberg-Tong film boiling correlation.

The fluid properties are evaluated at film temperature (average between wall and bulk temperatures). VIPRE calculates the film coefficient at every time step based upon the actual heat transfer conditions at the time. The nuclear power, system pressure, bulk density, and mass flowrate as a function of time are used as program input.

15.4.4.2.6 Fuel Clad Gap Coefficient The magnitude and time dependence of the heat transfer coefficient between fuel and cladding (gap coefficient) has a pronounced influence on the thermal results. The larger the value of the gap coefficient, the more heat is transferred between pellet and clad. For the initial portion of the transient, a high gap coefficient produces higher clad temperatures since the heat stored and generated in the fuel redistributes itself in the cooler cladding. This effect is reversed when the clad temperature exceeds the pellet temperature in cases where a zirconium-steam reaction is present. Based on investigations of the effect of the gap coefficient upon the maximum clad temperature during the transient, the gap coefficient was assumed to increase from a steady-state value consistent with initial fuel temperatures to 10,000 Btu/h-ft2-°F at the initiation of the transient. Thus, the large amount of energy stored in the fuel is released to the clad at the initiation of the transient.

15.4.4.2.7 Zirconium-Steam Reaction The zirconium-steam reaction can become significant above 1800°F (clad temperature). In order to take this phenomenon into account, the following Baker-Just correlation, which defines the rate of the zirconium-steam reaction, was introduced into the model(34):

d( w 2 ) ( 45,500)

= 33.3 x 106 exp dt 1.986T where:

w = amount Zr reacted (mg/cm2) t = time (s)

T = temperature (°K)

The reaction heat is 1510 cal/g.

The effect of zirconium-steam reaction is included in the calculation of the "hot spot" clad temperature transient.

15.4-51 REV 30 10/21

FNP-FSAR-15 15.4.4.2.8 Evaluation of Rods-in-DNB An evaluation of the number of Rods-in-DNB was performed in order to assess the radiological consequences of the event. Analysis assumptions were made to maximize the heat flux and thus minimize the DNBR.

15.4.4.2.9 Results Peak RCS Pressure / Peak Clad Temperature Case The calculated sequence of events for the peak RCS pressure / peak clad temperature case is shown in table 15.4-5. The peak RCS pressure reached during the transient is less than that which would cause stresses to exceed the faulted condition stress limits.

The peak clad surface temperature is less than 2700 ºF (for ZIRLO), and the more restrictive limit of 2375°F (associated with Optimized ZIRLO cladding). It should be noted that the clad temperature was conservatively calculated assuming that DNB occurs at the initiation of the transient. The transient results are shown in Figures 15.4-33 through 15.4-35 and 15.4-38.

Rods-in DNB Case The calculated sequence of events for the Rods-in DNB case is shown in Table 15.4-5. The number of rods-in-DNB is less than 20% of the core.

The results of these calculations (peak pressure, peak clad temperature, and zirconium-steam reaction) are also summarized in table 15.4-25.

15.4.4.3 Conclusions The analysis has shown the following:

A. Since the peak RCS pressure reached during the transient is less than that which would cause stresses to exceed the faulted condition stress limits, the integrity of the primary coolant system is not endangered.

B. Since the peak clad surface temperature calculated for the hotspot during the worst transient remains less than 2700°F (for ZIRLO) and 2375°F (Optimized ZIRLO) and the amount of zirconium-water reaction is small, the core will remain in place and intact with no loss of core cooling capability.

C. The number of fuel rods in DNB calculated for dose analysis is less than 20% of the core.

15.4-52 REV 30 10/21

FNP-FSAR-15 15.4.4.4 Environmental Consequences of a Single Reactor Coolant Pump Locked Rotor The radiological effects of a single reactor coolant pump locked rotor have been analyzed using assumptions as discussed below. The models used to calculate offsite doses are discussed in appendix 15B.

A. The accident occurs when the reactor has been operating at 102% of full power (2831 MWt).

B. 100% of the gas gap inventory from 20% of the core is released to, and mixes uniformly with, the RCS. The RCS primary to secondary leakage is 1 gpm total for all steam generators.

C. Secondary side concentration of iodine is assumed to be 0.1 Ci/gm DEI131. No noble gas is assumed to be dissolved in the secondary side water.

The model for the activity available for release to the atmosphere from the relief valves assumes that the release consists of the activity in the secondary coolant prior to the accident plus that fraction of the activity leaking from the primary coolant through the steam generator tubes following the accident. The leakage of primary coolant to the secondary side of the steam generator is assumed to continue at its initial rate, which is assumed to be the same rate as the leakage prior to the accident, for the 8-h duration of the accident. The steam releases and other assumptions are shown in table 15.4-25A. Site boundary, low population zone, and control room doses are also shown in table 15.4-25.

15.4.4.5 Radiological Consequences to Control Room A conservative analysis is performed to determine the radiological consequences to control room personnel following the locked rotor accident. Parameters used in the analysis and radiological dose result are listed in tables 15.4-25 and 15.4.25a.

15.4.5 FUEL HANDLING ACCIDENT 15.4.5.1 Identification of Causes and Accident Description The accident is defined as dropping of a spent-fuel assembly onto the spent-fuel pool floor or the refueling canal floor resulting in the rupture of the cladding of all the fuel rods in the assembly despite many administrative controls and physical limitations imposed on fuel handling operations. All refueling operations are conducted in accordance with prescribed procedures under direct surveillance of a supervisor.

15.4-53 REV 30 10/21

FNP-FSAR-15 15.4.5.2 Analysis of Effects and Consequences The radiological effects of dropping a spent-fuel assembly have been analyzed for two separate cases, depending on whether the accident occurs inside the auxiliary building or inside the containment. Both cases are analyzed conservatively using assumptions outlined in Regulatory Guide 1.183, as discussed below. The models used to calculate offsite doses are discussed in appendix 15B.

The following assumptions are postulated in the calculation of the radiological consequences of a fuel handling accident (FHA; reference 62):

A. The accident occurs at 70 h following the reactor shutdown; i.e., the earliest time after shutdown at which spent-fuel operations would begin. Radioactive decay of the fission product inventory is taken into account during this interval.

B. In an FHA, only the outer row of rods in an assembly is expected to be damaged.

However, in this analysis, it is assumed that all the rods in an assembly are damaged.

C. The damaged assembly is, conservatively, the one operating at the highest power level in the core region to be discharged. See table 15.4-26 for activities.

D. The entire activity in the clad gap of the damaged assembly at the time of the accident is assumed to be released. For the Regulatory Guide 1.183 auxiliary building and containment analyses, this consists of 8% for I-131, 10% for Kr-85, and 5% for other halogens and noble gases. The iodine released from the fuel is 99.85% elemental and 0.15% organic.

E. The spent-fuel pool or refueling canal water retains a large fraction of the iodine released from the damaged fuel assembly. For the Regulatory Guide 1.183 auxiliary building and containment analyses, an overall decontamination factor (DF) of 200 is assumed for iodine (for elemental iodine DF = 500 and for organic iodine no scrubbing removal is assumed, so DF = 1). Noble gases are also assumed not to be retained by the water, that is, DF = 1.

F. For an FHA in either the spent-fuel pool (SFP) or the containment, all radioactivity is released unfiltered to the environment over 2 h through the plant vent stack.

G. For an FHA in the containment, no credit is taken for isolation by the containment purge exhaust radiation monitors. The containment purge is assumed to continue with an additional release through the open personnel airlock; both are released to the environment via the plant vent stack. Although the containment purge filters remain in place, no credit is taken for filtration of contaminated air exhausted.

H. For an FHA in the SFP, no credit is taken for isolation by the fuel handling area ventilation system exhaust radiation monitors. The fuel handling area ventilation exhaust is assumed to continue, released to the environment through the plant vent stack.

15.4-54 REV 30 10/21

FNP-FSAR-15 I. In the event of damage to one or more new fuel assemblies, it may be necessary to move replacement fuel assemblies from the new fuel storage area into the transfer canal and then into the SFP either during a refueling outage. This movement requires opening the two new fuel access hatches, one in the roof of the SFP room and one in the roof of the new fuel storage area. Movement of new fuel over spent fuel may occur while these hatches are open. In this configuration, the SFP ventilation system may not be able to maintain a negative pressure. This creates the potential for an unfiltered release path to the environment. The consequences of an FHA in this configuration has been evaluated as being bounded by the fuel handling area ventilation system unfiltered release via the plant vent stack.

J. As noted in the Technical Specification Bases, the potential for containment pressurization as a result of an accident in Mode 6 (refueling) is not likely; therefore, requirements to isolate the containment from outside atmosphere can be less stringent. The Technical Specification requirements are referred to as refueling integrity rather than containment OPERABILITY. Refueling integrity means that all potential escape paths are closed or are capable of being closed.

During periods of unit shutdown, when refueling integrity is not required, the personnel airlock door interlock mechanism may be disabled, allowing both doors of an airlock to remain open for extended periods when frequent containment entry is required. During core alterations or movement of irradiated fuel assemblies within containment, refueling integrity is required and one airlock door must always remain capable of being closed. The 2-h closure is not included in the Technical Specification Bases, since the analysis did not extend beyond 2 h. However, as a defense in depth, the commitment was made to have one door in each personnel airlock closed following evacuation.

K. FNP procedures demonstrate the capability to close the Unit 1 or Unit 2 equipment hatches when the hatches are open during core alterations or movement of irradiated fuel, in the event of an FHA inside containment within the 2-h time limitation. A designated, trained maintenance closure response team (MCRT) is available to facilitate prompt closure of at least one door each of the personnel and auxiliary access locks, after evacuation of containment, in the event of an FHA (reference 60).

L. Short-term atmospheric dilution factors are taken from table 15B-2 for the site boundary and low-population zone doses. The plant vent stack atmospheric dilution factors are taken from table 15B-3 for the control room doses.

M. The control room ventilation will be switched to the emergency ventilation system as described in subsection 9.4.1.

15.4-55 REV 30 10/21

FNP-FSAR-15 15.4.5.3 Environmental Consequences of a Fuel Handling Accident The assumptions used to analyze the consequences of an FHA in the SFP (auxiliary building) or refueling canal (containment) are discussed in paragraph 15.4.5.2. The assumptions are summarized in table 15.4-27.

The activity released to the environment following the postulated FHA is dependent on the location of the accident.

Table 15.4-26 lists activity releases to the environment for an FHA occurring in the SFP or in the refueling canal. The corresponding TEDE doses at the control room, site boundary, and low-population zone are presented in tables 15.4-29 and 15.4-30. The NRC acceptance criteria require offsite doses to be within 6.3 rem TEDE per Regulatory Guide 1.183.

15.4.6 RUPTURE OF A CONTROL ROD DRIVE MECHANISM (CRDM) HOUSING (RCCA EJECTION) 15.4.6.1 Identification of Causes and Accident Description This accident is defined as the mechanical failure of a CRDM pressure housing resulting in the ejection of a drive shaft. The consequence of this mechanical failure is a rapid positive reactivity insertion together with an adverse core power distribution, possibly leading to localized fuel rod damage.

15.4.6.1.1 Design Precautions and Protection Certain features in Westinghouse pressurized-water reactors (PWRs) are intended to preclude the possibility of a rod ejection accident or to limit the consequences if the accident were to occur. These include a sound, conservative mechanical design of the rod housings, together with a thorough quality control (testing) program during assembly, and a nuclear design which lessens the potential ejection worth of RCCAs and minimizes the number of assemblies inserted at power.

15.4.6.1.1.1 Mechanical Design. The mechanical design is discussed in section 4.2.

Mechanical design and quality control procedures intended to preclude the possibility of an RCCA to be rapidly ejected from the core are listed below:

A. All full-length CRDM housings are completely assembled with the reactor vessel head and shop tested as an assembly at 3107 psig.

B. Deleted.

C. Stress levels in the mechanism are not affected by anticipated system transients at power or by the thermal movement of the coolant loops. Moments induced by the 15.4-56 REV 30 10/21

FNP-FSAR-15 design earthquake can be accepted within the allowable primary working stress range specified by the ASME Code,Section III, for Class 1 components.

D. The latch mechanism housing and rod travel housing are each a single length of forged type 304 stainless steel. This material exhibits excellent notch toughness at all temperatures which will be encountered.

A significant margin of strength in the elastic range, together with the large energy absorption capability in the plastic range, gives additional assurance that gross failure of the housing will not occur. The joints between the latch mechanism housing and rod travel housing are threaded joints reinforced by canopy-type rod welds. Administrative procedures require periodic inspections of these welds.

15.4.6.1.1.2 Nuclear Design. Even if a rupture of an RCCA drive mechanism housing is postulated, the operation of a plant utilizing chemical shim is such that the severity of an ejected RCCA is limited. In general, the reactor is operated with the RCCAs inserted only far enough to permit load follow. Reactivity changes caused by core depletion and xenon transients are compensated by boron changes. Further, the location and grouping of control rod banks are selected during the nuclear design to lessen the severity of a RCCA ejection accident.

Therefore, should an RCCA be ejected from its normal position during full-power operation, only a minor reactivity excursion, at worst, could be expected to occur.

However, it may be occasionally desirable to operate with larger-than-normal insertions. For this reason, a rod insertion limit is defined as a function of power level. Operation with the RCCAs above this limit guarantees adequate shutdown capability and acceptable power distribution. The position of all RCCAs is continuously indicated in the control room. An alarm will occur if a bank of RCCAs approaches its insertion limit or if one assembly deviates from its bank. There are low and low-low level insertion alarm circuits for each bank. In addition, bank positions and the low-low limit are provided by the rod insertion limit recorder. Operating instructions require boration at low level alarm and emergency boration at the low-low level alarm.

15.4.6.1.1.3 Reactor Protection. The RPS response to a rod ejection accident has been described in reference 35. The protection for this accident is provided by the power range high neutron flux trip (high and low setting) and high rate of neutron flux increase trip. These protection functions are described in detail in section 7.2.

15.4.6.1.1.4 Effects on Adjacent Housing. Disregarding the remote possibility of the occurrence of an RCCA mechanism housing failure, investigations have shown that failure of a housing due to either longitudinal or circumferential cracking would not cause damage to adjacent housings leading to increased severity of the initial accident.

15.4.6.1.2 Limiting Criteria 15.4-57 REV 30 10/21

FNP-FSAR-15 Due to the extremely low probability of an RCCA ejection accident, some fuel damage could be considered an acceptable consequence.

Comprehensive studies of the threshold of fuel failure and of the threshold of significant conversion of the fuel thermal energy to mechanical energy have been carried out as part of the SPERT project by the Idaho Nuclear Corporation.(36) Extensive tests of UO2 zirconium clad fuel rods representative of those in PWR-type cores have demonstrated failure thresholds in the range of 240 to 257 cal/g. However, other rods of a slightly different design have exhibited failure as low as 225 cal/g. These results differ significantly from the TREAT(37) results which indicated a failure threshold of 280 cal/g. Limited results have indicated that this threshold decreases by about 10% with fuel burnup. The clad failure mechanism appears to be melting for zero burnup rods and brittle fracture for irradiated rods. Also important is the conversion ratio of thermal to mechanical energy. This ratio becomes marginally detectable above 300 cal/g for unirradiated rods and 200 cal/g for irradiated rods; catastrophic failure (large fuel dispersal, large pressure rise), even for irradiated rods, did not occur below 300 cal/g.

The real physical limits of this accident are that the rod ejection event and any consequential damage to either the core or the RCS must not prevent long-term core cooling and any offsite dose consequences must be within the guidelines of 10 CFR 100. More specific and restrictive criteria are applied to ensure that fuel dispersal in the coolant, gross lattice distortion, or severe shock waves will not occur. In view of the above experimental results, the conclusions of WCAP-7588, Rev. 1-A (reference 38) and reference 39, the limiting criteria are as follows:

A. Average fuel-pellet enthalpy at the hotspot must be maintained below 225 cal/g for unirradiated fuel and 200 cal/g for irradiated fuel.

B. Peak reactor coolant pressure must be less than that which would cause stresses to exceed the faulted condition stress limits.

C. Fuel melting will be limited to less than 10% of the fuel volume at the hotspot even if the average fuel-pellet enthalpy is below the limits of criterion A.

15.4.6.2 Analysis of Effects and Consequences 15.4.6.2.1 Method of Analysis The calculation of the rod ejection transient is performed in two stages, first an average core channel calculation and then a hot region calculation. The average core power calculation is performed using spatial neutron kinetics methods to determine the average power generation with time including the various total core feedback effects; i.e., Doppler reactivity and moderator reactivity. Enthalpy and temperature transients in the hotspot are then determined by multiplying the average core energy generation by the hot channel factor and performing a fuel rod transient heat transfer calculation. The power distribution calculated without feedback is conservatively assumed to persist throughout the transient. A detailed discussion of the method of analysis can be found in reference 40.

15.4-58 REV 30 10/21

FNP-FSAR-15 15.4.6.2.1.1 Average Core Analysis. The spatial kinetics computer code TWINKLE(42) is used for the average core transient analysis. This code solves the two-group neutron diffusion theory kinetic equations in one, two, or three spatial dimensions (rectangular coordinates) for six delayed neutron groups and up to 2000 spatial points. The computer code includes a detailed multiregion, transient fuel clad coolant heat transfer model for calculating pointwise Doppler and moderator feedback effects. In this analysis, the code is used as a one-dimensional axial kinetics code since it allows a more realistic representation of the spatial effects of axial moderator feedback and RCCA movement. However, since the radial dimension is missing, it is still necessary to employ very conservative methods (described below) of calculating the ejected rod worth and hot channel factor. Further description of TWINKLE appears in subsection 15.1.9.

15.4.6.2.1.2 Hotspot Analysis. The average core energy addition, calculated as described above, is multiplied by the appropriate hot channel factors, and the hotspot analysis is performed using the detailed fuel and clad transient heat transfer computer code, FACTRAN.

This computer code calculates the transient temperature distribution in a cross-section of a metal clad UO2 fuel rod, and the heat flux at the surface of the rod, using as input the nuclear power versus time and the local coolant conditions. The zirconium-water reaction is explicitly represented, and all material properties are represented as functions of temperature. A parabolic radial power distribution is used within the fuel rod. Also consistent with the PAD5 fuel performance code (Reference 47), the effects of fuel thermal conductivity degradation with burnup are conservatively accounted for in the analysis.

FACTRAN uses the Dittus-Boelter or Jens-Lottes correlation to determine the film heat transfer before DNB, and a transition boiling correlation (Bishop-Sandburg-Tong)(27) to determine the film boiling coefficient after DNB. The DNB heat flux is not calculated; instead the code is forced into DNB by specifying a conservative DNB heat flux. The gap heat transfer coefficient may be calculated by the code; however, it is adjusted in order to force the full-power, steady-state temperature distribution to agree with the fuel heat transfer design codes. Further description of FACTRAN appears in subsection 15.1.9.

15.4.6.2.1.3 System Overpressure Analysis. Because safety limits for fuel damage specified earlier are not exceeded, there is little likelihood of fuel dispersal into the coolant. The pressure surge may therefore be calculated on the basis of conventional heat transfer from the fuel and prompt heat generation in the coolant.

The pressure surge is calculated by first performing the fuel heat transfer calculation to determine the average and hotspot heat flux versus time. Using this heat flux data, a THINC calculation is conducted to determine the volume surge. Finally, the volume surge is simulated in a plant transient taking into account fluid transport in the system and heat transfer to the steam generators. No credit is taken for the possible pressure reduction caused by the assumed failure of the control rod pressure housing.

15.4-59 REV 30 10/21

FNP-FSAR-15 15.4.6.2.2 Calculation of Basic Parameters Input parameters for the analysis are conservatively selected on the basis of values calculated for this type of core. The more important parameters are discussed below. Table 15.4-12 presents the parameters used in this analysis.

15.4.6.2.2.1 Ejected Rod Worths and Hot Channel Factors The values for ejected rod worths and hot channel factors are calculated using either three-dimensional static methods.

Standard nuclear design codes are used in the analysis. No credit is taken for the flux-flattening effects of reactivity feedback. The calculation is performed for the maximum allowed bank insertion at a given power level as determined by the rod insertion limits. Adverse xenon distributions are considered in the calculation. The total transient hot channel factor, Fq, is then obtained by combining the axial and radial factors, even though the axial peaks are not coincident under the conditions of calculation.

The ejected rod worth and hot channel factors include appropriate margins to account for any calculational uncertainties, including an allowance for nuclear power peaking due to densification.

15.4.6.2.2.2 Reactivity Feedback Weighting Factors. The largest temperature rises, and hence the largest reactivity feedbacks, occur in channels where the power is higher than average. Since the weight of a region is dependent on flux, these regions have high weights.

This means that the reactivity feedback is larger than that indicated by a simple single-channel analysis. Physics calculations are carried out for temperature changes with a flat temperature distribution and with a large number of axial and radial temperature distributions. Reactivity changes are compared and effective weighting factors determined. These weighting factors take the form of multipliers which, when applied to single-channel feedbacks, correct them to effective whole-core feedbacks for the appropriate flux shape. In this analysis, since a one-dimensional (axial) spatial kinetics method is employed, the axial weighting is not used. In addition, no weighting is applied to the moderator feedback. A very conservative radial weighting factor is applied to the transient fuel temperature to obtain an effective fuel temperature as a function of time accounting for the missing spatial dimension. These weighting factors are shown to be conservative compared to three-dimensional analysis.(38) 15.4.6.2.2.3 Moderator and Doppler Coefficient. The critical boron concentrations at the beginning of life (BOL) and end of life (EOL) are adjusted in the nuclear code in order to obtain moderator density coefficient curves which are conservative compared to actual design conditions for the plant. As discussed above, no weighting factor is applied to these results.

The resulting moderator temperature coefficient is at least +7 pcm/°F at the at the no-load temperature and at least 0 pcm/°F at the or full-power nominal average temperature for the BOL cases.

15.4-60 REV 30 10/21

FNP-FSAR-15 The Doppler reactivity defect is determined as a function of power level using a one-dimensional steady-state computer code with a Doppler weighting factor of 1.0. This weighting factor will increase under accident conditions (as discussed above).

15.4.6.2.2.4 Delayed Neutron Fraction, . Calculations of the effective delayed neutron fraction (eff) typically yield values no less than 0.70% at BOL and 0.50% at EOL. The accident is sensitive to if the ejected rod worth is equal to or greater than eff as in zero-power transients. In order to allow for future fuel cycles, conservative estimates of at beginning of cycle and at end of cycle were used in the analysis. (See table 15.4-12.)

15.4.6.2.2.5 Trip Reactivity Insertion. The trip reactivity insertion is assumed to be 4.0%

from hot full power and 2.0% from hot zero power, including the effect of one stuck rod. These values are reduced by the ejected rod reactivity. The shutdown reactivity was simulated by dropping a rod of the required worth into the core. The start of rod motion occurred 0.5 s after the high neutron flux trip setpoint is reached. It is assumed that insertion to dashpot does not occur until 2.7 s after the rods begin to fall. This time to full insertion, together with the 0.5-s trip delay, overestimates the time for significant insertion of shutdown reactivity into the core. The choice of such a conservative insertion rate means that there is over 1 s after reaching the trip point before significant shutdown reactivity is inserted into the core. This is a significant conservatism for hot full-power accidents.

The minimum design shutdown margin available for this plant at hot zero power may only occur at EOL in the equilibrium cycle. This value includes an allowance for the worst stuck rod, an adverse xenon distribution, conservative Doppler and moderator defects, and an allowance for calculational uncertainties. Physics calculations have shown that two stuck RCCAs (one of which is the worst ejected rod) reduce the shutdown margin by about an additional 1% .

Therefore, following a reactor trip resulting from an RCCA ejection accident, the reactor will be subcritical when the core returns to hot zero power.

15.4.6.2.3 Results The calculated sequence of events is shown in table 15.4-5. The values of the parameters used in the analysis, as well as the results of the analysis, are presented in table 15.4-12 and are discussed in the following paragraphs.

15.4.6.2.3.1 Beginning of Cycle, Full Power. Control bank D was assumed to be inserted to its insertion limit. The worst ejected rod worth and hot channel factor were conservatively calculated. Key analysis assumptions and results are presented in table 15.4-12.

15.4.6.2.3.2 Beginning of Cycle, Zero Power. For this condition, control bank D was assumed to be fully inserted and bank C was at its insertion limit. The worst ejected rod is located in control bank D. Key analysis assumptions and results are provided in table 15.4-12.

15.4-61 REV 30 10/21

FNP-FSAR-15 15.4.6.2.3.3 End of Cycle, Full Power. Control bank D was assumed to be inserted to its insertion limit. The ejected rod worth and hot channel factors were conservatively calculated.

Key analysis assumptions and results are presented in table 15.4-12.

15.4.6.2.3.4 End of Cycle, Zero Power. The ejected rod worth and hot channel factor for this case were obtained assuming control bank D to be fully inserted and bank C to be at its insertion limit. The worst ejected rod is in control bank. Key analysis assumptions and results are presented in table 15.4-12.

A summary of the cases presented in paragraphs 15.4.6.2.3.1 through 15.4.6.2.3.4 above is given in table 15.4-12. The nuclear power and hotspot fuel temperature transients for two cases (BOL full power and EOL zero power) are presented in figures 15.4-40 through 15.4-43.

15.4.6.2.3.5 Fission Product Release. It is assumed that fission products are released from the gaps of all rods entering DNB. In all cases considered, less than 10% of the rods entered DNB based on a detailed three-dimensional THINC analysis. Although the analysis results show fuel melting at the hotspot almost occurred for the full-power cases, in practice, melting is not expected since the analysis conservatively assumed that the hotspots before and after ejection were coincident.

15.4.6.2.3.6 Pressure Surge. A detailed calculation of the pressure surge for an ejection rod worth of $1 at BOL hot full power indicates that the peak pressure does not exceed that which would cause reactor pressure vessel stress to exceed the faulted condition stress limits. Since the severity of the present analysis does not exceed this "worst case" analysis, the accident for this plant will not result in an excessive pressure rise or further adverse effects to the RCS.

15.4.6.2.3.7 Lattice Deformations. A large temperature gradient will exist in the region of the hotspot. Since the fuel rods are free to move in the vertical direction, differential expansion between separate rods cannot produce distortion. However, the temperature gradients across individual rods may produce a differential expansion tending to bow the midpoint of the rods toward the hotspot. Physics calculations indicate that the net result of this would be a negative reactivity insertion. In practice, no significant bowing is anticipated since the structural rigidity of the core is more than sufficient to withstand the forces produced. Boiling in the hotspot region would produce a net flow away from that region. However, the heat from the fuel is released to the water relatively slowly and it is considered inconceivable that cross-flow will be sufficient to produce significant lattice forces. Even if massive and rapid boiling sufficient to distort the lattice is hypothetically postulated, the large void fraction in the hotspot region would produce a reduction in the total core moderator to fuel ratio. The net effect would therefore be a negative feedback. It can be concluded that no conceivable mechanism exists for a net positive feedback resulting from lattice deformation. In fact, a small negative feedback may result. The effect is conservatively ignored in the analyses.

15.4-62 REV 30 10/21

FNP-FSAR-15 15.4.6.3 Conclusions Despite the conservative assumptions, the analyses indicate that the described fuel limits are not exceeded. It is concluded that there is no danger of sudden fuel dispersal into the coolant.

Since the peak pressure does not exceed that which would cause stresses to exceed the faulted condition stress limits, it is concluded that there is no danger of further consequential damage to the RCS. The analyses have demonstrated that the fuel rods entering DNB are less than 10% of the fuel rods in the core; therefore, the assumption of 10% of the fuel rods in the core entering DNB for the fission product release calculation is conservative. In addition, the maximum average fuel pellet enthalpy was < 200 cal/g for all control rod ejection events, thus meeting the NRC acceptance criteria of < 280 cal/g.

15.4.6.4 Environmental Consequences of a Postulated Rod Ejection Accident A conservative analysis of a postulated rod ejection accident is performed based on Regulatory Guide 1.183.(40) The parameters used for the analysis are listed in table 15.4-31.

The conservative analysis of the doses resulting from a rod ejection accident is based on the analysis given previously in this section which demonstrates a conservative fission product release of the gap activity from 10% of the fuel rods in the core.

For the conservative analysis, it is assumed that the plant is operating at equilibrium levels of radioactivity in the primary and secondary systems prior to the postulated rod ejection accident as a result of coincident fuel defects and steam generator tube leakage. Following a postulated rod ejection accident, two activity release paths contribute to the total radiological consequences of the accident. The first release path is via containment leakage resulting from release of activity from the primary coolant to the containment. The second path is the contribution of contaminated steam in the secondary system dumped through the relief valves since offsite power is assumed to be lost.

15.4.6.4.1 Model Prior to the accident, it is assumed that the plant has been operating with simultaneous fuel defects and steam generator tube leakage for a sufficient period of time to establish equilibrium levels of activity in the primary and secondary coolant.

Following a postulated rod ejection accident, the activity released from the fuel-pellet clad gap due to failure of a portion of the fuel rods is assumed to be instantaneously released to the primary coolant. It is assumed that this release to the primary coolant is uniformly mixed throughout the coolant instantaneously. Thus, the total activity released from the fuel rod gaps is assumed to be immediately available for release from the RCS.

Of the activity released to the containment from the coolant through the rupture in the reactor vessel head, 100% is assumed to be mixed instantaneously throughout the containment and is available for leakage from the containment at the design leak rate. The removal processes 15.4-63 REV 30 10/21

FNP-FSAR-15 considered in the containment are plateout, radioactive decay, and leakage from the containment.

The model for the activity available for release to the atmosphere from the relief valves assumes that the release consists of the activity in the secondary coolant prior to the accident plus that fraction of the activity leaking from the primary coolant through the steam generator tubes following the accident. The leakage of primary coolant to the secondary side of the steam generator is assumed to continue at its initial rate, which is assumed to be the same rate as the leakage prior to the accident, until the pressures in the primary and secondary system are equalized. No mass transfer from the primary system to the secondary system through the steam generator tube leakage is assumed thereafter. Thus, in the case of coincident LOSP, activity is assumed released to the atmosphere from a steam dump through the relief valves for 98 s.

15.4.6.4.2 Assumptions for Conservative Analysis of Equilibrium Concentrations of Isotopes in the Secondary System The following conservative assumptions were used in the analysis of the release of secondary system radioactivity to the environment in the event of a postulated rod ejection accident. A summary of parameters used in the analysis is given in table 15.4-31.

A. The primary to secondary leakage in the steam generators occurs when the reactor starts up; leakage remains constant at 1 gpm total for all steam generators.

B. The primary to secondary leakage is evenly distributed in the steam generators.

C. The secondary side concentration of iodine is assumed to be 0.1 Ci/gm DEI131.

D. No noble gas is dissolved or contained in the steam generator water; i.e., all noble gas leaked to the secondary system is continuously released with steam from the steam generators through the condenser offgas system.

15.4.6.4.3 Assumptions for Regulatory Guide 1.183 Analysis Design criteria applied to ensure that fuel dispersal into the coolant will not occur include:

"Fuel melting limited to less than the innermost 10 percent of the fuel pellet at the hotspot...."(38)

Even though centerline melting in a small fraction of the core is not expected, a conservative upper limit of fission product release from the core as a result of a rod ejection accident can be estimated. This limit would include the release of 100% of the noble gases and 50% of the iodines from that portion of the fuel which could experience centerline melting under the above criteria.

15.4-64 REV 30 10/21

FNP-FSAR-15 The upper limit of fission product release from the core for this very conservative case was determined using the following assumptions:

A. One hundred percent of the noble gases and iodines in the clad gaps of the fuel rods experiencing clad damage (assumed to be 10% of the rods in the core(38)) is assumed released to the reactor coolant.

B. Fifty percent of the iodines and 100% of the noble gases in the fuel that melts is assumed released to the reactor coolant. This is a very conservative assumption since only centerline melting could occur for a maximum time period of 6 s.

C. The fraction of fuel melting was conservatively assumed to be 0.25% of the core as determined by the following method:

1. A conservative upper limit of 50% of the rods experiencing clad damage may experience centerline melting (a total of 5% of the core).

2. Of rods experiencing centerline melting, only a conservative maximum of the innermost 10% of the rod volume will actually melt (equivalent to 0.5%

of the core that could experience melting).

3. A conservative maximum of 50% of the axial length of the rod will experience melting due to the power distribution (0.5 of the 0.5% of the core is equal to 0.25% of the core).

D. Instantaneous mixing in the containment of all activity released from the coolant.

E. It is assumed that aerosols released to the containment atmosphere immediatelyare removed using the Powers model 10th percentile correlation(63).

No credit is taken for elemental iodine plateout.

F. No credit is assumed for removal of iodine in the containment due to containment sprays.

G. The containment leaks for the first 24 h at its design leak rate (as specified in the Technical Specifications) of 0.15%/day. Thereafter, the containment leak rate is 0.075%/day.

H. No credit is taken for the penetration room filters.

I. Primary and secondary system pressures are equalized after 2500 s, thus terminating primary to secondary leakage in the steam generators.

J. For the case of LOSP, 469,000 lb of steam are discharged from the secondary system through the relief valves the first 98 s following the accident. Steam dump is terminated after 98 s.

K. All releases to the atmosphere are assumed to be at ground level.

15.4-65 REV 30 10/21

FNP-FSAR-15 L. Dose models and isotopic data used in the analysis are presented in appendix 15B of this report.

15.4.6.4.4 Results The TEDE doses at the site boundary, low-population zone, and control room for the rod ejection accident for the conservative Regulatory Guide 1.183 analyses are given in table 15.4-

31. For the 2-h and 30-day periods after a postulated rod ejection accident, the doses at the site boundary and low-population zone, respectively, meet the NRC Regulatory Guide 1.183 acceptance criteria for rod ejection accidents. Control room doses are within the limits of 10 CFR 50.67.

[HISTORICAL]

The potential for uncovery of the steam generator tubes during the event has also been evaluated for impact on doses. The tube uncovery was assumed to exist until the primary to secondary leakage is terminated when the primary and secondary pressures are equalized.

The tube leakage locations were assumed to all be near the top of the tube bundle and, thus, subject to the uncovery. With the primary to secondary leakage entering the vapor space, no credit was taken for mixing with the secondary coolant, nor was credit taken for a partition factor within the steam generator (i.e., the primary coolant was assumed to be released directly to the environment). The uncovery does not impact the release of noble gases to the environment; thus, the gamma and beta doses are not affected. The uncovery does result in an increase in the accident releases of iodine. The effect on the conservative thyroid dose at the site boundary is that this dose remains within the limits as defined in 10 CFR 100.

15.4-66 REV 30 10/21

FNP-FSAR-15 REFERENCES

1. 10 CFR Part 50 "Acceptance Criteria for Emergency Cooling Systems for Light Water-Cooled Nuclear Power Plants," Federal Register 39, (3), December, 1973.

2. U. S. Nuclear Regulatory Commission, "Reactor Safety Study An Assessment of Accident Risks in U. S. Commercial Nuclear Power Plants," WASH-1400, NUREG-75/014, 1975.

3. Federal Register, Emergency Core Cooling System: Revisions to Acceptance Criteria, V53, N180, pp. 35996-36005, September 16, 1988.

4. USNRC Regulatory Guide 1.157, Best-Estimate Calculations of Emergency Core Cooling System Performances, May 1989.

5. Boyack, B., et al., 1989, Qualifying Reactor Safety Margins: Application of Code Scaling Applicability and Uncertainty (CSAU) Evaluation Methodology to a Large Break Loss-of-Coolant Accident, NUREG/CR-5249.

6. Deleted

7. Deleted

8. Deleted

9. Containment Pressure Analysis Code (COCO), WCAP-8327 (Proprietary) and WCAP-8326 (Non-Proprietary), June 1974.

10. Best Estimate Analysis of the Large Break Loss of Coolant Accident for Farley Units 1 and 2 Power Uprate, WCAP-14746, January, 1997.

11. "Westinghouse Emergency Core Cooling System Evaluation Model - Summary, WCAP-8339, 1974.

12. Deleted

13. Deleted

14. Deleted

15. Deleted

16. Deleted

17. Deleted

18. Deleted 15.4-67 REV 30 10/21

FNP-FSAR-15

19. Anderson, F. D., et al., "Calculation of Distance Factors for Power and Test Reactor Sites," TID-14844, March 1962.

20. Cottrell, W. B., "ORNL Nuclear Safety Research and Development Program Bimonthly Report for July-August 1968," ORNL-TM-23688, November 1968.

21. Cottrell, W. B., "ORNL Nuclear Safety Research and Development Program Bimonthly Report for September-October 1968," ORNL-TM-2425, p 53, January 1969.

22. Bell, J. M., Fletcher, W. D., and Picone, L. F., "Post-LOCA Hydrogen Generation in PWR Containment," Nuclear Technology 10, pp 420-427, 1971.

23. Row, T. H. and Zittel, H. E., "Radiation and Thermal Stability of Spray Solutions,"

Nuclear Technology 10, pp 436-443, 1971.

24. Allen, A. O., "The Radiation Chemistry of Water and Aqueous Solutions," Van Nostrand, Princeton, N. J., 1961.

25. Moody, F. S., "Transactions of the ASME," Journal of Heat Transfer, p 134, February 1965.

26. Nuclear Regulatory Commission, Division of Reactor Standards, "Control of Combustible Gas Concentrations in Containment Following a Loss-of-Coolant Accident,"

Regulatory Guide 1.7, March 10, 1971.

27. Nuclear Regulatory Commission, Office of Nuclear Regulatory Research, Alternative Radiological Source Terms for Evaluating Design Basis Accidents at Nuclear Power Reactors, Regulatory Guide 1.183, July 2000.

28. Deleted

29. Slade, D. H., ed., Meteorology and Atomic Energy, 1968, July 1968.

30. Burnett, T. W. T., et al., "LOFTRAN Code Description," WCAP-7907-P-A (Proprietary),

WCAP-7907-A (Nonproprietary), April 1984.

31. Deleted

32. ANSI/ANS-5.1-1979, American National Standard for Decay Heat Power in Light Water Reactors, August 29, 1979.

33. Letter from J. D. Woodard of Alabama Power Company to Document Control Desk of the Nuclear Regulatory Commission," Joseph M. Farley Nuclear Plant, VANTAGE-5 Fuel Design Amendment," July 15, 1991.

34. Hargrove, H. G., "FACTRAN, a Fortran IV Code for Thermal Transients in a UO2 Fuel Rod," WCAP-7908-A, December 1989.

15.4-68 REV 30 10/21

FNP-FSAR-15

35. Burnett, T. W. T., "Reactor Protection System Diversity in Westinghouse Pressurized-Water Reactors," WCAP-7306, April 1969.

36. Taxebius, T. G., ed., "Annual Report - Spert Project, October 1968-September 1969,"

IN-1370, Idaho Nuclear Corporation, June 1970.

37. Liimatainen, R. C. and Testa, F. J., "Studies in TREAT of Zircaloy 2-Clad, UO2-Cyore Simulated Fuel Elements," ANL-7225, p 177, November 1966.

38. Risher, D. H., Jr., "An Evaluation of the Rod Ejection Accident in Westinghouse Pressurized-Water Reactors Using Spatial Kinetics Methods," WCAP-7588, Rev. 1A, December 1971.

39. Letter from W. J. Johnson of Westinghouse Electric Corporation to R. C. Jones of the Nuclear Regulatory Commission, "Use of 2700°F PCT Acceptance Limit in Non-LOCA Accidents," Letter No. NS-NRC-89-3466, October 23, 1989.

40. Deleted

41. Deleted

42. Barry, R. F. and Risher, D. H., Jr., "TWINKLE, a Multidimensional Neutron Kinetics Computer Code," WCAP-7979-P-A, January 1975.

43. Deleted

44. Letter from J. D. Woodward of Southern Nuclear Operating Company to Document Control Desk of the Nuclear Regulatory Commission, "Joseph M. Farley Nuclear Plant, 10 CFR 50.46 Annual ECCS Evaluation Model Change Report for 1992," March 16, 1993.

45. Letter from D. N. Morey of Southern Nuclear Operating Company to Document Control Desk of the Nuclear Regulatory Commission, "Joseph M. Farley Nuclear Plant, 10 CFR 50.46 Annual ECCS Evaluation Model Change Report for 1993," March 18, 1994.

46. Clayton, F.L. (APCo), Letter to A. Schwencer (NRC), Containment Purging During Normal Plant Operation, February 5, 1979.

47. Linsuain, O., et al., Westinghouse Performance Analysis and Design Model (PAD5),

WCAP-17642-P-A, Revision 1, November 2017.

48. Deleted

49. Nuclear Regulatory Commission, Standard Review Plan for Review of Safety Analysis Reports for Nuclear Power Plants, LWR Edition, NUREG-0800, July 1981.

15.4-69 REV 30 10/21

FNP-FSAR-15

50. Letter from D. E. McKinnon of Westinghouse to R. G. Cocherell (SNC), Joseph M.

Farley Nuclear Plant Units 1 and 2, Evaluation of 100 psig IFBA and New Helium Release for LBLOCA, 97AP-G-0036, June 2, 1997.

51. Nuclear Regulatory Commission, Issuance of Amendments -Joseph M. Farley Nuclear Plant, Units 1 and 2, April 29, 1998.

52. Letter from C. O. Thomas (USNRC) to T. W. Schnatz (UGRA), Acceptance for Referencing of Licensing Topical Reports EPRI CCM-5, RETRAN-A Program for One Dimensional Transient Thermal Hydraulic Analysis of Complex Fluid Flow Systems, and C. E. Peterson, et al., RETRAN-02-A Program for Transient Thermal-Hydraulic Analysis of Complex Fluid Flow Systems, EPRI NP-1850-CCM, Rev. 6, December 1995.

53. Letter from A. C. Thandani to W. J. Boatwright (TU Electric), Acceptance for Use of RETRAN MOD005.0, November 1, 1991.

54. Huegel, D. S., et al., RETRAN-02 Modeling and Qualification for Westinghouse Pressurized Water Reactor Non-LOCA Safety Analyses, WCAP-14882-P-A (Proprietary), WCAP-15234-A (Non-Proprietary), April 1999.

55. SECY-83-472, Information Report from W. J. Dircks to the Commissioners, Emergency Core Cooling System Analysis Methods, November 17, 1983.

56. Realistic Large-Break LOCA Evaluation Methodology Using the Automated Statistical Treatment of Uncertainty Method (ASTRUM), WCAP-16009-P-A (Proprietary), January 2005.

57. Letter, H N. Berkow (USNRC) to J. A. Gresham (Westinghouse), Final Safety Evaluation for WCPA-16009-P-A, Revision 0, Realistic Large-Break LOCA Evaluation Methodology Using the Automated Statistical Treatment of Uncertainty Method (ASTRUM), (TAC No. MB9483), November 5, 2004.

58. Best-Estimate Large-Break LOCA Analysis for J. M. Farley Units 1 & 2 Using the ASTRUM Methodology, WCAP-16272-P (Proprietary), March 2005.

59. Letter, D. B. Vassallo (USNRC) to C. Eicheldinger, Westinghouse, Topical Report Evaluation for the Westinghouse ECCS Evaluation Model: Supplementary Information, May 30, 1975.

60. Nuclear Regulatory Commission, Joseph M. Farley Nuclear Plant, Units 1 and 2 RE:

Issuance of Amendments RE: Revised Technical Specification for Limiting Condition for Operation 3.9.3, Containment Penetration, September 29, 2008 (LC # 14842).

61. Shah, H. H., et al., Addendum 1 to WCAP-12610-P-A and CENPD-404-P-A Optimized ZIRLO, February 2003.

15.4-70 REV 30 10/21

FNP-FSAR-15

62. Nuclear Regulatory Commission, Joseph M. Farley Nuclear Plant, Units 1 and 2 -

Issuance of Amendments Re: Revise Technical Specification Requirements During Handling Irradiated Fuel and Core Alterations TSTF-51 and TSTF-471 (EPID L-2018-LLA-0486 and L-2018-LLA-0487), July 2019.

63. Sung, Y. X., et al., VIPRE-01 Modeling and Qualification for Pressurized Water Reactor Non-LOCA, Thermal Hydraulic Safety Analysis, WCAP-14565-P-A (Proprietary) and WCAP-14565-A (Non-Proprietary), October 1999.

64. Higby, W. D., et al., RETRAN-02 Modeling and Qualification for Westinghouse Pressurized Water Reactor Non-LOCA Safety Analysis, Supplement 1 - Thick Metal Mass Heat Transfer Model and NOTRUMP-Based Steam Generator Mass Calculation Method, WCAP-14882-S1-P-A, (Proprietary), WCAP-15234-A, (Non-proprietary)

October 2005.

65. Lang, G. E., et. al., Report on the Consequences of a Postulated Main Feedline Rupture, WCAP-9230, (Proprietary) January 1978.

15.4-71 REV 30 10/21

FNP-FSAR-15 TABLE 15.4-1 (SHEET 1 OF 4)

KEY LOCA PARAMETERS AND INITIAL TRANSIENT ASSUMPTIONS (UNITS 1 AND 2)

Parameter Initial Transient Uncertainty Treatment 1.0 Plant Physical Description

a. Dimensions Nominal Sampled(a)

b. Flow resistance Nominal Sampled(a)

c. Pressurizer location Opposite broken loop Bounded

d. Hot assembly location Under limiting location Bounded

e. Hot assembly type 17 x 17 V5 w/ZIRLO clad(d) Bounded

f. SG tube plugging level High (10%) Bounded 2.0 Plant Initial Operating Conditions 2.1 Reactor Power

a. Core average linear heat rate (AFLUX) Nominal - Based on core power of 0.0(b) 2831 MWt (102% of uprated power)

b. Hot rod average linear heat rate (PLHR) Derived from TS limit of 2.5 and Sampled(a) maximum baseload FQ

c. Hot rod average linear heat rate (HRFLUX) Derived from TS FH = 1.7 Sampled(a)

d. Hot assembly average heat rate (HAFLUX) HRFLUX/1.04 Sampled(a)

e. Hot assembly peak heat rate (HAPHR) PLHR/1.04 Sampled(a)

REV 27 4/17

FNP-FSAR-15 TABLE 15.4-1 (SHEET 2 OF 4)

Parameter Initial Transient Uncertainty Treatment

f. Axial power distribution (PBOT, PMID) Figure 15.4-16 Sampled(a)

g. Low power region relative power (PLOW) 0.2 Bounded

h. Cycle burnup 500 MWD//T Sampled(a)

i. Prior operating history Equilibrium decay heat Bounded

j. Moderator Temperature Coefficient (MTC) TS MAXIMUM (0) Bounded 2.2 Fluid Conditions

a. Tavg High Tavg = 577.2F Bounded; Sampled(a)

b. Pressurizer Pressure Nominal (2250 psia) Sampled(a)

c. Loop flow 86,000 gal/min Bounded

d. TUH THOT 0

e. Pressurizer level Nominal (54.9%) at High Tavg 0

f. Accumulator temperature Nominal (105F) Sampled(a)

g. Accumulator pressure Nominal (640 psia) Sampled(a)

h. Accumulator liquid volume Nominal (980 ft3) Sampled(a)

i. Accumulator line resistance Nominal Sampled(a)

j. Accumulator boron Minimum Bounded REV 27 4/17

FNP-FSAR-15 TABLE 15.4-1 (SHEET 3 OF 4)

Parameter Initial Transient Uncertainty Treatment 3.0 Accident Boundary Conditions

a. Break location Cold leg Bounded

b. Break type Guillotine (DECLG) Sampled(a)

c. Break size Nominal (cold leg area) Sampled(a)

d. Offsite power On (RCS pumps running) Bounded

e. Safety injection flow Minimum Bounded

f. Safety injection temperature Nominal (85F) Sampled(a)

g. Safety injection delay Max delay (12 s) (c) Bounded

h. Containment pressure Bounded - Based on minimum Bounded containment pressure of 14.7 psia.

The WCOBRA/TRAC pressure curve is based on the COCO containment pressure curve (figure 15.4-17) obtained using conditions supplied in table 15.4-6.

i. Single failure ECCS: Loss of 1 SI train Containment Bounded pressure: all trains operational

j. Control rod drop time No control rods Bounded REV 27 4/17

FNP-FSAR-15 TABLE 15.4-1 (SHEET 4 OF 4)

Parameter Initial Transient Uncertainty Treatment 4.0 Model Parameters

a. Critical Flow Nominal (CD = 1.0) Sampled(a)

b. Resistance uncertainties in broken loop Nominal (as coded) Sampled(a)

c. Initial stored energy/fuel rod behavior Nominal (as coded) Sampled(a)

d. Core heat transfer Nominal (as coded) Sampled(a)

e. Delivery and bypassing of ECC Nominal (as coded) Conservative

f. Steam binding/entrainment Nominal (as coded) Conservative

g. Noncondensible gases/accumulator nitrogen Nominal (as coded) Conservative

h. Condensation Nominal (as coded) Sampled(a)

a. Sampling distribution defined in table 5.2.1 of reference 58.

b. This is used in the methodology to allow for mini-uprate and will bound any potential mini-uprate; i.e., any calorimetric uprate in which the increase in core power and reduced uncertainty sum to 2%.

c. SI injection actuation delay is calculated to bound RHR miniflow effects.

d. All results are for ZIRLO cladding; use of Optimized ZIRLO cladding was qualitatively evaluated as acceptable.

REV 27 4/17

FNP-FSAR-15 TABLE 15.4-2 RESULTS FROM CONFIRMATORY STUDIES FOR FARLEY UNITS 1 AND 2 Study Description Parameter Varied Value PCT (°F)

Initial Transient N/A N/A 1680 Offsite Power Yes 1667 Power in Outer Assemblies (PLOW) 0.8 1608 Confirmatory Runs Steam Generator Tube Plugging (SGTP) 0% 1631 Average Temperature (Tavg) 567.2°F 1678 Offsite Power No PLOW 0.2 Final Reference Transient 1728 SGTP 10%

(Tavg) 577.2°F REV 21 5/08

FNP-FSAR-15 TABLE 15.4-3 BEST ESTIMATE LARGE BREAK LOCA RESULTS Result Criterion 95/95 PCT (°F) 1836(a) 2200 95/95 LMO (%) 2.9 17.0 95/95 CWO (%) 0.22 1.00 Coolable Geometry Core remains coolable Long Term Cooling Core remains cool in long term Additional Assessment Quarterly

+ 25°F N/A RHR Pump Test(a)

Reactor Coolant Pumps Input

+18°F N/A Error(b)

Evaluation of Fuel Pellet Thermal Conductivity Degradation and +150°F N/A Peaking Factor Burndown(b)

Revised Heat Transfer Multiplier

- 40°F N/A Distributions(b)

Changes to Grid Blockage Ratio

+24°F N/A and Porosity(b)

Error in Burst Strain Application (b) +21°F N/A Licensing Basis PCT95%

2034(c) 2200

+ Margin Allocations (°F)

PCT - Peak Clad Temperature LMO - Local Maximum Oxidation CWO - Core-Wide Oxidation

a. An evaluation was performed to assess the ECCS performance during the quarterly residual heat removal (RHR) surveillance testing. The assessment concluded that a 25°F PCT penalty applies to the 95/95 PCT during the testing period. The penalty will be tracked as a temporary PCT penalty and will apply only during the period of the test. See paragraph 15.4.1.5.3 for further explanation on the RHR test.

b. See paragraph 15.4.1.5.3 for further information.

c. Includes temporary PCT penalty, per footnote a.

REV 28 10/18

FNP-FSAR-15 TABLE 15.4-4 (SHEET 1 OF 2)

PLANT OPERATING RANGE ALLOWED BY THE BEST-ESTIMATE LARGE-BREAK LOCA ANALYSIS (UNITS 1 and 2)

Parameter Operating Range 1.0 Plant Physical Description

a. Dimensions No in board assembly grid deformation during LOCA + SSE

b. Flow resistance N/A

c. Pressurizer location N/A

d. Hot assembly location Anywhere in core

e. Hot assembly type Fresh 17 x 17 V5, w/ZIRLO or Optimized ZIRLO cladding

f. SG tube plugging level < 10%

g. Fuel assembly type VANTAGE 5, ZIRLO, or Optimized ZIRLO cladding, 1.5 x IFBA 2.0 Plant Initial Operating Conditions 2.1 Reactor Power

a. Core avg linear heat rate (AFLUX) Based on core power < 102% of 2775 MWt

b. Peak linear heat rate (PLHR) FQ 2.5

c. Hot rod avg linear heat rate (HRFLUX) F H 1.7

d. Hot assembly average heat rate (HAFLUX) (a)

P HA 1.7/1.04

e. Hot assembly peak heat rate (HAPHR) FQ, HA 2.5/1.04

f. Axial power distribution (PBOT, PMID) Figure 15.4-16

g. Lower power region relative power (PLOW) 0.2 PLOW 0.8

h. Hot rod burnup 75,000 MWD/MTU, lead rod(b)

i. Prior operating history All normal operating histories j MTC 0 at HFP 2.2 Fluid Conditions

a. Tavg 567.2 6F Tavg 577.2 6F

b. Pressurizer pressure PRCS = 2250 psia 50 psi

c. Loop flow > 86,000 gpm/loop

d. TUH Current upper internals REV 27 4/17

FNP-FSAR-15 TABLE 15.4-4 (SHEET 2 OF 2)

Parameter Operating Range

e. Pressurizer level Normal level, automatic control

f. Accumulator temperature 90F TACC 120F

g. Accumulator pressure 600 psia PACC 680 psia

h. Accumulator volume (tank only) 965 ft3 VACC 995 ft3

i. Accumulator fL/D Current line configuration

j. Minimum accumulator boron > 2100 ppm 3.0 Accident Boundary Conditions

a. Break location N/A

b. Break type N/A

c. Break size N/A

d. Offsite power On or Off

e. Safety injection flow values used in reference case

f. Safety injection temperature 70F(3) SI Temp 100F

g. Safety injection delay 12 s (with offsite power) 27 s (without offsite power)

h. Containment pressure Bounded - Based on minimum containment pressure of 14.7 psia. The WCOBRA/TRAC pressure curve is based on the COCO containment pressure curve (figure 15-4-17) obtained using conditions supplied in table 15.4-6.

i. Single failure Loss of one ECCS train

j. Control rod drop time N/A

1. Note that this P HA limit is a maximum value. For purposes of core design calculations or in core measurements, the maximum value must be reduced by an additional 4%, yielding a value of P HA 17 . 1574

. / 108 . .

2. Based on generic BE LBLOCA studies.

3. 70F is a statistical lower limit for the SI temperature based on actual plant data. Temperatures as low as the TS lower limit of 35F are acceptable.

REV 27 4/17

FNP-FSAR-15 TABLE 15.4-5 (SHEET 1 OF 5)

Accident Event Time (s)

Major steam pipe rupture Steam line ruptures 0.0 With offsite power Borated water from the RWST reaches 66.3 the core Criticality attained 51.6 Accumulators actuate 148.2 Without offsite power Steamline ruptures 0.0 Borated water from the RWST reaches 86.7 the core Criticality attained 108.3 Reactor coolant pump shaft seizure (locked rotor/shaft break)

Peak RCS Pressure / Peak Clad Rotor on one pump locks or the shaft 0.0 Temperature Case breaks Low flow reactor trip setpoint reached 0.03 Rods begin to drop 1.03 Remaining pumps lose power and begin 3.03 coasting down Maximum RCS pressure occurs 3.4 Maximum Clad Temperature occurs 3.7 Rods-in-DNB Case Rotor on one pump locks or the shaft 0.0 breaks Low flow reactor trip setpoint reached 0.03 Rods begin to drop 1.03 Minimum DNBR occurs 2.3 REV 30 10/21

FNP-FSAR-15 TABLE 15.4-5 (SHEET 2 OF 5)

Accident Event Time (s)

Remaining pumps lose power and begin 3.03 coasting down Rupture of main feedwater pipe CASE A - Offsite Power Always Feedline rupture occurs 0.0 Available Affected steam generator, low-low level 20.4 reactor trip setpoint reached Reactor trip occurs (rods fall) 22.4 Low steam line pressure setpoint 272.2 reached Steam line isolation occurs 284.2 Safety injection flow initiated 299.3 Auxiliary feedwater flow initiated to two 622.4 intact steam generators at 350 gal/min Pressurizer fills 989.0 Minimum margin to hot leg saturation 2676.5 occurs Core decay heat (combined with RCP ~3110 heat) decreases to auxiliary feedwater heat removal capacity CASE A - Loss of Offsite Power Feedline rupture occurs 0.0 Affected steam generator low-low level 20.9 reactor trip setpoint reached Reactor trip occurs (rods fall) 22.9 Reactor coolant pumps lose power and 24.9 begin coasting down due to loss of offsite power REV 30 10/21

FNP-FSAR-15 TABLE 15.4-5 (SHEET 3 OF 5)

Accident Event Time (s)

Low steam line pressure setpoint 320.9 reached Steam line isolation occurs 332.9 Safety injection flow initiated 363.0 Auxiliary feedwater flow initiated to two 622.9 intact steam generators at 350 gal/min Minimum margin to hot leg saturation 1310 occurs Core decay heat decreases to auxiliary ~1600 feedwater heat removal capability Pressurizer fills 4125.0 CASE B - Loss of Offsite Power Feedline rupture occurs 0.0 Affected steam generator, low-low level 20.4 reactor trip setpoint reached Reactor trip occurs (rods fall) 22.4 30% of initial main feedwater flow to the 22.5 intact steam generators isolated Reactor coolant pumps lose power and 24.4 begin coasting down due to loss of offsite power Auxiliary feedwater flow initiated to two 80.4 intact steam generators at 105 gal/min Low pressurizer pressure safety 506.3 injection setpoint reached Low steam line pressure setpoint 506.7 reached Steam line isolation occurs 518.7 REV 30 10/21

FNP-FSAR-15 TABLE 15.4-5 (SHEET 4 OF 5)

Accident Event Time (s)

Safety injection flow initiated 548.3 Pressurizer fills 1659.9 Auxiliary feedwater flow increased to 1822.4 350 gal/min Minimum margin to hot leg saturation 1930.0 occurs Core decay heat decreases to auxiliary ~1930 feedwater heat removal capacity RCCA ejection accident BOL, zero power Initiation of rod ejection 0.0 Power range high neutron flux low 0.30 setpoint reached Peak nuclear power occurs 0.36 Rods begin to fall into core 0.80 Peak clad average temperature occurs 2.30 Peak heat flux occurs 2.31 Peak fuel average temperature occurs 2.49 BOL, full power Initiation of rod ejection 0.0 Power range high neutron flux high 0.0 setpoint reached Peak nuclear power occurs 0.13 Rods begin to fall into core 0.60 Peak fuel average temperature occurs 2.27 Peak clad average temperature occurs 2.46 REV 30 10/21

FNP-FSAR-15 TABLE 15.4-5 (SHEET 5 OF 5)

Accident Event Time (s)

Peak heat flux occurs 2.47 EOL, zero power Initiation of rod ejection 0.0 Power range high neutron flux low 0.17 setpoint reached Peak nuclear power occurs 0.20 Rods begin to fall into core 0.67 Peak clad average temperature occurs 1.44 Peak heat flux occurs 1.44 Peak fuel average temperature occurs 1.79 EOL, full power Initiation of rod ejection 0.0 Power range high neutron flux high 0.08 setpoint reached Peak nuclear power occurs 0.13 Rods begin to fall into core 0.58 Peak fuel average temperature occurs 2.21 Peak clad average temperature occurs 2.47 Peak heat flux occurs 2.48 REV 30 10/21

FNP-FSAR-15 TABLE 15.4-6 (SHEET 1 OF 2)

LARGE BREAK LOCA CONTAINMENT DATA USED FOR COCO CALCULATION OF CONTAINMENT PRESSURE Net Free Volume 2,150,000 ft3 Initial Conditions Pressure 14.7 psia Temperature 90.0°F RWST temperature 35.0°F Service water temperature 40.0°F Temperature outside containment 20.0°F Initial spray temperature 35.0°F Spray System Runout flow for a spray pump 3400 gal/min Number of spray pumps operating 2 Post-accident spray system initiation delay 18 s Maximum spray system flow 6800 gal/min(1)

Containment Fan Coolers Post-accident initiation fan coolers 0.0 s(a)

Number of fan coolers operating 4 REV 31 10/23

FNP-FSAR-15 TABLE 15.4-6 (SHEET 2 OF 2)

Structural Heat Sinks Area Height Tinit Nominal(b)

WALL Tair (°F) (ft2) (ft) (°F) Thickness (in)

1. Containment wall and dome 20 (Unit 2) 75,000 10 90 0.25 Carbon steel /

45 Concrete

2. Containment penetrations, plates, 20 (Unit 2) 5,170 10 90 0.51 Carbon steel and liner stiffeners /45 Concrete

3. Unlined concrete 90 82,733 10 90 9 Concrete

4. Galvanized carbon steel 90 91,985 10 90 0.003 Zinc /.08 (excluding cable trays) Steel

5. Thin painted carbon steel (< 0.5 in.) 90 137,102 10 90 0.18 Steel

6. Painted steel (< 1.0 in.) 90 36,982 10 90 0.59 Steel

7. Painted steel (< 2.0 in.) 90 12,674 10 90 1.35 Steel

8. Thick painted steel ( 2.0 in.) 90 5,030 10 90 3.59 Steel

9. Floor 50 13,275 10 90 108 Concrete

10. Refueling pool liner (Stainless steel) 90 7,900 10 90 0.25 Stainless steel /

18 Concrete

11. Unpainted stainless steel 90 14,567 10 90 0.12 Stainless steel

12. Galvanized steel 90 31,916 10 90 0.003 Zinc /

.05 steel

13. Uninsulated stainless steel pipe 90 1,535 10 90 0.22 stainless steel

a. Bounds delay with and without Loop.

b. The nominal thicknesses are increased by 15% in the ASTRUM containment pressure analysis.

REV 31 10/23

FNP-FSAR-15 TABLE 15.4-7 CORROSION RATE USED IN THE POST-ACCIDENT CONTAINMENT HYDROGEN GENERATION ANALYSIS Zinc Corrosion Rate Zinc Corrosion Rate Temperature (°F) (lb-moleZN/ft2-hr) (mg/dm2-hr) 266 1.00 x 10-4 319 240 1.99 x 10-5 63.6 234 1.59 x 10-5 50.7 205 2.78 x 10-6 8.9 190 1.39 x 10-6 4.43 175 5.13 x 10-7 1.64 160 2.21 x 10-7 0.71 147 12.4 x 10-8 0.395 REV 21 5/08

FNP-FSAR-15 TABLE 15.4-8 POSTACCIDENT CONTAINMENT TEMPERATURE TRANSIENT USED IN THE CALCULATION OF ALUMINUM AND ZINC CORROSION Time Interval (s) Temperature (°F) 0 - 2000 266 2000 - 4000 240 4000 - 6000 234 6000 - 40000 205 40000 - 86400 190 86400 - 172800 175 172800 - 259200 160

.>259200 REV 21 5/08

FNP-FSAR-15 TABLE 15.4-8A This table has been deleted.

REV 21 5/08

FNP-FSAR-15 TABLE 15.4-9 CORE FISSION PRODUCT ENERGY AFTER 830 FULL-POWER DAYS Core Fission Product Energy(a, b)

Time After Energy Release Rate Integrated Energy Release Reactor Trip (day) (W/MWt x 10-3) (W-day/MWt x 10-4) 1 3.887 0.574 5 2.595 1.777 10 2.211 2.967 20 1.760 4.934 30 1.475 6.541 40 1.291 7.919 50 1.163 9.143 60 1.068 10.259 70 0.992 11.289 80 0.926 12.249 90 0.867 13.139 100 0.814 13.979

a. Assumes release of 50-percent core halogens and 1-percent other fission products, including 100-percent noble gases. Values are for total ( and ) energy.

b. For power uprate, a 5% increase in these values was assumed. Table values are pre-uprate and do not include the 5% increase.

REV 21 5/08

FNP-FSAR-15 TABLE 15.4-10 FISSION PRODUCT DECAY DEPOSITION IN SUMP SOLUTION 50-Percent Halogens 1-Percent Other Fission Products Total(a)

Integrated Energy Integrated Energy Integrated Energy Time After Energy Release Release Energy Release Release Energy Release Release Reactor Trip (day) Rate (W/MWt) (W-day/MW x 10-2) Rate (W/MWt x 10-1) (W-day/MWt x 10-2) Rate (W/MWt x 10-1) (W-day/MWt x 10-3) 1 145.00 4.27 3.78 0.536 18.28 0.481 3 49.40 5.88 2.90 1.18 7.85 0.707 5 31.00 6.65 2.59 1.78 5.69 0.338 10 18.20 7.82 2.22 2.92 4.03 1.07 20 7.63 9.03 1.77 4.89 2.53 1.39 30 3.22 9.54 1.49 6.51 1.31 1.61 40 1.36 9.76 1.30 7.90 1.44 1.77 60 0.241 9.89 1.08 10.30 1.10 2.02 80 0.043 9.91 0.935 12.30 0.940 2.22 100 0.008 9.92 0.822 14.00 0.823 2.39

a. For power uprate, a 5% increase in these values was assumed. Table values are pre-uprate and do not include the 5% increase.

REV 21 5/08

FNP-FSAR-15 TABLE 15.4-11 This table has been deleted.

REV 21 5/08

FNP-FSAR-15 TABLE 15.4-12 PARAMETERS USED IN THE ANALYSIS OF THE ROD CLUSTER CONTROL ASSEMBLY EJECTION ACCIDENT HZP HFP Time in Life Beginning Beginning HZP End HFP End Core Power level (%)(a) 0 100 0 100 Ejected rod worth (% ) 0.75 0.10 0.945 0.10 Delayed neutron fraction (%) 0.54 0.54 0.45 0.45 Doppler feedback reactivity weighting 2.30 1.23 3.91 1.23 Trip reactivity (%) 2.0 4.0 2.0 4.0 FQ before rod ejection - 2.50 - 2.50 FQ after rod ejection 13.0 5.0 27.0 5.0 Number of operational pumps 2 3 2 3 Maximum fuel pellet average 2991 3671 3900 3538 temperature at the hotspot (°F)

Maximum fuel center temperature at the 3520 5025 4423 4894 hotspot (°F)

Maximum fuel stored energy at the 123.5 157.5 169.2 150.7 hotspot (cal/g)

Fuel melt (%) 0 0 0 0

a. Power level is percent of 2831 MWt.

REV 30 10/21

FNP-FSAR-15 TABLE 15.4-13 FARLEY HYDROGEN GENERATION NRC BASIS (5-percent Zr-Water Reaction)(b)

Total Hydrogen generated by Zr-Water reaction = 1.541E + 04 sf3 AL & ZN HYDROGEN CONTAINMENT (a)

SUMP RADIOLYSIS CORE RADIOLYSIS CORROSION RECOMBINER GRAND TOTAL CONCENTRATION TIME (DAYS) (CU.FT.) (CU.FT.) (CU.FT.) (CU.FT.) (CU.FT.) (% VOL) 0 0 1 4956 2793 23748 0 47937 2.71 10 11025 15330 34326 <32631> 44489 2.52 20 14385 25410 39905 <62344> 33796 1.93 30 16485 33705 45484 <85426> 26688 1.53 40 18165 40845 51064 <104201> 22313 1.28 50 19530 47145 56643 <120262> 19495 1.12 60 20790 52815 62222 <134575> 17692 1.02 70 21840 58170 67801 <147752> 16500 0.95 80 22785 63105 73381 <160126> 15585 0.90 90 23730 67620 78960 <171879> 14871 0.86 100 24675 72030 84539 <183211> 14474 0.83

a. Includes hydrogen generated by the zirconium-water reaction and initial RCS/pressurizer hydrogen.

b. The NRC hydrogen generation model results were used in the development of the design criteria for the containment combustible gas control systems.

REV 21 5/08

FNP-FSAR-15 TABLE 15.4-14 (SHEET 1 OF 2)

PARAMETERS USED IN THE LOCA ANALYSIS Parameter Value Core power level (2% uncertainty and a rated power of 2775 MWt) 2831 MWt Fuel release fractions Per RG 1.183 Fuel release timing Per RG 1.183 Reactor coolant system mass 440,900 lb mass RCS concentration Based on 1% failed fuel and 0.5 µci per gram (DEI) per TS 3.4.16 Containment Mini-Purge Parameters Minimum containment free volume 2.03E06 ft3 chemical Form of iodine released 4.85% Elemental 95% Particulate 0.15% Organic Containment purge filtration None Containment purge flow rate 2,850 ft3/min Containment purge isolation 30 s or less Removal by wall deposition or containment sprays None Containment Leakage Parameters Containment volume 2.03E+06 ft3 Sprayed: 1,669,500 ft3 Unsprayed: 360,500 ft3 Chemical form of iodine released 4.85% Elemental 95% Particulate 0.15% Organic Containment spray removal coefficient Element iodine: 13.7 per hour Aerosol: 5.45 per hour during injection mode and 5.03 per hour during recirculation mode Organic: None Natural deposition of aerosols 0.1 per hour after sprays are terminated Containment spray Initiation time: 90 s Termination time: 8 h REV 30 10/21

FNP-FSAR-15 TABLE 15.4-14 (SHEET 2 OF 2)

PARAMETERS USED IN THE LOCA ANALYSIS Containment spray flow rate 2,480 gal/min in injection mode 2,290 gal/min in recirculation mode Long term sump water pH 7.0 Maximum allowable DF for fission product removal Elemental iodine: 200 Containment leak rate 0 to 24 h: 0.15% weight per day 1 to 30 days: 0.75% weight per day Engineered Safety Features System Leakage Parameters Sump volume 49,200 ft3 Minimum time after LOCA when recirculation is initiated 20 min Leakage duration 30 days Maximum ECCS fluid temperature after initiation of recirculation 265°F ECCS leak rate 50,000 cubic centimeters /h ECCS leakage iodine flashing fraction 10%

Chemical form of iodine released 97% Elemental 3% Organic Refueling Water Storage Tank (RWST) Back Leakage Parameters Minimum time after LOCA when recirculation is initiated 20 min RWST volume at transfer to recirculation mode 21,743 gal RWST capacity 500,000 gal RWST leakage inflow rate 3.5 gal/min RWST leakage iodine flashing fractions 0% to 13.8%

Atmospheric Dispersion Factors Offsite Table 15B-2 Control room Table 15B-3 REV 30 10/21

FNP-FSAR-15 TABLE 15.4-14a PARAMETERS USED IN THE SMALL BREAK LOCA ANALYSIS Core thermal power 2831 MWt (2775 x 1.02)

Core thermal power (control room dose analysis) 2831 MWt (2775 x 1.02)

Containment free volume 2.03 x 106 ft3 Volume fractions Sprayed 0.822 Unsprayed 0.178 Mixing rate between sprayed and unsprayed containment volumes 12,000 ft3/min Core fission product inventories See table 15.1-4.

Activity released to containment Gas gap activity Plateout of elemental iodine activity released to containment 2.7 h-1 (DF < 100) 0.27 h-1(100 < DF < 1000) 0.0 h-1 (DF > 1000)

Form of iodine activity in containment available for release Elemental 95.5%

Organic 2.0%

Particulate 2.5%

Spray removal constants 0.0 h-1 Time to reach decontamination factor Elemental 24 min Methyl N/A Particulate 8h Containment leak rate 0-24 h 0.15%/day 1-30 days 0.075%/day Atmospheric dilution estimates See table 15.B-2a.

REV 28 10/18

FNP-FSAR-15 TABLE 15.4-15 OFFSITE DOSES FROM LOCA Site Boundary (rem) Low Population Zone (rem)

Total 14.1 6.8 Standard Review Plan 15.0.1 25 25 and RG 1.183 Limit (rem)

REV 30 10/21

FNP-FSAR-15 TABLE 15.4-16 PARAMETERS USED IN ANALYSIS OF POST-LOCA CONTROL ROOM DOSES CREFS Initiation Time Pressurization: 60 s Filtered pressurization rate (ft3/min) 375 Filtered recirculation rate (ft3/min) 2700 Unfiltered inleakage rate (ft3/min) 10 (ingress/egress) 200 (control room envelope)

Filter efficiencies (%)

Pressurization air (all forms of iodine) 98.5(a)

Recirculation air (elemental/organic iodine) 94.5(a)

(particulate iodine) 98.5(a)

Volume (ft3) 114,000 Operator breathing rate (m3/s) 3.5 x 10-4 Percent of time operator is in control room following LOCA 0-1 day 100 1-4 days 60 4-30 days 40

a. Filter efficiencies have been reduced by 0.5% for all forms of iodine to account for bypass leakage.

REV 30 10/21

FNP-FSAR-15 TABLE 15.4-17 CONTROL ROOM DOSES FOLLOWING A LOCA TEDE Dose Results (rem)

Total 4.5*

10 CFR 50.67 Limit 5

• Includes 0.4 rem TEDE for control room ingress/egress.

REV 30 10/21

FNP-FSAR-15 TABLE 15.4-18 PARAMETERS USED IN THE ANALYSES OF HYDROGEN PURGING FOLLOWING A LOCA Parameter Realistic Analysis Regulatory Guide 1.7 Analysis Model used to determine hydrogen generation (a) Regulatory Guide 1.7 Hydrogen concentration limit in containment (vol/%) - 4.0 Time after LOCA at which hydrogen concentration limit is reached and containment - 5 pressurization is initiated (days)

Containment pressurization (psig) - 2.0 Time after LOCA at which hydrogen concentration limit is reached after containment - 7 pressurization (days) 3 Containment purge rate (sf /min) - 54 (b)

Containment purge filter efficiencies Elemental iodine (%) - 89.5 Methyl iodine (%) - 30.0 Particulate iodine (%) - 98.5 Activity released to containment available for release Noble (%) - 100 of core inventory Iodines (%) - 50 of core inventory as reduced by decay, plateout, and spray Meteorology - Accident (see appendix 15B)

a. No activity release due to purging since redundant electric recombiners would operate and purging would not be required.

b. Filter efficiencies have been reduced by 0.5% to account for bypass leakage.

REV 21 5/08

FNP-FSAR-15 TABLE 15.4-19 OFFSITE DOSES FROM CONTAINMENT PURGING TO CONTROL HYDROGEN FOLLOWING A LOCA Thyroid Dose (rem)

Low-Population Zone (0-30 day) (3219 m)

Realistic analysis 0.0 Regulatory Guide 1.7 analysis 86.0 Whole Body Dose (rem)

Low-Population Zone (0-30 day) (3219 m)

Realistic analysis 0.0 Regulatory Guide 1.7 analysis 0.4 REV 21 5/08

FNP-FSAR-15 TABLE 15.4-20 Deleted REV 28 10/18

FNP-FSAR-15 TABLE 15.4-21 CORE PARAMETERS USED IN STEAM BREAK DNB ANALYSIS This table has been deleted.

REV 21 5/08

FNP-FSAR-15 TABLE 15.4-22

SUMMARY

OF IMPORTANT PARAMETERS FOR THE STEAM BREAK ANALYSIS REPORTED IN SUBSECTION 15.4.2 This table has been deleted.

REV 21 5/08

FNP-FSAR-15 TABLE 15.4-23 (SHEET 1 OF 2)

PARAMETERS USED IN STEAM LINE BREAK ANALYSES Conservative Analysis Core thermal power (MWt) 2831 Steam generator tube leak rate prior to accident and initial 24 h following accident 1 gal/min(b) (0.65 gal/min to intact SG/0.35 gal/min to faulted SG)

Offsite power Lost Fuel defects (%) 1(a)

Iodine partition factor for initial steam release from faulted steam generator 1.0 Iodine partition factor in intact steam generators prior to and during accident 100 Alkali metals partition factor in intact steam generators 1000 Steam release from faulted steam generator (lbm) 483,000 (0-24 h)

Duration of cooldown by secondary system after accident (time to terminate RCS leak and steam 24 releases (h)

Steam release from two intact steam generators (lbm) 348,000 (0-2) 774,000 (2-8) 1,040,000 (8-24)

Feedwater flow to two intact steam generators (lbm) 481,000 (0-2) 783,000 (2-8) 1,040,000 (8-24)

Meteorology Accident (see Appendix 15B)

REV 30 10/21

FNP-FSAR-15 TABLE 15.4-23 (SHEET 2 OF 2)

Offsite Dose (rem) Pre-Accident Iodine Spike Accident-Initiated Iodine Spike Site Boundary 2.3 2.3 LPZ 0.9 1.0 Regulatory Guide 1.183 Offsite Limit 25 2.5

a. A pre-existing iodine spike of 30 Ci/gm or an accident-initiated iodine spike 500 times the normal appearance rate based on an initial RCS DEI-131 concentration of 0.5 Ci/gm and 145 gal/min letdown is assumed.

b. Mass released is in addition to steam releases shown.

REV 30 10/21

FNP-FSAR-15 TABLE 15.4-23a PARAMETERS USED IN ANALYSIS OF MAIN STEAM LINE BREAK CONTROL ROOM DOSES CREFS initiation time Safety injection signal generated; 27 s Pressurization < 60 s Filtered pressurization rate (ft3/ min) 375 Filtered recirculation rate (ft3/min) 2700 210 (includes 10 ft3/min for Unfiltered inleakage rate (ft3/min) ingress/egress)

Filter efficiencies (%)

Pressurization air (all forms of iodine) 98.5 Recirculation air (elemental/organic iodine) 94.5 (particulate iodine) 98.5 Volume (ft3) 114,000 Operator breathing rate (m3/s) 3.5 x 10-4 Meteorology Accident (see appendix 15B)

Control room dose 10 CFR 50.67 Limit (rem)

Pre-iodine spike 0.4 Concurrent iodine spike 0.5 10 CFR 50.67 Limit 5 REV 30 10/21

FNP-FSAR-15 TABLE 15.4-24 (SHEET 1 OF 2)

PARAMETERS USED IN STEAM GENERATOR TUBE RUPTURE ANALYSES Parameter Value Core thermal power (MWt) 2831 Steam generator tube leak rate prior to and during accident 1 gal/min (0.65 gal/min to intact SG/0.35 gal/min to faulted SG )

Offsite power Lost Fuel defects (%) 1(a)

Alkali metal partition factor flow out of the steam generators during accident 1000 Iodine partition factors for secondary sidewater in steam generators during 100 accident Iodine and alkali partition factor for primary side water (RCS flashing) during Non-Flash Flashing accident 0-324 s (before trip) 1.27 4.76 324 s - 1800s (after trip) 1.18 6.67 Time to reactor trip (s) 324(b)

Time to isolate defective steam generator (min) 30 Duration of plant cooldown by secondary system after accident (h) 8 Steam release from ruptured steam generator 405,000 lb (0-324 s) 74,000 lb (324 s -30 min)

Steam release from two intact steam generators 810,000 lb (0-324 s) 395,000 lb (324 s -2 h) 934,000 lb (2-8hr)

Feedwater flow to two intact steam generators 1,116,000 lb (0-2 h) 981,000 lb (2-8 h)

REV 30 10/21

FNP-FSAR-15 TABLE 15.4-24 (SHEET 2 OF 2)

Reactor coolant released to the ruptured steam generator 26,600 lbm (0-324 s) 136,400 lbm (>324 s)

Meteorology Accident (see appendix 15B)

Pre-Accident Offsite Dose (rem)(c) Iodine Spike Accident-Initiated Iodine Spike Site Boundary 2.0 0.9 LPZ 0.8 0.4 Regulatory Guide 1.183 Offsite Limit 25 2.5

a. Pre-accident iodine spike 60 times the Technical Specification limit or accident-initiated iodine spike 335 times the normal appearance rate based on an initial RCS DEI-131 concentration of 0.5 Ci/gm and 145 gal/min letdown.

b. Steam release prior to reactor trip is to the condenser.

REV 30 10/21

FNP-FSAR-15 TABLE 15.4-24a PARAMETERS USED IN ANALYSIS OF STEAM GENERATOR TUBE RUPTURE ACCIDENT CONTROL ROOM DOSES CREFS initiation time Safety injection signal generated; 324 s Pressurization 324 s Filtered pressurization rate (ft3/min) 375 Filtered recirculation rate (ft3/min) 2700 210 (includes 10 ft3/min for Unfiltered inleakage rate (ft3/min) ingress/egress)

Filter efficiencies (%)

Pressurization air (all forms of iodine) 98.5 Recirculation air (elemental/organic iodine) 94.5 (particulate iodine) 98.5 Volume (ft3) 114,000 Operator breathing rate (m3/s) 3.5 x 10-4 Meteorology Accident (see appendix 15B)

Control room dose (REM)

Pre-iodine spike 0.3 Concurrent iodine spike 0.2 10 CFR 50.67 Limit 5 REV 30 10/21

FNP-FSAR-15 TABLE 15.4-25A

SUMMARY

OF RESULTS FOR THE LOCKED ROTOR TRANSIENT Criteria 3 Loops Initially Operating, One Locked Rotor Maximum RCS pressure 2736 psia Maximum clad temperature at core hotspot 1959°F Zr-H2O reaction at core hotspot 0.5 wt%

Fraction of rods in DNB < 20 percent Site boundary dose (0 - 2 h) 1.0 rem Low population zone dose (0 - 8 hour9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br />)(a) 0.7 rem Regulatory Guide 1.183 Offsite Limit 2.5 rem Control room dose 0.4 rem 10 CFR 50.67 Limit 5 rem REV 30 10/21

FNP-FSAR-15 TABLE 15.4-25B PARAMETERS USED IN RCP LOCKED ROTOR ANALYSES Core thermal power (MWt) 2831 Offsite Power Lost Steam generator tube leak rate prior to and during accident (gal/min) 1 Activity released to RCS 20% of gap inventory Radial peaking factor 1.7 Secondary side iodine activity 0.1 Ci/gm DEI131 Iodine partition factor in steam generators 100 Duration of plant cooldown by secondary system after accident (h) 8 Steam release from three steam generators (lb) 564,000 (0-2 h) 917,000 (2-8 h)

Feedwater flow to three steam generators (lb) 763,000 (0-2 h) 929,000 (2-8 h)

Manual CREFS initiation 20 min Filtered pressurization rate (ft3/min) 375 Filtered recirculation rate (ft3/min) 2700 Unfiltered inleakage rate (ft3/min) 210 (includes 10 ft3/min for ingress/egress)

Filter efficiencies (%)

Pressurization air (all forms of iodine) 98.5 Recirculation air (elemental/organic iodine) 94.5 (particulate iodine) 98.5 Volume (ft3) 114,000 Operator breathing rate (m3/s) 3.5 x 10-4 Meteorology Accident (see appendix 15B)

REV 30 10/21

FNP-FSAR-15 TABLE 15.4-26 RELEASE ACTIVITIES FOR FUEL HANDLING ACCIDENT 70-h Released Activity Group Isotope (Curies)

Kr-85 9.0E+02 Xe-131m 4.6E+02 Noble Gases Xe-133 6.8E+04 Xe-133m 1.6E+03 Xe-135 1.0E+03 I-131 2.7E+02 I-132 1.7E+02 Halogens I-133 4.2E+01 I-135 2.6E-01 REV 29 4/20

FNP-FSAR-15 TABLE 15.4-27 (SHEET 1 OF 3)

PARAMETERS USED IN FUEL HANDLING ACCIDENT ANALYSIS Accident in Spent-Fuel Accident in Refueling Pool (Auxiliary Building) Canal (Containment) (c)

Core thermal power 2831 MWt 2831 MWt Time between plant shutdown and accident 70 h 70 h Minimum water depth between tops of damaged 23 ft 23 ft fuel rods and water surface Damage to fuel assembly All rods ruptured All rods ruptured Fuel assembly activity Highest powered fuel assembly in core Highest powered fuel assembly in core region discharged region discharged Activity release from assembly Gap activity in ruptured rods Gap activity in ruptured rods Radial peaking factor 1.7 1.7 Decontamination factor in water Elemental iodine (99.85%) 500 500 Organic iodine (0.15%) 1 1 Noble gases 1 1 Amount of mixing in building 72,150 ft3 1.0 x 106 ft3 REV 29 4/20

FNP-FSAR-15 TABLE 15.4-27 (SHEET 2 OF 3)

PARAMETERS USED IN FUEL HANDLING ACCIDENT ANALYSIS Accident in Spent-Fuel Accident in Refueling Pool (Auxiliary Building) Canal (Containment) (c)

Exhaust flowrate 16,500 ft3/min 55,000 ft3/min (containment purge exhaust) 25,000 ft3/min (personnel airlock)

Isolation time N/A N/A Iodine filtration system Penetration room filtration system Containment purge system (not credited)

Filter efficiency (all species) N/A N/A Atmospheric dilution factors Accident (see table 15B-2) Accident (see table 15B-2)

Control Room Parameters Normal HVAC unfiltered intake (ft3/min) 2,340 Unpressurized unfiltered infiltration (ft3/min) 600 Filtered pressurization makeup rate (ft3/min) 375 Pressurized unfiltered inleakage (ft3/min) 325 Filtered recirculation rate (ft3/min) 2,700 REV 29 4/20

FNP-FSAR-15 TABLE 15.4-27 (SHEET 3 OF 3)

PARAMETERS USED IN FUEL HANDLING ACCIDENT ANALYSIS Control Room Parameters Unfiltered ingress / egress rate (ft3/min) 10 Filter efficiencies (all forms of iodine) %(a)

Pressurization air 98.5 Recirculation air 94.5 Isolation time (s) 120 Pressurization Sys Manual Start Time (min) 22 Volume 114,000 Operator breathing rate (m3/s) 3.5 x 10 -4 Percent of time operator is in control room following fuel handling accident (%)

0-8h 100

a. Filter efficiency has been reduced by 0.5% to account for bypass leakage.

b. Deleted

c. During the postulated FHA, no credit is taken for isolation by the containment purge exhaust radiation monitor. The unfiltered release to the environment is via the containment purge exhaust and the open personnel airlock to the plant vent stack.

REV 29 4/20

FNP-FSAR-15 TABLE 15.4-28 DELETED REV 28 10/18

FNP-FSAR-15 TABLE 15.4-29 DOSES FROM FUEL HANDLING ACCIDENT IN SPENT FUEL POOL 70 HR DECAY Site Boundary Dose (rem) Low-Population Zone Dose (rem) 2.8 1.0 Control Room Dose (rem) 2.9 REV 29 4/20

FNP-FSAR-15 TABLE 15.4-30 DOSES FROM FUEL HANDLING ACCIDENT INSIDE CONTAINMENT Location Dose type Dose (rem) Accident Limit (rem)

Site Boundary TEDE 2.8 6.3 Low - Population Zone TEDE 1.0 6.3 (LPZ)

Control Room (a) TEDE 3.4 5

a. The control room doses comply with the acceptance criteria of 10 CFR 50.67.

REV 29 4/20

FNP-FSAR-15 TABLE 15.4-31 (SHEET 1 OF 4)

PARAMETERS USED IN ROD EJECTION ACCIDENT ANALYSES Conservative Analysis Core thermal power (MWt) 2831 Containment free volume (ft3) 2.03 x 106 Containment leak rates 0-24 h 0.15 weight %/day

> 24 h 0.0075 weight %/day Steam generator tube leak rate prior to and during steam (gal/min total) 1 Failed fuel (clad) 10% of fuel rods in core Activity released to reactor coolant from failed fuel gap and available for release Iodine isotopes and noble gases 10% of core inventory Melted fuel 0.25% of fuel rods in core REV 30 10/21

FNP-FSAR-15 TABLE 15.4-31 (SHEET 2 OF 4)

PARAMETERS USED IN ROD EJECTION ACCIDENT ANALYSES Conservative Analysis Activity released to reactor coolant from melted fuel and available for release Containment Release Noble gases 100% within melted rods Iodines 25% within melted rods Secondary Release Noble gases 100% within melted rods Iodines 50% within melted rods Radial peaking factor 1.7 Iodine partition factor in steam generators prior to and during accident 100 Alkali metal partition factor in steam generators prior to and during accident 1000 Plateout of aerosol activity released to containment (h) Power Model (Tenth Percentile)

REV 30 10/21

FNP-FSAR-15 TABLE 15.4-31 (SHEET 3 OF 4)

Conservative Analysis Form of iodine activity in containment available for release Elemental iodine (%) 4.85 Organic iodine (%) 0.15 Aerosols (%) 95 Form of iodine activity released from steam generators Elemental iodine (%) 97 Organic iodine (%) 3 Aerosols (%) 0 Time between accident and equalization of primary and secondary system pressures (s) 2500 CREFS initiation time 120 seconds Filtered pressurization rate (ft3/min) 375 Filtered recirculation rate (ft3/min) 2700 Unfiltered inleakage rate (ft3/min) 210 (includes 10 ft3/min for ingress/egress)

Filter efficiencies (%)

Pressurization air (all forms of iodine) 98.5 Recirculation air (elemental/organic iodine) 94.5 (particulate iodine) 98.5 Volume (ft3) 114,000 REV 30 10/21

FNP-FSAR-15 TABLE 15.4-31 (SHEET 4 OF 4)

Conservative Analysis Operator breathing rate (m3/s) 3.5 x 10-4 Meteorology Accident (see appendix 15B)

Off-Site Dose (Rem)

Site Boundary Containment release 2.5 Secondary release 0.5 LPZ Containment release 1.7 Secondary release 0.2 Control Room Dose (rem)

Containment release 1.5 Secondary release < 0.1 REV 30 10/21

REV 21 5/08 LARGE BREAK LOCA SEQUENCE OF EVENTS JOSEPH M. FARLEY NUCLEAR PLANT FOR REFERENCE TRANSIENT UNIT 1 AND UNIT 2 FIGURE 15.4-1

REV 21 5/08 PEAK CLADDING TEMPERATURE AND JOSEPH M. FARLEY NUCLEAR PLANT ELEVATION (REFERENCE DECLG TRANSIENT)

UNIT 1 AND UNIT 2 FIGURE 15.4-2

REV 21 5/08 JOSEPH M. FARLEY BREAK FLOW (VESSEL SIDE)

NUCLEAR PLANT UNIT 1 AND UNIT 2 FIGURE 15.4-3

REV 21 5/08 JOSEPH M. FARLEY BREAK FLOW (LOOP SIDE)

NUCLEAR PLANT UNIT 1 AND UNIT 2 FIGURE 15.4-4

REV 21 5/08 INTACT LOOP PUMP INLET JOSEPH M. FARLEY NUCLEAR PLANT VOID FRACTION UNIT 1 AND UNIT 2 FIGURE 15.4-5

REV 21 5/08 BROKEN LOOP PUMP INLET JOSEPH M. FARLEY NUCLEAR PLANT VOID FRACTION UNIT 1 AND UNIT 2 FIGURE 15.4-6

REV 21 5/08 FLOWRATE AT TOP, MIDDLE, AND BOTTOM JOSEPH M. FARLEY NUCLEAR PLANT OF CORE DURING BLOWDOWN UNIT 1 AND UNIT 2 FIGURE 15.4-7

REV 21 5/08 JOSEPH M. FARLEY PRESSURIZER PRESSURE NUCLEAR PLANT UNIT 1 AND UNIT 2 FIGURE 15.4-8

REV 21 5/08 JOSEPH M. FARLEY LOWER PLENUM COLLAPSED LIQUID LEVEL NUCLEAR PLANT UNIT 1 AND UNIT 2 FIGURE 15.4-9

REV 21 5/08 JOSEPH M. FARLEY VESSEL FLUID MASS NUCLEAR PLANT UNIT 1 AND UNIT 2 FIGURE 15.4-10

REV 21 5/08 JOSEPH M. FARLEY ACCUMULATOR LIQUID FLOW NUCLEAR PLANT UNIT 1 AND UNIT 2 FIGURE 15.4-11

REV 21 5/08 JOSEPH M. FARLEY SAFETY INJECTION FLOW NUCLEAR PLANT UNIT 1 AND UNIT 2 FIGURE 15.4-12

REV 21 5/08 JOSEPH M. FARLEY CORE CHANNELS COLLAPSED LIQUID LEVEL NUCLEAR PLANT UNIT 1 AND UNIT 2 FIGURE 15.4-13

REV 21 5/08 DOWNCOMER CHANNELS COLLAPSED JOSEPH M. FARLEY NUCLEAR PLANT LIQUID LEVEL UNIT 1 AND UNIT 2 FIGURE 15.4-14

REV 21 5/08 CLADDING TEMPERATURE AT VARIOUS JOSEPH M. FARLEY NUCLEAR PLANT ELEVATIONS (HOT ROD)

UNIT 1 AND UNIT 2 FIGURE 15.4-15

REV 21 5/08 PEAK CLADDING TEMPERATURE JOSEPH M. FARLEY NUCLEAR PLANT (REFERENCE SPLIT TRANSIENT)

UNIT 1 AND UNIT 2 FIGURE 15.4-15A

REV 21 5/08 BREAK FLOW JOSEPH M. FARLEY NUCLEAR PLANT (SPLIT BREAK)

UNIT 1 AND UNIT 2 FIGURE 15.4-15B

REV 21 5/08 FLOWRATE AT TOP, MIDDLE, AND BOTTOM JOSEPH M. FARLEY NUCLEAR PLANT OF CORE DURING BLOWDOWN UNIT 1 AND UNIT 2 FIGURE 15.4-15C

REV 21 5/08 INTACT LOOP PUMP INLET JOSEPH M. FARLEY NUCLEAR PLANT VOID FRACTION UNIT 1 AND UNIT 2 FIGURE 15.4-15D

REV 21 5/08 FLOWRATE AT BOTTOM JOSEPH M. FARLEY NUCLEAR PLANT OF BROKEN DC CHANNEL UNIT 1 AND UNIT 2 FIGURE 15.4-15E

REV 21 5/08 JOSEPH M. FARLEY ACCUMULATOR LIQUID FLOW NUCLEAR PLANT UNIT 1 AND UNIT 2 FIGURE 15.4-15F

REV 21 5/08 JOSEPH M. FARLEY PRESSURIZER PRESSURE NUCLEAR PLANT UNIT 1 AND UNIT 2 FIGURE 15.4-15G

REV 21 5/08 DOWNCOMER CHANNELS JOSEPH M. FARLEY NUCLEAR PLANT COLLAPSED LIQUID LEVEL UNIT 1 AND UNIT 2 FIGURE 15.4-15H

REV 21 5/08 JOSEPH M. FARLEY LOWER PLENUM COLLAPSED LIQUID LEVEL NUCLEAR PLANT UNIT 1 AND UNIT 2 FIGURE 15.4-15I

REV 21 5/08 JOSEPH M. FARLEY VESSEL FLUID MASS NUCLEAR PLANT UNIT 1 AND UNIT 2 FIGURE 15.4-15J

REV 21 5/08 JOSEPH M. FARLEY CORE CHANNELS COLLAPSED LIQUID LEVEL NUCLEAR PLANT UNIT 1 AND UNIT 2 FIGURE 15.4-15K

REV 21 5/08 JOSEPH M. FARLEY SAFETY INJECTION FLOW NUCLEAR PLANT UNIT 1 AND UNIT 2 FIGURE 15.4-15L

REV 21 5/08 CLADDING TEMPERATURE JOSEPH M. FARLEY NUCLEAR PLANT AT VARIOUS ELEVATIONS (HOT ROD)

UNIT 1 AND UNIT 2 FIGURE 15.4-15M

REV 21 5/08 FAREY REFERENCE SPLIT BREAK -

JOSEPH M. FARLEY CD = 1.0 PEAK CLADDING TEMPERATURE NUCLEAR PLANT HOT ROD UNIT 1 AND UNIT 2 FIGURE 15.4-15N

REV 21 5/08 FARLEY REFERENCE SPLIT BREAK -

JOSEPH M. FARLEY CD = 1.0 AVERAGE CORE LIQUID NUCLEAR PLANT LEVE - CH 10, 11, 12, 13 UNIT 1 AND UNIT 2 FIGURE 15.4-15P

REV 21 5/08 PBOT/PMID LIMITS USED IN JOSEPH M. FARLEY NUCLEAR PLANT BEST-ESTIMATE LOCA ANALYSIS UNIT 1 AND UNIT 2 FIGURE 15.4-16

REV 21 5/08 COCO CONTAINMENT PRESSURE USED JOSEPH M. FARLEY NUCLEAR PLANT IN BEST-ESTIMATE LOCA ANALYSIS UNIT 1 AND UNIT 2 FIGURE 15.4-17

REV 21 5/08 ALUMINUM CORROSION IN JOSEPH M. FARLEY NUCLEAR PLANT DBA ENVIRONMENT UNIT 1 AND UNIT 2 FIGURE 15.4-18

REV 21 5/08 RESULTS OF WESTINGHOUSE JOSEPH M. FARLEY NUCLEAR PLANT CAPSULE IRRADIATION TESTS UNIT 1 AND UNIT 2 FIGURE 15.4-19

REV 21 5/08 JOSEPH M. FARLEY STEAM LINE BREAK GAMMA DOSE NUCLEAR PLANT UNIT 1 AND UNIT 2 FIGURE 15.4-20

REV 21 5/08 JOSEPH M. FARLEY STEAM LINE BREAK BETA DOSE NUCLEAR PLANT UNIT 1 AND UNIT 2 FIGURE 15.4-21

REV 21 5/08 JOSEPH M. FARLEY STEAM LINE BREAK THYROID DOSE NUCLEAR PLANT UNIT 1 AND UNIT 2 FIGURE 15.4-22

REV 21 5/08 JOSEPH M. FARLEY BREAK AND INJECTED MASS FLOWS NUCLEAR PLANT UNIT 1 AND UNIT 2 FIGURE 15.4-23

REV 21 5/08 STEAM GENERATOR TUBE RUPTURE -

JOSEPH M. FARLEY TYPICAL PRIMARY AND SECONDARY SYSTEM NUCLEAR PLANT PRESSURE AS A FUNCTION OF TIME UNIT 1 AND UNIT 2 FIGURE 15.4-24

REV 21 5/08 STEAM LINE BREAK TRANSIENT JOSEPH M. FARLEY WITH OFFSITE POWER 1.069 ft2 NUCLEAR PLANT DOUBLE-ENDED RUPTURE UNIT 1 AND UNIT 2 FIGURE 15.4-28 (SHEET 1 OF 3)

REV 21 5/08 STEAM LINE BREAK TRANSIENT JOSEPH M. FARLEY WITH OFFSITE POWER 1.069 ft2 NUCLEAR PLANT DOUBLE-ENDED RUPTURE UNIT 1 AND UNIT 2 FIGURE 15.4-28 (SHEET 2 OF 3)

REV 21 5/08 STEAM LINE BREAK TRANSIENT JOSEPH M. FARLEY WITH OFFSITE POWER 1.069 ft2 NUCLEAR PLANT DOUBLE-ENDED RUPTURE UNIT 1 AND UNIT 2 FIGURE 15.4-28 (SHEET 3 OF 3)

REV 21 5/08 STEAM LINE BREAK TRANSIENT JOSEPH M. FARLEY WITH OFFSITE POWER 1.069 ft2 NUCLEAR PLANT DOUBLE-ENDED RUPTURE UNIT 1 AND UNIT 2 FIGURE 15.4-29 (SHEET 1 OF 3)

REV 21 5/08 STEAM LINE BREAK TRANSIENT JOSEPH M. FARLEY WITH OFFSITE POWER 1.069 ft2 NUCLEAR PLANT DOUBLE-ENDED RUPTURE UNIT 1 AND UNIT 2 FIGURE 15.4-29 (SHEET 2 OF 3)

REV 21 5/08 STEAM LINE BREAK TRANSIENT JOSEPH M. FARLEY WITH OFFSITE POWER 1.069 ft2 NUCLEAR PLANT DOUBLE-ENDED RUPTURE UNIT 1 AND UNIT 2 FIGURE 15.4-29 (SHEET 3 OF 3)

REV 21 5/08 STEAM LINE BREAK TRANSIENT JOSEPH M. FARLEY WITHOUT OFFSITE POWER 1.069 ft2 NUCLEAR PLANT DOUBLE-ENDED RUPTURE UNIT 1 AND UNIT 2 FIGURE 15.4-30 (SHEET 1 OF 3)

REV 21 5/08 STEAM LINE BREAK TRANSIENT JOSEPH M. FARLEY WITHOUT OFFSITE POWER 1.069 ft2 NUCLEAR PLANT DOUBLE-ENDED RUPTURE UNIT 1 AND UNIT 2 FIGURE 15.4-30 (SHEET 2 OF 3)

REV 21 5/08 STEAM LINE BREAK TRANSIENT JOSEPH M. FARLEY WITHOUT OFFSITE POWER 1.069 ft2 NUCLEAR PLANT DOUBLE-ENDED RUPTURE UNIT 1 AND UNIT 2 FIGURE 15.4-30 (SHEET 3 OF 3)

REV 21 5/08 STEAM LINE BREAK TRANSIENT JOSEPH M. FARLEY WITHOUT OFFSITE POWER 1.069 ft2 NUCLEAR PLANT DOUBLE-ENDED RUPTURE UNIT 1 AND UNIT 2 FIGURE 15.4-31 (SHEET 1 OF 3)

REV 21 5/08 STEAM LINE BREAK TRANSIENT JOSEPH M. FARLEY WITHOUT OFFSITE POWER 1.069 ft2 NUCLEAR PLANT DOUBLE-ENDED RUPTURE UNIT 1 AND UNIT 2 FIGURE 15.4-31 (SHEET 2 OF 3)

REV 21 5/08 STEAM LINE BREAK TRANSIENT JOSEPH M. FARLEY WITHOUT OFFSITE POWER 1.069 ft2 NUCLEAR PLANT DOUBLE-ENDED RUPTURE UNIT 1 AND UNIT 2 FIGURE 15.4-31 (SHEET 3 OF 3)

REV 30 10/21 MAJOR RUPTURE OF A MAIN FEEDWATER PIPE WITH OFFSITE POWER ALWAYS AVAILABLE - PRESSURIZER JOSEPH M. FARLEY PRESSURE NUCLEAR PLANT AND WATER VOLUME VERSUS TIME UNIT 1 AND UNIT 2 (CASE A)

FIGURE 15.4-32 (SHEET 1 OF 6)

REV 30 10/21 MAJOR RUPTURE OF A MAIN FEEDWATER PIPE WITH OFFSITE POWER ALWAYS AVAILABLE - INTACT AND JOSEPH M. FARLEY NUCLEAR PLANT FAULTED LOOP TEMPERATURE VERSUS TIME UNIT 1 AND UNIT 2 (CASE A)

FIGURE 15.4-32 (SHEET 2 OF 6)

REV 30 10/21 MAJOR RUPTURE OF A MAIN FEEDWATER PIPE WITHOUT OFFSITE POWER - PRESSURIZER PRESSURE JOSEPH M. FARLEY NUCLEAR PLANT AND WATER VOLUME VERSUS TIME UNIT 1 AND UNIT 2 (CASE B)

FIGURE 15.4-32 (SHEET 3 OF 6)

REV 30 10/21 MAJOR RUPTURE OF A MAIN FEEDWATER PIPE WITHOUT OFFSITE POWER - INTACT AND JOSEPH M. FARLEY NUCLEAR PLANT FAULTED LOOP TEMPERATURE VERSUS TIME UNIT 1 AND UNIT 2 (CASE B)

FIGURE 15.4-32 (SHEET 4 OF 6)

REV 30 10/21 MAJOR RUPTURE OF A MAIN FEEDWATER PIPE WITHOUT OFFSITE POWER - PRESSURIZER PRESSURE JOSEPH M. FARLEY NUCLEAR PLANT AND WATER VOLUME VERSUS TIME UNIT 1 AND UNIT 2 (CASE B)

FIGURE 15.4-32 (SHEET 5 OF 6)

REV 30 10/21 MAJOR RUPTURE OF A MAIN FEEDWATER PIPE WITHOUT OFFSITE POWER - INTACT AND JOSEPH M. FARLEY NUCLEAR PLANT FAULTED LOOP TEMPERATURE VERSUS TIME UNIT 1 AND UNIT 2 (CASE B)

FIGURE 15.4-32 (SHEET 6 OF 6)

REV 30 10/21 ALL LOOPS INITIALLY JOSEPH M. FARLEY OPERAITNG, ONE LOCKED ROTOR -

NUCLEAR PLANT REACTOR COOLANT SYSTEM PRESSURE UNIT 1 AND UNIT 2 FIGURE 15.4-33

REV 30 10/21 ALL LOOPS INITIALLY JOSEPH M. FARLEY OPERATING, ONE LOCKED ROTOR - TOTAL NUCLEAR PLANT RCS FLOW AND FAULTED LOOP FLOW UNIT 1 AND UNIT 2 FIGURE 15.4-34

REV 30 10/21 ALL LOOPS INITIALLY JOSEPH M. FARLEY OPERATING, ONE LOCKED ROTOR -

NUCLEAR PLANT NUCLEAR POWER UNIT 1 AND UNIT 2 FIGURE 15.4-35

DELETED REV 30 10/21 ALL LOOPS INITIALLY JOSEPH M. FARLEY OPRATING, ONE LOCKED ROTOR -

NUCLEAR PLANT AVERAGE CHANNEL HEAT FLUX UNIT 1 AND UNIT 2 FIGURE 15.4-36

DELETED REV 30 10/21 ALL LOOPS INITIALLY JOSEPH M. FARLEY OPERATING, ONE LOCKED ROTOR -

NUCLEAR PLANT HOT CHANNEL HEAT FLUX UNIT 1 AND UNIT 2 FIGURE 15.4-37

REV 30 10/21 ALL LOOPS INITIALLY JOSEPH M. FARLEY OPERATING, ONE LOCKED ROTOR -

NUCLEAR PLANT CLAD INNER TEMPERATURE UNIT 1 AND UNIT 2 FIGURE 15.4-38

REV 21 5/08 ALL LOOPS OPERATING, JOSEPH M. FARLEY ONE L OCKED ROTOR -

NUCLEAR PLANT CLAD TEMPERATURE VERSUS TIME UNIT 1 AND UNIT 2 FIGURE 15.4-39

REV 30 10/21 NUCLEAR POWER TRANSIENT BOL JOSEPH M. FARLEY HOT FULL-POWER ROD NUCLEAR PLANT EJECTION ACCIDENT UNIT 1 AND UNIT 2 FIGURE 15.4-40

REV 30 10/21 HOTSPOT FUEL AND CLAD TEMPERATURE JOSEPH M. FARLEY VERSUS TIME - BOL HOT FULL-POWER NUCLEAR PLANT ROD EJECTION ACCIDENT UNIT 1 AND UNIT 2 FIGURE 15.4-41

REV 30 10/21 NUCLEAR POWER TRANSIENT JOSEPH M. FARLEY EOL HOT ZERO-POWER ROD NUCLEAR PLANT EJECTION ACCIDENT UNIT 1 AND UNIT 2 FIGURE 15.4-42

REV 30 10/21 HOTSPOT FUEL AND CLAD JOSEPH M. FARLEY TEMPERATURE VERSUS TIME - EOL HOT NUCLEAR PLANT ZERO-POWER ROD EJECTION ACCIDENT UNIT 1 AND UNIT 2 FIGURE 15.4-43

REV 21 5/08 ROD EJECTION ACCIDENT JOSEPH M. FARLEY NUCLEAR PLANT (NO MELTING) GAMMA DOSE UNIT 1 AND UNIT 2 FIGURE 15.4-44

REV 21 5/08 ROD EJECTION ACCIDENT JOSEPH M. FARLEY NUCLEAR PLANT (NO MELTING) BETA DOSE UNIT 1 AND UNIT 2 FIGURE 15.4-45

REV 21 5/08 ROD EJECTION ACCIDENT JOSEPH M. FARLEY NUCLEAR PLANT (NO MELTING) THYROID DOSE UNIT 1 AND UNIT 2 FIGURE 15.4-46

REV 21 5/08 ROD EJECTION ACCIDENT JOSEPH M. FARLEY NUCLEAR PLANT (0.25-PERCENT MELTING) GAMMA DOSE UNIT 1 AND UNIT 2 FIGURE 15.4-47

REV 21 5/08 ROD EJECTION ACCIDENT JOSEPH M. FARLEY NUCLEAR PLANT (0.25-PERCENT MELTING) BETA DOSE UNIT 1 AND UNIT 2 FIGURE 15.4-48

REV 21 5/08 ROD EJECTION ACCIDENT JOSEPH M. FARLEY (0.25-PERCENT MELTING)

NUCLEAR PLANT THYROID DOSE UNIT 1 AND UNIT 2 FIGURE 15.4-49

REV 21 5/08 DEPICTION OF THE DOWNFLOW BARREL JOSEPH M. FARLEY NUCLEAR PLANT BAFFLE DESIGN CONFIGURATION UNIT 1 AND UNIT 2 FIGURE 15.4-50

REV 21 5/08 DEPICTION OF THE UPFLOW BARREL JOSEPH M. FARLEY NUCLEAR PLANT BAFFLE DESIGN CONFIGURATION UNIT 1 AND UNIT 2 FIGURE 15.4-51

FNP-FSAR-15 15.5 ANTICIPATED TRANSIENTS WITHOUT SCRAM The worst common mode failure which is postulated to occur is the failure to scram the reactor after an anticipated transient has occurred. A series of generic studies(1,2) on anticipated transients without scram (ATWS) and additional plant-specific analyses showed acceptable consequences would result provided that the turbine trips and auxiliary feedwater flow is initiated in a timely manner. The final NRC ATWS rule(3) requires that Westinghouse designed plants install an ATWS mitigation system actuation circuitry (AMSAC) to initiate a turbine trip and actuate auxiliary feedwater flow independent of the reactor protection system.

The Farley AMSAC design is described in section 7.8 15.5-1 REV 30 10/21

FNP-FSAR-15 REFERENCES

1. "Westinghouse Anticipated Transients Without Trip Analysis," WCAP-8330, August 1974.

2. Anderson, T.M., "ATWS Submittal," Westinghouse Letter NS-TMA-2182 to S. H.

Hanauer of the NRC, December 1979.

3. ATWS Final Rule - Code of Federal Regulations 10 CFR 50.62 and Supplementary Information Package, "Reduction of Risk from Anticipated Transients Without Scram (ATWS) Events for Light-Water-Cooled Nuclear Power Plants."

15.5-2 REV 30 10/21

FNP-FSAR-15A APPENDIX 15A HEAT TRANSFER COEFFICIENTS USED IN THE LOCTA-R2 CORE THERMAL ANALYSIS This appendix has been deleted from the FSAR.

15A-1 REV 21 5/08

FNP-FSAR-15B APPENDIX 15B DOSE MODELS USED TO EVALUATE THE ENVIRONMENTAL CONSEQUENCES OF ACCIDENTS TABLE OF CONTENTS Page 15B.1 INTRODUCTION .................................................................................................... 15B-1 15B.2 ASSUMPTIONS ...................................................................................................... 15B-1 15B.3 GAMMA DOSE AND BETA DOSE ......................................................................... 15B-2 15B.4 THYROID INHALATION DOSE .............................................................................. 15B-3 15B.5 TOTAL EFFECTIVE DOSE EQUIVALENT DOSE ................................................. 15B-3 15B-i REV 29 4/20

FNP-FSAR-15B LIST OF TABLES 15B-1 Physical Data for Isotopes 15B-2 Offsite Accident Atmospheric Dispersion Factors (s/m3) 15B-2a Small Break LOCA Atmospheric Dilution Factors (s/m3) 15B-3 Control room Atmospheric Dispersion Factors (s/m3) 15B-ii REV 29 4/20

FNP-FSAR-15B APPENDIX 15B DOSE MODELS USED TO EVALUATE THE ENVIRONMENTAL CONSEQUENCES OF ACCIDENTS 15B.1 INTRODUCTION This section identifies the models used to calculate offsite radiological doses that would result from releases of radioactivity due to various postulated accidents. The postulated accidents are:

A. Fuel handling accident (FHA).

B. Waste gas decay tank rupture.

C. Steam generator tube rupture (SGTR).

D. Main steam line break (MSLB) accident.

E. Control rod ejection (CRE) accident.

F. Loss-of-coolant accident (LOCA).

G. Locked rotor accident (LRA).

15B.2 ASSUMPTIONS The following assumptions are basic to both the model for the gamma and beta doses due to immersion in a cloud of radioactive material and the model for the TEDE and thyroid dose due to inhalation of radioactive material:

A. Direct radiation from the source point is negligible compared to gamma and beta radiation due to submersion in the radioactive material leakage cloud.

B. All radioactive material releases are treated as ground-level releases regardless of the point of discharge.

C. The dose receptor is a standard man as defined the International Commission on Radiological Protection (ICRP)(1).

D. Radioactive decay from the point of release to the dose receptor is neglected.

15B-1 REV 29 4/20

FNP-FSAR-15B E. Isotopic data such as decay rates and decay energy emissions are taken from standard industry documents.(2, 7) 15B.3 GAMMA DOSE AND BETA DOSE The gamma and beta doses delivered to a dose receptor are obtained by considering the dose receptor to be immersed in a radioactive cloud which is infinite in all directions above the ground plane; i.e., an "infinite semispherical cloud." The concentration of radioactive material within this cloud is taken to be uniform and equal to the maximum centerline ground level concentration that would exist in the cloud at the appropriate distance from the point of release.

The beta dose is a result of external beta radiation and the gamma dose is a result of external gamma radiation. Equations describing an infinite semispherical cloud were used to calculate the doses for a given time period as follows:(3)

Beta Dose = 0.23 A R i Ei Q i Gamma Dose = 0.25 A R i E i Q i where:

A Ri = the activity of isotope i release during a given time period (Ci)

= the atmospheric dilution factor for a given time period (s/m3)

Q E i = the average beta radiation energy emitted by isotope i per disintegration (MeV)

E i = the average gamma radiation energy emitted by isotope i per disintegration (MeV)

As an alternative, doses may be calculated as Beta or Gamma Dose =

Q i A R i DCFi where DCFi is the Dose Conversion Factor for isotope i taken from standard industry documents(4-8). The dose may be modified by an occupancy factor for non-continuous occupancy, a geometry factor for other than an infinite hemispherical source, etc., as appropriate to the problem being analyzed.

15B-2 REV 29 4/20

FNP-FSAR-15B 15B.4 THYROID INHALATION DOSE The thyroid dose for accidents not utilizing the 10 CFR 50.67 Alternative Source Term for a given time period t is obtained from the following expression:(4)

D B Qi DCFi Q i where:

D = thyroid inhalation dose (rem)

B = breathing rate for time interval t (m3/s)

Q = total activity of iodine isotope i released in time period t (Ci)

The isotopic data and standard-man data are given in table 15B-1. The atmospheric dilution factors used in the analysis of the environmental consequences of accidents are given in chapter 2 of this report and are reiterated in table 15B-2a of this appendix.

The gamma energies, E, in table 15B-1 include the X-rays and annihilation gamma rays if they are prominent in the electromagnetic spectrum. Also, the beta energies, E, include conversion electrons if they are prominent in the electromagnetic spectrum. The beta energies are averaged quantities in the sense that the continuous beta spectra energies are computed as one-third the maximum beta energies.

15B.5 TOTAL EFFECTIVE DOSE EQUIVALENT DOSE The total effective dose equivalent (TEDE) dose for accidents that utilize the 10 CFR 50.67 Alternative Source Term for a given time period t is derived from the methodology described in Regulatory Guide 1.183.

The atmospheric dispersion factors (X/Q) for the exclusion area boundary and the low population zone were established during the initial licensing of the facility, as described in paragraph 2.3.4.2. The X/Q values used for each averaging period are shown in table 15B-2.

The atmospheric dispersion factors were computed at the control room intake for each hour of meteorological date, for the years 2000 through 2004, using the ARCON96 computer code as described in Regulatory Guide 1.194. ARCON96 evaluates ground level, vent, and elevated releases. A vent release is one that takes place through a rooftop vent with an uncapped vertical opening. Building wake effects are also considered in the model for estimating X/Q values from ground-level releases. Momentum rise and thermal plume rise are not considered in calculating the effective release height in the model. Additionally, under calm wind conditions, the receptor location is assumed to be directly downwind of the release point.

Considering the release height, the receptor height, and the horizontal distance from the release point to the receptor, the model will calculate a slant range distance as the straight-line distance between the release point and the receptor. The values of X/Q for each averaging 15B-3 REV 29 4/20

FNP-FSAR-15B period were calculated and the 5-percent probable values determined. The X/Q values for each averaging time for each accident are shown in table 15B-3.

15B-4 REV 29 4/20

FNP-FSAR-15B REFERENCES

1. "Report on ICRP Committee III on Permissible Dose for Internal Radiation (1959),"

Health Physics, Vol 3, pp 30 and 146-153, 1960.

2. Lederer, C. M., et al., Table of Isotopes, 6th ed., 1968, or 7th ed., 1978.

3. Nuclear Regulatory Commission, "Assumptions Used for Evaluating the Potential Radiological Consequences for a Loss of Coolant Accident for Pressurized-Water Reactors," Regulatory Guide 1.4, June 1974.

4. DiNunno, J. J., et al., "Calculation of Distance Factors for Power and Test Reactor Sites," TID-14844, March 1962.

5. Nuclear Regulatory Commission, "Calculation of Annual Doses to Man from Routine Releases of Reactor Effluents for the Purpose of Evaluating Compliance with 10 CFR Part 50, Appendix I," Regulatory Guide 1.109, Revision 1, October 1977.

6. Limits for Intakes of Radionuclides by Workers, ICRP Publication 30.

7. EPA-520-1-88-020, Federal Guidance Report #11: Limiting Values of Radionuclide Intake and Air Concentration and Dose Conversion Factors for Inhalation, Submersion, and Ingestion, September 1988.

8. EPA-402-R-93-081, Federal Guidance Report #12: External Exposure to Radionuclides in Air, Water, and Soil, September 1993.

15B-5 REV 29 4/20

FNP-FSAR-15B TABLE 15B-1 PHYSICAL DATA FOR ISOTOPES Gamma Energy(a) Beta Energy(a) Dose Conversion Isotope Decay Constant (HR-1) (MeV/Disintegration) (MeV/Disintegration) Factor(b) (rem/Ci)

I-131 3.5856 x 10-3 0.371 0.197 1.48 x 106

-1 I-132 2.97 x 10 2.400 0.448 5.35 x 104 I-133 3.31 x 10-2 0.477 0.423 4.00 x 105

-1 I-134 7.92 x 10 1.939 0.455 2.50 x 104 I-135 1.03 x 10-1 1.779 0.308 1.24 x 105

-3 Xe-133 5.47 x 10 0.030 0.146 -

Xe-133m 1.26 x 10-2 0.033 0.155 -

-2 Xe-135 7.60 x 10 0.246 0.322 -

Xe-135m 2.72 x 100 0.422 0.097 -

0 Xe-138 2.45 x 10 2.870 0.800 -

Kr-85 7.95 x 10-6 0.0021 0.223 -

-1 Kr-85m 1.49 x 10 0.151 0.233 -

Kr-87 5.33 x 10-1 1.375 1.050 -

-1 Kr-88 2.50 x 10 1.743 0.341 -

BREATHING RATES Time Period (h) Control Room (m3/s) Offsite (m3/s) 0-8 3.47 x 10-4 3.47 x 10-4 8 - 24 3.47 x 10-4 1.75 x 10-4 24 - 720 3.47 x 10-4 2.32 x 10-4

a. See reference 2.

b. See reference 4. Subsequent to the issuance of the Operating License, the dose conversion factors from Regulatory Guide 1.109 (reference 5) have been used and may continue to be used when calculating doses to the thyroid due to inhalation. Subsequent to FSAR Revision 13, dose conversion factors from ICRP 30 (reference 6) may be used when calculating doses to the thyroid due to inhalation.

REV 21 5/08

FNP-FSAR-15B TABLE 15B-2 OFFSITE ACCIDENT ATMOSPHERIC DISPERSION FACTORS (s/m3)

Site Boundary Low-Population Time Period (1262 m) Zone (3219 m) 0-2h 7.6 x 10-4 2.8 x 10-4 2-8h 1.1 x 10-4 8 - 24 h 1.0 x 10-5 24 - 96 h 5.4 x 10-6 96 - 720 h 2.9 x 10-6 REV 28 10/18

FNP-FSAR-15B TABLE 15B-2a SMALL BREAK LOCA ATMOSPHERIC DILUTION FACTORS (s/m3)

Site Boundary Low-Population Time Period (1262 m) Zone (3219 m) Control Room 0 - 30 s ------------- ------------- 8.79 x 10-4 (b) / 5.06 x 10-3 (c)(e) 30 - 2 h ------------- ------------- 8.79 x 10-4 (b) / 1.66 x 10-3 (d)(e) 0 - 2 h(a) 7.6 x 10-4 2.8 x 10-4 1.66 x 10-3 2-8h 2.9 x 10-4 1.1 x 10-4 1.38 x 10-3 8 - 24 h 3.3 x 10-5 1.0 x 10-5 7.20 x 10-4 24 - 96 h 1.9 x 10-5 5.4 x 10-6 5.60 x 10-4 96 - 720 h 1.1 x 10-5 2.9 x 10-6 4.21 x 10-4

a. These values are actually the 0-1-h X/Q values and are used for the 0 to 2-h period following an accident in accordance with NRC practice.

b. Equipment hatch - control room (emergency intake)

c. Containment - TSC used for control room (normal intake)

d. Containment - control room (emergency intake)

e. These control room atmospheric dispersion factors reflect the values resulting from analysis performed to support a Technical Specification change allowing the equipment hatch and personnel airlocks to remain open during refueling operations with appropriate administrative controls. Reference NRC SERs documented in NRC letters LC14842 (dated 29 September 2008) and LC 14149 (dated 30 September 2004).

REV 28 10/18

FNP-FSAR-15B TABLE 15B-3 (SHEET 1 OF 2)

CONTROL ROOM ATMOSPHERIC DISPERSION FACTORS (s/m3)

Containment Accident Time Period Control Room 0-2h 1.66 x 10-3 LOCA, MSLBA, SGTR, CRE, LRA 2-8h 1.36 x 10-3 LOCA 2-8h 1.38 x 10-3 MSLBA, SGTR, CRE, LRA 8 - 24 h 6.81 x 10-4 LOCA 8 - 24 h 7.20 x 10-4 MSLBA, CRE 24 - 96 h 5.60 x 10-4 LOCA, CRE 96 - 720 h 4.21 x 10-4 LOCA, CRE Plant Vent Time Period Control Room 0-2h 1.62 x 10-3 FHA 0 - 0.0167 h 2.79 x 10-3 LOCA 0.0167 - 2 h 1.65 x 10-3 LOCA 2-8h 1.37 x 10-3 FHA 2-8h 1.38 x 10-3 LOCA REV 29 4/20

FNP-FSAR-15B TABLE 15B-3 (SHEET 2 OF 2)

CONTROL ROOM ATMOSPHERIC DISPERSION FACTORS (s/m3)

Plant Vent Time Period Control Room Accident 8 - 24 h 7.10 x 10-4 FHA 8 - 24 h 7.20 x 10-4 LOCA 24 - 96 h 5.47 x 10-4 LOCA 96 - 720 h 3.63 x 10-4 LOCA RWST Time Period Control Room Accident 0-2h 4.97 x 10-4 LOCA 2-8h 3.82 x 10-4 LOCA 8 - 24 h 1.70 x 10-4 LOCA 24 - 96 h 1.28 x 10-4 LOCA 96 - 720 h 1.00 x 10-4 LOCA REV 29 4/20

FNP-FSAR-15C APPENDIX 15C DELETED 15C-1 REV 21 5/08