RS-14-006, Clinton, Unit 1, Updated Safety Analysis Report, Revision 16, Chapter 15 - Accident Analysis

Clinton, Unit 1, Updated Safety Analysis Report, Revision 16, Chapter 15 - Accident Analysis

ML14015A291
Person / Time
Site:	Clinton
Issue date:	01/09/2014
From:	Exelon Generation Co
To:	Office of Nuclear Reactor Regulation
Shared Package
ML14015A117	List: ML14015A096 ML14015A097 ML14015A098 ML14015A101 ML14015A103 ML14015A104 ML14015A105 ML14015A106 ML14015A107 ML14015A108 ML14015A111 ML14015A112 ML14015A129 ML14015A131 ML14015A132 ML14015A134 ML14015A135 ML14015A149 ML14015A150 ML14015A152 ML14015A245 ML14015A246 ML14015A250 ML14015A251 ML14015A252 ML14015A253 ML14015A254 ML14015A255 ML14015A283 ML14015A284 ML14015A285 ML14015A286 ML14015A290 ML14015A291 ML14015A292 RS-14-006, Clinton, Unit 1, Updated Licensing Basis Documents RS-14-006, Clinton, Unit 1, Updated Safety Analysis Report, Revision 16 Chapter 3 - Design of Structures, Components, Equipment, and Systems, Figure 3.6-1. Sheet 95 of 111 Through Figure 3.6-1. Sheet 100 of 111 RS-14-006, Clinton, Unit 1, Updated Safety Analysis Report, Revision 16, Appendix B - Construction Material Standards and Quality Control Procedures RS-14-006, Clinton, Unit 1, Updated Safety Analysis Report, Revision 16, Appendix C - Computer Programs RS-14-006, Clinton, Unit 1, Updated Safety Analysis Report, Revision 16, Appendix a - Glossary RS-14-006, Clinton, Unit 1, Updated Safety Analysis Report, Revision 16, Chapter 1 - Introduction and General Description of Plant RS-14-006, Clinton, Unit 1, Updated Safety Analysis Report, Revision 16, Chapter 10 - Steam and Power Conversion System RS-14-006, Clinton, Unit 1, Updated Safety Analysis Report, Revision 16, Chapter 11 - Radioactive Waste Management RS-14-006, Clinton, Unit 1, Updated Safety Analysis Report, Revision 16, Chapter 13 - Conduct of Operations RS-14-006, Clinton, Unit 1, Updated Safety Analysis Report, Revision 16, Chapter 14 - Initial Test Program RS-14-006, Clinton, Unit 1, Updated Safety Analysis Report, Revision 16, Chapter 15 - Accident Analysis RS-14-006, Clinton, Unit 1, Updated Safety Analysis Report, Revision 16, Chapter 16 - Technical Specifications RS-14-006, Clinton, Unit 1, Updated Safety Analysis Report, Revision 16, Chapter 17 - Quality Assurance RS-14-006, Clinton, Unit 1, Updated Safety Analysis Report, Revision 16, Chapter 2 - Site Characteristics RS-14-006, Clinton, Unit 1, Updated Safety Analysis Report, Revision 16, Chapter 2 - Site Characteristics, Figure 2.1-1 Through Figure 2.4-18 ... further results
References
RS-14-006
Download: ML14015A291 (510)

Text

CPS/USAR CHAPTER 15 15.0-1 REV. 12, JANUARY 2007 CHAPTER 15 - ACCIDENT ANALYSES 15.0 GENERAL In this chapter the effects of anticipated process disturbances and postulated component failures are examined to determine their consequences and to evaluate the capability built into the plant to control or accommodate such failures and events. The scope of the situations analyzed includes anticipated (expected) operational occurrences (e.g., loss of electrical load), off-design abnormal (unexpected) transients that induce system operations condition disturbances, postulated accidents of low probability (e.g., the sudden loss

of integrity of a major component), and finally hypothetical events of extremely low probability (e.g., an anticipated transient without the operation of the entire control rod drive system). For the postulated Fuel Handling Accident (FHA), Control Rod Drop Accident (CRDA), Main Steam Line Break (MSLB) accident outside containment, and Loss-of-Coolant Accident (LOCA), a new set of radiological consequence analyses are presented utilizing Alternative Source Term (AST) methodology per Regulatory Guide (RG) 1.183, "Alternative Radiological Source Terms for Evaluating Design Basis Accidents at Nuclear Power Reactors", and meeting the requirements of 10 CFR 50.67 "Accident Source Term". These AST accident evaluations were accepted by the USNRC. All of the non-LOCA AST analyses take no credit for operation of the Standby Gas Treatment System, secondary containment isolation, or control room air intake or recirculation filtration for the full duration of the accident event. The information provided in subsequent sections is from baseline analyses performed in support of initial cycle operation. Analyses of limiting transients for reload cycles are summarized in Appendix 15D, Reload Analysis. Analyses supporting Single Loop Operation (SLO) are contained in Appendix 15B. Analyses supporting both Maximum Extended Operating Domain (MEOD) and Feedwater Heater Out-of-Service (FWHOS) are detailed in Appendix 15C. Extended Power Uprate (EPU) is addressed in Appendix 15E. The MEOD and FWHOS analyses are applicable only when two recirculation loops are in operation. The EPU conditions of Appendix 15E were utilized in the AST analyses with 1.02 times the 3473 MWt EPU rated thermal power per Regulatory Guide 1.49. The requirements of the CPS Technical Specifications for the safety and relief modes of the Safety/Relief Valves (SRVs) are based solely on the minimum number of SRVs required to function in order to satisfy the ASME Boiler & Pressure Vessel Code. However, an analysis has been performed (Reference 5) permitting up to 2 SRVs to be out-of-service (OOS) during continuous operation. In addition to vessel overpressure protection performance, this analysis addresses abnormal operational occurrences, emergency core cooling system (ECCS)/loss-of-coolant-accident (LOCA) performance, and anticipated transient without scram (ATWS) performance. These safety evaluations are combined in Reference 5 with the evaluations required to justify relaxation of the SRV safety-mode setpoint tolerance +/-3%. These evaluations provide the basis for the plant remaining in an analyzed condition as long as 14 of the 16 SRVs (including the Technical Specification-required low-low set function and the ADS function) are operable and safety-mode opening setpoints are within the revised tolerance band of the corresponding nominal trip setpoints. Operation with extended power uprate in the MEOD region and concurrent with a FWHOS are included in these evaluations.

CPS/USAR CHAPTER 15 15.0-2 REV. 12, JANUARY 2007 15.0.1 Analytical Objective The spectrum of postulated initiating events is divided into categories based upon the type of disturbance and the expected frequency of the initiating occurrence; the limiting events in each combination of category and frequen cy are quantitatively analyzed. The plant safety analysis evaluates the ability of the plant to operate within regulatory guidelines, without undue risk to the public health and safety. 15.0.2 Analytical Categories Transient and accident events contained in this report are discussed in individual categories as required by Reference 2. The results of the events are summarized in Table 15.0-1 for events

in the main text of Chapter 15. Appendix 15B, Recirculation System Single-Loop Operation, and Appendix 15C, Maximum Extended Operating Domain and Feedwater Heater Out-of-Service Analysis, provide summary tables on the results of the subject analyses. Appendix 15E, Extended Power Uprate, updates the safety analyses to reflect the uprate in licensed plant power level to its current licensed power of 3473 MWt. Appendix 15D, Reload Analysis presents the results for the events analyzed for each reload. Each event evaluated is assigned to one of the following applicable categories: (1) Decrease in Core Coolant Temperature: Reactor vessel water (moderator) temperature reduction results in an increase in core reactivity. This could lead to fuel cladding

damage. (2) Increase in Reactor Pressure: Nuclear system pressure increases threaten to rupture the reactor coolant pressure boundary (RCPB). Increasing pressure also collapses the voids in the core-moderator thereby increasing core reactivity and power level which threaten fuel cladding due to overheating. (3) Decrease in Reactor Core Coolant Flow Rate: A reduction in the core coolant flow rate threatens to overheat the cladding as the coolant becomes unable to adequately remove the heat generated by the fuel. (4) Reactivity and Power Distribution Anomalies: Transient events included in this category are those which cause rapid increases in power which are due to increased core flow disturbance events. Increased core flow reduces the void content of the moderator increasing core reactivity and power level. (5) Increase in Reactor Coolant Inventory: Increasing coolant inventory could result in excessive moisture carryover to the main turbine, feedwater turbines, etc. (6) Decrease in Reactor Coolant Inventory: Reductions in coolant inventory could threaten the fuel as the coolant becomes less able to remove the heat generated in the core. (7) Radioactive Release from a Subsystem or Component: Loss of integrity of a radioactive containment component is postulated. (8) Anticipated Transients Without Scram: In order to determine the capability of plant design to accommodate an extremely low pr obability event, a multi-system maloperation situation is postulated.

CPS/USAR CHAPTER 15 15.0-3 REV. 12, JANUARY 2007 15.0.3 Event Evaluation 15.0.3.1 Identification of Causes and Frequency Classification Situations and causes which lead to the initiating event analyzed are described within the categories designated above. The frequency of occurrence of each event is summarized based upon currently available operating plant history for the transient event. Events for which inconclusive data exists are discussed separately within each event section. Each initiating event within the major groups is assigned to one of the following frequency groups. (1) Incidents of moderate frequency - these are incidents that may occur during a calendar year to once per 20 years for a particular plant. This event is referred to as an "anticipated (expected) operational transient." (2) Infrequent incidents - these are incidents that may occur during the life of the particular plant (spanning once in 20 years to once in 100 years). This event is referred to as an "abnormal (unexpected) operational transient." (3) Limiting faults - these are incidents that are not expected to occur but are postulated because their consequences may result in the release of significant amounts of radioactive material. This event is referred to as a "design basis (postulated) accident." (4) Normal operation - operations of high frequency are not discussed here but are examined along with (1), (2), and (3) in the nuclear systems operational analyses in Appendix A to Chapter 15. 15.0.3.1.1 Unacceptable Results for Incidents of Moderate Frequency (Anticipated (Expected) Operational Transients)

The following are considered to be unacceptable safety results for incidents of moderate frequency (anticipated operational transients): (1) A release of radioactive material to the environs that exceeds the limits of 10 CFR 20. (2) Reactor operation induced fuel cladding failure.

(3) Nuclear system stresses in excess of that allowed for the transient classification by applicable industry codes. (4) Containment stresses in excess of that allowed for the transient classification by applicable industry codes. 15.0.3.1.2 Unacceptable Results for Infrequent Incidents (Abnormal (Unexpected)

Operational Transients)

The following are considered to be unacceptable safety results for infrequent incidents (abnormal operational transients):

CPS/USAR CHAPTER 15 15.0-4 REV. 12, JANUARY 2007 (1) Release of radioactivity which results in dose consequences that exceed a small fraction of 10 CFR 100. (2) Fuel damage that would preclude resumption of normal operation after a normal restart. (3) Generation of a condition that results in consequential loss of function of the reactor coolant system. (4) Generation of a condition that results in a consequential loss of function of a necessary containment barrier. 15.0.3.1.3 Unacceptable Results for Limiting Faults (Design Basis (Postulated) Accidents)

The following are considered to be unacceptable safety results for limiting faults (design basis accidents): (1) Radioactive material release which results in dose consequences that exceed the guideline values of 10 CFR 100, or, for the design basis accidents of LOCA, CRDA, MSLB outside containment, and FHA, exceed the limits provided in 10 CFR 50.67. (2) Failure of fuel cladding which would cause changes in core geometry such that core cooling would be inhibited. (3) Nuclear system stresses in excess of those allowed for the accident classification by applicable industry codes. (4) Containment stresses in excess of those allowed for the accident classification by applicable industry codes when containment is required. (5) Radiation exposure to plant operations personnel in the main control room in excess of 5 Rem whole body, 30 Rem inhalation, and 30 Rem skin, or, for the design basis accidents of LOCA, CRDA, MSLB outside containment, and FHA, 5 Rem Total Effective Dose Equivalent (TEDE). 15.0.3.2 Sequence of Events and Systems Operations Each transient or accident is discussed and evaluated in terms of: (1) A step-by-step sequence of events from initiation to final stabilized condition. (2) The extent to which normally operating plant instrumentation and controls are assumed to function. (3) The extent to which plant and reactor protection systems are required to function. (4) The credit taken for the functioning of normally operating plant systems.

(5) The operation of engineered safety systems that is required. (6) The effect of a single failure or an operator error on the event.

CPS/USAR CHAPTER 15 15.0-5 REV. 12, JANUARY 2007 15.0.3.2.1 Single Failures or Operator Errors 15.0.3.2.1.1 General This paragraph discusses a very important concept pertaining to the application of single failures and operator errors analyses of the postulated events. Single active component failure (SACF) criteria have been required and successfully applied on past NRC approved docket applications to design basis accident categories only. Reference 2 infers that a "single failures and operator errors" requirement should be applied to transient events (both high, moderate, and low probability occurrences) as well as accident (very low probability) situations. Transient evaluations have been judged against a criteria of one single equipment failure "or" one single operator error as the initiating event with no additional single failure assumptions to the protective sequences although a great majority of these protective sequences utilized safety systems which can accommodate SACF aspects. Even under these postulated events, the plant damage allowances or limits were very much the same as those for normal operation. Reference 2 suggests that the transient and accident scenarios should now include "and" (multi-failure) event sequences. The format request follows: For initiating occurrence 1) an equipment failure or an operator error, and For single equipment failure or operator error analysis 2) another equipment failure or failures and/or another operator error or errors. This certainly is considered a new requirement and the impact will need to be completely evaluated. While this is under consideration CPS has evaluated and presented the transients and accidents in this chapter in the above new requirement manner. Event categorization relative to transient and accident analysis is discussed here. If the evaluation is done per the new multi-failure methods, the event frequency categories should be modified. The original categorization of events was based on frequency of the initiating event alone and thus the allowance or limit was accordingly established based on that high frequency level. With the introduction of additional assumptions and conditions (initial event and SCF and/or SOE), the total event would now fall into a lower frequency probability category. Thus, less restrictive limits or allowances should be applied in the analysis of transients and accidents.

This certainly needs to be considered and evaluated. CPS has evaluated and presented the transients and accidents in this chapter by the more restrictive old allowances and limits of the event categorization presently in effect. Most events postulated for consideration are already the results of single equipment failures or single operator errors that have been postulated during any normal or planned mode of plant operations. The types of operational single failures and operator errors considered as initiating events and subsequent protective sequence challenges are identified in the following

paragraphs:

CPS/USAR CHAPTER 15 15.0-6 REV. 12, JANUARY 2007 15.0.3.2.1.2 Initiating Event Analysis (1) The undesired opening or closing of any single valve (a check valv e is not assumed to close against normal flow) or (2) the undesired starting or stopping of any single component or (3) the malfunction or maloperation of any single control device or (4) any single electrical component failure or (5) any single operator error. Operator error is defined as an active deviation from written operating procedures or nuclear plant standard operating practices. A single operator error is the set of actions that is a direct consequence of a single erroneous decision. The set of actions is limited as follows: (1) Those actions that could be performed by one person. (2) Those actions that would have constituted a correct procedure had the initial decision been correct. (3) Those actions that are subsequent to the initial operator error and have an effect on the designed operation of the plant, but are not necessarily directly related to the

operator error. Examples of single operator errors are as follows: (1) An increase in power above the established flow control power limits by control rod withdrawal in the specified sequences. (2) The selection and complete withdrawal of a single control rod out of sequence.

(3) An incorrect calibration of an average power range monitor.

(4) Manual isolation of the main steam lines as a result of operator misinterpretation of an alarm or indication. 15.0.3.2.1.3 Single Active Component Failure or Single Operator Failure Analysis (1) The undesired action or maloperation of a single active component or (2) Any single operator error where operator errors are defined as in Section 15.0.3.2.1.2.

CPS/USAR CHAPTER 15 15.0-7 REV. 12, JANUARY 2007 15.0.3.3 Core and System Performance 15.0.3.3.1 Introduction Subsection 4.4, "Thermal and Hydraulic Design," describes the various fuel failure mechanisms. Avoidance of unacceptable results 1 and 2 (subsection S.2.1.1 of Ref. 6) for incidents of moderate frequency is verified statistically with consideration given to data, calculation, manufacturing, and operating uncertainties. An acceptable criterion was determined to be that 99.9% of the fuel rods in the core would not be expected to experience boiling transition (see Reference 3). This criterion is met by demonstrating that incidents of moderate frequency do not result in a minimum critical power ratio (MCPR) less than the MCPR safety limit of 1.06 for the initial core and the MCPR safety limit as defined in the CPS Technical Specifications for subsequent reload cores. The reactor steady-state CPR operating limit is derived by determining the decrease in MCPR for the most limiting event. All other events result in smaller MCPR decreases and are not reviewed in depth in this chapter. The MCPR during significant abnormal events is calculated using a transient core heat transfer analysis

computer program. The computer program is based on a multinode, single channel thermal-hydraulic model which requires simultaneous solution of the partial differential equations for the conservation of mass, energy, and momentum in the bundle, and which accounts for axial variation in power generation. The primary inputs to the model include a physical description of the bundle, and channel inlet flow and enthalpy, pressure and power generation as functions of time. A detailed description of the analytical model may be found in Appendix C of Reference 3, Reference 1, and Reference 4. The initial condition assumed for all full power transient MCPR calculations is that the bundle is operating at or above the MCPR operating limit for the initial and subsequent reload cores. Maintaining MCPR greater than the MCPR safety limit is a sufficient, but not necessary, condition to assure that no fuel damage occurs. This is discussed in Subsection 4.4, "Thermal and Hydraulic Design." For situations in which fuel damage is sustained, the extent of damage is determined by correlating fuel energy content, cladding temperature, fuel rod internal pressure, and cladding mechanical characteristics. These correlations are substantiated by fuel rod failure tests and are discussed in Subsection 4.4, "Thermal and Hydraulic Design," and Subsection 6.3, "Emergency Core Cooling System." 15.0.3.3.2 Input Parameters and Initial Conditions for Analyzed Events In general the events analyzed within this section have values for input parameters and initial conditions corresponding to the end of equilibrium cycle (EOEC) and as specified in Table 15.0-2.

Analyses which assume data inputs different from these values are designated accordingly in the appropriate event discussion. 15.0.3.3.3 Initial Power/Flow Operating Constraints 15.0.3.3.3.1 Normal Operation The analyses basis for most of the initial transient safety analyses is the thermal power (104.2% of rated thermal power) at rated core flow (100%) corresponding to 105% Nuclear Boiler Rated steam flow. This operating point is the apex of a bounded operating power/flow map which, in response to any classified abnormal operational transients, will yield the minimum pressure and thermal margins of any operating point within the bounded map. Referring to Figure 15.0.1, the apex of the bounded CPS/USAR CHAPTER 15 15.0-8 REV. 12, JANUARY 2007 power/flow map is point A, the upper bound is the design flow control line (104.2% rod line A-D), the lower bound is the zero power line H-J, the right bound is the rated core flow line A-H, and the left bound is the natural circulation line D-J. The power/flow map, A-D-J-H-A, represents the acceptable operational constraints for abnormal operational transient evaluations. Any other constraint which may truncate the bounded power/flow map must be observed, such as the recirculation valve and pump cavitation regions, the licensed power limit and other restrictions based on pressure and thermal margin criteria. For instance, if the licensed power is 100% nuclear boiler rated (NBR), the power/flow map is truncated by the line B-C and reactor operation must be confined within the boundary B-C-D-J-L-K-B. If the maximum operating power level has to be limited, such as point F, to satisfy pressure margin criteria, the upper constraint on power flow is correspondingly reduced to the rod line, such as line F-G, which intersects the power/flow coordinate of the new operating basis. In this case, the operating bounds would be F-G-J-L-K-F. Operation would not be allowed at any point along line F- M, removed from point F, at the derated power but at reduced flow. If, however, operating limitations are imposed by GETAB derived from transient data with an operating basis at point A, the power/flow boundary for 100% NBR licensed power would be B-C-D-J-L-K-B. This power/flow boundary would be truncated by the MCPR operating limit for which there is no direct correlation to a line on the power/flow map. Operation is allowed within the defined power/flow boundary and within the constraints imposed by GETAB. If operation is restricted to point F by the MCPR operating limit, operation at point M would be allowed provided the MCPR limit is not violated. Consequently, the upper operating power/flow limit of a reactor is predicated on the operating basis of the analysis and the corresponding constant rod pattern line. This boundary may be truncated by the licensed power and the GETAB operating limit. Certain localized events are evaluated at other than the above mentioned conditions. These conditions are discussed pertinent to the appropriate event. Reactor Operation up to the APRM rod block line, which is above the power levels corresponding to the design flow control line except at low drive flows, is assumed for ECCS analysis. 15.0.3.3.3.2 Extended Operation In addition to the transient and accident analyses based on the operating constraints described in 15.0.3.3.3.1 above, the Maximum Extended Operating Domain (MEOD) and extended power uprate analyses and evaluations have been performed to justify safe plant operation under certain specified conditions. A discussion of MEOD and the supporting analyses are found in Appendix 15C and for

extended power uprate in Appendix 15E. 15.0.3.3.4 Results The results of analytical evaluations are provided for each event. In addition critical parameters are shown in Table 15.0-1. From the data in Table 15.0-1 and the other similar tables an evaluation of the limiting event for that particular category and parameter can be made. Similar Tables are provided for recirculation system single loop operation, MEOD/feedwater heater out of service, and extended power uprate in Appendices 15B, 15C, and 15E respectively. Appendix 15D provides a summary table for all the reanalyzed reload events. In Table 15.0-1A a summary of applicable accidents is provided.

CPS/USAR CHAPTER 15 15.0-9 REV. 12, JANUARY 2007 The Chapter 15 events have been analyzed assuming all safety/relief valves are functioning. If one safety/relief valve is out of service, there will be no effect on the value of the minimum critical power ratio (MCPR) since the MCPR for each event occurs prior to the opening of any safety/relief valves. Therefore, it is acceptable for one safety/relief valve to be out of service for an extended period of time without any impact in plant thermal margins. An out of service valve could increase the peak pressures calculated for some Chapter 15 events. However, the pressure increase would be very small (<10 psi) and the nuclear system stress levels would remain below that allowed by applicable industry codes. For a generic evaluation of two safety/relief valves out-of-service, see Reference 5. 15.0.3.4 Barrier Performance The significant areas of interest for internal pressure damage are the high pressure portions of the reactor coolant pressure boundary (the reactor vessel and the high pressure pipelines attached to

the reactor vessel). The overpressure below which no damage can occur is defined as the pressure increase over design pressure allowed by the applicable ASME Boiler and Pressure Vessel Code for the reactor vessel and the high pressure nuclear system piping.

Because this ASME Code permits pressure transients up to 10% over design pressure the design pressure portion of the reactor coolant pressure boundary meets the design requirement if peak nuclear system pressure remains below 1375 psig (110% x 1250 psig). Comparing the events considered in this chapter with those used in the mechanical design of equipment reveals that either the accidents are the same or that the accident in this section results in less severe stresses than those assumed for mechanical design. The Low-Low Set (LLS) Relief Function armed upon relief actuation of any S/R valve will cause a greater magnitude blowdown (in the relief mode) for certain specified S/R valves and a subsequent cycling of a single low set valve. The effect of the LLS design on reactor coolant pressure is demonstrated (Chapter 5) as the bounding case for all other pressurization events and, therefore, is not simulated in the analysis presented in this chapter. 15.0.3.5 Radiological Consequences In this chapter, the consequences of radioactivity release during the three types of events: a) incidents of moderate frequency (anticipated operational transients), b) infrequent incidents (abnormal operational transients), and c) limiting faults (design basis accidents) are considered. For all events whose consequences are limiting and a detailed quantitative evaluation is presented. For non-limiting events a qualitative evaluation is presented or results are referenced from a more limiting or enveloping case or event. For limiting faults (design basis accidents) other than those analized using Alternative Source Terms, two quantitative analyses are considered: (1) The first is based on conservative assumptions considered to be acceptable to the NRC for the purposes of worst case bounding the event and determining the adequacy of the plant design to meet 10 CFR Part 100 guidelines. This analysis is referred to as the "design basis analysis".

CPS/USAR CHAPTER 15 15.0-10 REV. 12, JANUARY 2007 (2) The second is based on realistic assumptions considered to reflect expected radiological consequences. This analysis is referred to as the "realistic analysis". For design basis accidents analyzed using Alternative Source Terms, the conservative assumptions of Regulatory Guide 1.183 are considered to be acceptable to the NRC for the purposes of the worst case bounding the event and determining the adequacy of the plant design to meet 10 CFR 50.67 and are utilized as the new design basis analysis for these accidents. All results are shown to be within NRC guidelines. 15.0.4 Nuclear Safety Operational Analysis (NSOA) Relationship Appendix A attached to Chapter 15 is a comprehensive, total plant, system-level, qualitative FMEA, relative to all the Chapter 15 events considered (on a pre-AST basis), the protective sequences utilized to accommodate the events and their effects, and the systems involved in the protective actions. Interdependency of analysis and cross-referral of protective actions is an integral part of this chapter and the appendix. Contained in Appendix 15A are summary tables which classify events by frequency only (i.e., not just within a given category such as Decrease in Core Coolant Temperature).

15.0.5 References

1. Letter, Frank Akstulewicz (NRC) to Glen A. Watford (GE), "Acceptance for Referencing of Licensing Topical Reports NEDC-32601P, Methodology and Uncertainties for Safety Limit MCPR Evaluations; NEDC-32694P, Power Distribution Uncertainties for Safety Limit MCPR Evaluation; and Amendment 25 to NEDE-24011-P-A on Cycle Specific Safety Limit MCPR," (TAC Nos. M97490, M99069 and M97491), March 11, 1999. 2. United States Nuclear Regulatory Commission Regulatory Guide 1.70 Revision 3, November 1978, "Standard Format and Content of Safety Analysis Reports for Nuclear Power Plants, Light Water Reactor Edition." 3. "General Electric BWR Thermal Analysis Basis (GETAB): Data, Correlation, and Design Application," November 1973 (NEDO-10959 and NEDE-10958). 4. Odar, F, "Safety Evaluation for General Electric Topical Report: Qualification of the One-Dimensional Core Transient Model for Boiling Water Reactors," NEDO-24154, NEDE-24154 P, Volumes 1, 2, and 3, 1980. 5. "SRV Safety Setpoint Tolerance and Out-of-Service Analysis for Clinton Power Station," General Electric Company Report NEDC-32202P, August 1993. 6. "General Electric Standard Application for Reactor Fuel", NEDE-24011-P-A & supplements, latest approved revision.

CPS/USAR CHAPTER 15 15.0-11 REV. 11, JANUARY 2005 A. Regulatory Guide 1.49 General Compliance or Alternate Approach Assessment: For commitment, revision number, and scope, see Section 1.8. Regulatory Guide 1.49 requires that the proposed licensed power level be restricted to a reactor core power level of 3800 megawatts thermal or less, and that analyses and evaluations in support of the application should be made at 1.02 times the proposed licensed

power level. The rated thermal power for Clinton Power Station (CPS) is 3473 thermal megawatts. The rated thermal power for the initial transient safety analysis is 2894 MWt. The basis for most of the initial transient safety analyses is the thermal power at rated core flow (100%) corresponding to 105% rated steam flow. This equates to a 104.2% power level of 3015 thermal megawatts. This operating point is the apex of a bounded operating power/flow map which yielded the minimum pressure and thermal margins of any operating point within the bounded map. However, with extended power uprate in the MEOD power/flow domain extended these limits and therefore the analyse s perfomed for CPS after implementation of both EPU and MEOD utilize a different set of initial conditions (i.e., 100% rated thermal power and 107% rate of flow). In addition, some of the transient and accident analyses were performed at initial conditions other than 105% rated steam flow or MEOD and EPU conditions, however, all analyses were performed at conditions which were appropriate for

that analysis and which yielded the most severe results. These analyses have therefore been performed in compliance with the requirements of Regulatory Guide 1.49.

CPS/USAR CHAPTER 15 15.0-12 REV. 11, JANUARY 2005 Table 15.0-1

SUMMARY

OF EVENT RESULTS Duration of Blowdown Paragraph I.D. Figure I.D. Description Maximum NeutronFlux (%NBR) Maximum Dome Pressure(psig) Maximum(2)Core VesselPressure (psig) Maximum Steam Line Pressure (psig) Maximum Core Average Surface HeatFlux (% of Initial) CPR(4) FrequencyCategory*

No. of ValvesFirst Blowdown Duration of Blowdown(sec.) 15.1 DECREASE IN CORE COOLANT TEMPERATURE 15.1.1 15.1.1-2 Loss of Feedwater Heater, Manual FlowControl 122 1059 1071 1047 114 0.12(5)(6) a 0 0 15.1.2 15.1.2-1 Feedwater Control Failure, Maximum Demand 121 1176 1205 1171 107 0.11(5)(6) a 12 3 15.1.3 15.1.3-1 Pressure Regulator Failure Open, 130%Flow 104 1136 1141 1134 100 ** a 9 5 15.2 INCREASE IN REACTOR PRESSURE(1) 15.2.1 15.2.1-1 Pressure Regulator Downscale Failure 168

[160.8] 1185 [1186] 1193 [1219] 1180 [1182] 104 [102.69] 0.08(6)[0.09] b [a] 16 [16] 6 [7]

15.2.2 15.2.2-1 Generator Load Rejection, Bypass-On 131

[189.3] 1156 [1191] 1164 [1219] 1151 [1185] 100 [102.64] ** [0.08] a [a] 16 [16] 5 [6]

15.2.2 15.2.2-2 Generator Load Rejection, Bypass-Off 225

[237.7] 1196 [1204] 1226 [1232] 1190 [1198] 104 [104.88] 0.08(5)(6)[0.11] b [a] 16 [16] 7 [7]

15.2.3 15.2.3-1 Turbine Trip, Bypass-On 113

[164.1] 1155 [1189] 1162 [1217] 1150 [1184] 100 [100.92] ** [0.07] a [a] 16 [16] 4 [6]

15.2.3 15.2.3-2 Turbine Trip, Bypass-Off 190

[216.0] 1194 [1203] 1202 [1231] 1189 [1198] 101 [103.22] 0.05 [0.09] b [a] 6 [16] 6 [7]

CPS/USAR TABLE 15.0-1 (CONTINUED)

SUMMARY

OF EVENT RESULTS CHAPTER 15 15.0-13 REV. 11, JANUARY 2005 Duration of Blowdown Paragraph I.D. Figure I.D. Description Maximum NeutronFlux (%NBR) Maximum Dome Pressure(psig) Maximum(2)Vessel Pressure (psig) Maximum Steam Line Pressure (psig) Maximum Core Average Surface HeatFlux (% of Initial) CPR(4) FrequencyCategory*

No. of ValvesFirst Blowdown Duration of Blowdown(sec.) 15.2.4 15.2.4-1 Main Steam Line Isolation, Position Scram 104 [105.15] 1172 [1178] 1180 [1207] 1170 [1174] 100 [100.10] ** [<0.12] a [a] 16 [16] 5 [5]

15.2.5 15.2.5-1 Loss of Condenser Vacuum at 2 inches per sec 112 [168.7] 1153 [1190] 1160 [1217] 1150 [1184] 100 [100.90] ** [<0.12] a [a] 16 [16] 4 [6]

15.2.6 15.2.6-1 Loss of Auxiliary Power Transformer 104 [104.2] 1152 [1171] 1156 [1186] 1052 [1170] 100 [100.05] ** [<0.12] a [a] 0 [16] 0 [5]

15.2.6 15.2.6-2 Loss of All Grid Connections 106

[121.08 1157 [1187] 1164 [1211] 1152 [1182] 100 [100.03] ** [<0.12] a [a] 16 [16] 5 [8]

15.2.7 15.2.7-1 Loss of All Feedwater Flow (7) 104 [104.2] 1045 [1046] 1056 [1085] 1034 [1035] 100 [100.06] ** [<0.12] a [a] 0 [0] 0 [0]

15.3 DECREASE IN REACTOR COOLANT SYSTEM FLOWRATE 15.3.1 15.3.1-1 Trip of One Recirculation Pump Motor 104 1046 1056 1035 100 ** a 0 0 15.3.1 15.3.1-2 Trip of Both Recirculation Pump Motors 104 1138 1142 1136 100 ** a 9 5 15.3.2 15.3.2-1 Fast Closure of One Main Recirc Valve - 60%/sec 104 1048 1056 1037 100 ** a 0 0 15.3.3 15.3.3-1 Seizure of One Recirculation Pump 104 1139 1143 1137 100 ** c 9 4 CPS/USAR TABLE 15.0-1 (CONTINUED)

SUMMARY

OF EVENT RESULTS CHAPTER 15 15.0-14 REV. 11, JANUARY 2005 Duration of Blowdown Paragraph I.D. Figure I.D. Description Maximum NeutronFlux (%NBR) Maximum Dome Pressure(psig) Maximum(2)Core VesselPressure (psig) Maximum Steam Line Pressure(psig) Maximum Core Average Surface HeatFlux (% of Initial) CPR(4) FrequencyCategory*

No. of ValvesFirst Blowdown Duration of Blowdown(sec.) 15.4 REACTIVITY AND POWER DISTRIBUTION ANOMALIES 15.4.4 15.4.4-1 Startup of Idle Recirculation Loop 112 991 994 986 150 *** a 0 0 15.4.5 15.4.5-1 Fast Opening of One Main Recirc Valve - 30%/sec 309 976 979 972 139 *** a 0 0 15.5 INCREASE IN REACTOR COOLANT INVENTORY 15.5.1 15.5.1-1 Inadvertent HPCS Pump Start 104 1045 1056 1034 100 ** a 0 0 Notes

• a = incidents of moderate freq; b = infrequent incidents; c = limiting faults ** no significant change in CPR *** not start from full power (1) Numbers in [ ] are values from River Bend FSAR Amendment 7 using results from the ODYN Code. These values are conservatively applicable to CPS. (Refer to Section 15.2 for discussion.) (2) River Bend values [ ] and ODYN values are for Maximum Vessel Pressure (3) Not used (4) Option A CPR adjustment factor is included as specified in the NRC staff safety evaluation for the General Electric Topical Report, "Qualification of the One-Dimensional Core Transient Model for BWR," NEDO-24154 and NEDE-24154p, if applicable. (5) This transient was performed as part of the loss of feedwater heating, maximum extended operating domain and/or single loop operation analyses. For the initial conditions, required operating states and results of these analyses refer to Appendices 15B and 15C. (6) This transient is reperformed as part of the current cycle reload analysis. Appendix 15D contains the results of this reanalysis. These results s upersede previous transient analyses as documented in Chapter 15 and Appendices 15B and 15C when performed at the same power, flow, feedwater temperature and cycle exposure conditions. (7) This transient was reanalyzed for Power Uprate. See Appendix 15E for information on the analysis at uprated conditions.

CPS/USAR CHAPTER 15 15.0-15 REV. 12, JANUARY 2007 TABLE 15.0-1-a

SUMMARY

OF ACCIDENTS Paragraph I.D. Title 15.3.3 Seizure of One Recirculation Pump 15.3.4 Recirculation Pump Shaft Break 15.4.9 Rod Drop Accident 15.6.2 Instrument Line Break

15.6.4 Steam System Pipe Break Outside Containment 15.6.5 LOCA Within RCPB

15.6.6 Feedwater Line Break 15.7.1.1 Main Condenser Gas Treatment System Failure

15.7.3 Liquid Radwaste Tank Failure 15.7.4 Fuel Handling Accident 15.7.5 Cask Drop Accident

15.8 ATWS

CPS/USAR CHAPTER 15 15.0-16 REV. 11, JANUARY 2005 TABLE 15.0-2 INPUT PARAMETERS AND INITIAL CONDITIONS FOR TRANSIENTS (7) 1. Thermal Power Level, MWt Warranted Value 2894 Analysis Value 3015 (104.2% of rated thermal power/105% of rated steam flow)

2. Steam Flow, lbs per hr Warranted Values 12.453x10 6 Analysis Value 13.076x10 6 3. Core Flow, lbs per hr 84.5x10 6 4. Feedwater Flow Rate, lb per sec Warranted Value 3458 Analysis Value 3631 5. Feedwater Temperature, °F 425 6. Vessel Dome Pressure, psig 1045

7. Vessel Core Pressure, psig 1056

8. Turbine Bypass Capacity, % NBR 35 9. Core Coolant Inlet Enthalpy, Btu per lb 529.9 10. Turbine Inlet Pressure, psig 960

11. Fuel Lattice 8X8R (1), P8X8R (2)

12. Core Average Gap Conductance, Btu/sec-ft 2-F 0.1667 (1), 0.189 (2)

13. Core Leakage Flow, % 11 (1), 12.7 (2) 14. Required MCPR Operating Limit First Core 1.18 Reload Core 1.19

15. MCPR Safety Limit for Incidents of Moderate Frequency First Core 1.06 Reload Core 1.07 16. Doppler Coefficient (-)¢/

°F Analysis Data .132 (1) (3) 17. Void Coefficient (-)¢/%Rated Voids Analysis Data for Power Increase Events 14.0 (1) (3) (6)

Analysis Data for Power Decrease Events 4.0 (1) (3) (6)

CPS/USAR CHAPTER 15 15.0-17 REV. 11, JANUARY 2005 TABLE 15.0-2 (Cont'd) 18. Core Average Rated Void Fraction, % 43.08 (1) (3)

19. Scram Reactivity, $K Analysis Data Figure 15.0-2 (1) (3) 20. Control Rod Drive Speed, Position versus time Figure 15.0-3

21. Jet Pump Ratio, M 2.4584

22. Safety/Relief Valve Capacity, % NBR @ 1210 psig 115.1 Manufacturer DIKKER Quantity Installed 16 23. Relief Function Delay, seconds 0.15

24. Relief Function Response Time Constant, seconds 0.1

25. Safety Function Delay, seconds 0.0

26. Safety Function Response Time Constant, seconds 0.2

27. Set Points for Safety/Relief Valves Safety Function, psig 1175,1195,1215 Relief Function, psig (1) (4) 1125,1135,1145,1155 Relief Function, psig (2) 1145,1155,1165,1175 28. Number of Valve Groupings Simulated Safety Function, No. 3 Relief Function, No. 4

29. High Flux Trip, % NBR Analysis set point (122 x 1.042) 127.2

30. High Pressure Scram Set Point, psig 1095 31. Vessel Level Trips, Feet Above Bottom of Separator Skirt Bottom Level 8 - (L8), feet 5.883 Level 4 - (L4), feet 4.033 (1), 3.87(2) Level 3 - (L3), feet 2.158 (1), 1.94(2) Level 2 - (L2), feet -1.217 (1), -2.86 (2)

32. APRM Thermal Trip, % NBR Analysis Set Point (114x1.042) 118.8 CPS/USAR CHAPTER 15 15.0-18 REV. 11, JANUARY 2005 TABLE 15.0-2 (Cont'd) 33. Recirculation Pump Trip Delay, Seconds 0.14

34. Recirculation Pump Trip Inertia Time Constant for Analysis, seconds 5.0(MAX) 3.0(MIN)

(5) 35. Total Steamline Volume, ft 3275 36. High Pressure Recirculation Pump Trip Setpoint, psig 1135 Delay Time, seconds 0.3 ___________________________________ 1. Used only for REDY. 2. Used only for ODYN. 3. For transients simulated on the ODYN computer model, this impact is calculated by ODYN for end-of-equilibrium cycle (EOEC) nuclear characteristics. 4. Increased by 20 psi with estimated impact on peak pressure of less than 10 psi and no impact on CPR values 5. The inertia time constant is defined by the expression:

To g n J 2 t o= , where t = inertia time constant (Sec).

J o = pump motor inertial (lb-ft

2) n = rated pump speed (rps) g = gravitational constant (ft/sec

2) T o = pump shaft torque (lb-ft) 6. Applicable only for events analyzed using model described in Appendix C of Reference 2 to Section 15.1 for transients simulated using ODYN Code, these values are calculated within the Code for the end-of-equilibrium fuel exposure. 7. These input parameters and initial conditions for transients apply to the analysis discussed in the main text of Chapter 15. The Chapter 15 appendices provide input parameters and initial conditions for their applicable analyses.

CPS/USAR CHAPTER 15 15.1-1 REV. 11, JANUARY 2005 15.1 DECREASE IN REACTOR COOLANT TEMPERATURE 15.1.1 Loss of Feedwater Heating The loss of feedwater heating transient was performed as part of the initial cycle analyses supporting CPS operation. Subsequent analyses were performed in various operating modes and/or with equipment out of service, results of which are presented in the following Chapter 15 appendix: - Appendix 15C: Maximum Extended Operating Domain and Feedwater Heater Out-of-Service Analysis Certain limiting safety analyses are reperformed each operating cycle to determine and/or verify safety margins. The methods, input conditions, and results for the current cycle for the loss of feedwater heating event are presented in Appendix 15D, Reload Analysis. 15.1.1.1 Identification of Causes and Frequency Classification 15.1.1.1.1 Identification of Causes A feedwater heater can be lost in at least two ways: (1) Steam extraction line to heater is closed, (2) Feedwater is bypassed around heater. The first case produces a gradual cooling of the feedwater. In the second case, the feedwater bypasses the heater and no heating of that feedwater occurs. In either case the reactor vessel receives cooler feedwater. The maximum number of feedwater heaters which can be tripped or bypassed by a single event represents the most severe transient for analysis considerations. This event has been conservatively estimated to incur a loss of up to 100

°F of the feedwater heating capability of the plant and causes an increase in core inlet subcooling. This increases core power due to the negative void reactivity coefficient. 15.1.1.1.2 Frequency Classification This event is analyzed under worst case conditions of a 100

°F loss and full power. The probability of this event is considered low enough to warrant it being categorized as an infrequent incident. However, because of the lack of a sufficient frequency data base, this transient disturbance is analyzed as an incident of moderate frequency. 15.1.1.2 Sequence of Events and Systems Operation 15.1.1.2.1 Sequence of Events Table 15.1.1-2 lists the sequence of events for this transient and its effect on various parameters is shown in Figure 15.1.1-2.

CPS/USAR CHAPTER 15 15.1-2 REV. 11, JANUARY 2005 15.1.1.2.1.1 Identification of Operator Actions An average power range monitor (APRM) neutron flux or thermal power alarm will alert the operator to insert control rods to get back down to the rated flow control line, or to reduce flow. The operator should determine from existing tables the maximum allowable T-G output with feedwater heaters out of service. When reactor scram occurs, the operator should monitor the reactor water level and pressure controls and the T-G auxiliaries during coastdown. 15.1.1.2.2 Systems Operation In establishing the expected sequence of events and simulating the plant performance, it was assumed that normal functioning occurred in the plant instrumentation and controls, plant protection and reactor protection systems. The thermal power monitor (TPM) is the primary protection system trip in mitigating the consequences of this event. Required operation of Engineered Safeguard Features (ESF) is not expected for either of these transients. 15.1.1.2.3 The Effect of Single Failures and Operator Errors These two events generally lead to an increase in reactor power level. The TPM mentioned in Subsection 15.1.1.2.2 is the mitigating system and is designed to be single failure proof. Therefore, single failures are not expected to result in a more severe event than analyzed. See Appendix 15A for a detailed discussion of this subject. In addition to single failures of mitigating systems, CPS License Condition 4 required that CPS evaluate the impact of non-safety control system failures on Chapter 15 analyses. The evaluation in Reference 2 determined that the only event for which non-safety control system failures were not bounded by existing Chapter 15 events was loss of feedwater heating combined with a turbine trip and failure of the turbine bypass system. Reference 3 documents the analysis for the original core load. The analysis determined that for up to 100 °F reduction in feedwater temperature combined with a turbine trip and bypass failure, no fuel cladding damage or fuel rod perforations are expected to occur and the peak vessel bottom pressure remains well below the ASME Level B Service limit. Consequently, the radiological consequences are limited to those that result from the activity released to the suppression pool through the SRV's. These radiological consequences are bounded by those presented in Section 15.2.4.5. Loss of feedwater heating combined with a turbine trip and failure of the turbine bypass system is not classified as an event of moderate frequency and is therefore not subject to the same acceptance criteria as the loss of feedwater heating or turbine trip with failure of the bypass alone. In addition, due to its frequency classification, this event is not reanalyzed for each core load. 15.1.1.3 Core and System Performance 15.1.1.3.1 Mathematical Model The predicted dynamic behavior has been determined using a computer simulated, analytical model of a generic direct-cycle BWR. This model is described in detail in Reference 1. This CPS/USAR CHAPTER 15 15.1-3 REV. 11, JANUARY 2005 computer model has been verified through extensive comparison of its predicted results with actual BWR test data. The nonlinear, computer-simulated, analytical model is designed to predict associated transient behavior of this reactor. Some of the significant features of the model are: (1) A point kinetic model is assumed with reactivity feedbacks from control rods (absorption), voids (moderation) and Doppler (capture) effects. (2) The fuel is represented by three four-node cylindrical elements, each enclosed in a cladding node. One of the cylindrical elements is used to represent core

average power and fuel temperature conditions, providing the source of Doppler feedback. The other two are used to represent "hot Spots" in the core, to simulate peak fuel center temperature and cladding temperature. (3) Four primary system pressure nodes are simulated. The nodes represent the core exit pressure, vessel dome pressure, steam line pressure (at a point representative of the safety/relief valve location) and turbine inlet pressure. (4) The active core void fraction is calculated from a relationship between core exit quality, inlet subcooling, and pressure. This relationship is generated from multinode core steady-state calculations. A second-order void dynamic model with the void boiling sweep time calculated as a function of core flow and void conditions is also utilized. (5) Principal controller functions such as feedwater flow, recirculation flow, reactor water level, pressure and load demand are represented together with their dominant nonlinear characteristics. (6) The ability to simulate necessary reactor protection system functions is provided. 15.1.1.3.2 Input Parameters and Initial Conditions These analyses have been performed, unless otherwise noted, with plant conditions tabulated in Table 15.0-2. The plant is assumed to be operating at 105% of NB rated steam flow and at thermally limited conditions. The same void reactivity coefficient conservatism used for pressurization transients is applied since a more negative value conservatively increases the severity of the power increase. The values for both the feedwater heater time constant and the feedwater time volume between the heaters and the spargers are adjusted to reduce the time delays since they are not critical to the calculation of this transient. The transient is simulated by programming a change in feedwater enthalpy corresponding to a 100

°F loss in feedwater heating. 15.1.1.3.3 Results No compensation is provided by core flow. A scram on high APRM thermal power may occur. Vessel steam flow increases and the initial system pressure increase is slightly larger. Peak heat flux is 114% of its initial value and peak fuel center temperature increases 442

°F. The CPS/USAR CHAPTER 15 15.1-4 REV. 11, JANUARY 2005 increased core inlet subcooling aids core thermal margins and minimum MCPR is 1.07. Therefore, the design basis is satisfied. The transient responses of the key plant variables for this mode of operation are shown in Figure 15.1.1-2. If the reactor scrams, water level drops to the low level trip point (L2). This initiates RPT as shown in Table 15.1.1-2. This transient is less severe from lower initial power levels for two main reasons: (1) lower initial power levels will have initial CPR values greater than the limiting initial CPR value assumed, and (2) the magnitude of the power rise decreases with lower initial power conditions.

Therefore, transients from lower power levels will be less severe. 15.1.1.3.4 Considerations of Uncertainties Important factors (such as reactivity coefficient, scram characteristics, magnitude of the feedwater temperature change) are assumed to be at the worst configuration so that any deviations seen in the actual plant operation reduce the severity of the event. 15.1.1.4 Barrier Performance As noted above and shown in Figure 15.1.1-2, the consequences of this event do not result in any temperature or pressure transient in excess of the criteria for which the fuel, pressure vessel or containment are designed; therefore, these barriers maintain their integrity and function as designed. 15.1.1.5 Radiological Consequences Since this event does not result in any additional fuel failures or any release of primary coolant to either the secondary containment or to the environment there are no radiological consequences associated with this event.

15.1.1.6 References

1. R.B. Linford," Analytical Methods of Plant Transient Evaluations for the General Electric Boiling Water Reactor," April 1973 (NEDO-10802). 15.1.2 Feedwater Controller Failure - Maximum Demand The feedwater controller failure - maximum demand transient was performed as part of the initial cycle analyses supporting CPS operation. Subsequent analyses were performed in various operating modes and/or with equipment out of service, results of which are presented in the following Chapter 15 appendices: - Appendix 15B: Recirculation Systems Single-Loop Operation

- Appendix 15C: Maximum Extended Operating Domain and Feedwater Heater Out-of-Service Analysis Certain limiting safety analyses are reperformed each operating cycle to determine and/or verify safety margins. The methods, input conditions, and results for the current cycle for the CPS/USAR CHAPTER 15 15.1-5 REV. 11, JANUARY 2005 feedwater controller failure (maximum demand) are presented in Appendix 15D, Reload Analysis. 15.1.2.1 Identification of Causes and Frequency Classification 15.1.2.1.1 Identification of Causes This event is postulated on the basis of a single failure of a control device, specifically one which can direct]y cause an increase in coolant inventory by increasing the feedwater flow. The most severe applicable event is a feedwater controller failure during maximum flow demand.

The feedwater controller is forced to its upper limit at the beginning of the event. 15.1.2.1.2 Frequency Classification This event is considered to be an incident of moderate frequency. 15.1.2.2 Sequence of Events and Systems Operation 15.1.2.2.1 Sequence of Events With excess feedwater flow the water level rises to the high-level reference point at which time the feedwater pumps and the main turbine are tripped and a scram is initiated. Table 15.1.2-1 lists the sequence of events for Figure 15.1.2-1. The figure shows the changes in important variables during this transient. 15.1.2.2.1.1 Identification of Operator Actions The operator should: (1) Observe that high feedwater pump trip has terminated the failure event.

(2) Switch the feedwater controller from auto to manual control in order to try to regain a correct output signal. (3) Identify causes of the failure and report all key plant parameters during the event. 15.1.2.2.2 Systems Operation In order to properly simulate the expected sequence of events, the analysis of this event assumes normal functioning of plant instrumentation and controls, plant protection and reactor

protection systems. Important system operational actions for this event are high level scram and tripping of the main turbine and feedwater pumps, recirculation pump trip (RPT), and low water level initiation of the Reactor Core Isolation Cooling System and the High Pressure Core Spray System to maintain long term water level control following tripping of feedwater pumps. 15.1.2.2.3 The Effect of Single Failures and Operator Errors In Table 15.1.2-1 the first sensed event to initiate corrective action to the transient is the vessel high water level (L8) scram. Scram trip signals from Level 8 are designed such that a single failure will neither initiate nor impede a reactor scram trip initiation. Therefore, single failures are not expected to result in a more severe event than analyzed. See Appendix 15A for a detailed discussion of this subject.

CPS/USAR CHAPTER 15 15.1-6 REV. 11, JANUARY 2005 15.1.2.3 Core and System Performance 15.1.2.3.1 Mathematical Model The predicted dynamic behavior has been determined using a computer simulated, analytical model of a generic direct-cycle BWR. This model is described in Reference 1 (Section 15.1.7). This computer model has been improved and verified through extensive comparison of its predicted results with actual BWR test data. The nonlinear computer simulated analytical model is designed to predict associated transient behavior of this reactor. Some of the significant features of the model are: a. An integrated one-dimensional core model is assumed which includes a detailed description of hydraulic feedback effects, axial power shape changes, and reactivity feedbacks. b. The fuel is represented by an average cylindrical fuel and cladding model for each axial location in the core. c. The steam lines are modeled by eight pressure nodes incorporating mass and momentum balances which will predict any wave phenomena present in the steam line during the pressurization transient. d. The core average axial water density and pressure distribution is calculated using a single channel to represent the heat active flow and a single channel to represent the bypass flow. A model, representing liquid and vapor mass and energy conservation and mixture momentum conservation, is issued to describe the thermal-hydraulic behavior. Change in the flow split between the bypass and active channel flow are accounted for during transient events. e. Principal controller functions such as feedwater flow, recirculation flow, reactor water level, pressure and load demand, are represented together with their dominant nonlinear characteristics. f. The ability to simulate necessary reactor protection system functions is provided. g. The control systems and reactor protection system models are, for the most part, identical to those employed in the point reactor model, which is described in detail in Reference 1 (Section 15.1.7) and used in analysis for other transients. 15.1.2.3.2 Input Parameters and Initial Conditions These analyses have been performed, unless otherwise noted, with the plant conditions tabulated in Table 15.0-2. End of equilibrium cycle (all rods out) scram characteristics are assumed. The safety/relief valve action is conservatively assumed to occur with higher than nominal set points. The transient is simulated by programming an upper limit failure in the feedwater system such that 144% NBR feedwater flow occurs at a system design pressure of 1065 psig. The feedwater temperature is assumed constant because of the large time constant in the feedwater heater (in minutes) and the long transport delay time before the cold feedwater reaches the vessel.

CPS/USAR CHAPTER 15 15.1-7 REV. 12, JANUARY 2007 15.1.2.3.3 Results The simulated feedwater controller transient is shown in Figure 15.1.2-1. The high water level turbine trip and feedwater pump trip are initiated at approximately 10.7 sec. Scram occurs simultaneously, and limits the neutron flux peak and fuel thermal transient so that no fuel damage occurs. MCPR remains above safety limit. The turbine bypass system and SRV open to limit peak pressure in the steam line near the safety/relief valves to 1171 psig and the pressure at the bottom of the vessel to about 1205 psig. The level will gradually drop to the Low Level reference point (Level 2), activating the

RCIC/HPCS systems for long term level control. 15.1.2.3.4 Consideration of Uncertainties All systems utilized for protection in this event were assumed to have the most conservative allowable response (e.g., relief set points, scram stroke time and reactivity characteristics).

Expected plant behavior is, therefore, expected to lead to a less severe transient. 15.1.2.4 Barrier Performance As noted above the consequences of this event do not result in any temperature or pressure transient in excess of the criteria for which the fuel, pressure vessel or containment are designed; therefore, these barriers maintain their integrity and function as designed. 15.1.2.5 Radiological Consequences While the consequences of this event do not result in any fuel failures; radioactivity is nevertheless discharged to the suppression pool as a result of SRV actuation. However, the mass input, and hence activity input, for this event is much less than those consequences identified in Section 15.2.4.5 for type 2 events. Therefore, the radiological exposures noted in Section 15.2.4.5 cover the consequences of this event. 15.1.3 Pressure Regulator Failure - Open 15.1.3.1 Identification of Causes and Frequency Classification 15.1.3.1.1 Identification of Causes The total steam flow rate to the main turbine resulting from a pressure regulator malfunction is limited by a maximum flow limiter imposed at the turbine controls. This limiter is set to limit maximum steam flow to approximately 115% NB rated. If either the controlling pressure regulator or the backup regulator fails to the open position, the turbine admission valves can be fully opened and the turbine bypass valves can be partially opened until the maximum steam flow is established.

CPS/USAR CHAPTER 15 15.1-8 REV. 11, JANUARY 2005 15.1.3.1.2 Frequency Classification This transient disturbance is categorized as an incident of moderate frequency.

15.1.3.2 Sequence of Events and Systems Operation 15.1.3.2.1 Sequence of Events Table 15.1.3-1 lists the sequence of events for Figure 15.1.3-1. 15.1.3.2.1.1 Identification of Operator Actions When regulator trouble is preceded by spurious or erratic behavior of the controlling device, it may be possible for the operator to transfer operation to the backup controller in time to prevent the full transient. If the reactor scrams as a result of the isolation caused by the low pressure at the turbine inlet (825 psig) in the run mode, the following is the sequence of operator actions expected during the course of the event. Once isolation occurs the pressure will increase to a point where the relief valves open. The operator should: (1) Monitor that all rods are in.

(2) Monitor reactor water level and pressure.

(3) Observe turbine coastdown and break vacuum before the loss of steam seals. Check turbine auxiliaries. (4) Observe that the reactor pressure relief valves open at their set point. (5) Observe that RCIC and HPCS start on low-water level.

(6) Secure both HPCS and RCIC when reactor pressure and level are under control and it has been verified that the initiation is not due to a LOCA. (7) Monitor reactor water level and continue cooldown per the normal procedure.

(8) Complete the scram report and initiate a maintenance survey of pressure regulator before reactor restart. 15.1.3.2.2 Systems Operation In order to properly simulate the expected sequence of events, the analysis of this event assumes normal functioning of plant instrumentation and controls, plant protection and reactor protection systems except as otherwise noted. Initiation of HPCS and RCIC system functions will occur when the vessel water level reaches the L2 set point. Normal startup and actuation can take up to 30 seconds before effects are realized. If these events occur, they will follow sometime after the primary concerns of fuel thermal margin and overpressure effects have occurred, and are expected to be less severe than those already experienced by the system.

CPS/USAR CHAPTER 15 15.1-9 REV. 11, JANUARY 2005 15.1.3.2.3 The Effect of Single Failures and Operator Errors This transient leads to a loss of pressure control such that the increased steam flow demand causes a depressurization. Instrumentation for pressure sensing of the turbine inlet pressure is designed to be single failure proof for initiation of MSIV closure. Reactor scram sensing, originating from limit switches on the main steam line isolation valves or from vessel water level L8, is designed to be single failure proof. It is therefore concluded that the basic phenomenon of pressure decay is adequately terminated. See Appendix 15A for a detailed discussion of this subject. 15.1.3.3 Core and System Performance 15.1.3.3.1 Mathematical Model The nonlinear dynamic model described briefly in Subsection 15.1.1.3.1 is used to simulate this event. 15.1.3.3.2 Input Parameters and Initial Conditions This transient is simulated by setting the controlling regulator output to a high value, which causes the turbine admission valves to open fully and the turbine bypass valves to open partially. Since the controlling and backup regulator outputs are gated by a high value gate, the effect of such a failure in the backup regulator would be exactly the same. A regulator failure with 130% steam flow was simulated as a worst case since 115% is the normal maximum flow limit. A 5-second isolation valve closure instead of a 3-second closure is assumed when the turbine pressure decreases below the turbine inlet low pressure set point for main steam line isolation initiation. This is within the specification limits of the valve and represents a conservative assumption. Reactor scram is initiated when the water level reaches (L8).

This analysis has been performed, unless otherwise noted, with the plant conditions listed in Table 15.0-2. 15.1.3.3.3 Results Figure 15.1.3-1 shows graphically how the high water level turbine trip and the isolation valve closure stops vessel depressurization and produces a normal shutdown of the isolated reactor. Depressurization results in formation of voids in the reactor coolant and causes a decrease in reactor power almost immediately. In this simulation the depressurization rate is large enough such that water level swells to the sensed level trip set point (L8), initiating reactor scram and main turbine and feedwater turbine trips. Position switches on the turbine stop valves initiate recirculation pump trip (RPT). After the turbine trip, the failed pressure regulator now signals the bypass to open to full bypass flow of 35% NB rated steam flow. After the pressurization resulting from the turbine stop valve closure, pressure again drops and continues to drop until turbine inlet pressure is below the low turbine pressure isolation set point when main steam line isolation terminates the depressurization. The turbine trip and isolation limit the duration and CPS/USAR CHAPTER 15 15.1-10 REV. 11, JANUARY 2005 severity of the depressurization so that no significant thermal stresses are imposed on the reactor coolant pressure boundary. No significant reductions in fuel thermal margins occur. 15.1.3.3.4 Considerations of Uncertainties If the maximum flow limiter were set higher or lower than normal, there would result a faster or slower loss in nuclear steam pressure. The rate of depressurization may be limited by the bypass capacity, but it is unlikely. For example, the turbine valves will open to the valves-wide-open state admitting slightly more than the rated steam flow and with the limiter in this analysis set to fail at 130% we would expect something less than 23% to be bypassed. This is therefore not a limiting factor on this plant. If the rate of depressurization does change it will be terminated by the low turbine inlet pressure trip set point. Depressurization rate has a proportional effect upon the voiding action in the core and the flashing in the vessel bulkwater regions. If the rate is low enough, the water level may not swell to the high water level trip set point and the isolation will occur earlier when pressure at the turbine decreases below 825 psig. The reactor will scram as a result of the main steam isolation valve closure. 15.1.3.4 Barrier Performance As noted above the consequences of this event do not result in any temperature or pressure transient in excess of the criteria for which the fuel, pressure or containment are designed; therefore, these barriers maintain their integrity and function as designed. 15.1.3.5 Radiological Consequences While the consequences of this event do not result in any fuel failures, radioactivity is nevertheless discharged to the suppression pool as a result of SRV actuation. However, the mass input, and hence activity input, for this event is much less than those consequences identified in Section 15.2.4.5 for Type 2 events. Therefore, the radiological exposures noted in Section 15.2.4.5 cover the consequences of this event. 15.1.4 Inadvertent Safety/Relief Valve Opening 15.1.4.1 Identification of Causes and Frequency Classification 15.1.4.1.1 Identification of Causes Cause of inadvertent opening is attributed to malfunction of the valve or an operator initiated opening. Opening and closing circuitry at the individual valve level (as opposed to groups of valves) is subject to a single failure. It is therefore simply postulated that a failure occurs and the event is analyzed accordingly. Detailed discussion of the valve design is provided in Chapter 5 of this FSAR. 15.1.4.1.2 Frequency Classification This transient disturbance is categorized as an infrequent incident but due to a lack of a comprehensive data basis, it is being analyzed as an incident of moderate frequency.

CPS/USAR CHAPTER 15 15.1-11 REV. 11, JANUARY 2005 15.1.4.2 Sequence of Events and Systems Operation 15.1.4.2.1 Sequence of Events Table 15.1.4-1 lists the sequence of events for this event.

15.1.4.2.1.1 Identification of Operator Actions The plant operator must reclose the valve as soon as possible and check that reactor and T-G output return to normal. If the valve cannot be closed, plant shutdown should be initiated. 15.1.4.2.2 Systems Operation This event assumes normal functioning of normal plant instrumentation and controls, specifically the operation of the pressure regulator and level control systems. 15.1.4.2.3 The Effect of Single Failures and Operator Errors Failure of additional components (e.g., pressure regulator, feedwater flow controller) is discussed elsewhere in Chapter 15. In addition a detailed discussion of such effects is given in

Appendix 15A. 15.1.4.3 Core and System Performance 15.1.4.3.1 Mathematical Model The reactor model briefly described in Subsection 15.1.1.3.1 was previously used to simulate this event in earlier FSARs. This model is discussed in detail in Reference 1 of Subsection 15.1.2. It was determined that this event is not limiting from a core performance standpoint. Therefore a qualitative presentation of results is described below. 15.1.4.3.2 Input Parameters and Initial Conditions It is assumed that the reactor is operating at an initial power level corresponding to 105

% of rated steamflow conditions when a safety

/relief valve is inadvertently opened. Manual recirculation flow control is assumed. 15.1.4.3.3 Qualitative Results The opening of a safety/relief valve allows steam to be discharged into the suppression pool. The sudden increase in the rate of steam flow leaving the reactor vessel causes a mild depressurization transient. The pressure regulator senses the nuclear system pressure decrease and within a few seconds closes the turbine control valve far enough to stabilize reactor vessel pressure at a slightly lower value and reactor power settles at nearly the initial power level. Thermal margins decrease only slightly through the transient, and no fuel damage results from the transient. MCPR is essentially unchanged and therefore the safety limit margin is unaffected.

CPS/USAR CHAPTER 15 15.1-12 REV. 11, JANUARY 2005 15.1.4.4 Barrier Performance As discussed above, the transient resulting from a stuck open relief valve is a mild depressurization which is within the range of normal load following and therefore has no significant effect on RCPB and containment design pressure limits. 15.1.4.5 Radiological Consequences While the consequence of this event does not result in fuel failure it does result in the discharge of normal coolant activity to the suppression pool via SRV operation. Since this activity is contained in the primary containment there will be no exposures to operating personnel. Since this event does not result in an uncontrolled release to the environment the plant operator can choose to leave the activity bottled up in the containment or discharge it to the environment under controlled release conditions. If purging of the containment is chosen the release will be in accordance with the release rates established in the technical specifications; therefore, this event, at the worst, would only result in a small increase in the yearly integrated exposure level. 15.1.5 Spectrum of Steam System Piping Failures Inside and Outside of Containment in a PWR This event is not applicable to BWR plants. 15.1.6 Inadvertent RHR Shutdown Cooling Operation 15.1.6.1 Identification of Causes and Frequency Classification 15.1.6.1.1 Identification of Causes At design power conditions no conceivable malfunction in the shutdown cooling system could cause temperature reduction. In startup or cooldown operation, if the reactor were critical or near critical, a very slow increase in reactor power could result. A shutdown cooling malfunction leading to a moderator temperature decrease could result from misoperation of the cooling water controls for the RHR heat exchangers. The resulting temperature decrease would cause a slow insertion of positive reactivity into the core. If the operator did not act to control the power level, a high neutron flux reactor scram would terminate the transient without violating fuel thermal limits and without any measurable increase in nuclear system pressure. 15.1.6.1.2 Frequency Classification Although no single failure could cause this event, it is conservatively categorized as an event of moderate frequency. 15.1.6.2 Sequence of Events and Systems Operation 15.1.6.2.1 Sequence of Events A shutdown cooling malfunction leading to a moderator temperature decrease could result from misoperation of the cooling water controls for RHR heat exchangers. The resulting temperature decrease causes a slow insertion of positive reactivity into the core. Scram will occur before CPS/USAR CHAPTER 15 15.1-13 REV. 11, JANUARY 2005 any thermal limits are reached if the operator does not take action. The sequence of events for this event is shown in Table 15.1.6-1. 15.1.6.2.2 System Operation A shutdown cooling malfunction causing a moderator temperature decrease must be considered in all operating states. However, this event is not considered while at power operation since the nuclear system pressure is too high to permit operation of the shutdown cooling (RHRS). No unique safety actions are required to avoid unacceptable safety results for transients as a result of a reactor coolant temperature decrease induced by misoperation of the shutdown cooling heat exchangers. In startup or cooldown operation, where the reactors is at or near critical, the slow power increase resulting fr om the cooler moderator temperature would be controlled by the operator in the same manner normally used to control power in the source or intermediate power ranges. 15.1.6.2.3 Effect of Single Failures and Operator Action No single failures can cause this event to be more severe. If the operator takes action, the slow power rise will be controlled in the normal manner. If no operator action is taken, scram will terminate the power increase before thermal limits are reached. (See Appendix 15A for details.) 15.1.6.3 Core and System Performance The increased subcooling caused by misoperation of the RHR shutdown cooling mode could result in a slow power increase due to the reactivity insertion. This power rise would be

terminated by a flux scram before fuel thermal limits are approached. Therefore, only qualitative description is provided here. 15.1.6.4 Barrier Performance As noted above, the consequences of this event do not result in any temperature or pressure transient in excess of the criteria for which the fuel, pressure vessel or containment are designed, therefore, these barriers maintain their integrity and function as designed. 15.1.6.5 Radiological Consequences Since this event does not result in any fuel failures, no analysis of radiological consequences is required for this event.

15.1.7 References

1. Odar, F., "Safety Evaluation for General Electric Topical Report: Qualification of the One-Dimensional Core Transient Model for Boiling Water Reactors," NEDO-24154, NEDE-24154P, Volumes 1, 2, and 3, 1980. 2. Quadrex Report QUAD-1-87-004, Revision 0, 5/20/88, Non-Safety-Related Control Systems Failure Analysis, Prepared for Clinton Power Station. 3. GE Report EAS-18-0388 (DRF L12-00769), March 1988, Special Transient Event Analysis to Support Control System Failure Analysis for Clinton Power Station CPS/USAR CHAPTER 15 15.1-14 REV. 11, JANUARY 2005 TABLE 15.1.1-1 Deleted CPS/USAR CHAPTER 15 15.1-15 REV. 11, JANUARY 2005 TABLE 15.1.1-2 SEQUENCE OF EVENTS FOR FIGURE 15.1.1-2 Time-sec Event 0 Initiate a 100 F temperature reduction into the feedwater system. 5.0 Initial effect of unheated feedwater starts to raise core power level and steam flow. 8.0 Turbine control valves start to open to regulate pressure. 36.0 APRM initiates reactor scram on high thermal power.

49.5 Wide Range (WR) sensed water level reaches Level 2 (L2) set point. 49.7 Recirculation Pump Trip initiated due to Level 2 Trip. (not included in simulation). 79.5 HPCS/RCIC flow enters vessel (not simulated). >100.0 (EST) Reactor variables settle into limit cycle.

CPS/USAR CHAPTER 15 15.1-16 REV. 11, JANUARY 2005 TABLE 15.1.2-1 SEQUENCE OF EVENTS FOR FIGURE 15.1.2-1 Time-sec Event 0 Initiate simulated failure of 144% upper limitation feedwater flow. 10.7 L8 vessel level set point initiates reactor scram and trips main turbine and feedwater pumps. 10.8 Recirculation pump trip (RPT) actuated by stop valves position switches. 10.8 Main turbine bypass valves opened due to turbine trip. 12.3 Safety/relief valves open due to high pressure. 15.8 Safety/relief valves close.

CPS/USAR CHAPTER 15 15.1-17 REV. 11, JANUARY 2005 TABLE 15.1.3-1 SEQUENCE OF EVENTS FOR FIGURE 15.1.3-1 Time-sec Event 0 Simulate maximum limit on steam flow to main turbine. 0.2(est) Turbine control valves wide open. Turbine bypass valves open to about 23% NB rated steam flow. 2.64 Vessel water level (L8) trip initiates reactor scram and main turbine and feedwater turbine trips. 2.64 Turbine trip initiates bypass operation to full flow.

2.65 Main turbine stop valves reach 90% open position and initiates recirculation pump trip (RPT). 2.74 Turbine stop valves closed. Turbine bypass valves opening to full flow. 2.78 Recirculation pump motor circuit breakers open causing decrease in core flow to natural circulation. 5.74 Group 1 pressure relief valves actuated. 10.5(est) Group 1 pressure relief valves close.

12.2(est) Relief valves closed. 31.0 Main steam line isolation on low turbine inlet pressure (<825 psig). 36.0 Main steam isolation valves closed. Bypass valves remain open exhausting steam in steam lines downstream of isolation valve 54.0(est) RCIC and HPCS systems initiation on low level (L2) (not simulated). 100.0(est) Group 1 pressure relief valves actuated.

CPS/USAR CHAPTER 15 15.1-18 REV. 11, JANUARY 2005 TABLE 15.1.4-1 SEQUENCE OF EVENTS FOR INADVERTENT SAFETY/RELIEF VALVE OPENING Time-sec Event 0 Initiate opening of 1 safety/relief valve. 0.5 (est.) Relief flow reaches full flow. 15 (est.) System establishes new steady state operation.

CPS/USAR CHAPTER 15 15.1-19 REV. 11, JANUARY 2005 TABLE 15.1.6-1 SEQUENCE OF EVENTS FOR INADVERTENT RHR SHUTDOWN COOLING OPERATION Approximate Elapsed Time Event 0 Reactor at states B or D (of Appendix 15A) when RHR shutdown cooling inadvertently activated. 0-10 min Slow rise in reactor power. +10 min Operator may take action to limit power rise. Flux scram will occur if no action is taken.

CPS/USAR CHAPTER 15 15.3-1 REV. 11, JANUARY 2005 15.3 DECREASE IN REACTOR COOLANT SYSTEM FLOW RATE 15.3.1 Recirculation Pump Trip 15.3.1.1 Identification of Causes and Frequency Classification 15.3.1.1.1 Identification of Causes Recirculation pump motor operation can be tripped off by design for intended reduction of other transient core and RCPB effects as well as randomly by unpredictable operational failures.

Intentional tripping will occur in response to: (1) Reactor vessel water level L2 set point trip.

(2) TCV fast closure or Stop Valve closure.

(3) Failure to scram high pressure set point trip. (4) Motor branch circuit over-current protection. (5) Motor overload protection.

(6) Suction block valve not fully open.

(7) Discharge block valve not fully open. Random tripping will occur in response to: (1) Operator error. (2) Loss of electrical power source to the pumps. (3) Equipment or sensor failures and malfunctions which initiate the above intended trip response. 15.3.1.1.2 Frequency Classification 15.3.1.1.2.1 Trip of One Recirculation Pump This transient event is categorized as one of moderate frequency. 15.3.1.1.2.2 Trip of Two Recirculation Pumps This transient event is categorized as one of moderate frequency.

CPS/USAR CHAPTER 15 15.3-2 REV. 11, JANUARY 2005 15.3.1.2 Sequence of Events and Systems Operation 15.3.1.2.1 Sequence of Events 15.3.1.2.1.1 Trip of One Recirculation Pump Table 15.3.1-1 lists the sequence of events for Figure 15.3.1-1. 15.3.1.2.1.2 Trip of Two Recirculation Pumps Table 15.3.1-2 lists the sequence of events for Figure 15.3.1-2.

15.3.1.2.1.3 Identification of Operator Actions 15.3.1.2.1.3.1 Trip of One Recirculation Pump No scram occurs for trip of one recirculation pump. Following trip of one recirculation pump, the operator should take any action required by the technical specifications. As soon as possible, the operator should verify that no operating limits are being exceeded. Also, the operator should determine the cause of failure prior to returning the system to normal and follow the

restart procedure. 15.3.1.2.1.3.2 Trip of Two Recirculation Pumps The operator should ascertain that the reactor scrams with the turbine trip resulting from reactor water level swell. The operator should regain control of reactor water level through MDRFP or RCIC operation, monitoring reactor water level and pr essure control after shutdown. When both reactor pressure and level are under control, the operator should secure both HPCS and RCIC as necessary. The operator should also determine the cause of the trip prior to returning the

system to normal. 15.3.1.2.2 Systems Operation 15.3.1.2.2.1 Trip of One Recirculation Pump Tripping a single recirculation pump requires no protection system or safeguard system operation. This analysis assumes normal functioning of plant instrumentation and controls. 15.3.1.2.2.2 Trip of Two Recirculation Pumps Analysis of this event assumes normal functioning of plant instrumentation and controls, and plant protection and reactor protection systems. Specifically this transient takes credit for vessel level (L8) to scram the reactor and trip the turbine. Reactor shutdown relies on scram trips from the turbine stop valves. High system pressure is limited by the pressure relief valve system operation:

CPS/USAR CHAPTER 15 15.3-3 REV. 11, JANUARY 2005 15.3.1.2.3 The Effect of Single Failures and Operator Errors 15.3.1.2.3.1 Trip of One Recirculation Pump Since no corrective action is required per Subsection 15.3.1.2.2.1, no additional effects of single failures need be discussed. If additional SACF or SOE are assumed (for envelope purposes the other pump is assumed tripped) then the following two pump trip analysis is provided. Refer to Appendix 15A for specific details. 15.3.1.2.3.2 Trip of Two Recirculation Pumps Table 15.3.1-2 lists the vessel level (L8) scram as the first response to initiate protective action in this transient. This scram trip signal is designed such that a single failure will neither initiate nor impede a reactor scram trip initiation. See Appendix 15A for specific details. 15.3.1.3 Core and System Performance 15.3.1.3.1 Mathematical Model The nonlinear, dynamic model described briefly in Subsection 15.1.1.3.1 is used to simulate this event. 15.3.1.3.2 Input Parameters and Initial Conditions These analyses have been performed, unless otherwise noted, with plant conditions tabulated in Table 15.0-2. Pump motors and pump rotors are simulated with minimum specified rotating inertias.

15.3.1.3.3 Results 15.3.1.3.3.1 Trip of One Recirculation Pump Figure 15.3.1-1 shows the results of losing one recirculation pump. The tripped loop diffuser flow reverses in approximately 5.4 seconds. However, the ratio of diffuser mass flow to pump mass flow in the active jet pumps increases considerably and produces approximately 130% of normal diffuser flow and 55% of rated core flow. MCPR remains above the safety limit, and the fuel thermal limits are not violated. During this transient, level swell is not sufficient to cause turbine trip and scram. 15.3.1.3.3.2 Trip of Two Recirculation Pumps Figure 15.3.1-2 shows graphically this transient with the two recirculation pumps tripping at time zero followed by the coastdown with the conservative minimum specified rotating inertia. MCPR remains unchanged. No scram is initiated directly by pump trip. The vessel water level swell due to rapid flow coastdown is expected to reach the high level trip thereby shutting down the main turbine and feed pump turbines, and scramming. Subsequent events, such as main steam line isolation and initiation of RCIC and HPCS systems occurring late in this event, have no significant effect on the results.

CPS/USAR CHAPTER 15 15.3-4 REV. 11, JANUARY 2005 15.3.1.3.4 Consideration of Uncertainties Initial conditions chosen for these analyses are conservative and tend to force analytical results to be more severe than expected under actual plant conditions. Actual pump and pump-motor drive line rotating inertias are expected to be somewhat greater than the minimum design values assumed in this simulation. Actual plant deviations regarding inertia are expected to lessen the severity as analyzed. Minimum design inertias were used as well as the least negative void coefficient since the primary interest is in the flow reduction. 15.3.1.4 Barrier Performance 15.3.1.4.1 Trip of One Recirculation Pump Figure 15.3.1-1 results indicate a basic reduction in system pressures from the initial conditions. Therefore, the RCPB barrier is not threatened. 15.3.1.4.2 Trip of Two Recirculation Pumps The results shown in Figure 15.3.1-2 indicate peak pressures stay well below the 1375 psig limit allowed by the applicable code. Therefore, the barrier pressure boundary is not threatened. 15.3.1.5 Radiological Consequences While the consequences of the events identified previously do not result in any fuel failures, radioactivity is nevertheless discharged to the suppression pool as a result of SRV actuation. However, the mass input, and hence activity input, for this event is much less than those consequences identified in Section 15.2.4.5 for a Type 2 event. Therefore, the radiological exposures noted in Section 15.2.4.5 cover the consequences of this event. 15.3.2 Recirculation Flow Control Failure - Decreasing Flow 15.3.2.1 Identification of Causes and Frequency Classification 15.3.2.1.1 Identification of Causes Failure within either loop's controller can result in a maximum valve stroking rate as limited by the capacity of the valve hydraulics. 15.3.2.1.2 Frequency Classification This transient disturbance is categorized as an incident of moderate frequency.

15.3.2.2 Sequence of Events and Systems Operation 15.3.2.2.1 Sequence of Events 15.3.2.2.1.1 Fast Closure of One Main Recirculation Valve Table 15.3.2-1 lists the sequence of events for Figure 15.3.2-1.

CPS/USAR CHAPTER 15 15.3-5 REV. 11, JANUARY 2005 15.3.2.2.1.2 Fast Closure of Two Main Recirculation Valves Deleted 15.3.2.2.1.3 Identification of Operator Actions 15.3.2.2.1.3.1 Fast Closure of One Main Recirculation Valve Since no scram occurs, no immediate operator action is required. As soon as possible, the operator should verify that no operating limits are being exceeded. The operator should determine the cause of failure prior to returning the system to normal. 15.3.2.2.1.3.2 Fast Closure of Two Main Recirculation Valves Deleted 15.3.2.2.2 Systems Operation 15.3.2.2.2.1 Fast Closure of One Main Recirculation Valve Normal plant instrumentation and control is assumed to function. No protection system operation is required. 15.3.2.2.2.2 Fast Closure of Two Main Recirculation Valves Deleted 15.3.2.2.3 The Effect of Single Failures and Operator Errors The single failure and operator error considerations for this event are the same as discussed in "Trip of Two Recirculation Pumps," Subsection 15.3.1.2.3.2. Refer to Appendix 15A for details. 15.3.2.3 Core and System Performance 15.3.2.3.1 Mathematical Model The nonlinear dynamic model described briefly in Subsection 15.1.1.3.1 is used to simulate these transient events. 15.3.2.3.2 Input Parameters and Initial Conditions These analyses have been performed, unless otherwise noted, with plant conditions listed in Table 15.0-2. The less negative void coefficient in Table 15.0-2 was used for these analyses.

15.3.2.3.2.1 Fast Closure of One Main Recirculation Valve Failure within either loop controller can result in a maximum stroking rate of 60% per second as limited by the valve hydraulics.

CPS/USAR CHAPTER 15 15.3-6 REV. 11, JANUARY 2005 15.3.2.3.2.2 Fast Closure of Two Main Recirculation Valves Deleted 15.3.2.3.3 Results 15.3.2.3.3.1 Fast Closure of One Recirculation Valve Figure 15.3.2-1 illustrates the maximum valve stroking rate which is limited by hydraulic means. It is similar in most respects to the trip of one recirculation pump transient. Design of the hydraulic limit on maximum valve stroking rate is intended to make this transient event less severe than the one pump trip, and fuel thermal limits are not threatened. 15.3.2.3.3.2 Fast Closure of Two Recirculation Valves Deleted 15.3.2.3.4 Consideration of Uncertainties Initial conditions chosen for these analyses are conservative and tend to force analytical results to be more severe than otherwise expected. These analyses unlike the pump trip series will be unaffected by deviations in pump/pump motor and driveline inertias since it is the main valve that causes rapid recirculation decreases. 15.3.2.4 Barrier Performance 15.3.2.4.1 Fast Closure of One Recirculation Valve Figure 15.3.2-1 indicates a reduction in system pressure and no increases are expected. 15.3.2.4.2 Fast Closure of Two Recirculation Valves Deleted 15.3.2.5 Radiological Consequences While the consequences of the events identified previously do not result in any fuel failures, radioactivity is nevertheless discharged to the suppression pool as a result of SRV actuation. However, the mass input, and hence activity input, for this event is much less than those consequences identified in Section 15.2.4.5 for a Type 2 event. Therefore, the radiological exposures noted in Section 15.2.4.5 cover the consequences of this event. 15.3.3 Recirculation Pump Seizure 15.3.3.1 Identification of Causes and Frequency Classification The seizure of a recirculation pump is considered as a design basis accident event. It has been evaluated as having a very mild accident in relation to other design basis accidents such as the LOCA. The analysis has been conducted with consideration to a single or two loop operation. Refer to Chapter 5.1 for specific mechanical considerations and Chapter 7 for electrical aspects.

CPS/USAR CHAPTER 15 15.3-7 REV. 11, JANUARY 2005 The seizure event postulated certainly would not be the mode failure of such a device. Safe shutdown components (e.g., electrical breakers, protective circuits) would preclude an instantaneous seizure event. 15.3.3.1.1 Identification of Causes The case of recirculation pump seizure represents the extremely unlikely event of instantaneous stoppage of the pump motor shaft of one recirculation pump. This event produces a very rapid decrease of core flow as a result of the large hydraulic resistance introduced by the stopped rotor. 15.3.3.1.2 Frequency Classification This event is considered to be a limiting fault but results in effects which can easily satisfy an event of greater probability (i.e., infrequent incident classification). 15.3.3.2 Sequence of Events and Systems Operations 15.3.3.2.1 Sequence of Events Table 15.3.3-1 lists the sequence of events for Figure 15.3.3-1.

15.3.3.2.1.1 Identification of Operator Actions The operator should ascertain that the reactor scrams from reactor water level swell. The operator should regain control of reactor water level through RCIC operation or by restart of a feedwater pump; and he should monitor reactor water level and pressure control after

shutdown. 15.3.3.2.2 Systems Operation In order to properly simulate the expected sequence of events, the analysis of this event assumes normal functioning of plant instrumentation and controls, plant protection, and reactor protection systems. Operation of safe shutdown features, though not included in this simulation, is expected to be utilized in order to maintain adequate water level. 15.3.3.2.3 The Effect of Single Failures and Operator Errors Single failures in the scram logic originating via the high vessel level (L8) trip are similar to the considerations in Subsection 15.3.1.2.3.2, "Trip of Two Recirculation Pumps." Refer to appendix 15A for further details. 15.3.3.3 Core and System Performance 15.3.3.3.1 Mathematical Model The nonlinear dynamic model described briefly in Subsection 15.1.1.3.1 is used to simulate this event.

CPS/USAR CHAPTER 15 15.3-8 REV. 11, JANUARY 2005 15.3.3.3.2 Input Parameters and Initial Conditions This analysis has been performed, unless otherwise noted, with plant conditions tabulated in Table 15.0-2. For the purpose of evaluating consequences to the fuel thermal limits, this transient event is assumed to occur as a consequence of an unspecified, instantaneous stoppage of one recirculation pump shaft while the reactor is operating at 105% NB rated steamflow. Also, the reactor is assumed to be operating at thermally limited conditions. The void coefficient is adjusted to the most conservative value, that is, the least negative value in Table 15.0-2. 15.3.3.3.3 Results Figure 15.3.3-1 presents the results of the accident. Core coolant flow drops rapidly, reaching its minimum value in approximately 1.5 seconds. MCPR does not decrease significantly before fuel surface heat flux begins dropping enough to restore greater thermal margins. The level swell produces a trip of the main turbine and feedwater pumps and scram at 3.5 sec into the transient. The scram conditions impose no threat to thermal limits. Additionally, the momentary opening of the bypass valves and some of the safety/relief valves limit the pressure well within the range allowed by the ASME vessel code. Therefore, the reactor coolant pressure boundary is not threatened by overpressure. 15.3.3.3.3.1 Considerations of Uncertainties Considerations of uncertainties are included in the GETAB analysis.

15.3.3.4 Barrier Performance The bypass valves and momentary opening of some of the safety/relief valves limit the pressure well within the range allowed by the ASME vessel code. Therefore, the reactor coolant pressure boundary is not threatened by overpressure. 15.3.3.5 Radiological Consequences While the consequences of the events identified previously do not result in any fuel failures, radioactivity is nevertheless discharged to the suppression pool as a result of SRV activation. However, the mass input, and hence activity input, for this event is much less than those consequences identified in Section 15.2.4.5. Therefore, the radiological exposures noted in Section 15.2.4.5 cover the consequences of this event. 15.3.4 Recirculation Pump Shaft Break 15.3.4.1 Identification of Causes and Frequency Classification The breaking of the shaft of a recirculation pump is considered as a design basis accident event. It has been evaluated as a very mild accident in relation to other design basis accidents such as the LOCA. The analysis has been conducted with consideration to a single or two loop operation.

CPS/USAR CHAPTER 15 15.3-9 REV. 11, JANUARY 2005 Refer to Chapter 5 for specific mechanical considerations and Chapter 7 for electrical aspects. This postulated event is bounded by the more limiting case of recirculation pump seizure. Quantitative results for this more limiting case are presented in Section 15.3.3. 15.3.4.1.1 Identification of Causes The case of recirculation pump shaft breakage represents the extremely unlikely event of instantaneous stoppage of the pump motor operation of one recirculation pump. This event produces a very rapid decrease of core flow as a result of the break of the pump shaft. 15.3.4.1.2 Frequency Classification This event is considered a limiting fault but results in effects which can easily satisfy an event of greater probability (i.e., infrequent incident classification). 15.3.4.2 Sequence of Events and Systems Operations 15.3.4.2.1 Sequence of Events A postulated instantaneous break of the pump motor shaft of one recirculation pump as discussed in Subsection 15.3.4.1.1 will cause the core flow to decrease rapidly resulting in water level swell in the reactor vessel. When the vessel water level reaches the high water level setpoint (Level 8), scram, main turbine trip, and feedwater pump trip will be initiated. Subsequently, the remaining recirculation pump trip will be initiated due to the turbine trip. Eventually, the vessel water level will be controlled by HPCS and RClC flow. 15.3.4.2.1.1 Identification of Operator Actions The operator should ascertain that the reactor scrams resulting from reactor water level swell. The operator should regain control of reactor water level through RClC operation or by restart of a feedwater pump; and he should monitor reactor water level and pressure control after shutdown. 15.3.4.2.2 Systems Operation Normal operation of plant instrumentation and control is assumed. This event takes credit for vessel water level (Level 8) instrumentation to scram the reactor and trip the main turbine and feedwater pumps. High system pressure is limited by the pressure relief system operation.

Operation HPCS and RCIC systems is expected in order to maintain adequate water level control. 15.3.4.2.3 The Effect of Single Failures and Operator Errors Effects of single failures in the high vessel level (L8) trip are similar to the considerations in Subsection 15.3.1.2.3.2, "Trip of Two Recirculation Pumps." Assumption of SEF or SOE in other equipment has been examined and this has led to the conclusion that no other credible failure exists for this event. Therefore the bounding case has been considered.

CPS/USAR CHAPTER 15 15.3-10 REV. 11, JANUARY 2005 Refer to Appendix 15A for more details. 15.3.4.3 Core and System Performance The severity of this pump shaft break event is bounded by the pump seizure event as described in Section 15.3.3. This can be easily demonstrated by consideration of those two events as discussed in Subsection below. Since this event is less limiting than the event described in 15.3.3 only qualitative evaluation is provided. Therefore no discussion of mathematical model, input parameters, and consideration of uncertainties, etc., is necessary. 15.3.4.3.1 Qualitative Results If this extremely unlikely event occurs, core coolant flow will drop rapidly. The level swell produces a reactor scram and trip of the main and feedwater turbines. Since heat flux decreases much more rapidly than the rate at which heat is removed by the coolant, there is no threat to thermal limits. Additionally, the bypass valves and momentary opening of some of the safety/relief valves limit the pressure well within the range allowed by the ASME vessel code. Therefore, the reactor coolant pressure boundary is not threatened by overpressure. The severity of this pump shaft break event is bounded by the pump seizure event (see Section 15.3.3). This can be demonstrated easily by consideration of these two events. In either of these two events, the recirculation drive flow of the affected loop decreases rapidly. In the case of the pump seizure event, the loop flow decreases faster than the normal flow coastdown as a result of the large hydraulic resistance introduced by the stopped rotor. For the pump shaft break event, the hydraulic resistance caused by the broken pump shaft is less than that of the stopped rotor for the pump seizure event. Therefore, the core flow decrease following a pump shaft break effect is slower than the pump seizure event. Thus, it can be concluded that the potential effects of the hypothetical pump shaft break accident are bounded by the effects of the pump seizure event. 15.3.4.4 Barrier Performance The bypass valves and momentary opening of some of the safety/relief valves limit the pressure well within the range allowed by the ASME vessel code. Therefore, the reactor coolant pressure boundary is not threatened by overpressure. 15.3.4.5 Radiological Consequences While the consequences of this event do not result in any fuel failures, radioactivity is nevertheless discharged to the suppression pool as a result of SRV activation. However, the mass input, and hence activity input, for this event is much less than those consequences identified in Section 15.2.4.5. Therefore, the radiological exposures noted in Section 15.2.4.5 cover the consequences of this event.

CPS/USAR CHAPTER 15 15.3-11 REV. 11, JANUARY 2005 TABLE 15.3.1-1 SEQUENCE OF EVENTS FOR FIGURE 15.3.1-1 Time-sec Event 0 Trip of one recirculation pump initiated. 5.4 Jet pump diffuser flow reverses in the tripped loop. 34.0 Core flow and power level stabilize at new equilibrium conditions.

CPS/USAR CHAPTER 15 15.3-12 REV. 11, JANUARY 2005 TABLE 15.3.1-2 SEQUENCE OF EVENTS FOR FIGURE 15.3.1-2 Time-sec Event 0 Trip of both recirculation pumps initiated. 4.2 Vessel water level (L8) trip initiates scram, turbine trip and feedwater pump trip. 4.3 Turbine trip initiates bypass operation.

6.7 Safety/relief valves open due to high pressure. 12.0 Safety/relief valves close.

25.2 Vessel water level (L2) set point reached. 55.2 (est) HPCS and RCIC flow enters vessel (not simulated).

CPS/USAR CHAPTER 15 15.3-13 REV. 11, JANUARY 2005 TABLE 15.3.2-1 SEQUENCE OF EVENTS FOR FIGURE 15.3.2-1 Time-sec Event 0 Initiate fast closure of one main recirculation valve. 1.7 Jet pump diffuser flow reverses in the affected loop. 34.0 Core flow and power approach new equilibrium conditions.

CPS/USAR CHAPTER 15 15.3-14 REV. 11, JANUARY 2005 TABLE 15.3 3-1 SEQUENCE OF EVENTS FOR FIGURE 15.3.3-1 Time-sec Event 0 Single pump seizure was initiated. 0.8 Jet pump diffuser flow reverses in seized loop. 3.46 Vessel level (L8) trip initiates scram.

3.46 Vessel level (L8) trip initiates turbine trip.

3.46 Feedwater pumps are tripped off.

3.56 Turbine trip initiates bypass operation. 3.60 Turbine trip initiates recirculation pumps trip. 6.0 Safety/relief valves open due to high pressure. 10.0 Safety/relief valves close.

23.9 Main bypass valves close to regain pressure regulator control. 24.7 Vessel water level reaches Level 2 (L2) setpoint. 54.7(est) HPCS/RCIC flow enters the vessel (not simulated).

CPS/USAR CHAPTER 15 15.4-1 REV. 11, JANUARY 2005 15.4 REACTIVITY AND POWER DISTRIBUTION ANOMALIES 15.4.1 Rod Withdrawal Error - Low Power 15.4.1.1 Control Rod Removal Error During Refueling 15.4.1.1.1 Identification of Causes and Frequency Classification The event considered here is inadvertent criticality due to the complete withdrawal or removal of the most reactive rod during refueling. The probability of the initial causes alone is considered low enough to warrant its being categorized as an infrequent incident, since there is no postulated set of circumstances which results in an inadvertent Rod Withdrawal Error (RWE) while in the REFUEL mode. 15.4.1.1.2 Sequence of Events and Systems Operation 15.4.1.1.2.1 Initial Control Rod Removal Or Withdrawal During refueling operations safety system interlocks provide assurance that inadvertent criticality does not occur because a control rod has been removed or is withdrawn in coincidence with another control rod. 15.4.1.1.2.2 Fuel Insertion With Control Rod Withdrawn To minimize the possibility of loading fuel into a cell containing no control rod, it is required that all control rods are fully inserted when fuel is being loaded into the core or an approved spiral reload sequence is performed as allowed by the CPS Technical Specifications. This requirement is backed up by refueling interlocks on rod withdrawal and movement of the refueling platform. When the mode switch is in the "REFUEL" position, the interlocks prevent the platform from being moved over the core if a control rod is withdrawn and fuel is on the hoist. Likewise, if the refueling platform is over the core and fuel is on the hoist, control rod motion is blocked by the interlocks. 15.4.1.1.2.3 Second Control Rod Removal or Withdrawal When the platform is not over the core (or fuel is not on the hoist) and the mode switch is in the "REFUEL" position, only one control rod can be withdrawn. Any attempt to withdraw a second rod results in a rod block by the refueling interlocks. Since the core is designed to meet shutdown requirements with the highest worth rod withdrawn, the core remains subcritical even with one rod withdrawn. 15.4.1.1.2.4 Control Rod Removal Without Fuel Removal Finally, the design of the control rod, incorporating the velocity limiter, does not physically permit the upward removal of the control rod without the simultaneous or prior removal of the four adjacent fuel bundles. This precludes any hazardous condition. 15.4.1.1.2.5 Identification of Operator Actions No supplementary operator actions are required to preclude this event.

CPS/USAR CHAPTER 15 15.4-2 REV. 11, JANUARY 2005 15.4.1.1.2.6 Effect of Single Failure and Operator Errors If any one of the operations involved in initial failure or error is followed by any other Single Equipment Failure (SEF) or Single Operator Error (SOE), the necessary safety actions are taken (e.g., rod block or scram) automatically prior to limit violation. Refer to Appendix 15A for details. 15.4.1.1.3 Core and System Performances Since the probability of inadvertent criticality during refueling is precluded, the core and system performances were not analyzed. The withdrawal of the highest worth control rod during refueling will not result in criticality. This is verified experimentally by performing shutdown margin checks. (See Section 4.3.2 for a description of the methods and results of the shutdown margin analysis.) Additional reactivity insertion is precluded by interlocks. (See Section 7.6.1.1.) As a result, no radioactive material is ever released from the fuel making it unnecessary to assess any radiological consequences. No mathematic models are involved in this event. The need for input parameters or initial conditions is eliminated as there are no results to report. Consideration of uncertainties is not appropriate. 15.4.1.1.4 Barrier Performance An evaluation of the barrier performance was not made for this event since there is not a postulated set of circumstances for which this event could occur. 15.4.1.1.5 Radiological Consequences An evaluation of the radiological consequences was not made for this event since no radioactive material is released from the fuel. 15.4.1.2 Continuous Rod Withdrawal During Reactor Startup 15.4.1.2.1 Identification of Causes and Frequency Classification The probability of the initial causes of error of this event alone is considered low enough to warrant its being categorized as an infrequent incident. The probability of further single failures postulated for this event is even considerably lower because it is contingent upon the simultaneous failure of two redundant inputs to the Rod Control and Information System (RCIS), concurrent with a high worth rod, out-of-sequence rod selection, plus operator non-acknowledgement of continuous alarm annunciations prior to safety system actuations. 15.4.1.2.2 Sequence of Events and Systems Operation 15.4.1.2.2.1 Sequence of Events Control rod withdrawal errors are not considered credible in the startup and low power ranges. The RCIS prevents the operator from selecting and withdrawing an out-of-sequence control rod. Continuous control rod withdrawal errors during reactor startup are precluded by the RCIS. The RCIS prevents the withdrawal of an out-of-sequence control rod in the 100% to 75% control rod CPS/USAR CHAPTER 15 15.4-3 REV. 11, JANUARY 2005 density range and limits rod movement to the banked position mode of rod withdrawal from the 75% rod density to the preset power level. Since only in-sequence control rods can be withdrawn in the 100%-75% control rod density and control rods are withdrawn in the banked position mode from the 75% control rod density point to the preset power level, there is no basis for the continuous control rod withdrawal error in the startup and low power range. See Subsection 15.4.2 for description of continuous control rod withdrawal above the preset power level. The bank position mode of the RCIS is described in Reference 1. 15.4.1.2.2.2 Identification of Operator Actions No operator actions are required to preclude this event since the plant design as discussed above prevents its occurrence. 15.4.1.2.2.3 Effects of Single Failure and Operator Errors If any one of the operations involved the initial failure or error and is followed by another SEF or SOE, the necessary safety actions are automatically taken (e.g., rod blocks) prior to any limit violation. Refer to Appendix 15A for details. 15.4.1.2.3 Core and System Performance The performance of the RCIS prevents erroneous selection and withdrawal of an out-of-sequence control rod. Thus, the core and system performance is not affected by such an operator error. No mathematical models are involved in this event. The need for input parameters or initial conditions is not required as there are no results to report. Consideration of uncertainties is not appropriate. 15.4.1.2.4 Barrier Performance An evaluation of the barrier performance was not made for this event since there is no postulated set of circumstances for which this error could occur. 15.4.1.2.5 Radiological Consequences An evaluation of the radiological consequences is not required for this event since no radioactive material is released from the fuel. 15.4.1.2.6 References

1. Paone, C. J., "Banked Position Withdrawal Sequence," September 1976, (NEDO-21231). 15.4.2 Rod Withdrawal Error at Power The rod withdrawal error transient was performed as part of the initial cycle analyses supporting CPS operation. Subsequent analyses were performed in various operating modes and/or with equipment out of service, results of which are presented in the following Chapter 15 appendices:

CPS/USAR CHAPTER 15 15.4-4 REV. 11, JANUARY 2005 - Appendix 15B: Recirculation Systems Single-Loop Operation. - Appendix 15C: Maximum Extended Operating Domain and Feedwater Heater Out-of-Service Analysis. For BWR/6's the rod withdrawal error at power event may be analyzed generically or on a cycle-specific basis. The applicability of the generic analysis is determined during each new cycle analysis. The methods, input conditions, and results for the current cycle for the rod withdrawal error transient analysis are presented in Appendix 15D, Reload Analysis. This event was reanalyzed for current rated power (3473 MWt) and the discussion in this section reflects that analysis. Appendix 15E provides a general discussion of the analyses performed for Extended Power Uprate. 15.4.2.1 Identification of Causes and Frequency Classification 15.4.2.1.1 Identification of Causes The Rod Withdrawal Error (RWE) transient results from a procedural error by the operator in which a single control rod or a gang of control rods is withdrawn continuously until the Rod Withdrawal Limiter (RWL) mode of the Rod Control and Information System (RCIS) blocks further withdrawal. 15.4.2.1.2 Frequency Classification The frequency of occurrence for the RWE is considered to be moderate, although for the establishment of the set points for the RWL, a very conservative set of assumptions is assumed. An incident with assumptions as conservative as these is expected to occur infrequently. 15.4.2.2 Sequence of Events and Systems Operation 15.4.2.2.1 Sequence of Events The sequence of events for this transient is presented in Table 15.4.2-1. 15.4.2.2.2 System Operations While operating in the power range in a normal mode of operation, the reactor operator makes a procedural error and withdraws the maximum worth control rod or gang of control rods continuously until the RWL inhibits further withdrawal. Under most normal operating conditions no operator action is required since the transient which would occur would be very mild. Should the peak linear power design limits be exceeded, the nearest Local Power Range Monitor (LPRM) would detect this phenomenon and sound an alarm. The operator should acknowledge this alarm and take appropriate action to rectify the

situation. During this event normal operation of plant instrumentation and controls is assumed although no credit is taken for this, except as described above. No operation of any engineered safety feature (ESF) is required during this event.

CPS/USAR CHAPTER 15 15.4-5 REV. 11, JANUARY 2005 15.4.2.2.3 Single Failure or Single Operator Error The effect of operator errors has been discussed above. It was shown that operator errors (which initiated this transient) cannot impact the consequences of this event due to the RCIS system. The RCIS system is designed to be single failure proof, therefore termination of this transient is assured. See Appendix 15A for details. 15.4.2.3 Core and System Performance 15.4.2.3.1 Mathematical Model The consequences of a rod withdrawal error are calculated utilizing a three-dimensional, coupled nuclear-thermal-hydraulics computer program (Reference 1). This model calculates the changes in power level, power distribution, core flow, and critical power ratio under steady state conditions, as a function of control blade position. For this transient, the time for reactivity insertion is greater than the fuel thermal time constant and core-hydraulic transport times, so that the steady state assumption is adequate. 15.4.2.3.2 Input Parameters and Initial Conditions The reactor core is assumed to be on minimum critical power ratio (MCPR) and maximum linear heat generation rate (MLHGR) technical specification operating limits prior to RWE initiation. A statistical analysis of the rod withdrawal error results (Reference 2) initiated from a wide range of operating conditions (exposure, power, flow, rod patterns, xenon conditions, etc.) has been performed, establishing allowable rod withdrawal increments applicable to all BWR/6 plants. These rod withdrawal increments were determined such that the design basis MCPR for rod withdrawal errors initiated from the technical specification operating limit and mitigated by the RWL system withdrawal restrictions, provides a 95% probability at the 95% confidence level that any randomly occurring RWE will not result in a larger MCPR. MCPR was verified to be the limiting thermal performance parameter and therefore was used to establish the allowable withdrawal increments. The 1% plastic strain limit on the clad was always a less limiting parameter. 15.4.2.3.3 Results The calculated results demonstrate that, should a rod or gang be withdrawn a distance equal to the allowable rod withdrawal increment as determined by rod withdrawal limiter (RWL), there exists a 95% probability at the 95% confidence level that the resultant DMCPR will not be greater than the design basis DMCPR. Furthermore, the plant LHGR will be substantially less than that calculated to yield 1% plastic strain in the fuel clad. These results of the generic analyses in Reference 2 show that a control rod or gang can be withdrawn in increments of 12 in. at power levels ranging from 70-100% of rated, and 24 in. at power levels ranging from 16.7%-70% for EPU. See Section 15.4.1.2 for RWE's below 16.7%

reactor power at EPU. The 16.7% and 70% reactor core power levels correspond to the Low Power Set Point (LPSP) and High Power Set Point (HPSP) of the RWL. 15.4.2.3.4 Consideration of Uncertainties The most significant uncertainty for this transient is the initial control rod pattern and the location of the rods or gangs improperly selected and withdrawn. Because of the near-infinite CPS/USAR CHAPTER 15 15.4-6 REV. 11, JANUARY 2005 combinations of control patterns and reactor states, all possible states cannot be analyzed. However, because only high worth gangs were included in the statistical analysis, enough points have been evaluated so as to clearly establish the 95%/95% confidence level. This effectively bounds the results from any actual operator error of this type with the indicated probabilities. Quasi-steady state conditions were assumed for thermal hydraulic conditions. Although the uncertainty introduced by this assumption is not conservative, the magnitude of the effects neglected is insignificant relative to the result of the transient. The analysis of a Rod Withdrawal Error (RWE) at rated or reduced power has been performed for the BWR/6 Product in a statistical manner (Reference 2). (Q&R 491.3) 15.4.2.4 Barrier Performance An evaluation of the barrier performance was not made for this event, since this is a localized event with very little change in the gross core characteristics. Typically, an increase in total core power for RWE's initiated from rated conditions is less than 4 percent and the changes in pressure are negligible. 15.4.2.5 Radiological Consequences An evaluation of the radiological consequences was not made for this event since no radioactive material is release from the fuel.

15.4.2.6 References

1. Woolley, J. A., "Three Dimensional Boiling Water Reactor Core Simulator," May 1976, (NEDO-20953). 2. J. F. Klapproth, "BWR/6 Generic Rod Withdrawal Error Analysis," March 1980 (Appendix 15B, GESSAR II). 15.4.3 Control Rod Maloperation (System Malfunction or Operator Error)

This event is covered with evaluation cited in Sections 15.4.1 and 15.4.2.

15.4.4 Abnormal Startup of Idle Recirculation Pump The abnormal startup of an idle recirculation pump consists of a successful attempt to start the pump while the temperature difference between the two recirculation loops (T) is greater than the maximum value allowed by CPS Technical Specifications. The current analysis for an idle recirculation loop startup (ILS) assumes a maximum T of 50°F. This assumption is consistent with the input to an analysis of thermal stresses in reactor vessel nozzles and reactor recirculation system components and piping, called the ASME Upset Category Evaluation. The ILS is not explicitly analyzed in the CPS Supplemental Reload Licensing Report (SRLR). However, studies have been conducted, as documented in the SRLR, which justify that this event is bounded by other transient events explicitly analyzed. The ILS transient results were CPS/USAR CHAPTER 15 15.4-7 REV. 11, JANUARY 2005 shown (by these studies) to be within the fuel thermal limits (flow and power dependent) when the T is assumed to be less than 50

°F at the initial idle loop recirculation pump startup. This assumption (a maximum T of 50°F) is less conservative than the original input to the ILS transient analysis, as described in Reference 1.

The abnormal ILS event was analyzed as part of the cycle analyses supporting initial CPS operation. This historical analysis was labeled abnormal startup of the idle recirculation loop. It is available in the historic FSAR, Section 15.4.4. 15.4.4.1 Identification of Causes and Frequency Classification 15.4.4.1.1 Identification of Causes for an Abnormal ILS This action results directly from the operator's manual action to initiate pump operation. It assumes that the remaining loop is already operating. 15.4.4.1.1.1 Abnormal ILS Frequency Classification This transient is categorized as a non-credible incident. Two barriers protect the plant from such an abnormal startup. Both the ILS operating procedures and the a hardware interlock on the reactor recirculation pump must be ineffective (simultaneously) in order for an abnormal startup to occur. Analyses for a T of up to 50

°F are performed, as described in this section, to predict the results of a normal ILS. 15.4.4.1.1.2 Normal ILS Frequency Classification This transient is categorized as an incident of moderate frequency.

15.4.4.2 Sequence of Events and Systems Operation 15.4.4.2.1 Sequence of Normal ILS Events An example (based on cycle 1 data) of the transient response to the normal startup of a relatively cold idle recirculation loop is shown in Figure 15.4.4-1. Table 15.4.4-1 lists a postulated sequence of events for Figure 15.4.4-1. 15.4.4.2.1.1 Operator Actions The normal sequence of operator actions expected in starting the idle loop is as follows. The time to do this work is approximately 1/2 hour. The operator should: (1) Adjust rod pattern as necessary for new power level following idle loop start.

(2) Determine that the idle recirculation pump suction and discharge block valves are open and that the flow control valve in the idle loop is at 10% position and, if not, place them in this configuration. (3) Readjust flow of the running loop downward to less than half of the rated flow.

(4) Determine that the temperature difference between the two loops is no more than 50°F.

CPS/USAR CHAPTER 15 15.4-8 REV. 11, JANUARY 2005 (5) Start the idle loop pump and adjust flow to match the adjacent loop flow. Monitor reactor power. (6) Readjust power, as necessary, to satisfy plant requirements per standard procedure. 15.4.4.2.2 Systems Operation This event assumes and takes credit for normal functioning of plant instrumentation and controls. The protection systems are anticipated to perform their function if a high neutron flux is detected. ESF / RPS action may occur as a result of the abnormal ILS transient. 15.4.4.2.3 The Effect of Single Failures and Operator Errors Attempts by the operator to perform an abnormal ILS (T greater than 50

°F) will not result in a pump start. A hardware interlock prevents the reactor recirculation pump from starting during Ts greater than 50

°F. An operator attempt to perform an ILS at a T above 50

°F would constitute a violation of CPS Operating Procedures and Technical Specifications. During a period where the hardware interlock is not functioning properly, an operator attempt to perform an ILS at a T above 50

°F may result in a transient high power level. The fuel thermal limits may be exceeded during this event. See Appendix 15A for details on exceeding fuel thermal limits. 15.4.4.3 Core and System Performance 15.4.4.3.1 Mathematical Model The abnormal ILS event is not simulated, since it is a non-credible incident. A nonlinear dynamic model is used to simulate the normal ILS event. 15.4.4.3.2 Normal ILS Model Input Parameters and Initial Conditions The analysis was performed for the first cycle with plant conditions similar to those tabulated in Table 15.0-2. One recirculation loop is idle and filled with water at a temperature about 50

°F lower than the indicated active loop temperature. (Normal procedure when starting an idle loop with one pump already running requires that the indicated idle loop temperature be within 50

°F of the indicated active loop temperature.) The active recirculation loop is operating with the flow control valve position that produces about 85% of normal rated jet pump diffuser flow in the active jet pumps. The core is receiving about a third of its normal rated flow. A fraction of the coolant flows in the reverse direction through the inactive jet pumps. The idle recirculation pump suction and discharge block valves are open and the recirculation flow control valve is closed to its 10% open position. (Normal procedure requires placing the idle loop in this condition prior to restart.)

CPS/USAR CHAPTER 15 15.4-9 REV. 11, JANUARY 2005 15.4.4.3.3 Results of Normal ILS Event An example (based on cycle 1 data) of the transient response to a normal startup of a relatively cold idle recirculation loop is shown in Figure 15.4.4-1. Shortly after the pump begins to move, a surge in flow from the started jet pump diffusers causes the core inlet flow to rise sharply. The motor approaches synchronous speed in approximately 3 seconds because of the assumed minimum pump and motor inertia. A short-duration neutron flux peak to just below the scram setpoint is produced as the colder, increasing core flow reduces the void volume. Surface heat flux follows the slower response of the fuel and peaks at 80% of rated before decreasing after the cold water washed out of the loop at about 20 seconds. No damage occurs to the fuel barrier and MCPR remains above the safety limit as the reactor settles out at its new steady state condition. 15.4.4.3.4 Consideration of Uncertainties This particular transient is analyzed for an initial power level that is much higher than that expected for the actual event. The much slower thermal response of the fuel mitigates the effects of the rather sharp neutron flux spike and even in this high range of power, no threat to thermal limits is possible. 15.4.4.4 Barrier Performance An evaluation of barrier performance is required after the occurrence of an abnormal ILS event, since significant local cladding damage has not been shown to be highly improbable during this transient. See Figure 15.4.4-1 for an example of a normal ILS transient response.

The normal (50

°F T) ILS response is enveloped by the cycle specific reload analysis. 15.4.4.5 Radiological Consequences An evaluation of the radiological consequences is not required for the normal ILS event since no radioactive material is released from the fuel.

15.4.4.6 Reference

1. GE Nuclear Service Information Letter No. 517 Supplement 1, "Analysis Basis for Idle Recirculation Loop Start-up," August 26, 1998. 15.4.5 Recirculation Flow Control Failure with Increasing Flow 15.4.5.1 Identification of Causes and Frequency Classification 15.4.5.1.1 Identification of Causes Failure within a loop's flow controller can cause an increase in core coolant flow rate.

15.4.5.1.2 Frequency Classification This transient disturbance is classified as an incident of moderate frequency.

CPS/USAR CHAPTER 15 15.4-10 REV. 11, JANUARY 2005 15.4.5.2 Sequence of Events and Systems Operation 15.4.5.2.1 Sequence of Events 15.4.5.2.1.1 Fast Opening of One Recirculation Valve Table 15.4.5-1 lists the sequence of events for Figure 15.4.5-1. 15.4.5.2.1.2 Fast Opening of Two Recirculation Valves Deleted 15.4.5.2.1.3 Identification of Operator Actions Initial action by the operator should include (1) Stabilize flow.

(2) Identify cause of failure. Reactor pressure will be controlled as required, depending on whether a restart or cooldown is planned. In general, the corrective action would be to hold reactor pressure and condenser vacuum for restart after the malfunctioning flow controller has been repaired. The following is the sequence of operator actions expected during the course of the event, assuming restart. The operator should (1) Observe that all rods are in. (2) Check the reactor water level and maintain above low level (L2) trip to prevent MSLIVs from isolating. (3) Switch the reactor mode switch to the "startup" position.

(4) Continue to maintain vacuum and turbine seals.

(5) Transfer the recirculation flow controller to the manual position and reduce set point to zero. (6) Survey maintenance requirements and complete the scram report. (7) Monitor the turbine coastdown and auxiliary systems.

(8) Establish a restart of the reactor per the normal procedure.

NOTE: Time required from first trouble alarm to restart would be approximately 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br />. 15.4.5.2.2 Systems Operation The analysis of this transient assumes and takes credit for normal functioning of plant instrumentation and controls, and the reactor protection system. Operation of engineered safeguards is not expected.

CPS/USAR CHAPTER 15 15.4-11 REV. 11, JANUARY 2005 15.4.5.2.3 The Effect of Single Failures and Operator Errors This transient leads to a quick rise in reactor power level. Protective action first occurs in the high flux trip which, being part of the reactor protection system, is designed to single failure criteria. (See Appendix 15A for details.) Therefore, shutdown is assured. Operator errors are not of concern here in view of the fact that automatic shutdown events follow so quickly after the postulated failure. 15.4.5.3 Core and System Performance 15.4.5.3.1 Mathematical Model The nonlinear dynamic model described briefly in Subsection 15.1.1.3.1 is used to simulate this event. 15.4.5.3.2 Input Parameters and Initial Conditions These analyses have been performed, unless otherwise noted, with plant conditions tabulated in Table 15.0-2. In this transient event the most severe transient results when initial conditions are established for operation at the low end of the rated flow control rod line. Specifically, this is 53% NB rated power and 34% core flow, based on original rated power of 2894 MWt. Maximum stroking rate of a single recirculation loop valve for a loop controller failure is limited by hydraulics to 30% per second. 15.4.5.3.3 Results 15.4.5.3.3.1 Fast Opening of One Recirculation Valve Figure 15.4.5-1 shows the analysis for original rated power of a failure where one recirculation loop main valve is opened at its maximum stroking rate of 30% per second. The rapid increase in core flow causes a sharp rise in neutron flux initiating a reactor scram at approximately 1.1 seconds. The peak neutron flux reached was 309% of NB rated value, while the accompanying average fuel surface heat flux reaches 74% of NB rated at approximately 1.9 seconds. MCPR remains considerably above the safety limit and fuel center temperature increases only 310 F. Reactor pressure is discussed in 15.4.5.4. Since this event is not limiting, it was not reanalyzed for current rated power. 15.4.5.3.3.2 Fast Opening of Two Recirculation Valves Deleted 15.4.5.3.4 Considerations of Uncertainties Some uncertainties in void reactivity characteristics, scram time and worth are expected to be more optimistic and will therefore lead to reducing the actual severity over that which is simulated herein.

CPS/USAR CHAPTER 15 15.4-12 REV. 11, JANUARY 2005 15.4.5.4 Barrier Performance 15.4.5.4.1 Fast Opening of One Recirculation Valve This transient results in a very slight increase in reactor vessel pressure as shown in Figure 15.4.5-1 and therefore represents no threat to the RCPB. 15.4.5.4.2 Fast Opening of Two Recirculation Valves Deleted 15.4.5.5 Radiological Consequences An evaluation of the radiological consequences is not required for this event since no radioactive material is released from the fuel. 15.4.6 Chemical and Volume C ontrol System Malfunctions Not applicable to BWRs. This is a PWR event. 15.4.7 Misplaced Bundle Accident Analysis of the misplaced bundle accident (fuel loading error) for the initial core, presented below, only considered the mislocated bundle accident. For the current cycle analysis refer to Appendix 15D, Reload Analysis, for evaluation of the mislocated bundle accident and the misoriented bundle accident. 15.4.7.1 Identification of Causes and Frequency Classification 15.4.7.1.1 Identification of Causes The event discussed in this section is the improper loading of a fuel bundle and subsequent operation of the core. Three errors must occur for this event to take place in the initial core loading. First, a bundle must be misloaded into a wrong location in the core. Second, the bundle which was supposed to be loaded where the mislocation occurred would have to be overlooked and also put in an incorrect location. Third, the misplaced bundles would have to be overlooked during the core verification performed following initial core loading. 15.4.7.1.2 Frequency of Occurrence This event occurs when a fuel bundle is loaded into the wrong location in the core. It is assumed the bundle is misplaced to the worst possible location, and the plant is operated with the mislocated bundle. This event is categorized as an infrequent incident based on the following data.

Expected Frequency: .004 events/operating cycle The above number is based upon past experience. The only misloading events that have occurred in the past were in reload cores where only two errors are necessary. Therefore, the frequency of occurrence for initial cores is even lower since three errors must occur concurrently.

CPS/USAR CHAPTER 15 15.4-13 REV. 11, JANUARY 2005 15.4.7.2 Sequence of Events and Systems Operation The postulated sequence of events for the misplaced bundle accident (MBA) is presented in Table 15.4.7-1. Fuel loading errors, undetected by in-core instrumentation following fueling operations, may result in undetected reductions in thermal margins during power operations. No detection is assumed, and therefore, no corrective operator action or automatic protection system functioning occurs. 15.4.7.2.1 Effect of Single Failure and Operator Errors This analysis already represents the worst case (i.e., operation of a misplaced bundle with three SEF or SOE) and there are no further operator errors which can make the event results any worse. It is felt that this section is not applicable to this event. Refer to Appendix 15A for further details. 15.4.7.3 Core and System Performance 15.4.7.3.1 Mathematical Model A three-dimensional BWR simulator model is used to calculate the core performance resulting from this event. This model is described in detail in Reference 1. 15.4.7.3.2 Input Parameters and Initial Conditions The initial core consists of three bundle types with average enrichments that are high, medium or low with correspondingly different gadolinia concentrations. The fuel bundle loading error involves interchanging a bundle of one enrichment with another bundle of a different enrichment. The following fuel loading errors can be conceived for an initial core: (1) A high-enriched bundle is misloaded into low-enriched bundle location. (2) A medium-enriched bundle is misloaded into a low-enriched bundle location. (3) A low-enriched bundle is misloaded into a high-enriched bundle location.

(4) A low-enriched bundle is misloaded into a medium-enriched bundle location.

(5) A medium-enriched bundle is misloaded into a high-enriched bundle location.

(6) A high-enriched bundle is misloaded into a medium-enriched bundle location. Since all low-enriched bundles are located on the core periphery, the two possible fuel loading errors consisting of the misloading of high or medium-enriched bundles into a low-enriched bundle location, i.e., types 1 and 2 are not significant. In these cases, the higher reactivity bundles are moved to a region of lower importance resulting in an overall improvement in performance. The third type of fuel loading error, as identified above, results in largest enrichment mismatch. However, it does not result in an unacceptable operating consequence. Consider a fuel bundle loading error at beginning-of-cycle (BOC) with the low-enriched bundle (which should be loaded CPS/USAR CHAPTER 15 15.4-14 REV. 11, JANUARY 2005 at the periphery) interchanged with a high-enriched bundle located adjacent to a Local Power Range Monitor (LPRM) and predicted to have the highest LHGR and/or lowest CPR in the core.

After the loading error has occurred and has gone undetected, it is assumed, for purposes of conservatism, that the operator uses a control pattern that places the limiting bundle in the four bundle array containing the misplaced bundle, on thermal limits as recorded by the LPRM. As a result of loading the low-enriched bundle in an improper location, the average power in the four bundles decreases. Normally, the reading of the LPRM will show a decrease in thermal flux due to the decreased power, however, in this case an increase in the thermal flux occurs due to decreased neutron absorption in the low-enriched bundle. The effects of the softer neutron spectrum due to the decreased thermal absorption are larger than the power depression effect of the lower fission rate resulting in a net increase in instrument reading. Thus, a fuel loading error of this kind does not result in undetected reductions in thermal margins during power

operations. The fourth and fifth type of fuel loading errors are of the same kind (lower enrichment into higher enrichment) as the third type, and also do not result in a non-conservative operating error. The fuel bundle loading error with greatest impact on thermal margin is of the sixth type which occurs when a high-enriched bundle is interchanged with a medium-enriched bundle located away from a LPRM. Since the medium and high enrichment bundles have a corresponding medium and high gadolinia content, the maximum reactivity difference occurs at end of cycle (EOC) where the gadolinia is burned out. After the loading errors are made and have gone undetected, the operator assumes that the mislocated bundle is operating at the same power as the instrumented bundle in the mirror image location and operates the plant until EOC. For the purpose of conservatism, it is assumed that the mirror image bundle is on thermal limits as recorded by the LPRM. As a result of placing the instrumented bundle on limits, the mislocated bundle violates the Tech Spec operating MCPR limit. A summary of input parameters for this analysis are given in Table 15.4.7-2.

The early analysis performed for the Fuel Loading Error (FLE) is based on one and one-half group diffusion theory and evaluates the changes in core power distribution due to the misloading of fuel bundles. The analysis does not account for the additional spectral effects of misloading fuel bundles as detected by the thermal neutron monitoring systems (LPRM and APRM). In Subsection 15.4.7.3.2 the spectral effects of misloading a natural uranium bundle near an LPRM have been separately analyzed and found to compensate for the power depression effects (based upon multigroup fine mesh diffusion calculations which account for spectral effects). Therefore, the misloading of a natural uranium fuel bundle is not considered as a possible limiting FLE, and in reality results in conservative power prediction. As a result, a different FLE is reported. The new analysis removes the high degree of conservatism involved with misloading natural uranium fuel bundle into the central region of the core. (Q&R 491.4) The misoriented bundle loading error (i.e., rotated 180) is of no consequence of C-lattice BWR plants. Clinton is an S-lattice plant which is identical to the C-lattice configuration with the exception of the rod pitch and fuel channel dimensions being slightly less for the S-lattice. The S-lattice configuration has equal size gaps on all four sides of the bundle, thus rotation would have no effect on the maximum R-factor. Similar to the D-lattice, the bundle in a S-lattice configuration would tilt axially due to the channel buttons at the top of the fuel assembly.

Contrary to the D-lattice where the tilting tends to mitigate the effect of a rotation, the R-factor increases slightly for the S-lattice. The net effect for the S-lattice is a CPR of less than 0.05.

(Q&R 491.5)

CPS/USAR CHAPTER 15 15.4-15 REV. 11, JANUARY 2005 15.4.7.3.3 Results A bounding analysis was performed to quantify the worst fuel bundle loading error for initial cores. A summary of the results of that analysis are presented in Table 15.4.7-3. As can be

seen, MCPR remains well above the MCPR safety limit, and MLHGR does not exceed the 1% plastic strain limit for the clad. Therefore, no violation of fuel limits occurs as a result of this event. 15.4.7.3.4 Considerations of Uncertainties In order to assure the conservatism of the bounding analysis, major input parameters were taken as a worst case, i.e., the bundle is placed in location with the highest LHGR and/or the lowest CPR in the core and the bundle is operating on thermal limits. This assures that the MCPR and MLHGR are conservatively bounded for the error. 15.4.7.4 Barrier Performance An evaluation of the barrier performance was not m ade for this event since it is a very mild and highly localized event. No perceptible change in the core pressure would be observed. 15.4.7.5 Radiological Consequences An evaluation of the radiological consequences is not required for this event since no radioactive material is released from the fuel.

15.4.7.6 References

1. Woolley, J. K., "Three Dimensional Boiling Water Reactor Core Simulator," May 1976, (NEDO-20953). 2. G. G. Sherwood, et al., "General Electric Standard Application for Reactor Fuel," NEDE-24011-P-A-8 (proprietary). pages US.1-3 and 2-22, May 1986. 15.4.8 Spectrum of Rod Ejection Assemblies Not applicable to BWRs. This is a PWR event.

The BWR has precluded this event by incorporating into its design mechanical equipment which restricts any movement of the control rod drive system assemblies. The control rod drive housing support assemblies are described in Chapter 4. 15.4.9 Control Rod Drop Accident (CRDA)

Certain limiting safety analyses are reperformed each operating cycle to determine and/or verify safety margins. The methods, input conditions, and results for the current cycle for the control rod drop accident are presented in Appendix 15D, Reload Analysis. The NRC approved a generic bounding control rod drop accident analysis for banked position withdrawal sequence (BPWS) plants. Since CPS is a BPWS plant the generic analysis, described in Reference 11, is applied as described in Appendix 15D.

CPS/USAR CHAPTER 15 15.4-16 REV. 11, JANUARY 2005 15.4.9.1 Identification of Causes and Frequency Classification 15.4.9.1.1 Identification of Causes The control rod drop accident is the result of a postulated event in which a highest worth control rod, within the constraints of the banked position RCIS, drops from the fully inserted or intermediate position in the core. The highest worth rod becomes decoupled from its drive mechanism. The mechanism is withdrawn but the decoupled control rod is assumed to be stuck in place. At a later moment, the control rod suddenly falls free and drops to the control rod drive position. This results in the removal of large negative reactivity from the core and results in a localized power excursion. A more detailed discussion is given in Reference 1. 15.4.9.1.2 Frequency of Classification The CRDA is categorized as a limiting fault because it is not expected to occur during the lifetime of the plant; but if postulated to occur, it has consequences that include the potential for the release of radioactive material from the fuel. 15.4.9.2 Sequence of Events and System Operation 15.4.9.2.1 Sequence of Events Before the control rod drop accident (CRDA) is possible, the sequence of events presented in Table 15.4.9-1 must occur. No operator actions are required to terminate this transient. 15.4.9.2.2 Systems Operation The unlikely set of circumstances, referenced above, makes possible the rapid removal of a control rod. The dropping of the rod results in high reactivity in a small region of the core. For large, loosely coupled cores, this would result in a highly peaked power distribution and subsequent operation of shutdown mechanisms. Significant shifts in the spatial power generation would occur during the course of the excursion. The Rod Control and Information System (RCIS) limits the worth of any control rod which could be dropped by regulating the withdrawal sequence. This system prevents the movement of an out-of-sequence rod in the 100 to 75% rod density range, and from the 75% rod density point to the preset power level the RCIS will only allow bank position mode rod withdrawals or insertions. The banked position mode of this system is described in Reference 2 for a typical BWR. The RCIS used redundant input to provide absolute assurance on control rod drive position. If either of the diverse input were to fail t he other would provide the necessary information. The termination of this excursion is accomplished by automatic safety features of inherent shutdown mechanisms. Therefore, no operator action during the excursion is required. Although other normal plant instrumentation and controls are assumed to function, no credit for their operation is taken in the analysis of this event.

CPS/USAR CHAPTER 15 15.4-17 REV. 12, JANUARY 2007 15.4.9.2.3 Effect of Single Failures and Operator Errors Systems mitigating the consequences of this event are RCIS and APRM scram. The RCIS is designed as a redundant system network and therefore together provide single failure protection. The APRM scram system is designed to single failure criteria. Therefore, termination of this transient within the limiting results discussed below is assured. No operator error (in addition to the one that initiates this event) can result in a more limiting case since the reactor protection system will automatically terminate the transient. Appendix 15A provides a detailed discussion on this subject.

15.4.9.3 Core and System Performance 15.4.9.3.1 Mathematical Model The analytical methods, assumptions and conditions for evaluating the excursion aspects of the control rod drop accident are described in detail in References 1, 3, and 4. They are considered to provide a realistic yet conservative assessment of the associated consequences. The data presented in Reference 2 shows that the RCIS Banked Position mode reduces the control rod worths to the degree that the detailed analyses presented in References 1, 3, and 4 or the bounding analyses presented in Reference 5 are not necessary. Compliance checks are instead made to verify that the maximum rod worth does not exceed 1% k. If this criteria is not met, then the bounding analyses is performed. The rod worths are determined using the BWR Simulator model (Reference 6). Detailed evaluations, if necessary, are made using the methods described in References 1, 3, and 4. 15.4.9.3.2 Input Parameters and Initial Conditions The core at the time of rod drop accident is assumed to be at the point in cycle which results in the highest incremental rod worth, to contain no xenon, to be in a hot-startup condition, and to have the control rods in sequence A at 50% rod density (groups 1-4 withdrawn). Removing xenon, which competes well for neutron absorptions, increases the fractional absorptions, or

worth, of the control rods. The 50% control rod density ("black and white" rod pattern), which nominally occurs at the hotstartup condition, ensures that withdrawal of a rod results in the maximum increment of reactivity. Since the maximum incremental rod worth is maintained at very low values, the postulated CRDA cannot result in peak enthalpies in excess of 280 calories per gram for any plant condition. The data presented in Section 15.4.9.3.3 show the maximum control rod worth.

Other input parameters and initial conditions are shown in Table 15.4.9-2. 15.4.9.3.3 Results The radiological evaluations are based on the assumed failure of 1200 fuel rods in GE 10x10 fuel. The number of rods which exceed the damage threshold is less than 1200 for all plant operating conditions or core exposure, provided the peak enthalpy is less than the 280 cal/gm design limit. The results of the compliance check calculation, as shown in the Table 15.4.9-3, indicate that the maximum incremental rod worth is well below the worth required to cause a CRDA which CPS/USAR CHAPTER 15 15.4-18 REV. 12, JANUARY 2007 would result in 280 cal/gm peak fuel enthalpy (References 1, 3, and 4). The conclusion is that the 280 cal/gm design limit is not exceeded and the assumed failure of 1200 rods for the radiological evaluation is conservative. 15.4.9.4 Barrier Performance An evaluation of the barrier performance was not made for this accident since this is a highly localized event with no significant change in the gross core temperature or pressure. 15.4.9.5 Radiological Consequences As noted in Section 15.0.1, the radiological analysis of this accident is performed using Alternative Source Terms (AST) and is based on conservative assumptions considered to be acceptable to the NRC for the purpose of determ ining the adequacy of the plant design to meet 10 CFR 50.67 limits.

15.4.9.5.1 Analysis The design basis analysis is based on the NRC' s Standard Review Plan 15.4.9 (Reference 10) and Regulatory Guide 1.183. The specific models, assumptions and the program used for computer evaluation are described in Reference 7. Specific parametric values used in the evaluation are presented in Table 15.4.9-5. 15.4.9.5.1.1 Fission Product Release from Fuel The failure of 1200 fuel rods is used for this analysis. The mass fraction of the fuel in the damaged rods which reaches or exceeds the initiation temperature of fuel melting (taken as 2842°C) is estimated to be 0.0077. Fuel reaching melt conditions is assumed to release 100% of the noble gas inventory and 50% of the iodine inventory. The remaining fuel in the damaged rods is assumed to release 10% of both the noble gas and iodine inventories. A maximum equilibrium inventory of fission products in the core is based on 1095 days of continuous operation at 3543 MWT. No delay time is considered between departure from the above power condition and the initiation of the accident. 15.4.9.5.1.2 Fission Product Transport to the Environment The transport pathway consists of carryover with steam to the turbine condenser prior to MSLIV closure, and leakage from the condenser to the environment. No credit is taken for the turbine building. Of the activity released from the fuel, 100% of the noble gases and 10% of the iodines are assumed to be carried to the condenser before MSLIV closure is complete.

CPS/USAR CHAPTER 15 15.4-19 REV. 12, JANUARY 2007 Of the activity reaching the condenser, 100% of the noble gases and 10% of the iodines (due to partitioning and plateout) remain airborne. The activity airborne in the condenser is assumed to leak directly to the environment a rate of 1.0% per day, with no credit for the Standby Gas Treatment System. The activity airborne in the condenser is presented in Table 15.4.9-6. The cumulative release of activity to the environment is presented in Table 15.4.9-7. 15.4.9.5.1.3 Results The calculated exposures from the design basis analysis are presented in Table 15.4.9-8 and are well within the guidelines of 10 CFR 50.67 and Regulatory Guide 1.183. 15.4.9.5.1.4 Main Control Room The radiological dose for this accident with no credit for Control Room filtration, over a 30-day period after a CRDA is 0.43 rem TEDE.

CPS/USAR CHAPTER 15 15.4-20 REV. 12, JANUARY 2007 This page left blank intentionally CPS/USAR CHAPTER 15 15.4-21 REV. 12, JANUARY 2007 15.4.9.6 References

1. R. C. Stirn, et al., "Rod Drop Accident Analysis for Large BWRs", March 1976 (NEDO-10527). 2. C. J. Paone, "Banked Position Withdrawal Sequence", September 1976 (NEDO-21231). 3. R. C. Stirn, et al., "Rod Drop Accident Analysis for Large BWRs", July 1972 Supplement 1 (NEDO-10527). 4. R. C. Stirn, et al., "Rod Drop Accident Analysis for Large BWRs," January 1973, Supplement 2 (NEDO-10527). 5. "GE BWR Generic Reload Application for 8x8 Fuel" Supplement 3 to Revision 1, (NEDO-20360). 6. Woolley, J. A., "Three Dimensional Boiling Water Reactor Simulator," May 1976, (NEDO-20953). 7. Calculation C-024, "Reanalysis of Control Rod Drop Accident (CRDA) Using the Alternative Source Term Methodology. 8. Deleted 9. Deleted 10. USNRC Standard Review Plan, NUREG-75/087, Washington, D.C., November 24, 1975. 11. "General Electric Standard Application for Reactor Fuel", NEDE-24011-P-A, latest approved revision.

CPS/USAR CHAPTER 15 15.4-22 REV. 11, JANUARY 2005 TABLE 15.4.2-1 SEQUENCE OF EVENTS - RWE IN POWER RANGE Elapsed Time Event 0 Core is assumed to be operating at rated conditions. 0 Operator selects and withdraws the maximum worth single control rod or rod gang. 1 sec The total core power and the local power in the vicinity of the control rod increase. 6*sec The RWL mode blocks withdrawal. 25 sec Reactor core stabilizes at slightly higher core power level.

• Based on 2.0 feet RWL increment.

CPS/USAR CHAPTER 15 15.4-23 REV. 11, JANUARY 2005 TABLE 15.4.4-1 SEQUENCE OF EVENTS FOR FIGURE 15.4.4-1 Time-sec Event 0 Start pump motor. 1.2 Jet pump diffuser flows on started pump side become positive. 3.2 Pump motor at full speed and drive flow at about 25% of rated. 14.0 (est) Last of cold water leaves recirculation drive loop. 14.4 Peak value of core inlet subcooling. 20.0 Peak thermal power. Estimated APRM thermal power approximately 2% below the APRM thermal power set

point. 50.0 (est) Reactor variables settle into new steady state.

CPS/USAR CHAPTER 15 15.4-24 REV. 11, JANUARY 2005 TABLE 15.4.5-1 SEQUENCE OF EVENTS FOR FIGURE 15.4.5-1 Time-sec Event 0 Simulate failure of single loop control. 1.07 Reactor APRM high flux scram trip initiated. 4.3 (est) Turbine control valves start to close upon falling turbine pressure. 14.7 (est) Turbine control valves closed. Turbine pressure below pressure regulator set points. 33.4 (est) Vessel water level (L8) trip initiates main turbine and feedwater turbine trips. 33.5 (est) Main turbine stop valves closed. Bypass does not open as turbine inlet pressure remains below pressure regulator set

points. 65 (est) Turbine bypass opens to regulate pressure.

>100 (est) Reactor Variables settle into new steady state.

CPS/USAR CHAPTER 15 15.4-25 REV. 11, JANUARY 2005 TABLE 15.4.7-1 SEQUENCE OF EVENTS FOR MISPLACED BUNDLE ACCIDENT (1) During core loading operation, bundle is placed in the wrong location*. (2) Subsequently, the bundle intended for this location is placed in the location of the previous bundle. (3) During core verification procedure, error is not observed.

(4) Plant is brought to full power operation without detecting misplaced bundle.

(5) Plant continues to operate.

• For initial core load only.

CPS/USAR CHAPTER 15 15.4-26 REV. 11, JANUARY 2005 TABLE 15.4.7-2 INPUT PARAMETERS AND INITIAL CONDITIONS FOR FUEL BUNDLE LOADING ERROR

• (1) Power, % rated 100 (2) Flow, % rated 100 (3) MCPR operating limit 1.20 (4) MLHGR operating limit, kw/ft 13.4 (5) Core exposure End of Cycle

• For initial core load only. See Appendix 15D, Reload Analysis, for current cycle analysis.

CPS/USAR CHAPTER 15 15.4-27 REV. 11, JANUARY 2005 TABLE 15.4.7-3 RESULTS OF MISPLACED BUNDLE ANALYSIS

• (1) MCPR limit 1.20 (2) MCPR with misplaced bundle 1.10 (3) CPR for event 0.10 (4) LHGR limit 13.4 (5) LHGR with misplaced bundle 14.7

(6) LHGR for event 1.3

• For initial core load only. See Appendix 15D, Reload Analysis, for current cycle analysis.

CPS/USAR CHAPTER 15 15.4-28 REV. 11, JANUARY 2005 TABLE 15.4.9-1 SEQUENCE OF EVENTS FOR ROD DROP ACCIDENT Approximate Elapsed Time Event Reactor is operating at 50% rod density pattern. Maximum worth control rod blade becomes decoupled from the CRD. Operator selects and withdraws the control rod drive of the decoupled rod either individually or along with other control rods assigned to the RCIS group. Decoupled control rod sticks in the fully inserted or an intermediate bank position. 0 Control rod becomes unstuck and drops to the drive position at the nominal measured velocity plus three standard

deviations.

<1 second Reactor goes on a positive period and the initial power increase is terminated by the Doppler coefficient.

<1 second APRM 120% power signal scrams reactor.

<5 seconds Scram terminates accident.

CPS/USAR CHAPTER 15 15.4-29 REV. 11, JANUARY 2005 TABLE 15.4.9-2 INPUT PARAMETERS AND INITIAL CONDITIONS FOR ROD WORTH COMPLIANCE CALCULATION

• 1. Reactor Power, % Rated 0.0 2. Reactor Flow, % Rated 0.0 3. Core Average Exposure, MWd/t 0.0

4. Control Rod Fraction Approximately 0.50

5. Average Fuel Temperature, °C 286 6. Average Moderator Temperature, °C 286 7. Xenon State None

• For initial cycle analysis only. See Appendix 15D, Reload Analysis, for current cycle analysis.

CPS/USAR CHAPTER 15 15.4-30 REV. 11, JANUARY 2005 TABLE 15.4.9-3 INCREMENTAL WORTH OF THE MOST REACTIVE ROD USING BPWS (BOC)*

All Other Group 7 Rods At Notch Rod (24,33) Drops From Notch 00 To Notch Incremental Worth, K 00 04 .00034 04 08 .00249 08 12 .00383 12 48 .00426 48 48 .00266

• The following assumptions were used in producing the conservative results: a) Beginning of Cycle (BOC) b) No Xenon c) No Doppler Feedback d) Rod Groups 1 to 4 withdrawn e) Rod Groups 5, 8 to 10 inserted For initial cycle analysis. See Appendix 15D, Reload Analysis, for current cycle analysis.

CPS/USAR CHAPTER 15 15.4-31 REV. 11, JANUARY 2005 TABLE 15.4.9-4 NOT APPLICABLE

CPS/USAR CHAPTER 15 15.4-32 REV. 12, JANUARY 2007 TABLE 15.4.9-5 CONTROL ROD DROP ACCIDENT EVALUATION PARAMETERS Design Basis Assumptions I. Data and assumptions used to estimate radioactive source from postulated accidents.

A. Power level 3543 MWt B. Burn-up NA C. Fuel damaged (10 x 10) 1200 Rods D. Release of Activity by nuclide Reference 7 E. Iodine fractions Reference 7 F. Reactor coolant activity before the accident. NA II. Data and assumptions used to estimate activity released.

A. Condenser leak rate (%/day) 1.0 B. Turbine building leak rate (%/day) NA C. Valve closure time (sec) NA D. Absorption and filtration efficiencies (1) Organic iodine NA (2) Elemental iodine NA (3) Particulate iodine NA (4) Particulate fission products NA E. Recirculation system parameters (1) Flow rate NA (2) Mixing efficiency NA (3) Filter efficiency NA F. Containment spray parameters (flow rate, drop size, etc.) NA G. Containment volumes NA H. All other pertinent data and assumptions. None CPS/USAR TABLE 15.4.9-5 CONROL ROD DROP ACCIDENT EVALUATION PARAMETERS (Cont'd) CHAPTER 15 15.4-33 REV. 12, JANUARY 2007 Design Basis Assumptions III. Dispersion Data A. Boundary and LPZ distances (m) 975/4018 B. X/Q's for time intervals of (1) 0-2 hr - EAB/LPZ 2.46E-04/5.62E-05 (2) 0-8 hr - LPZ 2.48 E-05 (3) 8-24 hr - LPZ 1.65 E-05 (4) 1-4 days - LPZ 6.81 E-06 (5) 4-30 day - LPZ 1.91 E-06

IV. Dose Data A. Method of dose calculation Reference 7 B. Dose conversion assumptions Reference 7 C. Airborne activity in condenser. Reference 7 D. Doses Table 15.4.9-8

CPS/USAR CHAPTER 15 15.4-34 REV. 12, JANUARY 2007 Table 15.4.9-6 Has Been Deleted

.

CPS/USAR CHAPTER 15 15.4-35 REV. 12, JANUARY 2007 Table 15.4.9-7 Has Been Deleted

CPS/USAR CHAPTER 15 15.4-36 REV. 12, JANUARY 2007 TABLE 15.4.9-8 CONTROL ROD DROP ACCIDENT (DESIGN BASIS ANALYSIS)

RADIOLOGICAL EFFECTS

• TEDE (REM) Exclusion Area Boundry (975 Meters) 0.042 Low Population Zone (4018 Meters) 0.016 Control Room 0.43

• For licensed power level. See Appendix 15D, Reload Analysis, for current cycle analysis.

CPS/USAR CHAPTER 15 15.4-37 REV. 12, JANUARY 2007 Table 15.4.9-9 Has Been Deleted

CPS/USAR CHAPTER 15 15.4-38 REV. 12, JANUARY 2007 Table 15.4.9-10 Has Been Deleted

CPS/USAR CHAPTER 15 15.4-39 REV. 12, JANUARY 2007 TABLE 15.4.9-11 Has Been Deleted CPS/USAR CHAPTER 15 15.5-1 REV. 11, JANUARY 2005 15.5 INCREASE IN REACTOR COOLANT INVENTORY 15.5.1 Inadvertent HPCS/RCIC Pump Startup 15.5.1.1 Identification of Causes and Frequency Classification 15.5.1.1.1 Identification of Causes 15.5.1.1.1.1 Inadvertent HPCS Pump Startup Startup of the HPCS system is postulated for this analysis; i.e., operator error or a false start signal. 15.5.1.1.1.2 Inadvertent RCIC Pump Startup Startup of the RCIC system is postulated in this analysis; i.e., operator error or a false start signal. 15.5.1.1.2 Frequency Classification 15.5.1.1.2.1 Inadvertent HPCS Pump Startup This transient disturbance is categorized as an incident of moderate frequency.

15.5.1.1.2.2 Inadvertent RCIC Pump Startup This transient disturbance is categorized as an incident of moderate frequency.

15.5.1.2 Sequence of Events and Systems Operation 15.5.1.2.1 Sequence of Events 15.5.1.2.1.1 Inadvertent HPCS Pump Startup Table 15.5.1-1 lists the sequence of events for Figure 15.5.1-1.

15.5.1.2.1.2 Inadvertent RCIC Pump Startup Table 15.5.1-2 lists the estimated sequence of events for this system.

15.5.1.2.1.3 Identification of Operator Actions With the recirculation system in either the automatic or manual mode, relatively small changes would be experienced in plant conditions during HPCS initiation. The operator should, after hearing the alarm that the HPCS has commenced operation, check reactor water level and drywell pressure. If conditions are normal, the operator should shut down the system. If RCIC has initiated, the event becomes like a turbine trip, for which operation actions are described in

Subsection 15.2.3.

CPS/USAR CHAPTER 15 15.5-2 REV. 11, JANUARY 2005 15.5.1.2.2 System Operation 15.5.1.2.2.1 Inadvertent HPCS/RCIC Pump Startup In order to properly simulate the expected sequence of events, the analyses of these events assume normal functioning of plant instrumentation and controls specifically, the pressure regulator and the vessel level control which respond directly to these events. In the event of RCIC startup which initiates trip of the turbines, scram is initiated as is the turbine bypass system and safety relief valve operation. Required operation of engineered safeguards other than what is described is not expected for these transient events. The plant is assumed to be in the manual flow control mode of operation. 15.5.1.2.3 The Effect of Single Failures and Operator Errors Inadvertent operation of the HPCS results in a mild depressurization and water level change. Corrective action by the pressure regulator and level control is expected to establish a new stable operating state. The effect of a single failure in the pressure regulator will aggravate the transient depending upon the nature of the failure. Pressure regulator failures are discussed in Subsections 15.1.3 and 15.2.1; such failures are highly unlikely since the regulator must be operating properly before the event is postulated to occur. (This is also true for the feedwater level controls.) The effect of a single failure in the level control system has rather straightforward consequences including level rise or fall by improper control of the feedwater system. Increasing level will trip the turbine and automatically trip the HPCS/RCIC system off. This trip signature is already described in the failure of feedwater controller with increasing flow. Decreasing level will automatically initiate scram at the L3 level trip and will have a signature similar to loss of feedwater control - decreasing flow. Inadvertent operation of RCIC is nearly identical to the Turbine Trip event. (See Section 15.2.3.) 15.5.1.3 Core and System Performance 15.5.1.3.1 Mathematical Model The detailed nonlinear dynamic model described briefly in Subsection 15.2.2.3.1 is used to simulate HPCS/RCIC startup. 15.5.1.3.2 Input Parameter and Initial Conditions, HPCS/RCIC Startup This analysis has been performed unless otherwise noted with plant conditions tabulated in Table 15.0-2. The water temperature of the HPCS/RCIC systems was assumed to be 40

°F with an enthalpy of 11 BTU/Lb.

CPS/USAR CHAPTER 15 15.5-3 REV. 11, JANUARY 2005 Inadvertent startup of the HPCS/RCIC systems was chosen to be analyzed since they provide the greatest auxiliary source of cold water into the vessel. 15.5.1.3.3 Results 15.5.1.3.3.1 Inadvertent HPCS Pump Startup Figure 15.5.1-1 shows the simulated transient event for the manual flow control mode. It begins with the introduction of cold water into the upper core plenum. Within 3 seconds the full HPCS flow is established at approximately 6.2% of the rated feedwater flow rate. This flow is nearly 102% the HPCS flow at rated pressure.

No delays were considered because they are not relevant to the analysis. Addition of cooler water to the upper plenum causes a reduction in steam flow which results in some depressurization as the pressure regulator responds to the event. In the automatic flow control mode, following a momentary decrease, neutron power settles out a level slightly above operating level. In manual mode the flux level settles out slightly below operating level. In either case, pressure and thermal variations are relatively small and no significant consequences are expereienced. MCPR remains above the safety limit and therefore fuel thermal margins are maintained. 15.5.1.3.3.2 Inadvertent RCIC Pump Startup This transient was not simulated because it is bounded by other transient events. RCIC flow (600 gpm) is less than that of HPCS (1400 gpm) and the RCIC pump injects water into the reactor through the head spray nozzle directly above the steam separators and steam dryer.

However, to prevent the possibility of moisture carryover to the main turbine and feedwater turbines the RCIC has logic which will trip these turbines approximately 20 to 25 seconds after RCIC start signal. With this logic, RCIC startup becomes essentially the same as a main turbine trip. Turbine trips are discussed in Subsection 15.2.3. In the RCIC initiation case, the feedwater turbines have also been tripped with the main turbine, but RCIC is already initiated

providing adequate inventory supply. 15.5.1.3.3.3 Consideration of Uncertainties Important analytical factors including reactivity coefficient and feedwater temperature change have been assumed to be at the worst conditions so that any deviations in the actual plant parameters will produce a less severe transient. 15.5.1.4 Barrier Performance Figure 15.5.1-1 indicates a slight pressure reduction from initial conditions for inadvertent HPCS pump startup; therefore, no further evaluation is required as RCPB pressure margins are maintained. RCIC startup conditions are covered by the barrier evaluation provided for the Turbine Trip event (Section 15.2.3). 15.5.1.5 Radiological Consequences Since no activity is released during either an HPCS or RCIC event, a detailed evaluation is not required.

CPS/USAR CHAPTER 15 15.5-4 REV. 11, JANUARY 2005 15.5.2 Chemical Volume Control System Malfunction (or Operator Error)

This section is not applicable to BWR. This is of PWR interest.

15.5.3 BWR Transients Which Increase Reactor Coolant Inventory These events are discussed and considered in sections 15.1 and 15.2.

CPS/USAR CHAPTER 15 15.5-5 REV. 11, JANUARY 2005 TABLE 15.5.1-1 SEQUENCE OF EVENTS FOR INADVERTENT HPCS PUMP STARTUP - FIGURE 15.5.1-1 Time-sec Event 0 Simulate HPCS cold water injection.

2.0 Full flow established for HPCS.

6.0 Depressurization effect stabilized.

CPS/USAR CHAPTER 15 15.5-6 REV. 11, JANUARY 2005 TABLE 15.5.1-2 SEQUENCE OF EVENTS FOR INADVERTENT RCIC PUMP STARTUP Time (sec.) Event 0.0 Inadvertent RCIC initiation signal.

20-25(est.) RCIC initiation sensed and signal generated to trip main and FW turbines. Event sequence follows Table 15.2.3-1 after this time, with scram occurring with the turbine trip 25-30 Full flow established for RCIC, and it provides long term level control.

CPS/USAR CHAPTER 15 15.7-1 REV. 11, JANUARY 2005 15.7 RADIOACTIVE RELEASE FROM SUBSYSTEMS AND COMPONENTS 15.7.1 Radioactive Gas Waste System Leak or Failure The following radioactive gas waste system components are examined under severe failure mode conditions for effects on the plant safety profile: (1) Main condenser gas treatment system failure (2) Malfunction of main turbine gland sealing system (3) Failure of Air Ejector Lines. 15.7.1.1 Main Condenser Offgas Treatment System Failure 15.7.1.1.1 Identification of Causes and Frequency Classification 15.7.1.1.1.1 Identification of Causes Those events which could cause a gross failure in the offgas treatment system are: (1) a seismic occurrence - exceeding the seismic capabilities of the equipment (2) a hydrogen detonation which ruptures the system pressure boundary (3) a fire in the filter assemblies, and (4) failure of adjacent equipmentwhich could subsequently cause offgas equipment failure. The seismic event is considered to be the most probable and is the only conceivable event which could cause significant system damage. The equipment and piping are designed to contain any hydrogen-oxygen detonation which has a reasonable probability of occurring. A detonation is not considered as a possible failure

mode. The decay heat on the filters is insignificant and cannot serve as an ignition source for the filters. The system is isolated from other systems or components which could cause any serious interaction or failure. The only credible event which could result in the release of significant activity to the environment is an earthquake, causing building damage and subsequent rupture of offgas components from falling building debris. Even though the offgas system is designed to uniform building code seismic requirements, an event more severe than the design requirements is arbitrarily assumed to occur, resulting in the failure of the offgas system. The design basis, description, and performance evaluation of the subject system is given in Section 11.3.

CPS/USAR CHAPTER 15 15.7-2 REV. 11, JANUARY 2005 15.7.1.1.1.2 Frequency Classification This seismic event, more severe than the design requirements, is categorized as a limiting fault.

15.7.1.1.2 Sequence of Events and System Operation 15.7.1.1.2.1 Sequence of Events The expected sequence of events following this failure is shown in Table 15.7.1-1. 15.7.1.1.2.2 Identification of Operator Actions Gross failure of this system may require manual isolation of this system from the main condenser. This isolation results in high condenser pressure and a reactor scram. The operator should monitor the turbine-generator auxiliaries and break vacuum as soon as possible. The operator should notify personnel to evacuate the area immediately and notify radiation protection personnel to survey the area and determine requirements for reentry. The time needed for these actions is about 2 minutes. 15.7.1.1.2.3 Systems Operation In analyzing the postulated Offgas System failure, no credit is taken for the operation of plant and reactor protection systems, or of engineered safety features. Credit is taken for functioning of normally operating plant instruments and controls and other systems only in assuming the following: (1) Capability to detect the failure itself - indicated by an alarmed increase in radioactivity levels seen by Area Radiation Monitoring System, in an alarmed loss of flow in the Offgas System, or in an alarmed increase in activity at the vent release. (2) Capability to isolate the offgas system and shutdown the reactor. (3) Operational indicator and annunciators in the main control room. 15.7.1.1.2.4 The Effect of Single Failures and Operator Errors After the initial system gross failure, the inability of the operator to actuate a system isolation could affect the analysis. However, the seismic event which is assumed to occur beyond the present plant design basis for non-safety equipment will undoubtedly cause the tripping of turbine or will lead to a load rejection. This will initiate a scram and negate a need for the operator to initiate a reactor shutdown via system isolation. However for conservatism, the SJAE will be assumed to continue pumping process gas for 30 minutes after the time of the postulated system failure. 15.7.1.1.3 Core and System Performance The postulated failure results in a system isolation necessitating reactor shutdown because of loss of vacuum in the main condenser. This transient has been analyzed in Section 15.2.5.

CPS/USAR CHAPTER 15 15.7-3 REV. 11, JANUARY 2005 15.7.1.1.4 Barrier Performance The postulated failure is the rupture of the Offgas System pressure boundary. No credit is taken for performance of secondary barriers, except to the extent inherent in the assumed equipment release fractions discussed in 15.7.1.1.5 below. 15.7.1.1.5 Radiological Consequences 15.7.1.1.5.1 General Two separate radiological analyses are provided for this accident: (1) The first is based on conservative assumptions considered to be acceptable to the NRC for the purpose of determining adequacy of the plant design to meet 10 CFR Part 100 guidelines. This analysis is referred to as the "design basis analysis". (2) The second is based on assumptions considered to provide a realistic conservative estimate of radiological consequences. This analysis is referred to as the "realistic analysis". Both are based on the following equipment characteristics with respect to retention of radioactive solid daughter products during normal operation of the offgas system. a Offgas Condenser - 100% retained and continuously washed out with condensate b. Cooler Condenser - 100% retained and continuously washed out with condensate. c. Dryer - 100% retained, desiccant and charcoal replaced approximately every five years. d. Charcoal Adsorbers - 100% retained. e. After filter - 100% retained element changed approximately annually. Both analyses assume that the SJAE continues to pump the process gas out of a break near the failed component for 30 minutes after the accident. The release rates for breaks at the SJAE exit and charcoal adsorber entrance are given in Table 15.7.1-4. 15.7.1.1.5.2 Design Basis Analysis The NRC's Standard Review Plan 15.7.1 does not contain specific quantitative regulatory guideline requirements upon which to perform a Design Basis Analysis. Nevertheless, an evaluation, which is believed to produce very limiting conservative results has been performed. The primary differences between this analysis and the Realistic Analysis are in the basic source term and the equipment release fractions. The same analytical techniques used for the realistic analysis are used for this evaluation. Specific parametric values used in this evaluation are presented in Table 15.7.1-2.

CPS/USAR CHAPTER 15 15.7-4 REV. 11, JANUARY 2005 15.7.1.1.5.2.1 Fission Product Release 15.7.1.1.5.2.1.1 Initial Conditions The activity in the Offgas System is based on the following conditions: (1) 2 SCFM air inleakage (2) 100,000

µCi/sec noble gas after 30 minutes delay for a period of 11 months, followed by 1 month of 350,000

µCi/sec at 30 min. An air bleed is used to provide a minimum system air flow rate of 6 SCFM, when main turbine condenser inleakage falls below this value. The inleakage of 2 SCFM assumed for the design basis analyses is therefore an additional conservatism. 15.7.1.1.5.2.1.2 Assumptions Depending on the assumptions as to radionuclide release fractions for each piece of equipment, the assumed single failure of any one of serval equipment pieces could be controlling with respect to dose consequences. The assumed release fractions for the design basis analysis are found in Table 15.7.1-3. The basis for the assumptions for failure of those equipment pieces which are expected to have the worst dose consequence is as follows: (1) Charcoal Adsorbers - Because these vessels are designed with thick walls for detonation resistance, the only credible failure that would result in loss of carbon is a vessel nozzle failure due to collapse of the concrete building during the

seismic event. Assuming that both vessel supports and nozzle fail, it is expected that no more than 10-15% of the carbon would be displaced from the vessel. This percentage of the carbon is assumed to be from the top of the first bed and therefore would contain virtually all of the activity stored in the beds. Because iodine is strongly bonded to the charcoal, it is not expected to be removed by exposure to the air. However, the conservative assumption is made that 1% of the iodine activity contained in the adsorber tanks is released to the vault containing the offgas equipment. Additionally, the conservative assumption is made that 1% of the solid daughters retained in the charcoal is released. Measurements made at KRB indicate that offgas is about 30% richer in Kr than air, therefore 23% of the noble gas inventory of the charcoal exposed to the air should be available for release to the air. However, the first few inches of charcoal will blanket the

underlying charcoal from the air. Because of the small amount of exposed charcoal, the analysis assumption of release of 10% of the noble gas activity is conservative. 15.7.1.1.5.2.2 Fission Product Transport to the Environment The transport pathway consists of direct release from the failed component to the environment through the building ventilation system based on the release fractions given in Table 15.7.1-3.

The inventory of activities in each equipment piece before the assumed failure is presented in Chapter 12. The combined activity releases from failure of the worst single piece of equipment (charcoal adsorber beds) and from letting the SJAE continue to pump for 30 minutes after the failure are given in Table 15.7.1-4a.

CPS/USAR CHAPTER 15 15.7-5 REV. 11, JANUARY 2005 15.7.1.1.5.2.3 Results Dose consequences due to failure of the worst single equipment piece and letting the SJAE continue to pump for 30 minutes out the break is presented on Table 15.7.1-5 and is well below the design dose objective of 0.5 Rem whole body. 15.7.1.1.5.3 Realistic Analysis The realistic analysis is based on an engineered but still conservative assessment of this accident. Specific values of parameters used in the evaluation are presented in Table 15.7.1-2. 15.7.1.1.5.3.1 Fission Product Release 15.7.1.1.5.3.1.1 Initial Conditions The activity in the offgas system is based on the following conditions: (1) 30 SCFM air inleakage.

(2) 100,000

µCi/sec Noble Gas after 30 minutes delay. The activity stored in the various equipment pieces before the postulated failure is given in Chapter 12. 15.7.1.1.5.3.1.2 Assumptions The assumed release fractions for the realistic analysis are found in Table 15.7.1-3. The basis for the assumptions for failure of those pieces of equipment which could have the worst dose consequence are as follows: a. Charcoal Adsorbers - Same as for the design basis analysis except for the solid daughters. There is no reason to believe that any of the solid daughter products formed and retained within the micropore structure of the carbon will be released. Hence no such release is assumed for the realistic analysis. 15.7.1.1.5.3.2 Fission Product Transport to the Environment The release of activity to the environment from failure of a system component is determined by the release fraction of the worst single inventor y in Chapter 12. The combined release from the failed component and from letting the SJAE continue to pump for 30 minutes are given in Table 15.7.1-4b. 15.7.1.1.5.3.3 Results The calculated exposures for the realistic analysis are presented in Table 15.7.1-6, resulting from failure of the worst single equipment piece and letting the SJAE continue to pump for 30

minutes after the assumed failure. 15.7.1.1.6 References

1. Nguyen, D., "Realistic Accident Analysis - The RELAC Code," October 1977, (NEDO-21142).

CPS/USAR CHAPTER 15 15.7-6 REV. 13, JANUARY 2009

2. Meek, M.E., "User's Manual BWR Radiochemical Transport Model, TRACK02", July, 1977, (NEDE - 21153). 15.7.1.2 Malfunction of Main Turbine Gland Sealing System 15.7.1.2.1 Identification of Causes and Frequency Classification 15.7.1.2.1.1 Identification of Causes Instrumentation and controls are provided on the steam seal system to ensure an adequate supply of sealing steam to the turbine glands. Clean steam from the evaporator is the normal source of sealing steam. Main steam reduced in pressure may be used as an emergency backup. It is assumed that all sources of sealing are lost due to multiple control valve malfunction. 15.7.1.2.1.2 Frequency Classification This event is categorized as a limiting fault.

15.7.1.2.2 Sequence of Events and System Operation 15.7.1.2.2.1 Sequence of Events 15.7.1.2.2.2 Identification of Operator Actions The operator should initiate normal shutdown of the reactor to reduce gaseous activity being discharged. 15.7.1.2.2.3 System Operation 15.7.1.2.2.4 The Effects of Single Failures and Operator Errors See Appendix 15A for further details.

15.7.1.2.3 Core and System Performance Failure of turbine shaft sealing steam will result in turbine cycle steam leaking out along the high pressure turbine shaft into the turbine building and air will be drawn into the low pressure turbines along the shaft glands. The cool air quenching of the hot turbine shaft will cause excessive vibration. The turbine will trip from loss of condenser. The failure of this power-conversion system does not directly affect the nuclear steam supply systems (NSSS). It will, of course, lead to decoupling of the NSSS with power-conversion system. The tripping of the main turbine via the main condenser signal will result in an anticipated operational transient examined earlier on in Chapter 15.

This failure has no applicable effect on the core or the NSSS safety performance.

CPS/USAR CHAPTER 15 15.7-7 REV. 11, JANUARY 2005 15.7.1.2.4 Barrier Analysis This release occurs outside the containment hence does not involve any barrier integrity aspects. However, a discussion of the release of the radioactivity to the environment is presented in order to assess the radiological impact relative to applicable safety limits. 15.7.1.2.5 Radiological Consequences 15.7.1.2.5.1 General 15.7.1.2.5.2 Design Basis Analysis 15.7.1.2.5.2.1 Fission Product Release 15.7.1.2.5.2.2 Fission Product Transport to the Environment 15.7.1.2.5.2.3 Results 15.7.1.2.5.3 Realistic Analysis 15.7.1.2.5.3.1 Fission Product Release 15.7.1.2.5.3.2 Fission Product Transport to the Environment 15.7.1.2.5.3.3 Results 15.7.1.2.6 References 15.7.1.3 Failure of Main Turbine Steam Air Ejector Lines 15.7.1.3.1 Identification of Causes and Frequency Classification 15.7.1.3.1.1 Identification of Cause It is assumed that a failure occurs in the steam jet air ejector suction line near the condenser upstream of the isolation valve. There is no specific event identified which would cause failure of this line; however, for the purposes of determining the consequences of this event, the failure is assumed to occur. 15.7.1.3.1.2 Frequency Classification This event is categorized as a limiting fault.

15.7.1.3.2 Sequence of Events and System Operation 15.7.1.3.2.1 Sequence of Events 15.7.1.3.2.2 Identification of Operator Actions It is assumed that the line leading to the steam jet air ejector fails near the condenser. This results in a very rapid loss of condenser vacuum with its associated turbine trip, MSIV closure CPS/USAR CHAPTER 15 15.7-8 REV. 11, JANUARY 2005 and reactor scram. This terminates the release of activity within approximately one minute. There is no continuing release of activity to the building or the environs after the line break. 15.7.1.3.2.3 System Operation 15.7.1.3.2.4 The Effects of Single Failures and Operator Errors See Appendix 15A for further details. 15.7.1.3.3 Core and System Performance The failure of this power-conversion system will, of course, lead to decoupling of the NSSS from power-conversion system. The tripping of the main turbine via main condenser signals will result in an anticipated operational transient examined earlier on in Chapter 15. This failure has no applicable effect on the core or the NSSS safety performance. 15.7.1.3.4 Barrier Analysis There is no release.

15.7.2 Liquid Radioactive System Failure Section 15.7.2 of the Standard Review Plan has been revised such that analysis of this event is no longer required. 15.7.3 Postulated Radioactive Releases Due to Liquid Radwaste Tank Failure 15.7.3.1 Identification of Causes and Frequency Classification 15.7.3.1.1 Identification of Causes The complete release of the average radioactivity inventory of the concentrate waste tank to the environment via the plant stack from an unspecified event is the cause postulated for a radioactive release due to a liquid radwaste tank failure. The concentrate waste tank was chosen as its average radioactivity inventory that can become airborne is the highest for the liquid radwaste system. Postulated events that could cause release of the radioactive inventory of the concentrate waste tank are cracks in the vessels and operator error. The possibility of small cracks and consequent low-level release rates receives primary consideration in system and component design. The concentrate waste tank is designed to operate at atmospheric pressure and 200

° F maximum temperature so the possibility of failure is considered small. A liquid radwaste release caused by operator error is also considered a remote possibility. Operating techniques and administrative procedures emphasize detailed system and equipment operating instruction. The manually operated drain valve in series with the tank discharge valve prevents inadvertent tank draining. Should a release of liquid radioactive wastes occur, floor drain sump pumps in the floor of the radwaste building will receive a high water level alarm, activate automatically, and remove the spilled liquid.

CPS/USAR CHAPTER 15 15.7-9 REV. 11, JANUARY 2005 15.7.3.1.2 Frequency Classification Much of the exposition concerning the remote likelihood of a leakage or malfunction accident of the concentrate waste tank applies equally to a complete release accident. The probability of a complete rupture or complete malfunction accident is however, considered even lower. Although not analyzed for the requirements of Seismic Category I equipment, the liquid radwaste tanks are constructed in accordance with sound engineering principles. Therefore, simultaneous failure of all the tanks is not considered credible. This accident is expected to occur with the frequency of a limiting fault.

15.7.3.2 Sequence of Events and Systems Operation The sequence of events expected to occur is as follows: Sequence of Events Elapsed Time (1) Event begins -- failure occurs 0 (2) Area radiation alarms alert plant personnel 1 minute (3) Operator actions begin 5 minutes The rupture of a concentrate waste tank would leave little recourse to the operator. No method of recontaining the gaseous phase discharge is available, however, isolation of the radwaste area would minimize the results. High radiation alarms both in the radwaste ventilation exhaust and in the radwaste area would alert the operator to the failure. Normal isolation of the radwaste area ventilation is actuated upon initiation of the above alarms. However, no credit for any operator action or for ventilation isolation has been taken in evaluation of this event. 15.7.3.3 Core and System Performance The failure of this liquid radwaste system component does not directly affect the nuclear steam supply system (NSSS). It will, of course, ultimately lead to core limitation or normal shutdown of NSSS. This failure has no applicable effect on the core or the NSSS safety performance.

15.7.3.4 Barrier Performance This event does not involve any containment barrier integrity except the tank itself. A description of the pathway to the environment following the release and the dose impact relative to safety limits is presented next. 15.7.3.5 Radiological Consequences Two separate radiological analyses are provided for this accident:

CPS/USAR CHAPTER 15 15.7-10 REV. 11, JANUARY 2005 (1) The first is based on conservative assumptions Considered to be acceptable to the NRC for the purpose of determining adequacy of the plant design to meet 10 CFR Part 100 guidelines. This analysis is referred to as the "Design Basis

Analysis". (2) The second is based on assumptions considered to provide a realistic conservative estimate of radiological consequences. This analysis is referred to as the "Realistic Analysis". 15.7.3.5.1 Design Basis Analysis The design basis analysis is based on NRC Standard Review Plan 15.7.3 aspects although no specific regulatory guideline requirements are established. The specific models and assumptions are described in Reference 1 and 2. Specific values of parameters used in the evaluation are presented in Table 15.7.3-1. 15.7.3.5.1.1 Fission Product Release Liquid radwaste tank failure parameters are listed in Table 15.7.3-1. Fission product releases are tabulated in Table 15.7.3-2. The tank with the highest iodine inventory that can become airborne is assumed to fail releasing the entire contents of this tank (equal to 80% of the tank capacity) to the radwaste enclosure. 15.7.3.5.1.2 Fission Product Transport to the Environment Table 15.7.3-2 presents the release of activity to the environment.

15.7.3.5.1.3 Results Table 15.7.3-3 presents the radiological doses for this accident.

15.7.3.5.2 Realistic Analysis The realistic analysis is based on an engineering (but still conservative) assessment of this accident. The specific models and assumptions are also described in References 1 & 2.

Specific values of parameters used in the evaluation are presented in Table 15.7.3-1. 15.7.3.5.2.1 Fission Product Release The fission product releases are tabulated in Table 15.7.3-4. These values are based on an offgas release rate of 100,000

µCi/sec at 30 minutes decay. 15.7.3.5.2.2 Fission Product Transport to the Environment Table 15.7.3-4 presents the information on activity released to the environment.

15.7.3.5.2.3 Results Table 15.7.3-5 presents the radiological doses for this accident.

CPS/USAR CHAPTER 15 15.7-11 REV. 12, JANUARY 2007 15.7.3.6 References

1. Regulatory Guide 1.3, "Assumptions Used for Evaluating the Potential Radiological Consequences of a Loss of Coolant Accident for Boiling Water Reactors," Revision 2, June 1974. 2. Regulatory Guide 1.109, "Calculation of Annual Doses to Man From Routine Releases of Reactor Effluents for the Purpose of Evaluating Compliance With 10CFR50, Appendix I, Revision 1, October 1977. 3. "Calculation of Distance Factors for Power and Test Reactor Sites," Technical Information Document # TID-14844, March 1962. 15.7.4 Fuel Handling Accident 15.7.4.1 Identification of Causes and Frequency Classification 15.7.4.1.1 Identification of Causes The fuel handling accident is assumed to occur as a consequence of a failure of the fuel assembly lifting mechanism resulting in the dropping of a raised fuel assembly onto stored fuel bundles. A variety of events which qualify for the class of accidents termed "fuel handling accidents" has been investigated. These included considerations for containment upper pool refueling operations as well as fuel building-pool activities. The accident which produces the largest number of failed spent fuel rods is the drop of a spent fuel bundle onto the reactor core when the reactor vessel head is off. 15.7.4.1.2 Frequency Classification This event has been categorized as a limiting fault.

15.7.4.2 Sequence of Events and Systems Operation A new set of radiological consequence analyses were performed utilizing Alternative Source Term (AST) methodology for the Fuel Handling Accident (FHA) per Regulatory Guide (RG) 1.183, "Alternative Radiological Source Terms for Evaluating Design Basis Accidents at Nuclear Power Reactors" and meeting the requirements of 10CFR50.67, "Accident Source Term". Implementation of AST for FHA consisted of the following steps.

• Identification of the bounding AST FHA based on analysis of core fission product inventory and FHA damage potential,

• Identification of appropriate release pathways and the corresponding atmospheric dispersion parameters,

• Calculation of the resulting releases for the FHA that could potentially result in control room and offsite doses, and

• Calculation of the exclusion area boundary (EAB), low population zone (LPZ), and control room personnel Total Effective Dose Equivalent (TEDE) doses.

CPS/USAR CHAPTER 15 15.7-12 REV. 12, JANUARY 2007 The RADTRAD computer code developed for and endorsed by the NRC for AST analyses was used in the calculations. The RADTRAD program is a radiological consequence analysis code used to estimate post-accident doses at plant offsite locations and in the control room. The AST FHA analyses take no credit for SGTS operation, secondary containment isolation, or control room air intake or recirculation filtration for the full duration of the accident event. The fission product inventories for the damaged fuel in the RADTRAD analysis were determined based on the licensed core power level following extended power uprate (EPU) of 3473 megawatts thermal (MWt) and further adjusted to 102% (3542 MWt). The atmospheric dispersion factors (X/Q) utilized are as found in Subsections 2.3.4 and 15.6.5.5. Assumptions used in the AST analysis for the FHA and the results are summarized below. This design basis AST FHA justifies the changes to Technical Specification (TS) requirements for the operability of certain Engineered Safety Feature (ESF) systems while fuel is being handled and during core alterations. In the most conservative FHA scenario, an irradiated fuel assembly is postulated to drop 34 feet onto the reactor core and cause the release of fission products from inside the fuel cladding that fails because of the impact. This scenario results in the largest number of fuel rod cladding failures and occurs in the primary containment building. This is because the fuel bundle drop in containment is from 34 feet and the corresponding FHA in the fuel building is from six feet. The analysis was based on the GE 14 fuel bundle type that was conservatively assumed to have been from a core operated at a reactor power level of 3542 MWt. This is two percent above the licensed power level of 3473 MWt, in order to account for uncertainty in the bounding analysis. The use of GE 14 fuel bundle is bounding because the other fuel bundle type in the core is GE 10 fuel which has a smaller peaking factor than the GE 14 fuel peaking factor. Specifically, the GE 14 fuel bundle has a peaking factor of 1.7, which is higher than the GE 10 fuel bundle peaking factor of 1.5. The higher peaking factor yields a larger source term. This bounding FHA was analyzed based on the AST provision for the condition when primary containment, secondary containment, and Standby Gas Treatment Systems (SGTS) are inoperable. This analysis demonstrates that the offsite and control room dose limits as specified in 10CFR50.67 would not be exceeded for irradiated fuel that had been allowed to decay for 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />. The 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> decay time is based on the minimum requirement for reactor sub-criticality prior to fuel movement as defined in the Operational Requirements Manual (ORM). By demonstrating that the dose limits will be met after a 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> decay period, fuel assemblies can be handled without primary and secondary containment systems operable and without the SGTS operable. No credit is taken for administrative actions to manually close doors, hatches, and penetrations. The key assumptions for the analysis are as follows: 1. The analysis is based on guidance in RG 1.183 and Standard Review Plan 15.0.1. 2. The damaged fuel is assumed to be decayed for 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />. 3. The limiting high burnup fuel type, GE 14, that has a radial peaking factor of 1.7, was used to derive the source term. 4. The reactor power level is consevatively rated at 102% of the licensed power level (3542 MWt) which accounts for uncertainty. 5. The dual inlet control room ventilation is used including the radiation monitors at the inlets consistent with the requirements of the control room ventilation system TS.

CPS/USAR CHAPTER 15 15.7-13 REV. 12, JANUARY 2007 6. The existing atmospheric dispersion factors for the EAB, the LPZ, and the control room in the USAR continue to apply. 7. For this analysis, the limiting FHA occurs in the primary containment. 8. The FHA is as described in GE document NEDE-24011-P-A-14-US, dated June 2000, which results in 172 failed fuel rods that is caused by a 34 foot drop of a GE 14 fuel bundle that has a 10 x 10 array of fuel onto the reactor core. The NF-500 fuel handling mast is assumed to fall onto the core along with the fuel bundle. 9. Although the depth of the water in the containment assumed for this analysis is over 34 feet, the decontamination factors are conservatively based on a 23 foot depth of water. The TS minimum required water level above the top of the reactor pressure vessel flange is 22 feet and 8 inches. 10. The offsite dose limit is 6.3 Rem Total Effective Dose Equivalent (TEDE) and the control room dose limit is 5 Rem TEDE for the worst case two hour release period. 11. Primary and secondary containment isolations were not credited. 12. The SGTS filtration was not credited. 13. The release of radioactive material was assumed to be directly into the wake of the containment and the ventilation flow into the control room enters through one of the two normal inlets that have radiation monitoring systems. 14. For the limiting scenario, filtration for the control room ventilation intake flow and recirculation flow is inoperable. 15. The calculated EAB dose bounds the LPZ dose. Because the dose limits are equal, EAB dose was used in the analysis. 16. No credit is taken for atmospheric dilution or mixing in the containment. A summary of the analysis assumptions is provided in Table 15.7.4-1. 15.7.4.3 Radiological Consequences The resulting dose consequences as calculated using AST releases and the other AST assumptions as described above for offsite and control room doses are provided in Table 15.7.4-4. As indicated, all results are within the AST acceptance criteria. The results indicate that the calculated consequences of a design basis FHA at or after 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> of shutdown will be within regulatory limits without the requirement of containment closure, the need to have SGTS filtration, or the control room emergency ventilation system operational during fuel movement.

15.7.4.4 References

1. Calculation C-022, Rev. 0, dated March 26, 2002, "Site Boundary and Control Room Dose following a FHA in Containment using Alternative Source Term.

CPS/USAR CHAPTER 15 15.7-14 REV. 11, JANUARY 2005 15.7.5 Cask Drop Accident 15.7.5.1 Identification of Causes This accident is postulated to occur as a consequence of an unspecified failure of the cask lifting mechanism, thereby allowing the cask to fail. 15.7.5.2 Starting Conditions and Assumptions It is postulated that a spent fuel shipping cask containing irradiated fuel elements is in the process of being removed from the cask storage pool to a shipping car. The cask is suspended from the crane at the maximum crane hook height of approximately 59 feet above the pool floor. Although a cask for use at the Clinton Power Station has not been purchased, it will be designed to sustain a free fall in air of 30 feet onto an unyielding surface without failure in accordance with 10CFR71. Cask length is assumed to be 16.1 feet, which is one of the shorter casks available, to determine the height of fall. 15.7.5.3 Evaluation of Effects 15.7.5.3.1 Damage to the Cask If the cask is accidentally released from the crane from its position of maximum height, it will fall into the cask storage pool, or into the cask washdown area, or onto the railroad tracks near the shipping car. In the first case, the cask will fall 12.4 feet through air and 30.5 feet through water; whereas in the other cases, it will drop 19 feet 11 inches and 17 feet 11 inches, respectively, through air. In all of the above cases, the cask should not rupture. 15.7.5.3.2 Damage to the Stored Spent Fuel The cask cannot travel over the spent fuel storage pool because structural barriers and a redundant limit switch on the crane lifting mechanism prevent lifting the cask high enough to clear the pool walls. Also, 100% capacity rail stops are located on the crane rails to prevent bridge travel over the spent fuel storage pool. (See Subsection 9.1.4 .2.2.2 for a description of the fuel building crane.) Hence, the stored spent fuel cannot be damaged in a cask drop accident. 15.7.5.3.3 Damage to Other Safety Equipment and Structures No nuclear safety-related equipment is located in the areas that can be directly affected by a dropped cask. The underside of the concrete slab could spall causing pieces of concrete to fall on safety-related equipment below. Procedural restrictions are in place to ensure safe handling of the cask. Also, the pools are arranged so that a rupture of the cask storage pool floor cannot drain water from the spent fuel storage pool. The arrangements of the various pools and their inter-connections are shown in Drawings M01-1105 through M01-1114. 15.7.5.4 Radiological Consequences There are no radiological consequences associated with a postulated cask drop since no release of radioactivity is postulated.

CPS/USAR CHAPTER 15 15.7-15 REV. 11, JANUARY 2005 TABLE 15.7.1-1 SEQUENCE OF EVENTS FOR MAIN CONDENSER GAS TREATMENT SYSTEM FAILURE Approximate Elapsed Time Event 0 sec. Event begins - system fails 0 sec. Noble gases are released < 1 min. Area radiation alarms alert plant personnel

< 1 min. Operator actions begin with a) initiation of appropriate system isolations b) manual scram actuation c) assurance of reactor shutdown cooling.

CPS/USAR CHAPTER 15 15.7-16 REV. 11, JANUARY 2005 TABLE 15.7.1-2 GASEOUS RADWASTE SYSTEM FAILURE - PARAMETERS TABULATED FOR POSTULATED ACCIDENT ANALYSES Design Basis Assumptions Realistic Basis Assumptions I. Data and assumptions used to estimate radioactive source for postulated accidents A. Power level NA NA B. Burn-up NA NA C. Fuel Damage None None D. Release of activity by nuclide Table 15.7.1-4a Table 15.7.1-4b E. Iodine fractions (1) Organic 0 0 (2) Elemental 1.0 1.0 (3) Particulate 0 0 F. Reactor coolant activity before the accident NA NA II. Data and assumptions used to estimate activity released A. Containment leak rate (%/day) NA NA B. Secondary containment leak rate

(%/day) NA NA C. Valve Movement times NA NA D. Adsorption and filtration efficiencies NA NA (1) Organic Iodine NA NA (2) Elemental Iodine NA NA (3) Particulate Iodine NA NA (4) Particulate fission products NA NA E. Recirculation system parameters NA NA (1) Flow rate NA NA (2) Mixing Efficiency NA NA (3) Filter Efficiency NA NA F. Containment spray parameters (flow rate, drop size, etc.) NA NA G. Contaiment volumes NA NA H. All other pertinent data and assumptions None None III. Dispersion Data A. Boundary and LPZ distances (m) 975/4018 975/4018 B. X/Q's for SB/LPZ 1.8E-4/4.2E-5 1.8E-4/4.2E-5

CPS/USAR TABLE 15.7.1-2 (Cont'd) CHAPTER 15 15.7-17 REV. 11, JANUARY 2005 Design Basis Assumptions Realistic Basis Assumptions IV. Dose Data A. Method of dose calculation Reference 1 Reference 1 B. Dose conversion assumptions Reference 1 Reference 1 C. Peak activity concentrations in containment NA NA D. Doses Table 15.7.1-5 Table 15.7.1-6 CPS/USAR CHAPTER 15 15.7-18 REV. 11, JANUARY 2005 TABLE 15.7.1-3 EQUIPMENT FAILURE RELEASE ASSUMPTIONS RELEASE FRACTIONS ASSUMED FOR DESIGN BASlS/REALISTIC ANALYSI S Equipment Piece Noble Gases Solid Daughters Radioiodine Preheater 1.00/1.00 1.00/1.00 N/A Catalytic Recombiner 1.00/1.00 1.00/1.00 N/A Offgas Condenser 1.00/1.00 1.00/1.00 N/A Cooler Condenser 1.00/1.00 1.00/1.00 N/A Desiccant Dryer Desiccant 1.00/0.10 0.01/0.01 N/A Desiccant Dryer Charcoal 0.10/0.10 0.01/0.0 N/A Gas Cooler 1.00/1.00 1.00/1.00 N/A Charcoal Adsorbers 0.10/0.10 0.01/0.00 0.01/0.01 Afterfilter 1.00/1.00 0.01/0.01 N/A CPS/USAR CHAPTER 15 15.7-19 REV. 11, JANUARY 2005 TABLE 15.7.1-4a GASEOUS RADWASTE SYSTEM FAILURE (DESIGN BASIS ANALYSIS)

ACTIVITY RELEASE TO ENVIRONMENT (CURIES)

ISOTOPE CI ISOTOPE CI ISOTOPE CI ISOTOPE CI I-131 1.0E-02 C-14 6.4E-04 SR-92 1.5E-03 TE-131M 1.4E-07 I-132 1.3E-01 NA-24 4.1E-06 Y-90 2.8E-09 TE-131 2.9E-05 I-133 7.6E-02 P-32 4.1E-08 Y-91M 8.5E-06 TE-132 1.1E-06 I-134 2.3E-01 CR-51 9.7E-07 Y-91 8.3E-08 CS-137 7.7E-06 I-135 1.2E-01 MN-54 4.7E-08 Y-92 5.2E-06 CS-138 7.1E-03 KR-83M 3.1E+01 MN-56 1.1E-04 Y-93 3.4E-06 BA-139 5.8E-04 KR-85M 7.0E+01 FE-59 1.5E-07 ZR-95 1.8E-07 BA-140 4.7E-05 KR-85 1.3E+00 CO-58 8.6E-06 ZR-97 1.7E-06 BA-141 2.5E-03 KR-87 1.4E+02 CO-60 3.8E-07 NB-95 1.6E-07 BA-142 4.1E-03 KR-88 1.9E+02 NI-65 6.3E-07 MO-99 1.7E-06 LA-140 3.2E-07 KR-89 1.3E+03 ZN-65 2.7E-09 TC-99M 9.0E-04 LA-142 2.0E-05 XE-131M 1.4E+01 BR-83 1.4E-02 TC-101 1.2E-03 CE-141 2.0E-07 XE-133M 2.2E+01 BR-84 3.1E-02 RU-103 1.1E-07 CE-143 9.9E-07 XE-133 1.5E+03 BR-85 2.9E-02 RU-105 1.1E-06 CE-144 7.7E-08 XE-135M 1.8E+02 RB-98 6.0E+00 RU-106 4.7E-09 PR-143 2.7E-07 XE-135 2.3E+02 RB-89 2.0E-02 AG-110M 2.3E-07 ND-147 1.1E-07 XE-137 1.5E+03 SR-89 2.9E-05 TE-129M 2.7E-08 W-187 2.0E-05 XE-138 7.4E+02 SR-90 1.5E-07 TE-129 4.0E-06 NP-239 1.3E-03 H-3 5.3E-04 SR-91 4.3E-04

CPS/USAR CHAPTER 15 15.7-20 REV. 11, JANUARY 2005 TABLE 15.7.1-4b GASEOUS RADWASTE SYSTEM FAILURE (REALISTIC BASIS ANALYSIS)

ACTIVITY RELEASE TO ENVIRONMENT (CURIES)

ISOTOPE CI ISOTOPE CI ISOTOPE CI ISOTOPE CI I-131 3.4E-03 C-14 1.6E-05 SR-92 5.0E-04 TE-131M 4.5E-08 I-132 4.3E-02 NA-24 4.1E-06 Y-90 5.6E-10 TE-131 9.5E-06 I-133 2.5E-02 P-32 4.1E-08 Y-91M 2.9E-06 TE-132 3.6E-07 I-134 7.9E-02 CR-51 9.7E-07 Y-91 2.7E-08 CS-137 5.4E-08 I-135 4.0E-2 MN-54 4.7E-08 Y-92 1.7E-06 CS-138 1.7E-03 KR-83M 1.1E+01 MN-56 1.1E-04 Y-93 1.2E-06 BA-139 2.0E-04 KR-85M 2.7E+01 FE-59 1.5E-07 ZR-95 6.1E-08 BA-140 1.5E-05 KR-85 4.7E-02 CO-58 8.6E-06 ZR-97 5.8E-07 BA-141 8.5E-04 KR-87 5.4E+01 CO-60 3.8E-07 NB-95 5.4E-08 BA-142 1.4E-03 KR-88 7.0E+01 NI-65 6.3E-07 MO-99 5.6E-07 LA-140 1.1E-07 KR-89 4.1E+02 ZN-65 2.7E-09 TC-99M 3.1E-04 LA-142 6.7E-06 XE-131M 4.3E+00 BR-83 4.7E-03 TC-101 3.8E-04 CE-141 6.7E-08 XE-133M 9.7E+00 BR-84 1.0E-02 RU-103 3.6E-08 CE-143 3.2E-07 XE-133 5.5E+02 BR-85 9.9E-03 RU-105 3.6E-07 CE-144 2.5E-08 XE-135M 5.9E+01 RB-88 5.0E-04 RU-106 1.5E-09 PR-143 9.0E-08 XE-135 1.4E+02 RB-89 6.5E-03 AG-110M 7.6E-08 ND-147 3.8E-08 XE-137 4.9E+02 SR-89 4.1E-06 TE-129M 9.2E-09 W-187 6.3E-06 XE-138 2.3E+02 SR-90 5.0E-08 TE-129 1.3E-06 NP-239 4.5E-04 H-3 5.0E-04 SR-91 1.4E-04

CPS/USAR CHAPTER 15 15.7-21 REV. 11, JANUARY 2005 TABLE 15.7.1-5 GASEOUS RADWASTE SYSTEM FAILURE (DESIGN BASIS ANALYSIS)

OFF-SITE RADIOLOGICAL EFFECTS (REM)

Bone Liver T. Body Thyroid Kidney Lung GI-LLI Exclusion Area (975 Meters) 1.2-5* 4.2-5 1.9-1 2.8-3 4.0-5 1.8-6 1.4-5 Low Population Zone (4018 Meters) 2.8-6 9.9-6 4.5-2 6.5-4 9.4-6 4.1-7 3.2-6 NOTE: *1.2-5 = 1.2x10

-5 CPS/USAR CHAPTER 15 15.7-22 REV. 11, JANUARY 2005 TABLE 15.7.1-6 GASEOUS RADWASTE SYSTEM FAILURE. (REALISTIC BASIS ANALYSIS)

OFF-SITE RADIOLOGICAL EFFECTS (REM)

Bone Liver T. Body Thyroid Kidney Lung GI-LLI Exclusion Area (975 Meters) 4.0-6* 8.1-6 6.4-2 9.3-4 1.3-5 5.1-7 4.4-6 Low Population Zone (4018 Meters) 9.3-7 1.9-6 1.5-2 2.2-4 3.1-6 1.2-7 1.0-6

• 4.0-6 = 4.0x10

-6 CPS/USAR CHAPTER 15 15.7-23 REV. 11, JANUARY 2005 TABLE 15.7.3-1 LIQUID RADWASTE TANKS FAILURE - PARAMETERS TABULATED FOR POSTULATED ACCIDENT ANALYSES Design Basis Assumptions Realistic Basis Assumptions I. Data and assumptions used to estimate radioactive source from postulated accidents.

A. Power Level NA NA B. Burn-up NA NA C. Fuel Damaged NA NA D. Release of activity by nuclide Table 15.7.3-2 Table 15.7.3-4 E. Iodine Fractions (1) Organic 0.0 0.0 (2) Elemental 1.0 1.0 (3) Particulate 0.0 0.0 F. Reactor coolant activity before the accident NA NA II. Data and assumptions used to estimate activity released A. Containment Leak rate (%/day) NA NA B. Secondary containment leak rate

(%/day) NA NA C. Valve movement times NA NA D. Adsorption and filtration efficiencies NA NA (1) Organic Iodine NA NA (2) Elemental Iodine NA NA (3) Particulate Iodine NA NA (4) Particulate fission products NA NA E. Recirculation system parameters NA NA (1) Flow rate NA NA (2) Mixing Efficiency NA NA (3) Filter Efficiency NA NA F. Containment spray parameters (flow rate, drop size, etc.)

Containment volumes NA NA NA NA H. All other pertinent data and assumptions None None III. Dose Data

A. Method of dose calculation Ref 1&2 Ref 1&2 B. Dose conversion assumptions Peak activity concentrations in containment Ref 3 NA Ref 3 NA CPS/USAR TABLE 15.7.3-1 (Cont'd) LIQUID RADWASTE TANKS FAILURE - PARAMETERS TABULATED FOR POSTULATED ACCIDENT ANALYSES CHAPTER 15 15.7-24 REV. 11, JANUARY 2005 Design Basis Assumptions Realistic Basis Assumptions D. Doses Table 15.7.3-3 Table 15.7.3-5 IV. Dispersion Data

A. Site boundary and LPZ distance (m) 975/4018 975/4018 B. X/Q'a for 0-2 hour SB/LPZ 1.8E-4/4.2E-5 1.8E-4/4.2E-5

CPS/USAR CHAPTER 15 15.7-25 REV. 11, JANUARY 2005 TABLE 15.7.3-2 LIQUID RADWASTE SYSTEM FAILURE (DESIGN BASIS ANALYSIS)

ACTIVITY RELEASE TO ENVIRONMENT (CURIES)

I-131 I-132 I-133 I-134 I-135 Concentrated Waste Tanks 16 5.8E-2 4.3E-1 3.2E-4 3.4E-1 TOTAL 16 5.8E-2 4.3E-1 3.2E-4 3.4E-1

CPS/USAR CHAPTER 15 15.7-26 REV. 11, JANUARY 2005 TABLE 15.7.3-3 LIQUID RADWASTE SYSTEM FAILURE (DESIGN BASIS ANALYSIS)

RADIOLOGICAL EFFECTS Whole Body Dose (REM)

Inhalation Dose (REM)

Exclusion Area (975 Meters) 3.7E-04 1.5E-00 Low Population Zone (4018 Meters) 8.6E-05 3.5E-01

CPS/USAR CHAPTER 15 15.7-27 REV. 11, JANUARY 2005 TABLE 15.7.3-4 LIQUID RADWASTE SYSTEM FAILURE (REALISTIC ANALYSIS)

ACTIVITY RELEASE TO ENVIRONMENT (CURIES)

I-131 I-132 I-133 I-134 I-135 Concentrated Waste Tank 1.6E-00 5.8E-00 4.3E-02 3.2E-05 3.4E-02 TOTAL 1.6E-00 5.8E-00 4.3E-02 3.2E-05 3.4E-02

CPS/USAR CHAPTER 15 15.7-28 REV. 11, JANUARY 2005 TABLE 15.7.3-5 LIQUID RADWASTE SYSTEM FAILURE (REALISTIC ANALYSIS)

RADIOLOGICAL EFFECTS Whole Body Dose (REM)

Thyroid Insulation Dose (REM) Exclusion Area 3.7E-05 1.5E-01 (975 Meters)

Low Population Zone 8.6E-06 3.5E-02 (4018 Meters)

CPS/USAR CHAPTER 15 15.7-29 REV. 12, JANUARY 2007 TABLE 15.7.4-1 FUEL HANDLING ACCIDENT PARAMETERS TABULATED FOR POSTULATED ACCIDENT ANALYSIS I. Data and assumptions used to estimate radioactive source from postulated accidents A. Power Level 3542 MWt B. Radial peaking factor 1.7 C. Fuel Damaged (in a 10 X 10 array) 172 rods D. Release of Activity from fuel by Nuclide (1) I-131 8% (2) Other Halogens 5% (3) Kr-85 10% (4) Other Noble Gases 5% E. Iodine fractions from fuel (1) Organic 0.15% (2) Elemental 4.85% (3) Particulate 95% II. Data and assumptions used to estimate activity released A. Release period 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> B. Overall pool decontamination factor for iodine isotopes 200 C. Overall pool decontamination factor For noble gases 1 D. Filtration (SGTS and Control Room) efficiencies (%)

0 E. All other pertinent data and assumptions None III Dispersion Data A. Boundary and LPZ distances (m) 975 / 4018 B. X/Q for time intervals of (1) 0-2 hr - EAB/LPZ 1.8E-4 / 4.2E-5 (2) 2-8 hr - LPZ 1.3E-5 (3) 8-24 hr - LPZ 8.2E-6 (4) 1-4 days - LPZ 3.3E-6 (5) 4-30 days - LPZ 1.6E-6 CPS/USAR CHAPTER 15 15.7-30 REV. 12, JANUARY 2007 Table 15.7.4-2 Deleted CPS/USAR CHAPTER 15 15.7-31 REV. 12, JANUARY 2007 Table 15.7.4-3 Deleted CPS/USAR CHAPTER 15 15.7-32 REV. 12, JANUARY 2007 TABLE 15.7.4-4 FUEL HANDLING ACCIDENT RADIOLOGICAL EFFECTS Location and Time Dose (REM TEDE)

Reg. Limit (REM TEDE)

EAB 0 - 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> 0.45 6.3 LPZ 0 - 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> 0.11 6.3 Control Room 30 days (worst case) 0.8 5.0 CPS/USAR CHAPTER 15 15.7-33 REV. 11, JANUARY 2005 Table 15.7.4-5 FUEL HANDLING ACCIDENT (REALISTIC ANALYSIS ACTIVITY AIRBORNE IN THE REFUELING BUILDING (CURIES)

ISOTOPE 1 MIN 1 HR 2 HRS 8 HRS 1 DAY 4 DAYS 30 DAYS I-131 6.57E 01 6.54E 01 6.51E 01 6.31E 01 5.82E 01 4.04E 01 1.71E 00 I-132 8.48E 00 6.28E 00 4.63E 00 7.43E-01 5.65E-03 1.59E-12 0.

I-133 1.25E 01 1.21E 01 1.17E 01 9.48E 00 5.43E 00 4.41E-01 1.66E-10 I-134 9.16E-07 4.20E-07 1.90E-07 1.63E-09 4.98E-15 0. 0. I-135 1.31E 00 1.18E 00 1.06E 00 5.58E-01 1.01E-01 4.65E-05 0.

TOTAL 8.80E 01 8.49E 01 8.24E 01 7.39E 01 6.37E 01 4.08E 01 1.71E 00

KR-83M 3.79E-01 2.49E-01 1.63E-01 1.27E-02 1.41E-05 0. 0. KR-85M 1.66E 01 1.36E 01 1.11E 01 3.22E 00 1.20E-01 4.36E-08 0. KR-85 4.55E 02 4.33E 02 4.11E 02 3.03E 02 1.34E 02 3.44E 00 5.93E-14 KR-87 1.19E-03 6.60E-04 3.63E-04 1.00E-05 7.02E-10 0. 0.

KR-88 2.82E 00 2.10E 00 1.56E 00 2.60E-01 2.19E-03 9.82E-13 0.

KR-89 1.28E-05 2.88E-11 5.18E-17 0. 0. 0. 0.

XE131M 5.32E 01 5.04E 01 4.78E 01 3.47E 01 1.48E 01 3.19E-01 1.23E-15 XE133M 7.16E 02 6.72E 02 6.31E 02 4.30E 02 1.55E 02 1.56E 00 0. XE-133 6.22E 03 5.88E 03 5.56E 03 3.97E 03 1.61E 03 2.78E 01 1.59E-14 XE135M 8.31E-01 5.46E-02 3.42E-03 2.09E-10 0. 0. 0.

XE-135 1.90E 03 1.67E 03 1.48E 03 6.91E 02 9.14E 01 1.00E-02 0.

XE-137 9.04E-06 2.03E-10 3.79E-15 0. 0. 0. 0.

XE-138 2.48E-05 1.32E-06 6.70E-08 1.14E-15 0. 0. 0. TOTAL 9.36E 03 8.73E 03 8.14E 03 5.43E 03 2.01E 03 3.31E 01 7.64E-14

CPS/USAR CHAPTER 15 15.7-34 REV. 12, JANUARY 2007 Table 15.7.4-6 FUEL HANDLING ACCIDENT (REALISTIC ANALYSIS)

ACTIVITY RELEASED TO THE ENVIRONMENT (CURIES)

ISOTOPE 1 MIN 1 HR 2 HRS 8 HRS 1 DAY 4 DAYS 30 DAYS I-131 5.57E-05 3.33E-03 6.65E-03 2.62E-02 7.55E-02 2.54E-01 6.41E-01 I-132 7.20E-06 3.73E-04 6.49E-04 1.30E-03 1.42E-03 1.42E-03 1.42E-03 I-133 1.06E-05 6.25E-04 1.23E-03 4.44E-03 1.04E-02 1.76E-02 1.83E-02 I-134 7.81E-13 3.26E-11 4.73E-11 5.94E-11 5.95E-11 5.95E-11 5.95E-11 I-135 1.11E-06 6.31E-05 1.20E-04 3.58E-04 5.76E-04 6.24E-04 6.24E-04 TOTAL 7.46E-05 4.39E-03 8.65E-03 3.23E-02 8.78E-02 2.74E-01 6.62E-01

KR-83M 3.22E-04 1.58E-02 2.61E-02 4.41E-02 4.56E-02 4.56E-02 4.56E-02 KR-85M 1.41E-02 7.67E-01 1.39E 00 3.33E 00 4.10E 00 4.13E 00 4.13E 00 KR-85 3.86E-01 2.26E 01 4.40E 01 1.52E 02 3.21E 02 4.52E 02 4.55E 02 KR-87 1.01E-06 4.59E-05 7.12E-05 1.01E-04 1.02E-04 1.02E-04 1.02E-04 KR-88 2.39E-03 1.25E-01 2.17E-01 4.38E-01 4.82E-01 4.82E-01 4.82E-01 KR-89 1.22E-08 6.14E-08 6.14E-08 6.14E-08 6.14E-08 6.14E-08 6.14E-08 XE131M 4.51E-02 2.63E 00 5.13E 00 1.76E 01 3.66E 01 5.05E 01 5.08E 01 XE133M 6.07E-01 3.53E 01 6.84E 01 2.28E 02 4.48E 02 5.70E 02 5.71E 02 XE-133 5.27E 00 3.08E 02 5.98E 02 2.04E 03 4.16E 03 5.59E 03 5.62E 03 XE135M 7.20E-04 1.50E-02 1.59E-02 1.60E-02 1.60E-02 1.60E-02 1.60E-02 XE-135 1.61E 00 9.07E 01 1.71E 02 4.86E 02 7.27E 02 7.64E 02 7.64E 02 XE-137 8.40E-09 5.06E-08 5.06E-08 5.06E-08 5.06E-08 5.06E-08 5.06E-08 XE-138 2.15E-08 4.22E-07 4.43E-07 4.44E-07 4.44E-07 4.44E-07 4.44E-07 TOTAL 7.93E 00 4.60E 02 8.88E 02 2.93E 03 5.70E 03 7.43E 03 7.46E 03 CPS/USAR CHAPTER 15 15.7-35 REV. 11, JANUARY 2005 TABLE 15.7.4-7 FUEL HANDLING ACCIDENT (REALISTIC ANALYSIS)

RADIOLOGICAL EFFECTS Whole Body Dose (REM)

Inhalation Dose (REM)

Exclusion Area ( 975 Meters) 3.2E-03 6.3E-04 Low Population Zone (4018 Meters) 1.6E-03 8.0E-04

CPS/USAR CHAPTER 15 15.8-1 REV. 11, JANUARY 2005 15.8 ANTICIPATED TRANSIENTS WITHOUT SCRAM (ATWS) 15.8.1 Capabilities of Present BWR/6 Design to Accommodate ATWS Studies were performed by General Electric to determine the reliability of the existing scram system. The probability of an anticipated transient without scram (ATWS) event is significantly less than the probability of a design basis event. In the extremely remote possibility that such an event should occur, the recirculation pump trip system will quickly reduce reactor power following an ATWS. Operator action can also be taken to insert control rods or activate the standby liquid control system and achieve subcriticality independent of rod insertion. ATWS requirements are normal scram failure in addition to the single failure criteria incorporated in the general design criteria. This philosophy of more than the single failure criteria is beyond the design basis events described in Chapter 15. The Clinton design meets the general design criteria and also meets the r equirements of 10CFR50.62, Requirements for Reduction of Risk from Anticipated Transients Without Scram (ATWS) events for Light Water Cooled Nuclear Power Plants. For the BWR, these requirements are alternate rod insertion (ARI), a manual standby liquid control system (SLCS) and automatic recirculation pump trip (RPT). Accordingly, this plant design will retain the present design for protection against failure to scram as discussed in Appendix 15A. The following transients are bounded by assumptions in the referenced GE licensing topical reports and Appendix 15A. 15.8.2 Inadvertent Control Rod Withdrawal 15.8.3 Loss of Feedwater 15.8.4 Loss of AC Power 15.8.5 Loss of Electrical Load 15.8.6 Loss of Condenser Vacuum 15.8.7 Turbine Trip 15.8.8 Closure of Main Steam Line Isolation Valves 15.8.9 References

1. Hatch Unit 1 FSAR, Amendment 10, Appendix L, "Failure-To-Scram Analysis," October 27, 1971. 2. Michelotti, L.A., "Analysis of Anticipated Transients Without Scram," March 1971, (NEDO-10349). 3. Claassen, L. B., Echert, E.C., "Studies of BWR Designs for Mitigation of Anticipated Transients Without Scrams," October 1974, (NEDO-20626).

CPS/USAR CHAPTER 15 15.8-2 REV. 11, JANUARY 2005 4. Claassen, L. B., Eckert, E.C., "Studies of BWR Designs for Mitigation of Anticipated Transients Without Scrams, Amendment 1," June 1975, (NEDO-20626-1). 5. Baysinger, L.W., Echert, E.C., and Weis, D.G., "Studies of BWR designs for mitigation of anticipated transients without scrams, amendment 2," July 1975, (NEDO-20626-2). 6. NUREG-0853, Safety Evaluation Report related to the operation of Clinton Power Station, Unit No. 1, Docket No. 50-461, Supplements 6 (Sections 7.2.3.1 and 15.2.1) and 7 (Section 9.3.3). 7. U. S. Nuclear Regulatory Commission, Safety Evaluation on Clinton Power Station Compliance with ATWS Rule, 10CFR50.62, Docket 50-461, dated May 18, 1987. 8 Calculation EPU-T0902, Extended Power Uprate - ATWS CPS/USAR CHAPTER 15 15A-1 REV. 11, JANUARY 2005 APPENDIX 15A PLANT NUCLEAR SAFETY OPERATIONAL ANALYSIS (NSOA) -

(A System-Level/Qualitative Type Plant FMEA) 15A.1 OBJECTIVES The NSOA was developed in the late 1960s as a basis for showing compliance with the NRC's draft General Design Criteria, assuring safety design basis adequacy of consistency, stipulating technical specifications, and determining applicability of ASME Boiler and Pressure Vessel

Code Section III, ANSI B31.7, and IEEE-279. The systematic methodology which was developed concisely and clearly identified a minimum set of design basis events that bounded potential adverse parameter variations, the safety functions relied upon to prevent or mitigate each of those events, and the safety structures relied upon to provide those functions. Safety-related functions, structures and systems are a subset of the safety functions, structures and systems identified in the NSOA. It captured generic developments encompassing the design, calculation, testing and operating experience of the early BWR product lines. The repair time rule given in Section 15A.5.3 was used as an assumption in early generic reliability analyses of the BWR ECCS and was not intended to direct or reflect individual plant practices. The NSOA identifies on a generic system level basis, those systems which should be the subject of technical specifications, and the safety systems utilized during the different modes of plant

operation. 15A.1.1 Essential Protective Sequences Identify and demonstrate that essential protection sequences needed to accommodate the plant normal operations, anticipated and abnormal operation transients, and design basis accidents are available and adequate. In addition, each event considered in the plant safety analysis (Chapter 15) is further examined and analyzed. Specific essential protective sequences are identified. The appropriate sequence is discussed for all BWR operating modes. 15A.1.2 Design Basis Adequacy Identify and demonstrate that the safety design basis of the various structures, systems or components, needed to satisfy the plant essential protection sequences are appropriate, available and adequate: Each protective sequence identifies the specific structures, systems or components performing safety or power generation functions. The interrelationships between primary systems and secondary (or auxiliary equipment) in providing these functions are shown. The individual design bases (identified throughout the USAR for each structure, system, or component) are brought together by the analysis in this section. In addition to the individual equipment design basis analysis the plant-wide design bases are examined and presented here. 15A.1.3 System-Level/

Qualitative Type FMEA Identify a system level/qualitative-type Failure Modes and Effects Analysis (FMEA) of essential protective sequences to show compliance with the Single Active Component Failure (SACF) or

Single Operator Error (SOE) criteria. Each protective sequence entry is evaluated relative to SACF or SOE criteria. Safety classification aspects and interrelationships between systems are also considered.

CPS/USAR CHAPTER 15 15A-2 REV. 11, JANUARY 2005 15A.1.4 NSOA Criteria Relative to Plant Safety Analysis Identify the systems, equipment, or components' operational conditions and requirements essential to satisfy the nuclear safety operational criteria utilized in the Chapter 15 plant events. 15A.1.5 Technical Specification Operational Basis Will establish limiting operating conditions, testing, and surveillance bases relative to plant technical specification 15A.2 APPROACH TO OPERATIONAL NUCLEAR SAFETY 15A.2.1 General Philosophy The specified measures of safety used in this analysis are referred to as "unacceptable consequences". They are analytically determinable limits on the consequences of different classifications of plant events. The nuclear safety operational analysis is thus an "event-consequence" oriented evaluation. Refer to Figure 15A.2-2 for a description of the systematic process by which these unacceptable results are converted into safety requirements. 15A.2.2 Specific Philosophy The following guidelines are utilized to develop the NSOA. (1) Scope and Classification Of Plant Events a. Normal (Planned) Operations Normal operations which are under planned conditions in the absence of significant abnormalities. Operations subsequent to an incident (transient, accident, or special event) are not considered planned operations until the procedures being followed or equipment being used are identical to those used during any one of the defined planned operations. Specific events are described further in Table 15A.6-1. b. Anticipated (Expected) Operational Transients Anticipated Operational Transients are deviations from normal conditions which are expected to occur at a moderate frequency, and as such the design should include capability to withstand the conditions without operational impairment. Included are incidents that result from a single operator error, control malfunction and others as described in Table 15A.6-2. c. Abnormal (Unexpected) Operational Transients Abnormal Operational Transients are deviations from normal conditions which occur at an infrequent frequency. The design should include a capability to withstand these conditions without operational impairment. Refer to Table 15A.6-3 for description of events included within this classification.

CPS/USAR CHAPTER 15 15A-3 REV. 11, JANUARY 2005 d. Design Basis (Postulated) Accidents Design Basis Accident (DBA) is a hypothesized accident the characteristics and consequences of which are utilized in the design of those systems and components pertinent to the preservation of radioactive material barriers and the restriction of radioactive material release from the barriers. The potential radiation exposures resulting from a design basis accident are greater than for any similar accident postulated from the same general accident assumptions. Specific events are described in Table 15A.6-4. e. Special (Hypothetical) Events Special Events are postulated to demonstrate some special capability of the plant in accordance with NRC requirements. For analyzed events within this classification see Table 15A.6-5. (2) Safety and Power Generation Aspects Matters identified with "safety" classification are governed by regulatory requirements. Safety functions include: a. The accommodation of abnormal operational transients and postulated design basis accidents. b. The maintenance of containment integrity,

c. The assurance of ECCS, and

d. The continuance of reactor coolant pressure boundary (RCPB) integrity.

Safety classified aspects are related to 10 CFR 100 dose limits, infrequent and low probability occurrences, SACF criteria, worst case operating conditions and initial assumptions, automatic (10 minute) corrective action, significant unacceptable dose and environmental effects, and the involvement of other coincident (mechanistic or nonmechanistic) plant and environmental situations. Power generation classified considerations are related to continued plant power generation operation, equipment operational matters, component availability aspects and to long term off-site public effects. Matters identified with "power generation" classification are also covered by regulatory guidelines. Power generation functions include: a. the accommodation of planned operations and anticipated operational transients, b. the minimization of radiological releases to 10 CFR 20 limits, and c. the assurance of safe and orderly reactor shutdown, and/or return to power generation operation.

CPS/USAR CHAPTER 15 15A-4 REV. 11, JANUARY 2005 Power generation is related to 10 CFR 20 and 10 CFR 50, Appendix I dose limits, moderate and high probability occurrences, nominal operating conditions and initial assumptions, allowable immediate operator manual actions, and insignificant unacceptable dose and environmental effects. (3) Frequency of Events Consideration of the frequency of the initial (or initiating) event is reasonably straight-forward. Added considerations (e.g., such as further failures or operator errors) certainly influences the classification grouping. The events in this appendix are initially grouped per initiating frequency occurrence. The imposition of further failures necessitates further classification to a lower frequency category.

The introduction of SACF or SOE into the examination of planned operation, anticipated operational transients or abnormal operational transient evaluations has not been previously considered a design basis or evaluation prerequisite. It is provided and included here to demonstrate the plant's capability to

accommodate the new requirement. (4) Conservative Analysis - Margins The unacceptable consequences established in this appendix relative to the public health and safety aspects are in themselves in strict and conservative conformance to regulatory requirements.

Restrictive Operations on hypothetical limits established by further operational limits (e.g. setpoint margins) leads to disrespect for true safety aspects. (5) Safety Function Definition First the essential protective sequences shown for an event in this appendix list the minimum structures and systems required to be available to satisfy the SACF or SOE evaluation aspects of the event. Other protective "success paths" exist in some cases than are shown with the event. Second, not all the events involve t he same natural, environmental or plant conditional assumptions. For example LOCA and SSE are associated with Event 44. In Event 40, CRDA is not assumed to be associated with any SSE or OBE occurrence. Therefore, seismic safety function requirements are not considered for Event 40. Some of the safety function equipment associated with the Event 40 protective sequence are also capable of handling more limiting events, such

as Event 44. Third, containment may be a safety function for some event (when uncontained radiological release would be unacceptable) but for other events it may not be applicable (e.g. during refueling). The requirement to maintain the containment in post-accident recovery is only needed to limit doses to less than 10 CFR 100.

After radiological sources are depleted with time, further containment is unnecessary. Thus, the "time domain" and "need for" aspects of a function CPS/USAR CHAPTER 15 15A-5 REV. 11, JANUARY 2005 should be and are taken into account and considered when evaluating the events in this appendix. Fourth, the operation of ESF equipment, for normal operational events should not be misunderstood to mean that ESF equipment requirements apply to this event category. Likewise the interpretation of the use of ESF-SACF capable systems for anticipated operational transient protective sequences should not imply that

these equipment requirements (seismic, redundancy, div ersity, testable, IEEE, etc.) are appropriately required for anticipated operational transients. (6) Envelope and Actual Event Analysis The event analyses presented in Chapter 15 do not include event frequency considerations. It does present an "envelope analysis" evaluation based on expected situations. Study of the actual plant occurrences, their frequency, their actual impact are reflected in their categorization in this appendix. This places the plant safety evaluations and impressions into a better perspective by focusing attention on the "envelope analysis" with more appropriate understanding. 15A2.2.1 Consistency of the Analysis Figure 15.A.2-1 illustrates three inconsistencies. Panel A shows the possible inconsistency resulting from operational requirements being placed on separated levels of protection for one event. If the second and sixth levels of protection are important enough to warrant operational requirements, then so are the third, fourth, and fifth levels. Panel B shows the possible inconsistency resulting from operational requirements being arbitrarily placed on some action thought to be important to safety. In the case shown, scram represents different protection levels for two similar events in one category; if the fourth level of protection for Event B is important enough to warrant an operational requirement, then so is the fourth level for Event A.

Thus, to simply place operational requirements on all equipment needed for some action (scram, isolation, etc.) could be inconsistent and unreasonable if different protection levels are represented. Panel C shows the possible inconsistency resulting from operational requirements being placed on some arbitrary level of protection for any and all postulated events. Here the inconsistency is not recognizing and accounting for different event categories based on cause or expected frequency of occurrence. Inconsistencies of the types illustrated in Figure 15A.2-1 are avoided in the NSOA by directing the analysis to "event-consequences" oriented aspects. Analytical inconsistencies are avoided by treating all the events of a category under the same set of functional rules. Applying another set of functional rules to another category and by having a consistent set of rules between categories. Thus, it is valid to compare the results of the analyses of the events in any one category and invalid to compare events of different category, and thus different rules, to the other category. An example of this is the different rules (limits, assumptions, etc.) of accidents compared to anticipated transients. 15A.2.3 Comprehensiveness of the Analysis The analysis must be sufficiently comprehensive in method that (1) all plant hardware is considered; and, (2) that the full range of plant operating conditions are considered. The CPS/USAR CHAPTER 15 15A-6 REV. 11, JANUARY 2005 tendency to be preoccupied with "worst cases" (those that appear to give the most severe consequences) is recognized; however, the protection sequences essential to lesser cases may be different (more or less restrictive) from the worst case sequence. To assure that operational and design basis requirements are defined and appropriate for all equipment essential to attaining acceptable consequences, all essential protection sequences must be identified for each of the plant safety events examinations. O nly in this way is a comprehensive level of safety attained. Thus, the NSOA is also "protection sequence" oriented to achieve comprehensiveness.

15A.2.4 Systematic Approach of the Analysis In summary, the systematic method utilized in this analysis contributes to both the consistency and comprehensiveness of the analysis mentioned above. The desired characteristics representative of a systematic approach to selecting BWR operational requirements are listed as follows: (1) Specify measures of safety-unacceptable consequences (2) Consider all normal operations (3) Systematic event selection (4) Common treatment analysis of all events of any one type (5) Systematic identification of plant actions and systems essential to avoiding unacceptable consequences (6) Emergence of operational requirements and limits from system analysis Figure 15A.2-2 illustrates the systematic process by which the operational and design basis nuclear safety requirements and technical specifications are derived. The process involves the evaluation of carefully selected plant events relative to the unacceptable consequences (specified measures of safety). Those limits, actions, systems, and component level found to be essential to achieving acceptable consequences are the subjects of operational requirements. Figure 15A.2-3 summarizes the systemat ic treatment of the appendix analysis. 15A.2.5 Relationship of Nuclear Safety Operational Analysis to Safety Analyses of Chapter 15 One of the main objectives of the operational analysis is to identify all essential protection sequences and to establish the detailed equipment conditions essential to satisfying the nuclear safety operational criteria. The spectrum of events examined in Chapter 15 represent a complete set of plant safety considerations. The main objective of the earlier analyses of Chapter 15, is, of course, to provide detailed "worst case" (limiting or envelope) analysis of the plant events. The "worst cases" are correspondingly analyzed and treated likewise in this appendix but in light of frequency of occurrence, unacceptable consequences, assumption categories and etc.

CPS/USAR CHAPTER 15 15A-7 REV. 11, JANUARY 2005 The detailed discussion relative to each of the events covered in Chapter 15 will not be repeated in this appendix. Please refer to the specific section in Chapter 15 as cross-correlated in Tables 15A.6-1 thru 15A.6-5. Tables 15A.6-1 thru 15A.6-5 provide cross-correlation between the NSOA event, its protection sequence diagram, and its safety evaluation in Chapter 15. 15A.2.6 Relationship Between NSOA and Operational Requirements, Technical Specifications, Design Basis, and SACF Aspects By definition, "an operational requirement" is a requirement or restriction (limit) on either the value of a plant variable or the operability condition associated with a plant system. Such requirements must be observed during all modes of plant operation (not just at full power) to assure that the plant is operated safely (to avoid the unacceptable results). There are two kinds of operational requirements for plant hardware; (1) Limiting condition for operation: the required condition for a system while the reactor is operating in a specified state. (2) Surveillance requirements: the nature and frequency of tests required to assure that the system is capable of performing its essential functions. Operational requirements are systematically selected for one of two basic reasons: (1) To assure that unacceptable consequences are mitigated following specified plant events by examining and challenging the system design. (2) To assure the consequences of a transient or accident is acceptable with the existence of a SACF or SOE criteria. The individual structures and systems which perform a safety function are required to do so under design basis conditions including environmental consideration and under single active component failure assumptions. The NSOA confirms the previous examination of the individual equipment (See "Evaluations" subsection) requirement conformance analyses. 15A.2.7 Unacceptable Consequences Criteria Tables 15A.2-6 thru 15A.2-10 identify the unacceptable consequences associated with different event categories. In order to prevent or mitigate them, they are recognized as the major bases for identifying system operational requirements as well as the bases for all other safety analyses vs. criteria throughout the SAR. 15A.2.8 General Nuclear Safety Operational Criteria The following general nuclear safety operational criteria are used to select operational requirements: Applicability Nuclear Safety Operational Criteria Planned operation anticipated, abnormal operational transients, design basis accidents and additional special plant capability events The plant shall be operated so as to avoid unacceptable consequences.

CPS/USAR CHAPTER 15 15A-8 REV. 11, JANUARY 2005 Applicability Nuclear Safety Operational Criteria Anticipated and abnormal operational transients and design basis accidents The plant shall be operated in such a way that no Single Active Component Failure (SACF) can prevent the safety actions essential to avoiding the unacceptable consequences associated with anticipated or abnormal operational transients or design basis accidents. However, this requirement is not applicable during structure, system, or component repair if the availability of the safety action is maintained either by restricting the allowable repair time or by more frequently testing a redundant structure, system, or

component. The unacceptable consequences associated with the different categories of plant operation and

events are dictated by: (1) probability of occurrence, (2) allowable limits (per the probability) - related to radiological, structural, environmental, etc., aspects, (3) coincidence of other related or unrelated disturbances, and (4) time domain of event and consequences consideration.

CPS/USAR CHAPTER 15 15A-9 REV. 11, JANUARY 2005 TABLE 15A.2-1 UNACCEPTABLE CONSEQUENCES CRITERIA PLANT EVENT CATEGORY: NORMAL OPERATION Unacceptable Consequences 1-1. Release of radioactive material to the environs that exceeds the limits of either 10 CFR 20 or 10 CFR 50. 1-2. Fuel failure to such an extent that were the freed fission products released to the environs via the normal discharge paths for radioactive material, the limits of 10 CFR 20 would be exceeded. 1-3. Nuclear system stress in excess of that allowed for planned operation by applicable industry codes. 1-4. Existence of a plant condition not considered by plant safety analyses.

CPS/USAR CHAPTER 15 15A-10 REV. 11, JANUARY 2005 TABLE 15A.2-2 UNACCEPTABLE CONSEQUENCES CRITERIA PLANT EVENT CATEGORY:

ANTICIPATED OPERATIONAL TRANSlENTS Unacceptable Consequences 2-1. Release of radioactive material to the environs that exceeds the limits of 10 CFR 20. 2-2. Any fuel failure calculated as a direct result of the transient analyses.

2-3. Nuclear system stress exceeding that allowed for transients by applicable industry codes. 2-4. Containment stresses exceeding that allowed for transients by applicable industry codes when containment is required.

CPS/USAR CHAPTER 15 15A-11 REV. 11, JANUARY 2005 TABLE 15A.2-3 UNACCEPTABLE CONSEQUENCES CRITERIA PLANT EVENT CATEGORY:

ABNORMAL OPERATIONAL TRANSlENTS Unacceptable Consequences 3-1. Radioactive material release exceeding the guideline values of a small fraction of 10 CFR 100. 3-2.* Failure of the fuel barrier as a result of exceeding mechanical or thermal limits. 3-3. Nuclear system stresses exceeding that allowed for transients by applicable industry codes. 3-4. Containment stresses exceeding that allowed for accidents by applicable industry codes when containment is required.

• Failure of the fuel barrier means gross core-wide fuel cladding perforations.

CPS/USAR CHAPTER 15 15A-12 REV. 11, JANUARY 2005 TABLE 15A.2-4 UNACCEPTABLE CONSEQUENCES CRITERIA PLANT EVENT CATEGORY:

DESIGN BASlS ACCIDENTS Unacceptable Consequences 4-1. Radioactive material release exceeding the guideline values of 10 CFR 100. 4-2.* Failure of the fuel barrier as a result of exceeding mechanical or thermal limits. 4-3. Nuclear system stresses exceeding that allowed for accidents by applicable industry codes. 4-4. Containment stresses exceeding that allowed for accidents by applicable industry codes when containment is required. 4-5. Overexposure to radiation of plant main control room personnel.

• Failure of the fuel barrier includes fuel cladding fragmentation (loss-of-coolant accident) and excessive fuel enthalpy (control rod drop accident).

CPS/USAR CHAPTER 15 15A-13 REV. 11, JANUARY 2005 TABLE 15A.2-5 UNACCEPTABLE CONSEQUENCES CONSIDERATIONS PLANT EVENT CATEGORY: SPECIAL EVENTS Special Events Considered A. Reactor shutdown from outside control room B. Reactor shutdown without control rods C. Reactor shutdown with anticipated transient without scram (ATWS)

D. Shipping Cask Drop

Capability Demonstration 5-1. Ability to shut down reactor by manipulating controls and equipment outside the main control room. 5-2. Ability to bring the reactor to the cold shutdown condition from outside the main control room. 5-3. Ability to shut down the reactor independent of control rods.

5-4. Ability to contain radiological contamination.

5-5. Ability to limit radiological exposure.

CPS/USAR CHAPTER 15 15A-14 REV. 11, JANUARY 2005 15A.3 METHOD OF ANALYSIS 15A.3.1 General Approach The NSOA is performed on the plant as designed. The end products of the analysis are the nuclear safety operational requirements and the restrictions on plant hardware and its operation that must be observed (1) to satisfy the nuclear safety operational criteria, and (2) to show compliance of the plant safety and power generat ion systems with plant wide requirements. Figure 15A.2-2 shows the process used in the analysis. The following inputs are required for the analysis of specific plant events: (1) Unacceptable Consequences Criterion (Subsection 15A.2.7)

(2) General Nuclear Safety Operational Criteria (Subsection 15A.2.8) (3) Definition of BWR Operating States (Subsection 15A.3.2) (4) Selection of Events for Analysis (Subsection 15A.3.3)

(5) Rules for Event Analysis (Subsection 15A.3.5) With this information, each selected event can be evaluated to determine systematically, the actions, the systems, and the limits essential to avoiding the defined unacceptable consequences. The essential plant components and limits so identified are then considered to be in agreement with and subject to nuclear operational, design basis requirements and technical specification restrictions. 15A.3.2 BWR Operating States Four BWR operating states in which the reactor can exist are defined in 15A.6.2.4 and summarized in Table 15A.3-1. The main objective in selecting operating states is to divide the BWR operating spectrum into sets of initial conditions to facilitate consideration of various events in each state. Each operating state includes a wide spectrum of values for important plant parameters. Within each state, these parameters are considered over their entire range to determine the limits on their values necessary to satisfy the nuclear safety operational criteria. Such limitations are presented in the subsections of the FSAR that describe the systems associated with the

parameter limit. The plant parameters to be considered in this manner include the following: Reactor coolant temperature Reactor vessel water level Reactor vessel pressure Reactor vessel water quality Reactor coolant forced circulation flow rate

Reactor power level (thermal and neutron flux) Core neutron flux distribution Feedwater temperature

Containment temperature and pressure Suppression pool water temperature and level Spent fuel pool water temperature and level CPS/USAR CHAPTER 15 15A-15 REV. 11, JANUARY 2005 15A.3.3 Selection of Events for Analysis 15A.3.3.1 Normal Operation Operations subsequent to an incident (transient, accident, or additional plant capability event) are not considered planned operations until the actions taken or equipment used in the plant are identical to those that would be used had the incident not occurred. As defined, the planned operations can be considered as a chronological sequence: refueling outage -

> achieving criticality -

> heatup -> power operation -

> achieving shutdown -

> cooldown -

> refueling outage. The normal operations are defined below. (1) Refueling outage: Includes all the planned operations associated with a normal refueling outage except those tests in which the reactor is taken critical and returned to the shutdown condition. The following planned operations are included in refueling outage: a. Planned, physical movement of core components (fuel, control rods, etc.) b. Refueling test operations (except criticality and shutdown margin tests) c. Planned maintenance

d. Required inspection (2) Achieving criticality: Includes all the plant actions normally accomplished in bringing the plant from a condition in which all control rods are fully inserted to a condition in which nuclear criticality is achieved and maintained. (3) Heatup: Begins when achieving criticality ends and includes all plant actions normally accomplished in approaching nuclear system rated temperature and pressure by using nuclear power (reactor critical). Heatup extends through warmup and synchronization of the main turbine-generator. (4) Power operation: Begins when heatup ends and includes continued plant operation at power levels in excess of heatup power. (5) Achieving shutdown: Begins when the main generator is unloaded and includes all plant actions normally accomplished in achieving nuclear shutdown (more than one rod subcritical) following power operation. (6) Cooldown: Begins when achieving nuclear shutdown ends and includes all plant actions normal to the continued removal of decay heat and the reduction of RPV temperature and pressure. The exact point at which some of the planned operations end and others begin cannot be precisely determined. It will be shown later that such precision is not required, for the protection requirements are adequately defined in passing from one state to the next. Dependence of several planned operations on the one rod subcritical condition provides an exact point on either side of which protection (especially scram) requirements differ. Thus, where a precise boundary between planned operations is needed, the definitions provide the needed precision.

CPS/USAR CHAPTER 15 15A-16 REV. 11, JANUARY 2005 Together, the BWR operating states and the planned operations define the full spectrum of conditions from which transients, accidents, and special events are initiated. The BWR operating states define only the physical condition (pressure, temperature, etc.) of the reactor; the planned operations define what the plant is doing. The separation of physical conditions from the operation being performed is deliberate and facilitates careful consideration of all possible initial conditions from which incidents may occur. 15A.3.3.2 Anticipated Operational Transients To select anticipated operational transients, eight nuclear system parameter variations are considered as potential initiating causes of threats to the fuel and the reactor coolant pressure boundary. The parameter variations are as follows: (1) Reactor pressure vessel pressure increase (2) Reactor pressure vessel water (moderator) temperature decrease (3) Control Rod Withdrawal (4) Reactor pressure vessel coolant inventory decrease (5) Reactor core coolant flow decrease (6) Reactor core coolant flow increase (7) Core coolant temperature increase (8) Excess of coolant inventory These parameter variations, if uncontrolled, could result in damage to the reactor fuel or reactor coolant pressure boundary, or both. A nuclear system pressure increase threatens to rupture the reactor coolant pressure boundary from internal pressure. A pressure increase also collapses voids in the moderator, causing an insertion of positive reactivity that threatens fuel damage as a result of overheating. A reactor vessel water (moderator) temperature decrease results in an insertion of positive reactivity as density increases. This could lead to fuel overheating. Positive reactivity insertions are possible from causes other than nuclear system pressure or moderator temperature changes. Such reactivity insertions threaten fuel damage caused by overheating. Both a reactor vessel coolant inventory decrease and a reduction in coolant flow through the core threatens the integrity of the fuel as the coolant becomes unable to adequately remove the heat generated in the core. An increase in coolant flow through the core reduces the void content of the moderator, and results in an insertion of partial reactivity. Core coolant temperature increase threatens the integrity of the fuel; such a variation could be the result of a heat exchanger malfunction during operation in the shutdown cooling mode. An excess of coolant inventory could be the result of malfunctioning water level control equipment; such a malfunction can result in a turbine trip, which causes an expected increase in nuclear system pressure and power. Anticipated operational transients are defined as transients resulting from a single active component failure, SACF, or single operator error, SOE, that can be reasonably expected (moderate probability of occurrence - once per day to once in 20 years) during any mode of CPS/USAR CHAPTER 15 15A-17 REV. 11, JANUARY 2005 plant operation. Examples of single operational failures or operator errors in this range of probability are: (1) Opening or closing any single valve (a check valve is not assumed to close against normal flow) (2) Starting or stopping any single component (3) Malfunction or maloperation of any single control device (4) Any single electrical failure (5) Any single operator error An operator error is defined as an active deviation from nuclear plant standard operating practices. A single operator error is the set of actions that is a direct consequence of a single reasonably expected erroneous decision. The set of actions is limited as follows: (1) Those actions that could be performed by only one person.

(2) Those actions that would have constituted a correct procedure had the initial decision been correct. (3) Those actions that are subsequent to the initial operator error and that affect the designed operation of the plant, but are not necessarily directly related to the operator error. Examples of single operator errors are as follows: (1) An increase in power above the established flow control power limits by control rod withdrawal in the specified sequences. (2) The selection and complete withdrawal of a single control rod out of sequence.

(3) An incorrect calibration of an average power range monitor. (4) Manual isolation of the main steam lines caused by operator misinterpretation of an alarm or indication. The various types of a single operator error or a single active component failure are applied to various plant systems with a consideration for a variety of plant conditions to discover events directly resulting in an undesired parameter variation. Once discovered, each event is evaluated for the threat it poses to the integrity of the radioactive material barriers. 15A.3.3.3 Abnormal Operational Transients To select abnormal operational transients, eight nuclear system parameter variations are considered as potential initiating causes of gross core-wide fuel failures and threats of the reactor coolant pressure boundary. The parameter variations are as follows:

CPS/USAR CHAPTER 15 15A-18 REV. 11, JANUARY 2005 (1) Reactor pressure vessel pressure increase (2) Reactor pressure vessel water (moderator) temperature decrease (3) Control rod withdrawal (4) Reactor vessel coolant inventory decrease (5) Reactor core coolant flow decrease (6) Reactor core coolant flow increase (7) Core coolant temperature increase (8) Excess of coolant inventory The eight parameter variations listed above include all effects within the nuclear system caused by abnormal operational transients that threaten gross core-wide reactor fuel integrity or seriously affect reactor coolant pressure boundar

y. Variation of any one parameter may cause a change in another listed parameter; however, for analysis purposes, threats to barrier integrity are evaluated by groups according to the parameter variation originating the threat. Abnormal operational transients are defined as incidents resulting from single or multiple equipment failures and/or single or multiple operator errors that are not reasonably expected (less than one event in 20 years to one in 100 years) during any mode of plant operation. Examples of single or multiple operational failures and/or single or multiple operator errors are: (1) Failure of major power generation equipment components (2) Multiple electrical failures (3) Multiple operator errors (4) Combinations of equipment failure and an operator error Operator error is defined as an active deviation from nuclear plant standard operating practices. A multiple operator error is the set of actions that is a direct consequence of several unexpected erroneous decisions. Examples of multiple operator errors are as follows: (1) Inadvertent loading and operating a fuel assembly in an improper position.

(2) The movement of a control rod during refueling operations. The various types of single errors and/or single malfunctions are applied to various plant systems with a consideration for a variety of plant conditions to discover events directly resulting in an undesired parameter variation. Once discovered, each event is evaluated for the threat it poses to the integrity of the various radioactive material barriers.

CPS/USAR CHAPTER 15 15A-19 REV. 11, JANUARY 2005 15A.3.3.4 Design Basis Accidents Accidents are defined as hypothesized events that affect the radioactive material barriers and are not expected during plant operations. These are plant events, equipment failures, combinations of initial conditions which are of extremely low probability (once in 100 years to once in 10,000 years). The postulated accident types considered are as follows: (1) Mechanical failure of a single component leading to the release of radioactive material from one or more barriers. The components referred to here are not those that act as radioactive material barriers. Examples of mechanical failure are breakage of the coupling between a control rod drive and the control rod. (2) Arbitrary rupture of any single pipe up to and including complete severance of the largest pipe in the reactor coolant pressure boundary. This kind of accident is considered only under conditions in which the nuclear system is pressurized. For purposes of analysis, accidents are categorized as those events that result in releasing radioactive material: (1) From the fuel with the reactor coolant pressure boundary, reactor building and auxiliary building initially intact. (Event 40) (2) Directly to the containment. (Event 42) (3) Directly to the reactor, auxiliary, or turbine buildings with the containment initially intact. (Events 40, 43, 44, 45, 50) (4) Directly to the reactor or auxiliary buildings with the containment not intact. (Events 41, 50) (5) Directly to the spent fuel containing facilities. (Events 41, 50) (6) Directly to the turbine building (Events 46, 47) (7) Directly to the environs (Events 48, 49) The effects of various accident types are investigated, with consideration for the full spectrum of plant conditions, to examine events that result in the release of radioactive material. 15A.3.3.5 Special Events A number of additional events are evaluated to demonstrate plant capabilities relative to special arbitrary nuclear safety criteria. These special events involve extremely low probability occurrence situations. As an example, the adequacy of the redundant reactivity control system is demonstrated by evaluating the special event: "reactor shutdown without control rods." Another similar example, the capability to perform a safe shutdown from outside the main control room is demonstrated by evaluating the special event "reactor shut-down from outside the main control room."

CPS/USAR CHAPTER 15 15A-20 REV. 11, JANUARY 2005 15A.3.4 Applicability of Events to Operating States The first step in performing an operational analysis for a given "incident" (transient, accident, or special event) is to determine in which operating states the incident can occur. An incident is considered applicable within an operating state if the incident can be initiated from the physical conditions that characterize the operating state. Applicability of the "normal operations" to the operating states follows from the definitions of planned operations. A planned operation is considered applicable within an operating state if the planned operation can be conducted when the reactor exists under the physical conditions defining the operating state. 15A.3.5 Guidelines for Event Analysis The following functional guidelines are followed in performing SACF, operational and design basis analyses for the various plant events: (1) An action, system, or limit shall be considered essential only if it is essential to avoiding an unacceptable result or satisfying the nuclear safety operational

criteria. (2) The full range of initial conditions (as defined in paragraph 15A.3.5.(3)) shall be considered for each event analyzed so that all essential protection sequences are identified. Consideration is not limited to "worst cases" because lesser cases sometimes may require more restrictive actions or systems different from the "worst cases". (3) The initial conditions for transients, accidents, and additional plant capability events shall be limited to conditions that would exist during planned operations in the applicable operating state. (4) For normal operations, consideration shall be made only for actions, limits, and systems essential to avoiding the unacceptable consequences during operation in that state (as opposed to transients, accidents, and additional plant capability events, which are followed through to completion). Normal operations are treated differently from other events because the transfer from one state to another during planned operations is deliberate. For events other than normal operations, the transfer from one state to another may be unavoidable. (5) Limits shall be derived only for those essential parameters that are continuously monitored by the operator. Parameter limits associated with the required performance of an essential system are considered to be included in the requirement for the operability of the sy stem. Limits on frequently monitored process parameters are called "envelope limits," and limits on parameters associated with the operability of a safety system are called "operability limits." Systems associated with the control of the envelope parameters are considered nonessential if it is possible to place the plant in a safe condition without using

the system in question. (6) For transients, accidents and special events, consideration shall be made for the entire duration of the event and results until some planned operation is resumed. Normal operation is considered resumed when the procedures being followed or equipment being used are identical to those used during any one of the defined CPS/USAR CHAPTER 15 15A-21 REV. 11, JANUARY 2005 planned operations. Where "Extended Core Cooling" is an immediate integral part of the event, it will be included in the protection sequence. Where it may be an eventual part of the event it will not be directly added but of course can be implied to be available. (7) Credit for operator action shall be taken on a case-by-case basis depending on the conditions that would exist at the time operator action would be required.

Because transients, accidents, and special events are considered through the entire duration of the event until normal operation is resumed, manual operation of certain systems is sometimes required following the more rapid or automatic portions of the event. Credit for operator action is taken only when the operator can reasonably be expected to accomplish the required action under the existing conditions. (8) For transients, accidents, and special events, only those actions, limits, and systems shall be considered essential for which there arises a unique requirement as a result of the event. For instance, if a system that was operating prior to the event (during planned operation) is to be employed in the same manner following the event and if the event did not affect the operation of the system, then the system would not appear on the protection sequence diagram. (9) The operational analyses shall identify all the support or auxiliary systems essential to the functioning of the front-line safety systems. Safety system auxiliaries whose failure results in safe failure of the front-line safety systems shall be considered nonessential. (10) A system or action that plays a unique role in the response to a transient, accident, or special event shall be considered essential unless the effects of the system or action are not included in the detailed analysis of the event. 15A.3.6 Steps in an Operational Analysis All information needed to perform an operational analysis for each plant event has been presented (Figure 15A.2-2). The procedure followed in performing an operational analysis for a given event (selected according to the event selection criteria) is as follows: (1) Determine the BWR operating states in which the event is applicable.

(2) Identify all the essential protection sequences (safety actions and front-line safety systems) for the event in each applicable operating state. (3) Identify all the safety system auxiliaries essential to the functioning of the front-line safety systems. The above three steps are performed in 15A.6. To derive the operational requirements and technical specifications for the individual components of a system included in any essential protection sequence, the following steps are taken:

CPS/USAR CHAPTER 15 15A-22 REV. 11, JANUARY 2005 (1) Identify all the essential actions within the system (intrasystem actions) necessary for the system to function to the degree necessary to avoid the unacceptable consequences. (2) Identify the minimum hardware conditions necessary for the system to accomplish the minimum intrasystem actions. (3) If the single-failure criterion applies, identify the additional hardware conditions necessary to achieve the plant safety actions (scram, pressure relief, isolation, cooling, etc.) in spite of single failures. This step gives the nuclear safety operational requirements for the plant components so identified. (4) Identify surveillance requirements and allowable repair times for the essential plant hardware (section 15A.5.2). (5) Simplify the operational requirements determined in steps (3) and (4) so that technical specifications may be obtained that encompass the true operational requirements and are easily used by plant operations and management personnel.

CPS/USAR CHAPTER 15 15A-23 REV. 11, JANUARY 2005 TABLE 15A.3-1 BWR OPERATING STATES*

Conditions States A B C D Reactor vessel head off X X Reactor vessel head on X X Shutdown X X Not shutdown X X Definition Shutdown: K sub (eff) sufficiently less than 1.0 that the full withdrawal of any one control rod could not produce criticality under the most restrictive potential conditions of temperature, pressure, core age, and fission product concentrations.

• Further discussion is procided in Subsection 15A.6.2.4.

CPS/USAR CHAPTER 15 15A-24 REV. 11, JANUARY 2005 15A.4 DISPLAY OF OPERATIONAL ANALYSIS RESULTS 15A.4.1 General To fully identify and establish the requirements, restrictions, and limitations that must be observed during plant operation, plant systems and components must be related to the needs for their actions in satisfying the nuclear safety operational criteria. This appendix displays these relationships in a series of block diagrams. Table 15A.3-1 and 15A.6-1 thru 15A.6-5 indicates which operating states each event is applicable. For each event, a block diagram is presented showing the conditions and systems required to achieve each essential safety action. The block diagrams show only those systems necessary to provide the safety actions such that the nuclear safety operational and design basis criteria are satisfied. The total plant capability to provide a safety action is generally not shown, only the minimum capability essential to satisfying the operational criteria. It is very important to understand that only enough protective equipment is cited in the diagram to provide the necessary action. Many events can utilze many more paths to success than are shown. These operational analyses involve the minimum equipment needed to prevent or avert an unacceptable consequence. Thus, the diagrams depict all essential protection sequences for each event with the least amount of protective equipment needed. Once all of these protection sequences are identified in block diagram form, system requirements are derived by considering all events in which the particular system is employed. The analysis considers the following conceptual aspects: (1) The BWR operating state.

(2) Types of operations or events that are possible within the operating state. (3) Relationships of certain safety actions to the unacceptable consequences and to specific types of operations and events. (4) Relationships of certain systems to safety actions and to specific types of operations and events. (5) Supporting or auxiliary systems essential to the operation of the front-line safety systems. (6) Functional redundancy (The single-failure criterion applied at the safety action level. This is, in effect, a qualitative, system level, FMEA-type analysis.) Each block in the sequence diagrams represents a finding of essentiality for the safety action, system, or limit under consideration. Essentiality in this context means that the safety action, system, or limit is needed to satisfy the nuclear safety operational criteria. Essentiality is determined through an analysis in which the safety action, system, or limit being considered is completely disregarded in the analyses of the applicable operations or events. If the nuclear safety operational criteria are satisfied without the safety action, system, or limit, then the safety action, system, or limit is not essential, and no operational nuclear safety requirement would be indicated. When disregarding a safety action, system, or limit, results in violating one or more nuclear safety operational criteria, the safety action, system, or limit is considered essential, and the resulting operational nuclear safety requirements can be related to specific criteria and unacceptable consequences.

CPS/USAR CHAPTER 15 15A-25 REV. 11, JANUARY 2005 15A.4.2 Protection Sequence and Safety System Auxiliary Diagrams Block diagrams illustrate essential protection sequences for each event requiring unique safety actions. These protection sequence diagrams show only the required front-line safety systems. The format and conventions used for these diagrams are shown in Figure 15A.4-1. The auxiliary systems essential to the correct functioning of front-line safety systems are shown on safety system auxiliary diagrams. The format used for these diagrams is shown in Figure 15A.4-2. The diagram indicates that auxiliary systems A, B, and C are required for proper operation of front-line safety system X. Total plant requirements for an auxiliary system or the relationships of a particular auxiliary system to all other safety systems (front-line and auxiliary) within an operating state are shown on the commonality of auxiliary diagrams. The format used for these diagrams is shown in Figure 15A.4-3. The convention employed in Figure 15A.4-3 indicates that auxiliary system A is required: (1) to be single-failure proof relative to system q in State A-events X, Y; State B-events X, Y; State C-events X, Y, Z; State D-events X, Y, Z. (2) to be single-failure proof relative to the parallel combination of systems and in State A-events U, V, W; State B-events V, W; State C-events U, V, W, X; State D-events U, V, W, X. (3) to be single-failure proof relative to the parallel combination of system and [system in series with the parallel combination of systems Epsilon and Chi in State C-events Y, W; State D-events Y, W, Z. As noted, system is part of the combination but does not require auxiliary system A for its proper operation. (4) for system in State B-events Q, R; State D-events Q, R, S. With these three types of diagrams, it is possible to determine for each system the detailed functional requirements and conditions to be obs erved regarding system hardware in each operating state. The detailed conditions to be observed regarding system hardware include such nuclear safety operational requirements as test frequencies and the number of components that must be operable. 15A.5 BASES FOR SELECTING SURVEILLANCE TEST FREQUENCIES The following three Subsections are historical. For current information, refer to the CPS Technical Specifications. 15A.5.1 Normal Surveillance Test Frequencies After the essential nuclear safety systems and engineered safeguards have been identified by applying the nuclear safety operational criteria, surveillance requirements are selected for these systems. In this selection process, the various systems are considered in terms of relative availability, test capability, plant conditions necessary for testing, and engineering experience

with the system type.

CPS/USAR CHAPTER 15 15A-26 REV. 11, JANUARY 2005 15A.5.2 Allowable Repair Times Allowable repair times are selected by computation using appropriate availability analysis methods for redundant standby systems. The resulting maximum average allowable repair times assure that a system's long-term availability, including allowance for repair, is not reduced below the theoretical availability that would be achieved if repairs could be made in zero time. 15A.5.3 Repair Time Rule A safety system can be repaired while the reactor is in operation if the repair time is equal to or less than the maximum allowable average repair time. If repair is not complete when the allowable repair time expires, the plant must be placed in its safest mode (with respect to the protection lost). To maintain the validity of the assumptions used to establish the above repair time rule, the following restrictions must be observed: (1) The allowable repair time should only be used as needed to restore failed equipment to operation, not for routine maintenance. Using this time should be an event as rare as failure of the equipment itself. Routine maintenance should be scheduled when the equipment is not needed. (2) At the conclusion of the repair, the repaired component must be retested and placed in service. (3) Once the need for repair of a failed component is discovered, repairs should proceed as quickly as possible consistent with good craftsmanship. Alternatively, if a system is expected to be out of repair for an extended time, the availability of the remaining systems can be maintained at the prefailure level by testing them more often. This technique is fully developed in Reference 15A.9-1. 15A.6 OPERATIONAL ANALYSES Results of the operational analyses are discussed in the following paragraphs and displayed on Figures 15A.6-1 through 15A.6-65 and in Tables 15A.6-1 through 15A.6-5. 15A.6.1 Safety System Auxiliaries Figures 15A.6-1 and 15A.6-2 show the safety system auxiliaries essential to the functioning of each front-line safety system. Commonality of auxiliary diagrams are shown in Figures 15A.6-60 through 15A.6-65. 15A.6.2 Normal Operations 15A.6.2.1 General Requirements for the normal or planned operations normally involve limits (L) on certain key process variables and restrictions (R) on certain plant equipment. The control block diagrams for each operating state (Figures 15A.6-3 through 15A.6-6) show only those controls necessary CPS/USAR CHAPTER 15 15A-27 REV. 11, JANUARY 2005 to avoid unacceptable safety consequences, 1-1 through 1-4 of Table 15A.2-1. Table 15A.6-1 summarizes additional information for Normal Operation. Following is a description of the planned operations (Events 1 through 6), as they pertain to each of the four operating states. The description of each operating state contains a definition of that state, a list of the planned operations that apply to that state, and a list of the safety actions that are required to avoid the unacceptable safety consequences. 15A.6.2.2 Event Definitions Event 1 - Refueling Outage Refueling outage includes all the planned operations associated with a normal refueling outage except those tests in which the reactor is made critical and returned to the shutdown condition. The following planned operations are included in refueling outage: (1) Planned, physical movement of core components (fuel, control rods, etc.)

(2) Refueling test operations (except criticality and shutdown margin tests)

(3) Planned maintenance (4) Required inspection Event 2 - Achieving Criticality Achieving criticality includes all the plant actions normally accomplished in bringing the plant from a condition in which all control rods are fully inserted to a condition in which nuclear criticality is achieved and maintained. Event 3 - Reactor Heatup Heatup begins where achieving criticality ends and includes all plant actions normally accomplished in approaching nuclear system rated temperature and pressure by using nuclear power (reactor critical). Heatup extends through warmup and synchronization of the main turbine generator. Event 4 - Power Operation

• Electric Generation Power operation begins where heatup ends and continued plant operation at power levels in excess of heatup power or steady state operation. It also includes plant manuevers such as: (1) daily electrical load reduction and recoveries (2) electrical grid frequency control adjustment (3) Control rod movements CPS/USAR CHAPTER 15 15A-28 REV. 11, JANUARY 2005 (4) Power generation surveillance testing involving: a. Turbine stop valve closing

b. Turbine control valve adjustments

c. MSIV exercising Event 5 - Achieving Reactor Shutdown Achieving shutdown begins where the main generator is unloaded and includes all plant actions normally accomplished in achieving nuclear shutdown (more than one rod subcritical) after power operation. Event 6 - Reactor Cooldown Cooldown begins where achieving shutdown ends and includes all plant actions normal to the continued removal of decay heat and the reduction of nuclear system temperature and pressure. 15A.6.2.3 Required Safety Actions/Related Unacceptable Consequences The following paragraphs describe the safety actions for planned operations. Each description includes a selection of the operating states that apply to the safety action, the plant system affected by limits or restrictions, and the unacceptable consequence that is avoided. The four operating states are defined in Table 15A.3-1. The unacceptable consequences criteria are tabulated in Table 15A.2-1. 15A.6.2.3.1 Radioactive Material Release Control Radioactive materials may be released to the environs in any operating state; therefore, radioactive material release control is required in all operating states. Because of the significance of preventing excessive release of radioactive materials to the environs, this is the only safety action for which monitoring systems are explicitly shown. The offgas vent radiation monitoring system provides indication for gaseous release from the offgas system. Gaseous releases through other highly probable vents ar e monitored by the ventilation monitoring system. A radiation monitoring system is also provided on the main stack which monitors all ventilation air releases from the plant. The process liquid radiation monitors are not required, because all liquid wastes are monitored by batch sampling before a controlled release. Limits are expressed on the offgas vent system, liquid radwaste system, and solid radwaste system so that the planned releases of radioactive materials comply with the limits given in 10 CFR 20, 10 CFR 50, and 10 CFR 71 (related unacceptable safety result 1-1). 15A.6.2.3.2 Core Coolant Flow Rate Control In State D, when above approximately 10% NB rated power, the core coolant flow rate must be maintained above certain minimums (i.e., limited) to maintain the integrity of the fuel cladding (1-2) and assure the validity of the plant safety analysis (1-4).

CPS/USAR CHAPTER 15 15A-29 REV. 11, JANUARY 2005 15A.6.2.3.3 Core Power Level Control The plant safety analyses of accidental positive reactivity additions have assumed as an initial condition that the neutron source level is above a specified minimum. Because a significant positive reactivity addition can only occur when the reactor is less than one rod subcritical, the assumed minimum source level need be observed only in States B and D. The minimum source level assumed in the analyses has been related to the counts/sec readings on the source range monitors (SRM); thus, this minimum power level limit on the fuel is expressed as a required SRM count level. Observing the limit assures validity of the plant safety analysis (1-4). Maximum core power limits are also expressed for operating States B and D to maintain fuel integrity (1-2) and remain below the maximum power levels assumed in the plant safety analysis (1-4). 15A.6.2.3.4 Core Neutron Flux Distribution Control Core neutron flux distribution must be limited in State D, otherwise core power peaking could result in fuel failure (1-2). Additional limits are expressed in this state, because the core neutron flux distribution must be maintained within the envelope of conditions considered by plant safety analysis (1-4). 15A.6.2.3.5 Reactor Vessel Water Level Control In any operating state, the reactor vessel water level could, unless controlled, drop to a level that will not provide adequate core cooling; therefore, reactor vessel water level control applies to all operating states. Observation of the reactor vessel water level limits protects against fuel failure (1-2) and assures the validity of the plant safety analysis (1-4). 15A.6.2.3.6 Reactor Vessel Pressure Control Reactor vessel pressure control is not needed in States A and B because vessel pressure cannot be increased above atmospheric pressure. In State C, a limit is expressed on the reactor vessel to assure that it is not hydrostatically tested until the temperature is above the NDT temperature plus 60 F; this prevents excessive stress (1-3). Also, in States C and D a limit is expressed on the residual heat removal system to assure that it is not operated in the shutdown cooling mode when the reactor vessel pressure is greater than approximately 104 psig; this prevents excessive stress (1-3). In States C and D, a limit on the reactor vessel pressure is necessitated by the plant safety analysis (1-4). 15A.6.2.3.7 Nuclear System Temperature Control In operating States C and D, a limit is expressed on the reactor vessel to prevent the reactor vessel head bolting studs from being in tension when the temperature is less than 70 F to avoid excessive stress (1-3) on the reactor vessel flange. This limit does not apply in States A and B because the head will not be bolted in place during criticality tests or during refueling. In all operating states, a limit is expressed on the reactor vessel to prevent an excessive rate of change of the reactor vessel temperature to avoid excessive stress (1-3). In States C and D, where it is planned operation to use the feedwater system, a limit is placed on the reactor fuel so that the feedwater temperature is maintained within the envelope of conditions considered by the plant safety analysis (1-4). For State D, a limit is observed on the temperature difference between the recirculation system and the reactor vessel to prevent the starting of the CPS/USAR CHAPTER 15 15A-30 REV. 11, JANUARY 2005 recirculation pumps. This operating restriction and limit prevents excessive stress in the reactor vessel (1-3). 15A.6.2.3.8 Nuclear System Water Quality Control In all operating states, water of improper chemical quality could produce excessive stress as a result of chemical corrosion (1-3). Therefore, a limit is placed on reactor coolant chemical quality in all operating states. For all operating states where the nuclear system can be pressurized (States C and D), and additional limit on reactor coolant activity assures the validity of the analysis of the main steam line break accident (1-4). 15A.6.2.3.9 Nuclear System Leakage Control Because excessive nuclear system leakage could occur only while the reactor vessel is pressurized, limits are applied only to the reactor vessel in States C and D. Observing these limits prevents vessel damage due to excessive stress (1-3) and assures the validity of the plant safety analysis (1-4). 15A.6.2.3.10 Core Reactivity Control In State A during refueling outage, a limit on core loading (fuel) to assure that core reactivity is maintained within the envelope of conditions considered by the plant safety analysis (1-4). In all states, limits are imposed on the control rod drive system to assure adequate control of core reactivity so that core reactivity remains within the envelope of conditions considered by the plant safety analysis (1-4). 15A.6.2.3.11 Control Rod Worth Control Any time the reactor is not shut down and is generating less than 20% power (State D), a limit is imposed on the control rod pattern to assure that control rod worth is maintained within the envelope of conditions considered by the analysis of the control rod drop accident (1-4). 15A.6.2.3.12 Refueling Restriction By definition, planned operation event 1 (refueling outage) applies only to State A. Observing the restrictions on the reactor fuel and on the operation of the control rod drive system within the specified limit maintains plant conditions within the envelope considered by the plant safety analysis (1-4). 15A.6.2.3.13 Containment and Reactor/Auxiliary Building Pressure and Temperature Control In States C and D, limits are imposed on the suppression pool temperature to maintain containment pressure within the envelope considered by plant safety analysis (1-4). These limits assure an environment in which instruments and equipment can operate correctly within the containment. Limits on the pressure suppression pool apply to the water temperature and water level to assure that it has the capability of absorbing the energy discharged during a safety/relief valve blowdown.

CPS/USAR CHAPTER 15 15A-31 REV. 11, JANUARY 2005 15A.6.2.3.14 Stored Fuel Shielding, Cooling, and Reactivity Control Because both new and spent fuel will be stored during all operating states, stored fuel shielding, cooling, and reactivity control apply to all operating states. Limits are imposed on the spent fuel pool storage positions, water level, fuel handling procedures, and water temperature. Observing the limits on fuel storage positions assures that spent fuel reactivity remains within the envelope of conditions considered by the plant safety analysis (1-4). Observing the limits on water level assures shielding in order to maintain conditions within the envelope of conditions considered by the plant safety analysis (1-4) and provides the fuel cooling necessary to avoid fuel damage (1-2). Observing the limit on water temperature avoids excessive fuel pool stress (1-3). 15A.6.2.4 Operational Safety Evaluations State A In State A the reactor is in a shutdown condition, the vessel head is off, and the vessel is at atmospheric pressure. The applicable events for planned operations are refueling outage, achieving criticality, and cooldown (Event s 1, 2, and 6, respectively). Figure 15A.6-3 shows the necessary safety actions for planned operations, the corresponding plant systems, and the event for which these actions are necessary. As indicated in the diagram, the required safety actions are as follows:

Safety Action Radioactive material release control Reactor vessel water level control Nuclear system temperature control Nuclear system water quality control Core reactivity control Refueling restrictions Stored fuel shielding, cooling, and reactivity control State B In State B the reactor vessel head is off, the reactor is not shutdown, and the vessel is at atmospheric pressure. Applicable planned operations are achieving criticality and achieving shutdown (Events 2 and 5, respectively). Figure 15A.6-4 relates the necessary safety actions for planned operations, the plant systems, and the event for which the safety actions are necessary. The required safety actions for planned operation in State B are as follows:

Safety Actions Radioactive material release control Core power level control Reactor vessel water level control Nuclear system temperature control Nuclear system water quality control

Core reactivity control

Rod worth control Stored fuel shielding, cooling, and reactivity control CPS/USAR CHAPTER 15 15A-32 REV. 11, JANUARY 2005 State C In State C the reactor vessel head is on and the reactor is shutdown. Applicable planned operations are achieving criticality and cooldown (Events 2 and 6, respectively). Sequence diagrams relating safety actions for planned operations, plant systems, and applicable events are shown in Figure 15A.6-5. The required safety actions for planned operation in State C are as follows:

Safety Actions Radioactive material release control Reactor vessel water level control Reactor vessel pressure control Nuclear system temperature control Nuclear system water quality control Nuclear system leakage control

Core reactivity control Drywell pressure and temperature control Spent fuel storage shielding, cooling, and reactivity control State D In State D the reactor vessel head is on and the reactor is not shutdown. Applicable planned operations are achieving criticality, heatup, power operation and achieving shutdown (Events 2, 3, 4, and 5, respectively). Figure 15A.6-6 relates safety actions for planned operations, corresponding plant systems, and events for which the safety actions are necessary. The required safety actions for planned operation in State D are as follows:

Safety Actions Radioactive material release control Core coolant flow rate control Core power level control Core neutron flux distribution control Reactor vessel water level control Reactor vessel pressure control Nuclear system temperature control Nuclear system water quality control Nuclear system leakage control

Core reactivity control Rod worth control Drywell pressure and temperature control Spent fuel storage shielding, cooling, and reactivity control 15A.6.3 Anticipated Operational Transients 15A.6.3.1 General The safety requirements and protection sequences for anticipated operational transients are described in the following paragraphs for Events 7 through 29. The protection sequence block CPS/USAR CHAPTER 15 15A-33 REV. 11, JANUARY 2005 diagrams show the sequence of front-line safety systems. (Refer to Figure 15A.6-7 through 15A.6-29.) The auxiliaries for the front-line safety systems are indicated in the auxiliary diagrams (Figures 15A.6-1 and 15A.6-2) and the commonality of auxiliary diagrams (Figures 15A.6-60 through 15A.6-65). 15A.6.3.2 Required Safety Actions/Related Unacceptable Consequences The following list relates that safety actions for anticipated operational transients to mitigate or prevent the unacceptable safety consequences. Refer to Table 15A.2-2 for the unacceptable consequences criteria. Safety Action Related Unacceptable Consequences Criteria Reason Action Required Scram and/or RPT 2-2 2-3 To prevent fuel damage and to limit RPV system pressure rise. Pressure relief 2-3 To prevent excessive RPV system pressure rise. Core and Containment cooling 2-1, 2-2, 2-4 To prevent fuel and containment damage in the event that normal cooling is interrupted. Reactor vessel isolation 2-2 To prevent fuel damage by reducing the outflow of steam and water from the reactor vessel, thereby limiting the decrease in reactor vessel

water level. Restore a-c power 2-2 To prevent fuel damage by restoring a-c power to systems essential to other safety actions. Prohibit rod motion 2-2 To prevent exceeding fuel limits during transients. Containment isolation 2-1, 2-4 To minimize radiological effects. 15A.6.3.3 Event Definitions and Operational Safety Evaluations Event 7 - Manual & Inadvertent SCRAM The deliberate manual or inadvertent automatic SCRAM due to single operator error is an event which can occur under any operating conditions. Although assumed to occur here for examination purpose, multi-operator error or action is necessary to initiate such an event. While all the safety criteria apply, no unique safety actions are required to control the planned-operation-like event after effects of the subject initiation actions. In all operating states, the safety criteria are therefore met through the basis design of the plant systems. Figure 15A.6-7 identifies the protection sequences for this event. Event 8 - Loss-of-Plant Instrument Air Loss of all plant instrument air system causes reactor shutdown and the closure of isolation valves. Although these actions occur, they are not a requirement to prevent unacceptable consequences in themselves. Multi-equipment failures would be necessary in order to cause the deterioration of the subject system to the point that the components supplied with instrument air would cease to operate "normally" and/or "fail-safe." The resulting actions are identical to the Event 14 described later.

CPS/USAR CHAPTER 15 15A-34 REV. 11, JANUARY 2005 Isolation of the main steam lines can result in a transient for which some degree of protection is required only in operating States C and D. In operating States A and B, the main steam lines are continuously isolated. Isolation of all main steam lines is most severe and rapid in operating State D during power operation. Figures 15A.6-8 and 15A.6-14 show how scram is accomplished by main steam line isolation through the actions of the reactor protection system and the control rod drive system. The nuclear system pressure relief system provides pressure relief. Pressure relief, combined with loss of feedwater flow, causes reactor vessel water level to fall. Either high-pressure core cooling system supplies water to maintain water level and to protect the core until normal steam flow (or other planned operation) is established. Adequate instrument service air supplies are maintained exclusively for the continual operation of the ADS safety/relief valves until reactor shutdown is accomplished. Event 9 - Inadvertent HPCS Pump St art (Moderator Temperature Decrease)

An inadvertent pump start (temperature decrease) is defined as an unintentional start of any nuclear system pump that adds sufficient cold water to the reactor coolant inventory to cause a measurable decrease in moderator temperature. This event is considered in all operating states because it can potentially occur under any operating condition. Since the HPCS pump operates over nearly the entire range of the operating states and delivers the greatest amount of cold water to the vessel, the following analysis will describe its inadvertent operation rather than other NSSS pumps (e.g., RCICS, RHRS, LPCS). While all the safety criteria apply, no unique safety actions are required to control the adverse effects of such a pump start (i.e., pressure increase and temperature decrease in States A and C). In these operating states, the safety criteria are met through the basic design of the plant systems, and no safety action is specified. In States B and D, where the reactor is not shutdown, the operator or the plant normal control system can control any power changes in the normal manner of power control. Figure 15A.6-9 illustrates the protection sequence for the subject event. Single failures to the normal plant control system pressure regulator or the feedwater controller systems will result in further protection sequences. These are shown in Events 22 and 23. The single failure (SF) aspects of their protection sequences will, of course, not be required. Event 10 - Startup of Idle Recirculation Pump The cold-loop startup of an idle recirculation pump can occur in any state and is most severe and rapid for those operating states in which the reactor may be critical (States B and D). When the transient occurs in the range of 10 to 60% power operation, no safety action response is required. Reactor power is normally limited to approximately 60% design power because of core flow limitations while operating with one recirculation loop working. Above about 60%

power, a high neutron flux scram is initiated. Figure 15A.6-10 shows the protective sequence

for this event.

CPS/USAR CHAPTER 15 15A-35 REV. 11, JANUARY 2005 Event 11 - Recirculation Flow Control Failure (Increasing Flow) A recirculation flow control failure causing increased flow is applicable in States C and D. In State D, the resulting increase in power level is limited by a reactor scram. As shown in Figure 15A.6-11, the scram safety action is accomplished through the combined actions of the neutron monitoring, reactor protection, and control rod drive systems. Event 12 - Recirculation Flow Control Failure (Decreasing Flow)

This recirculation flow control malfunction causes a decrease in core coolant flow. This event is not applicable to States A and B because the reactor vessel head is off and the recirculation pumps normally would not be in use. The number and type of flow controller failure modes determine the protection sequence for the event. For flow control valve control systems, the fast closure of one or two control valves results in the protective sequence of Figure 15A.6-12. Event 13 - Trip of One or Both Recirculation Pumps The trip of one recirculation pump produces a milder transient than does the simultaneous trip of two recirculation pumps. The transient resulting from this two-loop trip is not severe enough to require any unique safety action. The transient is compensated for by the inherent nuclear stability of the reactor. This event is not applicable in States A and B because the reactor vessel head is off and the recirculation pumps normally would not be in use. The trip could occur in States C and D; however, the reactor can accommodate the transient with no unique safety action requirement. Figure 15A.6-13 provides the protection sequence for the event for one or both pump trip

actuations. In fact, this event constitutes an acceptable operational technique to reduce or minimize the effects of other event conditions. To this end, an engineered recirculation pump trip capability is included in the plant operational design to reduce pressure and thermohydraulic transient effects. Operating States C and D are involved in this event. Tripping a single recirculation pump requires no protection system operation.

A two pump trip results in a high water level trip of the main turbine which further causes a stop valve closure and its subsequent SCRAM actuation. Main steamline isolation soon occurs and is followed by RCIC/HPCS systems initiation on low water level. Relief valve actuation will follow. Event 14 - Isolation of One or All Main Steam Lines Isolation of the main steam lines can result in a transient for which some degree of protection is required only in operating States C and D. In operating States A and B, the main steam lines are continuously isolated. Isolation of all main steam lines is most severe and rapid in operating State D during power operation.

CPS/USAR CHAPTER 15 15A-36 REV. 11, JANUARY 2005 Figure 15A.6-14a shows how scram is accomplished by main steam line isolation through the actions of the reactor protection system and the control rod drive system. The nuclear system pressure relief system provides pressure relief. Pressure relief, combined with loss of feedwater flow, causes reactor vessel water level to fall and high-pressure core and RCIC cooling systems supply water to maintain water level and to protect the core until normal steam flow (or other planned operation) is established. Isolation of one main steam line causes a significant transient only in State D during high power operation. Scram is the only unique action required to avoid fuel damage and nuclear system overpressure. Because the feedwater system and main condenser remain in operation following the event, no unique requirement arises for core cooling. As shown in Figure 15A.6-14b, the scram safety action is accomplished through the combined actions of the neutron monitoring, reactor protection, and control rod drive systems.

Event 15 - Inadvertent Opening of the Safety/Relief Valve The inadvertent opening of a safety/relief valve is possible in any operating state. The protection sequences are shown in Figure 15A.6-15. In States A, B, and C, the water level cannot be lowered far enough to threaten fuel damage; therefore, no safety actions are required. In State D, there is a slight decrease in reactor pressure following the event. The pressure regulator closes the main turbine control valves enough to stabilize pressure at a level slightly below the initial value. There are no unique safety system requirements for this event. If the event occurs when the feedwater system is not active in State D, a loss in the coolant inventory results in a reactor vessel isolation. The low water level signal initiates reactor vessel isolation. The nuclear system pressure relief system provides pressure relief. Core cooling is accomplished by the RCIC and HPCS systems which are automatically initiated by the incident detection circuitry (IDC). The automatic depressurization system (ADS) or the manual relief valve system remain as the backup depressurization system if needed. After the vessel has depressurized, long term core cooling is accomplished by the LPCI, LPCS and HPCS, which are initiated on low water level by the IDC system or are manually operated. Containment-suppression pool cooling is manually initiated. Event 16 - Control Rod Withdrawal Error During Refueling and Startup Operations Because a control rod withdrawal error resulting in an increase of positive reactivity can occur under any operating condition, it must be considered in all operating states. For this specific event situation, only State A and B apply.

Refueling No unique safety action is required in operating State A for the withdrawal of one control rod because the core is more than one control rod subcritical. Withdrawal of more than one control rod is precluded by the protection sequence shown in Figure 15A.6-16. During core alterations, the mode switch is normally in the REFUEL position, which allows the refueling equipment to be positioned over the core and also inhibits control rod withdrawal. This transient, therefore, applies only to operating State A.

CPS/USAR CHAPTER 15 15A-37 REV. 11, JANUARY 2005 No safety action is required because the total worth (positive reactivity) of one fuel assembly or control rod is not adequate to cause criticality. Moreover, mechanical design of the control rod

assembly prevents physical removal without removing the adjacent fuel assemblies.

Startup During low power operation (State B), the neutro n monitoring system via the RPS will initiate SCRAM if necessary. Refer to Figure 15A.6-16. Event 17 - Control Rod Withdrawal Error (During Power Operation)

Because a control rod withdrawal error resulting in an increase of positive reactivity can occur under any operating condition, it must be considered in all operating states. For this specific event situation, only States C and D apply. During power operation (Power Range State D), a number of plant protective devices of various designs prohibit the control rod motion before critical levels are reached. Refer to Figure 15A.6-

17. While in State C no protective action is needed. Systems in the power range (0 to 100% NBR) prevent the selection of an out-of-sequenced rod movement by using the rod worth minimizer (RWM) and RSCS which uses either Banked Position or Grouped Notch Withdrawal sequences. In addition, the movement of the rod is monitored and limited within acceptable intervals either by neutronic effects or actual rod motion. The rod block monitor (RBM) or RICS provides movement surveillance. Beyond these rod motion control limits are the fuel/core SCRAM protection systems. While in State C no protective action is needed. Event 18 - Loss of Shutdown Cooling The loss of RHRS-shutdown cooling can occur only during the low pressure portion of a normal reactor shutdown and cooldown. As shown in Figure 15A.6-18, for most single failures that could result in primary loss of shutdown cooling capabilities, no unique safety actions are required; in these cases, shutdown cooling is simply reestablished using redundant shutdown cooling equipment. In the cases

where the RHRS-shutdown cooling suction line beco mes inoperative, a unique arrangement for cooling arises. In States A and B, in which the reactor vessel head is off, the LPCI, LPCS or HPCS can be used to maintain reactor vessel water level. In States C and D, in which the reactor vessel head is on and the system can be pressurized, the automatic depressurization system (ADS) or manual operation of relief valves in conjunction with any of the ECCS and the RHRS suppression pool cooling mode (both manually operated) can be used to maintain water level and remove decay heat. Suppression pool cooling is actuated to remove heat energy from the suppression pool system. Event 19 - RHR Shutdown Cooling - Increased Cooling An RHR shutdown cooling malfunction causing a moderator temperature decrease must be considered in all operating states. However, this event is not considered in States C and D if RPV system pressure is too high to permit operation of the shutdown cooling (RHRS). Refer to Figure 15A.6-19. No unique safety actions are required to avoid the unacceptable safety CPS/USAR CHAPTER 15 15A-38 REV. 11, JANUARY 2005 consequences for transients as a result of a reactor coolant temperature decrease induced by misoperation of the shutdown cooling heat exchangers. In States B and D, where the reactor is at or near critical, the slow power increase resulting from the cooler moderator temperature would be controlled by the operator in the same manner normally used to control power in the source or intermediate power ranges. Event 20 - Loss of All Feedwater Flow A loss of feedwater flow results in a net decrease in the coolant inventory available for core cooling. A loss of feedwater flow can occur in States C and D. Appropriate responses to this transient include a reactor scram on low water lev el and restoration of RPV water level by RCIC and HPCS. As shown in Figure 15A.6-20, the reactor protection and control rod_ drive systems effect a scram on low water level. The primary containment and reactor vessel isolation control system (PCRVICS) and the main steam line isolation valves act to isolate the reactor vessel. After the main steam line isolation valves close, decay heat slowly raises system pressure to the lowest relief valve setting. Pressure is relieved by the RPV pressure relief system. Either the RCIC or HPCS system can maintain adequate water level for initial core cooling and to restore and maintain water level. For long term shutdown and extended core coolings, containment suppression pool cooling sy stems are manually initiated. The requirements for operating State C is the same as for State D except that the scram action is not required in State C. Event 21 - Loss of a Feedwater Heater Loss of a feedwater heater must be considered with regard to the nuclear safety operational criteria only in operating State D because significant feedwater heating does not occur in any other operating state. A loss of feedwater heating causes a transient that will reach the neutron flux scram setpoint. As shown in Figure 15A.6-21, the scram safety action is accomplished through actions of the neutron monitoring, reactor protection, and control rod drive systems. Event 22 - Feedwater Controller Failure - Maximum Demand A feedwater controller failure, causing an excess of coolant inventory in the reactor vessel, is possible in all operating states. Feedwater controller failures considered are those that would give failures of automatic flow control, manual flow control, or feedwater bypass valve control. In operating States A and B, no safety actions are required since the vessel head is removed and the moderator temperature is low. In operat ing State D, any positive reactivity effects by the reactor caused by cooling of the moderator can be mitigated by a scram. As shown in Figure 15A.6-22, the accomplishment of the scram safety action is satisfied through the combined actions of the neutron monitoring, reactor protection, and control rod drive systems. Pressure relief is required in States C and D and is achieved through the operation of the RPV pressure relief system. Initial restoration of the core water level is by the RCIC and HPCS systems. Prolonged isolation may require extended core cooling and containment/suppression pool cooling.

CPS/USAR CHAPTER 15 15A-39 REV. 11, JANUARY 2005 Event 23 - Pressure Regulator Failure (Open Direction) A pressure regulator failure in the open direction, causing the opening of a turbine control or bypass valve, applies only in operating States C and D, because in other states the pressure regulator is not in operation. A pressure regulator failure is most severe and rapid in operating State D at low power. The various protection sequences giving the safety actions are shown in Figure 15A.6-23. Depending on plant conditions existing prior to the event, scram will be initiated either on main steam line isolation, main turbine trip, reactor vessel high pressure, or reactor vessel low water level. The sequence resulting in reactor vessel isolation also depends on initial conditions.

With the mode switch in "Run," isolation is initiated when main steam line pressure decreases to approximately 850 psig. Under other conditions, isolation is initiated by reactor vessel low water level. After isolation is completed, decay heat will cause reactor vessel pressure to increase until limited by the operation of the relief valves. Core cooling following isolation can be provided by the RCICS or HPCS. Shortly after reactor vessel isolation, normal core cooling can be reestablished via the main condenser and feedwater systems or if prolonged isolation is necessary, extended core and containment cooling will manually actuated. Event 24 - Pressure Regulator Failure - Closed A pressure regulator failure in the closed direction (or downscale), causing the closing of turbine control valves, applies only in operating States C and D, because in other states the pressure regulator is not in operation. A single pressure regulator failure downscale would result in little or no effect on the plant operation. The second pressure regulator would provide turbine-reactor control. If the second unit failed this would result in the worst situation, yet it is much less severe than Events 25, 27, 30 and 31. The dual pressure regulator failures are most severe and rapid in operating State D

at high power. The various protection sequences giving the safety actions are shown in Figure 15A.6-24. Upon failure of one pressure regulator downscale, normally a backup regulator will maintain the plant in the present status upon the initial regulator downscale failure. An additional single active component failure of the backup regulator will result in a high flux or pressure SCRAM, system isolation, and subsequent extended isolation core cooling system actuations. Event 25 - Main Turbine Trips (With By-Pass System Operation) A main turbine trip can occur only in operating State D (during heatup or power operation). A turbine trip during heatup is not as severe as a trip at full power because the initial power level is less than 30%, thus minimizing the effects of the transient and enabling return to planned operations via the by-pass system operation. For a turbine trip above 30% power, a scram will occur via turbine stop valve closure as will a recirculation pump trip (RPT). Subsequent relief valve actuation will occur. Eventual main steam line isolation and RCIC and HPCS system initiation will result from low water level. Figure 15A.6-25 depicts the protection sequences required for main turbine trips. Main turbine trip and main generator trip are similar anticipated operational transients and, although main turbine trip is a more severe transient than main generator trip due to the rapid closure of the turbine stop valves, the required safety actions are the same.

CPS/USAR CHAPTER 15 15A-40 REV. 11, JANUARY 2005 Event 26 - Loss of Main Condenser Vacuum (Turbine Trip) A loss of vacuum in the main turbine condenser can occur any time steam pressure is available and the condenser is in use; it is applicable to operating States C and D. This nuclear system pressure increase transient is the most severe of the pressure increase transients. However, scram protection in State C is not needed since the reactor is not coupled to the turbine system. For State D above 30% power, loss of condenser vacuum will initiate a turbine trip with its attendant stop valve closures (which leads to SCRAM) and a recirculation pump trip (RPT) and will also initiate isolation, pressure relief valve actuation, RCIC and HPCS initial core cooling. A scram is initiated by MSIV closure to prevent fuel damage and is accomplished with the actions of the reactor protection system and control rod drive system. Below 30% power (State D) scram is initiated by a high neutron flux signal. Figure 15A.6-26 shows the protection sequences. Decay heat will necessitate extended core and suppression pool cooling. When the RPV depressurizes sufficiently, the low pressure core cooling systems provide core cooling until a planned operation via RHRS shutdown cooling is achieved. Event 27 - Main Generator Trip (With By-Pass System Operation) A main generator trip with by-pass system operation can occur only in operating State D (during heatup or power operation). Fast closure of the main turbine control valves is initiated whenever an electrical grid disturbance occurs which results in significant loss of electrical load on the generator. The turbine control valves are required to close as rapidly as possible to prevent excessive overspeed of the main turbine - generator rotor. Closure of the turbine control valves will cause a sudden reduction in steam flow which results in an increase in system pressure. Above 30% power, scram will occur as a result of fast control valve closure. Turbine tripping will actuate the recirculation pump trip (RPT). Subsequently main steam line isolation will result, pressure relief and initial core cooling by RCIC and HPCS will take place.

Prolonged shutdown of the turbine-generator unit will necessitate extended core and containment cooling. A generator trip during heatup (<30%) is not severe because the turbine by-pass system can accommodate the decoupling of the reactor and the turbine - generator unit, thus minimizing the effects of the transient and enabling return to planned operations.

Figure 15A.6-27 depicts the protection sequences required for a main generator trip. Main generator trip and main turbine trip are similar anticipated operational transients. Although the main generator trip is a less severe transient than a turbine trip due to the rapid closure of the turbine stop valves, the required safety actions for both are the same sequence.

Event 28 - Loss of Normal Onsite Power - Auxiliary Transformer Failure There is a variety of possible plant electrical component failures which could affect the reactor system. The total loss of onsite ac power is the most severe. The loss of auxiliary power transformer results in a sequence of events similar to that resulting from a loss of feedwater flow. The most severe situation occurs in State D during power operation. Figure 15A.6-28 shows the safety actions required to accommodate a loss of normal onsite power in the States

A, B, C, and D. The reactor protection and control rod drive systems effect a scram on main turbine trip or loss of reactor protection system power sources. The turbine trip will actuate a recirculation pump trip (RPT). The primary containment and reactor vessel isolation control system (PCRVICS/CRVICS) and the main steam line isolation valves act to isolate the reactor vessel. After the main steam line isolation valves (MSIV) close, decay heat slowly raises system CPS/USAR CHAPTER 15 15A-41 REV. 11, JANUARY 2005 pressure to the lowest relief valve setting. Pressure is relieved by the RPV pressure relief system. With continued isolation, decay heat may cause increased RPV pressure, and periodically lift relief valves which will cause reactor vessel water level to decrease. The core and containment cooling sequences shown in Figure 15A.6-28 denote the short and long term actions for achieving adequate cooling. Event 29 - Loss of Offsite Power - Grid Loss There is a variety of plant-grid electrical component failures which can affect reactor operation. The total loss of offsite ac power is the most severe. The loss of both onsite and offsite auxiliary power sources results in a sequence of events similar to that resulting from a loss of feedwater flow (see Event 20). The most severe case occurs in State D during power operation. Figure 15A.6-29 shows the safety actions required for a total loss of offsite power in all States A, B, C, and D. The reactor protection and control rod drive systems affect a scram from main turbine trip or loss of reactor protection system power sources. The turbine trip will initiate recirculation pump trip (RPT). The primary containment and reactor vessel isolation control system (PCRVICS/CRVICS) and the main steam line isolation valves (MSIV) act to isolate the reactor vessel. After the main steam line isolation valves close, decay heat slowly raises system pressure to the lowest relief valve setting. Pressure is relieved by the nuclear system pressure relief system. After the reactor is isolated and feedwater flow has been lost, decay heat continues to increase RPV pressure, periodically lifting relief valves and causing reactor vessel water level to decrease. The core and containment cooling sequence shown in Figure 15A.6-29 shows the short and long term sequences for achieving adequate cooling. 15A.6.4 Abnormal Operational Transients 15A.6.4.1 General The safety requirements and protection sequences for abnormal operational transients are described in the following paragraphs for Events 30 through 39. The protection sequence block diagrams show the sequence of front-line safety systems (refer to Figure 15A.6-30 through 15A.6-39). The auxiliaries for the front-line safety systems are indicated in the auxiliary diagrams (Figures 15A.6-1 and 15A.6-2) and the commonality of auxiliary diagrams (Figures 15A.6-60 through 15A.6-65). 15A.6.4.2 Required Safety Actions/Related Unacceptable Consequences The following list relates the safety actions for abnormal operational transients to mitigate or prevent the unacceptable safety consequences cited in Table 15A.2-3.

Safety Action Related Unacceptable ConsequenceReason Action Required Scram and/or RPT 3-2 3-3 To limit gross core-wide fuel damage and to limit nuclear system pressure rise. Pressure relief 3-3 To prevent excessive nuclear system pressure rise. Core, Suppression pool and

containment cooling 3-2, 3-4 To limit further fuel and containment damage in the event that normal cooling is interrupted.

CPS/USAR CHAPTER 15 15A-42 REV. 11, JANUARY 2005 Safety Action Related Unacceptable ConsequenceReason Action Required Reactor vessel isolation 3-2 To limit further fuel damage by reducing the outflow of steam and water from the reactor vessel, thereby limiting the decrease in reactor

vessel water level. Restore ac power 3-2 To limit initial fuel damage by restoring a-c power to systems essential to other safety

actions. Containment isolation 3-1 To limit radiological effects. 15A.6.4.3 Event Definition and Operational Safety Evaluation Event 30 - Main Generator Trip (Wit hout Bypass System Operation) A main generator trip without bypass system operation can occur only in operating State D (during heatup or power operation). A generator trip during heatup without bypass operation results in the same situation as the power operation case. Figure 15A.6-30 depicts the protection sequences required for a main generator trip. The event is basically the same as that described in Event 27 at power levels above 30%. A scram, RPT, isolation, relief valve, and RCIC and HPCS operation will immediately result in prolonged shutdown, which will follow the same pattern as Event 27. The thermohydraulic and thermodynamic effects on the core, of course, are more severe than with the bypass operating. Since the event is of lower probability than Event 27, the unacceptable consequences are less limiting. The load rejection and turbine trip are similar abnormal operational transients and, although main generator trip is a less severe transient than a turbine trip due to the rapid closure of the turbine stop valves, the required safety actions are the same. Event 31 - Main Turbine Trip (Without Bypass System Operation) A main turbine trip without bypass can occur only in operating State D (during heatup or power operation). Figure 15A.6-31 depicts the protection sequences required for main turbine trips. Plant operation with bypass system operation above or below 30% power, due to bypass system failure, will result in the same transient effects: a scram, a RPT, an isolation, subsequent relief valve actuation, and immediate RCIC and HPCS actuation. After initial shutdown, extended core and containment cooling will be required as noted previously in Event

25. Turbine trips without bypass system operations results in very severe thermohydraulic impacts on the reactor core. The allowable limit or acceptable calculational techniques for this event is less restrictive since the event is of lower probability of occurrence than the turbine trip with a bypass operation event. Event 32 - Inadvertent Loading and Operation with Fuel Assembly in Improper Position Operation with a fuel assembly in the improper position is shown in Figure 15A.6-32 and can occur in all operating states. No protection sequences are necessary relative to this event.

Calculated results of worst fuel handling loading error will not cause fuel cladding integrity CPS/USAR CHAPTER 15 15A-43 REV. 11, JANUARY 2005 damage. It requires three independent equipment/operator errors to allow this situation to develop. Events 33 thru 37 - Not Used Event 38 - Recirculation Loop Pump Seizure A recirculation loop pump seizure event considers the instantaneous stoppage of the pump motor shaft of one recirculation loop pump. The case involves operation at design power in State D. A main turbine trip will occur as vessel water level swell exceeds the turbine trip setpoint. This results in a trip scram and a RPT when the turbine stop valves close. Relief valve opening will occur to control pressure level and temperatures. RCIC or HPCS systems will maintain vessel water level. Prolonged isolation will require core and containment cooling and possibly some radiological effluent control. The protection sequence for this event is given in Figure 15A.6-38.

Event 39 - Recirculation Loop Pump Shaft Break A recirculation loop pump shaft break event considers the degraded, delayed stoppage of the pump motor shaft of one recirculation loop pump. The case involves operation at design power in State D. A main turbine trip will occur as vessel water level swell exceeds the turbine trip setpoint. This results in a trip scram and a RPT when the turbine stop valves close. Relief valve opening will occur to control pressure level and temperatures. RCIC or HPCS systems will maintain vessel water level. Prolonged isolation will require core and containment cooling and possibly some radiological effluent control. The protection sequence for this event is given in Figure 15A.6-39.

15A.6.5 Design Basis Accidents 15A.6.5.1 General The safety requirements and protection sequences for accidents are described in the following paragraphs for Events 40 through 49. The protection sequence block diagrams show the safety actions and the sequence of front-line safety systems used for the accidents (refer to Figures 15A.6-40 through 15A.6-49). The auxiliaries for the front-line safety systems are indicated in the auxiliary diagrams (Figures 15A.6-1 and 15A.6-2) and the commonality of auxiliary diagrams (Figures 15A.6-60 through 15A.6-65). 15A.6.5.2 Required Safety Actions/Unacceptable Consequences The following list relates the safety actions for design basis accident to mitigate or prevent the unacceptable consequences cited in Table 15A.2-4. Safety Action Related Unacceptable Consequence Reason Action Required Scram 4-2 4-3 To prevent fuel cladding failure* and to prevent excessive nuclear system pressures Pressure relief 4-3 To prevent excessive nuclear system pressure. Core Cooling 4-2 To prevent fuel cladding failure.

CPS/USAR CHAPTER 15 15A-44 REV. 11, JANUARY 2005 Safety Action Related Unacceptable Consequence Reason Action Required Reactor vessel isolation 4-1 To limit radiological effect to not exceed the guideline values of 10 CFR 100. Establish reactor containment 4-1 To limit radiological effects to not exceed the guideline values of 10 CFR 100. Containment cooling 4-4 To prevent excessive pressure in the containment when containment is required. Stop rod ejection 4-2 To prevent fuel cladding failure. Restrict loss of reactor coolant (passive) 4-2 To prevent fuel cladding failure. Main Control Room environmental control 4-5 To prevent overexposure to radiation of plant personnel in the control room. Limit reactivity insertion rate (passive) 4-2 4-3 To prevent fuel cladding failure and to prevent excessive nuclear system pressure

• Failure of the fuel barrier includes fuel cladding fragmentation (loss-of-coolant accident) and excessive fuel enthalpy (control rod drop accident). 15A.6.5.3 Event Definition and Operational Safety Evaluations Event 40 - Control Rod Drop Accident (CRDA)

The control rod drop accident (CRDA) results from an assumed failure of the control rod-to-drive mechanism coupling after the control rod (very reactive rod) becomes stuck in its fully inserted position. It is assumed that the control rod drive is then fully withdrawn before the stuck rod falls out of the core. The control rod velocity limiter, an engineered safeguard, limits the control rod drop velocity. The resultant radioactive material release is maintained far below the guideline values of 10 CFR 100. The control rod drop accident is applicable only in operating State D. The control rod drop accident cannot occur in State B because rod coupling integrity is checked on each rod to be withdrawn if more than one rod is to be withdrawn. No safety actions are required in States A or C where the plant is in a shutdown state by more than the reactivity worth of one rod prior to the

accident. Figure 15A.6-40 presents the different protection sequences for the control rod drop accident. As shown in Figure 15A.6-40, the reactor is automatically scrammed and isolated. For all design basis cases, the neutron monitoring, reactor protection, and control rod drive systems will provide a scram from high neutron flux. Any high radiation in the containment areas will initiate closure of other possible pathways to atmosphere, as necessary. After the reactor has been scrammed and isolated, the pressure relief system allows the steam (produced by decay heat) to be directed to the suppression pool. Initial core cooling is accomplished by either the RCIC or the HPCS or the normal feedwater system. With prolonged isolation, as indicated in Figure 15A.6-40, the reactor operator initiates the RHRS/suppression pool cooling mode and depressurizes the vessel with the manual mode of the ADS or via normal manual relief valve operation. The LPCI, LPCS and HPCS maintain the vessel water CPS/USAR CHAPTER 15 15A-45 REV. 11, JANUARY 2005 level and accomplish extended core cooling. Isolation of turbine-condenser fission product releases will also be maintained. Event 41 - Fuel Handling Accident Because a fuel-handling accident can potentially occur any time when fuel assemblies are being manipulated, either over the reactor core or in a spent fuel pool, this accident is considered in all operating states. Considerations include mechanical fuel damage caused by drop impact and a subsequent release of fission products. The protection sequences pertinent to this accident are shown in Figure 15A.6-41. Containment and/or auxiliary fuel building isolation and standby gas treatment operation are automatically initiated by the respective ventilation radiation monitoring systems. Figure 15.A.6-41 describes the protection sequences for the event. Event 42 - Loss-of-Coolant Accidents Resulting from Postulated Piping Breaks Within RPCB Inside Containment (DBA-LOCA) Pipe breaks inside the containment are considered only when the nuclear system is significantly pressurized (States C and D). The result is a release of steam and water into the containment.

Consistent with NSOA criteria, the protection requirements consider all size line breaks including larger liquid recirculation loop piping down to small steam instrument line breaks. The most severe cases are the circumferential break of the largest (liquid) recirculation system pipe and the circumferential break of the largest (steam) main steam line. As shown in Figure 15A.5-42, in operating State C (reactor shut down, but pressurized), a pipe break accident up to the DBA can be accommodated within the nuclear safety operational criteria through the various operations of the main steam line isolation valves, emergency core cooling systems (HPCS, ADS, LPCI, CSCS, and LPCS), containment and reactor vessel isolation control system, reactor/shield/auxiliary buildings, standby gas treatment system, main control room heating, cooling and ventilation system, MSIV-LCS, emergency service water systems, hydrogen control system, equipment cooling systems, and the incident detection circuitry. For small pipe breaks inside the containment, pressure relief is effected by the nuclear system pressure relief system, which transfers decay heat to the suppression pool. For large breaks, depressurization takes place through the break itself. In State D (reactor not shut down, but pressurized), the same equipment is required as in State C but, in addition, the reactor protection system and the control rod drive system must operate to scram the reactor. The limiting items, on which the operation of the above equipment is based, are the allowable fuel cladding temperature and the containment pressure capability. The control rod drive housing supports are considered necessary whenever the system is pressurized to prevent excessive control rod movement through the bottom of the reactor pressure vessel following the postulated rupture of one control rod drive housing (a lesser case of the design basis loss-of coolant accident and a related preventive of a postulated rod ejection accident). After completion of the automatic action of the above equipment, manual operation of the RHRS (suppression pool cooling mode) and ADS or relief valves (controlled depressurization) is required to maintain containment pressure and fuel cladding temperature within limits during extended core cooling.

CPS/USAR CHAPTER 15 15A-46 REV. 11, JANUARY 2005 Events 43, 44, 45 - Loss of Coolant Accidents (LOCA) Resulting from Postulated Pipe Breaks -

Outside Containment Pipe break accidents outside the containment are assumed to occur any time the nuclear system is pressurized (States C and D). This accident is most severe during operation at high power (State D). In State C, this accident becomes a subset of the State D sequence. The protection sequences for the various possible pipe breaks outside the containment are shown in Figures 15A.6-43, 15A.6-44, 15A.6-45. The sequences also show that for small breaks (breaks not requiring immediate action) the reactor operator can use a large number of process indications to identify the break and isolate it. In operating State D (reactor not shut down, but pressurized), scram is accomplished through operation of the reactor protection system and the control rod drive system. Reactor vessel isolation is accomplished through operation of the main steam line isolation valves and the containment and reactor vessel isolation control system. For a main steam line break, initial core cooling is accomplished by either the HPCS or the automatic depressurization system (ADS) or manual relief valve operation in conjunction with the LPCS, or LPCI. These systems provide parallel paths to effect initial core cooling, thereby satisfying the single-failure criterion. Extended core cooling is accomplished by the single failure proof, parallel combination of LPCS, HPCS, and LPCI systems. The ADS or relief valve system operation and the RHRS suppression po ol cooling mode (both manually operated) are required to maintain containment pressure and fuel cladding temperature within limits during extended core cooling. Event 46 - Gaseous Radwaste System Leak or Failure It is assumed that the line leading to the steam jet air ejector fails near the main condenser. This results in activity normally processed by the offgas treatment system being discharged directly to the turbine building and subsequently through the ventilation system to the environment. This failure results in a loss-of-flow signal to the offgas system. This event can be considered only under States C and D, and is shown in Figure 15A.6-46. The reactor operator initiates a normal shutdown of the reactor to reduce the gaseous activity being discharged. A loss of main condenser vacuum will result (timing depending on leak rate) in a main turbine trip and ultimately a reactor shutdown. Refer to Event 26 for reactor protection sequence (see Figure 15A.6-26). Event 47 - Augmented Offgas Treatment System Failure An evaluation of those events which could cause a gross failure in the offgas system has resulted in the identification of a postulated seismic event, more severe than the one for which the system is designed, as the only conceivable event which could cause significant damage. The detected gross failure of this system will result in manual isolation of this system from the main condenser. The isolation results in high main condenser pressure and ultimately a reactor scram. Protective sequences for the event are shown in Figure 15A.6-46.

CPS/USAR CHAPTER 15 15A-47 REV. 11, JANUARY 2005 The undetected postulated failure soon results in a system isolation necessitating reactor shutdown because of loss of vacuum in the main condenser. This transient has been analyzed in Event 26 (see Figure 15A.6-26). Event 48 - Liquid Radwaste System Leak or Failure Releases which could occur inside and outside of the containment, not covered by Events 40, 41, 42, 43, 44, 45, 47, and 48 will probably include small spills and equipment leaks of radioactive materials inside structures housing the subject process equipment. Conservative values for leakage have been assumed and evaluated in the plant under routine releases. The offsite dose that results from any small spill which could occur outside containment will be negligible in comparison to the dose resulting from the accountable (expected) plant leakage. The protective sequences for this event are provided in Figure 15A.6-48.

Event 49 - Liquid Radwaste System - Storage Tank Failure An unspecified event causes the complete release of the average radioactivity inventory in the storage tank containing the largest quantities of significant radionuclides from the liquid radwaste system. This is assumed to be one of the concentrate waste tanks in the radwaste building. The airborne radioactivity released during the accident is assumed to bypass directly to the environment via the main plant vent. The postulated events that could cause release of the radioactive inventory of the concentrate waste tank include cracks in the vessels and an operator error. The possibility of small cracks and consequent low-level release rates receives primary consideration in system and component design. The concentrate waste tank is designed to operate at atmospheric pressure and 200° F maximum temperature so the possibility of failure is considered small. A liquid radwaste release caused by operator error is also considered a remote possibility. Operating techniques and administrative procedures emphasize detailed system and equipment operating instruction. The manually operated drain valve in series with the tank discharge valve prevents inadvertent tank draining. Should a release of liquid radioactive wastes occur, floor drain sump pumps in the floor of the radwaste building will receive a high water level alarm, activate automatically, and remove the spilled liquid to a contained storage tank. The protective sequences for this event are provided in Figure 15A.6-49.

15A.6.6 Special Events 15A.6.6.1 General Additional special events are postulated to demonstrate that the plant is capable of accommodating off-design occurrences. (Refer to Events 50 through 53). As such, these events are beyond the safety requirements of the other event categories. The safety actions shown on the sequence diagrams (refer to Figures 15A.6-50 through 15A.6-53) for the additional special events follow directly from the requirements cited in the demonstration of the plant capability. Auxiliary system support analyses are shown in Figures 15A.6-1, 2, and 15A.6-60 through 15A.6-64.

CPS/USAR CHAPTER 15 15A-48 REV. 11, JANUARY 2005 15A.6.6.2 Required Safety Action/Unacceptable Consequences The following list relates the safety actions for special events to prevent the unacceptable consequences cited in Table 15A.2-5:

Safety Action Related Unacceptable Consequences Reason for Action Available A. Main Control Room Considerations Manually initiate all shutdown controls from local panels 5-1 5-2 Local panel control has been provided and is available outside main control room. Manually initiate SLCS 5-3 Standby Liquid Control System to control reactivity to cold shutdown is available. 15A.6.6.3 Event Definitions and Operational Safety Evaluation Event 50 - Shipping Cask Drop

Spent Fuel Cask Drop Due to the redundant nature of the plant crane, the cask drop accident is not believed to be a credible accident. However, the accident is hypothetically assumed to occur as a consequence of an unspecified failure of the cask lifting mechanism, thereby allowing the cask to fall. It is assumed that a spent fuel shipping cask containing irradiated fuel assemblies is in the process of being moved with the cask suspended from the crane above the rail car. The fuel assemblies have been out of the reactor for at least 90 days. Through some unspecified failure, the cask is released from the crane and falls between 30 to 100 feet onto the rail car. Some of the coolant in the outer cask structure may leak from the

cask. The reactor operator will ascertain the degree of cask damage and, if possible, make the necessary repairs and refill the cask coolant to its normal level if coolant has been lost. It is assumed that if the coolant is lost from the external cask shield, the operator will establish forced cooling of the cask by introducing water into the outer structure annulus or by spraying water on the cask exterior surface. Maintaining the cask in a cool condition will, therefore, ensure no fuel damage as a result of a temperature increase due to decay heat. Since the cask is still within the SGTS-building volume, any activity postulated to be released can be accommodated by the plant filter, decay and elevated release system. The protective sequences for this event are provided in Figure 15A.6-50a.

Event 51 - Reactor Shutdown - ATWS Reactor shutdown from a plant transient occurrence (e.g., turbine trip) without the use of mechanical control rods is an event currently being evaluated to determine the capability of the plant to be safely shutdown. The event is applicable in any operating state. Figure 15A.6-51 shows the protection sequence for this extremely improbable and demanding event in each CPS/USAR CHAPTER 15 15A-49 REV. 11, JANUARY 2005 operating state. In State A, no sequence is shown because the reactor is already in the condition finally required by definition. State D is the most limiting case. Upon initiation of the plant transient situation (turbine trip), a scram will be initiated but no control rods are assumed to move. The recirculation pumps will be tripped by the initial turbine trip signal. If the nuclear system becomes isolated from the main condenser, low power neutron heat can be transferred from the reactor to the suppression pool via the relief valves. The incident detection circuitry initiates operation of the HPCS on low water level which maintains reactor vessel water level. The standby liquid control system will be manually initiated and the transition from low power neutron heat to decay heat will occur. The RHRS suppression pool spray cooling mode is used to remove the low power neutron and decay heat from the suppression pool as required. When RPV pressure falls to 100 to 200 psig level, the RHRS shutdown cooling mode is started and continued to cold shutdown. Various single failure analytical exercises can be examined to further show additional capabilities to accommodate further plant system degradations. Event 52 - Reactor Shutdown From Outside Main Control Room Reactor shutdown from outside main control room is an event investigated to evaluate the capability of the plant to be safely shutdown and cooled to the cold shutdown state from outside the main control room. The event is applicable in any operating States A, B, C, and D. Figure 15A.6-52 shows the protection sequences for this event in each operating state. In State A, no sequence is shown because the reactor is already in the condition finally required for the event. In State C, only cooldown is required since the reactor is already shutdown.

A scram from outside the main control room can be achieved by opening the ac supply breakers for the reactor protection system. If the nuclear system becomes isolated from the main condenser, decay heat is transferred from the reactor to the suppression pool via the relief valves. The incident detection circuitry initiates operation of the RCIC and HPCS systems on low water level which maintains reactor vessel water level, and the RHRS suppression pool cooling mode is used to remove the decay heat from the suppression pool if required. When

reactor pressure falls below 96.5 psig level, the RHRS shutdown cooling mode is started.

Event 53 - Reactor Shutdown Without Control Rods Reactor shutdown without control rods is an event requiring an alternate method of reactivity control, the standby liquid control system. By definition, this event can occur only when the reactor is not already shutdown. Therefore, this event is considered only in operating States B

and D. The standby liquid control system must operate to avoid unacceptable consequence criteria 5-3. The design bases for the standby liquid control system result from these operating criteria when applied under the most severe conditions (State D at rated power). As indicated in Figure 15A.6-53, the standby liquid control system is manually initiated and controlled in States B and D.

CPS/USAR CHAPTER 15 15A-50 REV. 12, JANUARY 2007 TABLE 15A.6-1 NORMAL OPERATION BWR Operating State NSOA Event No. Event Description NSOA Event Figure Number Safety Analysis Section Number A B C D 1 Refueling 15A.6-3,4,5,6 X - Initial - Reload 2 Achieving Criticality 15A.6-3,4,5,6 X X X X 3 Heat-Up 15A.6-6 X 4 Power Operation - Generation 15A.6-6 X

- Steady State - Daily Load Reduction and Recovery

- Grid Frequency Control Response

- Control Rod Sequence Exchanges

- Power Generation Surveillance Testing

• Turbine Stop Value SurveillanceTests

• Turbine Control Value SurveillanceTests

• MSIV Surveillance Tests 5 Achieving Shutdown 15A.6-4,6 X X 6 Cooldown 15A.6-3,5 X X

CPS/USAR CHAPTER 15 15A-51 REV. 11, JANUARY 2005 TABLE 15A.6-2 ANTICIPATED OPERATIONAL TRANSIENTS NSOA Event BWR Operating State No. Event Description NSOA Event Figure Number Safety Analysis Section Number A B C D 7 Manual or Inadvertent SCRAM 15A.6-7 7.2 X X X X 8 Loss of Plant Instrument Service Air Systems 15A.6-8 9.3.1 X X X X 9 Inadvertent Startup of HPCS Pump 15A.6-9 15.5.1 X X X X 10 Inadvertent Startup of Idle Recirculation Loop Pump 15A.6-10 15.4.4 X X X X 11 Recirculation Loop Flow Control Failure With Increasing Flow 15A.6-11 15.4.5 X X 12 Recirculation Loop Flow Control Failure With Decreasing Flow 15A.6-12 15.3.2 X X 13 Recirculation Loop Pump Trip 15A.6-13 15.3.1 X X - With One Pump

- with Two Pumps 14 Inadvertent MSIV Closure 15.2.4 - With One Valve 15A.6-14a X X

- With Four Valves 15A.6-14b X X 15 Inadvertent Operation of One 15A.6-15 15.6.1 X X X X Safety/Relief Valve

- Opening/Closing - Stuck Open 16 Continuous Control Rod Withdrawal Error 15A.6-16 15.4.1

- During Startup X

- During Refueling X

CPS/USAR CHAPTER 15 15A-52 REV. 11, JANUARY 2005 TABLE 15A.6 (Continued) ANTICIPATED OPERATIONAL TRANSIENTS BWR Operating State NSOA Event No. Event Description NSOA Event Figure Number Safety Analysis Section Number A B C D 17 Continuous Control Rod Withdrawal Error - At Power 15A.6-17 15.4.2 X X 18 RHRS - Shutdown Cooling Failure Loss of Cooling 15A.6-18 15.2.9 X X X X 19 RHRS - Shutdown Cooling Failure Increased Cooling 15A.6-19 15.1.6 X X X X 20 Loss of All Feedwater Flow 15A.6-20 15.2.7 X X 21 Loss of Feedwater Heater 15A.6-21 15.1.1 X 22 Feedwater Controller Failure Maximum Demand - Low Power 15A.6-22 15.1.2 X X X X 23 Pressure Regulator Failure - Open 15A.6-23 15.1.3 X X 24 Pressure Regulator Failure - Closed 15A.6-24 15.2.1 X X 25 Main Turbine Trip With Bypass System Operational 15A.6-25 15.2.3 X 26 Loss of Main Condenser Vacuum 15A.6-26 15.2.5 X X 27 Main Generator Trip (Load Rejection) With Bypass System Operational 15A.6-27 15.2.2 X 28 Loss of Plant Normal On-Site AC POWER - Auxiliary Transformer Failure 15A.6-28 15.2.6 X X X X 29 Loss of Plant Normal Off-Site AC POWER - Grid Connection Failure 15A.6-29 15.2.6 X X X X

CPS/USAR CHAPTER 15 15A-53 REV. 11, JANUARY 2005 TABLE 15A.6-3 ABNORMAL OPERATIONAL TRANSIENTS BWR Operating State NSOA Event No. Event Description NSOA Event Figure Number Safety Analysis Section Number A B C D 30 Main Generator Trip (Load Rejection) With Bypass System Failure 15A.6-30 15.2.2 X 31 Main Turbine Trip With Bypass System Failure15A.6-31 15.2.3 X 32 Inadvertent Loading and Operation of a Fuel Assembly in an Improper Position 15A.6.32 15.4.7 X X X X 33 NOT USED --- --- 34 NOT USED --- ---

35 NOT USED --- ---

36 NOT USED --- ---

37 NOT USED --- --- 38 Recirculation Loop Pump Seizure for One Loop 15A.6-38 15.3.3 X 39 Recirculation Loop Pump Shaft Break 15A.6-39 15.3.4 X

CPS/USAR CHAPTER 15 15A-54 REV. 11, JANUARY 2005 TABLE 15A.6-4 DESIGN BASIS ACCIDENTS BWR Operating State NSOA Event No. Event Description NSOA Event Figure Number Safety Analysis Section Number A B C D 40 Control Rod Drop Accident 15A.6-40 15.4.9 X 41 Fuel Handling Accident 15A.6-41 15.7.4 X X X X 42 Loss-of-Coolant Accident* X X Resulting From Spectrum of Postulated Piping Breaks Within the RPCE Inside Containment 15A.6-42 15.6.5 43 Small, Large, Steam and Liquid 15A.6-43 15.6.4 X X Piping Breaks Outside Containment 44 Instrument Line Break Outside 15A.6-44 15.6.2 X X Drywell 45 Feedwater Line Break Outside 15A.6-45 15.6.6 X X Containment 46 Gaseous Radwaste System Leak or 15A.6-46 15.7.1 X X X X Failure 47 Augmented Off-Gas Treatment 15A.6-47 15.7.1 X X X X System Failure 48 Liquid Radwaste System Leak or 15A.6-48 15.7.2 X X X X Failure 49 Liquid Radwaste System Storage 15A.6-49 15.7.3 X X X X Tank Failure

• Small, Intermediate, and Large CPS/USAR CHAPTER 15 15A-55 REV. 11, JANUARY 2005 TABLE 15A.6-5 SPECIAL EVENTS BWR Operating State NSOA Event No. Event Description NSOA Event Figure Number Safety Analysis Section Number A B C D 50 Shipping Cask Drop 15A.6-50 15.7.5 X X X X - Solid Radwaste

- Spent Fuel

- New Fuel 51 Reactor Shutdown From Anticipated 15A.6-51 15.8 X X X X Transient Without SCRAM (ATWS) 52 Reactor Shutdown 15A.6-52 7.4 X X X X From Outside Main Control Room 53 Reactor Shutdown 15A.6-53 9.3.5 X X Without Control Rods CPS/USAR CHAPTER 15 15A-56 REV. 11, JANUARY 2005 15A.7 REMAINDER OF NSOA With the information presented in the protection sequence block diagrams, the auxiliary diagrams, and the commonality of auxiliary diagrams, it is possible to determine the exact functional and hardware requirements for each system. This is done by considering each event in which the system is employed and deriving a limiting set of operational requirements. This limiting set of operational requirements establishes the lowest acceptable level of performance for a system or component, or the minimum number of components or portions of a system that must be operable in order that plant operation may continue. The operational requirements derived using the above process may be complicated functions of operating states, parameter ranges, and hardware conditions. The final step is to simplify these complex requirements into technical specifications that encompass the operational requirements that can be used by plant operations and management personnel. 15A.8 CONCLUSIONS It is concluded that the nuclear safety operational and plant design basis criteria are satisfied when the plant is operated in accordance with the nuclear safety operational requirements determined by the method presented in this appendix. 15A.9 LIST OF REFERENCES 15A.9-1 Hirsch, M. M., "Methods for Calculating Safe Test Intervals and Allowable Repair Times for Engineered Safeguard Systems," January 1973 (NEDO-10739).

CPS/USAR CHAPTER 15 15B-1 REV. 11, JANUARY 2005 APPENDIX 15B RECIRCULATION SYSTEMS SINGLE-LOOP OPERATION 15B.1 INTRODUCTION AND

SUMMARY

To prevent potential control oscillations from occurring in the recirculation flow control system, the flow control in the active loop should be in manual mode for single-loop operation. The limiting Maximum Average Planar Linear Heat Generation Rate (MAPLHGR) reduction factor for single-loop operation for the current cycle is provided in Appendix 15D. The single-loop operation MAPLHGR reduction factor is adjusted as necessary based on the results of the reload analysis, including power uprate. The containment response for a Design Basis Accident (DBA) recirculation line break with single-loop operation is bounded by the rated power, including power uprate, two-loop operation analysis presented in Section 6.2. This conclusion covers all single-loop operation power/flow conditions.

A generic assessment was made to determine the impact of single-loop operation on the Anticipated Transient Without Scram (ATWS). It was found that consequences of ATWS events postulated during single-loop operation would be bounded by consequences of ATWS events during two-loop operation. The fuel thermal and mechanical duty for transient events occurring during SLO is found to be bounded by the fuel design bases. The Average Power Range Monitor (APRM) fluctuation should not exceed a flux amplitude of +15% of rated and the core plate differential pressure fluctuation should not exceed 3.2 psi peak to peak to be consistent with the fuel rod and assembly design bases. A recirculation pump drive flow limit is imposed for SLO. The highest drive flow that meets acceptable vessel internal vibration criteria is the driv e flow limit for SLO. Actual drive flow limit in SLO was determined at Kuo Sheng 1, the BWR6/218 prototype plant and is about 33,000

gpm. 15B.2 MCPR FUEL CLADDING INTEGRITY SAFETY LIMIT Except for core total flow and TIP reading, the uncertainties used in the statistical analysis to determine the MCPR fuel cladding integrity safety limit are not dependent on whether coolant flow is provided by one or two recirculation pumps. Uncertainties used in the two-loop operation analysis are documented in the USAR. A 6% co re flow measurement uncertainty has been established for single-loop operation (compared to 2.5% for two-loop operation). As shown below, this value conservatively reflects the one standard deviation (one sigma) accuracy of the core flow measurement system document ed in Reference 15B.8-1. The random noise component of the TIP reading uncertainty was revised for single recirculation loop operation to reflect the operating plant test results given in Subsection 15B.2.2. This revision resulted in a single-loop operation process computer effective TIP uncertainty of 6.8% for initial cores and 9.1% for reload cores. Comparable two-loop process computer uncertainty values are 6.3% for initial cores and 8.7% for reload cores. The net effect of these two revised uncertainties is a 0.01 increase in the required MCPR fuel cladding integrity safety limit to address 3D Monicore is bounded by the 0.01 MCPR penalty.

CPS/USAR CHAPTER 15 15B-2 REV. 11, JANUARY 2005 15B.2.1 Core Flow Uncertainty 15B.2.1.1 Core Flow Measurement During Single-Loop Operation The jet pump core flow measurement system is calibrated to measure core flow when both sets of jet pumps are in forward flow; total core flow is the sum of the indicated loop flows. For single-loop operation, however, some inactive jet pumps will be backflowing (at active pump flow above approximately 35%). Therefore, the measured flow in the backflowing jet pumps must be subtracted from the measured flow in the active loop to obtain the total core flow. In addition, the jet pump coefficient is different for reverse flow than for forward flow, and the measurement of reverse flow must be modified to account for this difference. In single-loop operation, the total core flow is derived by the following formula: =Flow Indicated Loop Inactive C Flow Indicated Loop Active Flow Core Total Where C (= 0.95) is defined as the ratio of "Inactive Loop True Flow" to "Inactive Loop Indicated Flow". "Loop Indicated Flow" is the flow measured by the Jet pump "single-tap" loop flow summers and indicators, which are set to read forward flow correctly. The 0.95 factor was the result of a conservative analysis to appropriately modify the single-tap flow coefficient for reverse flow.* If a more exact, less conservative core flow is required, special in-reactor calibration tests would have to be made. Such calibration tests would involve:

calibrating core support plate DP versus core flow during one-pump and two-pump operation along with 100% flow control line and calculating the correct value of C based on the core support plate DP and the loop flow indicator readings. 15B.2.1.2 Core Flow Uncertainty Analysis The uncertainty analysis procedure used to establish the core flow uncertainty for one-pump operation is essentially the same as for two-pump operation, with some exceptions. The core flow uncertainty analysis is described in Reference 15B.8-1. The analysis of one-pump core flow uncertainty is summarized below. For single loop operation, the total core flow can be expressed as follows (refer to Figure 15B.2-1):

W C = W A - W I where: W C = total core flow, W A = active loop flow, and W I = inactive loop (true) flow.

• The analytical expected value of the "C" coefficient for CPS is 0.82.

CPS/USAR CHAPTER 15 15B-3 REV. 11, JANUARY 2005 By applying the "propagation of errors" method to the above equation, the variance of the total flow uncertainty can be approximated by:

c a 1 a a 1 1 2 W 2 2 W 2 2 W 2 W 2 rand I rand A sys C+++= where: C W = uncertainty of total core flow; sys W = uncertainty systemic to both loops; rand A W = random uncertainty of active loop only; rand I W = random uncertainty of inactive loop only; c = uncertainty of "C" coefficient; and a = ratio of inactive loop flow (W I) to active loop flow (W A). From an uncertainty analysis, the conservative, bounding values of rand I rand A sys W W W , , and s c are 1.6%, 2.6%, 3.5%, and 2.8% respectively. Based on the above uncertainties and a bounding value of 0.36* for "a", the variance of the total flow uncertainty is approximately:

()()()()()2 2 2 2 2 2 W 2 8.2 5.3 36.0 1 36.0 6.2 36.0 1 1 6.1 C+++= = (5.0%)2 When the effect of 4.1% core bypass flow split uncertainty at 12% (bounding case) bypass flow fraction is added to the total core flow uncertainty, the active coolant flow uncertainty is:

()()()coolant%1.5%1.4 12.0 1 12.0%0.5 active 2 2 2 2 2=+= which is less than the 6% flow uncertainty assumed in the statistical analysis. In summary, core flow during one-pump operation is measured in a conservative way and its uncertainty has been conservatively evaluated.

• This flow split ratio varies from about 0.13 to 0.36. The 0.36 value is a conservative bounding value. The analytical expected value of the flow split ratio for CPS is 0.28.

CPS/USAR CHAPTER 15 15B-4 REV. 11, JANUARY 2005 15B.2.2 TIP Reading Uncertainty To ascertain the TIP noise uncertainty for single recirculation loop operation, a test was performed at an operating BWR. The test was performed at a power level 59.3% of rated with a single recirculation pump in operation (core flow 46.3% of rated). A rotationally symmetric control rod pattern existed during the test.

Five consecutive traverses were made with each of five TIP machines, giving a total of 25 traverses. Analysis of this data resulted in a nodal TIP noise of 2.85%. Use of this TIP noise value as a component of the process computer total uncertainty results in a one-sigma process computer total effective TIP uncertainty value for single-loop operation of 6.8% for initial cores and 9.1% for reload cores. 15B.3 MCPR OPERATING LIMIT 15B.3.1 Abnormal Operating Transients Operating with one recirculation loop results in a maximum power output which is about 30% below that which is attainable for two-pump operation. Therefore, the consequences of abnormal operational transients from one-loop operation will be considerably less severe than

those analyzed from a two-loop operational mode. For pressurization, flow increase, flow decrease, and cold water injection transients, the results presented in Chapter 15 bound both the thermal and overpressure consequences of one-loop operation. The consequences of flow decrease transients are also bounded by the full power analysis. A single pump trip from one-loop operation is less severe than a two-pump trip from full power because of the reduced initial power level. The worst flow increase transient results from recirculation flow controller failure, and the worst cold water injection transient results from the loss of feedwater heating. For the former, the MCPR f curve is derived from a postulated runout of both recirculation loops. This condition produces the maximum possible power increase and hence maximum CPR for transients initiated from less than rated power and flow. When operating with only one recirculation loop, the flow and power increase associated with this failure with only one loop will be less than that associated with both loops; therefore, the MCPR f curve derived with the two-pump assumption is conservative for single-loop operation. Adjustments to the single-loop operating limits are described in Appendix 15D for the reload cycles. The latter event, loss of feedwater heating, is generally the most severe cold water increase event with respect to increase in core power.

This event is caused by positive reactivity insertion from core inlet subcooling and it is relatively insensitive to initial power level. A generic statistical loss of feedwater heater analysis using different initial power levels and other core design parameters concluded one-pump operation with lower initial power level is conservatively bounded by the full power two-pump analysis. Abnormal restart of the idle recirculation pump was analyzed by GE as part of the cycle analysis supporting initial CPS operation (refer to historic FSAR Section 15.4.4). The input assumptions to analyses concerning fuel cladding were subsequently changed. This change includes the assumption of a smaller temperature difference between the two recirculation loops (50

°F) during the idle loop startup. The idle loop startup transient (during single-loop operation) at CPS has been analyzed to assure that it is bounded by transients explicitly analyzed in the Supplemental Reload Licensing Report. Aspects of this analysis are briefly described in Section 15.4.4.

CPS/USAR CHAPTER 15 15B-5 REV. 11, JANUARY 2005 From the above discussions, it is concluded that the transient consequence from one-loop operation is bounded by previously submitted full power analyses. The maximum power level that can be attained with one-loop operation is only restricted by the MCPR and overpressure limits established from a full-power analysis. In the following sections, the results of two of the most limiting transients analyzed for single-loop operation are presented. They are, respectively: a. feedwater flow controller failure (maximum demand), (FWCF)

b. generator load rejection with bypass failure, (LRBPF). The plant initial conditions are given in Table 15B.3-1.

15B.3.1.1 Feedwater Controller Failure - Maximum Demand The computer model described in Reference 15B.8-2 was used to simulate this event. The analysis has been performed with the plant conditions tabulated in Table 15B.3-1, except the initial vessel water level at level setpoint L4 for conservatism. By lowering the initial water level, more cold feedwater will be injected before Level 8 is reached resulting in higher heat

fluxes. The simulated feedwater controller failure transient is shown in Figure 15B.3-1 and Table 15B.3-2 which give a summary of the transient analysis results for the initial cycle. The calculated MCPR is 1.27, which is well above the safety limit MCPR of 1.07 so no fuel failure due to boiling transition is predicted. The peak vessel pressure predicted is 1067 psig and is well below the ASME limit of 1375 psig. 15B.3.1.2 Generator Load Rejection With Bypass Failure The computer model described in Reference 15B.8-2 was used to simulate this event. These analyses have been performed, unless otherwise noted, with the plant conditions tabulated in Table 15B.3-1. The simulated generator load rejection with bypass failure is shown in Figure 15B.3-2 and Table 15B.3-2 which summarize the transient analysis results for the initial cycle. The peak vessel predicted pressure is 1181 psig and well below the ASME limit of 1375 psig. The calculated MCPR is 1.34 which is considerably above the safety limit MCPR of 1.07. 15B.3.1.3 Summary and Conclusions The transient peak value results and the Critical Power Ratio (CPR) results for the initial cycle analysis are summarized in Table 15B.3-2. This table indicates that for the transient events analyzed here, the MCPRs for all transients are above the single-loop operation safety limit value of 1.07. It is concluded the operating limit MCPRs established for two-pump operation are also applicable to single-loop operation conditions.

CPS/USAR CHAPTER 15 15B-6 REV. 11, JANUARY 2005 For pressurization, Table 15B.3-2 indicates the peak pressures are below the ASME code value of 1375 psig. Hence, it is concluded the pressure barrier integrity is maintained under single-loop operation conditions. The applicability of this analysis for the current cycle is reverified as part of the reload analysis documented in Appendix 15D. 15B.3.2 Rod Withdrawal Error The rod withdrawal error (RWE) transient for two-loop operation documented in Chapter 15 employs a statistical evaluation of the minimum critical power ratio (MCPR) and linear heat generation rate (LHGR) response to the withdrawal of ganged control rods for both rated and off-rated conditions. The required MCPR limit protection for the event is provided by the rod withdrawal limiter (RWL) system. Since this analysis covered all off-rated conditions in the power/flow operating map, single-loop operation is bounded by the current technical specification. The Average Power Range Monitor (APRM) rod block system provides additional alarms and rod blocks when power levels are grossly exceeded. Modification of the APRM rod block equation (below) is required to maintain the two loop rod block versus power relationship when in one loop operation. One-pump operation results in backflow through 10 of the 20 jet pumps while the flow is being supplied into the lower plenum from the 10 active jet pumps. Because of the backflow through the inactive Jet pumps, the present rod block equation was conservatively modified for use during one-pump operation because the direct active-loop flow measurement may not indicate actual flow above about 35% core flow without correction. A procedure has been established for correcting the APRM rod block equation to account for the discrepancy between actual flow and indicated flow in the active loop. This preserves the original relationship between APRM rod block and actual effective drive flow when operating with a single loop. The two-pump rod block equation is: RB = mW + RB 100 - m(100)

The one-pump equation becomes: RB = mW + RB 100 - m(100) - m (W) where W = difference between two-loop and single-loop effective drive flow at the same core flow. This value was determined during startup testing; RB = power at rod block in %;

m = flow reference slope W = drive flow in % of rated.

RB 100 = top level rod block at 100% flow.

CPS/USAR CHAPTER 15 15B-7 REV. 11, JANUARY 2005 If the rod block setpoint (RB 100), is changed, the equation must be recalculated using the new value. The APRM scram trip settings are flow biased in the same manner as the APRM rod block setting. Therefore, the APRM scram trip settings are subject to the same procedural changes as the rod block settings discussed above. 15B.3.3 Operating MCPR Limit The following discussion is for the initial implementation of SLO. Refer to Appendix 15D for the safety limit for single-loop operation. For single-loop operation, the operating MCPR limit remains unchanged from the normal two-loop operation limit. Although the increased uncertainties in core total flow and TIP readings resulted in a 0.01 increase in MCPR fuel cladding integrity safety limit during single-loop operation (Section 15B.2), the limiting transients have been analyzed to indicate that there is more than enough MCPR margin during single-loop operation to compensate for this increase in safety limit. For single loop operation at off-rated conditions, the steady-state operating MCPR limit is established by the MCPR p and MCPR f curves. This ensures the 99.9% statistical limit requirement is always satisfied for any postulated abnormal operational occurrence. The abnormal operating transients analyzed concluded that current power dependent MCPR p limits are bounding for single loop operation. Since the maximum core flow runout during single loop operation is only about 54% of rated, the current flow dependent MCPR f limits which are generated based on the flow runout up to rated core flow are also adequate to protect the flow runout events during single loop operation.

CPS/USAR CHAPTER 15 15B-8 REV. 11, JANUARY 2005 TABLE 15B.3-1 INPUT PARAMETERS AND INITIAL CONDITIONS(1) (2) 1. Thermal Power Level, MWt Analysis Value 2032 2. Steam Flow, lb/sec Analysis Value 2304 3. Core Flow, lb/hr 4.53 x 10 7 4. Feedwater Flow Rate, lb/sec Analysis Value 2304

5. Feedwater Temperature, °F 383 6. Vessel Dome Pressure, psig 978 7. Core Pressure, psig 983

8. Turbine Bypass Capacity, % NBR 35 9. Core Coolant Inlet Enthalpy, Btu/lb 509 10. Turbine Inlet Pressure, psig 943

11. Fuel Lattice P8x8R

12. Core Average Gap Conductance, Btu/sec-ft 2-°F 0.189 13. Core Leakage Flow, % 12.7 14. Required MCPR Operating Limit First Core 1.39 15. MCPR Safety Limit for Incident of Moderate Frequency

First Core 1.07 1.08 Reload Core

16. Doppler Coefficient ¢/

°F (3) 17. Void Coefficient ¢/% Rated Voids (3) 18. Scram Reactivity, $K (3) 19. Control Rod Drive Speed Position Versus Time See USAR Figure 15.0-1 20. Core Average Void Fraction, % 45.7

21. Jet Pump Ratio, M 3.71 22. Safety/Relief Valve Capacity, % NBR at 1210 psig 115.1 Manufacturer Dikker Quantity Installed 16 23. Relief Function Delay, sec. 0.15

24. Relief Function Response Time Constant, sec. 0.10 25. Safety Function Delay, sec. 0.0 26. Safety Function Response Time Constant, sec. 0.2 CPS/USAR TABLE 15B.3-1 (Continued)

INPUT PARAMETERS AND INITIAL CONDITIONS (1) (2) CHAPTER 15 15B-9 REV. 11, JANUARY 2005 27. Setpoints for Safety/Relief Valves Safety Function, psig 1175,1185,1195,1205,1215 Relief Function, psig 1145,1155,1165,1175 28. Number of Valve Groupings Simulated Safety Function 6 Relief Function 4 29. SRV Reclosure Setpoint - Both Mode (% of Setpoint) 98 Maximum Safety Limit 89 Minimum Operational Limit 30. High Flux Trip, % NBR Analysis 127.2 Setpoint (122x1.042). % NBR 31. High Pressure Scram Setpoint, psig 1095 32. Vessel Level Trips, Feet Above Separator Skirt Bottom Level 8 - (L8), Feet 6.00 Level 4 - (L4), Feet 3.87 Level 3 - (L3), Feet 1.94 Level 2 - (L2), Feet -2.86 33. APRM Thermal Trip Setpoint, % NBR (114x1.042) 118.8

34. TPM Time Constant, sec. 7.0 35. RPT Delay one load rejection or turbine trip, sec. 0.14 36. RPT Inertia Time Constant for Analysis, sec. 5.0

37. Total Steamline Volume, ft 3 3275 38. Pressure Setpoint of Recirculation Pump Trip - psig (Nominal) 1135 Notes: (1) The transient analyses evaluated with the ODYN 06 code use slightly more conservative values for some parameters than described elsewhere in the USAR.

(2) These input parameters and initial conditions are those used for the single-loop analysis and correspond to the initial cycle values. Singel-loop operation is bounded by the transient results of two-loop operation for each cycle. These values are representative of the values that would be used in later reload cycles if the single-loop analysis were to be reperformed using the same analysis codes and methods.

(3) These values are calculated within the computer code (Reference 15B.8-2) based on the input from CRUNCH tape.

CPS/USAR CHAPTER 15 15B-10 REV. 11, JANUARY 2005 TABLE 15B.3-2

SUMMARY

OF TRANSIENT PEAK VALUE AND CPR RESULTS (1) LRBPF FWCF Initial Power/Flow (% Rated) 70.2/53.6 70.2/53.6 Peak Neutron Flux (% NBR) 70.3 82.1 Peak Heat Flux (% Initial) 100.3 106.1 Peak Dome Pressure (psig) 1167 1053 Peak Vessel Bottom Pressure (psig) 1181 1067 Required Two Loop Initial MCPR Operating Limit at SLO Condition 1.39 1.39 CPR 0.05 0.12 Transient MCPR 1.34 1.27 SLMCPR at SLO 1.07 1.07

Note: (1) This table provides initial cycle values or analysis results Results of the limiting transients (for two-loop operation) performed as part of the reload analysis (see

Appendix 15D) are reviewed each cycle to verify that adequate margins exist for single-loop operation.

CPS/USAR CHAPTER 15 15B-11 REV. 11, JANUARY 2005 15B.4 STABILITY ANALYSIS 15B.4.1 Phenomena The primary contributing factors to the stability performance with one recirculation loop not in service are the power/flow ratio and the recirculation loop characteristics. At forced circulation with one recirculation loop not in operation, the reactor core stability is influenced by the inactive recirculation loop. As core flow increases in SLO, the inactive loop forward flow decreases because the driving head decreases with increasing core flow. The reduced flow in the inactive loop reduces the resistance that the recirculation loops impose on reactor core flow perturbations thereby adding a destabilizing effect. At the same time the increased core flow results in a lower power/flow ratio which is a stabilizing effect. These two countering effects may result in decreased stability margin (higher decay ratio) initially as core flow is increased (from minimum) in SLO and then an increase in stability margin (lower decay ratio) as core flow is increased further and reverse flow in the inactive loop is established. As core flow is increased further during SLO and substantial reverse flow is established in the inactive loop an increase in jet pump flow, core flow and neutron noise is observed. A cross flow is established in the annular downcomer region near the jet pump suction entrance caused by the reverse flow of the inactive recirculation loop. This cross flow interacts with the jet pump suction flow of the active recirculation loop and increases the jet pump flow noise. This effect increases the total core flow noise which tends to drive the neutron flux noise. To determine if the increased noise was being caused by reduced stability margin as SLO core flow was increased, an evaluation was performed which phenomenologically accounts for single-loop operation effects on stability (Reference 15B.8-3). The model predictions were initially compared to test data and showed very good agreement for both two-loop and single-loop test conditions. An evaluation was performed to determine the effect of reverse flow on stability during SLO. With increasing reverse flow, SLO exhibited slightly lower decay ratios than two-loop operation. However, at low core flow conditions with no reverse flow, SLO was slightly less stable. This is consistent with observed behavior in stability tests at operating BWRs (Reference 15B.8-4). In addition to the above analyses, the cross flow established during reverse flow conditions was simulated analytically and shown to cause an increase in the individual and total jet pump flow noise, which is consistent with tests data (Reference 15B.8-3). The results of these analyses and tests indicate that the stability characteristics are not significantly different from two-loop operation. At low core flows, SLO may be slightly less stable than two-loop operation but as core flow is increased and reverse flow is established the stability performance is similar. At higher core flows with substantial reverse flow in the inactive recirculation loop, the effect of cross flow on the flow noise results in an increase in system noise (jet pump, core flow and neutron flux noise), but core thermal-hydraulic stability margin is very high, similar to two-loop operation. 15B.4.2 Compliance to Stability Criteria Consistent with the philosophy applied to two-loop operation, the stability compliance during single-loop operation is demonstrated on a generic basis. Stability acceptance criteria have been established to demonstrate compliance with the requirements set forth in 10CFR50, Appendix A, General Design Criterion (GDC) 12 (Reference 15B.8-5). The generic stability analysis has been performed covering all licensed GE BWR initial core and reload core fuel CPS/USAR CHAPTER 15 15B-12 REV. 11, JANUARY 2005 designs including those fuels contained in the General Electric Standard Application for Reload Fuel (GESTAR, Reference 15B.8-6) through fuel design GE8x8E. The analysis demonstrated that in the event limit cycle neutron flux oscillations occur within the bounds of safety system intervention, specified acceptable fuel design limits are not exceeded. Since the reactor core is assumed to be in an oscillatory mode, the question of stability margin during SLO is not relevant from a safety standpoint (i.e. the analysis already assumes no stability margin). The fuel performance during limit cycle oscillations is characteristically dependent on fuel design and certain fixed system features (high neutron flux scram setpoint, channel inlet orifice diameter, etc.). Therefore the acceptability of GE fuel designs independent of plant and cycle parameters has been established. Only those parameters unique to SLO which affect fuel performance need to be evaluated. The major consideration of SLO is the increased Minimum Critical Power Ratio (MCPR) safety limit caused by increased uncertainties in system parameters during SLO. However, the increase in MCPR safety limit (0.01) is well within the margin of the limit cycle analyses (Reference 15 B.8-5) and therefore it is demonstrated that stability compliance criteria are satisfied during single-loop operation. Operationally, the effects of higher flow noise and neutron flux noise observed at high SLO core flows are evaluated to determine if acceptable vessel internal vibration levels are met and to determine the effects on fuel and channel fatigue. However, these are not considered in the compliance to stability

criteria. A Service Information Letter-380, Revision 1 (Reference 15B.8-7) has been developed to inform plant operators how to recognize and suppress unanticipated oscillations when encountered during plant operation.

As a result of the above analysis and operator recommendations, the NRC staff has approved the generic stability analysis for application to single-loop operation (Reference 15B.8-8)

provided that the recommendations of SIL-380 have been incorporated into the Plant Technical Specifications. 15B.5 LOSS-OF-COOLANT ACCIDENT ANALYSIS The ECCS-LOCA analysis of single recirculation loop operation using the models and assumptions documented in Reference 15B.8.9 was performed for CPS. The ECCS-LOCA results of this event are more severe than the two-loop case in Section 6.3.3 because the break is assumed to occur in the operating recirculation loop resulting in the immediate interruption of core vlow and the rapid loss of nucleate boiling. Therefore the maximum average planar linear heat generation rate (MAPLHGR) operating curves are reduced for single recirculation loop operation. The MAPLHGR reduction factors for the current cycle are provided in Appendix 15D, Reload Analysis. 15B.5.1 Break Spectrum Analysis For the DBA a complete severance of the operating recirculation line during single recirculation loop operation is assumed. This results in the most rapid reduction in core flow and the earliest loss of nucleate boiling for any break size and location. This early loss of nucleate boiling causes a rise in cladding temperature due to the stored energy in the fuel. The resulting peak cladding temperture due to this rise is the limiting cladding temperature for the event. Since a smaller recirculation line break or a break in another location would result in less severe core CPS/USAR CHAPTER 15 15B-13 REV. 11, JANUARY 2005 flow coastdown, the DBA ECCS-LOCA analysis results are bounding for all single recirculation loop operation LOCA cases. 15B.5.2 Single Loop MAPLHGR Determination The approach used to assess single recirculation loop operation is to determine a MAPLHGR multiplier such that the PCT for the SLO condition using nominal assumptions does not exceeed the nominal two-loop PCT at rated conditions. This methodology produces SLO MAPLHGR multipliers for the SLO condition that are extremely conservative and assure that the SLO results meet the acceptance criteria of 10CFR50.46 and the NRC SER requirements for the SAFER application methodology. The MAPLHGR reduction factors for the current cycle are provided in Appendix 15D, Reload Analysis. For reloads SLO MAPLHGR reduction factors are calculated for each new fuel type introduced into the core. 15B.5.3 Small Break Peak Cladding Temperature The small break ECCS-LOCA peak cladding temperature for by the SLO condition is bounded by the DBA results as discussed in Section 15B.5.1. 15B.6 CONTAINMENT ANALYSIS This accident was not reanalyzed at current power (3543 MWt) since it was not the limiting case. However, analyses were done at a range of power conditions including the maximum vessel subcooling condition (64.7% power/32.8% core flow), which confirmed that the bounding event remains the main steam line break. The analysis presented below is based on a power of 2952 MWt. A single-loop operation containment analysis was performed for CPS. The peak drywell and containment pressure/temperature, peak suppression pool temperature, chugging loads, condensation oscillation and pool swell containment response were evaluated over the entire single-loop operation power/flow region. The analysis shows that the peak drywell pressure during single-loop operation is 32.9 psia and occurs under recirculation line break at the maximum vessel subcooling condition in the power/flow map (52.6% power/32.5% core flow). This is below the drywell peak pressure for the design basis accident at the rated two-loop operation reported in Chapter 6 of the USAR. The bounding event for the drywell temperature response is a double-ended break of a main steamline. The steam break flow is not affected by the increased vessel subcooling under SLO, but decreases due to the lower vessel pressure under SLO. It is concluded that the peak

drywell temperature for SLO is bounded by that of the USAR. The peak containment pressure, containment temperature, and suppression pool temperature are longer term results than peak drywell pressure and are not affected by subcooled blowdown under SLO. These are governed mainly by t he long-term release of decay heat, emergency removal of the RHR service water, etc. Since the initial power level is lower for SLO conditions compared to that of the USAR, it is concluded that these parameters are bounded by those reported in the USAR. Finally, the chugging and pool swell loads evaluated at the maximum vessel subcooling power/flow condition during single-loop operation are shown to be bounded by the peak values CPS/USAR CHAPTER 15 15B-14 REV. 11, JANUARY 2005 presented in the USAR. The corresponding condensation oscillation load increases slightly, but is adequately covered by existing load design margin. 15B.7 MISCELLANEOUS IMPACT EVALUATION 15B.7.1 Anticipated Transient Without Scram (ATWS) Impact Evaluation The principal difference between single-loop operation (SLO) and normal two-loop operation (TLO) affecting Anticipated Transient Without Scram (ATWS) performance is that of initial reactor conditions. Since the SLO initial power/flow condition is less than the rated condition used for TLO ATWS analysis, the transient response is less severe and therefore bounded by

the TLO analyses. It is concluded that if an ATWS event were initiated at CPS from the SLO conditions, the results would be less severe than if it were initiated from rated conditions. 15B.7.2 Fuel Mechanical Performance Evaluations were performed to determine the acceptability of CPS single-loop operation on P8X8R fuel rod and assembly thermal/ mechanical performance. Component pressure differential and fuel rod overpower values were determined for anticipated operational occurrences initiated from SLO conditions. These values were found to be bounded by those applied in the fuel rod and assembly design bases. It is observed that due to the substantial reverse flow established during SLO both the Average Power Range Monitor (APRM) noise and core plate differential pressure noise are slightly increased. An analysis has been carried out to determine that the APRM fluctuation should not exceed a flux amplitude of

+/-15% of rated and the core plate differential pressure fluctuation should not exceed 3.2 psi peak to peak to be consistent with the fuel rod and assembly design bases. 15B.7.3 Vessel Internal Vibration A recirculation pump drive flow limit is imposed for SLO. The highest drive flow that meets acceptable vessel internal vibration criteria is the dr ive flow limit for SLO. An assessment has been made for the expected reactor vibration level during SLO for CPS. Before providing the results of the assessment, it is prudent to define the term "maximum flow" during balanced two-loop operation and single-loop operation. Maximum flow for two-loop operation is equal to rated volumetric core flow at normal reactor operating conditions.

Maximum flow for single-loop operation is that flow obtained with the recirculation pump drive flow equal to that required for maximum flow during two-loop balanced operation. For rated reactor water temperature and pressure, the maximum recirculation pump drive flow for CPS is about 33,000 gpm. This is a measured value from the Kuo Sheng 1 plant which is the prototype plant for Clinton. 15B.7.4 Recirculation Piping Analysis Reanalysis of the recirculation piping system was performed for the additional thermal case of either piping loop at drywell ambient temperature with the other loop remaining at normal operating conditions. This analysis considered a temperature range of 70

°F to 528°F to account CPS/USAR CHAPTER 15 15B-15 REV. 11, JANUARY 2005 for the most conservative scenario possible and considered isolation by closing either or both of the suction and discharge gate valves. The analysis was performed for 50 cycles of single loop operation. These cycles are in addition to the existing plant duty cycles. The piping components were analyzed in accordance with the requirements of the ASME code,Section III, Sub-Article NB-3650 using GE's proprietary computer programs PISYS and ANSI7. The results of the analysis showed that the increase in the thermal stress range did not result in exceedance of the Code stress limits, the fatigue usage criteria or allowable loads on interfacing

equipment. The thermal displacements for the additional therm al case were compared with the existing walkdown clearances and were determined to be acceptable. 15B.8 REFERENCES 15B.8-1 "General Electric BWR Thermal Analysis Basis (GETAB); Data, Correlation, and Design Application", NEDO-10958-A, January 1977. 15B.8-2 "Qualification of the One-Dimensional Core Transient Model for Boiling Water Reactors", NEDO-24154, October 1978. 15B.8-3 Letter, H. C. Pfefferlen (GE) to C. O. Thomas (NRC), "Submittal of Response to Stability Action Item from NRC Concerning Single-Loop Operation," September 1983. 15B.8-4 S. F. Chen and R. O. Niemi, "Vermont Yankee Cycle8 Stability and Recirculation Pump Trip Test Report", General Electric Company, August 1982 (NEDE-25445, Proprietary Information). 15B.8-5 G. A. Watford, "Compliance of the General Electric Boiling Water Reactor Fuel Designs to Stability Licensing Criteria", General Electric Company, October 1984 (NEDE-22277-P-1), Proprietary Information). 15B.8-6 "General Electric Standard Application for Reload Fuel", General Electric Company, June 2000 (NEDE-24011-P-A-14). 15B.8-7 "BWR Core Thermal Hydraulic Stability", General Electric Company, February 10, 1984 (Service Information Letter-380, Revision 1). 15B.8-8 Letter, C. O. Thomas (NRC) to H. C. Pfefferlen (GE), "Acceptance for Referencing of Licensing Topical Report NEDE-24011, Rev. 6, Amendment 8, Thermal Hydraulic Stability Amendment to GESTAR II," April 24, 1985. 15B.8-9 "Clinton Power Station SAFER/GESTR-LOCA Loss-of-Coolant Accident Analysis," NEDC-32945P, General Electric Company, June 2000. 15B.8-10 BWROG-94078, BWR Owners Group Guidelines for Stability, Interim Corrective Action. June 6, 1994.

CPS/USAR CHAPTER 15 15C-1 REV. 11, JANUARY 2005 APPENDIX 15C.

MAXIMUM EXTENDED OPERATING DOMAIN AND FEEDWATER HEATER OUT-OF-SERVICE ANALYSIS 15C.1 INTRODUCTION AND

SUMMARY

15C.1.1 Introduction This appendix represents the results of a safety evaluation to support (1) operation of the Clinton Power Station (CPS) in an extended power/flow operating envelope called the Maximum

Extended Operating Domain (MEOD) and (2) continued operation of the plant during the normal operating cycle with feedwater heater(s) out-of-service (FWHOS) in the normal power/flow domain (as given in Figure 4.4-5) as well as in the MEOD region (Reference 1).* MEOD operation and the acceptability of reduced feedwater temperature for each cycle is reevaluated for the limiting transients as part of the reload analysis documented in

Appendix 15D. 15C.1.1.1 Maximum Extended Operating Domain A factor which restricts the flexibility of a BWR during power ascension in proceeding from the low power/low core flow condition to the high power/high core flow condition is the power/flow map given in Figure 4.4-5. The MEOD region, as defined and illustrated in Figure 15C.1-1, permits improved power ascension capability to full power and provides additional flow range at rated power, including an increased core flow region. This increased core flow region can compensate for reactivity reduction due to exposure during an operating cycle. The MEOD can be separated into two regions. One region is the extended operation in the lower than 100% core flow region, termed the Extended Load Line Region (ELLR). The other extended region is the higher than 100% core flow region, termed the Increased Core Flow Region (ICFR). The ELLR boundary is limited by 75% core flow at 100% original licensed power and its corresponding power/flow constant rod-line. The ICFR is bounded by the 107% core flow line.

The ELLR boundary is limited to 99% core flow at 100% power with current licensed power (3473 MWt). The ICFR remains unchanged at current licensed power. 15C.1.1.2 Feedwater Heater(s) Out-of-Service The baseline design evaluations justify operation with full feedwater heating, which corresponds to a rated feedwater temperature of 420

°F at original licensed power and 430

°F at current licensed power. Operation with reduced feedwater temperature occurs in the event that certain stage(s) or string(s) of individual heaters become inoperable during the fuel cycle or due to the inability of the feedwater heaters to achieve the design feedwater heating.**

• These modes of operation are denoted as MEOD and/or FWHOS in this Appendix. ** Both of these two partial feedwater heating modes are denoted as FWHOS in this Appendix.

CPS/USAR CHAPTER 15 15C-2 REV. 11, JANUARY 2005 Loss of feedwater heating from the highest pressure heaters would result in the highest temperature reduction. Loss of heating from t he early stages of low pressure heaters would result in only a slight reduction of feedwater temperature. It is estimated that feedwater temperature reduction from rated conditions due to an inoperable (out-of-service) high pressure heater stage is less than 50

°F. This appendix includes evaluations to justify that CPS can operate with FWHOS during the normal operating cycle up to a maximum rated feedwater temperature reduction of 50

°F, within the normal power/flow domain and also within ME OD. This evaluation is provided as required by the CPS Safety Evaluation Report (Reference 2), to permit CPS operation with reduced feedwater temperature. Appendix 15E describes the reference temperatures for operation with FWHOS at current licensed power (3473 MWt). 15C.1.2 Summary The MEOD and/or FWHOS evaluation was per formed for CPS on an 18-month equilibrium cycle basis and is applicable to 12-month or 18-month cycle operation for reload cycles with the GE BP8X8R fuel design. The acceptability of operation in the MEOD operating region and the acceptability of operating with reduced feedwater temperature is reverified for the limiting transients (with the current fuel design) as part of the reload analysis documented in Appendix 15D. FWHOS covers operation during the normal operating cycle with up to a maximum rated feedwater temperature reduction of 50

°F, within the normal power/flow domain and also within MEOD. The results of this evaluation are: (1) The limiting normal and abnormal operating transients in USAR Chapter 15 were reevaluated for the MEOD and/or FWHOS conditions. It is determined that the fuel mechanical limits are met for all transients under MEOD and/or FWHOS conditions. Needed changes to the power- and flow-dependent operating limits are developed. (2) The Loss-of-Coolant Accident (LOCA) and containment responses as described in the baseline data in Chapter 6 were reevaluated for MEOD and/or FWHOS operation. The responses meet licensing requirements. (3) Thermal-hydraulic stability was evaluated for its adequacy with respect to the General Design Criterion 12 (10CFR50, Appendix A). It is shown that MEOD and/or FWHOS operation satisfies this stability criterion. (4) The effect of acoustic and flow-induced loads on the reactor internal components and fuel channels was analyzed to show that the design limits are not exceeded. The effect of FWHOS on feedwater nozzle and sparger fatigue usage factor was determined. (5) The Average Power Range Monitor (APRM) trip setdown requirements are replaced with new power- and flow-dependent Maximum Average Planar Linear Heat Generation Rate (MAPLHGR) limits. Revised power-dependent MCPR limit requirements are also established. 15C.2 TRANSIENT EVENT ANALYSIS All analyzed core-wide transients in the Cycle 2 supplemental reload licensing submittal (Reference 3) and/or in the Chapter 15 baseline for Cycle 1 were examined for operation in the MEOD region and for FWHOS operation in the normal operating power/flow map as well as in CPS/USAR CHAPTER 15 15C-3 REV. 11, JANUARY 2005 the MEOD region. The results of this initial analysis are provided below. As discussed in Reference 5, these engineering evaluations are re-evaluated each reload cycle. The results of this evaluation for the current cycle are summarized in Appendix 15D. The initial reevaluation was performed at (100P, 75F)* and (100P, 107F) for a bounding rated feedwater temperature reduction of up to 50

°F and at the end of equilibrium cycle (EOEC) fuel exposure. Plant heat balance, core coolant hydraulics and nuclear transient parameter data were developed and used in the transient analysis. The initial conditions for the transient analysis are presented in Table 15C.2-1. Key input data used in the transient analysis are listed in Table 15C.2-2. The computer model described in Reference 4 was used, following GEMINI methods (Reference 5). Bounding response curves are given in Figures 15C.2-1 and 15C.2-2. Increasing the recirculation flow control valve stop setpoint for MEOD has the potential to make the slow flow runout transient more severe than for the normal operating domain for low core

flows. Hence, a more restrictive MCPR f limit applies to MEOD at low core flows. MCPR f limit curves have been determined for the normal and MEOD operating domain as shown in Figure 15C.2-3. The limiting transient for ASME Code overpressurization analysis was reevaluated (Figure 15C.2-4). The predicted peak vessel pressure is acceptable. The baseline Technical Specifications required that the flow-biased APRM trips be lowered (setdown) when the core maximum total peaking factor exceeds the design total peaking factor.

The APRM setdown requirement originated from the now obsolete Minimum Critical Heat Flux Ratio (MCHFR) limit criterion. Changes to the baseline fuel thermal CPR limit criterion and GETAB/GEXL, and the move to secondary reliance on flux scram for licensing transient evaluations (for transients terminated by anticipatory or direct scram) provide more effective and operationally desirable alternatives to the setdown requirement. The CPS MEOD evaluation uses transient analyses to define thermal limits initial conditions (operating limits) which conservatively assure that all licensing criteria are satisfied without setdown of the APRM scram and flow-biased rod block trips. Results from the transient analyses were used to establish the MAPLHGR versus power and flow operating limits and to verify or establish the MCPR versus power and flow operating limits. The baseline power-dependent MCPR limits (MCPR p) are modified, as shown in Figure 15C.2-5, based on analyses and plant data. The flow-dependent and power-dependent MAPLHGR limits were determined as shown in Figures 15C.2-6 and 15C.2-7. At any given power/flow state, both limits must be determined. The most limiting MAPLHGR limit (minimum of MAPLHGR f and MAPLHGR p) will be the governing limit. During Clinton Power Station Cycle 8, exposure dependent Linear Heat Generation Rates (LHGRs) were implemented. This was done to allow the station to go to longer sequence exchange intervals. In going to these longer sequence exchange intervals the control blade

• Denotes 100% power and 75% core flow condition.

CPS/USAR CHAPTER 15 15C-4 REV. 11, JANUARY 2005 history effect which can affect local peaking will be explicitly accounted for through the use of the exposure dependent LHGR limits. The exposure dependent LHGR limits will provide the same thermal mechanical protection as is currently done through the Maximum Average Planar Linear Heat Generation Rate (MAPLHGR) limits. Offrated LHGR reduction factors (MAPFAC f and MAPFAC p) will be applied to the LHGR limits. See the current cycle Clinton Power Station Core Operating Limits Report (COLR) for the cycle specific reduction factors. 15C.3 THERMAL-HYDRAULIC STABILITY ANALYSIS GE has established stability criteria to demonstrate compliance to requirements set forth in 10CFR50 Appendix A, General Design Criteria (GDC) 10 and 12. These criteria assure that for GE fuel designs, specified acceptable fuel design limits are not exceeded. To provide assurance that acceptable plant performance is achieved during operation in the least stable region of the power/flow map, as well as during all plant maneuvering and operating states, a generic set of operating recommendations has been developed as set forth in Reference 6. These recommendations, which have been implemented in the CPS Technical Specifications, instruct the operator on how to reliably detect and suppress limit cycle neutron flux oscillations should they occur. Furthermore, CPS operating procedures require an immediate manual scram if both recirculation pumps trip (in accordance with References 7 and 9). 15C.4 EMERGENCY CORE COOLING SYSTEM PERFORMANCE A LOCA analysis was performed at rated power for 75% and 107% core flow as defined in Figure 15C.1-1 to evaluate the Emergency Core Cooling System (ECCS) performance. The analysis was conducted to define MAPLHGR restrictions (multipliers) versus core flow (if any) required to cover operation in the MEOD region. New multipliers are developed as necessary for each cycle based on the reload analysis results. The current cycle results are provided in Reference 8. Based on this evaluation, CPS operation meets licensing requirements. 15C.5 CONTAINMENT EVALUATION A containment response analysis was performed with the limiting postulated recirculation piping LOCA at the limiting condition of MEOD with FWHOS. Containment performance parameters meet licensing requirements. A bounding analysis was performed to determine the impact of MEOD and FWHOS operation on annulus pressurization load (APL). All licensing requirements are met. 15C.6 MECHANICAL EVALUATION OF REACTOR INTERNALS AND FUEL ASSEMBLY Evaluations were performed to determine bounding acoustic and flow-induced loads, reactor internal pressure difference loads and fuel-support loads for MEOD and/or FWHOS operation. The reactor internals were evaluated using the bounding loads. It is concluded that the stresses produced in these and other components are within the allowable design limits. The fuel assemblies, including fuel bundles and channels, were evaluated for increased core flow under MEOD and/or FWHOS operating considering the effects of the bounding loads.

Results of the evaluation demonstrate that the fuel assemblies are adequate to withstand CPS/USAR CHAPTER 15 15C-5 REV. 11, JANUARY 2005 increased core flow effects to 107% rated flow. The channel wall pressure differentials were found to be within the allowable design values. 15C.7 FLOW-INDUCED VIBRATION Based on a review of the test data and the results of the analysis, it is concluded that the predicted maximum alternating stress intensity is within acceptable limits for plant operation under the MEOD and/or FWHOS condition at current licensed power (region bounded as shown

on the power flow map, Figure 15C.1-1). 15C.8 FEEDWATER NOZZLE AND FEEDWATER SPARGER FATIGUE USAGE An evaluation of the effect of FWHOS on the feedwater nozzle and feedwater sparger fatigue was performed for a 50

°F reduction in feedwater temperature for various lengths of time during an 18-month fuel cycle. The analysis done for normal design duty and current licensed power (3473 MWt) indicated that refurbishment of the Feedwater nozzle thermal sleeve seals after 30 years would be necessary to keep the 40-year total fatigue usage (system cycling plus rapid cycling) below a value of 1.0. Assuming operation with FWHOS for a cumulative time of up to a year, seal refurbishment after 29 years will ensure that the 40-year fatigue usage is less than 1.0 (Reference 16). To determine the effect of the FWHOS on the feedwater sparger, the fatigue usage in the sparger for normal and FWHOS operation was calculated. 15C.9 THERMAL POWER MONITOR SCRAM AND ROD BLOCK SETPOINTS In order to allow operation in the MEOD, the current Simulated Thermal Power Monitor (STPM) scram and rod block configuration and setpoints are modified to accommodate this region.

15C.10 REFERENCES

1. "Maximum Extended Operating Domain and Feedw ater Heater Out-of-Service Analysis for Clinton Power Station", General Electric Company, August 1988 (NEDC-31546P). 2. U.S. Nuclear Regulatory Commission, NUREG-0853, Supplement No. 7, "Safety Evaluation Report related to the operation of Clinton Power Station, Unit No. 1", September 1986. 3. "Supplemental Reload Licensing Submittal for Clinton Power Station Unit 1, Reload 1, Cycle 2," General Electric Company Report 23A5921, Rev. 0, August 1988. 4. "Qualification of the One-Dimensional Core Transient Model for Boiling Water Reactors", General Electric Company, August 1986 (NEDO-24154-A). 5. "General Electric Standard Application for Reactor Fuel (Supplement for United States)", May 1986 (NEDE-24011-P-A-US, as amended). 6. "BWR Core Thermal Hydraulic Stability", General Electric Company, SIL No. 380 Revision 1, February 1984.

CPS/USAR CHAPTER 15 15C-6 REV. 11, JANUARY 2005 7. NRC Bulletin Number 88-07, Supplement 1, "Power Oscillations in Boiling Water Reactors (BWRs)", United States Nuclear Regulatory Commission, December 30, 1988. 8. CPS Core Operating Limits Report (COLR) for current cycle.

9. BWROG-94078, BWR Owners Group Guidelines for Stability, Interim Corrective Action. June 6, 1994. 10. Calculation IP-M-0718, Feedwater Nozzle Blend Radius, Safe End and other RPV Component Usage Reduction.

CPS/USAR CHAPTER 15 15C-7 REV. 11, JANUARY 2005 TABLE 15C.2-1 INITIAL CONDITIONS FOR MEOD AND FWHOS TRANSIENT ANALYSIS (1) 100% Power 100% Power 107% Core Flow 75% Core Flow Rated Feedwater Temperature (°F) 420 370 420 370 Thermal Power (MWt) 2894 2894 2894 2894 Steam Flow (Mlb/hr) 12.45 11.66 12.45 11.66 Core Flow (Mlb/hr) 90.4 90.4 63.4 63.4 Vessel Dome Pressure (psia) 1040 1029 1040 1029

Note: (1) These initial conditions pertain to the initial MEOD/FWHOS analysis. Values for current licensed power are provided in Appendix 15E and values for the current cycle are provided in Appendix 15D.

CPS/USAR CHAPTER 15 15C-8 REV. 11, JANUARY 2005 TABLE 15C.2-2 KEY INPUT PARAMETERS FOR MEOD AND FWHOS TRANSIENT ANALYSIS (1) MCPR Safety Limit Incidents of Moderate Frequency 1.07 Safety/Relief Valves Quantity installed 16 Capacity (Mlb/hr) at 1.03x1190 psi 0.925 Lowest Safety Setpoint (psig) 1180 Lowest Relief Setpoint (psig) 1133

Note: (1) These input parameters were utilized in the initial MEOD/FWHOS analysis. Values for current licensed power are provided in Appendix 15E and values for the current cycle are provided in Appendix 15D.

CPS/USAR CHAPTER 15 15E-1 REV. 11, JANUARY 2005 APPENDIX 15E.

EXTENDED POWER UPRATE (EPU) ANALYSES 15E.1 INTRODUCTION AND

SUMMARY

15E.1.1 Introduction This appendix represents the results of a safety evaluation to support operation of the Clinton Power Station (CPS) at a rated power level of 3473 MWt, which represents a 20% increase from the previous licensed power level of 2894 MWt. The increase in power was accomplished without an increase in maximum dome pressure (commonly referred to as Constant Pressure Power Uprate). Inputs to the plant safe ty analysis are developed and maintained in accordance with applicable quality assurance programs. Selected safety analysis input parameters used for the initial power uprate analysis, with emphasis on parameters that may be affected by plant modifications and impact the reload analysis, are provided in Table 15E.2-l. 15E.2 INCREASE IN RATED THERMAL POWER 15E.2.1 Transient Event Analysis To confirm the acceptability of operation with a licensed power level of 3473 MWt, the applicable safety analyses events were reviewed for the increase in RTP. Specifically, all events in the safety analysis were reviewed. The review considered all plant modifications implemented prior to implementation of the power upr ate. The review confirmed that potentially limiting events for reloads remain as identified in NEDE-24011-P-A (GESTAR II), Reference 2. As described in Reference 1, the AOO events that determine the operating limit MCPR do not change significantly due to an increase in reactor power even for power uprate up to 20% above the OLTP. This characteristic was established by the initial and reload core analyses for different power level and power density plants and confirmed by the results from subsequent power uprate evaluations. These limiting events are defined in Reference 2. Other events listed in Table E-1 of Reference 3 do not establish the operating limit MCPR and do not have to be analyzed to establish this limit. The results of the limiting thermal margin event analyses are highly dependent upon the reference core loading pattern and will, therefore, be analyzed for the actual reload core and reported in Appendix 15D. The reactor operating conditions that apply most directly to the transient analysis are summarized in Table 15E.2-1. The power-to-flow map for a RTP of 3473 MWt, Figure 15C.1-1 includes operation in the following regions: 1. The Maximum Extended Operating Domain (MEOD) region, which allows plant operation with core flows as low as 99% of rated at 100% rated power. 2. The increased core flow (ICF) region is bounded by the constant recirculation pump speed line corresponding to 107% core flow at 100% rated power.

CPS/USAR CHAPTER 15 15E-2 REV. 11, JANUARY 2005 3. Operation with reduced feedwater temperature up to 50

°F in the event that certain stage(s) or string(s) of individual heaters become inoperable during the fuel cycle or due to the inability of the feedwater heaters to achieve the design feedwater heating. 4. Operation in Single Loop (SLO), however, the SLO operating domain remains unchanged with EPU. The severity of the transients at less than rated power are not significantly affected by the EPU, because of the protection provided by off-rated power distribution limits multipliers. Refer to 15D for current multipliers. The limiting transient for ASME Code overpressurization analysis was performed. The predicted peak vessel pressure is acceptable with 5 SRV's out-of-service (OOS). This event will be evaluated each reload and reported in Appendix 15D to demonstrate continued applicability of this OOS option. The Loss of Feedwater Flow (LOFW) transient was evaluated for EPU (Figure 15.2.7-1). The results showed that because of the extra decay heat from the EPU, slightly more time is required for the automatic systems to restore water level. However, the results showed that the minimum injection rate from the RCIC system is sufficient for compliance with the system limiting criteria to maintain the reactor water level above TAF at the EPU conditions, and with nominal decay heat the minimum sensed water level outside the shroud is high enough to avoid reaching the Level 1 instrument setpoint for ADS timer initiation and MSIV closure activation. The baseline Technical Specifications percent power values for the allowable values (AV) and the nominal trip setpoint values (NTSP) do not change as a result of EPU as the analytical limit (AL) for the Average Power Range Monitor (APRM) Neutron Flux Scram remains the same in

terms of percent power. 15E.3 THERMAL-HYDRAULIC STABILITY ANALYSIS An evaluation was performed to determine the effect of power uprate on core stability Interim Corrective Actions (ICAs) at Power Uprate Conditions. To ensure adequate level of protection against the occurrence of a thermal-hydraulic instability, the instability exclusion region boundaries are unchanged with respect to absolute power level (MWt). The stability based Operating Limit Minimum Critical Power Ratio (OLMCPR) associated with the OPRM setpoint assures that the Critical Power Ratio (CPR) safety limit is not violated following an instability

event. 15E.4 EMERGENCY CORE COOLING SYSTEM PERFORMANCE An ECCS-LOCA evaluation was performed at Extended Power Uprate conditions. The ECCS performance characteristics are not changed for EPU. The results of the licensing basis ECCS-LOCA analysis event, initiating at EPU conditions and using the current NRC-approved methods for CPS, are summarized in Chapter 6.3, and demonstrate that CPS continues to satisfy the 10 CFR 50.46 ECCS performance acceptance criteria. A limited set of ECCS-LOCA cases was analyzed for EPU to determine the peak cladding temperature (PCT) change due to EPU. The PCT change of + 20

°F was added to the license basis. Thus, EPU did not result in a "significant change" in calculated PCT, as defined in 10 CFR 50.46(a)(e)(i).

CPS/USAR CHAPTER 15 15E-3 REV. 11, JANUARY 2005 15E.5 CONTAINMENT EVALUATION Chapters 6 and 15 provide the containment response to various postulated accidents that validate the design basis for the containment. Operation with EPU changes some of the conditions for the containment analyses. This blowdown flow rate is dependent on the reactor initial thermal-hydraulic conditions, such as the mass and energy of the vessel fluid inventory, which change slightly with EPU. Also, the long-term decay heat depends on the initial reactor power level and effects the long-term containment response. The containment pressure and temperature responses have been reanalyzed, as described in Chapter 6.2, to demonstrate the plant's acceptability to operate at EPU conditions. The EPU containment analysis adopted changes in methodology from the initial analysis. The major differences between the original licensing and EPU containment analyses are the use of a more realistic decay heat curve, the modeling of the mass and energy transfer between the suppression pool and containment airspace, and the use of structural heat sinks for the long-term EPU analysis. A different computer code wa s also used for the EPU analysis. As a result of some of these changes, the EPU analysis is more realistic and resulted in a reduction in the long term containment pressure. Containment and drywell pressure and temperatures from the short-term analysis increased, but are within the allowable design values. The inputs and results from the EPU analysis are reflected in Chapter 6.2 The effect of EPU on the containment dynamic loads due to a LOCA and SRV discharge was also evaluated. The magnitude of the initial blowdown affects the LOCA loads, however the original licensed loads definitions were determined to be bounding. EPU did not affect the SRV discharge loads. Any changes to the description of the loads due to EPU are included in Section A3.8. 15E.6 REFERENCES

1. GE Nuclear Energy, "Constant Pressure Power Uprate", Licensing Topical Report, NEDC-33004P, Class III, March 2001. 2. GE Nuclear Energy, "General Electric Standard Application for Reactor Fuel", NEDE-24011-P-A and NEDE-24011-P-A-US, (latest approved revision). 3. GE Nuclear Energy, "Generic Guidelines for General Electric Boiling Water Reactor Extended Power Uprate," (ELTR1), Licensing Topical Reports NEDC-32424P-A, Class III (Proprietary), February 1999; and NEDO-32424, Class I (Non-proprietary), April 1995. 4. GE Nuclear Energy, "Safety Analysis Report for Clinton Power Station Extended Power Uprate," NEDC-32989P, Class 3, Revision 2, February 2002.

CPS/USAR CHAPTER 15 15E-4 REV. 11, JANUARY 2005 Table 15E.2-1 Comparison of Parameter Changes for EPU Transient Analysis Parameter Cycle 8 Analysis EPU Rated Thermal Power (MWt) 2894 3473 Analysis Power (% Rated) 2894 (1) 3473 (1) Analysis Dome Pressure (psia) 1040 1040 Analysis Turbine Pressure (psia) 982 (2) 954 (2) Rated Vessel Steam Flow (Mlb/hr) 12.45 15.15 Analysis Steam Flow (% Rated) 12.45 15.15 Rated Core Flow (Mlb/hr) 84.5 84.5 Rated Power Core Flow Range (% Rated)75-107 99-107 Normal Feedwater Temperature (°F) 420 430 Feedwater Temperature Reduction (T°F) 50 50 Steam Bypass Capacity (% Rated Steamflow) 35.0 28.8 No. of SRVs assumed in the analysis 14 (3) 14 (3)

(1) GEMINI analysis at 100%, REDY analysis at 102%.

(2) Reload and EPU analysis based on measured steam line pressure drop.

(3) The lowest 2 pressure setpoint SRVs are assumed to be out of service for transient MCPR analysis.

CPS/USAR CHAPTER 15 REV. 12, JAN 2007

FIGURE 15.1.1-1 HAS BEEN DELETED

CPS/USAR Revision 10 October 2002 NOTES FOR FIGURE 15.2.9-1A ACTIVITY A Initial pressure = 1040 psia Initial temperature = 549ºF. For purposes of this analysis, the following worst-case conditions are assumed to exist: (1) The reactor is assumed to be operating at 102% rated power; (2) A loss of power transient occurs (see Section 15.2.6); and (3) A simultaneous loss of onsite power (Division 1 or Division 2), which eventually results in the operator not being able to open one of the RHR shutdown cooling line suction valves. ACTIVITY B Initial system pressure = 1040 psia Initial system temperature = 549ºF.

Operator Actions During approximately the first 41 minutes, reactor decay heat is passed to the suppression pool by the automatic operation of the reactor relief valves. Reactor water level will be returned to normal by the HPCS and RCIC system automatic operation.

After 30 minutes, it is assumed one RHR heat exchanger will be placed in the suppression pool cooling mode to remove decay heat. At this time, the suppression pool will be almost 120ºF.

At approximately 32 minutes into the transient, the operator initiates depressurization of the reactor vessel. Controlled depressurization procedures consist of controlling vessel pressure and water level by using selected safety relief valves, RCIC, and HPCS systems.

When the reactor pressure approaches 100 psig, the operator would normally prepare for operation of the RHR system in the shutdown cooling m ode. At this time (153 minutes), the suppression pool temperature will be about 170ºF.

CLINTON POWER STATION UPDATED SAFETY ANALYSIS REPORT Figure 15.2.9-1A Sheet 2 of 3 ADS/RHR COOLING LOOPS CPS/USAR Revision 10 October 2002 NOTES FOR FIGURE 15.2.9-1A (Continued)

ACTIVITY C1 (Division 1 fails, Division 2 available) System pressure = approximately 100 psig System temperature = approximately 340ºF.

Operator Actions The operator establishes a closed cooling path as follows:

Either of the following cooling paths are established:

(a) Utilizing RHR Loop B, water from the suppression pool is pumped through the RHR heat exchanger (where a portion of the decay heat is removed) into the reactor vessel. The cooled suppression pool water flows through the vessel (picking up a portion of the decay heat) out the ADS valves and back to the suppression pool. This alternate cooling path is shown in Figure 15.2.9-4. (b) Utilizing RHR Loops B and C together, water is taken from the suppression pool and pumped directly into the reactor vessel. The water passes through the vessel (picking up decay heat) and out the ADS valves returning to the suppression pool as shown in Figure 15.2.9-5. Suppression pool water is then cooled by operation of RHR Loop B in the cooling mode (Figure 15.2.9-6). In this alternate cooling path, RHR Loop C is used for injection and RHR Loop B for cooling.

ACTIVITY C2 (Division 2 fails, Division 1 available) System pressure = approximately 100 psig System temperature = approximately 340ºF.

Operator Actions Utilizing RHR Loop A instead of Loop B, at 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> an alternate cooling path is established as in Activity C1 item 2 (a) above. Cold shutdown is reached in approximatley 24.3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br />.

CLINTON POWER STATION UPDATED SAFETY ANALYSIS REPORT Figure 15.2.9-1A Sheet 3 of 3 ADS/RHR COOLING LOOPS

CPS/USAR CHAPTER 15 REV. 12, JAN 2007

FIGURE 15.4.9-1 NOT APPLICABLE

CPS/USAR REV. 13, JANUARY 2009 Leakage Rates and Secondary Containment Mixing Parameters Path Description Parameters & Values L 1 Primary Containment

Leakage Bypassing

Secondary Containment to the Environment Leak Rate:

0.08*L a = 0.052%/day from 0 to 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />

= 0.033%/day from 1 to 30 days L 2 Primary Containment Leakage to Secondary

Containment Leak Rate:

0.92*L a = 0.598%/day from 0 to 10 min Unfiltered during drawdown period

= 0.598%/day from 10 min to 24 hrs SGTS filtered

= 0.380%/day from 1 to 30 days SGTS filtered L 3 MSIV Leakage to

Environment Leak Rate:

200 scfh for all main steam lines,

100 scfh for maximum for any one MS line;

reduced to 63.6% of these rates after 1 day L 4 FWIV Containment Air

Leakage to Environment Leak Rate:

10.98 cfm total, for the one hour before FWIV LCS fills the lines L 5 ECCS Leakage to

Secondary Containment Leak Rate:

5 gpm from 0 to 30 days L 6 FWIV LCS Leakage of

ECCS Liquid to the

Environment Leak Rate:

2 gpm from 0 to 1 days

1 gpm from 1 to 30 days

[Conservatively includes fill time]

L 7 Purge Penetrations 101

and 102 Leakage to the

Environment Leak Rate (for each of two penetrations):

0.02*L a = 0.013%/day from 0 to 1 day

= 0.0083%/day from 1 to 30 days L 8 Release of Secondary

Containment Atmosphere

through SGTS to the

Environment No Secondary Containment mixing credit

Modeled as:

Volume = 1 cu.ft.

Outflow = 1000 cfm

CLINTON POWER STATION UPDATED SAFETY ANALYSIS REPORT FIGURE 15.6.5-1 Page 2 of 2 Schematic of LOCA Transport Pathways

CPS/USAR CHAPTER 15 REV. 12, JAN 2007

FIGURES 15A.6-33 THROUGH 15A.6-37 NOT USED

CPS/USAR CHAPTER 15 REV. 12, JAN 2007

FIGURES 15A.6-54 THROUGH 15A.6-59 NOT USED