ML18022A255

Updated Final Safety Analysis Report (Ufsar), Amendment 27, 6.5 Safety Evaluation

ML18022A255
Person / Time
Site:	Browns Ferry
Issue date:	10/05/2017
From:	Tennessee Valley Authority
To:	Office of Nuclear Reactor Regulation
Shared Package
ML18018A778	List: ML18018A780 ML18018A781 ML18018A783 ML18018A784 ML18018A785 ML18018A787 ML18018A788 ML18018A790 ML18018A792 ML18018A793 ML18018A795 ML18018A796 ML18018A797 ML18018A798 ML18018A800 ML18018A801 ML18018A802 ML18018A804 ML18018A806 ML18018A807 ML18022A114 ML18022A115 ML18022A116 ML18022A117 ML18022A118 ML18022A119 ML18022A120 ML18022A121 ML18022A123 ML18022A124 ML18022A125 ML18022A127 ML18022A128 ML18022A129 ML18022A130 ML18022A131 ML18022A132 ML18022A133 ML18022A148 ML18022A155 ML18022A156 ML18022A157 ML18022A158 ML18022A159 ML18022A161 ML18022A162 ML18022A163 ML18022A164 ML18022A165 ML18022A166 ... further results
References
Download: ML18022A255 (21)

Text

BFN-27 6.5-1 6.5 SAFETY EVALUATION

6.5.1 Summary

In order to satisfy the safety design bas is, four means for emergency core cooling are provided. They are:

High Pressure Coolant Injection (HPCI)

Automatic Depressurization System (ADS)

Low Pressure Core Spray (LPCS) Low Pressure Coolant Injection (LPCI)

These are in addition to the feedwater, c ontrol rod drive, an d RCIC Systems which also supply core coolant.

For reliability, each emergency core cooling system uses equipment with as few components required to actuate as feas ible, and those are operable for test purposes during normal operation except the inboard isolation check valves can only be tested during cold shutdown. To provide diversity, two different cooling methods are provided--spraying and flooding.

Evaluation of the reliabili ty and redundancy of the controls and instrumentation for the Emergency Core Cooling Systems (ECCS) shows that no failure of a single initiating sensor eit her prevents or falsely starts the initiation of these cooling systems. No single control failure pr events the combined cooling systems from providing the core with adequate cooling. T he controls and instrumentation can be calibrated and tested to assure proper res ponse to conditions representative of accident situations.

As stated in the safety objective and in safe ty design basis 2, the ECCS is to remove the residual and decay heat from the reactor core so th at fuel clad melting is prevented and fuel clad damage is acceptably minimized. The design basis used is that nowhere in the core will the fuel cladding reach the calculated melting temperature of 3370

°F. The intent of the ECCS tem perature criterion is to prev ent gross core meltdown or clad damage. Since core cooling cannot be easily shown to be effective unless the geometry is defined, a no-cladding melt criterion should suffice. However, because under some conditions highly oxidized Zircal oy is known to fracture upon cooling, concern exists that the core geometry may not remain defined after cooldown. Based on the worst case experimental data, cladding fragm entation upon cooldown can be prevented for the time scale of interest here, if the maximum cladding temperature is limited to less than 2200

°F.1 Thus this is the design temperature

BFN-27 6.5-2 criterion against which ECCS performance must now be judged, i.e., the systems shall prevent cladding fragmentation upon co oldown which translates to a peak temperature of 2200

°F. It should be noted, however, that since t he cladding fragmentation would not occur until after the core is cooled and flooded, it is most likely that a considerable portion of the core could be fragmented without leading to gross core melting. In addition to this margin inherent in the criterion the actual performance of the core cooling systems is such that peak temperatures lower than 2200

°F result across the complete break spectrum.

All of the safety design bases for the E CCS are shown to be met by the previous descriptions, the referenced descriptions and evaluations of the individual and combined ECCS.

Peak cladding temperatures are determined in accordance with approved analytical methods.

6.5.2 Performance

Analysis The manner in which the ECCS operates to pr otect the core is a function of the rate at which coolant is lost from the break in the nuclear system process barrier. The HPCI is designed to operate while the nuclear system is at high pressure. The LPCS and LPCI are designed for operation at low pressures.

ADS is provided to automatically reduce nuclear system pressure if a break has occurred and vessel water level is not main tained by the HPCI and the other water addition systems. Rapid depressurization of the nuclear system is desirable to permit flow from the LPCS and LPCI to enter the vessel, so that the temperature rise in the core is limited.

If for a given size break, the HPCI has t he capacity to make up for all the coolant loss from the nuclear system, flow from the low pressure portion of the ECCS is available for core protection before t he nuclear system pressure has decreased below the pressure at which the HPCI turbine steam stop valve shuts due to low steam supply pressure (see Subsection 7.3, "Primary Containment Isolation

System").

Adequate net positive suction head (NPSH) is provided for the ECCS throughout the loss-of-coolant accident.

The ECCS response and resulting peak cladding temperatures have been evaluated. These evaluations were perfo rmed for a complete spectrum of break sizes and postulated single failures. The re sults of these evaluations demonstrate that adequate core cooling capability exists over the entire spectr um of break sizes BFN-27 6.5-3 even with a concurrent loss of normal auxiliary power and postulated single failures.12 6.5.2.1 Analysis Methodology

ECCS performance was analyzed usi ng the approved SAFER/GESTR-LOCA application methodology 12 for GE fuel analyses and the approved EXEM BWR-2000 methodology 13 for AREVA fuel analyses. Browns Ferry specific modifications to the EXEM BWR-2000 methodology are documented in Reference 24. These modifications were approved by NRC for application to Browns Ferry Unit 1 in Reference 26. These methodologies evalua te the short-term and long-term reactor vessel blowdown response to a pipe ruptur e, the subsequent core reflooding by ECCS, and the final rod heatup. The reactor vessel pressure and liquid levels, ECCS performance, and other primary thermal-hydraulic phenomena are predicted as a function of time. These predicti ons are then used to determine the cladding temperature under various accident conditions.

The Code of Federal Regulati ons (10 CFR 50.46) outlines t he acceptance criteria for ECCS analysis. A summary of the acceptance criteria is provided below.

Criterion 1 - Peak Cladding Temperature - The calculat ed maximum fuel element cladding temperature shall not exceed 2200

°F. Criterion 2 - Maximum Claddi ng Oxidation - The calculated total local oxidation shall not exceed 0.17 times the total cl adding thickness before oxidation.

Criterion 3 - Maximum Hydrogen Generatio n - The calculated total amount of hydrogen generated from the chemical reaction of the cladding with water or steam shall not exceed 0.01 times the hypothetic al amount that woul d be generated if all the metal in the cladding cylinder surrounding the fuel, excluding the cladding surrounding the plenum volu me, were to react.

Criterion 4 - Coolable Geom etry - Calculated changes in core geometry shall be such that the core rema ins amendable to cooling.

Criterion 5 - Long-Term Cooling - After any ca lculated successful in itial operation of the ECCS, the calculated core temperature shall be maintained at an acceptably low value and decay heat shall be removed for t he extended period of time required by the long-lived radioactivity remaining in the core.

BFN-27 6.5-4 The conformance with Criteria 1 through 3 is demonstrated by performing LOCA analyses and the conformance with Criterion 4 is demons trated by conformance to Criteria 1 and 2. Compliance with Crit erion 5 is addressed per Reference 29.

GE Fuel LOCA Analyses The SAFER/GESTR-LOCA application methodology used for GE fuel analyses consists of three essential parts. Fi rst, potentially limiting LOCA cases are determined by applying realistic (nominal) analytical models across the entire break spectrum. Second, limiting LOCA ca ses are analyzed with an Appendix K model (inputs and assumptions) which incorporates all the required feat ures of 10 CFR 50, Appendix K. For the most limiting cases, a Licensing Basis Peak Cladding Temperature (PCT) 12 is calculated based on the nominal PCT with an adder to account statistically for the differe nces between the nom inal and Appendix K assumptions. Finally, after demonstrating the conservatism of the Licensing Basis PCT, it is ensured that the resulting Licensing Basis PCT conforms to all the requirements of 10 CFR 50.46 and Appendix K.

AREVA Fuel LOCA Analyses

The evaluation model used for LOCA analyses of AREVA fuel is the EXEM BWR-2000 LOCA analysis methodology described in Reference 13. Browns Ferry specific modifications to the EXEM BWR-2000 methodology are documented in Reference 24. These modifications were approved by NRC for application to Browns Ferry Unit 1 in Reference 26. This methodology employs the following three major computer codes to evaluate the LOCA system and fuel response: RELAX, HUXY, and RODEX2. RELAX is used to calculate the system and hot channel response during the blowdown, refill and reflood phases of the LOCA. The HUXY code is used to perform heatup calculations for the entire LOCA, calculating the PCT and local clad oxidation at the axial plane of interest. RODEX2 is used to determine fuel parameters (such as st ored energy) for input to the other codes. The analysis uses models, inputs and assumptions consist ent with all the requir ed features of 10 CFR 50 Appendix K to calculate the Licensing Basis PCT.

Once the limiting LOCA break size, type, location, axial po wer shape, and ECCS single failure are established, HUXY heatup calculations versus exposure are made for the reload nuclear fuel design to determine the maxi mum average planar line ar heat generation rate (MAPLHGR) limits, PCT, and local maximum and core average cladding oxidation fractions. The reload fuel-specific analysis results and MAPLHGR limits are documented in the Reload Licensing An alysis (Appendix N of this UFSAR).

To conform with 10 CFR 50.46 and the LOCA analysis licensing methodologies, the Licensing Basis PCT must be less than 2200

°F. To demonstrate the conform ance with the ECCS acceptance criteria, the LOCA analysis is performed for the full break spec trum. Various single failures are also BFN-27 6.5-5 investigated to identify the worst cases.

Table 6.5-1 shows the plant operating conditions assumed in the analysis.

Table 6.5-2 shows the ECCS equipment capacity assumed for the analysis. Table 6.5-3 identifies systems available in core cooling for given combinations of break locations and single failures. One active single failure within the plant is postulated to occur concurrent with the pipe break.

Additional details about the AREVA LOCA analysis bases, plant operating conditions, ECCS equipment performance and timing can be found in Reference 24.

A seismic event is neither postulated to o ccur concurrently with the LOCA nor as an initiator of the pipe break.

6.5.2.2 High Pressure C oolant Injection System The HPCI is designed to provide adequate reac tor core cooling for small breaks and to depressurize the reactor primary system such that the LPCS and LPCI can be initiated. A detailed discussion of the per formance of the HPCI, in conjunction with the LPCS and LPCI, is given in paragraph 6.

5.3. Table

6.5-3 lists the ECCS which are available for both recirculation su ction and discharge breaks following an assumed single failure.

When the HPCI begins operatio n, the reactor depressurizes more rapidly than would occur if HPCI was not initia ted due to the condensation of steam by the cold fluid pumped into the reactor vessel by the HP CI. As the reactor vessel pressure continues to decrease, the HPCI flow momentarily reaches equilibrium with the flow through the break. Continued depressurizati on causes the break flow to decrease below the HPCI flow and the liq uid inventory begins to rise.

This type of response is typical of the sm all breaks. The core never uncovers and is continuously cooled throughout the transient so that no core damage of any kind occurs for breaks that lie within the range of the HPCI.

An analysis has been made to determine if any carryover occurs in the steam supply to the HPCI turbine which could have a detri mental effect on turbine operation. In the case of a break in a liquid line, when the HPCI is energiz ed, the level in the reactor vessel is low enough to prevent ca rryover in the steam which leaves the reactor vessel. In the case of a sm all break in the reactor steam region simultaneously with loss of normal AC power , reactor scram, recirculation pump coast-down, and loss of feedwater, analysis shows that the in itial decrease of pressure in the reactor results in no significant level swell and no carryover of water into the steam supply to the HPCI turbine. HPCI cold water quenches any steam formation in the downcomer region. Afte r the HPCI has been operating, and as the level rises in the reactor vessel, natur al circulation within the vessel becomes established and any steam to the HP CI turbine passes through the steam separators and dryers eliminat ing any moisture carryover. It is concluded that a mechanism to cause bypassing of the steam separators, by t he swelling steam BFN-27 6.5-6 water mixture, is not available. Therefore, gross moisture carryover to the HPCI turbine should not occur over the range of steamline breaks of interest in this system.

The HPCI turbine has been designed fo r high reliability under its design requirements of quick starting. Moreover, the turbine has adequate capacity to accept the small losses in efficiency due to any credible moisture carryover, since HPCI turbine efficiency is not of paramount importance.

The feedwater spargers are utilized in the reactor for HP CI injection. Each sparger is mounted to the inside reactor vessel surface. The thermal sleeve is attached to the sparger midpoint; however, the sleeve is not welded to the vessel nozzle.

Therefore, the feedwat er sparger is removable. T he spargers are mounted in the vessel at one elevation to distribute the fe edwater in a symmetric pattern about the vessel axis. Each sparger is support ed by the thermal sleeve and a bracket mounted to each end of the sparger. Provisi on is made for the differential expansion between the stainless steel sparger and car bon steel vessel. Radial differential expansion is taken up by the slip fit of the thermal sleeve into the vessel nozzle.

Tangential differential expansi on is taken up by tangential slots cut in the bracket mounted to each end of the feedwater sparger bracket. The sparger is analyzed assuming the thermal sleeve is welded into the nozzle. Additionally, pressure differentials, jet reactions, and earthquak e loadings are all add ed; these stresses within the sparger are all within ASME Code Section III allowables for Class A Vessels. The resultant bracket loads meet the loading criteria given in Appendix C. It is concluded that design basis 8 is satisfied.

6.5.2.3 Automatic Depressurization System When the ADS is actuated, the flow of steam through the valves provides a maximum energy removal rate while mini mizing the corresponding fluid mass loss from the reactor vessel. Thus , the specific internal energ y of the saturated fluid in the reactor vessel is rapidly decreased c ausing pressure reduction. Once the reactor vessel pressure has decreased below the shut off head of the LPCS and LPCI pumps, these low pressure ECCS will provide adequate core cooling flow.

Therefore, the ADS provides the backup for the HCPI. Table 6.5-3 lists the ECCS available for both recirculation sucti on and discharge breaks following an assumed single failure.

Actuation of the ADS function does not requi re any source of offsite power. The main steam relief valves require DC power from the unit batteries for control and air power from accumulators for operation.

This satisfies safety design basis 5.

BFN-27 6.5-7 The accumulators and the nuclear system main steam relief valves are within the primary containment and this satisfies the containment isolat ion requirements of safety design basis 6.

6.5.2.4 Low Pressure Core Spray System The LPCS, in conjunction with other ECCS Systems, is designed to maintain continuity of reactor core cooling for a la rge spectrum of loss-of-coolant accidents up to and including the design basis double-ended recirculation line break. The integrated performance of the LPCS, in conjunction with other ECCS, is given in paragraph 6.5.3.

Performance analyses of the reactor LPCS are based on an analytic prediction of the reactor vessel pressure and mass invent ory as a function of time following a postulated rupture of the coolant system piping.

The LPCS alone cannot protect the core below certain break sizes. This is because vessel pressure does not drop rapidly enough to allow sufficient injection before the cladding hot spot reaches excessively high temperature. Below this break size either the HPCI or the ADS extend the range of the LPCS to breaks of insignificant magnitude.

For the limiting design basis accident, a co mbination of the LPCS and LPCI provide sufficient cooling to meet peak clad temperature limits.

12 Table 6.5-3 lists the ECCS available for both recirculation sucti on and discharge breaks following an assumed single failure.

Experimental tests have shown that the quantity of flow cu rrently being provided for core spray is greatly in excess of the mini mum actually required fo r satisfactory core cooling 3. The tests showed that more than t he minimum flow required is readily attained for every fuel assembly. Other tests include evaluation of the effects of updraft caused by steam flow through the co re or evaporation of the water that enters the fuel assembly. The effects of updraft are minor. A series of tests were performed to obtain design data relating to dist ribution of core spray coolant over the top surface of the reactor core. The topical report 3 contains a description of the test facility and plots of the signific ant results from the tests.

The core spray tests also provided experimental effective heat transfer coefficients, thus enabling correlation of the core heatup m odel with the actual test data. Data from tests on an exact protot ype at power resulted in vo lume percentile temperature distributions. The close correlation betw een the peak temperature and general trend demonstrates the adequacy of the analytical models employed.

BFN-27 6.5-8 To assure continuity of core cooling, signals to isolate the primary or secondary containments do not operate any LPCS valv es. This arrangement satisfies safety design basis 6.

The check valve is the only core spra y equipment in the pr imary containment required to actuate during a loss-of-coolant accident which requires consideration for the high temperature and hum idity environment in the containment from the accident. The selected valve actuates on fl ow through the pipe line, independent of any external signal. Thus, neither t he normal nor accident environment in the containment affects the operability of the core spray equipment for the accident. It is concluded that safety design basis 9 is satisfied.

Taking the core spray water from the pressure suppression pool establishes a closed loop for recirculation of the spray water escaping from the break. It is concluded that safety design basis 11 is satisfied.

The core spray spargers and piping are designed as Class I (see Appendix C) so that they meet design basis 10.

6.5.2.5 Low Pressure Coolant Injection System LPCI is provided to automatically reflood t he reactor core in time to limit cladding temperatures after a nuclear system LOCA when the reactor vessel pressure is below the shutoff head of the pumps. The LPCI provides cooling by flooding which differs from the LPCS which provides cooling by spraying.

For the limiting design basis accident, a combination of the LPCS and LPCI is necessary to supply sufficient cooling to meet peak clad temperature limits.

12 Table 6.5-3 lists the Emergency Core Cooling Systems which are available for both recirculation suction and discharge breaks fo llowing an assumed si ngle failure.

The maximum vessel pressure against which the LPCI pumps must deliver some flow is determined by the required overlap with HPCI which has a low pressure cutoff for the HPCI turbine. The LPCIS pumps are capable of delivering flow above the pressure due to the pump head flow characteristics.

LPCI cooling capability is analyzed using approved analytical methods based on the mass and energy flows to and from the reactor.

The LPCI control system responds as described in Section 7.4.3. When the nuclear system pressure decreases to the pumping head of LPCI, the check valve in the injection line opens and LPCI water is pumped into the reactor vessel to reflood the core.

BFN-27 6.5-9 These actions provide an integral flow path fo r the injection of the LPCI flow into the bottom plenum of the reactor vessel. As th e LPCI flow accumulates, the level rises inside the shroud. When the level reaches the top of the jet pumps, spillover occurs for a time raising the level outside the sh roud. As the subcool ed LPCI flow begins spilling into the region outside the shroud, th e depressurization effect of the break is reduced since the subcooled water is now fl owing out the break. As the pressure begins to rise, the LPCI flow is reduced until a quasi-equilibrium pressure is reached. At this point the break is parti ally covered by subcooled water which has spilled over the top of the jet pumps and the equivalent area of the break available for steam blowdown is maintained at t he required equilibrium value by the LPCI spillage. If pressure were to rise, the LPCI flow woul d be reduced, the equivalent break size for steam blowdown would incr ease, and pressure would drop. Complete equilibrium will be reached when the rate of saturating the LPCI water becomes equal to the boil-off rate.

It is noted that this condition will not actually be attained because of the HPCI and ADS effects on the transient. Although HPCI flow will be lost when pressure is reduced sufficiently, the auto depressurization valves would open as level continues to drop.

To assure continuity of core cooling, signals to isolate the primary or secondary containments do not operate any LPCI va lves when aligned for power operation. This arrangement satisfies safety design basis 6.

The two check valves in Units 1, 2, and 3 are the only LPCI equipment in the primary containment required to actuate during a LOCA wh ich require consideration for the high temperature and humidity envir onment in the cont ainment from the accident. The type of valve chosen actuates on flow through the pipeline, independent of any external signal.

Note: For Units 1, 2, and 3, Unit 3, the RHR check valve actuator, controls and indication functions have been deleted.

The actuator is provided only for test.

Thus, neither the normal nor accident environment in the containment affects the operability of the LPCI equipment for the accident. It is concluded that safety design basis 9 is satisfied.

Using the pressure suppression pool as the source of water for LPCI establishes a closed loop for recirculation of LPCI water escaping from the break.

It is concluded that safety design basis 11 is satisfied.

The LPCI and appropriate porti ons of the recirculation loops are designed as Class I (see Appendix C) so that t hey meet design basis 10.

BFN-27 6.5-10 6.5.3 Integrated Operat ion of the Emergency Co re Cooling Systems Sections 6.4 and 6.5.2 described the per formance and operation of each of the EECS individually. Section 6.5.3 is dire cted toward the int egrated performance of the ECCS, i.e., how the entire ECCS operates together to provide core cooling for the entire spectrum of LOCA concurrent with an assumed active single failure. The ECCS integrated performance under LOCA conditions is evaluated according to the analysis procedure described in Section 6.5.2. The primary emphasis is placed on the liquid line break since for a given break size the consequences of a break in a liquid line are more severe than for a break in a steam line. As summarized in the next paragraphs, it is demonstrated that the core cooling capability is available even concurrently with the improbable loss of all offsite AC power. In actual cases, more core cooling capability than assumed in the analysis is avai lable since the reliability of plant AC power is extremely high.

The containment response is discussed in Section 14, "Plant Safety Analysis." 6.5.3.1 Recirculation Line Breaks Large Breaks The analyses assume a loss of normal auxi liary AC power concurrent with a line break. This satisfies safety design basis 5. The recirculation suction line is the largest liquid line inside the drywell. A double-ended break in this line would result in the most rapid depressurization and inventory loss.

For the limiting case, the reactor is a ssumed to be operating at 102% of 3458 MWt when the break occurs. The feedwater pumps are assumed to coast down in five seconds (for GE LOCA analyses; less for AREVA LOCA analyses) to minimize credit for feedwater to mainta in reactor inventory. The analyses assume the reactor water level is at the normal level when the break occurs.

Immediately after the break, critical flow would be est ablished at the break. The large increase in core void fraction that would be caused by the decreasing vessel

pressure would be sufficient to render the co re subcritical. High drywell pressure would initiate mechanical scram of the control rod system in less than one second.

A reactor vessel low-low-low water level signal initiates closure of the main steam isolation valves very rapidly.

A double-ended break in the recirculation line will result in rapid depressurization of the reactor vessel and loss of reactor coolant inventory. Eit her the low-low-low water level sensor in the reactor vessel or high drywell pressure sensor plus low reactor vessel pressure would generate a si gnal to initiate the ECCS (i.e., LPCS and LPCI mode of the RHR System).

BFN-27 6.5-11 Intermediate or Small Breaks

For break sizes below the lower limit of t he unassisted LPCS or LPCI, the HPCI or ADS acts to depressurize the nuclear boiler, allowing either the LPCS or the LPCI to provide core cooling. The intermediat e break range here is defined between the limits of the unassisted HPCI and the unassisted LPCS or LPCI, in which one of the high pressure systems (HPCI or ADS) wo rks in conjunction with one of the low pressure systems (LPCS or LPCI) to pr ovide core cooling. The integrated performance of the ADS, in conjunction with the LPCS or LPCS for the intermediate break sizes, is very similar to the perfo rmance of these same combinations for the small break sizes, except depressuriza tion is more rapidly accomplished with increasing break size. For this reason, the integrated performance of these system combinations is discussed below for small breaks.

For small breaks, the core is protected by the HPCI and by the LPCS or LPCI in conjunction with the ADS.

The performance of the HPCI for these small break sizes is described in paragraph 6.5.2.2.

Generally, the ADS/LPCS or ADS/LPCI combinations will not prevent partial core uncovery as the HPCI does. However, the ADS is designed to allow the LPCS or LPCI to prevent excessive cladding temper atures for all break sizes down to and including a zero break size.

The sequence of events during t he initial phase of the small break transient is similar to that discussed earlier for the HPCI System performance. The important difference in the system response for the ADS case is that the vessel pressure hovers near rated for a much longer period of time since the HPCI is assumed to be inoperable and the ADS is not actuated until 120 seconds a fter the low-low-low trip level is reached (and confirmation of ECCS system operation). An additional obvious difference is the more rapid loss of liquid inventory due to the higher vessel pressure and absence of HPCI makeup. When the ADS is actuated, a marked increase in the vessel pressure reduction rate occurs due to the critical steam flow through the main steam relief valves. This increased depressurization rate causes a corresponding increase in water levels inside and outside the shroud. When the water level inside the shroud drops to the top of the jet pumps, the water level is sustained except for flashing due to depressu rization and boil-off. The level outside the shroud continues to drop rapidly until th e LPCS or LPCI have restored the water level inside the shroud to the top of the jet pumps. At this level, the water from inside the shroud begins spilling over into the region outside the shroud, thereby raising the water level outside the shroud.

The performance cases illustrated above are ty pical for the ADS/LPCS or ADS/LPCI combinations in the small break region. As much larger breaks are considered, the BFN-27 6.5-12 performance of these system combinations becomes the same as the LPCS or LPCI alone discussed in paragraphs 6.5.2.

4 and 6.5.2.5, respectively.

Many different cases of recirculation line breaks in combination with various single failures were analyzed using nominal , Appendix K, and licensing basis assumptions 12, 24. GE fuel analyses have been performed for both EPU and 105%

OLTP conditions (References 12, 26). AREVA fuel analyses have been performed for 105% OLTP conditions (References 22-25).

The GE14 LOCA break spectrum analyses fo r EPU and 105% OLTP conditions are provided in Reference 12. For 105%

OLTP, the results show that a DBA recirculation suction line break with a batte ry failure produces the highest PCT. For EPU, the highest PCT is produced by a small (0.06 ft

2) recirculation discharge line break with battery failure.

The AREVA LOCA break spectrum analysis for ATRIUM-10 fuel at 105% OLTP conditions is provided in Reference 24. The limiting break is determined to be a 0.21 ft 2 split break in the recirculation di scharge line with top-peaked axial power shape and a battery failure affecting HPCI and LPCI.

The AREVA LOCA break spectrum analysis for ATRIUM-10XM fuel at 105% OLTP conditions is provided in Reference 28. The limiting break is determined to be a 0.20 ft 2 split break in the recirculation discharge line with top-peaked axial power shape and battery failure a ffecting HPCI and LPCI.

For the limiting fuel type, using the Appendix K assumptions for the maximum recirculation suction line break coincident wi th battery failure results in a PCT well below the 2200 °F limit. The licensing basis PCT is determined by summing the nominal PCT with an adder that is based on the nominal and Appendix K results. The analyses demonstrate the licensing basis PCT is well below the 2200 °F limit

12. This satisfies safety design bases 1, 2, and 3. The cycle specific values are provided in Appendix N. It is also demonstrated 12 that the maximum cladding oxidation and maximum hydrogen generation for all cases are well below the ECCS acceptance criteria discussed in paragraph 6.5.2.1. (Note: the preceding paragraph is specific to the Reference 12 GE SAFER/GESTR-LOCA analyses. Although the AREVA LOCA analysis bases and methodology are different, the conclusions relative to the ECCS licensing limits are essentially the same.)

Typical operational sequences of the Emergency Core Cooling Systems are shown in Table 6.5-4 (for a recirculation discharge line break).

28 6.5.3.2 Non-Recirculation Line Breaks

Non-recirculation line breaks were analyzed for the limiting fuel type.

12 The non-recirculation breaks include: core sp ray line break, feedwater line break, and BFN-27 6.5-13 steamline breaks inside and outside the contai nment. The results show that these postulated non-recirculation line breaks are significantly less limiting than the postulated recirculation line breaks.

Discussion and illustration of the ECCS performance capability has purposely been directed toward the liquid breaks below the core. In general, the ECCS design criterion of limiting cladding temperature to less than 2200

°F is more easily satisfied for steam breaks than for liquid breaks because the reacto r primary system depressurizes more rapidly with less mass loss for steam breaks than for liquid breaks. Thus the ECCS performance for a given break size improves with increasing break flow quality.

The most severe steam pipe break would be one which occurs inside the drywell, upstream of the flow limiters. A break in this locati on would permit the pressure vessel to continue to depressurize to the dryw ell. As serious as this accident could be, it does not result in thermal-hydraulic consequences as severe as the rupture of a coolant recirculation pipe.

The accident sequence would proceed as follows:

a. An instantaneous guillot ine severance of the st eam pipe upstream of the steam flow restrictors would permit flow to accelerate to its limiting critical flow value in the break at the pressure vessel end, and at the flow-limiter end.

b. The steam loss in exce ss of the generation rate would result in rapid depressurization of the pressure vessel and the steam pipes.

c. The first 10 seconds of this accident are similar to the break outside the drywell discussed in Section 14, "Plant Safety Analysis." However, for the break inside the drywell, cl osure of the isolatio n valves reduces the blowdown rate but does not prevent the vessel from depressurizing; the vessel would continue depressurizing through the pi pe from the pressure vessel to the break.

The reactor would be shut down immediately during a steamline break by the voids which would result from the depressuri zation. A mechanical scram would be initiated by a position swit ch in each isolation valve. Low water level and high drywell pressure which would occur later in the blowdown, would also initiate a scram. The reactor coolant loss through blowdown c onsists of three intervals: first steam blowdown, then mixture blowdown, and final ly steam blowdown again. After the accident, steam in each end of the break is accelerated to critical flow.

BFN-27 6.5-14 As the reactor vessel depressurizes, the wa ter level rises due to flashing. When the level reaches the steam pipes, the break flow changes from a steam blowdown to a steam-water mixture blowdown. Closure of the isolation valves reduces the blowdown rate. As coolant is expelled and the pressure decreases, the water level in the pressure vessel will drop below the steam pipe elevation and steam blowdown will begin again. The system depressurizati on rate would increase, but the mass flow rate through the break would decrease.

6.5.3.3 Effect of Fuel Cladding Failure on Core Cooling The ECCS is designed to prevent clad me lting and fragmentation upon cooldown for any loss of coolant within the design basis spectrum. The purpose is to keep the cladding and fuel from distor tion to a degree that subsequent cooling is ineffective.

Satisfying these criteria does allow for the tolerance of cladding perforation. Even though the cooling equipment is successful in keeping cl adding temperature well below the criterion for the des ign maximum temperature (2200

°F), a small percentage of the fuel may perforate. However, the occurrence of even a large number of perforations does not prevent core coo ling from being successful.

Cladding perforation occurs when the gas pressure within the rod exceeds the pressure the cladding can withstand for that particular cladding temperature. The mode of this failure is known. The perfora tion is local, in that a given fuel rod perforates at a particular loca tion the extent of which is on the order of an inch in axial length. The perforation is random in that it may occur and will be localized at a weak point along the fuel rod length-pr obably at a point of cladding flaw, pellet oversize, pellet chip, or point of slightly increased cladding oxidation. The locations of such weak points are randomly distri buted among the fuel r ods within the fuel assembly.

The conclusion that perforation is random and local is based upon confirmed observations of irradiated fuel.

9 Such random failures hav e also been demonstrated in test loops by placing Zi rcaloy tubing, filled with UO 2 pellets and pressurized with gas, in an induction heating facility and observing the failure mode. The observed failures were always localized and random al ong the length of t he heated rod. Only a slight change in diameter was observed to occur, except within an inch or two on either side of the perforation. This is characteristic of burst failure at high temperatures in general. From these tests, the major conclusions are that perforations are indeed local and that the fuel rods do not distort grossly over the length of the fuel rod.

A separate study 10 has been made of metal-water reactions during a loss-of-coolant accident and the report of the study shows how ECCS design is influenced by metal water reaction. In addition, this study covers the effect s of hydrogen generation during a loss-of-coolant accident.

BFN-27 6.5-15 The temperatures resulting from the postulated accident are determined using conservative models and conservative assumptions. Since steamline breaks are not as severe as liquid line breaks, it is c oncluded that safety design bases 2 and 3 are satisfied.

6.5.3.4 Alternate Operating Mode Considerations The impact of alternate operating modes on LOCA results is evaluated by analyzing the limiting LOCA case at su ch operating conditions as: Increased Core Flow (ICF), Maximum Extended Load Line Limit (ME LLL), and Final Feedwater Temperature Reduction (FFWTR).

12 For ICF and FFWTR, the im pact on LOCA results is negligible. For the GE Reference 12 analysis, the Appendix K PCT at MELLL core flow conditions is small relative to the PCT margin available at the rated core flow conditions, with respect to the 2200

°F limit. 6.5.4 Emergency Core C ooling Systems Redundancy The design criterion of preventing peak cladding temperatures greater than 2200

°F is satisfied across the entir e spectrum of possible liqu id or steamline break sizes even in the event of the loss of norma l auxiliary power combined with a single failure. It is concluded that the redundant cap ability of the ECCS is sufficient for all size line breaks up to and incl uding the design basis break.

It is assumed that one of the postulated sing le failures is a spurious accident signal initiated from a non-accident unit. This opposite unit false LOCA signal is assumed to occur either coincident with the valid LOCA signal prior to the valid LOCA signal or after the valid LOCA signal. There is sufficient redundancy in the ECCS initiation and preferred pump logic that the ECCS will be able to satisfy the design criteria for any postulated combinations of s purious and real accident signals.

The individual functions of the ECCS also meet the design criteria over various ranges of break sizes in the nuclear system. Their integrated performance provides adequate and timely core cooling over the entire spectrum of LOCAs up to and

including the design basis LOCA even with conc urrent loss of offsite AC power. It is concluded that safety design basis 1 is satisfied.

6.5.5 Net Positive Suction Head (NPSH) 6.5.5.1 Description An important design attribut e for the operation of the E CCS pumps is the assurance of adequate NPSH. NPSH is a function of individual pump flow , total ECCS flow, friction loss, ECCS strainer blockage, suppression pool water level, suppression pool temperature, and wetwell pressure. NPSH can be challenged for the ECCS pumps during events involving large increases in suppression pool temperature, BFN-27 6.5-16 which includes LOCA, Anticipated Transi ent Without Scram (FSAR Section 7.19), Station Blackout (FSAR Secti on 8.10), and fire events.

The HPCI is designed to provide reacto r inventory makeup water and assist in depressurizing the reactor during an intermedi ate or small break LOCA. During the first 10 minutes after initiation of the accident, the suppression pool temperature remains below 140ºF. If the HPCI pum p operates beyond the first 10 minutes following the event and the HPCI pump suction is aligned to the suppression pool, then manual operation would terminate HPCI pump operation when the suppression pool temperature reaches approximately 140°F due to system operating restrictions, which is below pool temperat ures where NPSH margin w ould be of concern. This approach ensures that the HPCI pump NPSH remains adequate for operation

following a postulated accident.

The determination of the available NPSH (NPSHa) to the RHR and LPCS pumps as a function of time after a postulated DBA-LOCA short-term and DBA-LOCA long-term has been accomplished in accor dance with the guidelines in Regulatory Guide (RG) 1.82, Revision 3, "Water S ources for Long-term Recirculation Cooling Following a Loss-of-Coolant A ccident." Any amount of containment pressure required in excess of atmospheric pre ssure to maintain adequate ECCS pump NPSH is referred to as Containment Overpressure (COP). Credit for COP in NPSH calculations is dependent on containment integrity and is limited to NRC-approved values.

BFN-27 6.5-17 6.5.5.2 NPSH Available (NPSHa)

NPSHa is a function of the system desi gn and operation and is determined from the following standard equation for pumps with flooded suctions:

NPSHa = h atm + h static - hloss - h vapor where h atm = the head on the surface of the suppres sion pool due to the pressure in the wetwell atmosphere

h static = the head due to the difference in el evation between the suppression pool surface and the centerli ne of the pump suction

h loss = the head loss due to fluid friction, fitti ngs in the flow path from the suppression pool to the pump, and the ECCS suction st rainers which prevent ingestion of debris into the pumps

h vapor = the head due to the vapor pressure of the suppression pool water at the suppression pool water temperature NPSHa, without credit for COP, has been determined using specified design input parameters including suppre ssion pool temperature, su ppression pool water level, and ECCS pump flow rates

15.

6.5.5.3 Potential Plugging of Emergency Core Cooling System Suction Strainers NRC Bulletin 96-03 concerns the potential for inadequate NPSH for ECCS pumps resulting from accumulated debris on t he ECCS suction st rainers during the recirculation phase of a LOCA. As part of th e resolution of this issue, high capacity passive stacked disk strainers are install ed on the ring header. The strainer design is governed by the debris generation calculations in accordance with the Boiling Water Utility Resolution Guidance (BWR OG) (URG) (GE NEDO-32686, R0, Dated November 1, 1996) for ECCS Suction Strainer Blockage.

The primary insulation type on the drywe ll piping systems is reflective metal insulation (RMI) of both aluminum and stainl ess steel. The suction strainers provide adequate NPSH margin with a saturated thick ness of foils of either aluminum or stainless steel insulation.

The quantification of debris loading used in the strainer design is provided in GENE E12-00148-02, "Debris Load Report for Sizing of Browns Ferry ECCS Pump Suction Strainer s", July 1997. Debris captured by the strainer during a postulated LOCA will increase the pressure drop across the strainers.

BFN-27 6.5-18 6.5.5.4 NPSH Required (NPSHr)

NPSHr is a function of the pump design.

The pump vendor testing results for the BFN RHR and LPCS pumps was evaluated to determine values for NPSHr. The evaluation resulted in the generation of tables and charts that provide RHR and LPCS pump NPSHr as a function of the fl ow rate and operational period.

6.5.5.5 Analysis Methods

The containment temperature and pressure conditions are determined using the M3CPT Code for the DBA-LOCA short-term and the SHEX Code for the DBA-LOCA long-term. Design inputs that maximize the suppression pool water temperature and minimize the containment pressure are utilized for the evaluation. This approach is appropriate for determining the most cons ervative results. The MULTIFLOW computer code is used to calculate the flow losses for the piping system configuration associated with each RHR and LPCS pump for the NPSH calculations.

This code produces steady-state hydraulic flow results. Design inputs for the evaluations include decay heat, maximum pum p flow rates, minimum suppression pool water level, maximum suppression pool temperature, containment spray operation, and operation of t he drywell coolers.

For the short-term analysis, the RHR and LP CS pumps are assumed to be at their maximum flow rate for the break locati on. For the long-term analysis, the RHR and LPCS pumps are throttled. The long-term analyses assume drywell and wetwell spray operation for the duration of the LOCA.

The NPSHa is compared to the NPSHr for each of the pumps to demonstrate that adequate NPSH margin exists to ensure that the RHR and LPCS pumps perform their intended design safety functions. For the situations when the NPSHr is greater than the calculated NPSHa, credit is taken for the existing COP. This is necessary to ensure that the NPSHa is greater than the NPSHr.

6.5.5.6 Results

On Unit 1, COP calculations are based on EPU input parameters; 18 however, only 3 psig of COP is currently NRC-approved 19 for short-term and long term LOCA analyses. Currently NRC-approved COP 20 on Units 2 and 3 is based on pre-EPU conditions. On Units 2 and 3, 3 psig is approved for short-term LOCA and 1 psig is

approved for long-term LOCA as shown in Figure 6.5-44.

BFN-27 6.5-19 REFERENCES

1. Dresden 2 - Docket No. 50-237, Amendment 7, response to question 5-1.

2. Polomik, E. C., Levy, S. S., Sawochka, S. G. F ilm Boiling of Steam-Water Mixtures in Annular Flow at 800, 1100, and 1400 psi, ASME Paper No.

62-WA-136, November 30, 1962.

3. Effectiveness of Core Standby Cooli ng Systems for General Electric Boiling Water Reactors, General Electric Co., Atomic Power Equipment Division, APED-5458, March 1968.

4. Moody, F. J., "Maximum Flowrate of a Single Component Two-Phase Mixture," Journal

5. Moody, F. J., Liquid/Vapor Action in a Vessel During Blowdown, APED-5177, June 1966.

6. Zuber and Hench, Steady-State and Transient Void Fraction of Bubbling Systems and Their Operating Limits, Part I, Steady State Operation, General Electric Report 62GL 100 (1962).

7. Haberman and Morton, An Experiment al Investigation of the Drag and Shape of Air Bubbles Rising in Various Liquids, Navy Dept., David Taylor Model Basic, Report 802, (September 1963).

8. Wilson, J. F., et al., The Velocity of Rising Steam in a Bubbling Two Phase Mixture, ANS Transactions, Vo

l. 5, No. 1, pg. 151 (1962).

9. Schraub, F. A., and Bock, R. G., Fuel Rod Failures During Simulated Loss-of-Coolant Conditi ons, APED-5479, March 1968.

10. Ianni, P. W., Metal Water Reactions--Effect on Core Cooling and Containment, General Electric Co., APED-5454, March 1968.

11. MCHFR (Minimum Critical Heat Flux Ra tio) This is a fuel thermal limit parameter which was used in analyzing and operating the early core loadings in Browns Ferry. MCHFR has been replaced by a similar fuel thermal parameter called MCPR (Minimum Critical Power Ratio).

12. "Browns Ferry Nuclear Plant Units 1, 2, and 3 SAFER/GESTR-LOCA Loss-of-Coolant Accident Analysis," NEDC-32484 P, Rev. 6, General Electric Company, February 2005.

BFN-27 6.5-20 13. EMF-2361(P)(A) Revision 0, EXE M BWR-2000 ECCS Evaluation Model, Framatome ANP, May 2001, as supplemented by the site-specific approval in NRC safety evaluation dated April 27, 2012.

14. DELETED

15. Calculation MDQ099920060011, "Trans ient NPSH/Containment Pressure Evaluation of RHR and Core Spray Pumps," Revision 5.

16. DELETED

17. Calculation MDQ0999970046, "NPSH Evaluation of Browns Ferry RHR and CS Pumps," Revision 10.

18. Calculation MDQ099920060011, "Transi ent NPSH/Containment Pressure Evaluation of RHR and Core Spray Pumps," Revision 1.

19. Browns Ferry Nuclear Plant, Unit 1

- Issuance of Amendment Regarding Five Percent Uprate (TS-431), March 6, 2007.

20. Browns Ferry Nuclear Plants, Units 2 and 3, "Issuance of Amendments Regarding Crediting of Containment Overpressure for Net Positive Suction Head Calculations for Emergency Core Cooling Pumps," September 3, 1999.

21. DELETED 22. ANP-2908(P) Revision 0, Browns Ferry Units 1, 2, and 3 105% OLTP LOCA Break Spectrum Analysis, March 2010.

23. ANP-2910(P) Revision 1, Browns Ferry Units 1, 2, and 3 105% OLTP LOCA-ECCS Analysis MAPLHGR Limit for ATRIUM TM-10 Fuel, November 2010.

24. ANP-3015(P) Revision 0, Browns Ferry Units 1, 2, and 3 LOCA Break Spectrum Analysis, AR EVA NP, September 2011.

25. ANP-3016(P) Revision 0, Browns Ferry Units 1, 2, and 3 LOCA-ECCS Analysis MAPLHGR Limit for ATRIUMTM-10 Fuel, December 2011.

26. NRC Letter, "Browns Ferry Nuclear Plan, Unit 1 - Issuance of Amendments Regarding the Transition to AREVA Fuel (TAC No. ME3775) (TS-473),"

April 27, 2012.

27. NEDC-32484P Rev. 6, Supplement 2 Revision 0, Browns Ferry Nuclear Plant Unit 1 Supplementary Report Regarding ECCS-LOCA Evaluation - Additional Single Failure Evaluation at Current Licensed Thermal Power, September 2012.

BFN-27 6.5-21 28. ANP-3152(P) Revision 0, Browns Ferry Units 1, 2, and 3 LOCA Break Spectrum Analysis for ATRIUM-10XM Fuel, AREVA NP Inc., October 2012.

29. NEDO-20566A, Analytical Model for Loss-of-Coolant Analysis in Accordance with 10 CFR Appendix K, General Electric Company, September 1986.