ML18022A255

Updated Final Safety Analysis Report (Ufsar), Amendment 27, 6.5 Safety Evaluation

ML18022A255
Person / Time
Site:	Browns Ferry
Issue date:	10/05/2017
From:	Tennessee Valley Authority
To:	Office of Nuclear Reactor Regulation
Shared Package
ML18018A778	List: ML18018A780 ML18018A781 ML18018A783 ML18018A784 ML18018A785 ML18018A787 ML18018A788 ML18018A790 ML18018A792 ML18018A793 ML18018A795 ML18018A796 ML18018A797 ML18018A798 ML18018A800 ML18018A801 ML18018A802 ML18018A804 ML18018A806 ML18018A807 ML18022A114 ML18022A115 ML18022A116 ML18022A117 ML18022A118 ML18022A119 ML18022A120 ML18022A121 ML18022A123 ML18022A124 ML18022A125 ML18022A127 ML18022A128 ML18022A129 ML18022A130 ML18022A131 ML18022A132 ML18022A133 ML18022A148 ML18022A155 ML18022A156 ML18022A157 ML18022A158 ML18022A159 ML18022A161 ML18022A162 ML18022A163 ML18022A164 ML18022A165 ML18022A166 ... further results
References
Download: ML18022A255 (21)

Text

BFN-27 6.5 SAFETY EVALUATION 6.5.1 Summary In order to satisfy the safety design basis, four means for emergency core cooling are provided. They are:

High Pressure Coolant Injection (HPCI)

Automatic Depressurization System (ADS)

Low Pressure Core Spray (LPCS)

Low Pressure Coolant Injection (LPCI)

These are in addition to the feedwater, control rod drive, and RCIC Systems which also supply core coolant.

For reliability, each emergency core cooling system uses equipment with as few components required to actuate as feasible, and those are operable for test purposes during normal operation except the inboard isolation check valves can only be tested during cold shutdown. To provide diversity, two different cooling methods are provided--spraying and flooding.

Evaluation of the reliability and redundancy of the controls and instrumentation for the Emergency Core Cooling Systems (ECCS) shows that no failure of a single initiating sensor either prevents or falsely starts the initiation of these cooling systems. No single control failure prevents the combined cooling systems from providing the core with adequate cooling. The controls and instrumentation can be calibrated and tested to assure proper response to conditions representative of accident situations.

As stated in the safety objective and in safety design basis 2, the ECCS is to remove the residual and decay heat from the reactor core so that fuel clad melting is prevented and fuel clad damage is acceptably minimized. The design basis used is that nowhere in the core will the fuel cladding reach the calculated melting temperature of 3370°F.

The intent of the ECCS temperature criterion is to prevent gross core meltdown or clad damage. Since core cooling cannot be easily shown to be effective unless the geometry is defined, a no-cladding melt criterion should suffice. However, because under some conditions highly oxidized Zircaloy is known to fracture upon cooling, concern exists that the core geometry may not remain defined after cooldown.

Based on the worst case experimental data, cladding fragmentation upon cooldown can be prevented for the time scale of interest here, if the maximum cladding temperature is limited to less than 2200°F.1 Thus this is the design temperature 6.5-1

BFN-27 criterion against which ECCS performance must now be judged, i.e., the systems shall prevent cladding fragmentation upon cooldown which translates to a peak temperature of 2200°F.

It should be noted, however, that since the cladding fragmentation would not occur until after the core is cooled and flooded, it is most likely that a considerable portion of the core could be fragmented without leading to gross core melting. In addition to this margin inherent in the criterion the actual performance of the core cooling systems is such that peak temperatures lower than 2200°F result across the complete break spectrum.

All of the safety design bases for the ECCS are shown to be met by the previous descriptions, the referenced descriptions and evaluations of the individual and combined ECCS.

Peak cladding temperatures are determined in accordance with approved analytical methods.

6.5.2 Performance Analysis The manner in which the ECCS operates to protect the core is a function of the rate at which coolant is lost from the break in the nuclear system process barrier. The HPCI is designed to operate while the nuclear system is at high pressure. The LPCS and LPCI are designed for operation at low pressures.

ADS is provided to automatically reduce nuclear system pressure if a break has occurred and vessel water level is not maintained by the HPCI and the other water addition systems. Rapid depressurization of the nuclear system is desirable to permit flow from the LPCS and LPCI to enter the vessel, so that the temperature rise in the core is limited.

If for a given size break, the HPCI has the capacity to make up for all the coolant loss from the nuclear system, flow from the low pressure portion of the ECCS is available for core protection before the nuclear system pressure has decreased below the pressure at which the HPCI turbine steam stop valve shuts due to low steam supply pressure (see Subsection 7.3, "Primary Containment Isolation System").

Adequate net positive suction head (NPSH) is provided for the ECCS throughout the loss-of-coolant accident.

The ECCS response and resulting peak cladding temperatures have been evaluated. These evaluations were performed for a complete spectrum of break sizes and postulated single failures. The results of these evaluations demonstrate that adequate core cooling capability exists over the entire spectrum of break sizes 6.5-2

BFN-27 even with a concurrent loss of normal auxiliary power and postulated single failures.12 6.5.2.1 Analysis Methodology ECCS performance was analyzed using the approved SAFER/GESTR-LOCA application methodology12 for GE fuel analyses and the approved EXEM BWR-2000 methodology13 for AREVA fuel analyses. Browns Ferry specific modifications to the EXEM BWR-2000 methodology are documented in Reference 24. These modifications were approved by NRC for application to Browns Ferry Unit 1 in Reference 26. These methodologies evaluate the short-term and long-term reactor vessel blowdown response to a pipe rupture, the subsequent core reflooding by ECCS, and the final rod heatup. The reactor vessel pressure and liquid levels, ECCS performance, and other primary thermal-hydraulic phenomena are predicted as a function of time. These predictions are then used to determine the cladding temperature under various accident conditions.

The Code of Federal Regulations (10 CFR 50.46) outlines the acceptance criteria for ECCS analysis. A summary of the acceptance criteria is provided below.

Criterion 1 - Peak Cladding Temperature - The calculated maximum fuel element cladding temperature shall not exceed 2200°F.

Criterion 2 - Maximum Cladding Oxidation - The calculated total local oxidation shall not exceed 0.17 times the total cladding thickness before oxidation.

Criterion 3 - Maximum Hydrogen Generation - The calculated total amount of hydrogen generated from the chemical reaction of the cladding with water or steam shall not exceed 0.01 times the hypothetical amount that would be generated if all the metal in the cladding cylinder surrounding the fuel, excluding the cladding surrounding the plenum volume, were to react.

Criterion 4 - Coolable Geometry - Calculated changes in core geometry shall be such that the core remains amendable to cooling.

Criterion 5 - Long-Term Cooling - After any calculated successful initial operation of the ECCS, the calculated core temperature shall be maintained at an acceptably low value and decay heat shall be removed for the extended period of time required by the long-lived radioactivity remaining in the core.

6.5-3

BFN-27 The conformance with Criteria 1 through 3 is demonstrated by performing LOCA analyses and the conformance with Criterion 4 is demonstrated by conformance to Criteria 1 and 2. Compliance with Criterion 5 is addressed per Reference 29.

GE Fuel LOCA Analyses The SAFER/GESTR-LOCA application methodology used for GE fuel analyses consists of three essential parts. First, potentially limiting LOCA cases are determined by applying realistic (nominal) analytical models across the entire break spectrum. Second, limiting LOCA cases are analyzed with an Appendix K model (inputs and assumptions) which incorporates all the required features of 10 CFR 50, Appendix K. For the most limiting cases, a Licensing Basis Peak Cladding Temperature (PCT)12 is calculated based on the nominal PCT with an adder to account statistically for the differences between the nominal and Appendix K assumptions. Finally, after demonstrating the conservatism of the Licensing Basis PCT, it is ensured that the resulting Licensing Basis PCT conforms to all the requirements of 10 CFR 50.46 and Appendix K.

AREVA Fuel LOCA Analyses The evaluation model used for LOCA analyses of AREVA fuel is the EXEM BWR-2000 LOCA analysis methodology described in Reference 13. Browns Ferry specific modifications to the EXEM BWR-2000 methodology are documented in Reference 24. These modifications were approved by NRC for application to Browns Ferry Unit 1 in Reference 26. This methodology employs the following three major computer codes to evaluate the LOCA system and fuel response: RELAX, HUXY, and RODEX2. RELAX is used to calculate the system and hot channel response during the blowdown, refill and reflood phases of the LOCA. The HUXY code is used to perform heatup calculations for the entire LOCA, calculating the PCT and local clad oxidation at the axial plane of interest. RODEX2 is used to determine fuel parameters (such as stored energy) for input to the other codes. The analysis uses models, inputs and assumptions consistent with all the required features of 10 CFR 50 Appendix K to calculate the Licensing Basis PCT. Once the limiting LOCA break size, type, location, axial power shape, and ECCS single failure are established, HUXY heatup calculations versus exposure are made for the reload nuclear fuel design to determine the maximum average planar linear heat generation rate (MAPLHGR) limits, PCT, and local maximum and core average cladding oxidation fractions. The reload fuel-specific analysis results and MAPLHGR limits are documented in the Reload Licensing Analysis (Appendix N of this UFSAR).

To conform with 10 CFR 50.46 and the LOCA analysis licensing methodologies, the Licensing Basis PCT must be less than 2200°F.

To demonstrate the conformance with the ECCS acceptance criteria, the LOCA analysis is performed for the full break spectrum. Various single failures are also 6.5-4

BFN-27 investigated to identify the worst cases. Table 6.5-1 shows the plant operating conditions assumed in the analysis. Table 6.5-2 shows the ECCS equipment capacity assumed for the analysis. Table 6.5-3 identifies systems available in core cooling for given combinations of break locations and single failures. One active single failure within the plant is postulated to occur concurrent with the pipe break.

Additional details about the AREVA LOCA analysis bases, plant operating conditions, ECCS equipment performance and timing can be found in Reference 24.

A seismic event is neither postulated to occur concurrently with the LOCA nor as an initiator of the pipe break.

6.5.2.2 High Pressure Coolant Injection System The HPCI is designed to provide adequate reactor core cooling for small breaks and to depressurize the reactor primary system such that the LPCS and LPCI can be initiated. A detailed discussion of the performance of the HPCI, in conjunction with the LPCS and LPCI, is given in paragraph 6.5.3. Table 6.5-3 lists the ECCS which are available for both recirculation suction and discharge breaks following an assumed single failure.

When the HPCI begins operation, the reactor depressurizes more rapidly than would occur if HPCI was not initiated due to the condensation of steam by the cold fluid pumped into the reactor vessel by the HPCI. As the reactor vessel pressure continues to decrease, the HPCI flow momentarily reaches equilibrium with the flow through the break. Continued depressurization causes the break flow to decrease below the HPCI flow and the liquid inventory begins to rise.

This type of response is typical of the small breaks. The core never uncovers and is continuously cooled throughout the transient so that no core damage of any kind occurs for breaks that lie within the range of the HPCI.

An analysis has been made to determine if any carryover occurs in the steam supply to the HPCI turbine which could have a detrimental effect on turbine operation. In the case of a break in a liquid line, when the HPCI is energized, the level in the reactor vessel is low enough to prevent carryover in the steam which leaves the reactor vessel. In the case of a small break in the reactor steam region simultaneously with loss of normal AC power, reactor scram, recirculation pump coast-down, and loss of feedwater, analysis shows that the initial decrease of pressure in the reactor results in no significant level swell and no carryover of water into the steam supply to the HPCI turbine. HPCI cold water quenches any steam formation in the downcomer region. After the HPCI has been operating, and as the level rises in the reactor vessel, natural circulation within the vessel becomes established and any steam to the HPCI turbine passes through the steam separators and dryers eliminating any moisture carryover. It is concluded that a mechanism to cause bypassing of the steam separators, by the swelling steam 6.5-5

BFN-27 water mixture, is not available. Therefore, gross moisture carryover to the HPCI turbine should not occur over the range of steamline breaks of interest in this system.

The HPCI turbine has been designed for high reliability under its design requirements of quick starting. Moreover, the turbine has adequate capacity to accept the small losses in efficiency due to any credible moisture carryover, since HPCI turbine efficiency is not of paramount importance.

The feedwater spargers are utilized in the reactor for HPCI injection. Each sparger is mounted to the inside reactor vessel surface. The thermal sleeve is attached to the sparger midpoint; however, the sleeve is not welded to the vessel nozzle.

Therefore, the feedwater sparger is removable. The spargers are mounted in the vessel at one elevation to distribute the feedwater in a symmetric pattern about the vessel axis. Each sparger is supported by the thermal sleeve and a bracket mounted to each end of the sparger. Provision is made for the differential expansion between the stainless steel sparger and carbon steel vessel. Radial differential expansion is taken up by the slip fit of the thermal sleeve into the vessel nozzle.

Tangential differential expansion is taken up by tangential slots cut in the bracket mounted to each end of the feedwater sparger bracket. The sparger is analyzed assuming the thermal sleeve is welded into the nozzle. Additionally, pressure differentials, jet reactions, and earthquake loadings are all added; these stresses within the sparger are all within ASME Code Section III allowables for Class A Vessels.

The resultant bracket loads meet the loading criteria given in Appendix C. It is concluded that design basis 8 is satisfied.

6.5.2.3 Automatic Depressurization System When the ADS is actuated, the flow of steam through the valves provides a maximum energy removal rate while minimizing the corresponding fluid mass loss from the reactor vessel. Thus, the specific internal energy of the saturated fluid in the reactor vessel is rapidly decreased causing pressure reduction. Once the reactor vessel pressure has decreased below the shut off head of the LPCS and LPCI pumps, these low pressure ECCS will provide adequate core cooling flow.

Therefore, the ADS provides the backup for the HCPI. Table 6.5-3 lists the ECCS available for both recirculation suction and discharge breaks following an assumed single failure.

Actuation of the ADS function does not require any source of offsite power. The main steam relief valves require DC power from the unit batteries for control and air power from accumulators for operation. This satisfies safety design basis 5.

6.5-6

BFN-27 The accumulators and the nuclear system main steam relief valves are within the primary containment and this satisfies the containment isolation requirements of safety design basis 6.

6.5.2.4 Low Pressure Core Spray System The LPCS, in conjunction with other ECCS Systems, is designed to maintain continuity of reactor core cooling for a large spectrum of loss-of-coolant accidents up to and including the design basis double-ended recirculation line break. The integrated performance of the LPCS, in conjunction with other ECCS, is given in paragraph 6.5.3.

Performance analyses of the reactor LPCS are based on an analytic prediction of the reactor vessel pressure and mass inventory as a function of time following a postulated rupture of the coolant system piping.

The LPCS alone cannot protect the core below certain break sizes. This is because vessel pressure does not drop rapidly enough to allow sufficient injection before the cladding hot spot reaches excessively high temperature. Below this break size either the HPCI or the ADS extend the range of the LPCS to breaks of insignificant magnitude.

For the limiting design basis accident, a combination of the LPCS and LPCI provide sufficient cooling to meet peak clad temperature limits.12 Table 6.5-3 lists the ECCS available for both recirculation suction and discharge breaks following an assumed single failure.

Experimental tests have shown that the quantity of flow currently being provided for core spray is greatly in excess of the minimum actually required for satisfactory core cooling3. The tests showed that more than the minimum flow required is readily attained for every fuel assembly. Other tests include evaluation of the effects of updraft caused by steam flow through the core or evaporation of the water that enters the fuel assembly. The effects of updraft are minor. A series of tests were performed to obtain design data relating to distribution of core spray coolant over the top surface of the reactor core. The topical report3 contains a description of the test facility and plots of the significant results from the tests.

The core spray tests also provided experimental effective heat transfer coefficients, thus enabling correlation of the core heatup model with the actual test data. Data from tests on an exact prototype at power resulted in volume percentile temperature distributions. The close correlation between the peak temperature and general trend demonstrates the adequacy of the analytical models employed.

6.5-7

BFN-27 To assure continuity of core cooling, signals to isolate the primary or secondary containments do not operate any LPCS valves. This arrangement satisfies safety design basis 6.

The check valve is the only core spray equipment in the primary containment required to actuate during a loss-of-coolant accident which requires consideration for the high temperature and humidity environment in the containment from the accident. The selected valve actuates on flow through the pipeline, independent of any external signal. Thus, neither the normal nor accident environment in the containment affects the operability of the core spray equipment for the accident. It is concluded that safety design basis 9 is satisfied.

Taking the core spray water from the pressure suppression pool establishes a closed loop for recirculation of the spray water escaping from the break. It is concluded that safety design basis 11 is satisfied.

The core spray spargers and piping are designed as Class I (see Appendix C) so that they meet design basis 10.

6.5.2.5 Low Pressure Coolant Injection System LPCI is provided to automatically reflood the reactor core in time to limit cladding temperatures after a nuclear system LOCA when the reactor vessel pressure is below the shutoff head of the pumps. The LPCI provides cooling by flooding which differs from the LPCS which provides cooling by spraying.

For the limiting design basis accident, a combination of the LPCS and LPCI is necessary to supply sufficient cooling to meet peak clad temperature limits.12 Table 6.5-3 lists the Emergency Core Cooling Systems which are available for both recirculation suction and discharge breaks following an assumed single failure.

The maximum vessel pressure against which the LPCI pumps must deliver some flow is determined by the required overlap with HPCI which has a low pressure cutoff for the HPCI turbine. The LPCIS pumps are capable of delivering flow above the pressure due to the pump head flow characteristics.

LPCI cooling capability is analyzed using approved analytical methods based on the mass and energy flows to and from the reactor.

The LPCI control system responds as described in Section 7.4.3. When the nuclear system pressure decreases to the pumping head of LPCI, the check valve in the injection line opens and LPCI water is pumped into the reactor vessel to reflood the core.

6.5-8

BFN-27 These actions provide an integral flow path for the injection of the LPCI flow into the bottom plenum of the reactor vessel. As the LPCI flow accumulates, the level rises inside the shroud. When the level reaches the top of the jet pumps, spillover occurs for a time raising the level outside the shroud. As the subcooled LPCI flow begins spilling into the region outside the shroud, the depressurization effect of the break is reduced since the subcooled water is now flowing out the break. As the pressure begins to rise, the LPCI flow is reduced until a quasi-equilibrium pressure is reached. At this point the break is partially covered by subcooled water which has spilled over the top of the jet pumps and the equivalent area of the break available for steam blowdown is maintained at the required equilibrium value by the LPCI spillage. If pressure were to rise, the LPCI flow would be reduced, the equivalent break size for steam blowdown would increase, and pressure would drop. Complete equilibrium will be reached when the rate of saturating the LPCI water becomes equal to the boil-off rate.

It is noted that this condition will not actually be attained because of the HPCI and ADS effects on the transient. Although HPCI flow will be lost when pressure is reduced sufficiently, the auto depressurization valves would open as level continues to drop.

To assure continuity of core cooling, signals to isolate the primary or secondary containments do not operate any LPCI valves when aligned for power operation.

This arrangement satisfies safety design basis 6.

The two check valves in Units 1, 2, and 3 are the only LPCI equipment in the primary containment required to actuate during a LOCA which require consideration for the high temperature and humidity environment in the containment from the accident. The type of valve chosen actuates on flow through the pipeline, independent of any external signal.

Note:

For Units 1, 2, and 3, Unit 3, the RHR check valve actuator, controls and indication functions have been deleted.

The actuator is provided only for test. Thus, neither the normal nor accident environment in the containment affects the operability of the LPCI equipment for the accident. It is concluded that safety design basis 9 is satisfied.

Using the pressure suppression pool as the source of water for LPCI establishes a closed loop for recirculation of LPCI water escaping from the break. It is concluded that safety design basis 11 is satisfied.

The LPCI and appropriate portions of the recirculation loops are designed as Class I (see Appendix C) so that they meet design basis 10.

6.5-9

BFN-27 6.5.3 Integrated Operation of the Emergency Core Cooling Systems Sections 6.4 and 6.5.2 described the performance and operation of each of the EECS individually. Section 6.5.3 is directed toward the integrated performance of the ECCS, i.e., how the entire ECCS operates together to provide core cooling for the entire spectrum of LOCA concurrent with an assumed active single failure. The ECCS integrated performance under LOCA conditions is evaluated according to the analysis procedure described in Section 6.5.2. The primary emphasis is placed on the liquid line break since for a given break size the consequences of a break in a liquid line are more severe than for a break in a steam line. As summarized in the next paragraphs, it is demonstrated that the core cooling capability is available even concurrently with the improbable loss of all offsite AC power. In actual cases, more core cooling capability than assumed in the analysis is available since the reliability of plant AC power is extremely high.

The containment response is discussed in Section 14, "Plant Safety Analysis."

6.5.3.1 Recirculation Line Breaks Large Breaks The analyses assume a loss of normal auxiliary AC power concurrent with a line break. This satisfies safety design basis 5. The recirculation suction line is the largest liquid line inside the drywell. A double-ended break in this line would result in the most rapid depressurization and inventory loss.

For the limiting case, the reactor is assumed to be operating at 102% of 3458 MWt when the break occurs. The feedwater pumps are assumed to coast down in five seconds (for GE LOCA analyses; less for AREVA LOCA analyses) to minimize credit for feedwater to maintain reactor inventory. The analyses assume the reactor water level is at the normal level when the break occurs.

Immediately after the break, critical flow would be established at the break. The large increase in core void fraction that would be caused by the decreasing vessel pressure would be sufficient to render the core subcritical. High drywell pressure would initiate mechanical scram of the control rod system in less than one second.

A reactor vessel low-low-low water level signal initiates closure of the main steam isolation valves very rapidly.

A double-ended break in the recirculation line will result in rapid depressurization of the reactor vessel and loss of reactor coolant inventory. Either the low-low-low water level sensor in the reactor vessel or high drywell pressure sensor plus low reactor vessel pressure would generate a signal to initiate the ECCS (i.e., LPCS and LPCI mode of the RHR System).

6.5-10

BFN-27 Intermediate or Small Breaks For break sizes below the lower limit of the unassisted LPCS or LPCI, the HPCI or ADS acts to depressurize the nuclear boiler, allowing either the LPCS or the LPCI to provide core cooling. The intermediate break range here is defined between the limits of the unassisted HPCI and the unassisted LPCS or LPCI, in which one of the high pressure systems (HPCI or ADS) works in conjunction with one of the low pressure systems (LPCS or LPCI) to provide core cooling. The integrated performance of the ADS, in conjunction with the LPCS or LPCS for the intermediate break sizes, is very similar to the performance of these same combinations for the small break sizes, except depressurization is more rapidly accomplished with increasing break size. For this reason, the integrated performance of these system combinations is discussed below for small breaks.

For small breaks, the core is protected by the HPCI and by the LPCS or LPCI in conjunction with the ADS. The performance of the HPCI for these small break sizes is described in paragraph 6.5.2.2.

Generally, the ADS/LPCS or ADS/LPCI combinations will not prevent partial core uncovery as the HPCI does. However, the ADS is designed to allow the LPCS or LPCI to prevent excessive cladding temperatures for all break sizes down to and including a zero break size.

The sequence of events during the initial phase of the small break transient is similar to that discussed earlier for the HPCI System performance. The important difference in the system response for the ADS case is that the vessel pressure hovers near rated for a much longer period of time since the HPCI is assumed to be inoperable and the ADS is not actuated until 120 seconds after the low-low-low trip level is reached (and confirmation of ECCS system operation). An additional obvious difference is the more rapid loss of liquid inventory due to the higher vessel pressure and absence of HPCI makeup. When the ADS is actuated, a marked increase in the vessel pressure reduction rate occurs due to the critical steam flow through the main steam relief valves. This increased depressurization rate causes a corresponding increase in water levels inside and outside the shroud. When the water level inside the shroud drops to the top of the jet pumps, the water level is sustained except for flashing due to depressurization and boil-off. The level outside the shroud continues to drop rapidly until the LPCS or LPCI have restored the water level inside the shroud to the top of the jet pumps. At this level, the water from inside the shroud begins spilling over into the region outside the shroud, thereby raising the water level outside the shroud.

The performance cases illustrated above are typical for the ADS/LPCS or ADS/LPCI combinations in the small break region. As much larger breaks are considered, the 6.5-11

BFN-27 performance of these system combinations becomes the same as the LPCS or LPCI alone discussed in paragraphs 6.5.2.4 and 6.5.2.5, respectively.

Many different cases of recirculation line breaks in combination with various single failures were analyzed using nominal, Appendix K, and licensing basis assumptions 12, 24. GE fuel analyses have been performed for both EPU and 105%

OLTP conditions (References 12, 26). AREVA fuel analyses have been performed for 105% OLTP conditions (References 22-25).

The GE14 LOCA break spectrum analyses for EPU and 105% OLTP conditions are provided in Reference 12. For 105% OLTP, the results show that a DBA recirculation suction line break with a battery failure produces the highest PCT. For EPU, the highest PCT is produced by a small (0.06 ft2) recirculation discharge line break with battery failure.

The AREVA LOCA break spectrum analysis for ATRIUM-10 fuel at 105% OLTP conditions is provided in Reference 24. The limiting break is determined to be a 0.21 ft2 split break in the recirculation discharge line with top-peaked axial power shape and a battery failure affecting HPCI and LPCI.

The AREVA LOCA break spectrum analysis for ATRIUM-10XM fuel at 105% OLTP conditions is provided in Reference 28. The limiting break is determined to be a 0.20 ft2 split break in the recirculation discharge line with top-peaked axial power shape and battery failure affecting HPCI and LPCI.

For the limiting fuel type, using the Appendix K assumptions for the maximum recirculation suction line break coincident with battery failure results in a PCT well below the 2200 °F limit. The licensing basis PCT is determined by summing the nominal PCT with an adder that is based on the nominal and Appendix K results.

The analyses demonstrate the licensing basis PCT is well below the 2200 °F limit12.

This satisfies safety design bases 1, 2, and 3. The cycle specific values are provided in Appendix N. It is also demonstrated12 that the maximum cladding oxidation and maximum hydrogen generation for all cases are well below the ECCS acceptance criteria discussed in paragraph 6.5.2.1. (Note: the preceding paragraph is specific to the Reference 12 GE SAFER/GESTR-LOCA analyses. Although the AREVA LOCA analysis bases and methodology are different, the conclusions relative to the ECCS licensing limits are essentially the same.)

Typical operational sequences of the Emergency Core Cooling Systems are shown in Table 6.5-4 (for a recirculation discharge line break).28 6.5.3.2 Non-Recirculation Line Breaks Non-recirculation line breaks were analyzed for the limiting fuel type.12 The non-recirculation breaks include: core spray line break, feedwater line break, and 6.5-12

BFN-27 steamline breaks inside and outside the containment. The results show that these postulated non-recirculation line breaks are significantly less limiting than the postulated recirculation line breaks.

Discussion and illustration of the ECCS performance capability has purposely been directed toward the liquid breaks below the core. In general, the ECCS design criterion of limiting cladding temperature to less than 2200°F is more easily satisfied for steam breaks than for liquid breaks because the reactor primary system depressurizes more rapidly with less mass loss for steam breaks than for liquid breaks. Thus the ECCS performance for a given break size improves with increasing break flow quality.

The most severe steam pipe break would be one which occurs inside the drywell, upstream of the flow limiters. A break in this location would permit the pressure vessel to continue to depressurize to the drywell. As serious as this accident could be, it does not result in thermal-hydraulic consequences as severe as the rupture of a coolant recirculation pipe.

The accident sequence would proceed as follows:

a. An instantaneous guillotine severance of the steam pipe upstream of the steam flow restrictors would permit flow to accelerate to its limiting critical flow value in the break at the pressure vessel end, and at the flow-limiter end.

b. The steam loss in excess of the generation rate would result in rapid depressurization of the pressure vessel and the steam pipes.

c. The first 10 seconds of this accident are similar to the break outside the drywell discussed in Section 14, "Plant Safety Analysis."

However, for the break inside the drywell, closure of the isolation valves reduces the blowdown rate but does not prevent the vessel from depressurizing; the vessel would continue depressurizing through the pipe from the pressure vessel to the break.

The reactor would be shut down immediately during a steamline break by the voids which would result from the depressurization. A mechanical scram would be initiated by a position switch in each isolation valve. Low water level and high drywell pressure which would occur later in the blowdown, would also initiate a scram.

The reactor coolant loss through blowdown consists of three intervals: first steam blowdown, then mixture blowdown, and finally steam blowdown again. After the accident, steam in each end of the break is accelerated to critical flow.

6.5-13

BFN-27 As the reactor vessel depressurizes, the water level rises due to flashing. When the level reaches the steam pipes, the break flow changes from a steam blowdown to a steam-water mixture blowdown. Closure of the isolation valves reduces the blowdown rate. As coolant is expelled and the pressure decreases, the water level in the pressure vessel will drop below the steam pipe elevation and steam blowdown will begin again. The system depressurization rate would increase, but the mass flow rate through the break would decrease.

6.5.3.3 Effect of Fuel Cladding Failure on Core Cooling The ECCS is designed to prevent clad melting and fragmentation upon cooldown for any loss of coolant within the design basis spectrum. The purpose is to keep the cladding and fuel from distortion to a degree that subsequent cooling is ineffective.

Satisfying these criteria does allow for the tolerance of cladding perforation. Even though the cooling equipment is successful in keeping cladding temperature well below the criterion for the design maximum temperature (2200°F), a small percentage of the fuel may perforate. However, the occurrence of even a large number of perforations does not prevent core cooling from being successful.

Cladding perforation occurs when the gas pressure within the rod exceeds the pressure the cladding can withstand for that particular cladding temperature. The mode of this failure is known. The perforation is local, in that a given fuel rod perforates at a particular location the extent of which is on the order of an inch in axial length. The perforation is random in that it may occur and will be localized at a weak point along the fuel rod length-probably at a point of cladding flaw, pellet oversize, pellet chip, or point of slightly increased cladding oxidation. The locations of such weak points are randomly distributed among the fuel rods within the fuel assembly.

The conclusion that perforation is random and local is based upon confirmed observations of irradiated fuel.9 Such random failures have also been demonstrated in test loops by placing Zircaloy tubing, filled with UO2 pellets and pressurized with gas, in an induction heating facility and observing the failure mode. The observed failures were always localized and random along the length of the heated rod. Only a slight change in diameter was observed to occur, except within an inch or two on either side of the perforation. This is characteristic of burst failure at high temperatures in general. From these tests, the major conclusions are that perforations are indeed local and that the fuel rods do not distort grossly over the length of the fuel rod.

A separate study10 has been made of metal-water reactions during a loss-of-coolant accident and the report of the study shows how ECCS design is influenced by metal water reaction. In addition, this study covers the effects of hydrogen generation during a loss-of-coolant accident.

6.5-14

BFN-27 The temperatures resulting from the postulated accident are determined using conservative models and conservative assumptions. Since steamline breaks are not as severe as liquid line breaks, it is concluded that safety design bases 2 and 3 are satisfied.

6.5.3.4 Alternate Operating Mode Considerations The impact of alternate operating modes on LOCA results is evaluated by analyzing the limiting LOCA case at such operating conditions as: Increased Core Flow (ICF),

Maximum Extended Load Line Limit (MELLL), and Final Feedwater Temperature Reduction (FFWTR).12 For ICF and FFWTR, the impact on LOCA results is negligible. For the GE Reference 12 analysis, the Appendix K PCT at MELLL core flow conditions is small relative to the PCT margin available at the rated core flow conditions, with respect to the 2200°F limit.

6.5.4 Emergency Core Cooling Systems Redundancy The design criterion of preventing peak cladding temperatures greater than 2200°F is satisfied across the entire spectrum of possible liquid or steamline break sizes even in the event of the loss of normal auxiliary power combined with a single failure. It is concluded that the redundant capability of the ECCS is sufficient for all size line breaks up to and including the design basis break.

It is assumed that one of the postulated single failures is a spurious accident signal initiated from a non-accident unit. This opposite unit false LOCA signal is assumed to occur either coincident with the valid LOCA signal prior to the valid LOCA signal or after the valid LOCA signal. There is sufficient redundancy in the ECCS initiation and preferred pump logic that the ECCS will be able to satisfy the design criteria for any postulated combinations of spurious and real accident signals.

The individual functions of the ECCS also meet the design criteria over various ranges of break sizes in the nuclear system. Their integrated performance provides adequate and timely core cooling over the entire spectrum of LOCAs up to and including the design basis LOCA even with concurrent loss of offsite AC power. It is concluded that safety design basis 1 is satisfied.

6.5.5 Net Positive Suction Head (NPSH) 6.5.5.1 Description An important design attribute for the operation of the ECCS pumps is the assurance of adequate NPSH. NPSH is a function of individual pump flow, total ECCS flow, friction loss, ECCS strainer blockage, suppression pool water level, suppression pool temperature, and wetwell pressure. NPSH can be challenged for the ECCS pumps during events involving large increases in suppression pool temperature, 6.5-15

BFN-27 which includes LOCA, Anticipated Transient Without Scram (FSAR Section 7.19),

Station Blackout (FSAR Section 8.10), and fire events.

The HPCI is designed to provide reactor inventory makeup water and assist in depressurizing the reactor during an intermediate or small break LOCA. During the first 10 minutes after initiation of the accident, the suppression pool temperature remains below 140ºF. If the HPCI pump operates beyond the first 10 minutes following the event and the HPCI pump suction is aligned to the suppression pool, then manual operation would terminate HPCI pump operation when the suppression pool temperature reaches approximately 140°F due to system operating restrictions, which is below pool temperatures where NPSH margin would be of concern. This approach ensures that the HPCI pump NPSH remains adequate for operation following a postulated accident.

The determination of the available NPSH (NPSHa) to the RHR and LPCS pumps as a function of time after a postulated DBA-LOCA short-term and DBA-LOCA long-term has been accomplished in accordance with the guidelines in Regulatory Guide (RG) 1.82, Revision 3, Water Sources for Long-term Recirculation Cooling Following a Loss-of-Coolant Accident. Any amount of containment pressure required in excess of atmospheric pressure to maintain adequate ECCS pump NPSH is referred to as Containment Overpressure (COP). Credit for COP in NPSH calculations is dependent on containment integrity and is limited to NRC-approved values.

6.5-16

BFN-27 6.5.5.2 NPSH Available (NPSHa)

NPSHa is a function of the system design and operation and is determined from the following standard equation for pumps with flooded suctions:

NPSHa = hatm + hstatic - hloss - h vapor where hatm = the head on the surface of the suppression pool due to the pressure in the wetwell atmosphere hstatic = the head due to the difference in elevation between the suppression pool surface and the centerline of the pump suction hloss = the head loss due to fluid friction, fittings in the flow path from the suppression pool to the pump, and the ECCS suction strainers which prevent ingestion of debris into the pumps hvapor = the head due to the vapor pressure of the suppression pool water at the suppression pool water temperature NPSHa, without credit for COP, has been determined using specified design input parameters including suppression pool temperature, suppression pool water level, and ECCS pump flow rates15.

6.5.5.3 Potential Plugging of Emergency Core Cooling System Suction Strainers NRC Bulletin 96-03 concerns the potential for inadequate NPSH for ECCS pumps resulting from accumulated debris on the ECCS suction strainers during the recirculation phase of a LOCA. As part of the resolution of this issue, high capacity passive stacked disk strainers are installed on the ring header. The strainer design is governed by the debris generation calculations in accordance with the Boiling Water Utility Resolution Guidance (BWROG) (URG) (GE NEDO-32686, R0, Dated November 1, 1996) for ECCS Suction Strainer Blockage.

The primary insulation type on the drywell piping systems is reflective metal insulation (RMI) of both aluminum and stainless steel. The suction strainers provide adequate NPSH margin with a saturated thickness of foils of either aluminum or stainless steel insulation. The quantification of debris loading used in the strainer design is provided in GENE E12-00148-02, Debris Load Report for Sizing of Browns Ferry ECCS Pump Suction Strainers, July 1997. Debris captured by the strainer during a postulated LOCA will increase the pressure drop across the strainers.

6.5-17

BFN-27 6.5.5.4 NPSH Required (NPSHr)

NPSHr is a function of the pump design. The pump vendor testing results for the BFN RHR and LPCS pumps was evaluated to determine values for NPSHr. The evaluation resulted in the generation of tables and charts that provide RHR and LPCS pump NPSHr as a function of the flow rate and operational period.

6.5.5.5 Analysis Methods The containment temperature and pressure conditions are determined using the M3CPT Code for the DBA-LOCA short-term and the SHEX Code for the DBA-LOCA long-term. Design inputs that maximize the suppression pool water temperature and minimize the containment pressure are utilized for the evaluation. This approach is appropriate for determining the most conservative results. The MULTIFLOW computer code is used to calculate the flow losses for the piping system configuration associated with each RHR and LPCS pump for the NPSH calculations.

This code produces steady-state hydraulic flow results. Design inputs for the evaluations include decay heat, maximum pump flow rates, minimum suppression pool water level, maximum suppression pool temperature, containment spray operation, and operation of the drywell coolers.

For the short-term analysis, the RHR and LPCS pumps are assumed to be at their maximum flow rate for the break location. For the long-term analysis, the RHR and LPCS pumps are throttled. The long-term analyses assume drywell and wetwell spray operation for the duration of the LOCA.

The NPSHa is compared to the NPSHr for each of the pumps to demonstrate that adequate NPSH margin exists to ensure that the RHR and LPCS pumps perform their intended design safety functions. For the situations when the NPSHr is greater than the calculated NPSHa, credit is taken for the existing COP. This is necessary to ensure that the NPSHa is greater than the NPSHr.

6.5.5.6 Results On Unit 1, COP calculations are based on EPU input parameters;18 however, only 3 psig of COP is currently NRC-approved19 for short-term and long term LOCA analyses. Currently NRC-approved COP20 on Units 2 and 3 is based on pre-EPU conditions. On Units 2 and 3, 3 psig is approved for short-term LOCA and 1 psig is approved for long-term LOCA as shown in Figure 6.5-44.

6.5-18

BFN-27 REFERENCES

1. Dresden 2 - Docket No. 50-237, Amendment 7, response to question 5-1.

2. Polomik, E. C., Levy, S. S., Sawochka, S. G. Film Boiling of Steam-Water Mixtures in Annular Flow at 800, 1100, and 1400 psi, ASME Paper No.

62-WA-136, November 30, 1962.

3. Effectiveness of Core Standby Cooling Systems for General Electric Boiling Water Reactors, General Electric Co., Atomic Power Equipment Division, APED-5458, March 1968.

4. Moody, F. J., "Maximum Flowrate of a Single Component Two-Phase Mixture,"

Journal

5. Moody, F. J., Liquid/Vapor Action in a Vessel During Blowdown, APED-5177, June 1966.

6. Zuber and Hench, Steady-State and Transient Void Fraction of Bubbling Systems and Their Operating Limits, Part I, Steady State Operation, General Electric Report 62GL 100 (1962).

7. Haberman and Morton, An Experimental Investigation of the Drag and Shape of Air Bubbles Rising in Various Liquids, Navy Dept., David Taylor Model Basic, Report 802, (September 1963).

8. Wilson, J. F., et al., The Velocity of Rising Steam in a Bubbling Two Phase Mixture, ANS Transactions, Vol. 5, No. 1, pg. 151 (1962).

9. Schraub, F. A., and Bock, R. G., Fuel Rod Failures During Simulated Loss-of-Coolant Conditions, APED-5479, March 1968.

10. Ianni, P. W., Metal Water Reactions--Effect on Core Cooling and Containment, General Electric Co., APED-5454, March 1968.

11. MCHFR (Minimum Critical Heat Flux Ratio) This is a fuel thermal limit parameter which was used in analyzing and operating the early core loadings in Browns Ferry. MCHFR has been replaced by a similar fuel thermal parameter called MCPR (Minimum Critical Power Ratio).

12. "Browns Ferry Nuclear Plant Units 1, 2, and 3 SAFER/GESTR-LOCA Loss-of-Coolant Accident Analysis," NEDC-32484P, Rev. 6, General Electric Company, February 2005.

6.5-19

BFN-27

13. EMF-2361(P)(A) Revision 0, EXEM BWR-2000 ECCS Evaluation Model, Framatome ANP, May 2001, as supplemented by the site-specific approval in NRC safety evaluation dated April 27, 2012.

14. DELETED

15. Calculation MDQ099920060011, Transient NPSH/Containment Pressure Evaluation of RHR and Core Spray Pumps, Revision 5.

16. DELETED

17. Calculation MDQ0999970046, NPSH Evaluation of Browns Ferry RHR and CS Pumps, Revision 10.

18. Calculation MDQ099920060011, Transient NPSH/Containment Pressure Evaluation of RHR and Core Spray Pumps, Revision 1.

19. Browns Ferry Nuclear Plant, Unit 1 - Issuance of Amendment Regarding Five Percent Uprate (TS-431), March 6, 2007.

20. Browns Ferry Nuclear Plants, Units 2 and 3, Issuance of Amendments Regarding Crediting of Containment Overpressure for Net Positive Suction Head Calculations for Emergency Core Cooling Pumps, September 3, 1999.

21. DELETED

22. ANP-2908(P) Revision 0, Browns Ferry Units 1, 2, and 3 105% OLTP LOCA Break Spectrum Analysis, March 2010.

23. ANP-2910(P) Revision 1, Browns Ferry Units 1, 2, and 3 105% OLTP LOCA-ECCS Analysis MAPLHGR Limit for ATRIUMTM-10 Fuel, November 2010.

24. ANP-3015(P) Revision 0, Browns Ferry Units 1, 2, and 3 LOCA Break Spectrum Analysis, AREVA NP, September 2011.

25. ANP-3016(P) Revision 0, Browns Ferry Units 1, 2, and 3 LOCA-ECCS Analysis MAPLHGR Limit for ATRIUMTM-10 Fuel, December 2011.

26. NRC Letter, Browns Ferry Nuclear Plan, Unit 1 - Issuance of Amendments Regarding the Transition to AREVA Fuel (TAC No. ME3775) (TS-473),

April 27, 2012.

27. NEDC-32484P Rev. 6, Supplement 2 Revision 0, Browns Ferry Nuclear Plant Unit 1 Supplementary Report Regarding ECCS-LOCA Evaluation - Additional Single Failure Evaluation at Current Licensed Thermal Power, September 2012.

6.5-20

BFN-27

28. ANP-3152(P) Revision 0, Browns Ferry Units 1, 2, and 3 LOCA Break Spectrum Analysis for ATRIUM-10XM Fuel, AREVA NP Inc., October 2012.

29. NEDO-20566A, Analytical Model for Loss-of-Coolant Analysis in Accordance with 10 CFR Appendix K, General Electric Company, September 1986.

6.5-21