ML19037A163

LIM Chapter 15 Redacted

ML19037A163
Person / Time
Site:	Limerick
Issue date:	09/19/2018
From:	Office of Nuclear Reactor Regulation
To:
Sreenivas V, 415-2597
Shared Package
ML19037A144	List: ML19037A163 ML19037A164
References
EPID L-2018-LRO-0038
Download: ML19037A163 (453)

Text

LGS UFSAR CHAPTER 15 - ACCIDENT ANALYSES TABLE OF CONTENTS 15.0 GENERAL 15.0.1 Analytical Objective 15.0.2 Analytical Categories 15.0.3 Transient or Accident Evaluation 15.0.3.1 Identification of Causes and Frequency Classification 15.0.3.1.1 Unacceptable Results for Incidents of Moderate Frequency - Anticipated (Expected) Operational Transients 15.0.3.1.2 Unacceptable Results for Infrequent Incidents - Abnormal (Unexpected)

Operational Transients 15.0.3.1.3 Unacceptable Results for Limiting Faults - Design Basis (Postulated) Accidents 15.0.3.2 Sequence of Events and System Operation 15.0.3.2.1 Single Active Failures or Single Operator Errors 15.0.3.2.2 Analyzed Transients and Nonsafety-Grade Systems or Components 15.0.3.3 Core and System Performance 15.0.3.3.1 Introduction 15.0.3.3.2 Input Parameters and Initial Conditions for Analyzed Events 15.0.3.3.3 Initial Power/Flow Operating Constraints 15.0.3.3.4 Results 15.0.3.4 Barrier Performance 15.0.3.5 Radiological Consequences 15.0.4 Regulatory Guide Conformance 15.0.5 Nuclear Safety Operational Analysis Relationship 15.0.6 Licensing Basis Vs. Emergency Procedure Guidelines 15.0.7 References 15.1 DECREASE IN REACTOR COOLANT TEMPERATURE 15.1.1 Loss of Feedwater Heating 15.1.1.1 Identification of Causes and Frequency Classification 15.1.1.1.1 Identification of Causes 15.1.1.1.2 Frequency Classification 15.1.1.2 Sequence of Events and System Operation 15.1.1.2.1 Sequence of Events 15.1.1.2.2 System Operation 15.1.1.2.3 The Effect of Single Failures and Operator Errors 15.1.1.3 Core and System Performance 15.1.1.3.1 Mathematical Model 15.1.1.3.2 Input Parameters and Initial Conditions 15.1.1.3.3 Results 15.1.1.3.4 Considerations of Uncertainties 15.1.1.4 Barrier Performance 15.1.1.5 Radiological Consequences 15.1.2 Feedwater Controller Failure - Maximum Demand 15.1.2.1 Identification of Causes and Frequency Classification 15.1.2.1.1 Identification of Causes 15.1.2.1.2 Frequency Classification CHAPTER 15 15-i REV. 17, SEPTEMBER 2014

LGS UFSAR TABLE OF CONTENTS (cont'd) 15.1.2.2 Sequence of Events and System Operation 15.1.2.2.1 Sequence of Events 15.1.2.2.2 System Operation 15.1.2.2.3 The Effect of Single Failures and Operator Errors 15.1.2.3 Core and System Performance 15.1.2.3.1 Mathematical Model 15.1.2.3.2 Input Parameters and Initial Conditions 15.1.2.3.3 Results 15.1.2.3.4 Consideration of Uncertainties 15.1.2.4 Barrier Performance 15.1.2.5 Radiological Consequences 15.1.2.6 Additional Transients Evaluated 15.1.3 Pressure Regulator Failure - Open 15.1.3.1 Identification of Causes and Frequency Classification 15.1.3.1.1 Identification of Causes 15.1.3.1.2 Frequency Classification 15.1.3.2 Sequence of Events and System Operation 15.1.3.2.1 Sequence of Events 15.1.3.2.2 System Operation 15.1.3.2.3 The Effect of Single Failures and Operator Errors 15.1.3.3 Core and System Performance 15.1.3.3.1 Mathematical Model 15.1.3.3.2 Input Parameters and Initial Conditions 15.1.3.3.3 Results 15.1.3.3.4 Consideration of Uncertainties 15.1.3.4 Barrier Performance 15.1.3.5 Radiological Consequences 15.1.4 Inadvertent Main Steam Relief Valve Opening 15.1.4.1 Identification of Causes and Frequency Classification 15.1.4.1.1 Identification of Causes 15.1.4.1.2 Frequency Classification 15.1.4.2 Sequence of Events and System Operation 15.1.4.2.1 Sequence of Events 15.1.4.2.2 System Operation 15.1.4.2.3 The Effect of Single Failures and Operator Errors 15.1.4.3 Core and System Performance 15.1.4.3.1 Mathematical Model 15.1.4.3.2 Input Parameters and Initial Conditions 15.1.4.3.3 Qualitative Results 15.1.4.4 Barrier Performance 15.1.4.5 Radiological Consequences 15.1.5 Spectrum of Steam System Piping Failures Inside and Outside of Containment in a PWR 15.1.6 Inadvertent RHR Shutdown Cooling Operation CHAPTER 15 15-ii REV. 17, SEPTEMBER 2014

LGS UFSAR TABLE OF CONTENTS (cont'd) 15.1.6.1 Identification of Causes and Frequency Classification 15.1.6.1.1 Identification of Causes 15.1.6.1.2 Frequency Classification 15.1.6.2 Sequence of Events and System Operation 15.1.6.2.1 Sequence of Events 15.1.6.2.2 System Operation 15.1.6.2.3 The Effect of Single Failures and Operator Errors 15.1.6.3 Core and System Performance 15.1.6.4 Barrier Performance 15.1.6.5 Radiological Consequences 15.1.7 References 15.2 INCREASE IN REACTOR PRESSURE 15.2.1 Pressure Regulator Failure - Closed 15.2.1.1 Identification of Causes and Frequency Classification 15.2.1.1.1 Identification of Causes 15.2.1.1.2 Frequency Classification 15.2.1.2 Sequence of Events and System Operation 15.2.1.2.1 Sequence of Events 15.2.1.2.2 Systems Operation 15.2.1.2.3 The Effect of Single Failures and Operator Errors 15.2.1.3 Core and System Performance 15.2.1.3.1 Mathematical Model 15.2.1.3.2 Input Parameters and Initial Conditions 15.2.1.3.3 Results 15.2.1.3.4 Consideration of Uncertainties 15.2.1.4 Barrier Performance 15.2.1.5 Radiological Consequences 15.2.2 Generator Load Rejection 15.2.2.1 Identification of Causes and Frequency Classification 15.2.2.1.1 Identification of Causes 15.2.2.1.2 Frequency Classification 15.2.2.2 Sequence of Events and System Operation 15.2.2.2.1 Sequence of Events 15.2.2.2.2 System Operation 15.2.2.2.3 The Effect of Single Failures and Operator Errors 15.2.2.3 Core and System Performance 15.2.2.3.1 Mathematical Model 15.2.2.3.2 Input Parameters and Initial Conditions 15.2.2.3.3 Results 15.2.2.3.4 Consideration of Uncertainties 15.2.2.4 Barrier Performance 15.2.2.4.1 Generator Load Rejection 15.2.2.4.2 Generator Load Rejection with Failure of Bypass 15.2.2.5 Radiological Consequences CHAPTER 15 15-iii REV. 17, SEPTEMBER 2014

LGS UFSAR TABLE OF CONTENTS (cont'd) 15.2.3 Turbine Trip 15.2.3.1 Identification of Causes and Frequency Classification 15.2.3.1.1 Identification of Causes 15.2.3.1.2 Frequency Classification 15.2.3.2 Sequence of Events and System Operation 15.2.3.2.1 Sequence of Events 15.2.3.2.2 System Operation 15.2.3.2.3 The Effect of Single Failures and Operator Errors 15.2.3.3 Core and System Performance 15.2.3.3.1 Mathematical Model 15.2.3.3.2 Input Parameters and Initial Conditions 15.2.3.3.3 Results 15.2.3.3.4 Consideration of Uncertainties 15.2.3.4 Barrier Performance 15.2.3.4.1 Turbine Trip 15.2.3.4.2 Turbine Trip with Failure of the Bypass 15.2.3.5 Radiological Consequences 15.2.4 MSIV Closures 15.2.4.1 Identification of Causes and Frequency Classification 15.2.4.1.1 Identification of Causes 15.2.4.1.2 Frequency Classification 15.2.4.2 Sequence of Events and System Operation 15.2.4.2.1 Sequence of Events 15.2.4.2.2 System Operation 15.2.4.2.3 The Effect of Single Failures and Operator Errors 15.2.4.3 Core and System Performance 15.2.4.3.1 Mathematical Model 15.2.4.3.2 Input Parameters and Initial Conditions 15.2.4.3.3 Results 15.2.4.3.4 Consideration of Uncertainties 15.2.4.4 Barrier Performance 15.2.4.4.1 Closure of All Main Steam Isolation Valves 15.2.4.4.2 Closure of One Main Steam Isolation Valve 15.2.4.5 Radiological Consequences 15.2.5 Loss of Condenser Vacuum 15.2.5.1 Identification of Causes and Frequency Classification 15.2.5.1.1 Identification of Causes 15.2.5.1.2 Frequency Classification 15.2.5.2 Sequence of Events and System Operation 15.2.5.2.1 Sequence of Events 15.2.5.2.2 System Operation 15.2.5.2.3 The Effect of Single Failures and Operator Errors 15.2.5.3 Core and System Performance 15.2.5.3.1 Mathematical Model 15.2.5.3.2 Input Parameters and Initial Conditions CHAPTER 15 15-iv REV. 17, SEPTEMBER 2014

LGS UFSAR TABLE OF CONTENTS (cont'd) 15.2.5.3.3 Results 15.2.5.3.4 Consideration of Uncertainties 15.2.5.4 Barrier Performance 15.2.5.5 Radiological Consequences 15.2.6 Loss of AC Power 15.2.6.1 Identification of Causes and Frequency Classification 15.2.6.1.1 Identification of Causes 15.2.6.1.2 Frequency Classification 15.2.6.2 Sequence of Events and System Operation 15.2.6.2.1 Sequence of Events 15.2.6.2.2 System Operation 15.2.6.2.3 The Effect of Single Failures and Operator Errors 15.2.6.3 Core and System Performance 15.2.6.3.1 Mathematical Model 15.2.6.3.2 Input Parameters and Initial Conditions 15.2.6.3.3 Results 15.2.6.3.4 Consideration of Uncertainties 15.2.6.4 Barrier Performance 15.2.6.4.1 Loss of All Grid Connections 15.2.6.5 Radiological Consequences 15.2.7 Loss of Feedwater Flow 15.2.7.1 Identification of Causes and Frequency Classification 15.2.7.1.1 Identification of Causes 15.2.7.1.2 Frequency Classification 15.2.7.2 Sequence of Events and System Operation 15.2.7.2.1 Sequence of Events 15.2.7.2.2 System Operation 15.2.7.2.3 The Effect of Single Failures and Operator Errors 15.2.7.3 Core and System Performance 15.2.7.3.1 Mathematical Model 15.2.7.3.2 Input Parameters and Initial Conditions 15.2.7.3.3 Results 15.2.7.3.4 Consideration of Uncertainties 15.2.7.4 Barrier Performance 15.2.7.5 Radiological Consequences 15.2.8 Feedwater Line Break 15.2.9 Failure of RHR Shutdown Cooling 15.2.9.1 Identification of Causes and Frequency Classification 15.2.9.1.1 Identification of Causes 15.2.9.1.2 Frequency Classification 15.2.9.2 Sequence of Events and System Operation 15.2.9.2.1 Sequence of Events 15.2.9.2.2 System Operation 15.2.9.2.3 The Effect of Single Failures and Operator Errors CHAPTER 15 15-v REV. 17, SEPTEMBER 2014

LGS UFSAR TABLE OF CONTENTS (cont'd) 15.2.9.3 Core and System Performance 15.2.9.3.1 Methods, Assumptions, and Conditions 15.2.9.3.2 Mathematical Model 15.2.9.3.3 Input Parameters and Initial Conditions 15.2.9.3.4 Results 15.2.9.4 Barrier Performance 15.2.9.5 Radiological Consequences 15.2.10 Loss of Stator Cooling 15.2.10.1 Identification of Causes and Frequency Classification 15.2.10.1.1 Identification of Causes 15.2.10.1.2 Frequency Classification 15.2.10.2 Sequence of Events and System Operation 15.2.10.2.1 Sequence of Events 15.2.10.2.2 System Operation 15.2.10.2.3 The Effect of Single Failures and Operator Errors 15.2.10.3 Core and System Performance 15.2.10.3.1 Mathematical Model 15.2.10.3.2 Input Parameters and Initial Conditions 15.2.10.3.3 Results 15.2.10.3.4 Consideration of Uncertainties 15.2.10.4 Barrier Performance 15.2.10.5 Radiological Consequences 15.2.11 References 15.3 DECREASE IN REACTOR COOLANT SYSTEM FLOW RATE 15.3.1 Recirculation Pump Trip 15.3.1.1 Identification of Causes and Frequency Classification 15.3.1.1.1 Identification of Causes 15.3.1.1.2 Frequency Classification 15.3.1.2 Sequence of Events and System Operation 15.3.1.2.1 Sequence of Events 15.3.1.2.2 System Operation 15.3.1.2.3 The Effect of Single Failures and Operator Errors 15.3.1.3 Core and System Performance 15.3.1.3.1 Mathematical Model 15.3.1.3.2 Input Parameters and Initial Conditions 15.3.1.3.3 Results 15.3.1.3.4 Consideration of Uncertainties 15.3.1.4 Barrier Performance 15.3.1.4.1 Trip of One Recirculation Pump 15.3.1.4.2 Trip of Two Recirculation Pumps 15.3.1.5 Radiological Consequences 15.3.2 Recirculation Flow Control Failure - Decreasing Flow 15.3.2.1 Identification of Causes and Frequency Classification CHAPTER 15 15-vi REV. 17, SEPTEMBER 2014

LGS UFSAR TABLE OF CONTENTS (cont'd) 15.3.2.1.1 Identification of Causes 15.3.2.1.2 Frequency Classification 15.3.2.2 Sequence of Events and System Operation 15.3.2.2.1 Sequence of Events 15.3.2.2.2 System Operation 15.3.2.2.3 The Effect of Single Failures and Operator Errors 15.3.2.3 Core and System Performance 15.3.2.3.1 Mathematical Model 15.3.2.3.2 Input Parameters and Initial Conditions 15.3.2.3.3 Results 15.3.2.3.4 Consideration of Uncertainties 15.3.2.4 Barrier Performance 15.3.2.5 Radiological Consequences 15.3.3 Recirculation Pump Seizure 15.3.3.1 Identification of Causes and Frequency Classification 15.3.3.1.1 Identification of Causes 15.3.3.1.2 Frequency Classification 15.3.3.2 Sequence of Events and System Operation 15.3.3.2.1 Sequence of Events 15.3.3.2.2 System Operation 15.3.3.2.3 The Effect of Single Failures and Operator Errors 15.3.3.3 Core and System Performance 15.3.3.3.1 Mathematical Model 15.3.3.3.2 Input Parameters and Initial Conditions 15.3.3.3.3 Results 15.3.3.3.4 Consideration of Uncertainties 15.3.3.4 Barrier Performance 15.3.3.5 Radiological Consequences 15.3.4 Recirculation Pump Shaft Break 15.3.4.1 Identification of Causes and Frequency Classification 15.3.4.1.1 Identification of Causes 15.3.4.1.2 Frequency Classification 15.3.4.2 Sequence of Events and System Operation 15.3.4.2.1 Sequence of Events 15.3.4.2.2 System Operation 15.3.4.2.3 The Effect of Single Failures and Operator Errors 15.3.4.3 Core and System Performance 15.3.4.4 Qualitative Results 15.3.4.5 Barrier Performance 15.3.4.6 Radiological Consequences 15.4 REACTIVITY AND POWER DISTRIBUTION ANOMALIES 15.4.1 Rod Withdrawal Error - Low Power 15.4.1.1 Control Rod Removal Error During Refueling 15.4.1.1.1 Identification of Causes and Frequency Classification CHAPTER 15 15-vii REV. 17, SEPTEMBER 2014

LGS UFSAR TABLE OF CONTENTS (cont'd) 15.4.1.1.2 Sequence of Events and System Operation 15.4.1.1.3 Core and System Performances 15.4.1.1.4 Barrier Performance 15.4.1.1.5 Radiological Consequences 15.4.1.2 Continuous Rod Withdrawal During Reactor Startup 15.4.1.2.1 Identification of Causes and Frequency Classification 15.4.1.2.2 Sequence of Events and System Operation 15.4.1.2.3 Core and System Performances 15.4.1.2.4 Barrier Performance 15.4.1.2.5 Radiological Consequences 15.4.2 Rod Withdrawal Error - at Power 15.4.2.1 Identification of Causes and Frequency Classification 15.4.2.1.1 Identification of Causes 15.4.2.1.2 Frequency Classification 15.4.2.2 Sequence of Events and System Operation 15.4.2.2.1 Sequence of Events 15.4.2.2.2 System Operation 15.4.2.2.3 The Effect of Single Failures and Operator Errors 15.4.2.3 Core and System Performance 15.4.2.4 Barrier Performance 15.4.2.5 Radiological Consequences 15.4.3 Control Rod Maloperation (System Malfunction or Operator Error) 15.4.4 Startup of Idle Recirculation Pump 15.4.4.1 Identification of Causes and Frequency Classification 15.4.4.1.1 Identification of Causes 15.4.4.2 Sequence of Events and System Operation 15.4.4.2.1 Sequence of Events 15.4.4.2.2 System Operation 15.4.4.2.3 The Effect of Single Failures and Operator Errors 15.4.4.3 Core and System Performance 15.4.4.3.1 Mathematical Model 15.4.4.3.2 Input Parameters and Initial Conditions 15.4.4.3.3 Results 15.4.4.3.4 Consideration of Uncertainties 15.4.4.4 Barrier Performance 15.4.4.5 Radiological Consequences 15.4.5 Recirculation Flow Control Failure with Increasing Flow 15.4.5.1 Identification of Causes and Frequency Classification 15.4.5.1.1 Identification of Causes 15.4.5.1.2 Frequency Classification 15.4.5.2 Sequence of Events and System Operation 15.4.5.2.1 Sequence of Events 15.4.5.2.2 System Operation 15.4.5.2.3 The Effect of Single Failures and Operator Errors CHAPTER 15 15-viii REV. 17, SEPTEMBER 2014

LGS UFSAR TABLE OF CONTENTS (cont'd) 15.4.5.3 Core and System Performance 15.4.5.3.1 Mathematical Model 15.4.5.3.2 Input Parameters and Initial Conditions 15.4.5.3.3 Results 15.4.5.3.4 Consideration of Uncertainties 15.4.5.4 Barrier Performance 15.4.5.5 Radiological Consequences 15.4.6 Chemical and Volume Control System Malfunctions 15.4.7 Misplaced Bundle Accident 15.4.7.1 Identification of Causes and Frequency Classification 15.4.7.1.1 Identification of Causes 15.4.7.1.2 Frequency Classification 15.4.7.2 Sequence of Events and System Operation 15.4.7.2.1 The Effect of Single Failures and Operator Errors 15.4.7.3 Core and System Performance 15.4.7.4 Barrier Performance 15.4.7.5 Radiological Consequences 15.4.8 Spectrum of Rod Ejection Accidents 15.4.9 Control Rod-Drop Accident 15.4.9.1 Identification of Causes and Frequency Classification 15.4.9.2 Sequence of Events and System Operation 15.4.9.3 Core and System Performance 15.4.9.3.1 Mathematical Model 15.4.9.3.2 Input Parameters and Initial Conditions 15.4.9.3.3 Results 15.4.9.4 Barrier Performance 15.4.9.5 Radiological Consequences for the CRDA 15.4.9.5.1 Regulatory Approach 15.4.9.5.2 Dose Acceptance Criteria 15.4.9.5.3 Computer Codes 15.4.9.5.4 Source Terms 15.4.9.5.5 Methodology 15.4.9.5.6 Atmospheric Dispersion Factors (X/Qs) 15.4.9.5.7 Summary and Conclusions 15.4.10 References 15.5 INCREASE IN REACTOR COOLANT INVENTORY 15.5.1 Inadvertent HPCI Startup 15.5.1.1 Identification of Causes and Frequency Classification 15.5.1.1.1 Identification of Causes 15.5.1.1.2 Frequency Classification 15.5.1.2 Sequence of Events and System Operation CHAPTER 15 15-ix REV. 17, SEPTEMBER 2014

LGS UFSAR TABLE OF CONTENTS (cont'd) 15.5.1.2.1 Sequence of Events 15.5.1.2.2 System Operation 15.5.1.2.3 The Effect of Single Failures and Operator Errors 15.5.1.3 Core and System Performance 15.5.1.3.1 Mathematical Model 15.5.1.3.2 Input Parameter and Initial Conditions 15.5.1.3.3 Results 15.5.1.3.4 Consideration of Uncertainties 15.5.1.4 Barrier Performance 15.5.1.5 Radiological Consequences 15.5.2 Chemical Volume Control System Malfunction (or Operator Error) 15.5.3 Other BWR Transients Which Increase Reactor Coolant Inventory 15.6 DECREASE IN REACTOR COOLANT INVENTORY 15.6.1 Inadvertent Main Steam Relief Valve Opening 15.6.2 Instrument Line Pipe Break 15.6.2.1 Identification of Causes and Frequency Classification 15.6.2.1.1 Identification of Causes and Event Description 15.6.2.1.2 Frequency Classification 15.6.2.2 Sequence of Events and System Operation 15.6.2.2.1 Sequence of Events 15.6.2.2.2 System Operation 15.6.2.2.3 The Effect of Single Failures and Operator Errors 15.6.2.3 Core and System Performance 15.6.2.3.1 Qualitative Summary 15.6.2.3.2 Quantitative Results 15.6.2.3.3 Consideration of Uncertainties 15.6.2.4 Barrier Performance 15.6.2.4.1 General 15.6.2.5 Radiological Consequences 15.6.2.5.1 Design Basis Analysis 15.6.2.5.2 Realistic Analysis 15.6.3 Steam Generator Tube Failure 15.6.4 Steam System Piping Break Outside Primary Containment 15.6.4.1 Identification of Causes and Frequency Classification 15.6.4.1.1 Identification of Causes 15.6.4.1.2 Frequency Classification 15.6.4.2 Sequence of Events and System Operation 15.6.4.2.1 Sequence of Events 15.6.4.2.2 System Operation 15.6.4.2.3 The Effect of Single Failures and Operator Errors 15.6.4.3 Core and System Performance CHAPTER 15 15-x REV. 17, SEPTEMBER 2014

LGS UFSAR TABLE OF CONTENTS (cont'd) 15.6.4.3.1 Input Parameters and Initial Conditions 15.6.4.3.2 Results 15.6.4.3.3 Consideration of Uncertainties 15.6.4.4 Barrier Performance 15.6.4.5 Radiological Consequences for the MSLB 15.6.4.5.1 Regulatory Approach 15.6.4.5.2 Dose Acceptance Criteria 15.6.4.5.3 Computer Codes 15.6.4.5.4 Source Terms 15.6.4.5.5 Methodology 15.6.4.5.6 Atmospheric Dispersion Factors (X/Qs) 15.6.4.5.7 Summary and Conclusions 15.6.5 Loss-of-Coolant Accidents (Resulting from Spectrum of Postulated Piping Breaks Within the Reactor Coolant Pressure Boundary) Inside Primary Containment 15.6.5.1 Identification of Causes and Frequency Classification 15.6.5.1.1 Identification of Causes 15.6.5.1.2 Frequency Classification 15.6.5.2 Sequence of Events and System Operation 15.6.5.2.1 Sequence of Events 15.6.5.2.2 System Operation 15.6.5.2.3 The Effect of Single Failures and Operator Errors 15.6.5.3 Core and System Performance 15.6.5.3.1 Mathematical Model 15.6.5.3.2 Input Parameters and Initial Conditions 15.6.5.3.3 Results 15.6.5.3.4 Consideration of Uncertainties 15.6.5.4 Barrier Performance 15.6.5.5 Radiological Consequences for the LOCA 15.6.5.5.1 Regulatory Approach 15.6.5.5.2 Dose Acceptance Criteria 15.6.5.5.3 Computer Codes 15.6.5.5.4 Source Terms 15.6.5.5.5 Methodology 15.6.5.5.6 Atmospheric Dispersion Factors (X/Qs) 15.6.5.5.7 Summary and Conclusions 15.6.6 Feedwater Line Break Outside Primary Containment 15.6.6.1 Identification of Causes and Frequency Classification 15.6.6.1.1 Identification of Causes 15.6.6.1.2 Frequency Classification 15.6.6.2 Sequence of Events and System Operation 15.6.6.2.1 Sequence of Events 15.6.6.2.2 System Operation 15.6.6.2.3 The Effect of Single Failures and Operator Errors 15.6.6.3 Core and System Performance 15.6.6.3.1 Qualitative Summary CHAPTER 15 15-xi REV. 17, SEPTEMBER 2014

LGS UFSAR TABLE OF CONTENTS (cont'd) 15.6.6.3.2 Qualitative Results 15.6.6.3.3 Consideration of Uncertainties 15.6.6.4 Barrier Performance 15.6.6.5 Radiological Consequences 15.6.6.5.1 Design Basis Analysis 15.6.6.5.2 Realistic Analysis 15.6.7 Loss of Feedwater Flow 15.6.8 References 15.7 RADIOACTIVE RELEASES FROM SUBSYSTEMS AND COMPONENTS 15.7.1 Radioactive Gas Waste System Leak or Failure 15.7.1.1 Main Condenser Offgas Treatment System Failure 15.7.1.1.1 Identification of Causes and Frequency Classification 15.7.1.1.2 Sequence of Events and System Operation 15.7.1.1.3 Core and System Performance 15.7.1.1.4 Barrier Performance 15.7.1.1.5 Radiological Consequences 15.7.1.2 Malfunction of Main Turbine Gland Sealing System 15.7.1.2.1 Identification of Causes and Frequency Classification 15.7.1.2.2 Sequence of Events and System Operation 15.7.1.2.3 Core and System Performance 15.7.1.2.4 Barrier Analysis 15.7.1.2.5 Radiological Consequences 15.7.1.3 Failure of Steam Jet Air Ejector Lines 15.7.1.3.1 Identification of Causes and Frequency Classification 15.7.1.3.2 Sequence of Events and System Operation 15.7.1.3.3 Core and System Performance 15.7.1.3.4 Barrier Analysis 15.7.1.3.5 Radiological Consequences 15.7.2 Liquid Radioactive Waste System Failure 15.7.2.1 Identification of Causes and Frequency Classification 15.7.2.1.1 Identification of Causes 15.7.2.1.2 Frequency Classification 15.7.2.2 Sequence of Events and System Operation 15.7.2.3 Core and System Performance 15.7.2.4 Barrier Performance 15.7.2.5 Radiological Consequences 15.7.2.5.1 Design Basis Analysis 15.7.2.5.2 Realistic Analysis 15.7.3 Postulated Radioactive Releases Due to Liquid Radwaste Tank Failure 15.7.4 Fuel Handling Accident 15.7.4.1 Identification of Causes and Frequency Classification CHAPTER 15 15-xii REV. 17, SEPTEMBER 2014

LGS UFSAR TABLE OF CONTENTS (cont'd) 15.7.4.1.1 Identification of Causes 15.7.4.1.2 Frequency Classification 15.7.4.2 Sequence of Events and System Operation 15.7.4.2.1 Sequence of Events 15.7.4.2.2 Identification of Operator Actions 15.7.4.2.3 System Operation 15.7.4.2.4 The Effect of Single Failures and Operator Errors 15.7.4.3 Core and System Performance 15.7.4.3.1 Mathematical Model 15.7.4.3.2 Input Parameters and Initial Conditions 15.7.4.3.3 Results 15.7.4.4 Barrier Performance 15.7.4.5 Radiological Consequences for the FHA 15.7.4.5.1 Regulatory Approach 15.7.4.5.2 Dose Acceptance Criteria 15.7.4.5.3 Computer Codes 15.7.4.5.4 Source Terms 15.7.4.5.5 Methodology 15.7.4.5.6 Atmospheric Dispersion Factors (X/Qs) 15.7.4.5.7 Summary and Conclusions 15.7.5 Spent Fuel Cask-Drop Accident 15.7.6 Movement of Loads Without Secondary Containment 15.7.7 References 15.8 ANTICIPATED TRANSIENTS WITHOUT SCRAM 15.8.1 Requirements 15.8.2 Plant Capabilities 15.8.3 Equipment Description 15.8.3.1 Redundant Reactivity Control System 15.8.3.2 Alternate Rod Insertion 15.8.3.3 Recirculation Pump Trip 15.8.3.4 Feedwater Runback 15.8.3.5 Standby Liquid Control System 15.8.3.6 Scram Discharge Volume 15.8.3.7 HPCI Flow Split Modification 15.8.4 References 15.9 PLANT NUCLEAR SAFETY OPERATIONAL ANALYSIS (A SYSTEM LEVEL/

QUALITATIVE-TYPE PLANT FMEA) 15.9.1 Objectives CHAPTER 15 15-xiii REV. 17, SEPTEMBER 2014

LGS UFSAR TABLE OF CONTENTS (cont'd) 15.9.2 Approach to Operational Nuclear Safety 15.9.2.1 Classification of Plant Events 15.9.2.2 NSOA Development 15.9.2.2.1 Scope and Classification of Plant Events 15.9.2.2.2 Safety and Power Generation 15.9.2.2.3 Frequency of Events 15.9.2.2.4 Conservative Analysis Margins 15.9.2.2.5 Safety Function Definition 15.9.2.2.6 Envelope and Actual Event Analyses 15.9.2.2.7 Analysis Consistency 15.9.2.3 Comprehensiveness of the Analysis 15.9.2.4 Systematic Approach of the Analysis 15.9.2.5 Relationship of Nuclear Safety Operational Analysis to Safety Analyses of Chapter 15 15.9.2.6 Relationship Between NSOA and Operational Requirements, Technical Specifications, Design Bases, and Single Active Component Failure Aspects 15.9.2.7 Unacceptable Consequences Criteria 15.9.2.8 General Nuclear Safety Operational Criteria 15.9.3 Method of Analysis 15.9.3.1 General Approach 15.9.3.2 BWR Operating States 15.9.3.3 Selection of Events for Analysis 15.9.3.3.1 Normal Operations 15.9.3.3.2 Anticipated Operational Transients 15.9.3.3.3 Abnormal Operational Transients 15.9.3.3.4 Design Basis Accidents 15.9.3.3.5 Special Events 15.9.3.4 Applicability of Events to Operating States 15.9.3.5 Guidelines for Event Analysis 15.9.3.6 Steps in an Operational Analysis 15.9.4 Display of Operational Analysis Results 15.9.4.1 General 15.9.4.2 Protection Sequence and Safety System Auxiliary Diagrams 15.9.5 Bases for Technical Specifications 15.9.5.1 Surveillance Test Requirements 15.9.5.2 Limiting Condition for Operation 15.9.5.3 Maximum Allowable Out-of-Service Time 15.9.6 Operational Analyses 15.9.6.1 Safety System Auxiliaries 15.9.6.2 Normal Operations 15.9.6.2.1 General 15.9.6.2.2 Event Definitions 15.9.6.2.3 Required Safety Actions/Related Unacceptable Consequences CHAPTER 15 15-xiv REV. 17, SEPTEMBER 2014

LGS UFSAR TABLE OF CONTENTS (cont'd) 15.9.6.2.4 Operational Safety Evaluations 15.9.6.3 Anticipated Operational Transients 15.9.6.3.1 General 15.9.6.3.2 Required Safety Actions/Related Unacceptable Consequences 15.9.6.3.3 Event Definitions and Operational Safety Evaluations 15.9.6.4 Abnormal Operational Transients 15.9.6.4.1 General 15.9.6.4.2 Required Safety Actions/Related Unacceptable Consequences 15.9.6.4.3 Event Definition and Operational Safety Evaluation 15.9.6.5 Design Basis Accidents 15.9.6.5.1 General 15.9.6.5.2 Required Safety Actions/Unacceptable Consequences 15.9.6.5.3 Event Definition and Operational Safety Evaluations 15.9.6.6 Special Events 15.9.6.6.1 General 15.9.6.6.2 Required Safety Action/Unacceptable Consequences 15.9.6.6.3 Event Definitions and Operational Safety Evaluation 15.9.7 Summary and Conclusions 15.10 ACCIDENT DOSE MODEL DESCRIPTIONS 15.10.1 Offsite Dose Model 15.10.1.1 Total Body Gamma Dose 15.10.1.2 Thyroid Inhalation Dose 15.10.1.3 Beta Skin Dose 15.10.2 Control Room Doses 15.10.2.1 Control Room X/Q Model 15.10.2.2 Control Room Dose Model 15.10.3 References 15.11 PROBABILISTIC RISK ASSESSMENT 15.12 STATION BLACKOUT 15.12.1 Requirements and Limerick Response 15.12.2 Determination of Required Coping Duration 15.12.3 Use of Alternate Ac Source 15.12.4 Assessment of Ability to Cope with a Station Blackout 15.12.4.1 Condensate Inventory for Decay Heat Removal 15.12.4.2 Class 1E Battery Capacity 15.12.4.3 Compressed Gas 15.12.4.4 Effects of Loss of Ventilation CHAPTER 15 15-xv REV. 17, SEPTEMBER 2014

LGS UFSAR TABLE OF CONTENTS (cont'd) 15.12.4.5 Containment Isolation 15.12.4.6 Reactor Coolant Inventory 15.12.5 Procedures for SBO 15.12.6 References Appendix 15A Continuous Control Rod Withdrawal Transient Analysis Appendix 15B Reload Evaluation CHAPTER 15 15-xvi REV. 17, SEPTEMBER 2014

LGS UFSAR CHAPTER 15 - ACCIDENT ANALYSES LIST OF TABLES TABLE TITLE 15.0-1 Summary of Initial Core Transients 15.0-1A Transient Analysis Results at Rerate Power 15.0-2 Input Parameters and Initial Conditions for Initial Core Transients 15.0-2A Input Parameters and Initial Conditions For Rerate Power Transient Analysis 15.0-3 Summary of Accidents 15.0-4 Atmospheric Dispersion Parameters 15.0-5 Required Operating Limit CPR Values for Initial Core Transients 15.0-6 Transients Where Nonsafety-Grade Systems/Components are Actuated During the Course of the Event 15.1-1 Sequence of Events for Inadvertent RHR Shutdown Cooling Operation 15.1-2 Sequence of Events for Loss of Feedwater Heating 15.1-3 Sequence of Events for Feedwater Controller Failure 15.1-4 Sequence of Events for Pressure Regulator Failure 15.1-5 Sequence of Events for Inadvertent Main Steam Relief Valve Opening 15.2-1 Sequence of Events for Turbine-Generator Load Rejection With Bypass 15.2-2 Sequence of Events for Turbine-Generator Load Rejection Without Bypass 15.2-3 Sequence of Events for Turbine Trip with Bypass 15.2-4 Sequence of Events for Turbine Trip Without Bypass 15.2-5 Sequence of Events for MSIV Closure 15.2-6 Typical Rates of Decay for Condenser Vacuum 15.2-7 Sequence of Events for Loss of Condenser Vacuum 15.2-8 Trip Signals Associated with Loss of Condenser Vacuum 15.2-9 Sequence of Events for Loss of Auxiliary Power Transformer 15.2-10 Sequence of Events for Loss of all Grid Connections CHAPTER 15 15-xvii REV. 17, SEPTEMBER 2014

LGS UFSAR LIST OF TABLES (cont'd) 15.2-11 Sequence of Events for Loss of Feedwater Flow 15.2-12 Sequence of Events for Failure of RHR Shutdown Cooling 15.2-13 Input Parameters for Evaluation of Failure of RHR Shutdown Cooling 15.2-14 Significant Initial Conditions and Results for the Generator Load Rejection Without Bypass and EOC-RPT 15.2-15 Sequence of Events for Loss of Stator Cooling 15.3-1 Sequence of Events for Trip of One Recirculation Pump 15.3-2 Sequence of Events for Trip of Both Recirculation Pumps 15.3-3 Sequence of Events for Recirculation Pump Seizure 15.4-1 Sequence of Events for Control Rod Withdrawal Error in Power Range 15.4-2 Intentionally Left Blank 15.4-3 Deleted.

15.4-4 Sequence of Events for Recirculation Flow Control Failure With Increasing Flow 15.4-5 Sequence of Events for Misplaced Bundle Accident 15.4-6 Initial Conditions and Results of Fuel Bundle Loading Error 15.4-7 This was left blank intentionally.

15.4-8 This was left blank intentionally.

15.4-9 This was left blank intentionally.

15.4-10 This was left blank intentionally.

15.4-11 CRDA - Radiological Consequences Key Inputs and Assumptions 15.4-12 X/Q Values for CRDA 15.4-13 CRDA Radiological Consequences Analysis Results 15.5-1 Sequence of Events: Inadvertent HPCI Startup 15.6-1 Sequence of Events for Instrument Line Break 15.6-2 Instrument Line Break Accident: Parameters Tabulated for Postulated Accident Analyses CHAPTER 15 15-xviii REV. 17, SEPTEMBER 2014

LGS UFSAR LIST OF TABLES (cont'd) 15.6-3 Instrument Line Failure: Activity Airborne in Reactor Enclosure 15.6-4 Instrument Line Failure: Activity Released to the Environment 15.6-5 Instrument Line Failure: Activity Airborne in Reactor Enclosure 15.6-6 Instrument Line Break: Activity Released to the Environment 15.6-7 Instrument Line Failure: Radiological Effects 15.6-8 Sequence of Events for Steam Line Break Outside Primary Containment 15.6-9 MSLB - Radiological Consequences Key Inputs and Assumptions 15.6-10 MSLB X/Q Values 15.6-11 MSLB Radiological Consequences Analysis Results 15.6-12 Not Used 15.6-13 Loss-of-Coolant Accident: Personnel Dose Inputs 15.6-14 Loss-of-Coolant Accident: Source Term 15.6-15 Loss-of-Coolant Accident: Containment Parameters 15.6-16 Loss-of-Coolant Accident: Control Room Parameters 15.6-17 Loss-of-Coolant Accident: Removal Inputs 15.6-18 Loss-of-Coolant Accident: Radiological Dose Summary 15.6-19 Loss-of-Coolant Accident: Control Room Dispersion Factors 15.6-20 Loss-of-Coolant Accident: Offsite Dispersion Factors 15.6-21 Deleted 15.6-22 Deleted 15.6-23 Sequence of Events for Feedwater Line Break Outside Primary Containment 15.6-24 Feedwater Line Break Accident: Parameters Tabulated for Postulated Accident Analyses 15.6-25 Feedwater Line Break: Activity Released to the Environment 15.6-26 Feedwater Line Break: Radiological Effects CHAPTER 15 15-xix REV. 17, SEPTEMBER 2014

LGS UFSAR LIST OF TABLES (cont'd) 15.6-27 Loss-of-Coolant Accident: Sequence of Events for Radiological Consequence Analysis 15.7-1 Sequence of Events for Main Condenser Offgas Treatment System Failure 15.7-2 Radioactive Gas Waste System Failure: Parameters Tabulated for Postulated Accident Analyses 15.7-3 Offgas Equipment Failure Release Assumptions: Release Fractions Assumed for Design Basis and Realistic Analysis 15.7-4 Main Condenser Offgas Treatment System Failure (Charcoal Adsorber Vessels): Activity Released to the Environment 15.7-5 Main Condenser Offgas Treatment System Failure (Charcoal Adsorber Vessels): Activity Released to the Environment 15.7-6 Main Condenser Offgas Treatment System Failure (Charcoal Adsorber Vessels): Radiological Effects 15.7-7 Failure of Steam Jet Air Ejector Lines: Parameters Tabulated for Postulated Accident Analyses 15.7-8 Failure of Steam Jet Air Ejector Lines: Activity Released to the Environment 15.7-9(a) Failure of Steam Jet Air Ejector Lines: Radiological Effects 15.7-9(b) Main Condenser Offgas Treatment System Failure: Radiological Effects 15.7-10 Sequence of Events: Liquid Radwaste Tank Failure 15.7-11 Liquid Radwaste Tank Failure: Parameters Tabulated for Postulated Accident Analyses 15.7-12 Liquid Radwaste Tank Failure (RWCU Phase Separator): Activity Released to the Environment 15.7-13 Liquid Radwaste Tank Failure (RWCU Phase Separator): Activity Released to the Environment 15.7-14 Liquid Radwaste Tank Failure (RWCU Phase Separator): Radiological Effects 15.7-15 Sequence of Events for Fuel Handling Accident 15.7-16 FHA - Radiological Consequences Key Inputs and Parameters 15.7-17 FHA X/Q Values CHAPTER 15 15-xx REV. 17, SEPTEMBER 2014

LGS UFSAR LIST OF TABLES (cont'd) 15.7-18 FHA Radiological Consequences Analysis Results 15.7-19 Not Used 15.7-20 Not Used 15.7-21 Not Used 15.7-22 Potential Energy of Light Loads to be Handled Over Spent Fuel 15.9-1 Normal Operation 15.9-2 Anticipated Operational Transients 15.9-3 Abnormal Operational Transients 15.9-4 Design Basis Accidents 15.9-5 Special Events 15.9-6 Unacceptable Consequences Criteria - Plant Event Category - Normal Operation 15.9-7 Unacceptable Consequences Criteria - Plant Event Category - Anticipated Operational Transients 15.9-8 Unacceptable Consequences Criteria - Plant Event Category - Abnormal Operational Transients 15.9-9 Unacceptable Consequences Criteria - Plant Event Category - Design Basis Accidents 15.9-10 Unacceptable Consequences Considerations - Plant Event Category -

Special Events 15.9-11 BWR Operating States 15.10-1 Physical Data for Isotopes 15.10-2 Accident Atmospheric Dilution Factors - X/Q 15.10.3 Breathing Rates for Offsite Dose Calculations CHAPTER 15 15-xxi REV. 17, SEPTEMBER 2014

LGS UFSAR CHAPTER 15 - ACCIDENT ANALYSES LIST OF FIGURES FIGURE TITLE 15.0-1 Typical Power/Flow Map 15.0-2 Scram Position and Reactivity Characteristics 15.0-3 Minimum Operating CPR Limits versus Scram Speed 15.1-1 Feedwater Controller Failure Without Turbine Bypass 15.1-2 Intentionally Left Blank 15.1-3 Feedwater Controller Failure, Maximum Demand, with High Level Turbine Trip 15.1-4 Pressure Regulator Failure Open 15.2-1 Generator Load Rejection, Trip Scram, Bypass - On, RPT - On 15.2-2 Generator Load Rejection without Bypass 15.2-3 Turbine Trip, Trip Scram, Bypass - On, RPT - On 15.2-4 Turbine Trip without Bypass, Trip Scram 15.2-5 Three Second Closure of all Main Steam Line Isolation Valves 15.2-6 Loss of Condenser Vacuum 15.2-7 Loss of Auxiliary Power Transformer 15.2-8 Loss of All Grid Connections 15.2-9 Loss of All Feedwater Flow 15.2-10 Summary of Paths Available to Achieve Cold Shutdown 15.2-11 Use of ADS and RHR Suppression Pool Cooling to Achieve Cold Shutdown 15.2-12 Vessel Temperature and Pressure versus Time to Achieve Cold Shutdown with ADS and RHR Suppression Pool Cooling 15.2-13 Suppression Pool Temperature versus Time to Achieve Cold Shutdown with ADS and RHR Suppression Pool Cooling CHAPTER 15 15-xxii REV. 17, SEPTEMBER 2014

LGS UFSAR LIST OF FIGURES (cont'd) 15.2-14 Generator Load Rejection, No Bypass, No EOC-RPT 15.3-1 Trip of One Recirculation Pump Motor 15.3-2 Trip of Both Recirculation Pump Motors 15.3-3 Seizure of One Recirculation Pump 15.4-1 This figure has been deleted.

15.4-2 Deleted 15.4-3 Recirculation Failure - Increasing Flow 15.4-4 Deleted 15.5-1 Inadvertent Startup of HPCI Pump 15.6-1 Leakage Path for Instrument Line Break 15.6-2 Steam Flow Schematic for Steam Break Outside Primary Containment 15.6-3 Leakage Flow for LOCA 15.6-4 Leakage Path for Feedwater Line Break Outside Primary Containment 15.7-1 Leakage Path for Fuel Handling Accident 15.9-1 Block Diagram of Method Used to Derive Nuclear Safety Operational Requirements System, Level Qualitative FMEA, Design Basis Confirmation Audits, and Technical Specifications 15.9-2 Possible Inconsistencies in the Selection of Nuclear Safety Operational Requirements 15.9-3 INTENTIONALLY LEFT BLANK 15.9-4 Format for Protection Sequence Diagrams 15.9-5 Format for Safety System Auxiliary Diagrams 15.9-6 INTENTIONALLY LEFT BLANK 15.9-7 Safety System Auxiliaries 15.9-8 Safety System Auxiliaries 15.9-9 Safety Action Sequences for Normal Operation in State A 15.9-10 Safety Action Sequences for Normal Operation in State B 15.9-11 Safety Action Sequences for Normal Operation in State C CHAPTER 15 15-xxiii REV. 17, SEPTEMBER 2014

LGS UFSAR LIST OF FIGURES (cont'd) 15.9-12 Safety Action Sequences for Normal Operation in State D 15.9-13 Protection Sequence for Manual or Inadvertent Scram 15.9-14 Protection Sequences for Loss of Plant Instrument and Service Air System 15.9-15 Protection Sequences for Inadvertent Startup of NSSS Pump 15.9-16 Protection Sequences for Inadvertent Startup of Idle Recirculation Loop Pump 15.9-17 Protection Sequence for Recirculation Loop Flow Control Failure (Increasing Flow) 15.9-18 Protection Sequence for Recirculation Loop Flow Control Failure (Decreasing Flow) 15.9-19 Protection Sequences for Recirculation Loop Pump Trip (One or Both) 15.9-20 Protection Sequences for Isolation of All Main Steam Lines 15.9-21 Protection Sequences for Isolation of One Main Steam Line 15.9-22 Protection Sequences for Inadvertent Opening of an MSRV 15.9-23 Protection Sequence for Control Rod Withdrawal Error for Startup and Refueling Operations 15.9-24 Protection Sequence for Control Rod Withdrawal Error - Power Operation 15.9-25 Protection Sequences for RHR - Loss of Shutdown Cooling 15.9-26 Protection Sequences for RHR (Shutdown Cooling) Increased Cooling 15.9-27 Protection Sequences for Loss of Feedwater Flow 15.9-28 Protection Sequence for Loss of a Feedwater Heater 15.9-29 Protection Sequences for Feedwater Controller Failure (Maximum Demand) 15.9-30 Protection Sequences for Pressure Regulator Failure (Open) 15.9-31 Protection Sequences for Pressure Regulator Failure (Closed) 15.9-32 Protection Sequences for Main Turbine Trip with Bypass System Operation 15.9-33 Protection Sequences for Loss of Main Condenser Vacuum CHAPTER 15 15-xxiv REV. 17, SEPTEMBER 2014

LGS UFSAR LIST OF FIGURES (cont'd) 15.9-34 Protection Sequences for Main Generator Trip with Bypass System Operation 15.9-35 Protection Sequences for Achieving Shutdown Cooling with Reactor Vessel Isolated 15.9-36 Protection Sequences for Loss of Normal Ac Power (Grid Connection Loss) 15.9-37 Protection Sequences for Main Generator Trip With Bypass System Failure 15.9-38 Protection Sequences for Main Turbine Trip With Bypass System Failure 15.9-39 Protection Sequence for Inadvertent Loading and Operation of Fuel Assembly in Improper Position 15.9-40 Protection Sequences for Recirculation Loop Pump Seizure 15.9-41 Protection Sequences for Recirculation Pump Shaft Break 15.9-42 Protection Sequences for Control Rod-Drop Accident 15.9-43 Protection Sequences for Fuel Handling Accident 15.9-44 Protection Sequences for Loss of Coolant Piping Breaks in RCPB Inside Containment 15.9-45 Protection Sequences for Piping Breaks Outside Containment 15.9-46 Protection Sequences for Gaseous Radwaste System Leak or Failure 15.9-47 Protection Sequences for Augmented Offgas Treatment System Failure 15.9-48 Protection Sequences for Liquid Radwaste System Leak or Failure 15.9-49 Protection Sequences for Liquid Radwaste System - Storage Tank Failure 15.9-50 Protection Sequences for Shipping Cask Drop 15.9-51 Protection Sequences for Reactor Shutdown/ATWS 15.9-52 Protection Sequences for Reactor Shutdown From Outside Control Room 15.9-53 Protection Sequences for Reactor Shutdown Without Control Rods CHAPTER 15 15-xxv REV. 17, SEPTEMBER 2014

LGS UFSAR CHAPTER 15 - ACCIDENT ANALYSIS 15.0 GENERAL This chapter describes the transient and accident analyses for LGS Units 1 and 2. The original analyses have been updated as part of the Power Rerate Project which increased the licensed rated thermal power to 3458 MWt (Reference 15.0-7). In addition, the original analyses have been supplemented to reflect changes to the licensed reactor operating domain (References 15.0-7, 15.0-10 and 15.0-11). As a result of improvements in plant feedwater flow measurement accuracy, a reduced reactor thermal power uncertainty can be applied. Due to the reduced uncertainty a MUR power uprate has been implemented that increases the licensed rated thermal power to 3515 MWt (1.65%) (See Section 1.1). Transient analyses to support MUR power uprate were performed for the first reload for MUR operation. Results are given in Cycle 14 reload documents. Radiological consequences evaluated for the Power Rerate Project are bounding for MUR because they were performed at a power level of 3527 MWt. The LGS operating domain is described in Appendix 15B.

The results of the analyses presented in the following sections provide the user with information regarding the general sequence of events, features, system behaviors, and trends and characteristics of each event. The information provided allows for an evaluation of the potential impact of changes to plant systems on the results of a particular analysis. The specific results presented (i.e. peak neutron flux and pressure, CPR, etc.) are explicitly applicable to the LGS Unit 1 Cycle 5 core only, which was the basis of the analyses (unless specified otherwise). The results are, however, representative of the expected plant response for both units.

The limiting transients in each category of event are discussed in detail and have been revised to reflect power rerate conditions. In general, the non-limiting events have not been reanalyzed for power rerate. The results presented in Chapter 15 for the non-limiting events reflect the original plant operating conditions. However, these results continue to provide a reasonable representation of the trends and characteristics of the event.

For each core reload, a cycle specific safety analysis is performed utilizing the methods described in References 15.0-2 to 15.0-5, 15.0-13, 15.0-15, and 15.0-16. The limiting transient events are re-evaluated for each reload. The results of these analyses are documented in the cycle specific Supplemental Reload Licensing Report (SRLR). Information from the SRLR is used in the development of the cycle specific Core Operating Limit Report (COLR).

The scope of the situations analyzed includes anticipated (expected) operational occurrences (e.g., loss of electrical load); off design, abnormal (unexpected) transients that induce system operation disturbances; postulated accidents of low probability (e.g., the sudden loss of integrity of a major component); and hypothetical events of extremely low probability (e.g., an ATWS).

15.0.1 ANALYTICAL OBJECTIVE The spectrum of postulated initiating events is divided into categories based upon the type of disturbance and the expected frequency of the initiating occurrence; the limiting events in each combination of category and frequency are quantitatively analyzed. The plant safety analysis evaluates the ability of the plant to operate within regulatory guidelines, without undue risk to the public health and safety.

CHAPTER 15 15.0-1 REV. 19, SEPTEMBER 2018

LGS UFSAR 15.0.2 ANALYTICAL CATEGORIES Transient and accident events contained in this report are discussed in individual categories as required by Reference 15.0-1. The results of the events are summarized in Table 15.0-1, for the initial core, and in Table 15.0-1A for rerated conditions. Each event evaluated is assigned to one of the following applicable categories:

a. Decrease in Core Coolant Temperature - Reactor vessel water (moderator) temperature reduction results in an increase incore reactivity. This could lead to fuel cladding damage.

b. Increase in Reactor Pressure - Nuclear system pressure increases threaten to rupture the RCPB. Increasing pressure also collapses the voids in the core moderator, thereby increasing core reactivity and power level which threaten fuel cladding due to overheating.

c. Decrease in Reactor Core Coolant Flow Rate - A reduction in the core coolant flow rate threatens to overheat the cladding as the coolant becomes unable to adequately remove the heat generated by the fuel.

d. Reactivity and Power Distribution Anomalies - Transient events included in this category are those that cause rapid increases in power and are due to increased core flow disturbance events. Increased core flow reduces the void content of the moderator, increasing core reactivity and power level.

e. Increase in Reactor Coolant Inventory - Increasing coolant inventory could result in excessive moisture carryover to the main turbine, feedwater turbines, etc.

f. Decrease in Reactor Coolant Inventory - Reductions in coolant inventory could threaten the fuel as the coolant becomes less able to remove the heat generated in the core.

g. Radioactive Release from Subsystems and Components - Loss of integrity of a radioactive containment component is postulated.

h. Anticipated Transients Without Scram - In order to determine the capability of plant design to accommodate an extremely low probability event, a multisystem maloperation situation is postulated.

15.0.3 TRANSIENT OR ACCIDENT EVALUATION 15.0.3.1 Identification of Causes and Frequency Classification Situations and causes that lead to the initiating event analyzed are described within the categories designated above. The frequency of occurrence of each transient or accident is summarized based upon currently available operating plant history for the transient, or accident. Transients, or accidents, for which inconclusive data exist are discussed separately within each section.

Each initiating event within the major groups is assigned to one of the following frequency groups:

CHAPTER 15 15.0-2 REV. 19, SEPTEMBER 2018

LGS UFSAR

a. Incidents of moderate frequency - These are accidents that may occur from once during a calendar year to once per 20 years for a particular plant. These events are referred to as "anticipated (expected) operational transients."

b. Infrequent incidents - These are accidents that may occur occasionally during the life of a particular plant, ranging in time from once in 20 years to once in 100 years.

These events are referred to as "abnormal (unexpected) operational transients."

c. Limiting faults - These are accidents that are not expected to happen, but are postulated because they may result in the release of significant amounts of radioactive material. These events are referred to as "design basis (postulated) accidents."

d. Normal operation - Operations of high frequency are not discussed here, but are examined, along with (a), (b), and (c), in the nuclear systems operational analyses in Section 15.9.

15.0.3.1.1 Unacceptable Results for Incidents of Moderate Frequency - Anticipated (Expected)

Operational Transients The following are considered to be unacceptable safety results for incidents of moderate frequency (anticipated operational transients):

a. A release of radioactive material to the environs that exceeds the limits of 10CFR20.

b. Reactor operation induced fuel cladding failure.

c. Nuclear system stresses in excess of those allowed for the transient classification by applicable industry codes.

d. Containment stresses in excess of those allowed for the transient classification by applicable industry codes.

15.0.3.1.2 Unacceptable Results for Infrequent Incidents - Abnormal (Unexpected) Operational Transients The following are considered to be unacceptable safety results for infrequent incidents (abnormal operational transients):

a. Release of radioactivity that results in dose consequences that exceed a small fraction of 10CFR50.67.

b. Failure of fuel cladding which could cause changes in core geometry such that core cooling would be inhibited.

c. Generation of a condition that results in consequential loss of function of the reactor coolant system.

d. Generation of a condition that results in a consequential loss of function of a necessary containment barrier.

CHAPTER 15 15.0-3 REV. 19, SEPTEMBER 2018

LGS UFSAR

e. Nuclear system stresses in excess of those allowed for the accident classification by applicable industry codes.

15.0.3.1.3 Unacceptable Results for Limiting Faults - Design Basis (Postulated) Accidents The following are considered to be unacceptable safety results for limiting faults (DBAs):

a. Radioactive material release that results in dose consequences that exceed the guideline values of 10CFR50.67.

b. Failure of fuel cladding which could cause sufficient changes in core geometry such that core cooling would be inhibited.

c. Nuclear system stresses in excess of those allowed for the accident classification by applicable industry codes.

d. Containment stresses in excess of those allowed for the accident classification by applicable industry codes when containment is required.

e. Radiation exposure to plant operations personnel in the main control room in excess of 5 rem TEDE (total effective dose equivalent).

15.0.3.2 Sequence of Events and System Operation Each transient, or accident, is discussed and evaluated in terms of the following:

a. A step-by-step sequence of events, from initiation to final stabilized condition.

b. The extent to which normally operating plant instrumentation and controls are assumed to function.

c. The extent to which plant and reactor protection systems are required to function.

d. The credit taken for the functioning of normally operating plant systems.

e. The operation of engineered safety systems that is required.

f. The effect of a single active failure, or of a single operator error.

g. The effects of plant equipment out-of-service.

15.0.3.2.1 Single Active Failures or Single Operator Errors 15.0.3.2.1.1 General This paragraph discusses a very important concept pertaining to the application of single active failures and single operator errors in analyses of the postulated events. Single active failure criteria have been required, and successfully applied, in past NRC-approved docket applications to DBA categories only. Reference 15.0-1 infers that "single active failures and single operator errors" requirements should be applied to transient events (including high, moderate, and low probability occurrences) as well as to accident (very low probability) situations.

Transient evaluations have been judged against a criterion of one single active failure, or one single operator error, as the initiating event, with no additional single failure assumptions to the protective sequences, although a great majority of these protective sequences are utilized in safety systems that can accommodate single active failures aspects. Even under these CHAPTER 15 15.0-4 REV. 19, SEPTEMBER 2018

LGS UFSAR postulated transients, or accidents, the plant damage allowances, or limits, were very much the same as those for normal operation.

Reference 15.0-1 suggests that the transient and accident scenarios should now include multifailure event sequences. The format requested follows:

a. For initiating occurrence 1- An equipment failure or an operator error, and

b. For single active failure 2- Another equipment failure or operator error analysis or failures and/or another operator error or errors.

Most transients, or accidents, postulated for consideration are the result of a single active failure or a single operator error that have been postulated during any normal or planned mode of plant operations. The types of operational single active failures and single operator errors considered as initiating events, and subsequent protective sequence challenges, are identified in the paragraphs below.

15.0.3.2.1.2 Initiating Event Analysis

a. The undesired opening or closing of any single valve (a check valve is not assumed to close against normal flow), or

b. The undesired starting or stopping of any single component, or

c. The malfunction or maloperation of any single control device, or

d. Any single electrical component failure, or

e. Any single operator error.

Operator error is defined as "an active deviation from written operating procedures or nuclear plant standard operating practices." The result of a single operator error is the set of actions that follows a single erroneous decision. The set of actions is limited as follows:

a. Those actions that could be performed by one person.

b. Those actions that would have constituted a correct procedure had the initial decision been correct.

c. Those actions that are subsequent to the initial operator error and have an effect on the designed operation of the plant, but are not necessarily directly related to the operator error.

Examples of single operator errors are as follows:

a. An increase in power above the established flow control power limits from control rod withdrawal in the specified sequences.

CHAPTER 15 15.0-5 REV. 19, SEPTEMBER 2018

LGS UFSAR

b. The selection and complete withdrawal of a single control rod out-of-sequence.

c. The incorrect calibration of an APRM.

d. Manual isolation of the main steam lines as a result of operator misinterpretation of an alarm or indicator.

15.0.3.2.1.3 Single Active Failure or Single Operator Error Analysis

a. The undesired action or maloperation of a single active component, or

b. Any single operator error as defined in Section 15.0.3.2.1.2.

15.0.3.2.2 Analyzed Transients and Nonsafety-Grade Systems or Components The thermal and pressure safety limits are not compromised by inclusion of the simulated response of nonsafety-grade systems when analyzing transients.

Referring to Table 15.0-6, the analysis for each of the transients is based on the single failure criterion associated with abnormal transients (i.e., abnormal transients are defined as events that occur as a result of equipment malfunctions as a result of a single active component failure or operator error). Following this single failure, the resulting transient is simulated in a conservative fashion to show the response of primary system variables and how the various plant systems would interact and function. In the transients, the consideration of any additional failures is not considered appropriate within the realm of the abnormal transient definition, but shifts them to infrequent events (infrequent events being those not expected in the 40 year plant lifetime).

Although certain transient events assume the operation of specific nonsafety-grade equipment to provide a realistic transient signature, failures of such equipment would not make these events more thermal or pressure limiting than the limiting accidents already addressed in Chapters 5 and

15. In fact, many of the events that have a Level 8 turbine trip (nonsafety-grade trip) would be less severe if the Level 8 trip was assumed not to function.

For example, failure of the Level 8 turbine trip or failure of the bypass to open when the Level 8 trip does occur was studied for a BWR similar to the LGS design. The increase in CPR was about 0.02 for a delay in the turbine trip and 0.08 for failure of bypass. Although thermal margins are reduced, no significant (if any) fuel damage is expected. The offsite doses (if any) would be negligible and therefore would have no impact from a health and safety viewpoint. The loss of feedwater event is analytically about the same with or without the recirculation runback ahead of the Level 2 trip.

15.0.3.3 Core and System Performance 15.0.3.3.1 Introduction Reactor core and system performance analysis must demonstrate that:

1. The margin of safety for Anticipated Operational Occurrences (AOOs) remain within all applicable criteria.

2. All fuel and thermal mechanical transient overpowers are within the applicable design bases.

CHAPTER 15 15.0-6 REV. 19, SEPTEMBER 2018

LGS UFSAR

3. The maximum reactor vessel pressure does not exceed the ASME code allowable peak pressure of 1375 psig.

4. Primary containment integrity is not comprised.

Section 4.4 describes the various fuel failure mechanisms. Avoidance of mechanisms (a) and (b) for incidents of moderate frequency is verified statistically with consideration given to data, calculating, manufacturing, and operating uncertainties. An acceptable criterion was determined to be that 99.9% of the fuel rods in the core would not be expected to experience boiling transition (References 15.0-2, 15.0-15, and 15.0-16). For TRACG applications, an operating limit MCPR (OLMCPR) is calculated for the transient initial condition that will result in no more than 0.1% of the fuel rods susceptible to boiling transition. For non-TRACG AOO analyses, this criterion is met by demonstrating that incidents of moderate frequency do not result in a MCPR less than the established Safety Limit MCPR (1.07 for the LGS Unit 1 Cycle 5 core). The reactor steady-state CPR operating limit is derived by determining the decrease in MCPR for the most limiting transient, or accident. All other transients, or accidents, result in smaller MCPR decreases and are not reviewed in depth in this chapter. The MCPR during significant abnormal transient, or accident, is calculated using a transient core heat transfer analysis computer program. The computer program for historical non-TRACG AOO analysis is based upon a multinode, single channel thermal-hydraulic model that requires simultaneous solution of the partial differential equations for the conservation of mass, energy, and momentum in the bundle, and that accounts for axial variation in power generation. The primary inputs to the model include a physical description of the bundle, channel inlet flow and enthalpy, and pressure and power generation as functions of time.

A detailed description of the analytical model may be found in Reference 15.0-2 or Reference 15.0-13 for TRACG reload AOO methodology. The initial condition assumed for all full power transient MCPR calculations is that the bundle is operating at or above the MCPR limit in the Technical Specifications. Maintaining MCPR greater than the safety limit MCPR is a sufficient, but not necessary, condition to assure that no fuel damage occurs. This is discussed in Section 4.4.

For situations in which fuel damage is sustained, the extent of damage is determined by correlating fuel energy content, cladding temperature, fuel rod internal pressure, and cladding mechanical characteristics.

These correlations are substantiated by fuel rod failure tests, and are discussed in Section 4.4 and Section 6.3.

The closure of all MSIVs causes an abrupt pressure increase in the reactor vessel. System pressure increase is mitigated by the actuation of the SRVs within their design and operating limits. Operating limits are placed on all RCPB component to ensure compliance to ASME overpressure protection criteria. Limits are also placed on reactor dome operating pressure and on SRVs out-of-service. These limits assure that the ASME code allowable value for peak vessel pressure is not exceeded and RCPB integrity is maintained.

The Mark II primary containment is designed to accommodate pressures, temperatures, and dynamic loads resulting from pipe breaks within the drywell or reactor blowdown through the SRV discharge and thereby limit the release of radioactive material to the plant and its environs. Core and containment cooling systems assure a coolable fuel geometry and control drywell and wetwell CHAPTER 15 15.0-7 REV. 19, SEPTEMBER 2018

LGS UFSAR pressure and temperature conditions within primary containment design limits. Limits placed on reactor and core operating conditions assure that containment integrity is maintained.

15.0.3.3.2 Input Parameters and Initial Conditions for Analyzed Events In general, the transients, or accidents, analyzed within this section have values for input parameters and initial conditions as specified in Table 15.0-2, for the initial core, and in Table 15.0.2A for power rerate. Analyses that assume data inputs different from these values are designated accordingly in the appropriate event discussion.

The transient analyses herein includes an RPT actuated by either fast closure of the turbine control valves or closure of the turbine stop valve.

For the original Cycle 1 transient event evaluations, low water level MSIV closure was simulated at Level 2. Subsequent design modifications have lowered the closure setpoint to Level 1. However, HPCI and RCIC initiation at Level 2 will prevent the water level from dropping to Level 1, and no MSIV closure will occur. Because no safety limits are approached during events for which the level is predicted to reach Level 2, reanalysis for the setpoint change is not required for the Cycle 1 analyses. The power rerate analysis utilized the Level 1 MSIV closure setpoint.

The UFSAR evaluates a wide range of process disturbances and component failures of varying severity to demonstrate conformance to plant safety and licensing criteria (Reference 15.0-1).

Generic guidelines for uprating BWRs (Reference 15.0-8) and established LGS reload licensing practice identify transient and accident events that are limiting to BWRs or are otherwise sufficient to demonstrate that all NRC protection criteria are met for LGS power rerate operation. The evaluations, where appropriate, are based on the characteristics of the LGS Unit 1 Cycle 5 core configuration. Comparisons of the results of the baseline evaluations for power rerate conditions and originally licensed operating conditions using improved models and methods are provided.

Input parameters consist of heat balance information, core characteristics, and reactor protection specifications. The inputs include the initial power and flow conditions, core pressure drop, nuclear dynamic parameters (scram times, void fraction, Doppler coefficient) and system set points (SRVs,reactor scram, recirculation and feedwater pump trips, etc.). The analyses cover the full spectrum of core conditions from the beginning to the end of the fuel cycle, whichever is more limiting for the event in consideration.

The analyses are based on the core loading characteristic of LGS Unit 1 Cycle 5. The GEMINI methodology is applied as recommended in the generic power uprate guidelines (Reference 15.0-8), which is consistent with the LGS reload licensing practice.

The key system input parameters used in the power rerate transient analysis are shown in Table 15.0-2A; corresponding evaluation results are summarized in Table 15.0-1A.

15.0.3.3.3 Initial Power/Flow Operating Constraints The analysis basis for most of the transient and accident analyses is the most limiting point on the power/flow operating map. Typically, this is at the maximum licensed core thermal power.

Depending on the event being analyzed, the core thermal power is adjusted, either directly or indirectly, to account for the required licensing power uncertainty as described in GESTAR II CHAPTER 15 15.0-8 REV. 19, SEPTEMBER 2018

LGS UFSAR (Reference 4.1-1) (See Section 15.0.4, Regulatory Guide 1.49). The limiting core flow rate is also dependent on the event being analyzed.

The operating power/flow map shown in Figure 15.0-1 includes the Maximum Extended Load Line Limit (MELLL) and Increased Core Flow (ICF) to 110% core flow operating domain.

The following performance improvement features are also included in the transient analyses: the FFWTR option used in conjunction with ICF at the end of the cycle, TBSOOS (formally known as

'TBVOOS'), EOC-RPTOOS, TCV/TSVOOS, PLUOOS, and PROOS. Additional details related to the combination of equipment OOS options with ARTS, MELLL, and ICF operation can be found in References 15.0-10 and 15.0-11.

The operating and performance improvement features described above are part of the LGS licensed operating domain. A detailed discussion of the LGS licensed operating domain is found in Appendix 15B.

Certain localized events are evaluated at other than the above mentioned conditions. These other conditions are discussed with the appropriate transient, or accident.

15.0.3.3.4 Results The results of analytical evaluations are provided for each transient, or accident. In addition, critical parameters are shown in Table 15.0-1 for Cycle 1 conditions and in Table 15.0-1A for power rerate conditions. From the data in Table 15.0-1, an evaluation of the limiting event for that particular category and parameter can be made. In Table 15.0-3, a summary of applicable accidents is provided. This table compares the GE calculated amount of failed fuel to that used in worst case radiological calculations.

The results of each transient or accident for subsequent cycles can be found in the Supplemental Reload Licensing Report.

15.0.3.4 Barrier Performance This section primarily evaluates the performance of both the RCPB and the containment system during transients and accidents.

During transients that occur with no release of coolant to the containment, only RCPB performance is considered. If release to the containment occurs, as in the case of limiting faults, then challenges to the containment are evaluated as well.

Containment integrity is maintained as long as internal pressures remain below the maximum allowable values. The design internal pressures are as follows:

Drywell (primary containment) 55 psig Suppression Chamber (Primary Containment) 55 psig Secondary Containment 7 in H2O CHAPTER 15 15.0-9 REV. 19, SEPTEMBER 2018

LGS UFSAR The LOCA radiological analyses account for the radiation released from the secondary containment during the time that the pressure exceeds minus 0.25 inch wg.

Damage to any of the radioactive material barriers as a result of accident-initiated fluid impingement, and jet forces, is considered in the other portions of the UFSAR where mechanical design features of the systems and components are described. Design basis accidents are used in determining the size and strength requirements of the essential nuclear system components. A comparison of the accidents considered in this section with those used in the mechanical design of equipment reveals that either the applicable accidents are the same, or that the accident in this section results in less severe stresses than those assumed for mechanical design.

15.0.3.5 Radiological Consequences In this chapter, the consequences of radioactivity release during the three types of events are considered:

a. Incidents of moderate frequency (anticipated operational transients)

b. Infrequent incidents (abnormal operational transients)

c. Limiting faults (DBA).

For all transients, or accidents, whose consequences are limiting, a detailed quantitative evaluation is presented. For nonlimiting transients, or accidents, a qualitative evaluation is presented, or results are referenced from a more limiting or enveloping case.

The original plant design basis included the analyses of radiological consequences based on the source terms of TID-14844 and Regulatory Guides 1.3, 1.5 and 1.25.

Regulation 10CFR50.67, "Accident Source Term," provides a mechanism to replace the traditional TID-14844 accident source term with an "Alternative Source Term" (AST). The methodology of approach to this replacement is provided in Regulatory Guide 1.183 and its associated Standard Review Plan 15.0.1.

In support of a full scope implementation of AST in accordance with Regulatory Guide 1.183, AST radiological consequence analyses were performed for the four Design Basis Accidents that result in offsite exposures. These include the Loss of Coolant Accident (LOCA), Main Steam Line Break (MSLB). Fuel Handling Accident (FHA) and Control Rod Drop Accident (CRDA). The dose consequences for these accidents are discussed elsewhere in Chapter 15 and result in doses that are within the guidelines of 10CFR50.67.

Although only the four major accidents have been evaluated using the AST methodology, the AST analytical methods described in Regulatory Guide 1.183 and dose limits defined in 10CFR50.67 comprise the design basis for Limerick for all design basis accidents.

Short-term, site specific X/Qs were calculated as described in Section 2.3 and are shown in Table 15.0-4.

15.0.4 REGULATORY GUIDE CONFORMANCE The regulatory guides pertinent to accident analyses, and LGS conformance, are as follows:

CHAPTER 15 15.0-10 REV. 19, SEPTEMBER 2018

LGS UFSAR Regulatory Guide 1.3 (Radiological Consequences of a LOCA)

The Limerick original LOCA dose consequences were determined in accordance with Regulatory Guide 1.3. With the implementation of Alternative Source Term in accordance with 10CFR50.67, the dose consequence analytical methodology of Regulatory Guide 1.183 applies and supercedes the methodology of Regulatory Guide 1.3. LGS is in conformance with Regulatory Guide 1.183 requirements.

Regulatory Guide 1.5 (Radiological Consequences of a Steam Line Break)

The Limerick original main steam line break dose consequences were determined in accordance with Regulatory Guide 1.5. With the implementation of Alternative Source Term in accordance with 10CFR50.67, the dose consequence analytical methodology of Regulatory Guide 1.183 applies and supercedes the methodology of Regulatory Guide 1.5. LGS is in conformance with Regulatory Guide 1.183 requirements.

Regulatory Guide 1.25 (Radiological Consequences of a Fuel Handling Accident)

The Limerick original fuel handling accident dose consequences were determined in accordance with Regulatory Guide 1.25. With the implementation of Alternative Source Term in accordance with 10CFR50.67, the dose analytical methodology of Regulatory Guide 1.183 applies and supercedes the methodology of Regulatory Guide 1.25. LGS is in conformance with Regulatory Guide 1.183 requirements as noted in NRC Safety Evaluation Reports dated September 8, 2006, and March 15, 2017.

Regulatory Guide 1.49 (Power Levels of Nuclear Power Plants).

The power levels assumed in the analyses are in accordance with this guide.

NOTE: Transient analyses were performed at the licensed rated thermal power of 3515 MWt for the first reload for MUR operation. Radiological consequences evaluated for the Power Rerate Project are bounding because they were performed at a power level of 3527 MWt (102% of the Power Rerate Project thermal power of 3458 MWt).

Regulatory Guide 1.98 (radiological consequences of an offgas system failure).

LGS is in conformance with this guide, with the following clarifications:

a. In reference to Paragraph c.4.a of the guide, the LGS total whole body dose is calculated based upon the radiation at a depth of 5 cm, the average depth of the blood-forming organs. This is standard practice and is endorsed for use in Appendix E, Paragraph 3, of Regulatory Guide 1.109 (doses for routine releases).

b. Dose conversion factors are taken from the most recent data available, rather than the reference given in Paragraph c.4.b of the guide.

Regulatory Guide 1.183 (Alternative Source Terms for Evaluating Design Basis Accidents)

Regulation 10CFR50.67, "Accident Source Term, "provides a mechanism to replace the traditional TID-14844 accident source term with an "Alternative Source Term" (AST). The CHAPTER 15 15.0-11 REV. 19, SEPTEMBER 2018

LGS UFSAR methodology of approach to this replacement is provided in Regulatory Guide 1.183 and its associated Standard Review Plan 15.0.1.

In support of a full scope implementation of AST in accordance with Regulatory Guide 1.183, AST radiological consequence analyses were performed for the four Design Basis Accidents that result in offsite exposures. These include the Loss of Coolant Accident (LOCA), Main Steam Line Break (MSLB), Fuel Handling Accident (FHA) and Control Rod Drop Accident (CRDA). The dose consequences for these accidents are discussed elsewhere in Chapter 15 and result in doses that are within the guidelines of 10CFR50.67.

Although only the four major accidents have been evaluated using the AST methodology, the AST analytical methods described in Regulatory Guide 1.183 and dose limits defined in 10CFR50.67 comprise the design basis for Limerick for all design basis accidents.

LGS is in conformance with the requirements of Regulatory Guide 1.183 as noted in NRC Safety Evaluation Reports dated September 8, 2006, and March 15, 2017.

15.0.5 NUCLEAR SAFETY OPERATIONAL ANALYSIS RELATIONSHIP Section 15.9 is a comprehensive, total plant, system level, qualitative FMEA, relative to all the Chapter 15 events considered, the protective sequences utilized to accommodate the transients, or accidents, and their effects, and the systems involved in the protective actions.

Interdependency of analysis, and cross-referral of protective actions, are an integral part of this chapter and the section.

A summary table that classifies events by frequency only (i.e., not just within a given category such as decrease in core coolant temperature) is in Section 15.9.

15.0.6 LICENSING BASIS VS. EMERGENCY PROCEDURE GUIDELINES The NRC Staff review of the BWR Owners' Group Emergency Procedure Guidelines (EPGs),

Revision 4 (NEDO-31331, March 1987) is documented in an NRC Safety Evaluation Report (SER) dated September 12, 1988. In this SER, the NRC Staff concluded that the guidelines are acceptable for implementation; however, the NRC stated that each BWR Licensee who wishes to incorporate Revision 4 of the EPGs should assure that the EPGs will not impact its licensing bases.

To ensure that implementation of EPGs, Rev. 4 did not conflict with the LGS licensing based analyses, a review of the Cycle 1 analyzed transients was conducted. This review (documented in reference 15.0-6) identified the Pressure Regulator Failure-Open Direction event as the only analyzed transient in which operator action, as instructed by the Transient Response Implementation Plan (TRIP) Procedures, could interfere with the analyzed transient response as discussed in Section 15. For the Pressure Regulator Failure-Open Direction transient, it was concluded that procedural actions are sufficient to make the end result for the transient the same as that analyzed in Section 15.

This review was performed based on the following position regarding Licensing Basis vs. EPGs:

Implementation of the TRIP procedures for events within the design basis does not conflict with the licensing basis as long as the successful implementation of operator actions CHAPTER 15 15.0-12 REV. 19, SEPTEMBER 2018

LGS UFSAR makes the end result for the transient response the same as or more conservative than that analyzed in the UFSAR.

The Revision 4 BWROG EPGs already included, to a considerable degree, operator actions required to prevent or mitigate what are termed severe accidents (considered to begin with the onset of core damage). Subsequent to the issue of the Revision 4 EPGs, the preparation of Individual Plant Examinations (IPE) for nuclear plants, in conjunction with industry research, have provided additional severe accident mitigation information that was not available during the development of the Revision 4 EPGs. To ensure that the EPG strategies reflect the most current severe accident mitigation information available, a review of the EPG strategies, to the additional available severe accident mitigation information, was conducted. As a result of this review, the BWROG developed the Emergency Procedure and Severe Accident Guidelines (EPG/SAG). The SAG, together with the modified EPGs, form an integrated set of symptomatic instructions that attempt to cover all possible mechanistic accident sequences. The EPGs contain strategies applicable prior to the transition to a severe accident, and the SAG contain strategies applicable after the transition. EPG/SAG has superseded EPG, Revision 4 as the basis for the Emergency Operating Procedures (EOPs) at LGS. An NRC SER does not exist for the Emergency Procedure and Severe Accident Guidelines (EPG/SAG), Rev. 3.

To ensure that the implementation of EPG/SAG did not conflict with the LGS licensing-based analysis, a review of the SAR analyzed accidents, transients, and special events was conducted.

The conclusions of this review are contained in the 10CFR50.59 Reviews prepared for the Plant Specific Technical Guidelines (PSTGs) and Plant Specific Severe Accident Management Guidelines (PSSAMGs) which support the transition from EPG, Revision 4 to EPG/SAG. Plant-unique variations from the EPG/SAG guidance have been evaluated in the 10CFR50.59 Reviews, the Plant Specific Technical Guidelines (PSTGs), and the Plant Specific Severe Accident Management Guidelines (PSSAMGs).

15.

0.7 REFERENCES

15.0-1 Regulatory Guide 1.70 (Rev 3), "Standard Format and Content of Safety Analysis Report for Nuclear Power Plants, Light-Water Reactor Edition," NRC, (November 1978).

15.0-2 "General Electric BWR Thermal Analysis Basis (GETAB): Data, Correlation and Design Application," NEDO-10958-A, GE, (January 1977).

15.0-3 R.B. Linford, "Analytical Methods of Plant Transient Evaluations for the General Electric Boiling Water Reactor", NEDO-10802, GE, (April 1973).

15.0-4 NEDO-24154, "Qualification of the One-Dimensional Core Transient Model for Boiling Water Reactors", GE, (October 1978).

15.0-5 F. Odar et al, "Safety Evaluation for the General Electric Topical Report:

Qualification of the One-Dimensional Core Transient Model for Boiling Water Reactors", NEDO-24154 and NEDE-24154-P, Volumes I, II, III, GE, (1980).

15.0-6 Design Analysis dated May 14, 1990, for resolution of Justification for Continued Operation L-90-050-001, Mode Switch Position Vs. Accident Analysis.

15.0-7 "Power Rerate Safety Analysis Report for Limerick Generating Station Units 1 and 2, " NEDC-32225P, GE, (September 1993).

CHAPTER 15 15.0-13 REV. 19, SEPTEMBER 2018

LGS UFSAR 15.0-8 "Generic Guidelines for General Electric Boiling Water Reactor Power Uprate,"

NEDO-31897, GE, (February 1992), and NEDC-31897P-A, GE (May 1992).

15.0-9 "Generic Evaluations of General Electric Boiling Water Reactor Power Uprate,"

Volume I, NEDC-31984P, GE, (July 1991).

15.0-10 "Maximum Extended Load Line Limit and ARTS Improvement Program Analyses for Limerick Generating Station Units 1 and 2", NEDC-32193P, Revision 2, GE, (October 1993).

15.0-11 "Safety Review for Limerick Generating Station Units 1 and 2 110% Increased Core Flow Operation", NEDC-32224P, July 1993.

15.0-12 General Electric Standard Application for Reactor Fuel, including the United States Supplement, NEDE-24011-P-A and NEDE-24011-P-A-US, (Latest Approved Revision).

15.0-13 Migration to TRACG04 / PANAC11 from TRACG02 / PANAC10 for TRACG AOO and ATWS Overpressure Transients, NEDE-32906P Supplement 3-A, Revision 1, April 2010.

15.0-14 GE-Hitachi Nuclear Energy, 0000-0077-4603-R1, "BWR Owners Group Evaluation of Steam Flow Induced Error (SFIE) Impact on the L3 Setpoint Analytic Limit", October 2008.

15.0-15 "Methodology and Uncertainties for Safety Limit MCPR Evaluations," NEDC-32601P-A, August 1999.

15.0-16 "Power Distribution Uncertainties for Safety Limit MCPR Evaluations," NEDC-32694-A, August 1999.

CHAPTER 15 15.0-14 REV. 19, SEPTEMBER 2018

LGS UFSAR Table 15.0-1* (See Note)

SUMMARY

OF INITIAL CORE TRANSIENTS MAXIMUM CORE AVERAGE MAXIMUM SURFACE NO. OF MAXIMUM MAXIMUM MAXIMUM STEAM HEAT VALVES DURATION NEUTRON DOME VESSEL LINE FLUX 1ST OF UFSAR FIGURE FLUX PRESSURE PRESSURE PRESSURE % OF FREQUENCY BLOW- BLOWDOWN SECTION NO. DESCRIPTION  % NBR (psig) (psig) (psig) INITIAL CPR(2) CATEGORY(1) DOWN (sec) 15.1 DECREASE IN CORE COOLANT TEMPERATURE 15.1.1 15.1-2 Loss of Feedwater Heater, Manual Flow Control 127.7 1030.0 1069.0 1016.0 119.4 0.16 a 0 0.0 15.1.2 15.1-3 Feedwater Controller Failure, Maximum Demand, 135.4% Flow(3) 156.3 1168 1194 1165 105.0 0.06 a 14 6.0 15.1.2 15.1-1 Feedwater Controller Failure Maximum Demand, Bypass Off 135.4% Flow(3) 216.6 1204 1231 1200 110.2 0.11 b 14 15.1.3 15.1-4 Pressure Regulator Failure - Open 104.3 1149.0 1165.0 1148.0 100.3 <0.06(4) a 5 3.2 15.1.4 - Inadvertent Opening of Safety or Relief Valve See Section 15.1 b 15.1.6 - Inadvertent RHR Shutdown Cooling Operation See Section 15.1 a 15.2 - INCREASE IN REACTOR PRESSURE 15.2.1 - Pressure Regulator Failure - Closed See Sections 15.2.2 and 15.2.3 (Bypass on) a 15.2.2 15.2-1 Generator Load Rejection, Trip Scram, Bypass, and RPT - On(3) 178.5 1169 1193 1164 101.2 0.03 a 14 6.0 CHAPTER 15 15.0-15 REV. 13, SEPTEMBER 2006

LGS UFSAR Table 15.0-1 (Cont'd)*

MAXIMUM CORE AVERAGE MAXIMUM SURFACE NO. OF MAXIMUM MAXIMUM MAXIMUM STEAM HEAT VALVES DURATION NEUTRON DOME VESSEL LINE FLUX 1ST OF PRESSUR UFSAR FIGURE FLUX PRESSURE PRESSURE E  % OF FREQUENCY BLOW- BLOWDOWN SECTION NO. DESCRIPTION  % NBR (psig) (psig) (psig) INITIAL CPR(2) CATEGORY(1) DOWN (sec) 15.2.2 15.2-2 Generator Load Rejection, Trip Scram, Bypass - Off, 222.5 1200 1225.0 1196.0 106.2 0.08 a(6) 14 12.7 RPT - On(3) 15.2.3 15.2-3 Turbine Trip, Trip Scram, and RPT - On 163.3 1174.0 1196.0 1169.0 102.0 <0.16(4) a 14 5.8 15.2.3 15.2-4 Turbine Trip, Trip Scram, Bypass - Off, RTP - On(3) 198.4 1198 1223.0 1195.0 104.5 0.06 a(6) 14 12.6 15.2.4 15.2-5 MSIV Closure, Position Switch Scram 190.9 1187.0 1220.0 1185.0 100.0 <0.06(4) a 14 11.5 (4) 15.2.5 15.2-6 Loss of Condenser Vacuum 160.9 1172.0 1194.0 1168.0 101.9 <0.06 a 14 10.8 15.2.6 15.2-7 Loss of Auxiliary Power Transformer See Loss of All Grid Connections 15.2.6 15.2-8 Loss of All Grid Connections 178.5 1168.4 1175.4 1164.2 101.3 <0.06(4) a 14 4.8 15.2.7 15.2-9 Loss of All Feedwater Flow 104.3 1144.0 1155.0 1144.0 100.0 <0.06(4) a 5 2.2 15.2.8 - Feedwater Line Break See Table 15.0-3, event 15.6.6 15.2.9 - Failure of RHR Shutdown Cooling See Section 15.2 15.3 - DECREASE IN REACTOR COOLANT SYSTEM FLOW RATE 15.3.1 15.3-1 Trip of One Recirculation Pump Motor 104.3 1021.0 1057.0 1011.0 100.0 <0.06(4) a 0 0.0 CHAPTER 15 15.0-16 REV. 13, SEPTEMBER 2006

LGS UFSAR Table 15.0-1 (Cont'd)*

MAXIMUM CORE AVERAGE MAXIMUM SURFACE NO. OF MAXIMUM MAXIMUM MAXIMUM STEAM HEAT VALVES DURATION NEUTRON DOME VESSEL LINE FLUX 1ST OF UFSAR FIGURE FLUX PRESSURE PRESSURE PRESSURE  % OF FREQUENCY BLOW- BLOWDOWN SECTION NO. DESCRIPTION  % NBR (psig) (psig) (psig) INITIAL CPR(2) CATEGORY(1) DOWN (sec) 15.3.1 15.3-2 Trip of Both Recirculation Pump Motors 104.3 1149.0 1160.0 1148.0 100.1 <0.06(4) a 5 3.0 15.3.2 - Recirculation Flow Control Failure - Decreasing Flow See Section 15.3.1 a 15.3.3 15.3-3 Seizure of One Recirculation Pump 104.3 1023.0 1057.0 1013.0 102.2 <0.16(4) c 0 0.0 15.3.4 - Recirculating Pump Shaft Break See Section 15.3.3 c 15.4 - REACTIVITY AND POWER DISTRIBUTION ANOMALIES 15.4.1.1 - Rod Withdrawal Error -

Refueling See Section 15.4 b 15.4.1.2 - Rod Withdrawal Error -

Startup See Section 15.4 b 15.4.2 - Rod Withdrawal Error -

At Power See Section 15.4 b 15.4.3 - Control Rod Misoperation See Sections 15.4.1 and 15.4.2 b 15.4.4 15.4-2 Abnormal Startup of Idle (5)

Recirculation Loop 454.9 981.0 996.0 977.0 150.8 a 0 0.0 15.4.5 15.4-3 Recirculation Flow Control (5)

Failure - Increasing Flow 382.3 982.0 1001.0 978.0 145.1 a 0 0.0 15.4.7 - Misplaced Bundle Accident See Section 15.4 b 15.4.9 - Rod-Drop Accident See Section 15.4 c CHAPTER 15 15.0-17 REV. 13, SEPTEMBER 2006

LGS UFSAR Table 15.0-1 (Cont'd)*

MAXIMUM CORE AVERAGE MAXIMUM SURFACE NO. OF MAXIMUM MAXIMUM MAXIMUM STEAM HEAT VALVES DURATION NEUTRON DOME VESSEL LINE FLUX 1ST OF UFSAR FIGURE FLUX PRESSURE PRESSURE PRESSURE  % OF FREQUENCY BLOW- BLOWDOWN SECTION NO. DESCRIPTION  % NBR (psig) (psig) (psig) INITIAL CPR(2) CATEGORY(1) DOWN (sec) 15.5 - INCREASE IN REACTOR COOLANT INVENTORY 15.5.1 15.5-1 Inadvertent HPCI Pump Start 118.8 1020.0 1059.0 1007.0 107.6 <0.16(4) a 0 0.0 15.5.3 - BWR Transients See appropriate events in Sections 15.1 and 15.2 (1) a = Incidents of moderate frequency b = Infrequent incidents c = Limiting faults (2)

CPRs are based on initial CPR that would yield a MCPR of 1.06.

(3)

Results do not include adjustment factors and utilize EOC parameters (Reference 15.0-4).

(4)

Estimated value, based on comparison with the most severe transient in the pressurization or nonpressurization category.

(5)

These events are postulated to occur at low power and low flow conditions; a larger thermal margin is maintained above the safety limit prior to the event occurrence. Therefore, the resulting MCPR is well above 1.06.

(6)

These events are classified as moderate frequency events for analysis purposes, pending the final resolution of this generic issue, as discussed in Sections 15.2.2.1.2.2 and 15.2.3.1.2.2.

• NOTE: The information in this table is based on the original design conditions. The results of transient analyses performed rerated conditions are tabulated in Table 15.0-1A CHAPTER 15 15.0-18 REV. 13, SEPTEMBER 2006

LGS UFSAR Table 15.0-1A TRANSIENT ANALYSIS RESULTS (Power Rerate Conditions)

Unit 1 Cycle 5 Characteristics PEAK PEAK PEAK NEUTRON HEAT VESSEL SYSTEM UFSAR INITIAL (B) FLUX FLUX PRESS CPR (c) RESPONSE SECTION TRANSIENT(A) POWER/FLOW (%NBR) (%NBR) (psig) GE8x8NB/GE11 CURVES 15.2.3 TTNB P100RP/100F 446 119 1271 0.17/0.25 Fig. 15.2-4 TTNBP(h) 100RP/110F 328 113 1265 0.21 TTNBP 100RP/110F 482 120 1272 0.17/0.24 TTNBP 100RP/81F 362 117 1269 0.12/0.25 TTNBP(d) 100RP/110F 638 126 1276 0.22/0.30 TTNBP(d) 100RP/81F 415 120 1270 0.14/0.27 15.2.2 LRNBP 100RP/100F 429 118 1270 0.15/0.25 Fig. 15.2-2 LRNBP(h) 100RP/110F 332 115 1266 0.22 LRNBP(d) 100RP/110F 631 128 1276 0.22/0.32 Fig. 15.2-14 15.1.2 FWCF(e) 100RP/100F 348 122 1218 0.15/0.22 Fig. 15.1-3 FWCF(e) 100RP/100F 348 122 1218 0.15/0.22 FWCF(e) 100RP/81F 314 119 1217 0.11/0.22 FWCF(e,f) 100RP/110F 500 129 1259 0.21/0.28 Fig.15.1-1 FCWF(e,f) 100RP/81F 450 127 1260 0.16/0.29 FWCF(d,e,f) 100RP/110F 647 136 1263 0.24/0.33 FWCF(d,e,f) 100RP/81F 509 131 1261 0.18/0.31 15.5.1 HPCI,BOC 102RP/100F 112 109 1082 N/A Fig. 15.5-1 HPCI,BOC 102RP/81F 112 110 1077 N/A 15.0.1 LFWH,EOC 100RP/110F N/A N/A N/A 0.08 LFWH,BOC 100RP/81F N/A N/A N/A 0.09 LFWH,MOC 100RP/81F N/A N/A N/A 0.09 15.4.2 RWE 100RP/100F N/A N/A N/A 0.13 15.3.3 RPSE,EOC 102RP/100F 102 102 1085 N/A Fig. 15.3-3 15.2.4 MSIVF 102RP/110F 536 131 1314 N/A MSIVF(g) 102RP/110F 536 131 1342 N/A Fig. 15.2-1 CHAPTER 15 15.0-19 REV. 13, SEPTEMBER 2006

LGS UFSAR Table 15.0-1A (Contd)

TRANSIENT ANALYSIS RESULTS FOR POWER RERATE (UNIT 1 CYCLE 5 CHARACTERISTICS)

Footnote (a) TTNBP = turbine trip with no bypass LRNBP = load rejection with no bypass FWCF = feedwater controller failure to maximum demand MSIVF = main steam isolation valve closure, flux scram HPCI = inadvertent actuation of high pressure coolant injection system LFWH = loss of 100 feedwater heating RWE = rod withdrawal error BOC, MOC, EOC = beginning-of-cycle 5, mid-of-cycle 5, end-of-cycle 5 RPSE = recirculation pump seizure (b) 100RP = rerate power of 3458 MWt 100F = rated core flow of 100.0 Mlb/hr 110F = ICF flow point (110M lb/hr) at rerate power 81F = MELLL flow point (81M lb/hr) at rerate power (c) CPR based on initial CPR which yields MCPR = 1.07, uncorrected for ODYN options A and B for TTNBP, LRNBP and FWCF events. GE8x8NB refers to the most limiting of all the 8x8 array fuel types in LGS Units 1 Cycle 5 core.

(d) EOC-RPT out-of-service (EOC-RPTOOS)

(e) Reduced feedwater temperature f 320F (105F reduction at rerate conditions).

(f) Turbine bypass valves out-of service (TBVOOS)

(g) Three SRVs out-of-services (3SRVOOS)

(h) Unit 1, Cycle 8, TCV modified for full arc admission, GE 13 fuel.

CHAPTER 15 15.0-20 REV. 13, SEPTEMBER 2006

LGS UFSAR Table 15.0-2 INPUT PARAMETERS AND INITIAL CONDITIONS FOR INITIAL CORE TRANSIENTS*

1. Thermal power level, MWt Warranted value 3.293x10+3 Analysis value - radiological 3.458x10+3 consequence

- transient analysis 3.435x10+3

2. Steam flow, lb/hr Warranted value 1.416x10+7 Analysis value 1.486x10+7

3. Core flow, lb/hr 1.0x10+8

4. Feedwater flow rate, lb/sec Warranted value 3.958x10+3 Analysis value 4.129x10+3

5. Feedwater temperature,F 4.25x10+2

6. Vessel dome pressure, psig 1.020x10+3

7. Vessel core pressure, psig 1.031x10+3

8. Turbine bypass capacity, % NBR 2.5x10+1

9. Core coolant inlet enthalpy, Btu/lb 5.266x10+2

10. Turbine inlet pressure, psig 9.6x10+2

11. Fuel lattice P8x8R

12. Core average gap conductance, Btu/sec-ft2-F 0.1744

13. Core leakage flow, % 12

14. Required MCPR operating limit See Figure 15.0-3 and Table 15.0-5

15. MCPR safety limit 1.06

• Information for Cycle 1 analysis. The inputs and initial conditions for power rerate are tabulated in Table 15.0-2A.

CHAPTER 15 15.0-21 REV. 17, SEPTEMBER 2014

LGS UFSAR Table 15.0-2 (Cont'd)*

16. Doppler coefficient, -¢/F Nominal EOC-1 2.29x10-1 Analysis data(3) 2.06x10-1

17. Void coefficient, -¢/% Rated voids Nominal EOC-1 7.61 Analyses data for power increase events(3) 1.271x10+1 Analyses data for power decrease events 3.63

18. Core average rated void fraction, % 4.345x10+1

19. Scram reactivity, $k Analysis data(3) Figure 15.0-2

20. CRD speed, position versus time Figure 15.0-2

21. Jet pump ratio, M 2.0

22. SRV capacity, % NBR At 1142.0 psig 8.74x10+1 Manufacturer Target Rock Quantity installed 14

23. Safety/relief function delay, seconds 4.0x10-1

24. Safety/relief function response, seconds 1.5x10-1

25. Setpoints for SRVs(2)

Safety/relief function, psig 1142.0, 1152.0, 1162.0

26. Number of valve groups simulated Safety/relief function, Number 3

27. High flux trip, % NBR Analysis setpoint (121.0 x 1.043) 1.262x10+2

28. High pressure scram setpoint, psig 1.071x10+3

• Information for Cycle 1 analysis. The inputs and initial conditions for power rerate are tabulated in Table 15.0-2A.

CHAPTER 15 15.0-22 REV. 17, SEPTEMBER 2014

LGS UFSAR Table 15.0-2 (Cont'd)*

29. Vessel level trips, feet above bottom of separator skirt (42.83 ft above vessel zero)

Level 8 - (L8), feet 6.018 Level 4 - (L4), feet 3.625 Level 3 - (L3), feet (4) 1.750 Level 2 - (L2), feet -3.708

30. Recirculation pump trip delay, seconds 1.75x10-1

31. Recirculation pump trip inertia time constant for analysis, seconds (1) 4.5

32. Total steam line volume, ft3 6.015x10+3 (1)

The inertia time constant is defined by the expression:

t = 2Jon gTo where t = inertia time constants (sec)

Jo = pump motor inertia (lb-ft2) n = pump speed (rps) g = gravitational constant (ft/sec2)

To = pump shaft torque (lb-ft)

(2)

Safety analyses are conservatively based on these setpoints. Actual setpoints are 1130 psig, 1140 psig, and 1150 psig.

(3)

Applicable to events analyzed using model described in Reference 15.0-3.

(4)

The L3 Analytical value in this table may be slightly different for various events due to a steam flow induced process measurement error. However, as described in Reference 15.0-13 the impact of the change is not significant and the event descriptions or conclusions need not be modified.

• Information for Cycle 1 analysis. The inputs and initial conditions for power rerate are tabulated in Table 15.0-2A.

CHAPTER 15 15.0-23 REV. 17, SEPTEMBER 2014

LGS UFSAR Table 15.0-2A INPUT PARAMETERS AND INITIAL CONDITIONS FOR TRANSIENTS (Unit 1, Cycle 5)(5)

1. Thermal power level, MWt Rated value 3458 Analysis value - radiological 3527 consequence

- transient analysis 3458

2. Steam flow, lb/hr (rated) 15.0x106

3. Core flow, lb/hr (maximum core flow assumed) 1.1x108

4. Feedwater flow rate, lb/hr (rated) 15.0x106

5. Feedwater temperature,F 425

6. Vessel dome pressure, psig 1045

7. Vessel core pressure, psig 1060

8. Turbine bypass capacity, % NBR(4) 20.1

9. Core coolant inlet enthalpy, Btu/lb 532.9 (Corresponding to 110% core flow)

10. Turbine inlet pressure, psig 990

11. Fuel lattice GE8x8NB, GE11

12. Core average gap conductance, Btu/sec-ft2-F 0.3568

13. Core leakage flow, % 12

14. Required MCPR operating limit See Figure 15.0-3 and Table 15.0-5

15. MCPR safety limit 1.07 CHAPTER 15 15.0-24 REV. 17, SEPTEMBER 2014

LGS UFSAR Table 15.0-2A (Cont'd)

16. Doppler coefficient, -¢/F (at 100% rerated power, 0.19 100% rated core flow)

17. Void coefficient, -¢/% Rated voids (at 100% rerated power, 10.18 100% rate core flow)

18. Core average rated void fraction, % 4.061

19. Scram reactivity, $k Analysis data(3) Figure 15.0-2

20. CRD speed, position versus time Figure 15.0-2

21. Jet pump ratio, M 2.0

22. SRV capacity, % NBR At 1142.0 psig 8.74x10+1 Manufacturer Target Rock Quantity installed 14

23. Safety/relief function delay, seconds 4.0x10-1

24. Safety/relief function response, seconds 1.5x10-1

25. Setpoints for SRVs(2)

Safety/relief function, 1182, 1192 1202

26. Number of valve groups simulated Safety/relief function, Number 3

27. High flux trip, % NBR Analysis setpoint (121.0 x 1.05) 1.27.05

28. High pressure scram setpoint, psig 1111 CHAPTER 15 15.0-25 REV. 17, SEPTEMBER 2014

LGS UFSAR Table 15.0-2A (Cont'd)

29. Vessel level trips, inches above vessel zero Level 8 - (L8), inches 586.5 Level 4 - (L4), inches 556 Level 3 - (L3), inches (6) 535 Level 2 - (L2), inches 469.5

30. Recirculation pump trip delay, seconds 1.75x10-1

31. Recirculation pump trip inertia time constant for analysis, seconds (1) 4.5

32. Total steam line volume, ft3 6.015x10+3 (1)

The inertia time constant is defined by the expression:

t = 2Jon gTo where t = inertia time constants (sec)

Jo = pump motor inertia (lb-ft2) n = pump speed (rps) g = gravitational constant (ft/sec2)

To = pump shaft torque (lb-ft)

(2)

Power Re-Rate safety analyses are conservatively based on these setpoints. Re-analysis for +3% setpoint tolerance used 1205, 1215, and 1226 psig (nominal +3% setpoint).

Actual setpoints are 1170 psig, 1180 psig, and 1190 psig.

(3)

Applicable to events analyzed using model described in Reference 15.0-3.

(4)

Assuming 7 of 9 valves operable. Total capacity of bypass system is 25.8% NBR (9 valves)

(5)

The data in this table is historical. For current Unit 1 and Unit 2 input parameters, see the cycle specific reload documents.

(6)

The L3 Analytical value in this table may be slightly different for various events due to a steam flow induced process measurement error. However, as described in Reference 15.0-13 the impact of the change is not significant and the event descriptions or conclusions need not be modified.

CHAPTER 15 15.0-26 REV. 17, SEPTEMBER 2014

LGS UFSAR Table 15.0-3

SUMMARY

OF ACCIDENTS FAILED FUEL RODS GE NRC WORST UFSAR CALCULATED CASE SECTION TITLE VALUE ASSUMPTION 15.3.3 Seizure of One None -

Recirculation Pump 15.3.4 Recirculation Pump None -

Shaft Break 15.4.9 Control Rod-Drop <770(1) 770(1)

Accident 15.6.2 Instrument Line Break None None 15.6.4 Steam System Pipe Break None None Outside Containment 15.6.5 LOCA Within RCPB None 100%

15.6.6 Feedwater Line Break None None 15.7.1.1 Main Condenser Offgas N/A N/A Treatment System Failure 15.7.3 Liquid Radwaste Tank N/A N/A Failure 15.7.4 Fuel Handling Accident <212 212 15.7.5 Cask-Drop Accident N/A N/A (1)

Evaluation of the dose consequences of the control rod drop accident using the methodology of Regulatory Guide 1.183 utilized a failure of 1200 fuel rods.

CHAPTER 15 15.0-27 REV. 14, SEPTEMBER 2008

LGS UFSAR Table 15.0-4 ATMOSPHERIC DISPERSION PARAMETERS TIME PERIODS - X/Q VALUES(1) 0-2 hr 0-8 hr 8-24 hr 1-4 days 4-30 days Exclusion Area 3.18x10-4 - - - -

Boundary (731 Meters)

Low Population - 5.79x10-5 4.10x10-5 1.95x10-5 6.68x10-6 Zone (2043 Meters)

(1)

Units for X/Q values are sec/m3.

CHAPTER 15 15.0-28 REV. 14, SEPTEMBER 2008

LGS UFSAR Table 15.0-5 REQUIRED OPERATING LIMIT CPR VALUES FOR INITIAL CORE TRANSIENTS*

Pressurization Events:

CPR (Option A)(1) CPR (Option B)(1)

Load Rejection Without Bypass 1.19 1.11 Turbine Trip Without Bypass 1.17 1.10 Feedwater Controller Failure 1.17 1.14 Load Rejection 1.14 1.07 Feedwater Controller Failure 1.22 1.19 Without Bypass Feedwater Controller Failure 1.30 1.23 Without Bypass and With EOC RPT Out-of-Service Load Rejection Without 1.28 1.17 Bypass and with EOC RPT Out-of-Service Nonpressurization Events:

CPR Rod Withdrawal Error(3) 1.21 Loss of Feedwater Heater 1.22(2)

(1)

Includes adjustment factors as specified in Reference 15.0-5.

(2)

Required OLCPR using either Option A or Option B adjustment factor without bypass with operable EOC RPT.

(3)

OLCPR value is obtained for the 107% rod block setpoint, control cell core analysis.

• Applies to Cycle 1 only. The updated rerate analysis information is contained in Table 15.0-1A.

CHAPTER 15 15.0-29 REV. 13, SEPTEMBER 2006

LGS UFSAR Table 15.0-6 TRANSIENTS WHERE NONSAFETY-GRADE SYSTEMS/COMPONENTS ARE ACTUATED DURING THE COURSE OF THE EVENT UFSAR NONSAFETY-GRADE SECTION TRANSIENT SYSTEM OR COMPONENT 15.1.2 Feedwater Controller Level 8 Turbine and Failure - Maximum Demand Feedwater Trip, Turbine Bypass 15.1.3 Pressure Regulator Level 8 Turbine and Failure - Open Feedwater Trip, Turbine Bypass 15.2.2 Generator Load Rejection Turbine Bypass(1) 15.2.3 Turbine Trip Turbine Bypass(1) 15.2.5 Loss of Condenser Vacuum Turbine Bypass 15.2.6 Loss of Ac Power Turbine Bypass 15.2.7 Loss of Feedwater Flow Recirculation Runback(2) 15.3.1 Recirculation Pump Trip - Level 8 Turbine Trip, Two Pumps Turbine Bypass 15.3.2 Recirculation Flow Control Level 8 Turbine Trip, Failure - Decreasing Flow Turbine Bypass 15.4.1 Rod Withdrawal Error - Low Rod Worth Minimizer Power System 15.4.2 Rod Withdrawal Error - At Rod Block Monitor Power (1)

Level 8 (high water level) trip potentially activated following the initial part of these events, but it is not a significant factor in fuel or vessel protection evaluation.

(2)

Neglected in the analysis.

CHAPTER 15 15.0-30 REV. 13, SEPTEMBER 2006

LGS UFSAR 15.1 DECREASE IN REACTOR COOLANT TEMPERATURE 15.1.1 LOSS OF FEEDWATER HEATING 15.1.1.1 Identification of Causes and Frequency Classification 15.1.1.1.1 Identification of Causes Feedwater heating can be lost in at least two ways:

a. Steam extraction line valves to one heater string are closed.

b. Feedwater train is isolated automatically by high water level in either the first or second heaters.

The first case produces a gradual cooling of the feedwater. The second case produces a slight cooling of the feedwater. In both cases the reactor vessel receives cooler feedwater. The maximum number of feedwater heaters that can be isolated by a single event represents the most severe transient for analysis considerations. This transient has been conservatively estimated to incur a loss of up to 100F of the feedwater heating capability of the plant and causes an increase in core inlet subcooling. This increases core power due to the negative void reactivity coefficient.

The design specification of the feedwater heater system requires that the maximum temperature decrease caused by a single failure should be less than or equal to 100F. In the unlikely event that a drop in feedwater temperature in excess of 100F occurs, and assuming no operator action, the decrease in the MCPR and increase in reactor power would still be bounded by the limiting event (i.e. generator load rejection trip with failure of bypass).

15.1.1.1.2 Frequency Classification The feedwater heating system is designed to provide and maintain adequate heating such that under any single failure condition, the loss of feedwater heating is limited to less than 100F. The loss of feedwater heating event is categorized as an incident of moderate frequency in the General Electric Standard Application for Reactor Fuel (Supplement for United States) (GESTAR II). This event is considered to be one of the limiting Anticipated Operational Occurrences (AOOs) events. Therefore, this transient is analyzed as an incident of moderate frequency; a 100F drop of feedwater temperature at full power is postulated.

15.1.1.2 Sequence of Events and System Operation 15.1.1.2.1 Sequence of Events Table 15.1-2 lists the sequence of events for this transient. An APRM Simulated Thermal Power Upscale alarm alerts the operator to insert control rods or to reduce recirculation flow. The operator should determine from existing tables the maximum allowable turbine-generator output with feedwater heaters out of service. If reactor scram occurs, the operator should monitor the reactor water level, pressure controls, and turbine-generator auxiliaries during coast-down.

CHAPTER 15 15.1-1 REV. 19, SEPTEMBER 2018

LGS UFSAR 15.1.1.2.2 System Operation In establishing the expected sequence of events and simulating plant performance, it is assumed that normal functioning occurs in the plant instrumentation and controls, plant protection, and reactor protection systems.

Required operation of ESF is not expected in either case for this transient. The APRM Simulated Thermal Power - Upscale scram is the primary protection system trip in mitigating the consequences of this event.

15.1.1.2.3 The Effect of Single Failures and Operator Errors This transient generally leads to an increase in reactor power level. Single failures are not expected to result in a more severe transient than analyzed. See Section 15.9 for a detailed discussion of this subject.

15.1.1.3 Core and System Performance 15.1.1.3.1 Mathematical Model Due to its slow progression, this event is treated as a quasi-steady-state transient and is analyzed with a steady-state, three dimensional BWR core simulator. The core simulator is used to evaluate the differences, including thermal margins, between the initial conditions of the event and the final equilibrium state point after the loss of feedwater heating.

15.1.1.3.2 Input Parameters and Initial Conditions These analyses have been performed, unless otherwise noted, with plant conditions as tabulated in Table 15.0-2A. The events are analyzed for full cycle exposures at the BOC, MOC, and EOC conditions in order to bound the LGS operating domain described in Appendix 15B.

In addition to the inadvertent loss of feedwater heating event, consideration has also been given to planned operation with partial feedwater heating as follows.

There are two distinct periods of concern when operating with reduced feedwater temperature:

a. Before EOC - Reducing the feedwater temperature before EOC may occur during routine maintenance. The peak pressure will be lower because of the reduced steam production. The basis for the plant safety analysis covers this operating condition, and a cycle specific analysis is performed to confirm the plant safety.

b. After EOC - Operating with reduced feedwater temperature may occur as a result of an extended fuel cycle. The basis for the plant safety analysis covers this operating condition, and a cycle specific analysis is performed to confirm the plant safety.

The safety analyses for operation with reduced feedwater temperature evaluates: anticipated operational transients, including the LFWH event; Design Basis Accidents, including LOCA containment response; thermal-hydraulic instability; and reactor vessel internals, including CHAPTER 15 15.1-2 REV. 19, SEPTEMBER 2018

LGS UFSAR feedwater nozzle and sparger fatigue. (Refer to Sections 15B.1.2 and 15B1.3 for more information.)

15.1.1.3.3 Results The LFWH event is initiated from a closure of a steam extraction line to a feedwater heater or when feedwater is bypassed around one or more feedwater heaters. In either case, the feedwater temperature is reduced and core inlet subcooling is gradually increased. As a result, core power increases due to the negative void reactivity coefficient.

Vessel steam flow increases and the system pressure increase is slight so the RCPB is not threatened. The increased core inlet subcooling aids core thermal margins and the minimum MCPR is maintained above the safety limit MCPR. The CPR for this event is 0.09 which is significantly less than the CPR for the limiting event (generator load rejection with bypass failure). Therefore, the safety limit is satisfied.

Sensitivity studies have shown that the effect of initial power level on core thermal margin is negligible, with the event occurring at high power slightly more severe.

The results at the low core flow condition (MELLL case) are actually slightly more severe than for the high core flow condition (ICF case) because of increased inlet subcooling into the reactor core.

15.1.1.3.4 Considerations of Uncertainties Important factors (such as reactivity coefficient, scram characteristics, magnitude of the feedwater temperature change) are assumed to be at the worst configuration so that any deviations seen in the actual plant operation reduce the severity of the transient.

15.1.1.4 Barrier Performance As noted above consequences of this transient do not result in any temperature or pressure transient in excess of the criteria for which the fuel, pressure vessel, or containment are designed; therefore, these barriers maintain their integrity and function as designed.

15.1.1.5 Radiological Consequences Since this transient does not result in any additional fuel failures or any release of primary coolant to either the secondary containment or the environment, there are no radiological consequences associated with this transient.

15.1.2 FEEDWATER CONTROLLER FAILURE - MAXIMUM DEMAND 15.1.2.1 Identification of Causes and Frequency Classification 15.1.2.1.1 Identification of Causes This transient is postulated on the basis of a single failure of a control device, specifically one which can directly cause an increase in coolant inventory by increasing the feedwater flow. The most severe applicable transient is a feedwater controller failure during maximum flow demand.

The feedwater controller is forced to its upper limit at the beginning of the transient.

CHAPTER 15 15.1-3 REV. 19, SEPTEMBER 2018

LGS UFSAR 15.1.2.1.2 Frequency Classification This transient is considered to be an incident of moderate frequency.

15.1.2.2 Sequence of Events and System Operation 15.1.2.2.1 Sequence of Events With excess feedwater flow the water level rises to the high level reference point at which time the feedwater pumps and the main turbine are tripped and a scram is initiated. Table 15.1-3 lists the sequence of events for Figure 15.1-3. The figure shows the changes in important variables during this transient.

The operator should:

a. Observe that high feedwater pump trip has terminated the failure event.

b. Switch the feedwater controller from automatic to manual control in order to try to regain a correct output signal.

c. Identify causes of the failure and report all key plant parameters during the transient.

15.1.2.2.2 System Operation To properly simulate the expected sequence of events, the analysis of this transient assumes normal functioning of plant instrumentation and controls, plant protection, and reactor protection systems. Important system operational actions for this transient are high level tripping of the main turbine, turbine stop valve scram trip initiation, RPT, and low water level initiation of the RCIC system and the HPCI system to maintain long-term water level control following tripping of feedwater pumps.

15.1.2.2.3 The Effect of Single Failures and Operator Errors In Table 15.1-3 the first sensed event to initiate corrective action to the transient is the vessel high water level (Level 8) trip. Multiple level sensors are used to sense and detect when the water level reaches the Level 8 setpoint. At this point in the logic, a single failure will not initiate or prevent a turbine trip signal. Turbine trip signal transmission, however, is not built to single failure criterion. The result of a failure at this point would have the effect of delaying the pressurization "signature." High levels in the turbine's moisture separators will result in a trip of the unit before high moisture levels enter the low pressure turbine.

Scram trip signals from the turbine are designed such that a single failure neither initiates nor impedes a reactor scram trip initiation. See Section 15.9 for a discussion of this subject.

CHAPTER 15 15.1-4 REV. 19, SEPTEMBER 2018

LGS UFSAR 15.1.2.3 Core and System Performance 15.1.2.3.1 Mathematical Model The predicted dynamic behavior has been determined using a computer simulated, analytical models of a generic direct-cycle BWR. The models are described in detail in Reference 15.0-4 (ODYN) and Reference 15.0-13 (TRACG). These computer models have been improved and verified through extensive comparison of their predicted results with BWR test data.

The nonlinear computer simulated analytical model is designed to predict associated transient behavior of this reactor. Some of the significant features of the ODYN model are:

a. An integrated one-dimensional core model is assumed which includes a detailed description of hydraulic feedback effects, axial power shape changes, and reactivity feedbacks.

b. The fuel is represented by an average cylindrical fuel and cladding node for each axial location in the core.

c. The steam lines are modeled by eight pressure nodes incorporating mass and momentum balances which will predict any wave phenomena present in the steam line during pressurization transient.

d. The core average axial water density and pressure distribution is calculated using a single channel to represent the heated active flow and a single channel to represent the bypass flow. A model, representing liquid and vapor mass and energy conservation, and mixture momentum conservation, is used to describe the thermal-hydraulic behavior. Changes in the flow split between the bypass and active channel flow are accounted for during transient events.

e. Principal controller functions such as feedwater flow, recirculation flow, reactor water level, and pressure and load demand, are represented together with their dominant nonlinear characteristics.

f. The ability to simulate necessary reactor protection system functions is provided.

g. The control systems and reactor protection system models are, for the most part, identical to those employed in the point reactor model, which is described in detail in Reference 15.0.4-2 and used in analysis for other transients.

The TRACG model has similar features except it is a three-dimensional model.

15.1.2.3.2 Input Parameters and Initial Conditions These analyses have been performed, unless otherwise noted, with the plant conditions as tabulated in Table 15.0-2A.

This event is typically analyzed at the limiting EOC (all-rods-out) statepoint, and at the limiting conditions (i.e. core flow, feedwater temperature, etc.), which bound the allowable LGS operating CHAPTER 15 15.1-5 REV. 19, SEPTEMBER 2018

LGS UFSAR domain (see Appendix 15B). The cycle-specific maximum feedwater system runout capability is specified, with 5% additional feedwater runout capability applied for conservatism. The results presented (LGS Unit 1, Cycle 5) are based on a 149% runout capability (144% + 5%) (where 100% feedwater flow is defined as 15.0x106lb/hr).

15.1.2.3.3 Results The simulated feedwater controller transient is shown in Figure 15.1-3. The high water level turbine trip and feedwater pump trip are initiated at approximately 8.6 seconds. Scram occurs simultaneously from stop valve closure and limits the neutron flux peak and fuel thermal transient so that no fuel damage occurs. MCPR remains considerably above the safety limit. The turbine bypass system opens to limit peak pressure at the bottom of the vessel to about 1218 psig.

Consequently, the nuclear system process barrier pressure limit is not endangered.

The bypass valves subsequently close to re-establish pressure control in the vessel during shutdown. The level would gradually drop to the low level isolation reference point, activating the RCIC/HPCI systems for long-term level control.

15.1.2.3.4 Consideration of Uncertainties All systems utilized for protection in this transient were assumed to have the most conservative allowable response (e.g., relief setpoints, scram stroke time, and reactivity characteristics).

Expected plant behavior is, therefore, expected to lead to a less severe transient.

15.1.2.4 Barrier Performance As noted above, the consequences of this transient do not result in any temperature or pressure transient in excess of the criteria for which the fuel, pressure vessel, or containment are designed; therefore, these barriers maintain their integrity and function as designed.

15.1.2.5 Radiological Consequences While the consequence of this transient does not result in fuel failure, it does result in the discharge of normal coolant activity to the suppression pool via MSRV operation. Because this activity is contained in the primary containment, there is no exposure to operating personnel. This transient does not result in an uncontrolled release to the environment, so the plant operator can choose to leave the activity bottled up in the containment or discharge it to the environment under controlled release conditions. If purging of the containment is chosen, the release will be in accordance with established technical specifications and, at the worst, would only result in a small increase in yearly integrated exposure level.

15.1.2.6 Additional Transients Evaluated Additional transients have been considered for LGS. Table 15.0-1A shows the peak transient responses for the various cases analyzed. For the ICF and the MELLL conditions, the FWCF event becomes more limiting due to the TBSOOS and the EOC-RPTOOS analysis assumptions.

The fuel thermal margin results are within the acceptable limits for the fuel types analyzed. The sequence of events with an inoperative bypass system is shown on Table 15.1-3 and the transient CHAPTER 15 15.1-6 REV. 19, SEPTEMBER 2018

LGS UFSAR parameters are on Figure 15.1-1. The MCPR values for these transients are also shown in Table 15.0-1A.

15.1.3 PRESSURE REGULATOR FAILURE - OPEN 15.1.3.1 Identification of Causes and Frequency Classification 15.1.3.1.1 Identification of Causes The total steam flow rate to the main turbine resulting from a pressure regulator malfunction is limited by a maximum flow limiter imposed at the turbine controls. This limiter is set to limit maximum steam flow to approximately 115% NBR.

If the controlling regulator fails, the backup controller will take over control with a bumpless switchover. If both controllers fail to the open position, the turbine control valves can be fully opened and the turbine bypass valves can be partially or fully opened until the maximum steam flow is established.

15.1.3.1.2 Frequency Classification This transient is categorized as an incident of moderate frequency.

15.1.3.2 Sequence of Events and System Operation 15.1.3.2.1 Sequence of Events This is a non-limiting event that has not been reanalyzed for power rerate. The sequence of events presented in Table 15.1-4 are based on Cycle 1 conditions. An analysis of this event for rerate conditions is not expected to result in a change in the general trends and characteristics as shown.

Table 15.1-4 lists the sequence of events for Figure 15.1-4.

When a fault is detected with the controlling pressure regulator and preceded by spurious or erratic behavior of the controlling device, an automatic "bumpless" failover will occur to the back-up redundant pressure regulator controller. The operator does not have the ability to select the primary or backup controller. If both controllers fail to the open position, and if the reactor scrams as a result of the isolation caused by the low pressure at the turbine inlet in the run mode, the following is the sequence of operator actions expected during the course of the Once isolation occurs the pressure will increase to a point where the relief valves open.

Operator actions for the case where high level (Level 8) trip occurs before the isolation are essentially identical. The operator should:

a. Monitor that all rods are in.

b. Monitor reactor water level and pressure.

c. Observe turbine coast-down and break vacuum before the loss of steam seals.

Check turbine auxiliaries.

d. Observe that the reactor pressure relief valves open at their setpoint.

CHAPTER 15 15.1-7 REV. 19, SEPTEMBER 2018

LGS UFSAR

e. Observe that RCIC and HPCI initiate on low water level.

f. Secure both HPCI and RCIC when reactor pressure and level are under control.

g. Monitor reactor water level and continue cooldown per the normal procedure.

h. Complete the scram report and initiate a maintenance survey of pressure regulator before reactor restart.

15.1.3.2.2 System Operation To simulate the expected sequence of events properly, the analysis of this transient assumes normal functioning of plant instrumentation and controls, plant protection, and reactor protection systems except as otherwise noted.

Initiation of HPCI and RCIC system functions will occur when the vessel water level reaches the Level 2 setpoint. Normal startup and actuation can take up to 30 seconds before full flow is realized. The 30 seconds is based on the cycle 1 conditions. This event was not reanalyzed for power rerate. If these events occur, they will follow sometime after the primary concerns of fuel thermal margin and overpressure effects have occurred, and are expected to be less severe than those already experienced by the system.

15.1.3.2.3 The Effect of Single Failures and Operator Errors This transient leads to a loss of pressure control such that the increased steam flow demand causes a depressurization. Instrumentation for pressure sensing of the turbine inlet pressure is designed to be single failure proof for initiation of MSIV closure.

Reactor scram sensing, originating from limit switches on the turbine stop valves, is designed to be single failure proof. It is therefore concluded that the basic phenomenon of pressure decay is adequately terminated. See Section 15.9 for a detailed discussion of this subject.

15.1.3.3 Core and System Performance 15.1.3.3.1 Mathematical Model The nonlinear dynamic model described in Reference 15.0-3 is used to simulate this transient.

15.1.3.3.2 Input Parameters and Initial Conditions This transient is simulated by assuming both the primary and backup regulator outputs to a high value, which causes the turbine admission valves and the turbine bypass valves to open fully.

Regulator failure with 135% steam flow was simulated as a worst case since 115% is the normal maximum flow limit.

A 5 second isolation valve closure instead of a 3 second closure is assumed when the turbine pressure decreases below the turbine inlet low pressure setpoint for main steam line isolation initiation. This is within the specification limits of the valve and represents a conservative assumption.

CHAPTER 15 15.1-8 REV. 19, SEPTEMBER 2018

LGS UFSAR This analysis has been performed, unless otherwise noted, using Cycle 1 plant conditions as listed in Table 15.0-2.

15.1.3.3.3 Results The results of this event are based on Cycle 1 conditions. An analysis of this event for current conditions is not expected to result in a change in the general trends and characteristics as shown.

A Pressure Regulator Failure-Open (PRFO), is non-limiting for fuel cladding integrity because the Critical Power Ratio (CPR) increases during the event, and they are not typically included in the scope of reload evaluations including uprate conditions and or raising the MSIV low pressure isolation setpoint. The following evaluation predicts that reactor vessel water level would swell during a PRFO transient; the depressurization would be terminated by a high level turbine trip.

Reactor vessel water level swell is difficult to predict and the reactor vessel water level swell portion of transient models have larger uncertainties than other portions of the transient models.

Recent evaluations by GE with improved transient models have determined that the reactor vessel water level swell may not be sufficient to reach the high level trip, in which case the depressurization could be terminated by MSIV closure at the LPIS. The analysis of this scenario is provided In References 15.1-2, 15.1-3 and 15.1-4.

Figure 15.1-4 shows the response of important nuclear system variables for this transient. The water level rises to the high level trip setpoint and initiates trip of the main turbine and feedwater turbines. Closure of the turbine stop valves initiates scram and RPT. After the pressurization resulting from the turbine stop valve closure, pressure again drops and continues to drop until the turbine inlet pressure is below the low turbine pressure isolation setpoint when the main steam line isolation finally terminates the depressurization.

Reactor high level trip limits the duration and severity of the depressurization so that no significant thermal-stresses are imposed on the nuclear system process barrier. After the rapid portion of the transient is complete, the MSRVs operate intermittently to relieve the pressure rise that results from decay heat generation. No significant reductions in fuel thermal margins occur. Because the rapid portion of the transient results in only momentary depressurization of the nuclear system, the MSRVs need operate only to relieve the pressure increase caused by decay heat, the nuclear system process barrier is not threatened by high internal pressure for this pressure regulator malfunction.

15.1.3.3.4 Consideration of Uncertainties If the maximum flow limiter were set higher or lower than normal, there would result a faster or slower loss in nuclear steam pressure. The rate of depressurization may be limited by the bypass capacity. For example, the turbine valves will open to the wide open state admitting slightly more than the rated steam flow, and with the limiter in this analysis set to fail at 135%, no more than 25% is expected to be bypassed. This is therefore not a limiting factor on this plant. If the rate of depressurization does change it will be terminated by the low turbine inlet pressure trip setpoint.

The depressurization rate has a proportional effect upon the voiding action of the core. If it is not large enough, the sensed vessel water level trip setpoint (Level 8) may not be reached and a CHAPTER 15 15.1-9 REV. 19, SEPTEMBER 2018

LGS UFSAR turbine and feedwater pump trip will not occur in the transient. In this case, the turbine inlet pressure will drop below the low pressure isolation setpoint and the expected transient signature will conclude with an isolation of the main steam lines. The reactor will be shut down by the scram initiated from MSIV closure.

15.1.3.4 Barrier Performance This is a non-limiting event that has not been reanalyzed for power rerate or for raising the MSIV low pressure isolation setpoint. The results presented are based on Cycle 1 conditions. An analysis of this event for rerate conditions is not expected to result in a change in the general trends and characteristics as shown. Raising the MSIV low pressure isolation setpoint would terminate the event sooner and be less limiting.

Barrier performance analyses are not required since the consequences of this transient do not result in any temperature or pressure transient in excess of the criteria for which fuel, pressure vessel, or containment are designed. Peak pressure in the bottom of the vessel reaches 1165 psig which is below the ASME code limit of vessel dome pressure, 1375 psig for the RCPB.

Vessel dome pressure reaches 1149 psig, just slightly below the setpoint of the second pressure relief group.

15.1.3.5 Radiological Consequences While the consequence of this transient does not result in fuel failure, it does result in the discharge of normal coolant activity to the suppression pool via MSRV operation. Because this activity is contained in the primary containment, there is no exposure to operating personnel. This transient does not result in an uncontrolled release to the environment, so the plant operator can choose to leave the activity bottled up in the containment or discharge it to the environment under controlled release conditions. If purging of the containment is chosen, the release will be in accordance with established technical specifications and, at the worst, would only result in a small increase in the yearly integrated exposure level.

15.1.4 INADVERTENT MAIN STEAM RELIEF VALVE OPENING 15.1.4.1 Identification of Causes and Frequency Classification 15.1.4.1.1 Identification of Causes Cause of inadvertent MSRV opening is attributed to malfunction of the valve or an operator initiated opening. Opening and closing circuitry at the individual valve level (as opposed to groups of valves) is subject to a single failure event. It is therefore simply postulated that a failure occurs and the transient is analyzed accordingly. Detailed discussion of the valve design is provided in Chapter 5.

15.1.4.1.2 Frequency Classification This transient is categorized as an infrequent incident. However, it is analyzed as an incident of moderate frequency.

15.1.4.2 Sequence of Events and System Operation 15.1.4.2.1 Sequence of Events CHAPTER 15 15.1-10 REV. 19, SEPTEMBER 2018

LGS UFSAR This is a non-limiting event that has not been reanalyzed for the power rerate. The sequence of events is based on Cycle 1 conditions. An analysis of this event for rerate conditions is not expected to result in a change in the general trends and characteristics as shown.

Table 15.1-5 lists the sequence of events for this transient.

The plant operator must "reclose" the valve as soon as possible and check that reactor and turbine-generator output return-to-normal. If the valve cannot be closed, plant shutdown should be initiated.

The operator will have the time period between the valve first sticking full open and the bulk pool temperature reaching 110F before he must scram the reactor to be in compliance with the Technical Specifications.

If it is assumed that the suppression pool is at its maximum operating temperature (95F) and minimum operating volume with no pool cooling systems in operation when the valve first opens, the operator will have more than 6 minutes before the pool scram temperature of 110F is reached. If the above worst case assumptions were relaxed, the time for operator action would increase.

Delaying the reactor scram to 10 minutes after the valve sticks full open would have no adverse effect on plant safety. Even though the suppression pool temperature would approach 120F at the time of scram, the maximum allowable suppression pool temperature limits would not be exceeded.

15.1.4.2.2 System Operation This transient assumes normal functioning of normal plant instrumentation and controls, specifically the operation of the pressure regulator and levels control systems.

15.1.4.2.3 The Effect of Single Failures and Operator Errors Failure of additional components (e.g., pressure regulator, feedwater flow controller) is discussed elsewhere in this chapter.

15.1.4.3 Core and System Performance 15.1.4.3.1 Mathematical Model The computer model used to simulate this transient is discussed in detail in Reference 15.1-1. It has been determined that this transient is not limiting from a core performance standpoint.

Therefore, a qualitative presentation of results is described below.

15.1.4.3.2 Input Parameters and Initial Conditions This event is based on Cycle 1 conditions (see Table 15.0-2).

For this event it is assumed that the reactor is operating at an initial power level of 3458 MWt when an MSRV is inadvertently opened. Flow through the valve at normal plant operating conditions stated above is approximately 7% of original rated steam flow.

15.1.4.3.3 Results This is a non-limiting event that has not bee reanalyzed for power rerate. The results presented are based on Cycle 1 conditions. An analysis of this event for current conditions is not expected to result in a change in the general trends and characteristics as shown.

CHAPTER 15 15.1-11 REV. 19, SEPTEMBER 2018

LGS UFSAR The opening of an MSRV allows steam to be discharged into the suppression pool. The sudden increase in the rate of steam flow leaving the reactor vessel causes a mild depressurization transient.

The pressure regulator senses the nuclear system pressure decrease and within a few seconds closes the turbine control valve far enough to stabilize reactor vessel pressure at a slightly lower value, and reactor power settles at nearly the initial power level. Thermal margins decrease only slightly through the transient, and no fuel damage results from the transient. MCPR is essentially unchanged and therefore the safety limit margin is unaffected.

15.1.4.4 Barrier Performance As discussed above, the transient resulting from an inadvertent MSRV opening is a mild depressurization which is within the range of normal load-following and therefore has no significant effect on RCPB and containment design pressure limits.

15.1.4.5 Radiological Consequences While the consequence of this transient does not result in fuel failure, it does result in the discharge of normal coolant activity to the suppression pool via MSRV operation. Because this activity is contained in the primary containment, there is no exposure to operating personnel. This transient does not result in an uncontrolled release to the environment, so the plant operator can choose to leave the activity bottled up in the containment or discharge it to the environment under controlled release conditions. If purging of the containment is chosen, the release will be in accordance with the established Technical Specifications and, at the worst, would only result in a small increase in the yearly integrated exposure level.

15.1.5 SPECTRUM OF STEAM SYSTEM PIPING FAILURES INSIDE AND OUTSIDE OF CONTAINMENT IN A PWR This event is not applicable to BWR plants.

15.1.6 INADVERTENT RHR SHUTDOWN COOLING OPERATION 15.1.6.1 Identification of Causes and Frequency Classification 15.1.6.1.1 Identification of Causes At design power conditions no conceivable malfunction in the shutdown cooling system could cause temperature reduction.

If the reactor were critical or near critical in a startup or cooldown condition, a very slow increase in reactor power could result. A shutdown cooling malfunction leading to a moderator temperature decrease could result from misoperation of the cooling water controls for the RHR heat exchangers. The resulting temperature decrease would cause a slow insertion of positive reactivity into the core. If the operator did not act to control the power level, a high neutron flux reactor scram would terminate the transient without violating fuel thermal limits and without any measurable increase in nuclear system pressure.

15.1.6.1.2 Frequency Classification CHAPTER 15 15.1-12 REV. 19, SEPTEMBER 2018

LGS UFSAR Although no single failure could cause this transient, it is conservatively categorized as a transient of moderate frequency.

15.1.6.2 Sequence of Events and System Operation 15.1.6.2.1 Sequence of Events A shutdown cooling malfunction leading to a moderator temperature decrease could result from misoperation of the cooling water controls for RHR heat exchangers. The resulting temperature decrease causes a slow insertion of positive reactivity into the core. Scram will occur before any thermal limits are reached if the operator does not take action. The sequence of events for this transient is shown in Table 15.1-1.

15.1.6.2.2 System Operation A shutdown cooling malfunction causing a moderator temperature decrease must be considered in all operating states. However, this transient is not considered while at power operation since the nuclear system pressure is too high to permit operation of the RHR shutdown cooling mode.

No unique safety actions are required to avoid unacceptable safety results for transients as a result of a reactor coolant temperature decrease induced by misoperation of the shutdown cooling heat exchangers. In startup or cooldown operation, where the reactor is or nearly is critical, the slow power increase resulting from the cooler moderator temperature would be controlled by the operator in the same manner normally used to control power in the source or intermediate power ranges.

15.1.6.2.3 The Effect of Single Failures and Operator Errors No single failures can cause this transient to be more severe. If the operator takes action, the slow power rise will be controlled in the normal manner. If no operator action is taken, scram will terminate the power increase before thermal limits are reached (Section 15.9).

15.1.6.3 Core and System Performance The increased subcooling caused by misoperation of the RHR shutdown cooling mode could result in a slow power increase due to the reactivity insertion. This power rise would be terminated by a flux scram before fuel thermal limits are approached. Therefore, only a qualitative description is provided here.

15.1.6.4 Barrier Performance As noted above, the consequences of this transient do not result in any temperature or pressure transient in excess of the criteria for which the fuel, pressure vessel, or containment are designed, therefore, these barriers maintain their integrity and function as designed.

15.1.6.5 Radiological Consequences Since this transient does not result in any fuel failures, no analysis of radiological consequences is required for this transient.

CHAPTER 15 15.1-13 REV. 19, SEPTEMBER 2018

LGS UFSAR 15.

1.7 REFERENCES

15.1-1 R.B. Linford, "Analytical Methods of Plant Transient Evaluations for the General Electric Boiling Water Reactor," NEDO-10802, (April 1973).

15-1-2 General Electric "10 CFR 21 Reportable Condition Notification: Potential to Exceed Low Pressure Technical Specification Safety Limit," March 29, 2005.

15-1-3 NEDC-33743, Revision 0, "BWR Owner's Group Reload Analysis and Core Management Committee SC05-03 Analysis Report," GE Hitachi Energy, April 2012.

15-1-4 EC 400057, Revision 0, SC05-03 Assessment for Limerick, Units 1 and 2.

CHAPTER 15 15.1-14 REV. 19, SEPTEMBER 2018

LGS UFSAR Table 15.1-1 SEQUENCE OF EVENTS FOR INADVERTENT RHR SHUTDOWN COOLING OPERATION TIME (min) EVENT 0 Reactor at states B or D (Section 15.9) when RHR shutdown cooling inadvertently activated.

0-10 Slow rise in reactor power.

+10 Operator may take action to limit power rise. Flux scram will occur if no action is taken.

CHAPTER 15 15.1-15 REV. 13, SEPTEMBER 2006

LGS UFSAR Table 15.1-2 SEQUENCE OF EVENTS FOR LOSS OF FEEDWATER HEATING TIME (sec) EVENT 0 Initiate a 100F temperature reduction into the feedwater system.

25.0 (approx.) Initial effect of unheated feedwater to raise core power level and steam flow.

65.0 (approx.) Bypass valves open to accommodate the increasing steam flow.

120.0 (approx.) New higher power, steady-state conditions reached CHAPTER 15 15.1-16 REV. 13, SEPTEMBER 2006

LGS UFSAR Table 15.1-3 SEQUENCE OF EVENTS FOR FEEDWATER CONTROLLER FAILURE TIME (sec) EVENT(1) (WITH TURBINE BYPASS) 0 Initiate simulated failure of feedwater controller to upper limit on feedwater flow.

8.4 Level 8 vessel level setpoint trips main turbine and feedwater pumps.

8.4 Reactor scram trip actuated from main turbine stop valve position switches.

8.4 RPT actuated by stop valve position switches.

8.6 Main turbine stop valves closed and turbine bypass valves start to open.

8.6 Recirculation pump motor circuit breakers open causing recirculation drive flow to start to coast down.

11.2 First group of SRVs open due to high pressure.

TIME (sec) EVENT(2) (WITHOUT TURBINE BYPASS) 0 Initiate simulated failure of feedwater controller to upper limit on feedwater flow.

8.3 Level 8 vessel level setpoint trips main turbine and feedwater pumps.

8.3(est) Reactor scram trip actuated from main turbine stop valve position switches.

8.3 RPT actuated by stop valve position switches.

8.5 Turbine bypass valves fail to open.

8.5 Main turbine stop valves closed.

8.6 Recirculation pump motor circuit breakers open causing recirculation drive flow to coast-down.

10.5 First groups 1 to 3 actuated due to high pressure.

(1)

See Figure 15.1-3.

(2)

See Figure 15.1-1.

CHAPTER 15 15.1-17 REV. 13, SEPTEMBER 2006

LGS UFSAR Table 15.1-4 SEQUENCE OF EVENTS FOR PRESSURE REGULATOR FAILURE(1)

TIME (sec) EVENT 0 Simulate maximum limit flow to main turbine.

0.4 Main turbine bypass opens.

0.7(est) Turbine control valves open wide.

4.7 Vessel water level (Level 8) trip initiates main turbine and feedwater turbine trips.

4.7 Main turbine stop valve position initiates reactor scram and RPT.

4.8 Turbine stop valves closed.

4.9 Recirculation pump motor circuit breakers open causing decrease in core flow to natural circulation.

46.8 Main steam line isolation on low turbine inlet pressure.

51.8 MSIVs closed. Bypass valves remain open, exhausting steam in steam lines downstream of isolation valves.

52.0 RCIC AND HPCI systems initiation on low level (Level 2).

>100.0 Group 1 MSRVs actuate and cycle.

(1)

See Figure 15.1-4.

NOTE: This is a non-limiting event that has not been re-analyzed for power rerate or for raising the MSIV low pressure isolation setpoint. The results of this event are based on Cycle 1 conditions. An analysis of this event for the rerate conditions is not expected to result in a change in the general trends and characteristics as shown. Raising the MSIV low pressure isolation setpoint would terminate the event sooner and be less limiting.

CHAPTER 15 15.1-18 REV. 19, SEPTEMBER 2018

LGS UFSAR Table 15.1-5 SEQUENCE OF EVENTS FOR INADVERTENT MAIN STEAM RELIEF VALVE OPENING TIME (sec) EVENT 0 Initiate opening of one MSRV.

0.5(est) MSRV flow reaches full flow.

15.0(est) System establishes new steady-state operation.

NOTE: This is a non-limiting event that has not been re-analyzed for power rerate. The results of this event are based on Cycle 1 conditions. An analysis of this event for the rerate conditions is not expected to result in a change in the general trends and characteristics as shown.

CHAPTER 15 15.1-19 REV. 13, SEPTEMBER 2006

LGS UFSAR 15.2 INCREASE IN REACTOR PRESSURE 15.2.1 PRESSURE REGULATOR FAILURE - CLOSED 15.2.1.1 Identification of Causes and Frequency Classification 15.2.1.1.1 Identification of Causes The Digital Electro-Hydraulic Control (DEHC) pressure regulator control function is performed via application software running on redundant controllers. The main steam pressure indications and pressure setpoint adjustments and indications are located on the HMI workstation of the turbine control panel. Each functional controller in the redundant pair executes the same application program, although only one controller at a time accesses the I/O and runs in the control mode. The partner processor runs in the backup mode. The transfer between the primary and the backup regulator controllers is automatic. The operator does not have the ability to select the primary or backup regulator controller. It is assumed, for the purposes of this transient analysis that a single failure occurs, erroneously causes the controlling regulator processor to close the main turbine control valves. Failure of the primary controlling regulator processor results in the automatic bumpless transfer between the primary and the backup regulator controllers, thereby preventing an increase in reactor pressure.

15.2.1.1.2 Frequency Classification This transient is treated as a moderate frequency event.

15.2.1.2 Sequence of Events and System Operation 15.2.1.2.1 Sequence of Events When a fault is detected with the controlling pressure regulator processor, as discussed in Section 15.2.1.1.1, an automatic "bumpless" failover will occur to the back-up redundant regulator controller. The pressure increase will be small, if any. Both regulators receive the same setpoint value from the operator input via the HMI, thus, pressure will be controlled at approximately the same value prior to the assumed failure.

15.2.1.2.2 Systems Operation Normal plant instrumentation and control is assumed to function. This transient requires no protection system, or safeguard systems, operation.

15.2.1.2.3 The Effect of Single Failures and Operator Errors The nature of the first assumed failure produces a slight pressure increase in the reactor until the backup processor gains control. The control system is designed to provide a bumpless transfer between control modes and various control functions throughout the reactor power range (0-100%), such as primary to backup pressure regulator controller, valve tests, and automatic cool down. Also, upon detection of a primary controller fault, the control of the I/O interface is automatically transferred to the backup controller. To minimize the effects from transferring control from the primary to backup regulator control processor (bumpless transfer),

the algorithms track the output values, pass the information upstream, and apply the data CHAPTER 15 15.2-1 REV. 19, SEPTEMBER 2018

LGS UFSAR during the first pass of execution. Each processor has its own network connection that is integrated into the process module and provides complete redundancy. To ensure redundant communications, each processor in the redundant pair is attached to a different switch. This ensures that there is no single point of failure. The term "bumpless" is defined as not exceeding 2 psi as set forth for pressure control. This means that mode changes and switching of functions will not cause a step change in throttle pressure greater than 2 psi operating throttle pressure variations.

15.2.1.3 Core and System Performance The disturbance is mild, similar to a pressure setpoint change, and no significant reductions in fuel thermal margins occur. This transient is much less severe than the generator and turbine trip transients described in Sections 15.2.2 and 15.2.3.

15.2.1.3.1 Mathematical Model Qualitative evaluation provided only.

15.2.1.3.2 Input Parameters and Initial Conditions Qualitative evaluation provided only.

15.2.1.3.3 Results Response of the reactor during this primary pressure regulator control processor failure is such that the pressure change at the turbine inlet is small, and no pressure disturbance in the vessel.

Thus, neutron flux and pressure trip margins will be maintained.

15.2.1.3.4 Consideration of Uncertainties All systems utilized for protection in this transient were assumed to have the most conservative allowable response (e.g., relief setpoints, scram stroke time, and worth characteristics). Normal plant behavior is, therefore, expected to reduce the actual severity of the transient.

15.2.1.4 Barrier Performance The consequences of this transient do not result in any temperature or pressure transient in excess of the criteria for which the fuel, pressure vessel or containment are designed. Therefore, these barriers maintain their integrity and function as designed.

15.2.1.5 Radiological Consequences Because this transient does not result in any fuel failures, or any release of primary coolant to either the secondary containment or to the environment, there are no radiological consequences associated with this transient.

15.2.2 GENERATOR LOAD REJECTION 15.2.2.1 Identification of Causes and Frequency Classification CHAPTER 15 15.2-2 REV. 19, SEPTEMBER 2018

LGS UFSAR 15.2.2.1.1 Identification of Causes Fast closure of the turbine control valves is initiated whenever electrical grid disturbances occur that result in significant loss of electrical load on the generator. The turbine control valves are required to close as rapidly as possible to prevent excessive overspeed of the turbine-generator.

Closure of the main turbine control valves will cause a sudden reduction in steam flow that results in an increase in system pressure and a reactor shutdown.

15.2.2.1.2 Frequency Classification 15.2.2.1.2.1 Generator Load Rejection This transient is categorized as an incident of moderate frequency.

15.2.2.1.2.2 Generator Load Rejection with Bypass Failure Frequency Basis: Thorough searches of domestic plant operating records have revealed three instances of bypass failure during 628 bypass system operations. This gives a probability of bypass failure of 0.0048. Combining the actual frequency of a generator load rejection with the failure rate of the bypass yields an event frequency of a generator load rejection with bypass failure of 0.0036/plant year.

15.2.2.2 Sequence of Events and System Operation 15.2.2.2.1 Sequence of Events 15.2.2.2.1.1 Generator Load Rejection - Turbine Control Valve Fast Closure A loss of generator electrical load from high power conditions produces the sequence of events listed in Table 15.2-1.

15.2.2.2.1.2 Generator Load Rejection with Failure of Bypass A loss of generator electrical load at high power with bypass failure produces the sequence of events listed in Table 15.2-2.

15.2.2.2.1.3 Identification of Operator Actions The operator should:

a. Verify proper bypass valve operation.

b. Observe that the feedwater/level controls have maintained the reactor water level at a satisfactory value.

c. Observe that the pressure regulator is controlling reactor pressure at the desired value.

d. Record peak power and pressure.

CHAPTER 15 15.2-3 REV. 19, SEPTEMBER 2018

LGS UFSAR

e. Verify relief valve operation.

15.2.2.2.2 System Operation 15.2.2.2.2.1 Generator Load Rejection with Bypass This is a non-limiting event that has not been reanalyzed for power rerate.

In order to properly simulate the expected sequence of events, the analysis of this transient assumes normal functioning of plant instrumentation and controls, plant protection, and reactor protection systems, unless stated otherwise.

Turbine control valve fast closure initiates a trip signal for power levels greater than 30% NBR. In addition, RPT is initiated. Both of these trip signals satisfy single failure criteria, and credit is taken for these protective features.

The nuclear pressure relief system, which operates the MSRVs independently when system pressure exceeds relief valve instrumentation setpoints, is assumed to function normally during the time period analyzed.

15.2.2.2.2.2 Generator Load Rejection with Failure of Bypass This is the same as Section 15.2.2.2.2.1, except that failure of the main turbine bypass valves is assumed for the entire transient.

15.2.2.2.3 The Effect of Single Failures and Operator Errors Mitigation of pressure increase, the basic nature of this transient, is accomplished by the RPS functions. Turbine control valves trip and RPT are designed to satisfy single failure criteria. An evaluation of the most limiting single failure (i.e., failure of the bypass system) was considered in this transient. Single failure analysis can be found in Section 15.9.

15.2.2.3 Core and System Performance 15.2.2.3.1 Mathematical Model The computer models described in Section 15.1.2.3.1 are used to simulate this transient.

15.2.2.3.2 Input Parameters and Initial Conditions These analyses have been performed, unless otherwise noted, with the plant conditions tabulated in Table 15.0-2A for rerate conditions.

The turbine EHC system detects load rejection before a measurable speed change takes place.

The closure characteristics of the turbine control valves are assumed to have a full stroke closure time, from fully open to fully closed, of 0.15 seconds.

Auxiliary power would normally be independent of any turbine- generator overspeed effects, and be continuously supplied at rated frequency as automatic fast transfer to auxiliary power supplies CHAPTER 15 15.2-4 REV. 19, SEPTEMBER 2018

LGS UFSAR occurs. For the purposes of worse case analysis, the recirculation pumps are assumed to remain tied to the main generator, and thus increase in speed with the turbine-generator overspeed until tripped by the RPT system.

The reactor is operating in the manual flow control mode when load rejection occurs.

The bypass valve opening characteristics are simulated, using the specified delay together with the specified opening characteristic required for bypass system operation.

Actual closure of MSIVs as caused by low water level trip (Level 1), and actual flow from initiation of RCIC and HPCI core cooling system functions do not occur during the duration of the simulation. If these events occur, they will follow sometime after the primary concerns of fuel margin and overpressure effects have passed and are expected to result in effects less severe than those already experienced by the reactor system.

15.2.2.3.3 Results 15.2.2.3.3.1 Generator Load Rejection with Bypass The results of this event are based on Cycle 1 conditions. An analysis of this event for current conditions is not expected to result in a change in the general trends and characteristics as shown.

Figure 15.2-1 shows the results of the generator trip from 104.3% rated power. Peak neutron flux rises to 178.5% of NBR conditions.

The average surface heat flux peaks at 101.2% of its initial value. The change in CPR for this event is only 0.03, and CPR does not significantly decrease below its initial value.

15.2.2.3.3.2 Generator Load Rejection with Failure of Bypass Beginning with Cycle 8 of Unit 1, the turbine control valves (TCV) have been modified to operate in full arc admission. In this configuration the TCVs close sooner than the turbine stop valves to shut off steam flow. As a result, the Generator Load Rejection with Failure of Bypass event (LRNBP) is more limiting than the turbine trip with failure of bypass (TTNBP). Table 15.0-1A provides the results of the LRNBP analyses for several different conditions, including one for the TCVs in full arc admission configuration. Figure 15.2-2 depicts the transient response of various plant parameters following a LRNBP event. The LRNBP is also analyzed assuming the EOC-RPT function is inoperable to provide a basis for this possible mode of operation. A similar analysis has been performed to address power load unbalance (PLU) function failure. For cycle specific reload licensing analysis the LRNBP event is evaluated at the limiting operating domain condition (see Appendix 15B).

Additionally, an analysis of Generator Load Rejection and Turbine Trip events with simultaneous Failure of Bypass and End of Cycle Recirculation Pump Trip (EOC-RPT) was performed using the ODYN code. The Generator Load Rejection event bounds the turbine trip. Table 15.2-14 presents a summary of the initial conditions and significant results for the Generator Load Rejection with no bypass and no EOC-RPT event, while Figure 15.2-14 shows its time history.

15.2.2.3.4 Consideration of Uncertainties CHAPTER 15 15.2-5 REV. 19, SEPTEMBER 2018

LGS UFSAR The full stroke closure time of the turbine control valves of 0.15 seconds is conservative.

Typically, actual closure time is more like 0.2 seconds. Thus, the shorter time chosen for closure results in a more severe pressurization effect.

All systems utilized for protection in this transient were assumed to have the poorest allowable response (e.g., relief setpoints, scram stroke time, and work characteristics). Anticipated plant behavior is, therefore, expected to reduce the actual severity of the transient.

15.2.2.4 Barrier Performance 15.2.2.4.1 Generator Load Rejection Peak pressure remains within normal operating range and no threat to the barrier exists.

15.2.2.4.2 Generator Load Rejection with Failure of Bypass As shown in Table 15.0-1A the peak nuclear system pressure at the bottom of the vessel remains well below the nuclear barrier transient pressure limit of 1375 psig.

15.2.2.5 Radiological Consequences While the consequence of this transient does not result in fuel failure, it does result in the discharge of normal coolant activity to the suppression pool via MSRV operation. Because this activity is restricted to the primary containment, there is no exposure to operating personnel. This transient does not result in an uncontrolled release to the environment, so the plant operator can choose to leave the activity bottled up in the containment or discharge it to the environment under controlled release conditions. If purging of the containment is chosen, the release will be in accordance with established Technical Specifications and, at the worst, would only result in a small increase in the yearly integrated exposure level.

15.2.3 TURBINE TRIP 15.2.3.1 Identification of Causes and Frequency Classification 15.2.3.1.1 Identification of Causes A variety of turbine or nuclear system malfunctions will initiate a turbine trip. Some examples are:

moisture separator and heater drain tank high levels, operational lockout, loss of control fluid pressure, low condenser vacuum, and reactor high water level.

15.2.3.1.2 Frequency Classification 15.2.3.1.2.1 Turbine Trip with Bypass This transient is categorized as an incident of moderate frequency. In defining the frequency of this transient, turbine trips that occur as a by-product of other transients, such as loss of condenser vacuum or reactor high level trip events, are not included. However, spurious low vacuum or high level trip signals, which cause an unnecessary turbine trip, are included in defining CHAPTER 15 15.2-6 REV. 19, SEPTEMBER 2018

LGS UFSAR the frequency. In order to get an accurate event-by-event frequency breakdown, this division of initiating causes is required.

15.2.3.1.2.2 Turbine Trip with Failure of the Bypass Frequency Basis: As discussed in Section 15.2.2.1.2.2, the failure rate of the bypass is 0.0048.

Combining this with the turbine trip frequency of 1.33 events/plant year yields the frequency of 0.0064/plant year.

15.2.3.2 Sequence of Events and System Operation 15.2.3.2.1 Sequence of Events 15.2.3.2.1.1 Turbine Trip with Bypass This event is non-limiting and was not reanalyzed at power rerate conditions. A turbine trip at high power with bypass produces the sequence of events listed in Table 15.2-3 for Cycle 1 conditions.

15.2.3.2.1.2 Turbine Trip with Failure of the Bypass A turbine trip at high power with bypass failure produces the sequence of events listed in Table 15.2-4.

15.2.3.2.1.3 Identification of Operator Actions The operator should:

a. Verify automatic transfer of buses supplied by generator to incoming power. If automatic transfer does not occur, manual transfer must be made.

b. Monitor and maintain reactor water level at required level.

c. Check turbine for proper operation of all auxiliaries during coast-down.

d. Depending upon conditions, initiate normal operating procedures for cooldown, or maintain pressure for restart purposes.

e. Put the mode switch in the shutdown position and verify all control rods are inserted.

f. Secure the RCIC operation if automatic initiation occurred due to low water level.

g. Monitor CRD positions and insert both the IRMs and SRMs.

h. Cool down the reactor per standard procedure if a restart is not intended.

15.2.3.2.2 System Operation 15.2.3.2.2.1 Turbine Trip with Bypass CHAPTER 15 15.2-7 REV. 19, SEPTEMBER 2018

LGS UFSAR All plant control systems maintain normal operation unless otherwise noted.

Turbine stop valve closure initiates a reactor trip via position signals to the protection system.

Credit is taken for successful operation of the RPS.

Turbine stop valve closure initiates RPT, thereby terminating the jet pump drive flow.

The nuclear pressure relief system, which consists of the MSRVs that operate independently when system pressure exceeds relief valve setpoints, is assumed to function normally during the time period analyzed.

15.2.3.2.2.2 Turbine Trip with Failure of the Bypass Same as Section 15.2.3.2.2.1 except that failure of the main turbine bypass system is assumed for the entire transient time period analyzed.

15.2.3.2.2.3 Turbine Trip at Low Power with Failure of the Bypass Same as Section 15.2.3.2.2.1 except that failure of the main turbine bypass system is assumed.

It should be noted that, below 30% NBR power level a main stop valve trip inhibit signal is actuated by the first-stage pressure of the turbine. This is done to eliminate the stop valve trip signal from scramming the reactor, provided the bypass system functions properly. In other words, the bypass would be sufficient at this low power to accommodate a turbine trip without the necessity of shutting down the reactor. All other protection system functions remain operative as before, and credit is taken for those protection system trips.

15.2.3.2.3 The Effect of Single Failures and Operator Errors 15.2.3.2.3.1 Turbine Trips at Power Levels Greater Than 30% NBR Mitigation of pressure increase, the basic nature of this transient, is accomplished by RPS functions. The main stop valve closure trip is designed to satisfy the single failure criterion.

15.2.3.2.3.2 Turbine Trips at Power Levels Less Than 30% NBR This is the same as in Section 15.2.3.2.3.1, except RPT and stop valve closure trip is normally inoperative. Since protection is still provided by high flux, high pressure, etc., these factors will scram the reactor should a single failure occur.

15.2.3.3 Core and System Performance 15.2.3.3.1 Mathematical Model The computer model described in Section 15.1.1.3.1 was used to simulate these transients with normal bypass operation. The infrequent event of turbine trip with bypass failure is simulated with the computer models in Section 15.1.2.3.1.

15.2.3.3.2 Input Parameters and Initial Conditions CHAPTER 15 15.2-8 REV. 19, SEPTEMBER 2018

LGS UFSAR These analyses have been performed, unless otherwise noted, with plant conditions as tabulated in Table 15.0-2 for Cycle 1 and in Table 15.02A for rerate..

Turbine stop valves full stroke closure time is 0.1 second.

A reactor scram is initiated by position switches on the stop valves when the valves are not fully open. This stop valve trip signal is automatically bypassed when the reactor is below 30% NBR power level.

Reduction in core recirculation flow is initiated by position switches on the main stop valves that trip the recirculation pumps.

15.2.3.3.3 Results 15.2.3.3.3.1 Turbine Trip with Bypass The results of this event are based on Cycle 1 conditions. An analysis of this event for current conditions is not expected to result in a change in the general trends and characteristics as shown.

A turbine trip with the bypass system operating normally is simulated at 104.3% NBR steam flow conditions in Figure 15.2-3.

Neutron flux increases rapidly because of the void reduction caused by the pressure increase.

However, the flux increase is limited to 163.3% of rated value by the stop valve scram and the RPT system. Peak fuel surface heat flux does not exceed 102% of its initial value. The CPR is less than that for turbine trip with assumed bypass failure (Section 15.2.3.3.3.2) and the MCPR remains well above the safety limit.

15.2.3.3.3.2 Turbine Trip with Failure of Bypass The TTNBP event is caused by the rapid closure of the turbine stop valves. A reactor scram signal is immediately initiated from the position switches on the TSVs. The turbine bypass system is conservatively assumed to be inoperable.

With the TCVs configured for full arc admission, the TTNBP is bounded by the LRNBP event.

The TTNBP event is also analyzed assuming the EOC-RPT function is inoperable to provide a basis for this possible mode of operation. The TTNBP transient results are summarized in Table 15.0-1A. The system response curves are shown in Figure 15.2-4. The fuel transient thermal and mechanical overpower results are below the design criteria.

15.2.3.3.3.3 Turbine Trip with Bypass Valve Failure, Low Power This transient is less severe than a similar one at high power. Below 30% of rated power, the turbine stop valve and turbine control valve closure scrams are automatically bypassed. At these lower power levels, the turbine first-stage pressure is used to initiate the scram logic bypass. The scram which terminates the transient is initiated by high neutron flux or high vessel pressure. The bypass valves are assumed to fail; therefore, system pressure will increase until the pressure relief setpoints are reached. At this time, because of the relatively low power of this transient event, relatively few MSRVs will open to limit reactor pressure. Peak pressures are not expected CHAPTER 15 15.2-9 REV. 19, SEPTEMBER 2018

LGS UFSAR to greatly exceed the MSRV setpoints, and will be significantly below the RCPB transient limit of 1375 psig. Peak surface heat flux and peak fuel center temperature remain at relatively low values, and MCPR remains well above the GETAB safety limit.

15.2.3.3.4 Consideration of Uncertainties Uncertainties in these analyses involve protection system settings, system capacities, and system response characteristics. The most conservative values are used in all the analyses. For example:

a. Control rod scram speed based on conservative statistical aproach consistent with GEMINI methodology option A/B.

b. Scram worth shape for all rod-out conditions is assumed.

c. Minimum specified MSRV capacities are utilized for overpressure protection.

d. Setpoints of the MSRVs include errors (high) for all valves.

15.2.3.4 Barrier Performance 15.2.3.4.1 Turbine Trip with Bypass NOTE: The results presented here are based on original plant conditions. Because this is not a limiting transient, this event was not reanalyzed for rerated conditions. However, the general trends and characteristics as shown here are not expected to change.

Peak pressure in the bottom of the vessel reaches 1196 psig, which is below the ASME code limit of 1375 psig for the RCPB. Vessel dome pressure does not exceed 1174 psig. The severity of turbine trips from low initial power levels decreases to the point where a scram can be avoided if auxiliary power is available and the power level is within bypass capability.

15.2.3.4.2 Turbine Trip with Failure of the Bypass The MSRVs open and close sequentially as the stored energy is dissipated and the pressure falls below the setpoints of the valves. As shown in Table 15.0-1A, the peak nuclear system pressure at the vessel bottom remains below the RCPB transient pressure limit of 1375 psig.

15.2.3.4.2.1 Turbine Trip with Failure of Bypass at Low Power Qualitative discussion is provided in Section 15.2.3.3.3.3.

15.2.3.5 Radiological Consequences Although the consequence of this transient does not result in fuel failure, it does result in the discharge of normal coolant activity to the suppression pool via MSRV operation. Because this activity is contained in the primary containment, there is no exposure to operating personnel. This transient does not result in an uncontrolled release to the environment, so the plant operator can choose to leave the activity bottled up in the containment or discharge it to the environment under controlled release conditions. If purging of the containment is chosen, the release will be in CHAPTER 15 15.2-10 REV. 19, SEPTEMBER 2018

LGS UFSAR accordance with established Technical Specifications and, at the worst, would only result in a small increase in the yearly integrated exposure level.

15.2.4 MSIV CLOSURES 15.2.4.1 Identification of Causes and Frequency Classification 15.2.4.1.1 Identification of Causes Various steam line and nuclear system malfunctions, or operator actions, can initiate MSIV closure. Examples are: low steam line pressure, high steam line flow, low water level, or manual action.

15.2.4.1.2 Frequency Classification 15.2.4.1.2.1 Closure of All Main Steam Isolation Valves This transient is categorized as an incident of moderate frequency. To define the frequency of this transient, as an initiating transient and not the byproduct of another transient, only the following contribute to the frequency: manual action (purposely or inadvertent), spurious signals such as low pressure, low reactor water level, low condenser vacuum, etc.; and, finally, equipment malfunctions such as faulty valves or operating mechanisms. A closure of one MSIV may cause an immediate closure of all the other MSIVs, depending upon reactor conditions. If this occurs, it is also included in this category. During the MSIV closure, position switches on the valves provide a reactor scram if the valves in three or more main steam lines are not fully open, except for interlocks which permit proper plant startup. Protection system logic, however, permits the test closure of one valve without initiating scram from the position switches.

15.2.4.1.2.2 Closure of One Main Steam Isolation Valve This transient is categorized as an incident of moderate frequency. RPS logic allows for one MSIV at a time to be closed without generating a half scram signal. Operator error or equipment malfunction may cause a single MSIV to be closed inadvertently. If reactor power is greater than approximately 90% when this occurs, a high flux scram or high steam line flow scram may result.

If all MSIVs close as a result of the single closure, the transient is considered as a closure of all MSIVs.

15.2.4.2 Sequence of Events and System Operation 15.2.4.2.1 Sequence of Events This is a non-limiting event that has not been reanalyzed for power rerate. The sequence of events is Table 15.2-5 is based on Cycle 1 conditions. The general trend and characteristics shown here are not expected to change for current conditions.

Table 15.2-5 lists the sequence of events for Figure 15.2-5.

The following is the sequence of operator actions expected during the course of the transient, assuming no restart of the reactor. The operator should:

CHAPTER 15 15.2-11 REV. 19, SEPTEMBER 2018

LGS UFSAR

a. Observe that all rods have been inserted.

b. Observe that the relief valves have opened for reactor pressure control.

c. Check that RCIC/HPCI automatically starts on the impending low reactor water level condition.

d. Switch the feed pump controllers to the manual position.

e. When the reactor vessel level has recovered to a satisfactory level, secure RCIC/HPCI.

f. When the reactor pressure has decayed sufficiently, initiate shutdown cooling.

g. Before resetting the MSIV isolation, determine the cause of valve closure.

h. Observe turbine coast-down and break vacuum before the loss of sealing steam.

Check turbine-generator auxiliaries for proper operation.

j. Reset and open MSIVs if conditions warrant and assure that the pressure regulator setpoint is above vessel pressure.

15.2.4.2.2 System Operation 15.2.4.2.2.1 Closure of All Main Steam Isolation Valves MSIV closures initiate a reactor scram trip through position signals to the protection system.

Credit is taken for successful operation of the protection system.

The nuclear pressure relief system, which opens the MSRVs when system pressure exceeds relief valve setpoints, is assumed to function normally during the time period analyzed.

All plant control systems maintain normal operation unless otherwise noted.

15.2.4.2.2.2 Closure of One Main Steam Isolation Valve The closure of a single MSIV at any given time will not initiate a reactor scram. This is because the valve position scram trip logic is designed to accommodate single valve operation and testability during normal reactor operation at limited power levels. Credit is taken for the operation of the pressure and flux signals to initiate a reactor scram.

All plant control systems maintain normal operation unless otherwise noted.

15.2.4.2.3 The Effect of Single Failures and Operator Errors Mitigation of pressure increase is accomplished by initiation of the reactor scram via MSIV position switches and the protection system. MSRVs also operate to limit system pressure. All of these functions are designed to single failure criteria, and additional single failures would not alter the results of this analysis.

CHAPTER 15 15.2-12 REV. 19, SEPTEMBER 2018

LGS UFSAR Failure of a single MSRV to open is not expected to have any significant effect. Such a failure is expected to result in less than a 20 psi increase in the maximum vessel pressure rise. The peak pressure will still remain considerably below 1375 psig. The design basis and performance of the pressure relief system is discussed in Section 5.2.

15.2.4.3 Core and System Performance 15.2.4.3.1 Mathematical Model The computer model described in Section 15.1.1.3.1 was used to simulate these transient events.

15.2.4.3.2 Input Parameters and Initial Conditions These analyses have been performed, unless otherwise noted, with plant conditions tabulated in Table 15.0-2.

The MSIV closing time is adjustable between 3 and 10 seconds. The worst case, the 3 second closure time, is assumed in this analysis.

Position switches on the valves initiate a reactor scram when the valves are not fully open.

Closure of these valves inhibits steam flow to the feedwater turbines, terminating feedwater flow.

Because of the loss of feedwater flow, water level within the vessel decreases sufficiently to initiate the HPCI and RCIC systems.

15.2.4.3.3 Results 15.2.4.3.3.1 Closure of All Main Steam Isolation Valves This is a non-limiting event that has not been reanalyzed for power rerate. The results of this event are based on Cycle 1 conditions. An analysis of this event for current conditions is not expected to result in a change in the general trends and characteristics as shown.

Figure 15.2-5 shows the changes in important nuclear system variables for the simultaneous isolation of all main steam lines while the reactor is operating at 104.3% of NBR steam flow. Peak neutron flux reaches 190.9% of rated value in the first few seconds of the event. At the time of peak neutron flux, the nonlinear valve closure becomes a strong effect, and the conservative scram characteristic assumption has not yet allowed credit for the full shutdown of the reactor. As pressure increases, recirculation pumps trip on the high vessel pressure.

Water level decreases cause initiation of the HPCI and RCIC systems. Although there is a delay of up to 30 seconds before the water supply enters the vessel, there is no change in the thermal margins. The 30 seconds is based on cycle 1 conditions. This event was not reanalyzed for power rerate.

15.2.4.3.3.2 Closure of One Main Steam Isolation Valve This is a non-limiting event that has not been reanalyzed for power rerate. The results of this event are based on Cycle 1 conditions. An analysis of this event for current conditions is not expected to result in a change in the general trends and characteristics as shown.

CHAPTER 15 15.2-13 REV. 19, SEPTEMBER 2018

LGS UFSAR RPS logic is such that only one isolation valve at a time can be closed without generating a half scram signal. With a 3 second closure of one MSIV with reactor power greater than approximately 90%, the steam flow disturbance may raise vessel pressure and reactor power enough to initiate a high neutron flux scram. This transient is considerably milder than the closure of all MSIVs at power. No quantitative analysis is furnished for this transient. However, no significant change in thermal margins is experienced, and no fuel damage occurs. Peak pressure remains below MSRV setpoints.

For testing purposes, one MSIV at a time is partially slow closed using a test push button to verify the RPS logic.

Inadvertent closure of one or all of the isolation valves while the reactor is shut down (such as operating state C, as defined in Section 15.9) will produce no significant transient. Closures during plant heatup (operating state D) will be less severe than the maximum power cases (maximum stored and decay heat) discussed in Section 15.2.4.3.3.1.

15.2.4.3.4 Consideration of Uncertainties Uncertainties in these analyses involve protection system settings, system capacities, and system response characteristics. In all cases, the most conservative values are used in the analyses. For example:

a. Slowest allowable control rod scram motion is assumed.

b. Scram worth shape for all rod-out conditions is assumed.

c. Minimum specified MSRV capacities are utilized for overpressure protection.

d. MSRV setpoints are assumed to be 3% higher than the valves nominal setpoints.

Additionally, Unit 2, cycle 4 parameters were used for the performance of the 3%

analysis (Reference 5.3-10).

15.2.4.4 Barrier Performance 15.2.4.4.1 Closure of All Main Steam Isolation Valves The MSRVs begin to open within the first few seconds after the start of isolation. The valves close sequentially as the stored heat is dissipated, but continue to discharge the decay heat intermittently. Peak pressure at the vessel bottom reaches 1220 psig, clearly below the pressure limits of the RCPB. Peak pressure in the main steam line is 1185 psig.

15.2.4.4.2 Closure of One Main Steam Isolation Valve No significant effect is imposed on the RCPB, since if closure of the valve occurs at an unacceptably high operating power level, a flux or pressure scram will result. The main turbine bypass system will continue to regulate system pressure through the other three "live" steam lines.

15.2.4.5 Radiological Consequences CHAPTER 15 15.2-14 REV. 19, SEPTEMBER 2018

LGS UFSAR While the consequence of this transient does not result in fuel failure, it does result in the discharge of normal coolant activity to the suppression pool via MSRV operation. Because this activity is contained in the primary containment, there is no exposure to operating personnel. This transient does not result in an uncontrolled release to the environment, so the plant operator can choose to leave the activity bottled up in the containment or discharge it to the environment under controlled release conditions. If purging of the containment is chosen, the release will be in accordance with established Technical Specifications and, at the worst, would only result in a small increase in the yearly integrated exposure level.

15.2.5 LOSS OF CONDENSER VACUUM 15.2.5.1 Identification of Causes and Frequency Classification 15.2.5.1.1 Identification of Causes Various system malfunctions that can cause a loss of condenser vacuum are designated in Table 15.2-6.

15.2.5.1.2 Frequency Classification This transient is categorized as an incident of moderate frequency.

15.2.5.2 Sequence of Events and System Operation 15.2.5.2.1 Sequence of Events This event was not reanalyzed for power rerate. The sequence of events in Table 15.2-7 is based on Cycle 1 conditions.

Table 15.2-7 lists the sequence of events for Figure 15.2-6.

The operator should:

a. Verify automatic transfer of buses supplied by generator to incoming power. If automatic transfer has not occurred, manual transfer must be made.

b. Monitor and maintain reactor water level at required level.

c. Check turbine for proper operation of all auxiliaries during coast-down.

d. Depending upon conditions, initiate normal operating procedures for cooldown, or maintain pressure for restart purposes.

e. Put the mode switch in the STARTUP position before the reactor pressure decays to the turbine inlet low pressure setpoint.

f. Secure RCIC operation if automatic initiation occurred due to low water level.

g. Monitor CRD positions and insert both the IRMs and SRMs.

CHAPTER 15 15.2-15 REV. 19, SEPTEMBER 2018

LGS UFSAR

h. Cool down the reactor following standard procedures if a restart is not intended.

15.2.5.2.2 System Operation In establishing the expected sequence of events and simulating the plant performance, it was assumed that normal functioning occurred in the plant instrumentation and controls, and plant protection and reactor protection systems.

Tripping functions associated with a loss of main turbine condenser vacuum are listed in Table 15.2-8.

15.2.5.2.3 The Effect of Single Failures and Operator Errors This transient does not lead to a general increase in reactor power level due to the protection system initiating a scram.

Failure of the integrity of the offgas treatment system is considered to be an accident situation and is described in Section 15.7.1.

Single failures will not affect the vacuum monitoring and turbine trip devices which are redundant.

The protective sequences of the anticipated operational transient are shown to be single failure proof (Section 15.9).

15.2.5.3 Core and System Performance 15.2.5.3.1 Mathematical Model The computer model described in Section 15.1.1.3.1 was used to simulate this transient event.

15.2.5.3.2 Input Parameters and Initial Conditions This analysis was performed with plant conditions tabulated in Table 15.0-2 unless otherwise noted.

Turbine stop valves full stroke closure time is 0.1 second.

A reactor scram is initiated by position switches on the stop valves when the valves are not fully open. This stop valve closure trip signal is automatically bypassed when the reactor is below 30%

NBR power level.

The analysis presented here is a hypothetical case with a conservative 2 in. Hg/sec vacuum decay rate. The bypass system was assumed to be available for several seconds by simulating bypass valve closure at a vacuum level of 10 inches Hg less than the stop valve closure vacuum level.

15.2.5.3.3 Results CHAPTER 15 15.2-16 REV. 19, SEPTEMBER 2018

LGS UFSAR This is a non-limiting event that has not been reanalyzed for power rerate. The results of this event are based on Cycle 1 conditions. An analysis of this event for current conditions is not expected to result in a change in the general trends and characteristics as shown.

Under this hypothetical 2 in. Hg/sec vacuum decay condition, the turbine bypass valve and MSIV closure would follow main turbine and feedwater turbine trips about 5 seconds after being initiated by the transient. This transient, therefore, is similar to a normal turbine trip with bypass. The effect of MSIV closure tends to be minimal, since the closure of main turbine stop valves, and subsequently the bypass valves, has already shut off the main steam line flow. Figure 15.2-6 shows the transient expected for this event. It is assumed that the plant is initially operating at 105% NBR steam flow conditions. Peak neutron flux reaches 160.9% of NBR power, while average fuel surface heat flux reaches 101.9% of rated value. MSRVs open to limit the pressure rise, then sequentially reclose as the stored energy is dissipated.

15.2.5.3.4 Consideration of Uncertainties The reduction, or loss, of vacuum in the main condenser sequentially trip the main and feedwater turbines, and close the MSIVs and bypass valves. While these are the major events occurring, other resultant actions will include scram (from stop valve closure) and bypass opening with the main turbine trip. Because the protective actions are actuated at various levels of condenser vacuum, the severity of the resulting transient is directly dependent upon the rate at which the vacuum is lost. Normal loss of vacuum, due to loss of cooling water pumps or steam jet air ejector problems, produces a very slow rate of loss that is timed in minutes, not seconds (Table 15.2-6).

If corrective actions by the reactor operators are not successful, then sequential trips of the main and feedwater turbines and, ultimately, complete isolation by closing the MSIVs and the bypass valves (opened with the main turbine trip), will occur.

A faster rate of loss of the condenser vacuum would shorten the time for the scram and reduce the overall effectiveness of the bypass valves since they would be closed more quickly.

Other uncertainties in these analyses involve protection system settings, system capacities, and system response characteristics.

In all cases, the most conservative values are used in the analyses. For example:

a. Slowest allowable control rod scram motion is assumed.

b. Scram worth shape for all rod-out conditions is assumed.

c. Minimum specified MSRV capacities are utilized for overpressure protection.

d. Setpoints of the MSRVs are assumed to be at the upper limit of Technical Specifications for all valves.

15.2.5.4 Barrier Performance Peak nuclear system pressure is 1194 psig at the vessel bottom. The overpressure transient is below the RCPB transient pressure limit of 1375 psig. Vessel dome pressure does not exceed 1172 psig. A comparison of these values to those for turbine trip with bypass failure at high power CHAPTER 15 15.2-17 REV. 19, SEPTEMBER 2018

LGS UFSAR shows the similarities between these two transients. The prime differences are the loss of feedwater and main steam line isolation, and the resulting low water level trips.

15.2.5.5 Radiological Consequences While the consequence of this transient does not result in fuel failure, it does result in the discharge of normal coolant activity to the suppression pool via MSRV operation. Because this activity is contained in the primary containment, there is no exposure to operating personnel. This transient does not result in an uncontrolled release to the environment, so the plant operator can choose to leave the activity bottled up in the containment or discharge it to the environment under controlled release conditions. If purging of the containment is chosen, the release will be in accordance with established Technical Specifications and, at the worst, would only result in a small increase in the yearly integrated exposure level.

15.2.6 LOSS OF AC POWER 15.2.6.1 Identification of Causes and Frequency Classification 15.2.6.1.1 Identification of Causes 15.2.6.1.1.1 Loss of Auxiliary Power Transformers The loss of all plant auxiliary buses due to transformer failure would require the simultaneous loss of three separate auxiliary transformers: the 1 Unit Auxiliary, the 10 Station Auxiliary, and the 20 Regulating transformers. The simultaneous loss of all three transformers is not considered credible without a common mode failure initiating event. Under this scenario, the plant sees a loss of all grid connections which is analyzed in the following sections.

15.2.6.1.1.2 Loss of All Grid Connections Loss of all grid connections can result from major shifts in electrical loads, seismic events, loss of loads, lightning, storms, wind, etc., that contribute to electrical grid instabilities. These instabilities cause equipment damage if unchecked. Protective relay schemes automatically disconnect electrical sources and loads to mitigate damage and regain electrical grid stability.

15.2.6.1.2 Frequency Classification 15.2.6.1.2.1 Loss of All Grid Connections This transient disturbance is categorized as an incident of moderate frequency.

15.2.6.2 Sequence of Events and System Operation 15.2.6.2.1 Sequence of Events 15.2.6.2.1.1 Loss of All Grid Connections This is a non-limiting event that has not been reanalyzed for power rerate. The results of this event are based on Cycle 1 conditions. An analysis of this events for current conditions is not expected to result in a change in the general trends and characteristics as shown.

CHAPTER 15 15.2-18 REV. 19, SEPTEMBER 2018

LGS UFSAR Table 15.2-10 lists the sequence of events for Figure 15.2-8.

15.2.6.2.1.2 Identification of Operator Actions The operator should maintain the reactor water level by use of the RCIC or HPCI system, control reactor pressure by use of the relief valves, and verify that the turbine dc oil pump is operating satisfactorily to prevent turbine bearing damage. The operator should also verify proper switching and loading of the emergency diesel generators.

The following is the sequence of operator actions expected during the course of the events when no immediate restart is assumed. The operator should:

a. Following the scram, verify all rods-in.

b. Check that diesel generators start and carry the vital loads.

c. Check that both RCIC and HPCI start when reactor vessel level drops to the initiation point after the relief valve opens.

d. Break vacuum before the loss of sealing steam occurs.

e. Check turbine-generator auxiliaries during coast-down.

f. When both the reactor pressure and level are under control, secure both HPCI and RCIC as necessary.

g. Continue cooldown following normal procedures.

15.2.6.2.2 System Operation 15.2.6.2.2.1 Loss of All Grid Connections This transient analysis, unless otherwise stated, assumes and takes credit for normal functioning of plant instrumentation and controls, and plant protection and reactor protection systems.

The loss of all grid connections causes the loss of all auxiliary power. This transient consists of a generator load rejection and recirculation pump trip at time t=0. The load rejection immediately closes the turbine control valves and causes a scram.

15.2.6.2.3 The Effect of Single Failures and Operator Errors Loss of all connections to the grid leads to a turbine trip due to load rejection and an immediate scram due to turbine control valve fast closure. Additional failures of other systems designed to protect the reactor would not result in effects different from those reported. Failures of the protective systems have been considered and satisfy single failure criteria, so no change in analyzed consequences is expected. See Section 15.9 for details on single failure analysis.

15.2.6.3 Core and System Performance CHAPTER 15 15.2-19 REV. 19, SEPTEMBER 2018

LGS UFSAR 15.2.6.3.1 Mathematical Model The computer model described in Section 15.1.1.3.1 was used to simulate this transient.

Operation of the RCIC or HPCI systems is not included in the simulation of this transient, since startup of these pumps does not permit flow in the time period of this simulation.

15.2.6.3.2 Input Parameters and Initial Conditions 15.2.6.3.2.1 Loss of All Grid Connections These analyses have been performed, unless otherwise noted, with the plant conditions tabulated in Table 15.0-2, and under the assumed systems constraints described in Section 15.2.6.2.2.

15.2.6.3.3 Results 15.2.6.3.3.1 Loss of All Grid Connections This is a non-limiting event that has not been reanalyzed for power rerate. The results of this event are based on Cycle 1 conditions. An analysis of this event for current conditions is not expected to result in a change in the general trends and characteristics as shown.

Loss of all grid connections causes simultaneous generator load rejection and loss of all auxiliary power. It essentially takes on the characteristic response of the standard full load rejection discussed in Section 15.2.2. Figure 15.2-8 graphically shows the simulated transient. Peak neutron flux reaches 178.5% of NBR power while fuel surface heat flux peaks at 101.3% of initial value.

15.2.6.3.4 Consideration of Uncertainties The most conservative characteristics of protection features are assumed. Any actual deviations in plant performance are expected to make the results of this transient less severe.

Operation of the RCIC or HPCI systems is not included in the simulation of the first 50 seconds of this transient. Startup of these pumps occurs in the latter part of this time period, but the systems have no significant effect on the results of this transient.

Following turbine control valve closure, the reactor pressure is expected to increase until the MSRV setpoints are reached. During this time the valves operate in a cyclic manner to discharge the decay heat to the suppression pool.

15.2.6.4 Barrier Performance 15.2.6.4.1 Loss of All Grid Connections MSRVs open in the pressure relief mode of operation as the pressure increases beyond their setpoints. The vessel bottom peak pressure is well below the vessel pressure limit of 1375 psig.

15.2.6.5 Radiological Consequences CHAPTER 15 15.2-20 REV. 19, SEPTEMBER 2018

LGS UFSAR While the consequence of this transient does not result in fuel failure, it does result in the discharge of normal coolant activity to the suppression pool via MSRV operation. Because this activity is contained in the primary containment, there is no exposure to operating personnel. This transient does not result in an uncontrolled release to the environment, so the plant operator can choose to leave the activity bottled up in the containment or discharge it to the environment under controlled release conditions. If purging of the containment is chosen, the release will be in accordance with established Technical Specifications and, at the worst, would only result in a small increase in the yearly integrated exposure level.

15.2.7 LOSS OF FEEDWATER FLOW The Loss of Feedwater Flow (LOFW) event represents the design basis for the performance of the reactor core isolation cooling (RCIC) system. The following criteria are applied to this event:

1) The RCIC system shall maintain sufficient water level inside the core shroud to assure that the top of active fuel remains covered throughout the event.

2) The RCIC system shall maintain wide range sensed reactor water level high enough that the very low level instrument trip setpoint (Level 1) for low pressure emergency core cooling system initiation and MSIV closure is not activated.

This transient event does not pose any direct challenge to the reactor vessel or core in terms of a power or pressure increase. All unacceptable safety results are avoided. However, it is included in the evaluation to provide assurance that sufficient makeup water capability is available to keep the core covered when all normal feedwater flow is lost.

15.2.7.1 Identification of Causes and Frequency Classification 15.2.7.1.1 Identification of Causes A loss of feedwater flow could occur due to pump failures, feedwater controller failures, operator errors, or reactor system variables such as a high vessel water level (Level 8) trip signal.

15.2.7.1.2 Frequency Classification This transient disturbance is categorized as an incident of moderate frequency.

15.2.7.2 Sequence of Events and System Operation 15.2.7.2.1 Sequence of Events Table 15.2-11 lists the sequence of events for Figures 15.2-9A and 15.2-9B.

The operator should verify RCIC and HPCI actuation, so that water inventory is maintained in the reactor vessel. The operator should also monitor reactor water level, pressure control, and turbine-generator auxiliaries during shutdown.

The following is the sequence of operator actions expected during the course of the event when no immediate restart is assumed. The operator should:

CHAPTER 15 15.2-21 REV. 19, SEPTEMBER 2018

LGS UFSAR

a. Verify that all rods are in, following the scram.

b. Verify the initiation of HPCI and RCIC.

c. Verify that the recirculation pumps trip on reactor low level.

d. Secure HPCI when reactor level and pressure are under control.

e. Continue operation of the RCIC until decay heat diminishes to a point where the RHR system can be put into service.

f. Monitor the turbine coast-down, breaking vacuum as necessary.

15.2.7.2.2 System Operation Loss of feedwater flow results in a proportional reduction of vessel inventory, causing the vessel water level to drop. The first corrective action is the low level (Level 3) trip actuation. RPS responds within l.05 seconds after reaching this trip level to scram the reactor. The 1.05 second total response time is equal to the level sensor response time (1.0 seconds) plus the RPS logic delay time (0.05 seconds). The low level (Level 3) trip function meets the single failure criterion.

Pressure control is maintained by the turbine bypass system, since the MSIVs remain open.

Because of an additional steam flow induced process measurement error in the Level 3 scram, the timing values in Table 15.2-11 following Low water level scram based on the L3 Analytical Limit are slightly different. However, as described in Reference 15.2-4, the impact of the change is not significant.

15.2.7.2.3 The Effect of Single Failures and Operator Errors The nature of this transient, as explained above, results in a lowering of vessel water level. Key corrective actions to shut down the reactor are automatic, and designed to satisfy the single failure criterion.

15.2.7.3 Core and System Performance 15.2.7.3.1 Mathematical Model The computer model described in Reference 6.3.7 was used to simulate this transient.

15.2.7.3.2 Input Parameters and Initial Conditions This analysis has been performed, unless otherwise noted, with plant conditions as described in Section 6.3.3.

15.2.7.3.3 Results Feedwater flow termination results in a decrease in subcooling, causing a reduction in core power level and pressure. As power level is lowered, the turbine steam flow starts to drop off because the pressure regulator is attempting to maintain pressure. Water level continues to drop until the CHAPTER 15 15.2-22 REV. 19, SEPTEMBER 2018

LGS UFSAR vessel level (Level 3) scram trip setpoint is reached, whereupon the reactor is shut down. The trip of the recirc pumps occurs at approximately 13 seconds (after reactor scram) due to vessel water dropping to the Level 2 trip setpoint. Also at this time RCIC operation is initiated. For this analysis the HPCI system is assumed to be unavailable. MCPR remains considerably above the safety limit since increases in heat flux are not experienced.

The timing values in Table 15.2-11 following Low water level scram based on the L3 Analytical Limit are slightly different. However, as described in Reference 15.2-4, the impact of the change is not significant.

Water level in the annulus slowly decreases until the boil off from decay heat is matched by the RCIC makeup flow. The LOFW analysis (Reference 15.2.2) assumed 3622 Mwt for an initial core thermal power. For these conditions the minimum water level in the annulus region is predicted to reach a minimum of 6.5 feet above the level 1 setpoint, occurring at approximately 800 seconds after the start of the event. Since natural recirculation flow continues through the core, the water level inside the shroud is maintained within the separator elevation.

15.2.7.3.4 Consideration of Uncertainties EOC scram characteristics are assumed.

This transient is most severe from high power conditions, because the rate of level decrease is greatest, and the amounts of stored and decay heat to be dissipated are highest. As noted the LOFW analysis was conservatively performed at a power level of 3622 MWt. Furthermore, the HPCI systems was assumed to be unavailable. The RCIC system is assumed to inject at rated flow 55 seconds after the level 2 initiation signal.

An additional steam flow induced process measurement error in the Level 3 scram was accounted for in the Loss of Normal Feedwater event. A lowering in the Level 3 Analytical Limit (AL) setpoint was calculated in Reference 15.2-4. It was determined that adequate margin exists to Top of Active Fuel (TAF) uncovery while considering a bounding process measurement error applicable for this event. The consequences of lowering the AL is a bounding reduction in minimum water level in the upper plenum of 12 inches and a bounding reduction in minimum water level of 12 inches in the vessel downcomer region as discussed in Reference 15.2-4. The analysis also shows significant margin to the TAF. The results of the analysis are applicable for power levels up to extended (20%) Power Uprate (3952 MWt). The impact of the change is not significant, and no event descriptions or conclusions in the UFSAR need to be modified.

15.2.7.4 Barrier Performance The consequences of this transient do not result in a temperature or pressure transient.

Therefore, the RCPB is not threatened.

15.2.7.5 Radiological Consequences Since this transient does not result in fuel failures or release of reactor coolant, there are no radiological consequences associated with the transient.

15.2.8 FEEDWATER LINE BREAK CHAPTER 15 15.2-23 REV. 19, SEPTEMBER 2018

LGS UFSAR Refer to Section 15.6.6 15.2.9 FAILURE OF RHR SHUTDOWN COOLING Normally, in evaluating component failure considerations associated with the RHR shutdown cooling mode of operation, active pumps or instrumentation (all of which are redundant for safety system portions) would be assumed to be the likely failed equipment. For purposes of analysis, the single recirculation loop suction valve to the redundant RHR loops is assumed to fail. This failure would, of course, still leave four complete RHR loops for LPCI, or two RHR loops for LPCI and two loops for pool, and containment cooling minus the normal RHR shutdown cooling loop connection. Although the valve could be manually opened, it is assumed to be failed indefinitely. If it is now assumed that the single active failure criterion is applied, the plant operator has at least one complete RHR loop with a heat exchanger available.

Recent analytical evaluations of this transient have required additional worst case assumptions.

These include:

a. Loss of all offsite ac power.

b. Utilization of safety shutdown equipment only.

c. Operator involvement only after 10 minutes after coincident assumptions.

Incorporation of these assumptions changes the initial incident (malfunction of RHR suction valve) from a moderate frequency incident to a classification in the design basis accident status.

However, the transient is evaluated as a moderate frequency event with its subsequent limits.

During cold shutdown or refueling operation conditions, four subsystems of shutdown cooling exist, comprised of the A heat exchanger and A RHR pump, A heat exchanger and C RHR pump, B heat exchanger and B RHR pump, and B heat exchanger and D RHR pump. If two subsystems of shutdown cooling are required to be operable per Technical Specifications and both subsystems are associated with the same heat exchanger, a failure of the shutdown cooling discharge valve or discharge check valve associated with that heat exchanger may require use of the alternate vessel return flowpath, if manual repair of the valve can not be effected. This single failure is considered to be bounded by the single failure of the recirculation loop suction valve to the redundant RHR loops described above in that mitigating actions required to be taken in the event of a suction valve failure (ADS/relief valve with alternate shutdown cooling flowpath) exceed the required actions for a discharge valve failure. Further, a loss of electical power to the shutdown cooling discharge valve following the initial establishment of shutdown cooling would not require a change in cooling flowpath as the motor-operated valve fails in-place, and would be positioned for normal shutdown cooling return.

15.2.9.1 Identification of Causes and Frequency Classification 15.2.9.1.1 Identification of Causes The plant is operating at 3528 MWt when a long-term LOOP occurs, causing multiple MSRV actuation (Section 15.2.6) and subsequent heatup of the suppression pool. Reactor vessel depressurization is initiated to bring the reactor pressure to approximately 75 psig. Concurrent CHAPTER 15 15.2-24 REV. 19, SEPTEMBER 2018

LGS UFSAR with the LOOP, an additional single failure occurs which prevents the operator from establishing the normal shutdown cooling path through the RHR shutdown cooling lines. The operator then establishes a shutdown cooling path for the vessel through the ADS valves.

15.2.9.1.2 Frequency Classification This transient is evaluated as a moderate frequency event. However, for the following reasons it could be considered an infrequent incident:

a. No RHR valves have failed in the shutdown cooling mode in BWR total operating experience.

b. The set of conditions evaluated is for multiple failure as described above and is only postulated (not expected) to occur.

15.2.9.2 Sequence of Events and System Operation 15.2.9.2.1 Sequence of Events The sequence of events for this transient is shown in Table 15.2-12. Figures 15.2-10 and 15.2-11 show shutdown cooling paths.

For the early part of the transient, the operator actions are identical to those described in Section 15.2.6 (LOOP transient with isolation/scram).

The operator should do the following:

a. Within approximately 10 minutes of the isolation/scram, the operator should initiate RPV shutdown depressurization at 100F/hr by manual actuation of the MSRVs.

b. At approximately 15 minutes into the transient, the operator should initiate suppression pool cooling (again for purposes of this analysis, it is assumed that only one RHR heat exchanger is available).

c. After the RPV is depressurized to approximately 75 psig, the operator should attempt to open the two RHR shutdown cooling suction valves. This attempt is assumed to be unsuccessful.

d. The operator then powers open the ADS relief valves to complete blowdown, and floods the RPV with LPCI or core spray to establish a closed cooling path as described in Figure 15.2-11.

15.2.9.2.2 System Operation Plant instrumentation and control is assumed to be functioning normally except as noted. In this evaluation, credit is taken for the plant and reactor protection systems and/or the ESF is used.

15.2.9.2.3 The Effect of Single Failures and Operator Errors CHAPTER 15 15.2-25 REV. 19, SEPTEMBER 2018

LGS UFSAR The worst case single failure has already been analyzed in this transient. Therefore, no single failure or operator error can make the consequences of this event any worse. See Section 15.9 for a discussion of this subject.

15.2.9.3 Core and System Performance 15.2.9.3.1 Methods, Assumptions, and Conditions A transient that can directly cause reactor vessel water temperature increase is one in which the energy removal rate is less than the decay heat rate. The applicable transient is loss of RHR shutdown cooling. This transient can occur only during the low pressure portion of a normal reactor shutdown and cooldown, when the RHR system is operating in the shutdown cooling mode. During this time, MCPR remains high and nucleate boiling heat transfer is not exceeded at any time. Therefore, the core thermal safety margin remains essentially unchanged. The 10 minute time period assumed for operator action is an estimate of how long it would take before the operator would initiate the necessary actions; it is not a time by which he must initiate action.

15.2.9.3.2 Mathematical Model In evaluating this transient, the important parameters to consider are reactor depressurization rate and suppression pool temperature. Models used for this evaluation are described in Section 6.2.1.8.

15.2.9.3.3 Input Parameters and Initial Conditions Table 15.2-13 shows the input parameters and initial conditions used in evaluation of this transient.

15.2.9.3.4 Results For most single failures that could result in loss of shutdown cooling, no unique safety actions are required. In these cases, shutdown cooling is simply re-established using an alternate shutdown cooling flow path. In cases where either of the RHR shutdown cooling suction valves cannot be opened, alternate paths are available to accomplish the shutdown cooling function (Figure 15.2-10). An evaluation has been performed assuming the worst single failure that could disable the RHR shutdown cooling valves.

As a result of SIL 636, the failure of RHR cooling transient was re-evaluated to determine the impact of the increased decay heat and was performed at a reactor power of 3528 MWt and a revised K-factor for the RHR heat exchangers. This qualitative evaluation concludes that there no significant changes in the suppression pool temperature profile or shutdown cooling time, more information on the SIL 636 evaluation is provided in Section 6.2.1.8.

The analysis demonstrates the capability to safely transfer fission product decay heat, and other residual heat, from the reactor core so that specified acceptable fuel design limits and the design conditions of the RCPB are not exceeded. The evaluation assures that, for onsite electric power system operation (assuming offsite power is not available), and for offsite electric power system operation (assuming onsite power is not available), the safety function can be accomplished, assuming a worst case single failure.

CHAPTER 15 15.2-26 REV. 19, SEPTEMBER 2018

LGS UFSAR The alternate cooldown path, chosen to accomplish the shutdown cooling function, utilizes the RHR pumps and heat exchangers, core spray pumps and ADS or normal relief valve systems (Reference 15.2-1 and Figure 15.2-11).

The alternate shutdown systems are capable of performing the function of transferring heat from the reactor to the environment using only safety-grade equipment. Even if it is additionally postulated that all of the ADS or relief valves discharge piping also fails, the shutdown cooling function would eventually be accomplished as the cooling water would run directly out of the ADS or MSRVs, flooding into the drywell and then to the suppression pool.

The systems have suitable redundancy in components so that, for onsite electrical power operation (assuming offsite power is not available), and for offsite electrical power operation (assuming onsite power is also not available), the systems' safety function can be accomplished, even assuming an additional single failure. The systems can be fully operated from the main control room.

The design evaluation is divided into two phases:

a. Full power operation to approximately 75 psig vessel pressure.

b. Approximately 75 psig vessel pressure to cold shutdown (200F) conditions.

15.2.9.3.4.1 Full Power to Approximately 75 psig Independent of the transient that initiated plant shutdown (whether it be a normal plant shutdown or a forced plant shutdown), the reactor is normally brought to approximately 75 psig using either the main condenser or, in the case where the main condenser is unavailable, the RCIC/HPCI systems, together with the nuclear boiler pressure relief system.

For evaluation purposes, however, it is assumed that plant shutdown is initiated by a transient event (LOOP) that results in reactor isolation/scram and subsequent relief valve actuation and suppression pool heatup. For this postulated condition, the reactor is shut down and the reactor vessel pressure and temperature are reduced to, and maintained at, saturated conditions at approximately 75 psig. The RPV is depressurized by manually opening selected MSRVs.

Reactor vessel makeup water is automatically provided via the RCIC/HPCI systems. While in this condition, the RHR system (suppression pool cooling mode) is used to maintain the suppression pool temperature within design limits.

These systems are designed to routinely perform their functions for both normal and forced plant shutdown. Since the RCIC, HPCI, and RHR systems are divisionally separated, no single failure, together with the LOOP, can prevent reaching the 75 psig level.

For conservatism in the analysis of this event, it was assumed that the reactor vessel makeup water was provided by the feedwater system instead of the HPCI/RCIC system. While feedwater system is not a safety system, this assumption maximizes the energy addition to the vessel and containment due to the residual heat in the feedwater system. This results in a conservative calculation of the vessel depressurization and cooldown and conservative suppression pool temperature results.

15.2.9.3.4.2 Approximately 75 psig to Cold Shutdown CHAPTER 15 15.2-27 REV. 19, SEPTEMBER 2018

LGS UFSAR The following assumptions are used for the analyses of the procedures for attaining cold shutdown from a pressure of approximately 75 psig:

a. The vessel is at 75 psig and saturated conditions.

b. A worst case single failure is assumed to have occurred (i.e., loss of a division of emergency power).

c. There is no offsite power available.

In the event that the RHR shutdown suction line is not available because of single failure, the first action to be taken will be for personnel to gain access to the suction line and to attempt to effect repairs. For example, if a single electrical failure caused a suction valve to fail in the closed position, a hand wheel is provided on the valve to allow manual operation. If for some reason the normal shutdown cooling suction line cannot be repaired, the capabilities described below will satisfy the normal shutdown cooling requirements and comply with GDC 34.

The RHR shutdown cooling line valves are in two divisions (Division 1 = the outboard valve, and Division 2 = the inboard valve) to satisfy containment isolation criteria. For evaluation purposes, the worst case failure is assumed to be the loss of a division of emergency power, since this also prevents actuation of one shutdown cooling line valve. ESF equipment available for accomplishing the shutdown cooling function includes (for the selected path) the following:

a. ADS (dc Division 1 and dc Division 3)

b. RHR Loop A (Division 1)

c. RHR Loop B (Division 2)

d. HPCI (dc Division 2 and 4)

e. RCIC (dc Division 1 and 3)

f. Core Spray A (Division 1 and 3)

g. Core Spray B (Division 2 and 4).

For failures of Division 1 or 2, the following systems are assumed to be functional:

a. Division 1 fails, Divisions 2, 3, and 4 are functional:

Failed Systems Functional Systems RHR Pump A HPCI CS Loop A ADS (one solenoid)

RCIC RHR Loop B CS Loop B RHR Pumps B, C, and D CHAPTER 15 15.2-28 REV. 19, SEPTEMBER 2018

LGS UFSAR

b. Division 2 fails, Divisions 1,3, and 4 are functional:

Failed Systems Functional Systems RHR Pump B CS Loop A CS Loop B RCIC HPCI RHR Loop A ADS RHR Pumps A, C, and D Assuming the single failure is the failure of Division 1, the safety function is accomplished by establishing one of the cooling loops described in Activity C1 of Figure 15.2-11. If the assumed single failure is Division 2, the safety function is accomplished by establishing one of the cooling loops described as Activity C2 of Figure 15.2-11.

Using the above assumptions, and following the depressurization transient shown in Figure 15.2-12A and 15.2-12B, the suppression pool temperature is shown in Figure 15.2-13.

The failure of RHR shutdown cooling event was evaluated for power rerate at an initial power level of 3694 MWt, ANS 5.1-1979 nominal decay heat values, and RHR heat exchanger K-value of 288.9 BTU/sec-F.

A qualitative evaluation was performed for this event considering the increased decay heat loads of SIL 636. Using an initial power level of 3528 MWt and an RHR heat exchanger K-value of 305 BTU/sec-F, the increase in decay values of SIL 636 with 2 sigma uncertainty is not expected to increase the shutdown cooling time beyond the 30 hours1.25 days <br />0.179 weeks <br />0.0411 months <br /> calculated for power rerate at 3694 MWt.

(Ref. 15.2-3) 15.2.9.4 Barrier Performance As noted above, the consequences of this transient do not result in any temperature or pressure transient in excess of the criteria for which the fuel, pressure vessel, or containment are designed.

Release of coolant to the containment occurs via MSRV actuation. Release of radiation to the environment is described below.

15.2.9.5 Radiological Consequences While this transient does not result in fuel failure, it does result in the discharge of normal coolant activity to the suppression pool via MSRV operation. Because this activity is contained in the primary containment, there is no exposure to operating personnel. This transient does not result in an uncontrolled release to the environment, so the plant operator can choose to leave the activity bottled up in the containment or discharge it to the environment under controlled release conditions. If purging of the containment is chosen, the release will be in accordance with established technical specifications and, at the worst, would only result in a small increase in the yearly integrated exposure level.

15.2.10 LOSS OF STATOR COOLING 15.2.10.1 Identification of Causes and Frequency Classification CHAPTER 15 15.2-29 REV. 19, SEPTEMBER 2018

LGS UFSAR 15.2.10.1.1 Identification of Causes A Loss of Stator Cooling (LOSC) event begins after a sustained Stator Coolant Trouble signal resulting from low coolant flow, low system discharge pressure, or high system return temperature.

15.2.10.1.2 Frequency Classification A LOSC is a moderate frequency event and classified as an AOO.

15.2.10.2 Sequence of Events and System Operation 15.2.10.2.1 Sequence of Events Table 15.2-15 lists the sequence of events for a LOSC event initiated at rated power. The sequence of events presented in Table 15.2-15 is for the analysis conditions. In actuality, the recirculation pump runbacks do not occur simultaneously but are separated by several seconds.

15.2.10.2.2 System Operation Once the LOSC signal is confirmed, both recirculation pumps will runback to 42% speed.

Additionally a runback of the turbine-generator will initiate. The turbine-generator runback will cause the turbine control valves to close slowly. The turbine bypass valves will open in response to the closure of the turbine control valves. Once the available bypass capacity is exceeded, the system will begin to pressurize. The event is terminated when the reactor scrams on high pressure or high neutron flux. The analysis also considers the TBSOOS condition 15.2.10.2.3 The Effect of Single Failures and Operator Errors The single failure for the LOSC is the failure which initiates the event. No consideration for additional failures is required.

15.2.10.3 Core and System Performance 15.2.10.3.1 Mathematical Model The computer models described in Section 15.1.2.3.1 are used to simulate this transient.

15.2.10.3.2 Input Parameters and Initial Conditions The LOSC is assumed to occur at time zero, as shown in Table 15.2-15. At the same time, both recirculation pumps runback to 42% speed and the turbine-generator runback begins. The turbine-generator runback is assumed to reduce the load set from 105% to 20% over a period of 140 seconds which bounds actual plant response. The first LOSC analysis was done for Unit 1 Cycle 16 and is based on the rated power of 3,515 MWt.

15.2.10.3.3 Results CHAPTER 15 15.2-30 REV. 19, SEPTEMBER 2018

LGS UFSAR The LOSC event has the potential to be a limiting AOO and is therefore confirmed to be bounded by other transients as part of each reload's safety analysis.

15.2.10.3.4 Consideration of Uncertainties All systems utilized for protection in this transient were assumed to have the most conservative allowable response (e.g., pressure scram setpoint). Normal plant behavior is, therefore, expected to reduce the actual severity of the transient.

In actuality, the LOSC signal must be present for several seconds before any plant response is initiated. Additionally, the recirculation pump runbacks do not occur simultaneously but are separated by several seconds. This difference does not impact the results of the analysis because core flow reaches the reduced steady state flow well before the pressurization part of the event occurs. Finally, the actual turbine-generator runback times are greater than the assumed value. A shorter runback time results in a greater pressurization rate, increasing the severity of the event.

15.2.10.4 Barrier Performance The consequences of this transient do not result in any temperature or pressure transient in excess of the criteria for which the fuel, pressure vessel or containment are designed.

Therefore, these barriers maintain their integrity and function as designed.

15.2.10.5 Radiological Consequences Because this transient does not result in any fuel failures, or any release of primary coolant to either the secondary containment or to the environment, there are no radiological consequences associated with this transient.

15.2.11 REFERENCES 15.2-1 Letter R.S. Boyd to I.F. Stuart, "Requirements Delineated for RHRS - Shutdown Cooling System - Single Failure Analysis" (November 12, 1975).

15.2-2 "Emergency Core Cooling System Parameter Relaxations for Limerick Generating Station Units 1 & 2, GE-NE-L12-00822, February 1995.

15.2-3 "Limerick Generating Station 1 & 2 SIL 636 Evaluation," GE, GE-NE-0000-0003-3779, June 2003 15.2-4 GE-Hitachi Nuclear Energy, 0000-0077-4603-R1, "BWR Owners Group Evaluation of Steam Flow Induced Error (SFIE) Impact on the L3 Setpoint Analytic Limit,"

October 2008.

CHAPTER 15 15.2-31 REV. 19, SEPTEMBER 2018

LGS UFSAR Table 15.2-1 SEQUENCE OF EVENTS FOR TURBINE-GENERATOR LOAD REJECTION WITH BYPASS(1)

TIME (sec) EVENT

-0.015 (approx.) Turbine-generator detection of loss of electrical load 0.0 Turbine-generator power load unbalance devices trip to initiate turbine control valve fast closure.

0.0 Turbine-generator power load unbalance trip initiates main turbine bypass system operation.

0.0 Fast turbine control valve closure initiates scram trip.

0.0 Turbine control valve closure initiates an RPT.

0.07 Turbine control valve closed.

0.14 Turbine bypass valves start to open.

0.175 Recirculation pump motor circuit breakers open causing the recirculation drive flows to coast down.

2.0 Group 1 MSRVs actuated.

2.15 Group 2 MSRVs actuated.

2.40 Group 3 MSRVs actuated.

3.90 Group 1 MSRVs close.

(1)

See Figure 15.2-1.

NOTE: The results presented here are based on original plant conditions. Because this is not a limiting transient, this event was not reanalyzed for rerated conditions. However, the general trends and characteristics as shown here are not expected to change.

CHAPTER 15 15.2-32 REV. 13, SEPTEMBER 2006

LGS UFSAR Table 15.2-2 SEQUENCE OF EVENTS FOR TURBINE-GENERATOR LOAD REJECTION WITHOUT BYPASS(1)

TIME (sec) EVENT

-0.015 (approx.) Turbine-generator detection of loss of electrical load.

0.0 Turbine-generator power load unbalance devices trip to initiate turbine control valve fast closure.

0.0 Turbine bypass valves fail to operate.

0.0 Fast control valve closure initiates scram trip.

0.0 Turbine control valve closure initiates a recirculation pump trip (RPT).

0.08 (approx.) Turbine control valve closed.

0.175 Recirculation pump motor circuit breakers open causing the recirculation drive flow to begin to coast down.

1.9 MSRV actuation initiated.

>6 MSRV closed.

(1)

See Figure 15.2-2.

CHAPTER 15 15.2-33 REV. 13, SEPTEMBER 2006

LGS UFSAR Table 15.2-3 SEQUENCE OF EVENTS FOR TURBINE TRIP WITH BYPASS(1)

TIME (sec) EVENT 0.0 Turbine trip initiates closure of main stop valves.

0.0 Turbine trip initiates bypass operation.

0.01 Main turbine stop valves reach 90% open position and initiates reactor scram trip.

0.01 Main turbine stop valves reach 90% open position and initiates an RPT.

0.1 Turbine stop valves closed.

0.17 Turbine bypass valves start to open to regulate pressure.

2.5 Group 1 MSRVs actuated.

2.7 Group 2 MSRVs actuated.

2.9 Group 3 MSRVs actuated.

8.3 All MSRVs closed.

(1)

See Figure 15.2-3.

NOTE: The results presented here are based on original plant conditions. Because this is not a limiting transient, this event was not reanalyzed for rerated conditions. However, the general trends and characteristics as shown here are not expected to change.

CHAPTER 15 15.2-34 REV. 13, SEPTEMBER 2006

LGS UFSAR Table 15.2-4 SEQUENCE OF EVENTS FOR TURBINE TRIP WITHOUT BYPASS(1)

TIME (sec) EVENT 0.0 Turbine trip initiates closure of main stop valves.

0.0 Turbine bypass valves fail to operate.

0.01 Main turbine stop valves reach 90% open position and initiate reactor scram trip.

0.01 Main turbine stop valves reach 90% open position and initiate an RPT.

0.1 Turbine stop valves closed.

0.175 Recirculation pump motor circuit breakers open causing the recirculation drive flows to coast down.

1.8 MSRV actuation initiated.

>6 MSRVs closed.

(1)

See Figure 15.2-4.

CHAPTER 15 15.2-35 REV. 13, SEPTEMBER 2006

LGS UFSAR Table 15.2-5 SEQUENCE OF EVENTS FOR MSIV CLOSURE(2)

TIME (sec) EVENT 0.0 Initiate closure of all MSIV 0.3 MSIV position trip scram initiated(1) 2.9 Recirculation pump drive motors are tripped 3.1 MSRVs open 3 groups due to pressure relief setpoint action 14.6 All MSRVs closed 26.0 Initiate HPCI and RCIC systems on low-low water level (Level 2)

(1)

The event was simulated with an MSIV position trip at the 90% open position. Using an analytical value of 85% has no significant impact on the CPR and peak system pressure results.

(2)

See Figure 15.2-5.

NOTE: The results presented here are based on original plant conditions. Because this is not a limiting transient, this event was not reanalyzed for rerated conditions. However, the general trends and characteristics as shown here are not expected to change.

CHAPTER 15 15.2-36 REV. 13, SEPTEMBER 2006

LGS UFSAR Table 15.2-6 TYPICAL RATES OF DECAY FOR CONDENSER VACUUM CAUSE ESTIMATED VACUUM DECAY RATE

a. Failure or isolation of steam jet air ejectors <1 inch Hg/minute

b. Loss of sealing steam to shaft gland seals 1 to 2 inches Hg/minute (approx)

c. Opening of vacuum breaker valves 2 to 12 inches Hg/minute (approx)

d. Loss of one or more circulating water pumps 4 to 24 inches Hg/minute (approx)

CHAPTER 15 15.2-37 REV. 13, SEPTEMBER 2006

LGS UFSAR Table 15.2-7 SEQUENCE OF EVENTS FOR LOSS OF CONDENSER VACUUM(1)

TIME (sec) EVENT

-3.0 Initiate simulated loss of condenser vacuum at 2 inches of Hg per second.

0.0 (est) Low condenser vacuum main turbine trip actuated.

0.0 (est) Low condenser vacuum feedwater trip actuated.

0.01 Main turbine trip initiates reactor scram.

0.01 Main turbine trip initiates RPT.

0.1 Turbine stop valves closed.

0.1 Bypass valves begin to open.

2.5 Group 1 MSRV setpoints actuated.

2.7 Group 2 MSRV setpoints actuated.

2.9 Group 3 MSRV setpoints actuated.

5.0 Low condenser vacuum initiates MSIV closure.

5.0 Low condenser vacuum initiates bypass valve closure.

13.3 All MSRVs close.

16.9 MSRV cyclic actuation on pressure demand.

50.6 HPCI/RCIC system initiation on low level (Level 2) (not included in simulation)

(1)

See Figure 15.2-6.

NOTE: The results presented here are based on original plant conditions. Because this is not a limiting transient, this event was not reanalyzed for rerated conditions. However, the general trends and characteristics as shown here are not expected to change.

CHAPTER 15 15.2-38 REV. 13, SEPTEMBER 2006

LGS UFSAR Table 15.2-8 TRIP SIGNALS ASSOCIATED WITH LOSS OF CONDENSER VACUUM Condenser Vacuum (Inches of Hg)

Transient Analysis (Table 15.2-7)

a. Normal Operating -

Range

b. Main Turbine Trip 20

c. Feedwater Trip 20

d. MSIV Closure 10 Initiated

e. Bypass Valve Closure 10 Initiated (1)

In the plant, the spread between the turbine trip (b) and bypass valve closure (e) conservatively exceeds the analyzed condition. The transient analysis CPR and peak system pressure results remain bounding.

NOTE: The results presented here are based on original plant conditions. Because this is not a limiting transient, this event was not reanalyzed for rerated conditions. However, the general trends and characteristics as shown here are not expected to change.

CHAPTER 15 15.2-39 REV. 13, SEPTEMBER 2006

LGS UFSAR Table 15.2-9 SEQUENCE OF EVENTS FOR LOSS OF AUXILIARY POWER TRANSFORMER(1)

REFER TO TABLE 15.2-10 (1)

See Figure 15.2-7.

CHAPTER 15 15.2-40 REV. 13, SEPTEMBER 2006

LGS UFSAR Table 15.2-10 SEQUENCE OF EVENTS FOR LOSS OF ALL GRID CONNECTIONS(1)

TIME (sec) EVENT

-0.015 (approx.) Loss of grid causes turbine-generator to detect a loss of electrical load.

0.0 Turbine control valve fast closure is initiated.

0.0 Turbine-generator power load unbalance trip initiates main turbine bypass system operation.

0.0 Recirculation system pump motors are tripped.

0.0 Turbine control valve fast closure initiates a reactor scram trip.

0.07 Turbine control valves closed.

0.10 Turbine bypass valves begin to open.

2.0 Feedwater pumps trip on low suction pressure.

2.4 MSRVs open and cycle.

7.2 Initial SRVs closure.

49 Low water Level 2 setpoint reached, HPCI/RCIC initiated (not simulated).

(1)

See Figure 15.2-8.

NOTE: The results presented here are based on original plant conditions. Because this is not a limiting transient, this event was not reanalyzed for rerated conditions.

However, the general trends and characteristics as shown here are not expected to change.

CHAPTER 15 15.2-41 REV. 13, SEPTEMBER 2006

LGS UFSAR Table 15.2-11 SEQUENCE OF EVENTS FOR LOSS OF FEEDWATER FLOW TIME (sec) EVENT 0.0 Trip of all feedwater pumps initiated.

~6 Vessel water level (Level 3)(1) trip initiates scram trip.

~19 Vessel water level (Level 2)* trip initiates RCIC (and HPCI) operation.

~19 Vessel water level (Level 2) trip initiates containment isolation.

~19 Vessel water level (Level 2) trip initiates recirculation pump trip.

~74 Rated RCIC flow is achieved. **

~800 Minimum Level is reached (444 inches above vessel zero),

approx. 45.5 inches above Level 1 trip.***

Note:

(1)

Because of an additional steam flow induced process measurement error in the Level 3 scram, the timing values following Low water level scram based on the L3 Analytical Limit are slightly different. However, as described in Reference 15.2-4, the impact of the change is not significant.

• Level 2 (Analytical Limit) is assumed to be at 457.5 inches above vessel zero.

• • A system response time of 55 seconds is assumed.

• • • Level 1 (NTSP) is 398.5 inches above vessel zero.

CHAPTER 15 15.2-42 REV. 17, SEPTEMBER 2014

LGS UFSAR Table 15.2-12 SEQUENCE OF EVENTS FOR FAILURE OF RHR SHUTDOWN COOLING TIME (min) EVENT 0 Reactor is operating at 3528 MWt when LOOP occurs initiating plant shutdown.

0 Concurrently, loss of one division of power occurs.

10 Controlled depressurization initiated (100%) using selected MSRVs.

15 Suppression pool cooling initiated to prevent overheating from MSRV actuation(1).

157 Blowdown to approximately 75.0 psig completed.

157 Personnel are sent in to open RHR shutdown cooling suction valve; this fails.

187 Actuate core spray into vessel and reopen ADS valves to establish alternate cooling path.

(1)

See Table 15.2-9 for detailed sequence of events for loss of ac power transient.

CHAPTER 15 15.2-43 REV. 13, SEPTEMBER 2006

LGS UFSAR Table 15.2-13 INPUT PARAMETERS FOR EVALUATION OF FAILURE OF RHR SHUTDOWN COOLING Initial power level (MWt) 3528 Suppression pool mass (lbm) 7.364x106 RHR (KHX value) (Btu/sec/F) 305 Initial vessel condition Pressure (psia) 1068 Temperature (F) 553 Initial primary fluid inventory (lbm) 6.253x105 Initial pool temperature, (F) 9.500x10+1 Service water temperature, (F) 9.500x10+1 Vessel heat capacity (Btu/lbmF) 1.230x10-1 Core spray flow rate, (lbm/sec) 8.690x10+2 RHR pool cooling flow rate (lbm/sec) 1.390x10+3 CHAPTER 15 15.2-44 REV. 13, SEPTEMBER 2006

LGS UFSAR TABLE 15.2-14 SIGNIFICANT INITIAL CONDITIONS AND RESULTS FOR THE GENERATOR LOAD REJECTION WITHOUT BYPASS AND RPT INITIAL CONDITIONS Initiating Event: Generator Load Rejection Failed Systems Recirculation Pump Trip(1)

Turbine Bypass Valves First Functioning Scram Signal Turbine Control Valve Fast Closure RESULTS Maximum Vessel Pressure (psig) 1276 Time of Maximum Pressure (sec) 2.1 Minimum Critical Power Ratio (MCPR) 0.22/0.32(2)

Time of MCPR (sec) 1.19/1.22(2)

(1)

Initiated by Turbine Control Valve Fast Closure.

(2)

GE8X8NB/GE11 CHAPTER 15 15.2-45 REV. 13, SEPTEMBER 2006

LGS UFSAR Table 15.2-15 SEQUENCE OF EVENTS FOR LOSS OF STATOR COOLING TIME (sec) EVENT 0.0 Loss of Stator Cooling occurs.

0.0 Dual Recirculation Pump to 42% Speed is initiated.

0.0 Turbine-Generator Load Set Runback begins from 105%

going to 20% over 140 seconds.

90 (approx.) Turbine-Generator Load Set reaches Turbine Control Valve (TCV) position and starts causing the TCVs to close.

Turbine Bypass Valves (TBV) begin to open in response to the TCV Closure.

120 (approx.) TBVs open to their available capacity. Pressurization begins due to mismatch between steam flow coming from the vessel and the available TCV/TBV capacity.

138 (approx.) Reactor scrams on high pressure.

CHAPTER 15 15.2-46 REV. 18, SEPTEMBER 2016

LGS UFSAR 15.3 DECREASE IN REACTOR COOLANT SYSTEM FLOW RATE 15.3.1 RECIRCULATION PUMP TRIP 15.3.1.1 Identification of Causes and Frequency Classification 15.3.1.1.1 Identification of Causes Recirculation pump motor operation can be tripped off either by design for the reduction of other core and RCPB transient effects or by random unpredictable operational failures. Intentional tripping will occur in response to the following:

a. Reactor vessel water level Level 2 setpoint trip

b. Turbine control valve fast closure or stop valve closure

c. Reactor vessel high pressure setpoint trip

d. Motor branch circuit overcurrent protection

e. Motor overload protection

f. Suction block valve not fully open

g. Discharge valve not fully open

h. Deleted

i. Low lube oil pressure

j. Main unit lockout

k. Deleted

l. Deleted

m. Bus undervoltage

n. High oil temperature

o. Manual trip Random tripping will occur in response to the following:

a. Operator error

b. Loss of electrical power source to the pumps

c. Equipment or sensor failures and malfunctions which initiate the above trips.

CHAPTER 15 15.3-1 REV. 18, SEPTEMBER 2016

LGS UFSAR 15.3.1.1.2 Frequency Classification 15.3.1.1.2.1 Trip of One Recirculation Pump This transient is categorized as one of moderate frequency.

15.3.1.1.2.2 Trip of Two Recirculation Pumps This transient is categorized as one of moderate frequency.

15.3.1.2 Sequence of Events and System Operation 15.3.1.2.1 Sequence of Events 15.3.1.2.1.1 Trip of One Recirculation Pump Table 15.3-1 lists the sequence of events for Figure 15.3-1.

15.3.1.2.1.2 Trip of Two Recirculation Pumps Table 15.3-2 lists the sequence of events for Figure 15.3-2.

15.3.1.2.1.3 Identification of Operator Actions 15.3.1.2.1.3.1 Trip of One Recirculation Pump Since no scram occurs for trip of one recirculation pump, no immediate operator action is required. As soon as possible, the operator should first verify that no operating limits are being exceeded and then reduce the flow of the operating pump to conform to the single pump flow criteria. Also, the operator must determine the cause of failure before following the restart procedure and returning the system to normal.

15.3.1.2.1.3.2 Trip of Two Recirculation Pumps Tripping of two recirculation pumps will cause a reactor water level swell that will trip the main turbine. This in turn will cause a reactor scram. The operator should ascertain that the reactor has been scrammed by the turbine trip resulting from reactor water level swell. The operator should regain control of reactor water level through RCIC operation, monitoring reactor water level and pressure control after shutdown. When both reactor pressure and level are under control, the operator may secure both HPCI and RCIC as necessary. The operator should also determine the cause of the trip before returning the system to normal.

15.3.1.2.2 System Operation 15.3.1.2.2.1 Trip of One Recirculation Pump Tripping a single recirculation pump requires no protection system or safeguard system operation.

This analysis assumes normal functioning of plant instrumentation and controls.

CHAPTER 15 15.3-2 REV. 18, SEPTEMBER 2016

LGS UFSAR 15.3.1.2.2.2 Trip of Two Recirculation Pumps Analysis of this transient assumes normal functioning of plant instrumentation and controls as well as plant and reactor protection systems.

Specifically, this transient takes credit for vessel level (Level 8) instrumentation that closes the turbine stop valves. Reactor shutdown relies on scram trips from the turbine stop valves. High system pressure is limited by MSRV operation.

15.3.1.2.3 The Effect of Single Failures and Operator Errors 15.3.1.2.3.1 Trip of One Recirculation Pump Since no corrective action is required, no additional effects of single failures need be discussed. If additional single active failure or single operator error are assumed (for envelope purposes the other pump is assumed tripped), then the following two-pump trip analysis is provided (Section 15.9.6.3.3.g, Table 15.9-2).

15.3.1.2.3.2 Trip of Two Recirculation Pumps Table 15.3-2 lists the vessel level (Level 8) trip event as the first response to initiate corrective action in this transient. The level (Level 8) is intended to prohibit moisture carryover to the main turbine. Multiple level sensors are used to sense and detect when the water level reaches the Level 8 setpoint. At this point, a single failure will neither initiate nor impede a turbine trip signal.

However, turbine trip signal transmission circuitry is not built to the single failure criterion. The result of a failure at this point would have the effect of delaying the pressurization "signature."

However, high moisture levels entering the turbine can trip the turbine via turbine supervisory instrumentation.

Scram trip signals from the turbine are designed so that a single failure will neither initiate nor impede a reactor scram trip initiation (Section 15.9.6.3.3.g, Table 15.9-2).

15.3.1.3 Core and System Performance 15.3.1.3.1 Mathematical Model The nonlinear dynamic model used to simulate this transient is discussed in Reference 15.1-1.

15.3.1.3.2 Input Parameters and Initial Conditions Unless otherwise noted, these analyses have been performed using Cycle 1 plant conditions.

Pump motors and pump rotors are simulated with minimum specified rotating inertias.

15.3.1.3.3 Results The results of these events are based on Cycle 1 conditions. However, with the development of new analysis methodologies and the introduction of new fuel types, a recirculation pump trip does not have as significant of a level response and the Level 8 setpoint is not expected to be reached.

In this scenario, a two recirculation pump trip remains non-limiting. Additionally, other transient CHAPTER 15 15.3-3 REV. 18, SEPTEMBER 2016

LGS UFSAR events which result in a two recirculation pump trip model the recirculation pump trip as part of the event, and the resulting level response may be different than the historic Cycle 1 response due to the introduction of new fuel types and the use of newer analysis methodologies.

15.3.1.3.3.1 Trip of One Recirculation Pump Figure 15.3-l shows the results of losing one recirculation pump. The tripped loop diffuser flow reverses in approximately 2.7 seconds. However, the ratio of diffuser mass flow to pump mass flow in the active jet pumps increases considerably and produces approximately 154% of normal diffuser flow and 58% of rated core flow. MCPR remains well above the safety limit; thus, the fuel thermal limits are not violated. During this transient, level swell is not sufficient to cause turbine trip and scram.

15.3.1.3.3.2 Trip of Two Recirculation Pumps Figure 15.3-2 shows this transient, with minimum specified rotating inertia, in graph form. MCPR remains unchanged. No scram is initiated directly by pump trip. The vessel water level swell due to rapid flow coast-down is expected to reach the high level trip, thereby shutting down the main turbine and feed pump turbines and scramming the reactor. Subsequent events, such as main steam line isolation and initiation of RCIC and HPCI systems occurring later in this transient, have no significant effect on the results.

15.3.1.3.4 Consideration of Uncertainties Initial conditions chosen for these analyses are conservative and tend to force analytical results to be more severe than those expected under actual plant conditions.

Actual pump and pump motor driveline rotating inertias are expected to be somewhat greater than the minimum design values assumed in this simulation. Actual plant deviations regarding inertia are expected to lessen the severity of the results indicated by this analysis. Minimum design inertias were used as well as the least negative void coefficient, because the primary concern here is flow reduction.

15.3.1.4 Barrier Performance 15.3.1.4.1 Trip of One Recirculation Pump Figure 15.3-1 results indicate a basic reduction in system pressures from the initial conditions.

Therefore, the RCPB barrier is not threatened.

15.3.1.4.2 Trip of Two Recirculation Pumps The results shown in Figure 15.3-2 indicate that peak pressures stay well below the 1375 psig limit allowed by the applicable code. Therefore, the barrier pressure boundary is not threatened.

15.3.1.5 Radiological Consequences While the consequence of this transient does not result in fuel failure, it does result in the discharge of normal coolant activity to the suppression pool via MSRV operation. Because this activity is contained in the primary containment, there is no exposure to operating personnel. This CHAPTER 15 15.3-4 REV. 18, SEPTEMBER 2016

LGS UFSAR transient does not result in an uncontrolled release to the environment, so the plant operator can choose to leave the activity bottled up in the containment or discharge it to the environment under controlled release conditions. If purging of the containment is chosen, the release will be in accordance with established technical specifications and, at the worst, would only result in a small increase in the yearly integrated exposure level.

15.3.2 RECIRCULATION FLOW CONTROL FAILURE - DECREASING FLOW 15.3.2.1 Identification of Causes and Frequency Classification 15.3.2.1.1 Identification of Causes Some causes of recirculation flow control failure are malfunction of the active ASD controller (one of two redundant controllers), malfunction of the PLC supplying command signals to the controllers, or corruption to the communication between these devices (one of two redundant channels). These malfunctions can result in a rapid flow decrease in only one recirculation loop.

15.3.2.1.2 Frequency Classification This transient is categorized as an incident of moderate frequency.

15.3.2.2 Sequence of Events and System Operation 15.3.2.2.1 Sequence of Events 15.3.2.2.1.1 Failure of One Controller - Closed The sequence of events for this transient is similar to, and can never be more severe than, that listed in Table 15.3-1 for the trip of one recirculation pump.

15.3.2.2.1.2 Deleted 15.3.2.2.1.3 Identification of Operator Actions As soon as possible, the operator should verify that no operating limits are being exceeded. If limits are exceeded, corrective action must be initiated. The operator must also determine the cause of the trip before returning the system to normal.

15.3.2.2.2 System Operation Normal plant instrumentation and control is assumed to function. Credit is taken for scram in response to vessel high water level (Level 8) turbine trip if it occurs.

15.3.2.2.3 The Effect of Single Failures and Operator Errors The single failure and operator error considerations for these events are the same as those discussed in Section 15.3.1.2.3 on the RPT. Failure of an ASD and thus an RPT, would be the envelope case for additional single action failure or single operator error (Section 15.9.6.3.3.f, Table 15.9-2).

CHAPTER 15 15.3-5 REV. 18, SEPTEMBER 2016

LGS UFSAR 15.3.2.3 Core and System Performance 15.3.2.3.1 Mathematical Model The nonlinear dynamic model used to simulate these transients is discussed in Reference 15.1-1.

15.3.2.3.2 Input Parameters and Initial Conditions These analyses have been performed, unless otherwise noted, with Cycle 1 plant conditions. The lowest negative void coefficient in Table 15.0-2 was used for these analyses.

15.3.2.3.3 Results The results of these events are based on Cycle 1 conditions. An analysis of these events for current conditions is not expected to result in a change in the general trends and characteristics as shown.

In the case of zero demand to both controllers each individual ASD speed controller has internal limits established in its system operating program (SOP) that limits the maximum rate of change of speed in each loop. Thus, the results of these transients can never be more severe than those of the simultaneous trip of both recirculation pumps, as evaluated in Section 15.3.1.3.3.2.

The failure of one controller has two possible outcomes. A detectable failure of the active primary controller will cause swap-over to the back-up controller, resulting in maintaining pump speed at a lower fixed (speed-hold) value. An undetectable malfunction of the primary active controller or malfunction of an active back-up controller (with primary controller inactive) can result in a speed decrease at an uncontrolled rate (step change) to 0% speed. This case is similar to the trip of one recirculation pump, described in Section 15.3.1.3.3.1, and is less severe than the transient that results from the simultaneous trip of both recirculation pumps.

15.3.2.3.4 Consideration of Uncertainties Initial conditions chosen for these analyses are conservative and tend to force the analytical results to be more severe than would otherwise be expected. These analyses, unlike the pump trip series, will be unaffected by deviations in pump/pump motor and driveline inertias because the flow controllers are what cause rapid recirculation decreases.

15.3.2.4 Barrier Performance The barrier performance considerations for these events are the same as those discussed in Section 15.3.1.4.

15.3.2.5 Radiological Consequences While the consequence of this transient does not result in fuel failure, it does result in the discharge of normal coolant activity to the suppression pool via MSRV operation. Because this activity is contained in the primary containment, there will be no exposure to operating personnel.

This transient does not result in an uncontrolled release to the environment, so the plant operator can choose to leave the activity bottled up in the containment, or discharge it to the environment under controlled release conditions. If purging of the containment is chosen, the release will be in CHAPTER 15 15.3-6 REV. 18, SEPTEMBER 2016

LGS UFSAR accordance with established Technical Specifications and, at the worst, would only result in a small increase in the yearly integrated exposure level.

15.3.3 RECIRCULATION PUMP SEIZURE 15.3.3.1 Identification of Causes and Frequency Classification The seizure of a recirculation pump is considered as a DBA. It has been evaluated as being a very mild accident in relation to other DBAs such as the LOCA. The analysis has been conducted with consideration to both single-loop and two-loop operations. A discussion is given in GESTAR II (Reference 4.1-1).

15.3.3.1.1 Identification of Causes The case of recirculation pump seizure represents the extremely unlikely event of instantaneous stoppage of the pump motor shaft of one recirculation pump. This accident produces a very rapid decrease of core flow as the result of the large hydraulic resistance introduced by the stopped rotor.

15.3.3.1.2 Frequency Classification This accident is considered a limiting fault but results in effects that are comparable to those of an accident of greater probability (i.e. infrequent incident classification).

15.3.3.2 Sequence of Events and System Operation 15.3.3.2.1 Sequence of Events Table 15.3-3 lists the sequence of events for Figure 15.3-3. Appropriate operator actions must be taken for recovery after the recirculation pump seizure event.

15.3.3.2.2 System Operation In order to properly simulate the expected sequence of events, the analysis of this accident assumes normal functioning of plant instrumentation and controls, plant protection, and reactor protection systems.

Operation of safe shutdown features, though not included in this simulation, is expected to be utilized in order to maintain adequate water level.

15.3.3.2.3 The Effect of Single Failures and Operator Errors Corrective action by the level control is expected to establish a new stable operating state. The effect of a single failure in the level control system has rather straightforward consequences, including level rise or fall by improper control of the feedwater system. Increasing level will trip the main and feedwater turbines. This trip signal is described in Section 15.1.2.2.3. Decreasing level will automatically initiate scram at the low level (Level 3) trip which is designed to single failure criteria (Section 15.9.6.4.3.e, Table 15.9-2).

15.3.3.3 Core and System Performance CHAPTER 15 15.3-7 REV. 18, SEPTEMBER 2016

LGS UFSAR 15.3.3.3.1 Mathematical Model The nonlinear dynamic model used to simulate this accident is discussed in Reference 15.1-1.

15.3.3.3.2 Input Parameters and Initial Conditions This analysis has been performed, unless otherwise noted, with the plant conditions tabulated in Table 15.0-2A.

For the purpose of evaluating consequences to the fuel thermal limits, this accident is assumed to occur as the result of an unspecified, instantaneous stoppage of one recirculation pump shaft while the reactor is operating at 102% rated power. The reactor is also assumed to be operating at thermally limited conditions.

15.3.3.3.3 Results Figure 15.3-3 presents the results of the accident while operating in two-loop mode. Core coolant flow drops rapidly, reaching its minimum value in approximately 1.7 seconds. The vessel water level rises and feedwater flow reduces to compensate. The reactor stabilizes at a new steady-state operating condition. The peak neutron flux and average surface heat flux did not increase significantly above the initial conditions, therefore no impact on the fuel thermal margins is postulated to occur.

A specific analysis has been performed to model the recirculation pump seizure transient while in single-loop mode and is used to establish a MCPR requirement for single-loop operation. See GE-NE-L12-00884-00-01P, GE14 Fuel Design Cycle-Independent Analyses for Limerick Generating Station Units 1 and 2, March 2001, and Reference 15.7-17.

15.3.3.3.4 Consideration of Uncertainties This transient is predicted to result in a reactor vessel water level increase to slightly below the high level (Level 8) turbine trip setpoint. Slightly different nuclear boiler system operational parameters might result in the level swell causing a turbine trip. Should the vessel water level reach the high water level setpoint (Level 8), main turbine trip, resulting from stop valve closure, and feedwater pump trip would be initiated. Subsequently, reactor scram and the remaining recirculation pump trip would be initiated due to the turbine trip. The vessel water level would eventually be controlled by HPCI and RCIC flow.

Further uncertainties are considered in the GETAB (Reference 15.0-2) analysis.

15.3.3.4 Barrier Performance The bypass valves, and possible momentary opening of some of the MSRVs, limit the pressure well within the range allowed by the ASME vessel code. Therefore, the RCPB is not threatened by overpressure.

15.3.3.5 Radiological Consequences CHAPTER 15 15.3-8 REV. 18, SEPTEMBER 2016

LGS UFSAR While the consequence of this accident does not result in fuel failure, it could result in the discharge of normal coolant activity to the suppression pool via MSRV operation. Because this activity is contained in the primary containment, there would be no exposure to operating personnel. This accident does not result in an uncontrolled release to the environment, so the plant operator can choose to leave the activity bottled up in the containment or discharge it to the environment under controlled release conditions. If purging of the containment is chosen, the release will be in accordance with established Technical Specifications and, at the worst, would only result in a small increase in the yearly integrated exposure level.

15.3.4 RECIRCULATION PUMP SHAFT BREAK 15.3.4.1 Identification of Causes and Frequency Classification The breaking of the shaft of a recirculation pump is considered an accident. It has been evaluated as a very mild accident in relation to other DBAs such as the LOCA. The analysis has been conducted with consideration to both single-loop and two-loop operation.

This postulated accident is bounded by the more limiting case of recirculation pump seizure.

Quantitative results for this more limiting case are presented in Section 15.3.3.

15.3.4.1.1 Identification of Causes Recirculation pump shaft breakage represents the extremely unlikely event of instantaneous stoppage of one recirculation pump motor. This accident produces a very rapid decrease of core flow as a result of the broken pump shaft.

15.3.4.1.2 Frequency Classification This accident is considered a limiting fault, but results in effects that are comparable to those of an accident of greater probability (i.e., infrequent incident classification).

15.3.4.2 Sequence of Events and System Operation 15.3.4.2.1 Sequence of Events A postulated instantaneous break of the motor shaft of one recirculation pump, as discussed in Section 15.3.4.1.1, will cause the core flow to decrease rapidly and result in water level swell in the reactor vessel but no scram. The core flow and power will stabilize at new equilibrium conditions. Appropriate operator actions must be taken for recovery after the recirculation pump shaft break event.

15.3.4.2.2 System Operation Normal operation of plant instrumentation and control is assumed. Operation of HPCI and RCIC systems during shutdown is expected in order to maintain adequate water level control.

15.3.4.2.3 The Effect of Single Failures and Operator Errors Effects of single failures are similar to those considered in Section 15.3.3.2.3 .

CHAPTER 15 15.3-9 REV. 18, SEPTEMBER 2016

LGS UFSAR Refer to Section 15.9.6.4.3.f and Table 15.9-3 for more details.

15.3.4.3 Core and System Performance The severity of this pump shaft break accident is bounded by the pump seizure accident as described in Section 15.3.3. This can be easily demonstrated by consideration of these two accidents as discussed in the section below. Since the shaft break accident is less limiting than the accident discussed in Section 15.3.3 only a qualitative evaluation is provided. Therefore, no discussion of mathematical model, input parameters, and consideration of uncertainties, etc., is necessary.

15.3.4.4 Qualitative Results If this extremely unlikely accident occurs, core coolant flow will drop rapidly. The vessel level increases but remains below the trip level (Level 8) of the main and feedwater turbines. The flow in the recirculation loop with the failed pump decreases rapidly. The core flow and then the reactor power stabilize at lower values within less than a minute of the failure.

The severity of this pump shaft break accident is bounded by the pump seizure accident (Section 15.3.3). This can be demonstrated easily by consideration of the two types of accidents. In both accidents, the recirculation drive flow of the affected loop decreases rapidly. In the case of the pump seizure accident, the loop flow decreases faster than the normal flow coast-down as a result of the large hydraulic resistance introduced by the stopped rotor. In the case of the pump shaft break accident, the hydraulic resistance caused by the broken pump shaft is less than that of the stopped rotor for the pump seizure accident. Therefore, the core flow decrease following a pump shaft break effect is slower than the pump seizure accident. Thus, it can be concluded that the potential effects of the hypothetical pump shaft break accident are bounded by the effects of the pump seizure accident.

15.3.4.5 Barrier Performance The bypass valves, and possible momentary opening of some of the MSRVs, limit the pressure well within the range allowed by the ASME vessel code. Therefore, the RCPB is not threatened by overpressure.

15.3.4.6 Radiological Consequences While the consequence of this accident does not result in fuel failure, it could result in the discharge of normal coolant activity to the suppression pool via MSRV operation. Because this activity is contained in the primary containment, there would be no exposure to operating personnel. This accident does not result in an uncontrolled release to the environment, so the plant operator can choose to leave the activity bottled up in the containment, or discharge it to the environment under controlled conditions. If purging of the containment is chosen, the release will be in accordance with established Technical Specifications and, at the worst, would only result in a small increase in the yearly integrated exposure level.

CHAPTER 15 15.3-10 REV. 18, SEPTEMBER 2016

LGS UFSAR Table 15.3-1 SEQUENCE OF EVENTS FOR TRIP OF ONE RECIRCULATION PUMP(1)

TIME (sec) EVENT 0.0 Trip of one recirculation pump initiated.

2.7 Diffuser flow decreases significantly in the tripped loop.

20.0 Core flow stabilizes at new equilibrium conditions.

40.0 Power level stabilizes at new equilibrium conditions.

(1)

See Figure 15.3-1.

NOTE: The results presented here are based on original plant conditions. Because this is not a limiting transient, this event was not reanalyzed for rerated conditions.

However, the general trends and characteristics as shown here are not expected to change.

CHAPTER 15 15.3-11 REV. 13, SEPTEMBER 2006

LGS UFSAR Table 15.3-2 SEQUENCE OF EVENTS FOR TRIP OF BOTH RECIRCULATION PUMPS(2)

TIME (sec) EVENT(1) 0.0 Trip of both recirculation pumps initiated.

5.2 Vessel water level (Level 8) trip initiates turbine trip and feedwater pumps trip.

5.2 Turbine trip initiates bypass operation.

5.2 Turbine trip initiates reactor scram trip.

9.9 Group 1 MSRVs open.

12.9 Group 1 MSRVs close.

43.5 Level 2 vessel level setpoint initiates steam line isolation and HPCI/RCIC start.

(1)

For these events, MSIV closure was simulated at Level 2. Subsequent design modifications have lowered the closure setpoint to Level 1. However, HPCI and RCIC initiation at Level 2 will prevent the water level from dropping to Level 1 and no MSIV closure will occur. Because no safety limits are approached during this event, reanalysis for the setpoint change is not required.

(2)

See Figure 15.3-2.

NOTE: The results presented here are based on original plant conditions. Because this is not a limiting transient, this event was not reanalyzed for rerated conditions. However, the general trends and characteristics as shown here are not expected to change.

CHAPTER 15 15.3-12 REV. 13, SEPTEMBER 2006

LGS UFSAR Table 15.3-3 SEQUENCE OF EVENTS FOR RECIRCULATION PUMP SEIZURE(1)

TIME (sec) EVENT 0.0 Single pump seizure was initiated.

0.7 Jet pump diffuser flow reverses in seized loop.

4.0 Core flow stabilizes at new equilibrium conditions.

40.0 Power stabilizes at new equilibrium conditions.

(1)

See Figure 15.3-3.

CHAPTER 15 15.3-13 REV. 13, SEPTEMBER 2006

LGS UFSAR 15.4 REACTIVITY AND POWER DISTRIBUTION ANOMALIES 15.4.1 ROD WITHDRAWAL ERROR - LOW POWER 15.4.1.1 Control Rod Removal Error During Refueling 15.4.1.1.1 Identification of Causes and Frequency Classification The transient considered here is inadvertent criticality due to the complete withdrawal or removal of the highest worth control rod during refueling. The probability of the initial causes alone is considered low enough to warrant its being categorized as an infrequent incident, since there is no postulated set of circumstances that results in an inadvertent rod withdrawal error while in the refueling mode.

15.4.1.1.2 Sequence of Events and System Operation 15.4.1.1.2.1 Initial Control Rod Removal or Withdrawal During refueling operations system interlocks provide assurance that inadvertent criticality does not occur because two control rods have been removed or withdrawn together.

When fuel is being moved from the core to the spent fuel pool during refueling, the refueling interlocks may be disabled for core cells from which the four fuel assemblies have been removed if the conditions contained in technical specification 3.9.10.2 are met and compensating administrative controls are established.

15.4.1.1.2.2 Fuel Insertion With Control Rod Withdrawn To minimize the possibility of loading fuel into a cell containing no control rod, all control rods must be fully inserted when fuel is being loaded into the core. This requirement is backed up by refueling interlocks on rod withdrawal and movement of the refueling platform. When the mode switch is in the REFUEL position, the interlocks prevent the platform from being moved over the core if a control rod is withdrawn and fuel is on the hoist. Likewise, if the refueling platform is over the core and fuel is on the hoist, control rod motion is blocked by the interlocks.

When fuel is being moved from the core to the spent fuel pool during refueling, the refueling interlocks may be disabled for core cells from which the four fuel assemblies have been removed if the conditions contained in technical specification 3.9.10.2 are met and compensating administrative controls are established.

15.4.1.1.2.3 Second Control Rod Removal or Withdrawal When the platform is not over the core (or fuel is not on the hoist) and the mode switch is in the REFUEL position, only one control rod can be withdrawn. Any attempt to withdraw a second rod results in a rod block by the refueling interlocks. Since the core is designed to meet shutdown requirements with the highest worth rod withdrawn, the core remains subcritical even with one rod withdrawn.

CHAPTER 15 15.4-1 REV. 19, SEPTEMBER 2018

LGS UFSAR 15.4.1.1.2.4 Control Rod Removal Without Fuel Removal Finally, the design of the control rod, incorporating the velocity limiter, does not physically permit the upward removal of the control rod without prior or simultaneous removal of the four adjacent fuel bundles. This precludes any hazardous condition.

15.4.1.1.2.5 Identification of Operator Actions No operator actions are required to preclude this transient since the plant design, as discussed above, prevents its occurrence.

15.4.1.1.2.6 Effect of Single Failure and Operator Errors If any one of the operations involved in initial failure or error is followed by any other single active failure or single operator error, the necessary safety actions (e.g., rod block or scram) are taken automatically prior to limit violation (Section 15.9).

15.4.1.1.3 Core and System Performances Since the probability of inadvertent criticality during refueling is precluded, the core and system performances were not analyzed. The withdrawal of the highest worth control rod during refueling will not result in criticality. This is determined analytically during the core design process.

Shutdown Margin is verified experimentally during the first startup following refueling operations.

(See Section 4.3.2 for a description of the methods and results of the shutdown margin analysis.)

Additional reactivity insertion is precluded by interlocks (Section 7.7). As a result, no radioactive material is ever released from the fuel making it unnecessary to assess any radiological consequences.

No mathematical models are involved in this transient. The need for input parameters or initial conditions is not required as there are no results to report. Consideration of uncertainties is not appropriate.

15.4.1.1.4 Barrier Performance An evaluation of the barrier performance was not made for this transient, since there is not a postulated set of circumstances for which this transient could occur.

15.4.1.1.5 Radiological Consequences An evaluation of the radiological consequences was not made for this transient, since no radioactive material is released from the fuel.

15.4.1.2 Continuous Rod Withdrawal During Reactor Startup 15.4.1.2.1 Identification of Causes and Frequency Classification The probability of initial causes or errors of this transient alone is considered low enough to warrant its being categorized as an infrequent incident. The probability of further development of this transient is extremely low because it is contingent upon the failure of the RWM system, CHAPTER 15 15.4-2 REV. 19, SEPTEMBER 2018

LGS UFSAR together with a high worth out-of-sequence rod selection contrary to procedures, and operator failure to acknowledge continuous alarm annunciations prior to safety system actuation.

15.4.1.2.2 Sequence of Events and System Operation 15.4.1.2.2.1 Sequence of Events Control rod withdrawal errors are not considered credible in the startup and low power ranges.

The RWM system prevents the operator from selecting and withdrawing an out-of-sequence control rod.

15.4.1.2.2.2 Identification of Operator Actions No operator actions are required to preclude this transient since the plant design, as discussed above, prevents its occurrence.

15.4.1.2.2.3 The Effect of Single Failures and Operator Errors If any one of the operations involved the initial failure or error is followed by another single active failure or single operator error, the necessary safety actions (e.g., rod blocks) are automatically taken prior to any limit violation (Section 15.9). Further development of this event is contingent upon simultaneous failure of two systems as described in Appendix 15A.

15.4.1.2.3 Core and System Performance The performance of the RWM system prevents erroneous selection and withdrawal of an out-of-sequence rod. The core and system performance is not affected by such an operator error.

No mathematical models are involved in this transient. The need for input parameters, or initial conditions, is not required as there are no results to report. Consideration of uncertainties is not appropriate.

15.4.1.2.4 Barrier Performance An evaluation of the barrier performance was not made for this transient, since there is no postulated set of circumstances for which this error could occur.

15.4.1.2.5 Radiological Consequences An evaluation of the radiological consequences is not required for this transient, since no radioactive material is released from the fuel.

15.4.2 ROD WITHDRAWAL ERROR - AT POWER 15.4.2.1 Identification of Causes and Frequency Classification 15.4.2.1.1 Identification of Causes CHAPTER 15 15.4-3 REV. 19, SEPTEMBER 2018

LGS UFSAR While operating in the power range in a normal mode of operation, the reactor operator makes a procedural error and continuously withdraws a high worth control rod until the RBM system inhibits further withdrawal.

15.4.2.1.2 Frequency Classification This transient is classified as an incident of moderate frequency.

15.4.2.2 Sequence of Events and System Operation 15.4.2.2.1 Sequence of Events The sequence of events for this transient, as calculated with conservative assumptions, is presented in Table 15.4-1. No operator actions are required during this transient. However, operator procedural actions expected to occur are shown in the above referenced table.

15.4.2.2.2 System Operation The focal point of this transient is localized to a small portion of the core. Therefore, although reactor controls and instrumentation are assumed to function normally, credit is taken only for the RBM system. A discussion of the transient follows below.

While operating in the power range in a normal mode of operation, the reactor operator withdraws high worth control rod until the RBM system inhibits further withdrawal.

Under most normal operating conditions, no operator action is required since the transient which would occur would be very mild.

If the rod withdrawal error is severe enough, the RBM system would sound alarms, at which time the operator would acknowledge the alarm and take corrective action. Even assuming that the operator ignores all alarms and warnings and continues to withdraw the control rod, the RBM system will block further withdrawal of the control rod before the fuel reaches the point of boiling transition or the 1%, plastic strain limit imposed on the cladding.

15.4.2.2.3 The Effect of Single Failures and Operator Errors The effect of operator errors has been discussed above. It was shown that operator errors (which initiated this transient) cannot impact the consequences of this transient due to the highly reliable RBM system (Section 15.9).

15.4.2.3 Core and System Performance The rod withdraw error (RWE) event has been analyzed generically to support the Rod Block Monitor (RBM) set points established by the ARTS program. The RWE analysis and the ARTS program for Limerick are discussed in Reference 15.0-10. The generic RWE analysis provides a relationship between CPR and Rod Block Monitor set points. ARTS based generic RWE CPR requirements are verified by confirmatory calculations each cycle to ensure that the RWE MCPR limits are bounding for the cycle. If these limits are not bounding for the cycle, cycle-specific limits are documented in the Supplemental Reload Licensing Report and incorporated in the Core Operating Limits Report for the cycle. If necessary, new RBM set points are established. The CHAPTER 15 15.4-4 REV. 19, SEPTEMBER 2018

LGS UFSAR generic RWE analysis also verifies conformance to the fuel thermal-mechanic limit of 1 % plastic strain.

15.4.2.4 Barrier Performance An evaluation of the barrier performance was not made for this transient, since this is a localized transient with very little change in the gross core characteristics. Typically, the increase in total core power is less than 5% and the changes in pressure are negligible.

15.4.2.5 Radiological Consequences An evaluation of the radiological consequences is not required for this transient, since no radioactive material is released from the fuel.

15.4.3 CONTROL ROD MALOPERATION (SYSTEM MALFUNCTION OR OPERATOR ERROR)

This transient is covered by the evaluations cited in Sections 15.4.1 and 15.4.2.

15.4.4 ABNORMAL STARTUP OF IDLE RECIRCULATION PUMP 15.4.4.1 Identification of Causes and Frequency Classification 15.4.4.1.1 Identification of Causes This action results directly from the operator's manual action to initiate pump operation. It assumes that the remaining loop is already operating.

15.4.4.1.1.1 Normal Restart of Recirculation Pump at Power This transient is categorized as an incident of moderate frequency.

15.4.4.1.1.2 Abnormal Startup of Idle Recirculation Pump This transient is categorized as an incident of moderate frequency.

15.4.4.2 Sequence of Events and System Operation 15.4.4.2.1 Sequence of Events Table 15.4-3 lists the sequence of events for Figure 15.4-2.

The normal sequence of operator actions expected in starting the idle loop is as follows. The operator should:

a. Adjust rod pattern as necessary for new power level following idle loop start.

b. Determine that the idle recirculation pump suction valve is open, the discharge valve is closed, and the coupler in the idle loop is in the starting position. If they are not, the operator must place them in these configurations.

CHAPTER 15 15.4-5 REV. 19, SEPTEMBER 2018

LGS UFSAR

c. Readjust flow of the running loop downward to less than one-half of rated flow.

d. Determine that the temperature differential between the reactor pressure vessel steam space coolant and the bottom head drain line coolant is no more than 145F.

e. Determine that the temperature difference between the two loops is no more than 50F.

f. Start the idle loop pump and open the discharge valve by jogging manual circuitry.

g. Adjust flow to match the adjacent loop flow. Monitor reactor power.

h. Readjust power, as necessary, to satisfy plant requirements per standard procedure.

The time required to do the above work is approximately 1/2 hour.

15.4.4.2.2 System Operation This transient assumes and takes credit for normal functioning of plant instrumentation and controls, plant protection, and RPS. In particular, credit is taken for high flux scram to terminate the transient. No ESF action occurs as a result of the transient.

15.4.4.2.3 The Effect of Single Failures and Operator Errors This transient leads to a quick rise in reactor power level. Corrective action first occurs in the APRM neutron flux upscale trip and, being part of the RPS, it is designed to the single failure criterion. Therefore, shutdown is assured. Operator errors are not of concern here in view of the fact that automatic shutdown transients follow so quickly after the postulated failure (Section 15.9).

15.4.4.3 Core and System Performance 15.4.4.3.1 Mathematical Model The nonlinear dynamic model described briefly in Section 15.1.1.3.1 is used to simulate this transient.

15.4.4.3.2 Input Parameters and Initial Conditions This analysis has been performed, unless otherwise noted, with plant conditions as tabulated in Table 15.0-2.

One recirculation loop is idle and filled with cold water at 100F. (Normal procedure when starting an idle loop with one pump already running requires heating the idle recirculation loop to within 50F of core inlet temperature prior to loop startup.)

CHAPTER 15 15.4-6 REV. 19, SEPTEMBER 2018

LGS UFSAR The active recirculation loop is operating with about 84% of normal rated diffuser flow going across the active jet pumps.

The core is receiving 38% of its normal rated flow. The remainder of the coolant flows in the reverse direction through the inactive jet pumps.

Reactor power is 55% of NBR power conditions. (Normal procedures require startup of an idle loop at a lower power.)

The idle recirculation pump suction valve is open, but the pump discharge valve is closed.

The idle pump fluid coupler is at a setting that approximates 50% generator speed demand.

15.4.4.3.3 Results The results of this event are based on Cycle 1 conditions. An analysis of this event for current conditions is not expected to result in a change in the general trends and characteristics as shown.

The transient response to the incorrect startup of a cold, idle recirculation loop is shown in Figure 15.4-2. Shortly after the pump begins to move, a surge in flow from the jet pump diffusers causes the core inlet flow to rise sharply.

When the neutron flux peak reaches the APRM neutron flux upscale scram setpoint, reactor scram is initiated. The neutron flux peaks at 454.9% of NBR. Surface heat flux follows the slower response of the fuel and peaks at 90% NBR. Nuclear system pressures do not increase significantly above the initial pressures. The water level does not reach either the high or low level setpoints.

15.4.4.3.4 Consideration of Uncertainties This particular transient is analyzed for an initial power level that is much higher than that expected for the actual transient. The much slower thermal response of the fuel mitigates the effects of the rather sharp neutron flux spike and, even in this high range of power, no threat to thermal limits is possible.

15.4.4.4 Barrier Performance No evaluation of barrier performance is required for this transient, since no significant pressure increases are incurred.

15.4.4.5 Radiological Consequences An evaluation of the radiological consequences is not required for this transient, since no radioactive material is released from the fuel.

15.4.5 RECIRCULATION FLOW CONTROL FAILURE WITH INCREASING FLOW 15.4.5.1 Identification of Causes and Frequency Classification CHAPTER 15 15.4-7 REV. 19, SEPTEMBER 2018

LGS UFSAR 15.4.5.1.1 Identification of Causes Failure of an individual flow controller can cause a speed increase for its associated recirculation pump. The failure of one ASD controller has two possible outcomes. A detectable failure of the active primary controller will cause swap-over to the back-up controller, resulting in maintaining pump speed at a lower fixed (speed-hold) value. An undetectable malfunction of the primary active controller or malfunction of the active back-up controller (with primary controller inactive) can result in a speed decrease at an uncontrolled rate (step change) to 0% speed.

15.4.5.1.2 Frequency Classification This transient is classified as an incident of moderate frequency.

15.4.5.2 Sequence of Events and System Operation 15.4.5.2.1 Sequence of Events Table 15.4-4 lists the sequence of transients for Figure 15.4-3.

Initial actions by the operator include:

a. Reducing recirculation flow to minimum

b. Identifying the cause of the failure.

Reactor pressure will be controlled as required, depending upon whether a restart or cooldown is planned. In general, the corrective action would be to hold reactor pressure and condenser vacuum for restart after the malfunctioning flow controller has been repaired. The following is the sequence of operator actions expected during the course of the transient. The operator should:

a. Observe that all rods are in.

b. Check the reactor water level and maintain it above low level (Level 1) trip to prevent MSIVs from isolating.

c. Switch the reactor mode switch to the STARTUP position.

d. Continue to maintain vacuum and turbine seals.

e. Reduce seep demand to 28% or less.

f. Monitor the turbine coast-down and auxiliary systems.

The time required from first alarm to restart would be approximately one hour.

15.4.5.2.2 System Operation The analysis of this transient assumes and takes credit for normal functioning of plant instrumentation and controls, and the RPS. Operation of engineered safeguards is not expected.

CHAPTER 15 15.4-8 REV. 19, SEPTEMBER 2018

LGS UFSAR 15.4.5.2.3 The Effect of Single Failures and Operator Errors This transient leads to a quick rise in reactor power level. Corrective action first occurs in the APRM neutron flux upscale trip and, being part of the RPS, it is designed to the single failure criterion. Therefore, shutdown is assured (Section 15.9). Operator errors are not of concern here in view of the fact that automatic shutdown transients follow so quickly after the postulated failure.

15.4.5.3 Core and System Performance 15.4.5.3.1 Mathematical Model The nonlinear dynamic model described briefly in Section 15.1.1.3.1 is used to simulate this transient.

15.4.5.3.2 Input Parameters and Initial Conditions This analysis has been performed, unless otherwise noted, with Cycle 1 plant conditions.

In each of these transients, the most severe transient results when initial conditions are established for operation at the low end of the rated flow control rod line. Specifically, at 57%

NBR power and 39.6% core flow.

Maximum change in speed control occurs with a malfunction of one of the two redundant ASD controllers that results in an instantaneous step change to maximum output speed.

15.4.5.3.3 Results The results of this event are based on Cycle 1 conditions. An analysis of this event for current conditions is not expected to result in a change in the general trends and characteristics as shown.

Figure 15.4-3 shows the results of the transient. The changes in nuclear system pressure are not significant with regard to overpressure. Pressure decreases over most of the transient. The rapid increase in core coolant flow causes an increase in neutron flux, which initiates a reactor APRM neutron flux upscale scram.

The peak neutron flux rise reaches 382.3% of NBR flux, and the accompanying transient fuel surface heat flux reaches 82.7% of rated. The MCPR remains above the safety limit, and fuel center temperature increases only 383F. Therefore, the design basis is satisfied.

15.4.5.3.4 Consideration of Uncertainties Some uncertainties in void reactivity characteristics, scram time, and worth are expected to be more optimistic and will therefore produce less severe consequences than those simulated here.

15.4.5.4 Barrier Performance This transient results in a very slight increase in reactor vessel pressure, as shown in Figure 15.4-3, and therefore represents no threat to the RCPB.

CHAPTER 15 15.4-9 REV. 19, SEPTEMBER 2018

LGS UFSAR 15.4.5.5 Radiological Consequences An evaluation of the radiological consequences is not required for this transient, since no radioactive material is released from the fuel.

15.4.6 CHEMICAL AND VOLUME CONTROL SYSTEM MALFUNCTIONS These are not applicable to BWRs. This is a PWR transient.

15.4.7 MISPLACED BUNDLE ACCIDENT 15.4.7.1 Identification of Causes and Frequency Classification 15.4.7.1.1 Identification of Causes The accident discussed in this section is the improper loading of a fuel bundle and subsequent operation of the core. Three errors must occur for this accident to take place in the initial core loading. First, a bundle must be loaded into a wrong location in the core. Second, the bundle which was supposed to be loaded where the mislocation occurred would have to be overlooked and also put in an incorrect location. Third, the misplaced bundles would have to be overlooked during the core verification performed following initial core loading.

15.4.7.1.2 Frequency Classification This accident occurs when a fuel bundle is loaded into the wrong location in the core. It is assumed the bundle is misplaced in the worst possible location, and the plant is operated with the mislocated bundle. This accident is categorized as an infrequent incident based upon the following data:

Expected Frequency: 0.004 events/operating cycle The above number is based upon past experience. The only misloading accidents that have occurred in the past were in reload cores where only two errors are necessary. Therefore, the frequency of occurrence for initial cores is even lower since three errors must occur concurrently.

15.4.7.2 Sequence of Events and System Operation The postulated sequence of transients for the misplaced bundle accident is presented in Table 15.4-5.

Fuel loading errors, undetected by incore instrumentation following fueling operations, may result in undetected reductions in thermal margins during power operations. No detection is assumed and, therefore, no corrective operator action or automatic protection system functioning occurs.

15.4.7.2.1 The Effect of Single Failures and Operator Errors This analysis already represents the worst case (i.e., operation of a misplaced bundle with three single active failures or single operator errors) and there are no further operator errors which can make the accident results any worse. It is felt that this section is not applicable to this accident (Section 15.9).

CHAPTER 15 15.4-10 REV. 19, SEPTEMBER 2018

LGS UFSAR 15.4.7.3 Core and System Performance This event is discussed in the corresponding section of GESTAR II (Reference 4.1-1).

Results of analyzing the worst fuel bundle loading error are reported in Table 15.4-6. As can be seen, MCPR remains well above the point where boiling transition would be expected to occur, and the MLHGR does not exceed the 1% plastic strain limit for the cladding. Therefore, no fuel damage occurs as a result of this accident.

15.4.7.4 Barrier Performance An evaluation of the barrier performance was not made for this accident since it is very mild and highly localized. No perceptible change in the core pressure would be observed.

15.4.7.5 Radiological Consequences An evaluation of the radiological consequences is not required for this accident since no radioactive material is released from the fuel.

15.4.8 SPECTRUM OF ROD EJECTION ACCIDENTS This is not applicable to BWRs since the BWR has precluded this transient by incorporating into its design mechanical equipment which restricts any movement of the CRD system assemblies.

The CRD housing support assemblies are described in Chapter 4.

15.4.9 CONTROL ROD-DROP ACCIDENT 15.4.9.1 Identification of Causes and Frequency Classification Causes and frequency of the control rod-drop accident are described in the corresponding section of GESTAR II (Reference 4.1-1).

15.4.9.2 Sequence of Events and System Operation A description of the sequence of events and the operation of the system during a control rod-drop accident is provided in the corresponding Section of GESTAR II (Reference 4.1-1).

15.4.9.3 Core and System Performance 15.4.9.3.1 Mathematical Model The analytical methods, assumptions and conditions for evaluating the excursion aspects of the control rod-drop accident originally presented in the UFSAR are described in detail in GESTAR II (Reference 4.1-1). In support of the deletion of the MSLRM trip and valve closure functions, a new analysis was performed as described in NEDO-31400A, Reference 15.4-7.

15.4.9.3.2 Input Parameters and Initial Conditions CHAPTER 15 15.4-11 REV. 19, SEPTEMBER 2018

LGS UFSAR The input parameters and conditions for the control rod-drop accident originally presented in the UFSAR are described in GESTAR II (Reference 4.1-1). In support of the deletion of the MSLRM trip and valve closure functions, a new analysis was performed, with slightly different input parameters, as described in NEDO-31400A, Reference 15.4-7.

15.4.9.3.3 Results The radiological consequences of the control rod drop accident are based on the methodology of Regulatory Guide 1.183 and the assumed failure of 1200 fuel rods of GNF2 10x10 fuel in an 85.6 equivalent pin array with a peaking factor of 1.7.

Two cases were evaluated. One with a release pathway through the main condenser where the condenser is assumed to leak radioactivity into the turbine enclosure and then released to the environment. The second pathway is through the Steam Jet Air Ejectors which discharge to the off-gas system. In all cases, the dose for the main condenser leakage pathway bound the off-gas pathway dose.

The offsite dose limits established by Regulatory Guide 1.183 are 6.3 rem TEDE at the exclusion area boundary and 6.3 rem TEDE at the low population zone. The calculated dose at the exclusion area boundary is 0.045 rem TEDE and at the low population zone is 0.032 rem TEDE and are well within the prescribed limits.

The control room dose limit established by 10 CFR 50.67 is 5 rem TEDE. The calculated dose in the control room for the control rod drop accident is 1.55 rem TEDE and is within the prescribed limit.

15.4.9.4 Barrier Performance An evaluation of the barrier performance was not made for this accident, since this is a highly localized accident with no significant change in the gross core temperature or pressure.

15.4.9.5 Radiological Consequences for the CRDA Regulation 10 CFR 50.67, "Accident Source Term," provides a mechanism for power reactor licensees to voluntarily replace the traditional TID-14844 (Ref. 15.4-9) accident source term used in design-basis accident analyses with an "Alternative Source Term" (AST). The methodology of approach to this replacement is given in USNRC Regulatory Guide 1.183 (Ref.

15.4-10) and its associated Standard Review Plan 15.0.1 (Ref. 15.4-11).

Accordingly, Limerick Generating Station, Units 1 and 2, have applied the AST methodology for several areas of operational relief in the event of a Design Basis Accident (DBA), without fully crediting the use of previously assumed safety systems. Amongst these systems are the Control Room Emergency Fresh Air Supply System (CREFAS) and the Standby Gas Treatment System (SGTS).

In support of a full-scope implementation of AST as described in and in accordance with the guidance of Ref. 15.4-10, AST radiological consequence analyses are performed for the four DBAs that result in offsite exposure (i.e., Loss of Coolant Accident (LOCA), Main Steam Line Break (MSLB), Fuel Handling Accident (FHA), and Control Rod Drop Accident (CRDA)).

CHAPTER 15 15.4-12 REV. 19, SEPTEMBER 2018

LGS UFSAR Implementation consisted of the following steps:

• Identification of the AST based on plant-specific analysis of core fission product inventory,

• Calculation of the release fractions for the four DBAs that could potentially result in control room and offsite doses (i.e., LOCA, MSLB, FHA, and CRDA),

• Analysis of the atmospheric dispersion for the radiological propagation pathways,

• Calculation of fission product deposition rates and removal mechanisms,

• Calculation of offsite and control room personnel Total Effective Dose Equivalent (TEDE) doses.

15.4.9.5.1 Regulatory Approach The analyses are prepared in accordance with the guidance provided by Regulatory Guide 1.183 (Ref. 15.4-10).

15.4.9.5.2 Dose Acceptance Criteria The AST acceptance criteria for Control Room dose for postulated major credible accident scenarios such as those resulting in substantial meltdown of the core with release of appreciable quantities of fission products is provided by 10 CFR 50.67, which requires:

"Adequate radiation protection is provided to permit access to and occupancy of the control room under accident conditions without personnel receiving radiation exposures in excess of 0.05 Sv (5 rem) total effective dose equivalent (TEDE) for the duration of the accident."

This limit is applied by Regulatory Guide 1.183 to all of the accidents considered with AST.

The AST acceptance criteria for an individual located at any point on the boundary of the exclusion area (the Exclusion Area Boundary or EAB) are provided by 10 CFR 50.67 as 25 rem TEDE for any 2-hour period following the onset of the postulated fission product release.

The AST acceptance criteria for an individual located at any point on the outer boundary of the low population zone (LPZ) are provided by 10 CFR 50.67 as 25 rem TEDE during the entire period of passage of the radioactive cloud resulting from the postulated fission product release.

These limits are applied by Regulatory Guide 1.183 to events with a higher probability of occurrence (including CRDA, MSLB, and FHA considered herein) to provide the following acceptance criteria:

• For the BWR MSLB for the case of an accident assuming fuel damage or a pre-incident Iodine spike, doses at the EAB and LPZ should not exceed 25 rem TEDE for the accident duration (2 hour2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> dose for EAB and 30 day dose for LPZ). For MSLB accidents assuming normal equilibrium Iodine activity, doses should not exceed 2.5 rem TEDE for the accident duration.

CHAPTER 15 15.4-13 REV. 19, SEPTEMBER 2018

LGS UFSAR

• For the BWR CRDA, doses at the EAB and LPZ should not exceed 6.3 rem TEDE for the accident duration (2 hour2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> dose for EAB and 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> dose for LPZ).

• For the FHA, doses at the EAB and LPZ should not exceed 6.3 rem TEDE for the accident duration (2 hour2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> dose for EAB and 30 day dose for LPZ).

15.4.9.5.3 Computer Codes New AST calculations for the CRDA were prepared to simulate the radionuclide release, transport, removal, and dose estimates associated with the postulated accident scenarios.

The RADTRAD computer code (Ref. 15.4-13) endorsed by the NRC for AST analyses was used in the calculations for the CRDA. The RADTRAD program is a radiological consequence analysis code used to estimate post-accident doses at plant offsite locations and in the control room. The CRDA assessment takes no credit for control room isolation, emergency ventilation or filtration of intake air for the duration of the accident event.

Offsite X/Qs were calculated with the PAVAN computer code (Ref. 15.4-14), using the guidance of Regulatory Guide 1.145 (Ref. 15.4-15); control room X/Qs were calculated with the ARCON96 computer code (Ref. 15.4-16). The PAVAN and ARCON96 codes generally calculate relative concentrations in plumes from nuclear power plants at offsite locations and control room air intakes, respectively.

All of these computer codes have been used by the NRC staff in their safety reviews.

15.4.9.5.4 Source Terms Core Inventory The inventory of reactor core fission products used in RADTRAD for the AST CRDA analysis is based on maximum full power operation at a power level of 3527 MWth, which includes a 2%

instrument error per Reg. Guide 1.49 (Ref. 15.4-17). The fission products used for the accidents are the 60 isotopes of the standard RADTRAD input library, determined by the code developer as significant in dose consequences. These were extracted from Attachment A of the LGS Design Analysis LM-0645 (Ref. 15.4-18), and correspond to 24 month cycle burnup parameters, conservatively calculated using the ORIGEN 2.1 code.

Reactor Coolant Inventory The reactor coolant fission product inventory for CRDA analysis is based on the Technical Specification concentration limits.

Release Fraction Current design basis accident evaluations as modified by Regulatory Guide 1.183 (Ref. 15.4-

10) were used to determine the specific releases of radioactive isotopes at the given stages of fuel pin failure and provide these releases as a percentage of the total release for each accident, as summarized below.

15.4.9.5.5 Methodology CHAPTER 15 15.4-14 REV. 19, SEPTEMBER 2018

LGS UFSAR Dose Calculations As per Regulatory Guide 1.183 {Ref. 15.4-10), Total Effective Dose Equivalent (TEDE) doses are determined as the sum of the CEDE and the Effective Dose Equivalent (EDE) using dose conversion factors for inhalation CEDE from Federal Guidance Report No. 11 (Ref. 15.4-19) and for external exposure EDE from Federal Guidance Report No. 12 (Ref. 15.4-20).

Table 15.4-11 lists key assumptions and inputs used in the CRDA analysis. The design basis CRDA involves the rapid removal of a highest worth control rod resulting in a reactivity excursion that encompasses the consequences of any other postulated CRDA. The core performance analysis shows that the energy deposition that results from this event is inadequate to damage fuel pellets or cladding. However, for the dose consequence analysis, it was assumed that 1200 fuel pins in the full core were damaged, with melting occurring in 0.77 percent of the damaged rods. This is applicable to the currently limiting assumption of a core loaded solely with 10 x 10 GE14 or GNF2 fuel. A core average radial peaking factor of 1.7 was also assumed in the analysis, consistent with core operating limit report bases, as suggested in Regulatory Guide 1.183.

Releases to the environment are possible via two pathways. The first is through the Main Condenser. The main condenser is assumed to leak activity into the Turbine Building (TB) at a rate of 1% per day. This activity is then released, unfiltered, to the environment by way of the North Vent Stack, taking no credit for holdup in the TB. The north vent stack is the most conservative release point with respect to the Control Room intake, as the normal release pathway via the South Stack is further from the intake, with lower X/Qs.

The second pathway is through the Steam Jet Air Ejectors. When in operation, the Steam Jet Air Ejectors (SJAE) discharge to the augmented off-gas system. The augmented off-gas system charcoal delay beds in this scenario substantially delay noble gas release and essentially eliminate iodine release.

Both were evaluated in Ref. 15.4-12, and the first release scenario, through the main condenser, was found to clearly be the bounding DBA.

The analysis assumptions for the transport, reduction, and release of the radioactive material from the fuel and the reactor coolant are consistent with the guidance provided in Appendix C of Regulatory Guide 1.183, and are provided in the design analysis of Ref. 15.4-12.

15.4.9.5.6 Atmospheric Dispersion Factors (X/Qs)

Table 15.4-12 lists X/Q values used for the control room dose assessments, as derived in UFSAR Chapter 2 and applied for release points applicable to the CRDA.

Table 15.4-12 lists XIQ values for the EAB and LPZ boundaries, as also derived in UFSAR Chapter 2 and applied for release points applicable to the CRDA.

15.4.9.5.7 Summary and Conclusions CHAPTER 15 15.4-15 REV. 19, SEPTEMBER 2018

LGS UFSAR The radiological consequences of the postulated CRDA are given in Table 15.4-13. As indicated, the control room, EAB, and LPZ calculated doses are within regulatory limits after AST implementation.

15.4.10 REFERENCES 15.4-1 C.J. Paone, "Banked Position Withdrawal Sequence," NEDO-21231, (January 1977).

15.4-2 J.A. Wooley, "Three-Dimensional Boiling Water Reactor, Simulator,"

NEDO-20953, (May 1976).

15.4-3 "NRC Standard Review Plan", Washington, D.C., (November 24, 1975).

15.4-4 P.O. Stancavage and E.J. Morgan, "Conservative Radiological Accident Evaluation

- The CONACO1 Code," NEDO-21143, (March 1976).

15.4-5 D. Nguyen, "Realistic Accident Analysis - The RELAC Code," NEDO-21142, (October 1977).

15.4-6 N.R. Horton, W.A. Williams, and K.W. Holtzclaw, "Analytical Methods for Evaluating the Radiological Aspects of General Electric Boiling Water Reactors,"

APED-5756, (March 1969).

15.4-7 NEDO-31400A, Safety Evaluation for Eliminating the Boiling Water Reactor Main Steam Line Isolation Valve Closure Function and Scram Function of the Main Steam Line Radiation Monitor, October 1992.

15.4-8 Letter, A.C. Thadani, NRC, to George J. Beck, BWROG, May 15, 1991 -

Subject:

Acceptance for Referencing of Licensing Topical Report NEDO-31400.

15.4-9 U. S. Atomic Energy Commission, Technical Information Document (TID) 14844, "Calculation of Distance Factors for Power and Test Reactor Sites," March 23, 1962.

15.4-10 U.S. Nuclear Regulatory Commission Regulatory Guide 1.183, "Alternative Radiological Source Terms for Evaluating Design Basis Accidents at Nuclear Power Reactors," July 2000.

15.4-11 U.S. Nuclear Regulatory Commission Standard Review Plan 15.0.1, "Radiological Consequence Analyses Using Alternative Source Terms," Revision 0, July 2000.

15.4-12 LGS Design Analysis LM-0643, Rev. 2, "Re-analysis of Control Rod Drop Accident (CRDA) Using Alternative Source Terms."

15.4-13 RADTRAD Code, "A Simplified Model for Radionuclide Transport and Removal and Dose Estimation," Version 3.03.

CHAPTER 15 15.4-16 REV. 19, SEPTEMBER 2018

LGS UFSAR 15.4-14 PAVAN Code, "An Atmospheric Dispersion Program for Evaluating Design Bases Accidental Releases of Radioactive Materials from Nuclear Power Stations."

15.4-15 U. S. Nuclear Regulatory Commission Regulatory Guide 1.145, "Atmospheric Dispersion Models for Potential Accident Consequence Assessments at Nuclear Power Plants," Revision 1, November 1982.

15.4-16 ARCON96 Code, "Atmospheric Relative Concentrations in Building Wakes.

15.4-17 U. S. Nuclear Regulatory Commission Regulatory Guide 1.49, "Power Levels of Nuclear Power Plants," Revision 1, December 1973.

15.4-18 LGS Design Analysis LM-0645, Rev. 3, "Re-analysis of Fuel Handling Accident (FHA) Using Alternative Source Terms.

15.4-19 Federal Guidance Report No. 11, "Limiting Values of Radionuclide Intake and Air Concentration and Dose Conversion Factors for Inhalation, Submersion, and Ingestion", 1988.

15.4-20 Federal Guidance Report No. 12, "External Exposure to Radionuclides in Air, Water, and Soil", 1993.

CHAPTER 15 15.4-17 REV. 19, SEPTEMBER 2018

LGS UFSAR Table 15.4-1 SEQUENCE OF EVENTS FOR CONTROL ROD WITHDRAWAL ERROR IN POWER RANGE

- Operator selects (the RBM is automatically normalized) and withdraws high worth control rod.

- The RBM system indicates excessive local peaking. Operator ignores the alarm and continues to withdraw control rod.

- The RBM system initiates a rod block, inhibiting further withdrawal.

- Operator verifies fuel thermal limits are satisfied before renormalizing RBM to further withdraw control rod.

CHAPTER 15 15.4-18 REV. 14, SEPTEMBER 2008

LGS UFSAR Table 15.4-3 SEQUENCE OF EVENTS FOR ABNORMAL STARTUP OF IDLE RECIRCULATION PUMP(1)

TIME (sec) EVENT 0 Start pump motor.

9.0 Startup loop flow starts to increase significantly.

10.4 APRM neutron flux upscale scram initiated.

>50.0 Vessel level returning to normal and will stabilize quickly.

(1)

See Figure 15.4-2.

NOTE: The results presented here are based on original plant conditions. Because this is not a limiting transient, this event was not reanalyzed for rerated conditions.

However, the general trends and characteristics as shown here are not expected to change.

CHAPTER 15 15.4-19 REV. 14, SEPTEMBER 2008

LGS UFSAR Table 15.4-4 SEQUENCE OF EVENTS FOR RECIRCULATION FLOW CONTROL FAILURE WITH INCREASING FLOW TIME (sec) EVENT 0 Simulate failure of single-loop control.

1.7 APRM neutron flux upscale scram trip initiated.

5.5 Turbine control valves start to close upon falling turbine pressure.

20.2 Feedwater decreases upon rising water level.

>100.0 Reactor variables settle into new steady-state.

(1)

See Figure 15.4-3.

NOTE: The results presented here are based on original plant conditions. Because this is not a limiting transient, this event was not reanalyzed for rerated conditions.

However, the general trends and characteristics as shown here are not expected to change.

CHAPTER 15 15.4-20 REV. 14, SEPTEMBER 2008

LGS UFSAR Table 15.4-5 SEQUENCE OF EVENTS FOR MISPLACED BUNDLE ACCIDENT

a. During core loading operation, bundle is placed in the wrong location.

b. Subsequently, the bundle intended for this location is placed in the location of the previous bundle.

c. During core verification procedure, error is not observed.

d. Plant is brought to full power operation without detecting misplaced bundle.

e. Plant continues to operate.

CHAPTER 15 15.4-21 REV. 14, SEPTEMBER 2008

LGS UFSAR Table 15.4-6 INITIAL CONDITIONS AND RESULTS OF FUEL BUNDLE LOADING ERROR(1)

Reactor Power, % rated 100 Core Flow, % rated 100 For Largest CPR:

Core Exposure, MWD/ST 7810 Location of Error (29, 32)

Initial CPR without Fuel Loading Error 1.40 Minimum CPR with Fuel Loading Error 1.29 CPR 0.11 For Largest MLHGR:

Core Exposure, MWD/ST 5000 Location of Error (21, 54)

Initial LHGR (Assumed at Operating Limit), kW/ft 13.4 LHGR with Fuel Loading Error, kW/ft 16.97 Core Conditions Minimum CPR Operating Limit 1.22 Minimum CPR Safety Limit 1.06 (1)

Core conditions are assumed to be normal for a hot, operating core.

NOTE: This is a non-limiting event that has not been reanalyzed for power rerate. The results of this event are based on Cycle 1 conditions. This event is analyzed only for the initial core.

CHAPTER 15 15.4-22 REV. 14, SEPTEMBER 2008

LGS UFSAR Tables 15.4-7 through 15.4-10 Tables 15.4-7 through 15.4-10 DELETED CHAPTER 15 15.4-23 REV. 13, SEPTEMBER 2006

LGS UFSAR Table 15.4-11 CRDA - RADIOLOGICAL CONSEQUENCES KEY INPUTS AND ASSUMPTIONS KEY CRDA ANALYSIS INPUTS AND ASSUMPTIONS Input/Assumption Value Core Damage 1200 fuel rods failed*

Percent of Damaged Fuel with Melt 0.77%

Radial Peaking Factor 1.7 Condenser Leak Rate 1% per day Release Period 24 hours1 days <br />0.143 weeks <br />0.0329 months <br /> CREFAS System Initiation Not utilized Charcoal Delay Bed 816 hours34 days <br />4.857 weeks <br />1.118 months <br /> for Xe Noble Gas Delay for SJAE pathway 35.5 hours0.208 days <br />0.0298 weeks <br />0.00685 months <br /> for Kr

• A bounding value, per use of 10x10 GE14 or GNF2 fuel and associated 1.7 peaking factor assumptions.

CHAPTER 15 15.4-24 REV. 16, SEPTEMBER 2012

LGS UFSAR Table 15.4-12 X/Q VALUES FOR CRDA Onsite Control Room X/Q Values for the CRDA Releases1 Time Period X/Q (sec/m3) 0 - 2 hrs 6.88E-03 2 - 8 hrs 5.17E-03 8 - 24 hrs 2.04E-03 Note

1. North Vent Stack release to Control Room X/Q values based on ARCON96.

Offsite X/Q (sec/m3) Values for the CRDA Releases1 Time Period EAB X/Q (sec/m3) LPZ X/Q (sec/m3) 0 - 2 hrs 3.18E-04 ---

0 - 8 hrs --- 5.79E-05 8 - 24 hrs --- 4.10E-05 Notes:

1. North Vent Stack release to offsite locations X/Q values based on Regulatory Guide 1.145 methodology.

CHAPTER 15 15.4-25 REV. 14, SEPTEMBER 2008

LGS UFSAR Table 15.4-13 CRDA RADIOLOGICAL CONSEQUENCES ANALYSIS RESULTS CRDA Radiological Consequence Analysis Scenario 1 (Main Condenser Leakage - DBA)

Regulatory Limit Location Duration TEDE (rem) TEDE (rem)

Control Room 30 days 1.55 5 EAB Maximum, 2 hours0.0833 days <br />0.0119 weeks <br />0.00274 months <br /> 0.0454 6.3 LPZ 30 days 0.0318 6.3 Scenario 2 (SJAE Release)

Regulatory Limit Location Duration TEDE (rem) TEDE (rem)

Control Room 30 days 0.0225 5 EAB Maximum, 2 hours0.0833 days <br />0.0119 weeks <br />0.00274 months <br /> 0.0231 6.3 LPZ 30 days 0.00835 6.3 CHAPTER 15 15.4-26 REV. 18, SEPTEMBER 2016

LGS UFSAR 15.5 INCREASE IN REACTOR COOLANT INVENTORY 15.5.1 INADVERTENT HPCI STARTUP 15.5.1.1 Identification of Causes and Frequency Classification 15.5.1.1.1 Identification of Causes Manual startup of the HPCI system is postulated for this analysis, i.e., operator error.

15.5.1.1.2 Frequency Classification This transient is categorized as an incident of moderate frequency.

15.5.1.2 Sequence of Events and System Operation 15.5.1.2.1 Sequence of Events Table 15.5-1 lists the sequence of events for Figure 15.5-1.

15.5.1.2.1.1 Identification of Operator Actions Relatively small changes would be experienced in plant conditions as a result of inadvertent HPCI start-up. The operator should, after hearing the alarm that the HPCI has commenced operation, check reactor water level and drywell pressure. If conditions are normal, the operator should shut down the system.

15.5.1.2.2 System Operation In order to properly simulate the expected sequence of events, the analysis of this transient assumes normal functioning of plant instrumentation and controls; specifically, the pressure regulator and the vessel level control which respond directly to this event.

Required operation of engineered safeguards other than what is described is not expected for this transient event.

The system is assumed to be in the manual flow control mode of operation.

15.5.1.2.3 The Effect of Single Failures and Operator Errors Inadvertent operation of the HPCI results in a mild depressurization. Corrective action by the pressure regulator and/or level control is expected to establish a new stable operating state. The effect of a single failure in the pressure regulator will aggravate the transient depending upon the nature of the failure. Pressure regulator failures are discussed in Sections 15.1.3 and 15.2.1.

The effect of a single failure in the level control system has rather straightforward consequences including level rise or fall by improper control of the feedwater system. Increasing level will trip the turbine and automatically trip the HPCI system off. This trip signature is already described in the failure of feedwater controller with increasing flow. Decreasing level will automatically initiate CHAPTER 15 15.5-1 REV. 16, SEPTEMBER 2012

LGS UFSAR scram at the Level 3 level trip and will have a signature similar to loss of feedwater control -

decreasing flow.

15.5.1.3 Core and System Performance 15.5.1.3.1 Mathematical Model The detailed nonlinear dynamic models described briefly in Section 15.1.2.3.1 are used to simulate this transient.

15.5.1.3.2 Input Parameter and Initial Conditions This analysis has been performed, unless otherwise noted, with plant conditions tabulated in Table 15.0-2.

The water temperature of the HPCI system was assumed to be 40F with an enthalpy of 11.0 Btu/lb.

Inadvertent startup of the HPCI system was chosen for analysis since it provides the greatest auxiliary source of cold water for the vessel.

15.5.1.3.3 Results Figure 15.5-1 shows the simulated transient. It begins with the introduction of cold water into the vessel through the core spray nozzles and the feedwater injection spargers. Within one second the full HPCI flow is established (2,000 gpm through the core spray and 3,600 gpm through the feedwater). The HPCI flow split event is conservative because it maximizes the decrease in the core inlet. No delays were considered because they are not relevant to the analysis.

Addition of cooler water through the feedwater sparger increases core inlet subcooling, causing power to go up. The effect of the cool water through the core sprays, however, is some small condensation of steam in the upper plenum, resulting in a mild depressurization. The loss of steam flow through the condensation process is small when compared to the gain in steam flow that is due to subcooling change. The combined effect is a decrease in reactor pressure, along with some increase in reactor power. The event is a relatively mild transient, and MCPR remains well above the safety limit.

15.5.1.3.4 Consideration of Uncertainties Important analytical factors, including reactivity coefficient and feedwater temperature change, have been assumed to be at the worst conditions so that any deviations in the actual plant parameters will produce a less severe transient.

15.5.1.4 Barrier Performance Figure 15.5-1 indicates a slight pressure reduction from initial conditions, therefore, no further evaluation is required as RCPB pressure margins are maintained.

15.5.1.5 Radiological Consequences CHAPTER 15 15.5-2 REV. 16, SEPTEMBER 2012

LGS UFSAR Since no activity is released during this transient, a detailed evaluation is not required.

15.5.2 CHEMICAL VOLUME CONTROL SYSTEM MALFUNCTION (OR OPERATOR ERROR)

Not applicable to BWR. This is a PWR transient.

15.5.3 OTHER BWR TRANSIENTS WHICH INCREASE REACTOR COOLANT INVENTORY These transients are discussed and considered in Sections 15.1 and 15.2.

CHAPTER 15 15.5-3 REV. 16, SEPTEMBER 2012

LGS UFSAR Table 15.5-1 SEQUENCE OF EVENTS: INADVERTENT HPCI STARTUP(1)

TIME (sec) EVENT 0 Simulate HPCI cold water injection.

1.0 Full flow established for HPCI.

45 Depressurization effect stabilized.

(1)

See Figure 15.5-1.

CHAPTER 15 15.5-4 REV. 13, SEPTEMBER 2006

LGS UFSAR 15.6 DECREASE IN REACTOR COOLANT INVENTORY 15.6.1 INADVERTENT MAIN STEAM RELIEF VALVE OPENING This transient is discussed and analyzed in Section 15.1.4.

15.6.2 INSTRUMENT LINE PIPE BREAK This accident involves the postulation of a small steam or liquid line pipe break inside or outside primary containment but within a controlled release structure. In order to bound the accident, it is assumed that a small instrument line, instantaneously and circumferentially, breaks at a location where it may not be able to be isolated and where immediate detection is not automatic or apparent.

Obviously, this accident is far less limiting than the postulated events in Sections 15.6.4, 15.6.5, and 15.6.6.

This postulated accident represents the envelope evaluation for small line failure inside and outside primary containment, relative to sensitivity to detection. It is summarized in Tables 15.6-1 through 15.6-7 and Figure 15.6-1.

15.6.2.1 Identification of Causes and Frequency Classification 15.6.2.1.1 Identification of Causes and Event Description There is no specific event or circumstance identified that results in the failure of an instrument line.

These lines are designed to high quality engineering codes and standards, and seismic and environmental requirements. However, for the purpose of evaluating the consequences of a small line rupture, the failure of an instrument line is assumed to occur.

A circumferential rupture of an instrument line connected to the primary coolant system is postulated to occur outside primary containment but inside secondary containment. This failure results in the release of primary system coolant to the secondary containment until the reactor is depressurized. This accident could conceivably occur also in the drywell. However, the associated effects would not be as significant as those from a failure in the secondary containment.

15.6.2.1.2 Frequency Classification This accident is categorized as a limiting fault.

15.6.2.2 Sequence of Events and System Operation 15.6.2.2.1 Sequence of Events The sequence of events for this accident is shown in Table 15.6-1.

The operator should isolate the affected instrument line. Depending on which line is broken, the operator should determine whether to continue plant operation until a scheduled shutdown can be CHAPTER 15 15.6-1 REV. 18, SEPTEMBER 2016

LGS UFSAR made or to proceed with an immediate, orderly plant shutdown and initiate the SGTS or other ventilation effluent treatment systems.

As a result of increased radiation, temperature, humidity, fluid, and noise levels within the secondary containment, operator action can be initiated by any one or any combination of the following:

a. Operator comparing the readings of several instruments monitoring the same process variable, such as reactor level, jet pump flow, steam flow, and steam pressure.

b. By alarm, either high or low in the control room, from the instrument served by the failed line.

c. By a half-channel scram if rupture occurred on an RPS instrument line.

d. By a general increase in the area radiation monitor readings.

e. By an increase in the ventilation process radiation monitor readings.

f. By leak detection system actuation.

Upon receiving one or more of the above signals and having made an unsuccessful attempt to isolate the break, the operator should proceed to shutdown the plant in an orderly manner.

15.6.2.2.2 System Operation Normal plant instrumentation and controls are assumed to be fully operational during the entire plant transient to ensure positive identification of the break and safe shutdown of the plant.

Minimum reactor and plant protection system operations are assumed for the analysis, e.g.,

minimum ECCS flow, and pool cooling capability. As a consequence of the accident, the reactor is scrammed and the reactor vessel cooled and depressurized over a 5 hour5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> period.

15.6.2.2.3 The Effect of Single Failures and Operator Errors The initiating event is handled by a protection sequence that can accommodate additional single failures. See Section 15.9 for a more detailed discussion of this subject.

15.6.2.3 Core and System Performance 15.6.2.3.1 Qualitative Summary Instrument line breaks, because of their small size, are substantially less limiting from a core and systems performance standpoint than the accidents examined in Sections 15.6.4, 15.6.5, and 15.6.6. Consequently, instrument line breaks are considered to be bounded specifically by the steam line break (Section 15.6.4). Details of this calculation, including those pertinent to core and system performance, are discussed in detail in Section 15.6.4.3.

Since instrument line breaks result in a slower rate of coolant loss and are bounded by the calculations referenced above, the results presented here are qualitative rather than quantitative.

CHAPTER 15 15.6-2 REV. 18, SEPTEMBER 2016

LGS UFSAR Since the rate of coolant loss is slow, an orderly reactor system depressurization follows reactor scram, and the primary system is cooled down and maintained without ECCS actuation. No fuel damage or core uncovering occurs as a result of this accident.

15.6.2.3.2 Quantitative Results Instrument line breaks, because of their small size, are substantially less limiting from a core and system performance standpoint than the steam line break outside primary containment. Similarly, instrument line breaks are considered within the spectrum considered in ECCS performance calculations discussed in detail in Section 6.3.3.

Therefore, all information concerning ECCS models employed, input parameters, and detailed results for a more limiting (steam line break) event may be found in Section 6.3.

15.6.2.3.3 Consideration of Uncertainties The approach toward conservatively analyzing this accident is discussed in detail for a more limiting case in Section 6.3.

15.6.2.4 Barrier Performance 15.6.2.4.1 General The release of primary coolant through the orificed instrument line could result in an increase in secondary containment pressure and the potential for isolation of the normal ventilation system.

The following assumptions and conditions are the basis for the mass loss during the 5 hour5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> reactor shutdown period of this accident:

a. Shutdown and depressurization initiated 10 minutes after break occurs.

b. Normal depressurization and cooldown of RPV.

c. Line contains a 1/4 inch diameter flow restricting orifice inside the drywell.

d. Moody critical blowdown flow model (Reference 15.6-1) is applicable, and flow is critical at the orifice.

The total integrated mass of fluid released into the secondary containment via the break during the blowdown is 25,000 pounds. Of this total, 6000 pounds flash to steam. Release of this mass of coolant results in a secondary containment pressure that is well below the design pressure.

Using the assumptions and methods discussed above, analysis shows that following the break of an instrument line installed with a 1/4 inch orifice, the vessel inventory mass loss during the first two hours is 14,500 pounds; of this total, 4200 pounds flash to steam.

Small lines connected to the primary reactor coolant system and penetrating the containment that do not have a 1/4 inch orifice upstream of the primary containment are listed below:

CHAPTER 15 15.6-3 REV. 18, SEPTEMBER 2016

LGS UFSAR System Containment Penetration No.

Recirculation Loop Sample X-28A-1 CRD Insert X-37A-D CRD Withdraw X-38A-D SLCS X-42 Main Steam Sample X-43B As identified in Table 6.2-17, these lines have redundant containment isolation barriers, except for the CRD withdraw lines. An estimate of the primary coolant released from the CRD withdraw lines in the event of a break is provided in NUREG-0803, "Generic Safety Evaluation Report Regarding Integrity of BWR Scram System Piping." Analyses to determine the amount of primary coolant released from the other lines have not been performed because the offsite radiological consequences of breaks in these lines would be bounded by those of a large steam line break outside primary containment (Section 15.6.4).

15.6.2.5 Radiological Consequences Two separate radiological analyses are provided for this accident:

a. The first is based on conservative assumptions considered to be acceptable to the NRC for the purpose of determining adequacy of the plant design to meet 10CFR100. This analysis is referred to as the "design basis analysis."

b. The second is based on assumptions considered to provide a realistic conservative estimate of the radiological consequences. This analysis is referred to as the "realistic analysis."

A schematic of the release path is shown in Figure 15.6-1.

15.6.2.5.1 Design Basis Analysis The design basis analysis is based on SRP 15.6.2 and Regulatory Guide 1.5. The specific models, assumptions, and the program used for computer evaluation are described in Section 15.10. Specific values of parameters used in the evaluation are presented in Table 15.6-2.

The assumptions and calculation methodology used are as follows:

a. Spiking factor The activity released from the fuel to the coolant as a consequence of reactor scram and vessel depression was based on measurements during plant shutdowns (Reference 15.6-2). It was shown that for a 95 percentile probability, a total of 7 Ci of I-131 is released to the coolant for every 1 Ci/sec of prespike I-131 release. This conservative ratio was applied for all the iodine isotopes for the dose CHAPTER 15 15.6-4 REV. 18, SEPTEMBER 2016

LGS UFSAR analysis. The prespike iodine releases were those that correspond to a 0.35 Ci/sec noble gases release, a DBA assumption.

b. Iodine concentration in coolant The total iodine released from the fuel to the coolant was assumed to take place in a span of 5 hours0.208 days <br />0.0298 weeks <br />0.00685 months <br />, resulting in continued buildup of coolant activity during that period. The coolant activity during 0-2 hours0.0833 days <br />0.0119 weeks <br />0.00274 months <br /> was assumed to be constant and equal to that at the end of the first hour. The coolant activity during 2-5 hours0.208 days <br />0.0298 weeks <br />0.00685 months <br /> was assumed to be equal to that at the end of 31/2 hours0.0833 days <br />0.0119 weeks <br />0.00274 months <br />. This is a conservative assumption, since the rate of increase in coolant activity decreases with time.

c. Partition factor It was assumed that 100% of the activity in the coolant that flashed into steam remains airborne and that 10% of the activity carried by the coolant water into the secondary containment becomes airborne (corresponding to a conservative partition factor of 0.1).

d. Activity in secondary containment and released to the environment The secondary containment volume was assumed to consist of one reactor enclosure, as discussed in Section 15.6.5.5.1.2. The activity airborne in the secondary containment was assumed to be uniformly mixed by the RERS with an air flow rate of 60,000 cfm and a 95% efficient filter. Secondary containment air is released to the environment via the SGTS at the rate of two secondary containment volumes change per day. The SGTS filter has an efficiency of 99%.

The SGTS draws air from the RERS exhaust. The activity airborne in the secondary containment and the activity released to the environment are presented in Tables 15.6-3 and 15.6-4, respectively.

The calculated exposure at the EAB and LPZ are presented in Table 15.6-7.

15.6.2.5.2 Realistic Analysis The realistic analysis was based on a realistic but still conservative assessment of this accident.

The specific models, assumptions, and the program used for computer evaluation are described in Reference 15.6-3. Specific values of parameters used in the evaluation are presented in Table 15.6.2. The leakage path used in these calculations is shown in Figure 15.6-1.

Assumptions and calculations for the realistic analysis were identical to that of the design basis except for the following:

a. Total iodine released from the fuel to the coolant was assumed to be 2 Ci for every 1 Ci/sec prespike release. This is an estimated ratio for a 50 percentile probability spiking release during plant shutdowns (Reference 15.6-2).

b. The 50% X/Qs were used instead of the 5% X/Qs used for the design basis analysis.

CHAPTER 15 15.6-5 REV. 18, SEPTEMBER 2016

LGS UFSAR The activity airborne in the secondary containment is presented in Table 15.6-5. The activity released to the environment is presented in Table 15.6-6. The calculated exposure at the EAB and the LPZ are presented in Table 15.6-7.

15.6.3 STEAM GENERATOR TUBE FAILURE This section is not applicable to the direct cycle BWR; this is a PWR-related event.

15.6.4 STEAM SYSTEM PIPING BREAK OUTSIDE PRIMARY CONTAINMENT This accident involves the postulation of a large steam line pipe break outside primary containment. It is assumed that the largest steam line instantaneously and circumferentially breaks at a location downstream of the outermost isolation valve. The plant is designed to immediately detect such an occurrence, initiate isolation of the broken line, and actuate the necessary protective features. This postulated accident represents the envelope evaluation of steam line failures outside primary containment.

This accident is summarized in Tables 15.6-8 through 15.6-11 and Figure 15.6-2.

15.6.4.1 Identification of Causes and Frequency Classification 15.6.4.1.1 Identification of Causes A main steam line break is postulated without the cause being identified. These lines are designed to high quality engineering codes and standards, and seismic and environmental requirements. However, for the purpose of evaluating the consequences of a postulated large steam line rupture, the failure of a main steam line is assumed to occur.

15.6.4.1.2 Frequency Classification This accident is categorized as a limiting fault.

15.6.4.2 Sequence of Events and System Operation 15.6.4.2.1 Sequence of Events Accidents that result in the release of radioactive materials directly outside primary containment are primary results of postulated breaches in the RCPB or the steam power conversion system boundary. A break spectrum analysis for the complete range of reactor conditions indicates that the limiting fault accident for breaks outside primary containment is a complete severance of one of the four main steam lines. The sequence of events and approximate time required to respond to the accident is given in Table 15.6-8.

Normally, the reactor operator will maintain reactor vessel water inventory and, therefore, core cooling with the RCIC system. Without operator action, the RCIC would initiate automatically on low water level following isolation of the main steam supply system (i.e., MSIV closure). The core would be covered throughout the accident and there would be no fuel damage. Without taking credit for the RCIC water makeup capability and assuming HPCI failure, the termination of the accident without fuel damage is assured because the ADS will actuate at low water level (Level 1).

This will permit the low pressure ECCS to re-establish water level above the core.

CHAPTER 15 15.6-6 REV. 18, SEPTEMBER 2016

LGS UFSAR 15.6.4.2.2 System Operation A postulated guillotine break of one of the four main steam lines outside primary containment results in mass loss from both ends of the break. The flow from the upstream side is initially limited by the flow restrictor upstream of the inboard isolation valve. Flow from the downstream side is initially limited by the total area of the flow restrictors in the three unbroken lines.

Subsequent closure of the MSIVs further limits the flow when the valve area becomes less than the limiter area and finally terminates the mass loss when the full closure is reached.

A discussion of plant and reactor protection system action and ESF action is given in Sections 6.3, 7.3, and 7.6.

15.6.4.2.3 The Effect of Single Failures and Operator Errors The effect of single failures has been considered in analyzing this accident. The ECCS aspects are covered in Section 6.3. The break detection and isolation considerations are defined in Sections 7.3 and 7.6. All of the protective sequences for this accident are capable of single failure accommodation and yet completion of the necessary safety action (Section 15.9).

15.6.4.3 Core and System Performance Quantitative results (including mathematical models, input parameters, and consideration of uncertainties) for this accident are given in Section 6.3. The temperature and pressure transients resulting as a consequence of this accident are insufficient to cause fuel damage.

15.6.4.3.1 Input Parameters and Initial Conditions Refer to Section 6.3 for initial conditions.

15.6.4.3.2 Results There is no fuel damage as a consequence of this accident. Refer to Section 6.3 for ECCS analysis.

15.6.4.3.3 Consideration of Uncertainties Sections 6.3 and 7.3 contain discussions of the uncertainties associated with the ECCS performance and the containment isolation systems, respectively.

15.6.4.4 Barrier Performance Since this break occurs outside primary containment, barrier performance within the primary containment envelope is not applicable. Details of the results of this accident can be found in Section 6.2.3.

The following assumptions and conditions are used in determining the mass loss from the primary system from the inception of the break to full closure of the MSIVs:

CHAPTER 15 15.6-7 REV. 18, SEPTEMBER 2016

LGS UFSAR

a. The reactor is operating at the power level associated with maximum mass release (4% Reactor Power, 35% Core Flow).

b. Nuclear system pressure is initially 1060 psia.

c. An instantaneous circumferential break of the main steam line occurs.

d. Isolation valves start to close at 1.0 second on high flow signal and are fully closed at 6.0 seconds.

e. The Moody critical flow model (Reference 15.6-1) is applicable.

f. The SAFER Code (Ref. 15.6-10) is used to calculate the time varying two-phase flow and system pressure during the accident.

Initially, only steam will issue from the broken end of the steam line. The flow in each line is limited by critical flow at the limiter to a maximum of 200% of rated flow for each line. Rapid depressurization of the RPV causes the water level to rise, resulting in a steam/water mixture flowing from the break until the valves are closed. The total integrated mass leaving the RPV through the steam line break is 115,700 lbm of which 101,562 lbm is liquid and 14,138 lbm is steam (Ref. 15.6-26). For the radiological consequence evaluation, a total mass of 140,000 lbm is assumed.

15.6.4.5 Radiological Consequences for the MSLB Regulation 10CFR50.67, "Accident Source Term," provides a mechanism for power reactor licensees to voluntarily replace the traditional TID-14844 (Ref. 15.6-11) accident source term used in design-basis accident analyses with an "Alternative Source Term" (AST). The methodology of approach to this replacement is given in USNRC Regulatory Guide 1.183 (Ref.

15.6-12) and its associated Standard Review Plan 15.0.1 (Ref. 15.6-13).

Accordingly, Limerick Generating Station, Units 1 and 2, have applied the AST methodology for several areas of operational relief in the event of a Design Basis Accident (DBA), without fully crediting the use of previously assumed safety systems. Amongst these systems are the Control Room Emergency Fresh Air Supply System (CREFAS) and the Standby Gas Treatment System (SGTS).

In support of a full-scope implementation of AST as described in and in accordance with the guidance of Ref. 15.6-12, AST radiological consequence analyses are performed for the four DBAs that result in offsite exposure (i.e., Loss of Coolant Accident (LOCA), Main Steam Line Break (MSLB), Fuel Handling Accident (FHA), and Control Rod Drop Accident (CRDA).

Implementation consisted of the following steps:

• Identification of the AST based on plant-specific analysis of core fission product inventory,

• Calculation of the release fractions for the four DBAs that could potentially result in control room and offsite doses (i.e., LOCA, MSLB, FHA, and CRDA),

CHAPTER 15 15.6-8 REV. 18, SEPTEMBER 2016

LGS UFSAR

• Analysis of the atmospheric dispersion for the radiological propagation pathways,

• Calculation of fission product deposition rates and removal mechanisms,

• Calculation of offsite and control room personnel Total Effective Dose Equivalent (TEDE) doses.

15.6.4.5.1 Regulatory Approach The analyses are prepared in accordance with the guidance provided by Regulatory Guide 1.183 (Ref. 15.6-12).

15.6.4.5.2 Dose Acceptance Criteria The AST acceptance criteria for Control Room dose for postulated major credible accident scenarios such as those resulting in substantial meltdown of the core with release of appreciable quantities of fission products is provided by 10CFR50.67, which requires:

"Adequate radiation protection is provided to permit access to and occupancy of the control room under accident conditions without personnel receiving radiation exposures in excess of 0.05 Sv (5 rem) total effective dose equivalent (TEDE) for the duration of the accident."

This limit is applied by Regulatory Guide 1.183 to all of the accidents considered with AST.

The AST acceptance criteria for an individual located at any point on the boundary of the exclusion area (the Exclusion Area Boundary or EAB) are provided by 10 CFR 50.67 as 25 rem TEDE for any 2-hour period following the onset of the postulated fission product release.

The AST acceptance criteria for an individual located at any point on the outer boundary of the low population zone (LPZ) are provided by 10CFR50.67 as 25 rem TEDE during the entire period of passage of the radioactive cloud resulting from the postulated fission product release.

These limits are applied by Regulatory Guide 1.183 to events with a higher probability of occurrence (including CRDA, MSLB, and FHA considered herein) to provide the following acceptance criteria:

• For the BWR MSLB for the case of an accident assuming fuel damage or a pre-incident Iodine spike, doses at the EAB and LPZ should not exceed 25 rem TEDE for the accident duration (2 hour2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> dose for EAB and 30 day dose for LPZ). For MSLB accidents assuming normal equilibrium Iodine activity, doses should not exceed 2.5 rem TEDE for the accident duration.

• For the BWR CRDA, doses at the EAB and LPZ should not exceed 6.3 rem TEDE for the accident duration (2 hour2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> dose for EAB and 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> dose for LPZ).

• For the FHA, doses at the EAB and LPZ should not exceed 6.3 rem TEDE for the accident duration (2 hour2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> dose for EAB and 30 day dose for LPZ).

15.6.4.5.3 Computer Codes CHAPTER 15 15.6-9 REV. 18, SEPTEMBER 2016

LGS UFSAR New AST calculations for the MSLB were prepared to simulate the radionuclide release, transport, removal, and dose estimates associated with the postulated accidents.

While the RADTRAD computer code (Ref. 15.6-15) endorsed by the NRC for AST analyses was used in the calculations for the LOCA, CRDA and FHA, the MSLB was analyzed using the Regulatory Guide 1.183 methodology. The MSLB assessment takes no credit for control room isolation, emergency ventilation or filtration of intake air for the duration of the accident event.

15.6.4.5.4 Source Terms Reactor Coolant Inventory The reactor coolant fission product inventory for MSLB analysis is based on the Technical Specification limits in terms of Dose Equivalent I-131 (the concentration of I-131 that alone would produce the same dose as the quantity and isotopic mixture of I-131, I-132, I-133, I-134, and I-135 actually present), using inhalation Committed Effective Dose Equivalent (CEDE) dose conversion factors from Federal Guidance Report No. 11 (Ref. 15.6-20). Cesium, as Cesium Iodide, and Noble Gas releases are also considered, but the iodine isotopes are the only significant dose contributors.

15.6.4.5.5 Methodology Dose Calculations As per Regulatory Guide 1.183 (Ref. 15.6-12), Total Effective Dose Equivalent (TEDE) doses are determined as the sum of the CEDE and the Effective Dose Equivalent (EDE) using dose conversion factors for inhalation CEDE from Federal Guidance Report No. 11 (Ref. 15.6-20) and for external exposure EDE from Federal Guidance Report No. 12 (Ref. 15.6-21).

Main Steam Line Break (MSLB)

Table 15.6-9 lists the key assumptions and inputs used in the analysis. The postulated MSLB accident assumes a double-ended break of one main steam line outside the primary containment with displacement of the pipe ends that permits maximum blowdown rates.

However, the break mass released is taken for the dose calculations as a bounding maximized value for all current Boiling Water reactor plants of 140,000 pounds of water, as provided in Standard Review Plan 15.6.4 for a GESSAR-251 plant. This value bounds for dose calculation purposes the historic UFSAR values, ensuring that the dose consequences are maximized and that the releases bound any other credible pipe break. Two activity release cases corresponding to the pre-accident spike and maximum equilibrium concentration allowed by Technical Specifications of 4.0 Ci/gm and 0.2 Ci/gm dose equivalent I-131 respectively were assumed, with inhalation CEDE dose conversion factors from Federal Guidance Report 11 conservatively used for normalized Dose Equivalent I-131 determination. The released activity assumptions are consistent with the guidance provided in Appendix D of Regulatory Guide 1.183.

The analysis assumes an instantaneous ground level release. For the control room dose calculations, the released reactor coolant and steam is assumed to expand to a hemispheric volume at atmospheric pressure and temperature (consistent with an assumption of no Turbine Building credit). This hemisphere is then assumed to move at a speed of 1 meter per second CHAPTER 15 15.6-10 REV. 18, SEPTEMBER 2016

LGS UFSAR downwind past the control room intake. No credit is taken for buoyant rise of the steam cloud or for decay, and dispersion of the activity of the plume was conservatively ignored. For offsite locations, the buoyant rise of the steam cloud is similarly ignored, and the ground level dispersion is based on the conservative and simplified Regulatory Guide 1.5 (Ref. 5.6-22) methodology.

The radiological consequences following an MSLB accident were determined using a spreadsheet. The following significant assumptions were made and are detailed in the applicable MSLB design analysis (Ref. 15.6-14):

• Iodine activity distribution in the coolant as follows:

Iodine Isotope Activity (Ci/cc)

I-131 0.039 I-132 0.360 I-133 0.267 I-134 0.720 I-135 0.390

• Release from the break to the environment is assumed instantaneous. No holdup in the Turbine Building or dilution by mixing with Turbine Building air volume is credited.

• The steam cloud is assumed to consist of the portion of the liquid reactor coolant release that flashed to steam.

• The activity of the cloud is based on the total mass of water released from the break.

This assumption is conservative because it considers the maximum release of fission products.

• Flashing fraction of liquid water released was assumed as 40%. However, all activity in the water is assumed to be released.

15.6.4.5.6 Atmospheric Dispersion Factors (X/Qs)

For the control room dose calculations, the released reactor coolant and resultant flashed steam is assumed to expand to a hemispheric volume at atmospheric pressure and temperature (consistent with an assumption of no Turbine Building credit). This hemisphere is then assumed to move at a speed of 1 meter per second downwind past the control room intake. No credit is taken for buoyant rise of the steam cloud or for decay, and dispersion of the activity of the plume was conservatively ignored.

For offsite locations, the buoyant rise of the steam cloud is similarly ignored, and the ground level dispersion is based on the conservative and simplified Regulatory Guide 1.5 (Ref. 15.6-22) methodology. Table 15.6-10 lists X/Q values for the EAB and LPZ boundaries.

15.6.4.5.7 Summary and Conclusions CHAPTER 15 15.6-11 REV. 18, SEPTEMBER 2016

LGS UFSAR The radiological consequences of the postulated MSLB are given in Table 15.6-11. As indicated, the control room, EAB, and LPZ calculated doses are within regulatory limits after AST implementation.

15.6.5 LOSS-OF-COOLANT ACCIDENTS (RESULTING FROM SPECTRUM OF POSTULATED PIPING BREAKS WITHIN THE REACTOR COOLANT PRESSURE BOUNDARY) INSIDE PRIMARY CONTAINMENT This accident involves the postulation of a spectrum of piping breaks inside containment varying in size, type, and location. The break type includes steam and/or liquid process system lines.

The accident is analyzed quantitatively in Sections 6.3, 6.2, 7.3, 7.6, and 8.3. Therefore, the following discussion provides only new information not presented in the subject sections. All other information is covered by cross-referencing.

The postulated accident represents the envelope evaluation for liquid or steam line failures inside primary containment. It is summarized in Tables 15.6-13 through 15.6-20 and Figure 15.6-3.

15.6.5.1 Identification of Causes and Frequency Classification 15.6.5.1.1 Identification of Causes There are no realistic, identifiable events that would result in a pipe break inside primary containment of the magnitude required to constitute a LOCA coincident with a single active failure.

The subject piping is designed to high quality engineering codes and standards, and seismic and environmental requirements. However, for estimating the resultant effects of this category of pipe breaks, a LOCA plus single active failure are assumed to occur without the causes being identified.

15.6.5.1.2 Frequency Classification This accident is categorized as a limiting fault.

15.6.5.2 Sequence of Events and System Operation 15.6.5.2.1 Sequence of Events The sequence of events associated with this accident is shown in Table 6.3-2 for core system performance and Table 6.2-8 for barrier (containment) performance.

Following the pipe break and scram, the low-low water level (Level 2) trip or the high drywell pressure trip will start the HPCI system. The MSIVs will begin to close on the low-low-low water level (Level 1) trip. Either the Level 1 trip or the high drywell pressure coincident with low reactor pressure trip will start the CS and LPCI systems. From time zero, the CS system will start at less than or equal to 54 seconds, the HPCI system will start at approximately 60 seconds and the LPCI system will start at less than or equal to 70 seconds..

Since automatic actuation and operation of the ECCS is a system design basis, no credit for immediate operator actions are assumed in the evaluation of the accident. However, in CHAPTER 15 15.6-12 REV. 18, SEPTEMBER 2016

LGS UFSAR accordance with procedural requirements, the operator should perform the following described actions.

The operator should, after ensuring that all rods have been inserted at time 0 plus approximately 10 seconds, determine plant condition by observing the annunciators. After observing that the ECCS flows are initiated, the operator should check that the diesel generators have started and are on standby condition, and that the ESW system has started.

Based on plant conditions, the operator should initiate operation of the RHRSW system and the RHR system heat exchangers in the suppression pool cooling mode. After the RHR system and other auxiliary systems are in proper operation, the operator should monitor the hydrogen concentration in the drywell for proper activation of the post-LOCA recombiners, if necessary.

15.6.5.2.2 System Operation Accidents that could result in the release of radioactive fission products directly into the containment are the result of postulated nuclear system RCPB pipe breaks. A spectrum of pipe break sizes and locations are examined in Sections 6.2 and 6.3, including the severance of small process system lines, the main steam lines upstream of the flow restrictors, and the recirculation loop pipelines. The most severe nuclear system effects and the greatest release of radioactive material to the containment result from a complete circumferential break of one of the two recirculation loops. The minimum required functions of any reactor and plant protection system are discussed in Sections 6.2, 6.3, 7.3, 7.6, 8.3, and 15.9.

15.6.5.2.3 The Effect of Single Failures and Operator Errors Single failures and operator errors have been considered in the analysis of the entire spectrum of primary system breaks. The consequences of a LOCA with considerations for single failures are shown to be fully accommodated without the loss of any required safety function (Section 15.9).

15.6.5.3 Core and System Performance 15.6.5.3.1 Mathematical Model The analytical methods and associated assumptions used in evaluating the consequences of this accident are considered to provide a conservative assessment of the expected consequences of this very improbable event.

The details of these calculations, their justification, and bases for the models are developed in Sections 6.3, 7.3, 7.6, 8.3, and 15.9.

15.6.5.3.2 Input Parameters and Initial Conditions Input parameters and initial conditions used for the analysis of this event are given in Table 6.3-1.

15.6.5.3.3 Results Results of this accident are given in detail in Section 6.3. Even though some swelling may have occurred, the temperature and pressure transients resulting as a consequence of this accident are insufficient to cause perforation of the fuel cladding. Postaccident tracking instrumentation and control are assured. Continued long-term core cooling is demonstrated. Radiological input is CHAPTER 15 15.6-13 REV. 18, SEPTEMBER 2016

LGS UFSAR minimized and within limits. Continued operator control and surveillance are examined and guaranteed.

15.6.5.3.4 Consideration of Uncertainties This event was conservatively analyzed (Sections 6.3, 7.3, 7.6, 8.3, and 15.9).

15.6.5.4 Barrier Performance The primary containment is designed to maintain pressure integrity in the event of an instantaneous rupture of the largest single primary system piping within the structure while also accommodating the dynamic effects of the pipe break. Therefore, any postulated LOCA would not exceed the containment design limit. For details and results of the analyses, see Sections 3.8, 3.9, and 6.2.

15.6.5.5 Radiological Consequences for the LOCA Regulation 10CFR50.67, "Accident Source Term," provides a mechanism for power reactor licensees to voluntarily replace the traditional TID-14844 (Ref. 15.6-11) accident source term used in design-basis accident analyses with an "Alternative Source Term" (AST). The methodology of approach to this replacement is given in USNRC Regulatory Guide 1.183 (Ref.

15.6-12) and its associated Standard Review Plan 15.0.1 (Ref. 15.6-13).

The AST methodology has been applied to justify that a Design Basis Accident (DBA) can be accommodated without fully crediting the use of previously assumed safety systems. Amongst these systems are the Control Room Emergency Fresh Air Supply System (CREFAS) and the Standby Gas Treatment System (SGTS).

In support of a full-scope implementation of AST as described in and in accordance with the guidance of Ref. 15.6-12, AST radiological consequence analyses are performed for the four DBAs that result in offsite exposure (i.e., Loss of Coolant Accident (LOCA), Main Steam Line Break (MSLB), Fuel Handling Accident (FHA), and Control Rod Drop Accident (CRDA)).

• Implementation consisted of the following steps:

• Identification of the AST based on plant-specific analysis of core fission product inventory,

• Calculation of the release fractions for the four DBAs that could potentially result in control room and offsite doses (i.e., LOCA, MSLB, FHA, and CRDA),

• Analysis of the atmospheric dispersion for the radiological propagation pathways,

• Calculation of fission product deposition rates and removal mechanisms,

• Calculation of offsite and control room personnel Total Effective Dose Equivalent (TEDE) doses, CHAPTER 15 15.6-14 REV. 18, SEPTEMBER 2016

LGS UFSAR

• Evaluation of suppression pool pH to ensure that the particulate iodine deposited into the pool during a DBA LOCA does not re-evolve and become airborne as elemental iodine.

15.6.5.5.1 Regulatory Approach The analyses are prepared in accordance with the guidance provided by Regulatory Guide 1.183 (Ref. 15.6-12).

Dose Acceptance Criteria The AST acceptance criteria for Control Room dose for postulated major credible accident scenarios such as those resulting in substantial meltdown of the core with release of appreciable quantities of fission products is provided by 10 CFR 50.67, which requires:

"Adequate radiation protection is provided to permit access to and occupancy of the control room under accident conditions without personnel receiving radiation exposures in excess of 0.05 Sv (5 rem) total effective dose equivalent (TEDE) for the duration of the accident.

This limit is applied by Regulatory Guide 1.183 to all of the accidents considered with AST.

The AST acceptance criteria for an individual located at any point on the boundary of the exclusion area (the Exclusion Area Boundary or EAB) are provided by 10 CFR 50.67 as 25 rem TEDE for any 2-hour period following the onset of the postulated fission product release.

The AST acceptance criteria for an individual located at any point on the outer boundary of the low population zone (LPZ) are provided by 10 CFR 50.67 as 25 rem TEDE during the entire period of passage of the radioactive cloud resulting from the postulated fission product release.

These limits are applied by Regulatory Guide 1.183 to events with a higher probability of occurrence (including CRDA, MSLB, and FHA considered herein) to provide the following acceptance criteria:

• For the BWR MSLB for the case of an accident assuming fuel damage or a pre-incident Iodine spike, doses at the EAB and LPZ should not exceed 25 rem TEDE for the accident duration (2 hour2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> dose for EAB and 30 day dose for LPZ). For MSLB accidents assuming normal equilibrium Iodine activity, doses should not exceed 2.5 rem TEDE for the accident duration.

• For the BWR CRDA, doses at the EAB and LPZ should not exceed 6.3 rem TEDE for the accident duration (2 hour2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> dose for EAB and 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> dose for LPZ).

• For the FHA, doses at the EAB and LPZ should not exceed 6.3 rem TEDE for the accident duration (2 hour2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> dose for EAB and 30 day dose for LPZ).

15.6.5.5.3 Computer Codes New AST calculations for the LOCA were prepared to simulate the radionuclide release, transport, removal, and dose estimates associated with the postulated accident scenario.

CHAPTER 15 15.6-15 REV. 18, SEPTEMBER 2016

LGS UFSAR The RADTRAD computer code (Ref. 15.6-15) endorsed by the NRC for AST analyses was used in the calculations for the LOCA. The RADTRAD program is a radiological consequence analysis code used to estimate post-accident doses at plant offsite locations and in the control room.

Offsite X/Qs were calculated using the guidance of Regulatory Guide 1.145 (Ref. 15.6-17);

control room X/Qs were calculated with the ARCON96 computer code (Ref. 15.6-18).

All of these computer codes and methodologies have been used by the NRC staff in their safety reviews.

15.6.5.5.4 Source Terms Core Inventory The inventory of reactor core fission products used in RADTRAD for the AST LOCA analysis is based on maximum full power operation at a power level of 3527 MWth, which includes a 2%

instrument error per Reg. Guide 1.49 (Ref: 15.6-19) (See Section 15.0.4, Regulatory Guide 1.49). The fission products used for the accidents are the 60 isotopes of the standard RADTRAD input library, determined by the code developer as significant in dose consequences. These were extracted from Attachment A of the LGS Design Analysis LM-0645 (Ref: 15.6-24), and correspond to 24 month cycle burnup parameters, conservatively calculated using the ORIGEN 2.1 code.

Release Fraction Current design basis accident evaluations as modified by Regulatory Guide 1.183 (Ref:

15.6-12) were used to determine the specific releases of radioactive isotopes at the given stages of fuel pin failure and provide these releases as a percentage of the total release for the accident, as summarized below.

15.6.5.5.5 Methodology Dose Calculations As per Regulatory Guide 1.183 (Ref. 15.6-12), Total Effective Dose Equivalent (TEDE) doses are determined as the sum of the CEDE and the Effective Dose Equivalent (EDE) using dose conversion factors for inhalation CEDE from Federal Guidance Report No. 11 (Ref: 15.6-20) and for external exposure EDE from Federal Guidance Report No. 12 (Ref. 15.6-21). Breathing rates and occupancy factors are given in Table 15.6-13.

Loss of Coolant Accident (LOCA)

The LOCA radiological assessment was performed in accordance with the guidance of Regulatory Guide 1.183. The key inputs used in this analysis are included in Tables 15.6-14 through Table 15.6-17. These inputs and assumptions are grouped into three main categories (i.e., release, transport, and removal). The initial source term parameters are given in Table 15.6-14.

CHAPTER 15 15.6-16 REV. 18, SEPTEMBER 2016

LGS UFSAR LOCA Release Inputs Key parameters used in the release pathway modeling for the LOCA analysis are given in Table 15.6-15. The primary containment is assumed to leak at 0.5 v%/day for the first 24 hours1 days <br />0.143 weeks <br />0.0329 months <br />, then at a reduced rate of 0.25 v%/day for the remaining 30-day duration of the accident. Separately, the MSIVs are assumed to leak at a combined total of 200 scfh for the first 24 hours1 days <br />0.143 weeks <br />0.0329 months <br />, then at a reduced rate of 110.20 scfh for the remaining accident duration, due to reductions in containment pressure. No primary containment leakage, with the exception of MSIV leakage, has been identified to bypass the secondary containment to be released unfiltered to the atmosphere.

The analysis assumes that the leak rate through the MSIVs to the environment is 200 scfh at a test pressure of 22 psig for the first 24 hours1 days <br />0.143 weeks <br />0.0329 months <br /> of the accident. This rate is then assumed to be reduced to 110.20 scfh after 24 hours1 days <br />0.143 weeks <br />0.0329 months <br /> and for the duration of the accident, due to containment pressure reductions. The maximum allowable per line is 100 scfh.

The analysis assumes an emergency core cooling system (ECCS) liquid leakage rate outside of containment of 5 gpm (Table 15.6-15). Ten percent of the activity in the leakage is assumed to become airborne. This is consistent with Regulatory Guide 1.183. Although the ECCS leakage rate may realistically be assumed to begin approximately 15 minutes following the accident, with the actuation of the drywell sprays, the present analysis conservatively assumes leakage to begin at the onset of the accident and to continue throughout the 30-day duration of the postulated accident.

The Regulatory Guide 1.183 accident isotopic release specification allows deposition of iodine in the suppression pool. Essentially all of the iodine is assumed to remain in solution as long as the pool pH is maintained at or above a level of 7. Station procedures will direct operators, upon detection of symptoms indicating that core damage is occurring to manually initiate the SLC System. The calculation results demonstrate the buffering effect of the boron solution maintains the suppression pool pH above 7 for the 30-day duration of the postulated LOCA.

LOCA Transport Inputs Prior to the LOCA, the reactor enclosure is mechanically maintained at a negative pressure. At the beginning of the LOCA event, the reactor enclosure exhaust fans are tripped and the reactor enclosure (i.e., secondary containment) is then exhausted by the SGTS continuing the building's negative pressure thus precluding unfiltered exfiltration.

In the analysis, the control room is assumed to be automatically isolated upon a high radiation signal, and therefore in Radiation Mode prior to activity infiltration. Flow rates are given in Table 15.6-16.

LOCA Removal Inputs Key parameters identifying radionuclide removal processes are given in Table 15.6-17. The activity of elemental iodine and aerosols released from the core into the drywell is reduced by deposition (i.e., plate-out) and settling in the drywell utilizing the natural deposition values identified in the RADTRAD code. No credit is assumed for natural deposition of elemental or organic iodine, or for suppression pool scrubbing.

CHAPTER 15 15.6-17 REV. 18, SEPTEMBER 2016

LGS UFSAR Containment leakage into the reactor building is colIected by the SGTS, which exhausts the reactor building, via filters, and reduces releases. The deposition removal mechanisms are characteristics of the AST methodology and represent a change in the plant design and licensing basis.

Main steam line pipe and main steam condenser particulate and chemical iodine deposition was modeled using the RADTRAD code with removal coefficients based on gravitational settling and chemical plateout. Two-node treatment is used for each steam line in which flow occurs. The first node is from the reactor vessel to the inboard MSIV. The second node is from the inboard MSIV to the outboard MSIV. No credit is taken for holdup or plate-out in the main steam lines beyond the outboard MSIV. However, additional credit is taken for plate-out in the main condenser. Main steam line deposition was based on using the shortest line (i.e., most rapid transport) for the worst case line (i.e., the one with the assumed failed inboard isolation valve).

Removal efficiencies for the standby gas treatment system (SGTS), reactor enclosure recirculation system, and the control room emergency filtration system (CREFAS) filters are given in Table 15.6-17.

The analysis assumptions for the transport, reduction, and release of the radioactive material from the fuel and the reactor coolant are consistent with the guidance provided in Appendix C of Regulatory Guide 1.183, and are provided in the design analysis of Ref. 15.6-23.

15.6.5.5.6 Atmospheric Dispersion Factors (X/Qs)

The station release points and control room intake are shown in Figure 15.6-3. Table 15.6-19 lists X/Q values used for the control room dose assessments. For release points applicable to the LOCA, the zero velocity vent release X/Q values were calculated with the ARCON96 computer code, as derived in UFSAR Chapter 2.

Table 15.6-20 lists X/Q values for the EAB and LPZ boundaries. These X/Q values are calculated using Regulatory Guide 1.145 methodology, as derived in UFSAR Chapter 2.

15.6.5.5.7 Summary and Conclusions The radiological consequences of the postulated LOCA are given in Table 15.6-18. As indicated, the control room, EAB, and LPZ calculated doses are within regulatory limits after AST implementation.

15.6.6 FEEDWATER LINE BREAK OUTSIDE PRIMARY CONTAINMENT The postulated break of the feedwater line, representing the largest liquid line outside primary containment, provides the envelope evaluation relative to this type of occurrence. The break is assumed to be instantaneous, circumferential, and upstream of the outermost isolation valve.

A more limiting accident from a core performance evaluation standpoint (feedwater line break inside primary containment) has been quantitatively analyzed in Section 6.3. Therefore, the following discussion provides only new information not presented in Section 6.3. All other information is covered by cross- referencing.

15.6.6.1 Identification of Causes and Frequency Classification CHAPTER 15 15.6-18 REV. 18, SEPTEMBER 2016

LGS UFSAR 15.6.6.1.1 Identification of Causes A feedwater line break is assumed without the cause being identified. The subject piping is designed to high quality engineering codes and standards, and seismic and environmental requirements.

15.6.6.1.2 Frequency Classification This accident is categorized as a limiting fault.

15.6.6.2 Sequence of Events and System Operation 15.6.6.2.1 Sequence of Events The sequence of events is shown in Table 15.6-23.

Since automatic actuation and operation of the ECCS is a system design basis, no credit for immediate operator actions are assumed in the evaluation for this accident. However, in accordance with procedural requirements the operator should perform the following actions, which are shown below for informational purposes:

a. The operator should determine that a line break has occurred and evacuate the area of the turbine enclosure.

b. The operator is not required to take any action to prevent primary reactor system mass loss, but should ensure that the reactor is shut down and that RCIC and/or HPCI are operating normally.

c. The operator should implement appropriate radiation incident procedures.

d. If possible, the operator should shut down the feedwater system and de-energize any electrical equipment that may be damaged by water from the feedwater system in the turbine enclosure.

e. The operator should continue to monitor reactor water level and the performance of the ECCS while the radiation incident procedure is being implemented and should begin normal reactor cooldown measures.

f. When the reactor pressure has decreased below 75 psig, operator should initiate RHR in the shutdown cooling mode to continue cooling down the reactor.

The operator procedures above occur over an elapsed time of 3-4 hours0.167 days <br />0.0238 weeks <br />0.00548 months <br />.

15.6.6.2.2 System Operation It is assumed that the normally operating plant instrumentation and controls are functioning.

Credit is taken for the actuation of the reactor isolation system and ECCS. The RPS (MSRVs, ECCS, and CRD) and plant protection system (RHR heat exchangers) are assumed to function properly to assure a safe shutdown.

CHAPTER 15 15.6-19 REV. 18, SEPTEMBER 2016

LGS UFSAR The ESF and RCIC/HPCI systems are assumed to operate normally.

15.6.6.2.3 The Effect of Single Failures and Operator Errors The feedwater line break outside of primary containment is a high energy line break as described in paragraph 3.6.1.2.1.3. For purposes of plant transient analysis, it is considered as a special case of the general LOCA break spectrum considered in detail in Section 6.3. The general single failure analysis for LOCAs is discussed in detail in Section 6.3.3.3. For the feedwater line break outside primary containment, since the break can be isolated, either the RCIC or HPCI can provide adequate flow to the vessel to maintain core cooling and prevent fuel clad failure. A single failure of either the HPCI or the RCIC would still provide sufficient flow to keep the core covered with water. See Sections 6.3 and 15.9 for detailed description of the analysis.

15.6.6.3 Core and System Performance 15.6.6.3.1 Qualitative Summary The accident evaluation qualitatively considered in this section is considered to be a conservative and envelope assessment of the consequences of the postulated failure (i.e., severance) of one of the feedwater piping lines outside primary containment. The accident is postulated to occur at the input parameters and initial conditions given in Table 6.3-1.

15.6.6.3.2 Qualitative Results The feedwater line break outside the containment is less limiting than either of the steam line breaks outside primary containment (analysis presented in Section 6.3 and/or in Section 15.6.4) or the feedwater line break inside primary containment (analysis presented in Sections 6.3.3 and 15.6.5). It is far less limiting than the DBA (the recirculation line break analysis presented in Sections 6.3.3 and 15.6.5).

The RCIC and the HPCI initiate on low-low (Level 2) water level and together restore the reactor water level to the normal elevation. MSIV isolation will occur upon receipt of a low-low-low (Level

1) water level signal, but it is unlikely that this level will be reached during this event. The fuel is covered throughout the accident and there are no pressure or temperature transients sufficient to cause fuel damage.

15.6.6.3.3 Consideration of Uncertainties This accident was conservatively analyzed, and uncertainties were adequately considered (Section 6.3).

15.6.6.4 Barrier Performance Accidents that result in the release of radioactive materials outside primary containment are the results of postulated breaches in the RCPB or the steam power conversion system boundary. A break spectrum analysis for the complete range of reactor conditions indicates that the limiting fault event for breaks outside primary containment is a complete severance of one of the main steam lines as described in Section 15.6.4. The feedwater system piping break is less severe CHAPTER 15 15.6-20 REV. 18, SEPTEMBER 2016

LGS UFSAR than the main steam line break. Results of analysis of this accident can be found in Sections 6.2.3 or 6.2.4.

15.6.6.5 Radiological Consequences 15.6.6.5.1 Design Basis Analysis No design basis analysis is presented.

15.6.6.5.2 Realistic Analysis The realistic analysis is based on a conservative assessment of this accident. The specific models and assumptions, and the program used for computer evaluation, are described in Reference 15.6-3. Specific values of parameters used in the evaluation are presented in Table 15.6-24. A schematic diagram of the leakage path for this accident is shown in Figure 15.6-4.

15.6.6.5.2.1 Fission Product Release There is no fuel damage as a consequence of this accident. In addition, an insignificant quantity of activity (compared to that existing in the main condenser hotwell prior to occurrence of the break) is released from the contained piping system prior to isolation closure.

The iodine concentration in the main condenser hotwell is consistent with an offgas release rate of 0.10 Ci/sec at 30 minutes delay and is 0.02 (2% carryover) times the concentration in the reactor coolant. Noble gas activity in the condensate is negligible, since the air ejector removes practically all noble gas from the condenser.

15.6.6.5.2.2 Fission Product Transport to the Environment Two breaks were postulated for release of liquid coolant: a break just outside primary containment, and a break on the 30 inch header manifolding the discharge of three condensate pumps.

If a break just outside primary containment is considered, reverse flow would release 650 gallons of feedwater before the check valve inside primary containment fully closes. During this time no reactor water would be discharged through the break. On the pump side, either the turbine drive protection equipment would sense overspeed, or the pump itself would see low suction pressure.

Very rapid trip would result in either case, minimizing spillage.

For the break on the 30 inch header, the condensate from the hotwell would be released along with the makeup from the CST. Backflow from upstream of the condensate filter/demineralizer would again close the check valves, but condensate in the feedwater heaters would be spilled.

Since more coolant would be discharged by this break than by the break just outside primary containment, it was used for the analysis.

The fission transport pathway consists of liquid release from the break, carryover to the turbine enclosure atmosphere due to flashing and partitioning, and unfiltered release to the environment through the turbine enclosure ventilation system.

CHAPTER 15 15.6-21 REV. 18, SEPTEMBER 2016

LGS UFSAR From the hotwell, 967,000 lb of condensate is released, of which 64,800 lb flashes to steam. Also released is 150,000 lb of condensate that was in the pipes from the break to the filter/demineralizers. Of this condensate, 10,100 lb flashes to steam. Low level in the condenser will send a signal for makeup to the CST; thus, 542,000 lb will be released, of which 36,300 lb will flash to steam. Upstream of the filter/demineralizers, 584,000 lb of condensate will backflow, with 146,000 lb flashing into steam. The condensate is assumed to be at a reactor steam concentrations. Of the activity remaining in the unflashed liquid, 10% is assumed to become airborne. Liquid that was upstream of the filter/demineralizers has passed through the condensate cleanup system, which have a 90% iodine removal efficiency. The CST is assumed to be 99% free of iodine.

Taking no credit for holdup, decay, or plateout during transport through the turbine enclosure, the release of activity to the environment is presented in Table 15.6-25. The release is assumed to take place within two hours of the occurrence of the break.

15.6.6.5.2.3 Results The calculated exposures for the realistic analysis are presented in Table 15.6-26 and are a small fraction of 10CFR100 limits.

15.6.7 LOSS OF FEEDWATER FLOW Refer to Section 15.2.7 15.

6.8 REFERENCES

15.6-1 F.J. Moody, "Maximum Two Phase Vessel Blowdown From Pipes," ASME Paper Number 65 WA/HT 1, (March 15, 1965).

15.6-2 F.J. Brutschy, C.R. Hills, and N.R. Horton, A.J. Levin, "Behavior of Iodine in Reactor Water During Plant Shutdown and Startup", NEDO-10585, (August 1972).

15.6-3 D. Nguyen, "Realistic Accident Analysis - The RELAC Code" NEDO-21142, (October 1977).

15.6-4 G.E. Start, et al., "Rancho Seco Building Wake Effects on Atmospheric Diffusion,"

NOAA Technical Memorandum ERL ARL-XX (in draft), Air Resources Laboratory, Idaho Falls, Idaho, (1977) (Available from Publication Services, Environmental Research Laboratories, National Oceanic and Atmospheric Administration, Boulder, Colorado 80302).

15.6-5 D.M. Rastler, "Suppression Pool Scrubbing Factors For Postulated Boiling Water Reactor Accident Conditions", NEDO-25420, GE, San Jose, CA, (June 1981).

15.6-6 W.E. Garrity, "Analytical Models for Aerosol Leakage Attenuation", ERDA-56, (1975).

15.6-7 G.J.E. Wilcutt, Jr., R.G. Guido, "Mixing of Radiolytic Hydrogen Generated Within A Containment Compartment Following a LOCA", NUREG/CR-0304, Los Alamos Scientific Laboratory, Los Alamos, NM, (August 1978).

CHAPTER 15 15.6-22 REV. 18, SEPTEMBER 2016

LGS UFSAR 15.6-8 G.J.E. Wilcutt, Jr., R.G. Guido, A. Koestel, "Hydrogen Mixing in a Closed Containment Compartment Based on a One-Dimensional Model with Convective Effects", NUREG/CR-1575, Los Alamos Scientific Laboratory, Los Alamos, NM, (September 1980).

15.6-9 A.K. Postma, R.R. Sherry, P.S. Tam, "Technological Bases for Models of Spray Washout of Airborne Contaminants in Containment Vessels", NUREG/CR-0009, NRC, (October 1978).

15.6-10 GE Nuclear Energy, "Limerick Generating Station, Units 1 and 2, SAFER/GESTR-LOCA Loss-of-Coolant Accident Analysis," NEDC-32170P, Revision 2, May 1995.

15.6-11 U. S. Atomic Energy Commission, Technical Information Document (TID) 14844, "Calculation of Distance Factors for Power and Test Reactor Sites," March 23,1962.

15.6-12 U. S. Nuclear Regulatory Commission Regulatory Guide 1.183, "Alternative Radiological Source Terms for Evaluating Design Basis Accidents at Nuclear Power Reactors," July 2000.

15.6-13 U. S. Nuclear Regulatory Commission Standard Review Plan 15.0.1, "Radiological Consequence Analyses Using Alternative Source Terms," Revision 0, July 2000.

15.6-14 LGS Design Analysis LM-0644, Rev. 2, "Re-analysis of Main Steam Line Break Accident (MSLB) Using Alternative Source Terms."

15.6-15 RADTRAD Code, "A Simplified Model for Radionuclide Transport and Removal and Dose Estimation," Version 3.03.

15.6-16 PAVAN Code, "An Atmospheric Dispersion Program for Evaluating Design Bases Accidental Releases of Radioactive Materials from Nuclear Power Stations."

15.6-17 U. S. Nuclear Regulatory Commission Regulatory Guide 1.145, "Atmospheric Dispersion Models for Potential Accident Consequence Assessments at Nuclear Power Plants," Revision 1, November 1982.

15.6-18 ARCON96 Code, "Atmospheric Relative Concentrations in Building Wakes."

15.6-19 U. S. Nuclear Regulatory Commission Regulatory Guide 1.49, "Power Levels of Nuclear Power Plants," Revision 1, December 1973.

15.6-20 Federal Guidance Report No. 11, "Limiting Values of Radionuclide Intake and Air Concentration and Dose Conversion Factors for Inhalation, Submersion, and Ingestion," 1988.

15.6-21 Federal Guidance Report No. 12, "External Exposure to Radionuclides in Air, Water, and Soil," 1993.

CHAPTER 15 15.6-23 REV. 18, SEPTEMBER 2016

LGS UFSAR 15.6-22 Regulatory (Safety) Guide 1.5, "Assumptions Used for Evaluating the Potential Radiological Consequences of a Steam Line Break Accident for Boiling Water Reactors," 3/10/71.

15.6-23 LGS Design Analysis LM-0646, Rev. 4, "Re-analysis of Loss of Coolant Accident (LOCA) Using Alternative Source Terms."

15.6-24 LGS Design Analysis LM-0645, Rev. 4, "Re-analysis of Fuel Handling Accident (FHA) Using Alternative Source Terms."

15.6-25 GE-Hitachi Nuclear Energy, 0000-0077-4603-R1, "BWR Owners Group Evaluation of Steam Flow Induced Error (SFIE) Impact on the L3 Setpoint Analytic Limit," October 2008.

15.6-26 GEH 0000-0158-9651-NP, Revision 0, October 2013, LGS Main Steam Isolation Valve Response Time Testing Analysis (SDOC G-080-VC-00489).

CHAPTER 15 15.6-24 REV. 18, SEPTEMBER 2016

LGS UFSAR Table 15.6-1 SEQUENCE OF EVENTS FOR INSTRUMENT LINE BREAK TIME EVENT 0 Instrument line fails 0-10 min Identification of break 10 min Activate SBGTS and initiate orderly shutdown 5 hours0.208 days <br />0.0298 weeks <br />0.00685 months <br /> Reactor vessel depressurized and break flow terminated CHAPTER 15 15.6-25 REV. 13, SEPTEMBER 2006

LGS UFSAR Table 15.6-2 INSTRUMENT LINE BREAK ACCIDENT: PARAMETERS TABULATED FOR POSTULATED ACCIDENT ANALYSES DESIGN REALISTIC BASIS BASIS ASSUMPTIONS ASSUMPTIONS I. Data and Assumptions used to Estimate Radioactive Source from Postulated Accidents A. Power Level 102% 102%

B. Burnup NA NA C. Fission Product Release NA None from Fuel (fuel damaged)

D. Release of Activity by Table 15.6-4 Table 15.6-6 Nuclide to the environment E. Iodine Fractions

1. Organic NA 0

2. Elemental NA 1

3. Particulate NA 0 F. Reactor Coolant Activity Section Section Before the Accident 15.6.4.5.1 15.6.4.5.2 II. Data and Assumptions Used to Estimate Activity Released A. Primary Containment Leak NA NA Rate (%/day)

B. Secondary Containment Release 100 100 Rate (%/day)

C. Valve Movement Times NA NA D. Adsorption and Filtration Efficiencies (SGTS)

1. Organic iodine 99 99

2. Elemental iodine 99 99

3. Particulate iodine 99 99

4. Particulate fission 99 99 products E. Recirculation System Parameters

1. Flow rate (cfm) 60,000 60,000

2. Mixing efficiency 50 50

3. Filter efficiency 95 95 F. Containment Spray Parameters NA NA (flow rate, drop size, etc.)

CHAPTER 15 15.6-26 REV. 13, SEPTEMBER 2006

LGS UFSAR Table 15.6-2 (Cont'd)

DESIGN REALISTIC BASIS BASIS ASSUMPTIONS ASSUMPTIONS G. Secondary Containment Volume (ft3)

Reactor enclosure, Unit 1 1.8x106 1.8x106 H. All Other Pertinent Data NA NA and Assumptions III. Dispersion Data A. EAB/LPZ Distance (m) 731/2043 731/2043 B. X/Qs for Time Intervals of

1. 0-2 hrs - EAB 2.9x10-4 1.2x10-4

2. 0-8 hrs - LPZ 4.0x10-5 2.0x10-5

3. 8-24 hrs - LPZ 2.9x10-5 1.6x10-5

4. 1-4 days - LPZ 1.4x10-5 9.0x10-6

5. 4-30 days - LPZ 5.4x10-6 4.2x10-6 IV. Dose Data A. Method of Dose Calculation Section Reference 15.10 15.6-3 B. Dose Conversion Assumptions Section Reference 15.10 15.6-3 C. Peak Activity in Table 15.6-3 Table 15.6-5 reactor enclosure D. Doses Table 15.6-7 Table 15.6-7 CHAPTER 15 15.6-27 REV. 13, SEPTEMBER 2006

LGS UFSAR Table 15.6-7 INSTRUMENT LINE FAILURE: RADIOLOGICAL EFFECTS DESIGN BASIS ANALYSIS WHOLE BODY THYROID DOSE (rem) DOSE (rem)

Exclusion Area Boundary (731 meters - 2 hr dose) 5.89x10-7 2.33x10-5 Low Population Zone (2043 meters - 30 day dose) 3.37x10-7 1.76x10-5 REALISTIC ANALYSIS WHOLE BODY THYROID DOSE (rem) DOSE (rem)

Exclusion Area Boundary 6.96x10-8 2.75x10-6 (731 meters - 2 hr dose)

Low Population Zone 4.81x10-8 2.51x10-6 (2043 meters - 30 day dose)

CHAPTER 15 15.6-32 REV. 13, SEPTEMBER 2006

LGS UFSAR Table 15.6-8 SEQUENCE OF EVENTS FOR STEAM LINE BREAK OUTSIDE PRIMARY CONTAINMENT TIME (sec) EVENT 0 Guillotine break of one main steam line outside primary containment.

1.0 (approx) High steam line flow signal initiates closure of MSIV.

< 1.5 Reactor begins scram.

6.0 MSIVs fully closed.

60.0 (approx) RCIC and HPCI initiate on low water level (Level 2) (RCIC considered unavailable, HPCI assumed single failure and therefore may not be available).

60.0 (approx) SRVs open on high vessel pressure. The valves open and close to maintain vessel pressure at approximately 1170 psi.

1780 (approx) Low water level (Level 1) reached. Low pressure ECCS receives signal to start. ADS logic is initiated.

1900 (approx) High drywell pressure bypass timer and ADS timer "timed out". ADS starts. Vessel depressurizes.

2100 (approx) Low pressure ECCS begin injection. Core partially uncovers.

2160 (approx) Core effectively reflooded and clad temperature heatup terminated. No fuel rod failure.

CHAPTER 15 15.6-33 REV. 18, SEPTEMBER 2016

LGS UFSAR Table 15.6-9 MSLB - RADIOLOGICAL CONSEQUENCES KEY INPUTS AND ASSUMPTIONS Key MSLB Accident Analysis Inputs and Assumptions Input/Assumption Value Mass Release 140,000 lbm of reactor coolant Pre-Accident Spike Iodine Concentration 4 µCi/gm I-131 equivalent Maximum Equilibrium Iodine Concentration 0.2 µCi/gm I-131 equivalent Transport model for Control Room Steam cloud moves past the Control Room intake at 1 m/sec Control Room Filtration No Credit Taken Control Room Free Volume 126,000 ft3 CHAPTER 15 15.6-34 REV. 18, SEPTEMBER 2016

LGS UFSAR Table 15.6-10 MSLB X/Q VALUES Offsite X/Q (sec/m3) Values for the MSLB Releases Time Period EAB /Q (sec/m3) LPZ /Q (sec/m3) 0 - 2 hrs 4.77E-04 1 1.89E-04 1 Notes:

1. Based on Regulatory Guide 1.5 methodology with Pasquill F atmospheric conditions and 1 meter/second wind speed.

CHAPTER 15 15.6-35 REV. 14, SEPTEMBER 2008

LGS UFSAR Table 15.6-11 MSLB RADIOLOGICAL CONSEQUENCE RESULTS MSLB Accident Radiological Consequence Analysis Results 4 µCi/gm Dose 0.2 µCi/gm Dose Equivalent I-131 Equivalent I-131 Regulatory Limit TEDE (rem) TEDE (rem) TEDE (rem)

Control 30 day 3.97 0.198 5 Room integrated dose EAB Worst 2-hour 2.22 0.111 25 (4.0 µCi/gm) integrated 2.5 (0.2 µCi/gm) dose LPZ 30 day 0.877 0.044 25 (4.0 µCi/gm) integrated 2.5 (0.2 µCi/gm) dose CHAPTER 15 15.6-36 REV. 14, SEPTEMBER 2008

LGS UFSAR Table 15.6-12 Table 15.6-12 Deleted CHAPTER 15 15.6-37 REV. 14, SEPTEMBER 2008

LGS UFSAR Table 15.6-13 LOSS OF COOLANT ACCIDENT: PERSONNEL DOSE INPUTS Personnel Dose Inputs Input/Assumption Value Onsite Breathing Rate 3.5E-04 m3/sec Offsite Breathing Rate 0-8 hours0.333 days <br />0.0476 weeks <br />0.011 months <br />: 3.5E-4 m3/sec 8-24 hours1 days <br />0.143 weeks <br />0.0329 months <br />: 1.8E-4 m3/sec 1-30 days: 2.3E-4 m3/sec Control Room Occupancy 0-1 day: 1.0 Factors 1-4 days: 0.6 4-30 days: 0.4 CHAPTER 15 15.6-38 REV. 14, SEPTEMBER 2008

LGS UFSAR Table 15.6-14 LOSS OF COOLANT ACCIDENT: SOURCE TERM Key Analysis Inputs and Assumptions Release Inputs - LOCA Radionuclide Source Term Input/Assumption Value Core Fission Product ORIGEN-2 Inventory Only the 60 nuclides considered by RADTRAD are utilized in the LOCA release analysis Core Power Level 3,527 MWt Fission Product Release RG 1.183, Table 1 Fractions for LOCA BWR Core Inventory Fraction Released Into Containment Gap Early Release In-vessel Group Phase Phase Total Noble Gases 0.05 0.95 1.0 Halogens 0.05 0.25 0.3 Alkali Metals 0.05 0.20 0.25 Tellurium Metals 0.00 0.05 0.05 Ba, Sr 0.00 0.02 0.02 Noble Metals 0.00 0.0025 0.0025 Cerium Group 0.00 0.0005 0.0005 Lanthanides 0.00 0.0002 0.0002 Fission Product Release RG 1.183, Table 4 Timing LOCA Release Phases (Per RG 1.183, the release BWRs phases are modeled Phase Onset Duration sequentially) Gap Release 2 min 0.5 hr Early In-Vessel 0.5 hr 1.5 hr CHAPTER 15 15.6-39 REV. 14, SEPTEMBER 2008

LGS UFSAR Table 15.6-15 LOSS OF COOLANT ACCIDENT: CONTAINMENT PARAMETERS Key LOCA Analysis Inputs and Assumptions Release Inputs - Primary and Secondary Containment Parameters Input/Assumption Value Containment Free Volume 3.79E+05 cubic feet Suppression Pool Water Volume 118,655 cubic feet Primary Containment Leak Rate 0.5% per day for 0 - 24 hours1 days <br />0.143 weeks <br />0.0329 months <br /> 0.25% per day for 24 - 720 hours30 days <br />4.286 weeks <br />0.986 months <br /> Total MSIV leak rate @ 22 psig 200 scfh total for 0 - 24 hours1 days <br />0.143 weeks <br />0.0329 months <br /> test pressure (100 scfh max per line) 110.20 scfh for 24 - 720 hours30 days <br />4.286 weeks <br />0.986 months <br /> Secondary Containment Volume 1.8E+06 cubic feet SGTS Flow Rate (maximum) 3,000 cfm (during drawdown) 2,500 cfm (post-drawdown)

RERS Flow Rate (minimum) 54,000 cfm Secondary Containment 15.5 minutes Drawdown Time ECCS Systems Leak Rate Outside 5 gpm of Primary Containment (includes factor of 2 margin)

ECCS Leakage Duration 0-30 days Release Location ECCS/Containment Leakage North Vent Stack MSIV Leakage North Vent Stack Release Duration ECCS/Containment Leakage 0-30 days MSIV Leakage 0-30 days CHAPTER 15 15.6-40 REV. 14, SEPTEMBER 2008

LGS UFSAR Table 15.6-16 LOSS OF COOLANT ACCIDENT: CONTROL ROOM PARAMETERS Key LOCA Analysis Inputs and Assumptions Transport Inputs - Control Room Parameters Input/Assumption Value Nuclide Release Locations Figure 15.6-3 CREFAS System Initiation On High Radiation Signal (Radiation Mode)

Control Room Free Volume 126,000 cubic feet CREFAS Air Intake Flow Rate 525 cfm (Radiation Mode)

CREFAS Recirculation Flow Rate 2175 cfm Total Filtered Intake 2700 cfm Control Room Unfiltered Inleakage Rate 225 cfm CHAPTER 15 15.6-41 REV. 14, SEPTEMBER 2008

LGS UFSAR Table 15.6-17 LOSS OF COOLANT ACCIDENT: REMOVAL INPUTS Key LOCA Analysis Inputs and Assumptions Removal Inputs Input/Assumption Value Aerosol Natural Deposition Coefficients Credit is taken for natural deposition of aerosols Used in the Drywell based on equations for the Power's model in NUREG/CR 6189 and input directly into RADTRAD as natural deposition time dependent lambdas.

Main Steam Lines Deposition Two-node treatment, each well-mixed, is used for each steam line in which flow occurs. The first node is from the reactor vessel to the inboard MSIV. The second node is from the inboard MSIV to the turbine stop valve. Gravitational settling applied to aerosols on horizontal pipe projected areas, based on a 20 group probability distribution as a function of particle velocities and characteristics. For Elemental Iodine, deposition velocities are calculated based on the pipe wall temperatures, and because elemental iodine deposition is not gravity dependant, all interior pipe surface is credited.

Main Steam Condenser Credit Only the deposition area of the horizontal surface of the wetwell of the HP Condenser is credited.

Aerosol and Elemental Iodine removal efficiencies are calculated in a manner similar to that used for the main steam lines, as discussed in the applicable design analysis.

CHAPTER 15 15.6-42 REV. 14, SEPTEMBER 2008

LGS UFSAR Table 15.6-17 (Contd)

Key LOCA Analysis Inputs and Assumptions Removal Inputs Input/Assumption Value SGTS Filter Efficiency HEPA: Particulate aerosol 99%

Charcoal: Elemental and organic iodine 99%

RERS Filter Efficiency HEPA: Particulate aerosol 99%

Charcoal: Elemental and organic iodine 95%

CREFAS Filter Efficiency HEPA: Particulate aerosol 99%

Charcoal: Elemental and organic iodine 95%

CHAPTER 15 15.6-43 REV. 14, SEPTEMBER 2008

LGS UFSAR Table 15.6-18 LOSS OF COOLANT ACCIDENT: RADIOLOGICAL DOSE

SUMMARY

LOCA Radiological Doses Regulatory Limit Location Duration TEDE (rem) TEDE (rem)

Control Room 30 days 4.76* 5 EAB Maximum, 2 hours0.0833 days <br />0.0119 weeks <br />0.00274 months <br /> 0.933 25 LPZ 30 days 1.26 25

• The doses here include general external gamma shine and inhalation doses from radioactivity drawn into the control room.

CHAPTER 15 15.6-44 REV. 18, SEPTEMBER 2016

LGS UFSAR Table 15.6-19 LOSS OF COOLANT ACCIDENT: CONTROL ROOM DISPERSION FACTORS Onsite Control Room Dispersion Factors Values for Activity Release from the North Vent Stack to the Control Room Intake1,2 Time Period Control Room /Q (sec/m3) 0 - 2 hrs 6.88E-03 2 - 8 hrs 5.17E-03 8 - 24 hrs 2.04E-03 1-4d 1.29E-03 4 - 30 d 9.63E-04 Notes:

1. Elevated release /Q values are based on Regulatory Guide 1.145 methodology.

2. Control room intake /Q values are also applicable for control room inleakage.

CHAPTER 15 15.6-45 REV. 14, SEPTEMBER 2008

LGS UFSAR Table 15.6-20 LOSS-OF-COOLANT ACCIDENT: OFFISTE DISPERSION FACTORS Offsite Dispersion Factors Values for Activity Release from the North Vent Stack to the EAB and LPZ Using RG 1.145 Methodology Time Period EAB /Q (sec/m3) LPZ /Q (sec/m3) 0 - 2 hrs 3.18E-04 -

0 - 8 hrs - 5.79E-05 8 - 24 hrs - 4.10E-05 1 - 4 days - 1.95E-05 4 - 30 days - 6.68E-06 CHAPTER 15 15.6-46 REV. 14, SEPTEMBER 2008

LGS UFSAR Table 15.6-21 Table 15.6-21 Deleted CHAPTER 15 15.6-47 REV. 14, SEPTEMBER 2008

LGS UFSAR Table 15.6-22 Table 15.6-22 Deleted CHAPTER 15 15.6-48 REV. 14, SEPTEMBER 2008

LGS UFSAR Table 15.6-23 SEQUENCE OF EVENTS FOR FEEDWATER LINE BREAK OUTSIDE PRIMARY CONTAINMENT TIME (min) EVENT 0 One feedwater line breaks.

0+ Feedwater line check valves isolate the reactor from the break.

<0.5 At low water level (Level 3), reactor scram would initiate. At low-low water (Level 2), HPCI would initiate, RCIC would initiate, and recirculation pumps would trip. If low-low-low water level (Level 1) is reached, MSIV closure begins, and CS and LPCI receive initiation signals but will not inject due to high reactor pressure.(1) 2 (approx) The MSRVs would open and close and maintain the reactor vessel pressure at approximately 1170 psig.

60 - 120 Normal reactor cooldown procedure established.

Note:

(1)

Because of an additional steam flow induced process measurement error in the Level 3 scram, the timing values following Low water level scram based on the L3 Analytical Limit are slightly different. However, as described in Reference 15.6-25, the impact of the change is not significant.

CHAPTER 15 15.6-49 REV. 17, SEPTEMBER 2014

LGS UFSAR Table 15.6-24 FEEDWATER LINE BREAK ACCIDENT: PARAMETERS TABULATED FOR POSTULATED ACCIDENT ANALYSES DESIGN REALISTIC BASIS BASIS ASSUMPTIONS ASSUMPTIONS I. Data and Assumptions Used to Estimate Radioactive Source from Postulated Accidents A. Power Level NA NA B. Burnup NA NA C. Fission Products Released NA None from Fuel (fuel damaged)

D. Release of Activity by NA Table 15.6-25 Nuclide E. Iodine Fractions

1. Organic NA 0

2. Elemental NA 1.0

3. Particulate NA 0 F. Reactor Coolant Activity NA Section Before the Accident 15.6.6.5.2 II. Data and Assumptions Used to Estimate Activity Released A. Primary containment Leak NA NA Rate (%/day)

B. Secondary Containment Release NA NA Rate (%/day)

C. Isolation Valve Closures NA NA Time (sec)

D. Adsorption and Filtration Efficiencies

1. Organic iodine NA NA

2. Elemental iodine NA NA

3. Particulate iodine NA NA

4. Particulate fission NA NA products E. Recirculation System NA NA Parameters

1. Flow rate NA NA

2. Mixing efficiency NA NA

3. Filter efficiency NA NA F. Containment Spray Parameters NA NA (flow rate, drop size, etc.)

G. Containment Volumes NA NA CHAPTER 15 15.6-50 REV. 13, SEPTEMBER 2006

LGS UFSAR Table 15.6-24 (Cont'd)

DESIGN REALISTIC BASIS BASIS ASSUMPTIONS ASSUMPTIONS H. All Other Pertinent Data NA None and Assumptions III. Dispersion Data A. EAB/LPZ Distance (m) NA 731/2043 B. X/Qs for Total Dose - 1.2x10-4 EAB/LPZ (8 hr) NA 2.0x10-5 IV. Dose Data A. Method of Dose Calculation NA Reference 15.6-3 B. Dose Conversion Assumptions NA Reference 15.6-3 C. Peak Activity Concentrations NA NA in Containment D. Doses NA Table 15.6-26 CHAPTER 15 15.6-51 REV. 13, SEPTEMBER 2006

LGS UFSAR Table 15.6-26 FEEDWATER LINE BREAK: RADIOLOGICAL EFFECTS REALISTIC ANALYSIS WHOLE BODY THYROID DOSE (rem) DOSE (rem)

Exclusion Area Boundary (731 meters - 2 hr dose) 3.06x10-3 3.14x10-1 Low Population Zone (2043 meters - 2 hr(1) dose) 5.10x10-4 5.23x10-2 (1)

Duration of accident is 2 hours0.0833 days <br />0.0119 weeks <br />0.00274 months <br /> CHAPTER 15 15.6-53 REV. 13, SEPTEMBER 2006

LGS UFSAR Table 15.6-27 LOSS OF COOLANT ACCIDENT: SEQUENCE OF EVENTS FOR RADIOLOGICAL CONSEQUENCE ANALYSIS Time Events and Assumptions 0 DBA LOCA is initiated.

- Instantaneous Regulatory Guide 1.183 source term assumed.

- Activity release from Reactor Enclosure taken at design basis SGTS flow of 3000 cfm per Reactor enclosure, to simulate exfiltration.

18 sec SGTS is initiated.

- No credit is taken for filtration during drawdown period.

- Exfiltration of 3000 cfm per Reactor Enclosure continues to be assumed.

3 min RERS is initiated.

- No credit is taken for filtration during drawdown period.

15.5 Reactor enclosure reaches -1/4 inch wg.

min. [Drawdown Period Ends(1).]

- Unfiltered exfiltration ceases.

- Reactor Enclosure exhausts at 2500 cfm [TS inleakage limit] throughout SGTS with 99% iodine removal eff.

- RERS filtration of recirculation flow with iodine removal eff. of 95% for organic /

elemental and 99% for particulate.

(1)

Drawdown period determined based on a more conservative 2800 cfm SGTS flow, to allow for flow balancing margin.

CHAPTER 15 15.6-54 REV. 14, SEPTEMBER 2008

LGS UFSAR 15.7 RADIOACTIVE RELEASES FROM SUBSYSTEMS AND COMPONENTS 15.7.1 RADIOACTIVE GAS WASTE SYSTEM LEAK OR FAILURE The following radioactive gas waste system components are examined under severe failure mode conditions for effects on plant safety:

a. Main condenser offgas treatment system failure

b. Malfunction of main turbine gland sealing system

c. Failure of SJAE lines.

15.7.1.1 Main Condenser Offgas Treatment System Failure 15.7.1.1.1 Identification of Causes and Frequency Classification 15.7.1.1.1.1 Identification of Causes Those events which could cause a failure in the offgas treatment system are:

a. A seismic occurrence greater than the equipment can withstand.

b. A fire in the filter assemblies.

c. Failure of spacially related equipment.

The equipment and piping are designed to resist any hydrogen/oxygen detonation that has a reasonable probability of occurring. Consequently, a detonation is not considered as a possible failure mode.

The decay heat on the filters is handled inherently by the system and by the available air flows.

The system is reasonably isolated from other systems or components that could cause any serious interaction or failure. The only credible event that could result in the release of significant activity to the environment is an earthquake.

Even though the offgas system is designed to the requirements of Regulatory Guide 1.143 as discussed in Section 11.3, an event resulting in the failure of the offgas system is assumed to occur.

The design basis, description, and performance evaluation of the subject system is given in Section 11.3.

15.7.1.1.1.2 Frequency Classification This accident is categorized as a limiting fault.

15.7.1.1.2 Sequence of Events and System Operation 15.7.1.1.2.1 Sequence of Events CHAPTER 15 15.7-1 REV. 19, SEPTEMBER 2018

LGS UFSAR The sequence of events following this failure is shown in Table 15.7-1.

15.7.1.1.2.2 Identification of Operator Actions Gross failure of this system may require manual isolation of this system from the main condenser.

This isolation results in high condenser pressure and a reactor scram. The operator should monitor the turbine-generator auxiliaries and break vacuum as soon as possible. The operator should notify personnel to evacuate the area immediately and notify radiation protection personnel to survey the area and determine requirements for re-entry. The time to perform these actions is estimated to be about two minutes.

15.7.1.1.2.3 System Operation In analyzing the postulated offgas system failure, credit is taken for functioning of normally operating plant instrumentation and controls and other systems only in assuming the following:

a. Capability to detect the failure itself, indicated by an alarmed increase in radioactivity levels seen by the area radiation monitoring system, in a loss of flow in the offgas system, and in an alarmed increase in activity at the ventilation release.

b. Capability to isolate the system and shut down the reactor.

c. Operational indicators and annunciators in the control room.

15.7.1.1.2.4 The Effect of Single Failures and Operator Errors After the initial system gross failure, the inability of the operator to actuate a system isolation could affect the analysis. However, a seismic event greater than design basis will cause the tripping of the turbine, or will lead to a load rejection. This will result in a scram and negate a need for the operator to initiate a reactor shutdown via system isolation.

See Section 15.9 for a further detailed discussion of this subject.

15.7.1.1.3 Core and System Performance The postulated failure results in a system isolation necessitating reactor shutdown because of loss of vacuum in the main condenser. This transient is analyzed in Section 15.2.5.

15.7.1.1.4 Barrier Performance The postulated failure is the rupture of the offgas treatment system pressure boundary. No credit is taken for performance of secondary barriers, except to the extent inherent in the assumed equipment release fractions discussed in Section 15.7.1.1.5, below.

15.7.1.1.5 Radiological Consequences 15.7.1.1.5.1 General Two separate radiological analyses are provided for this accident:

CHAPTER 15 15.7-2 REV. 19, SEPTEMBER 2018

LGS UFSAR

a. The first is based upon conservative assumptions considered to be acceptable to the NRC for the purpose of determining adequacy of the plant design to meet 10CFR100. This analysis is referred to as the "design basis analysis."

b. The second is based upon assumptions considered to provide a realistic conservative estimate of radiological consequences. This analysis is referred to as the "realistic analysis."

15.7.1.1.5.2 Design Basis Analysis Regulatory Guide 1.98 contains specific quantitative regulatory guidelines upon which a design basis analysis can be performed. The primary differences between this analysis and the realistic analysis are in the basic source terms and atmospheric dilution factors. The same analytical techniques used for the realistic analysis are used for this evaluation. Specific parametric values used in this evaluation are presented in Table 15.7-2.

15.7.1.1.5.2.1 Fission Product Release 15.7.1.1.5.2.1.1 Initial Conditions The activity in the offgas system was based upon the following conditions:

a. 6 scfm air inleakage.

b. 0.35 Ci/sec noble gas after 30 minutes delay for a period of one month, preceding the accident and 0.1 Ci/sec (at 30 minutes delay) for a time earlier than 30 days.

c. The total mass of charcoal in the system is 321,790 lbs. The adsorption coefficients for Xe and Kr are 1000 cc/g and 65 cc/g, respectively.

d. The uncontrolled releases from the SJAE occur for a period of 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> following the accident. The delay time between the SJAE and the break is five minutes.

15.7.1.1.5.2.1.2 Assumptions Depending upon assumptions as to radionuclide release fractions, various equipment pieces may be controlling with respect to dose consequences. The assumed release fractions are shown in Table 15.7-3. All other release sources are negligible. Iodine and activation gases are neglected per Regulatory Guide 1.98.

15.7.1.1.5.2.2 Fission Product Transport to the Environment The transport pathway consists of direct release from the failed component to the environment through the radwaste enclosure ventilation system. The activity released to the environment is presented in Tables 15.7-4 and 15.7-8.

15.7.1.1.5.2.3 Results CHAPTER 15 15.7-3 REV. 19, SEPTEMBER 2018

LGS UFSAR The dose contributions due to releases from the charcoal tanks and SJAE are presented in Tables 15.7-6 and 15.7-9(a) respectively. The total offsite doses due to failure of the system are summarized in Table 15.7-9(b).

15.7.1.1.5.3 Realistic Analysis The realistic analysis is based upon an engineered but still conservative assessment of this accident. Specific values of parameters used in the evaluation are presented in Table 15.7-2.

15.7.1.1.5.3.1 Fission Product Release 15.7.1.1.5.3.1.1 Initial Conditions The activity in the offgas system is based upon the following conditions:

a. 20 scfm air inleakage.

b. 0.06 Ci/sec noble gas after 30 minutes delay.

c. The total mass of charcoal in the system is 321,790 lbs. The adsorption coefficients for Xe and Kr are 733 cc/g and 31.8 cc/g, respectively.

d. The uncontrolled releases from the SJAE occur for a period of 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> following the accident. The delay time between the SJAE and the break is five minutes.

15.7.1.1.5.3.2 Fission Product Transport to the Environment The activity released to the environment is presented in Table 15.7-5 and 15.7-8.

15.7.1.1.5.3.3 Results The dose contributions due to releases from the charcoal tanks and SJAE are presented in Tables 15.7-6 and 15.7-9(a) respectively. The total offsite doses due to failure of the system are summarized in Table 15.7-9(b).

15.7.1.2 Malfunction of Main Turbine Gland Sealing System 15.7.1.2.1 Identification of Causes and Frequency Classification 15.7.1.2.1.1 Identification of Causes Those events that could cause a malfunction failure in the main turbine gland sealing system are:

a. Failure of the gland steam evaporator and its backup supply.

b. Failure of the gland steam condenser exhausters.

c. Excessive pressure in the steam seal header.

15.7.1.2.1.2 Frequency Classification CHAPTER 15 15.7-4 REV. 19, SEPTEMBER 2018

LGS UFSAR This accident is categorized as a limiting fault.

15.7.1.2.2 Sequence of Events and System Operation It is assumed that the system fails near the condenser. This results in activity normally processed by the offgas treatment system being discharged directly to the turbine enclosure and subsequently through the ventilation system to the environment.

The operator initiates a normal shutdown of the reactor to reduce the gaseous activity being discharged. A loss of main condenser vacuum will result in a turbine trip and reactor shutdown.

Failure of the gland steam evaporator and its backup steam supply would result in the discharge of a small amount of contaminated steam from the high pressure and low pressure shaft seals to the gland steam condenser exhauster.

Failure of both of the gland steam condenser exhausters results in the escape of clean steam from the high pressure and low pressure shaft seals.

Excessive pressure in the steam seal header as a result of a malfunction of the gland steam evaporator or the backup steam supply valve is prevented by a relief valve, so that there is no detrimental effect on the operation of the seals.

15.7.1.2.3 Core and System Performance The failure of this power conversion system does not directly affect the NSSS. It will, of course, lead to the decoupling of the NSSS from the power conversion system.

This failure has no applicable effect on the core or the NSSS safety performance.

15.7.1.2.4 Barrier Analysis This release occurs outside primary containment; therefore, the primary containment barrier integrity is not involved.

15.7.1.2.5 Radiological Consequences Each of the assumed malfunctions results in negligible releases of activity. Therefore, the doses that result from these failures are inconsequential.

15.7.1.3 Failure of Steam Jet Air Ejector Lines 15.7.1.3.1 Identification of Causes and Frequency Classification 15.7.1.3.1.1 Identification of Causes An evaluation of events that could cause a failure of the SJAE line indicates that a seismic event or hydrogen detonation more serious than the system is able to withstand are the only events that could rupture the lines.

15.7.1.3.1.2 Frequency Classification CHAPTER 15 15.7-5 REV. 19, SEPTEMBER 2018

LGS UFSAR This accident is categorized as a limiting fault.

15.7.1.3.2 Sequence of Events and System Operation It is assumed that the line leading from the SJAE to the offgas treatment system fails. This results in activity normally processed by the offgas treatment system being discharged directly to the turbine enclosure and subsequently through the ventilation system to the environment.

The operator will initiate a normal shutdown of the reactor to reduce the gaseous activity being discharged. The operator will isolate the main condenser, which results in high condenser pressure and a reactor scram. The operator will notify personnel to evacuate the area immediately and notify radiation protection personnel to survey the area and determine requirements for re-entry.

15.7.1.3.3 Core and System Performance The failure of this power conversion system does not directly affect the NSSS. It will, of course, lead to the decoupling of the NSSS with power conversion system.

This failure has no applicable effect on the core or the NSSS safety performance.

15.7.1.3.4 Barrier Analysis This release occurs outside primary containment; therefore, the primary containment barrier integrity is not involved.

15.7.1.3.5 Radiological Consequences The offgas release rates at the SJAE are assumed for the design basis and the realistic case to be 0.35 Ci/Sec and 0.06 Ci/Sec at 30 minutes decay, respectively. The delay between the SJAE and the break is assumed to be five minutes. It is conservatively assumed that activities are released directly to the environment and that the uncontrolled release period is one hour before the plant operator initiates a plant shutdown. Iodines are neglected per Regulatory Guide 1.98.

Specific parametric values in this evaluation are presented in Table 15.7-7.

The activity released to the environment and the calculated exposures are presented in Tables 15.7-8 and 15.7-9, respectively.

15.7.2 LIQUID RADIOACTIVE WASTE SYSTEM FAILURE 15.7.2.1 Identification of Causes and Frequency Classification 15.7.2.1.1 Identification of Causes It was assumed that an unspecified event causes the complete release of the average radioactivity inventory in the tank containing the largest quantities of significant radionuclides in the liquid radwaste system. This is the RWCU phase separator in the radwaste enclosure. The airborne radioactivity released during this accident passes directly to the environment via the ventilation stack.

CHAPTER 15 15.7-6 REV. 19, SEPTEMBER 2018

LGS UFSAR Postulated events that could cause release of the radioactive inventory of the RWCU phase separator are cracks in the vessel and operator error. The possibility of small cracks and consequent low-level release rates receives primary consideration in system and component design. The RWCU phase separator is designed to operate at atmospheric pressure and 212F, so the possibility of failure is considered small. A liquid radwaste release caused by operator error is also considered a remote possibility. Operating techniques and administrative procedures emphasize detailed system and equipment operating instruction. Should a release of liquid radioactive wastes occur, floor drain sump pumps in the floor of the radwaste enclosure will receive a high-water level signal, activate automatically, and remove the spilled liquid.

15.7.2.1.2 Frequency Classification Much of the discussion concerning the remote likelihood of a leakage or malfunction accident of a RWCU phase separator applies equally to a complete release accident. The probability of a complete rupture or complete malfunction accident is, however, considered even lower.

Although not analyzed for the requirements of seismic Category I equipment, the liquid radwaste tanks are constructed in accordance with sound engineering principles. Therefore, simultaneous failure of all the tanks is not considered credible.

This accident is expected to occur with the frequency of a limiting fault.

15.7.2.2 Sequence of Events and System Operation The sequence of events following this accident is shown in Table 15.7-10.

The rupture of a RWCU phase separator would leave little recourse to the operator. No method of recontaining the gaseous phase discharge is available.

15.7.2.3 Core and System Performance Failure of a RWCU phase separator does not directly affect the NSSS. It will, of course, lead to the decoupling of the NSSS from the liquid radioactive waste system.

This failure is not expected to have any applicable effect on the core or NSSS safety performance.

15.7.2.4 Barrier Performance This release occurs outside primary containment; therefore, barrier integrity is not involved.

15.7.2.5 Radiological Consequences 15.7.2.5.1 Design Basis Analysis It is assumed that a RWCU phase separator contains the inventory of radioactive material as presented in Section 12.2. A RWCU phase separator, which contains the greatest amount of iodine inventory that could be released, is assumed to fail releasing the entire contents of this tank (equal to 80% of the tank capacity) to the radwaste enclosure. An iodine partitioning factor of 100 is assumed for the spilled liquid. The airborne iodine activity is exhausted through the radwaste CHAPTER 15 15.7-7 REV. 19, SEPTEMBER 2018

LGS UFSAR ventilation system over a two-hour period. Specific parametric values used in this evaluation are presented in Table 15.7-11.

Table 15.7-12 lists the iodine activity released to the environment.

The offsite radiological doses for a RWCU phase separator rupture accident are given in Table 15.7-14.

15.7.2.5.2 Realistic Analysis It is assumed that the inventory in a RWCU phase separator corresponds to 0.05 Ci/sec offgas release under normal operation. Other assumptions are the same as that of the design basis analysis. Activities released to the environment and offsite doses are presented in Tables 15.7-13 and 15.7-14, respectively.

15.7.3 POSTULATED RADIOACTIVE RELEASES DUE TO LIQUID RADWASTE TANK FAILURE Refer to Section 2.4.12 for a discussion of tank failures.

15.7.4 FUEL HANDLING ACCIDENT The material presented in Section 15.7.4 is historical and based on an 8x8 fuel design. However, the material presented in Section 15.7.4.5 is updated for Alternative Source Terms and represents the current licensing basis for the FHA. The analytical methodology and licensing bases for the Fuel Handling Accident are provided in GESTAR II (Reference 4.1-1). Compliance with these bases is verified in Amendment 22 of GESTAR II for each new fuel design. The analysis in this Section generally follows the methodology described in GESTAR II, however, it applies additional conservative assumptions. The GE RCWP jib cranes are permitted to extend into the boundary zone during fuel handling based on a determination in a GE analysis that a collision between a loaded fuel grapple and the GE RCWP would not result in dropping the fuel bundle or mast fuel grapple assembly onto the core; and therefore the original FHA remains bounding.

15.7.4.1 Identification of Causes and Frequency Classification 15.7.4.1.1 Identification of Causes The fuel handling accident is assumed to occur as a consequence of a failure of the fuel assembly lifting mechanism resulting in the dropping of a raised fuel assembly onto other fuel bundles. A variety of events that qualify for the class of accidents termed "fuel handling accidents" has been investigated. The accident that produces the largest number of failed spent fuel rods is the drop of a spent fuel bundle and the fuel grapple assembly of the refueling platform into the reactor core when the reactor vessel head is off. The fuel grapple assembly consists of a telescopic mast and head assembly.

15.7.4.1.2 Frequency Classification This accident is categorized as a limiting fault.

15.7.4.2 Sequence of Events and System Operation CHAPTER 15 15.7-8 REV. 19, SEPTEMBER 2018

LGS UFSAR 15.7.4.2.1 Sequence of Events The sequence of events following this failure is shown in Table 15.7-15.

15.7.4.2.2 Identification of Operator Actions The operator actions are as follows:

a. Initiate the evacuation of the refueling area.

b. Notify Health Physics

c. The supervisor in charge of fuel handling will alert the control room operator to the accident.

d. Determine if the normal ventilation system has isolated and the SGTS is in operation.

e. Initiate action to determine the extent of potential radiation doses by measuring the radiation levels in the vicinity of or close to the refueling area.

f. Appropriate radiological control methods should be implemented at the entrance of the refueling area.

g. Before entering the refueling area, a careful study of conditions, radiation levels, etc., will be performed.

15.7.4.2.3 System Operation Normally, operating plant instrumentation and controls are assumed to function, although credit is taken only for the isolation of the normal ventilation system and the operation of the SGTS.

Operation of other plant or RPS or ESF systems is not expected.

15.7.4.2.4 The Effect of Single Failures and Operator Errors The automatic ventilation isolation system includes the radiation monitoring detectors and isolation valves. The SGTS is designed to the single failure criterion and safety requirements. Refer to Sections 7.6, 9.4 and 15.10 for further details.

15.7.4.3 Core and System Performance 15.7.4.3.1 Mathematical Model The analytical methods and associated assumptions used to evaluate the consequences of this accident are considered to provide a realistic yet conservative assessment of the consequences.

Calculations were performed to evaluate the consequences of a variety of drop scenarios. The worst-case scenario that produced the greatest number of failed fuel rods is represented by the fuel bundle and grapple assembly falling as two separate and independent units from their respective fully raised heights.

CHAPTER 15 15.7-9 REV. 19, SEPTEMBER 2018

LGS UFSAR The consequences of a drop scenario consisting of a fuel bundle and grapple assembly falling as a single unit are bounded by the above worst-case scenario, mainly because twice as many fuel rods are struck (and consequently fail due to bending) by the drop of two independent units.

The calculated results of the worst case scenario are conservative because both of the following unlikely events would have to occur:

a. The fuel bundle becomes detached from the grapple by either a break of the bail handle or grapple.

b. The grapple assembly becomes detached from the refueling platform by either a break of the cables or a break of the cable support eye bracket.

To estimate the expected number of failed fuel rods in each impact, an energy approach is used.

The fuel assembly and grapple assembly are expected to impact on the reactor core at a small angle from the vertical, possibly inducing a bending mode of failure on the fuel rods of the dropped assembly. It is assumed that each fuel rod resists the imposed bending load by a couple consisting of two equal, opposite concentrated forces. Therefore, fuel rods are expected to absorb little energy prior to failure as a result of bending. Actual bending tests with concentrated point loads show that each fuel rod absorbs approximately 1 ft-lb prior to cladding failure. Each rod that fails as a result of gross compression distortion is expected to absorb approximately 250 ft-lb before cladding failure (based upon 1% uniform plastic deformation of the rods). The energy of the dropped assemblies is conservatively assumed to be absorbed by only the cladding and other core structures. Because a typical 8x8 fuel assembly consists of 72% fuel, 11% cladding, and 17% other structural material by weight, the assumption that no energy is absorbed by the fuel material results in considerable conservatism in the mass-energy calculations that follow.

It should be noted that the energy required to cause cladding failure due to compression and weight percentages of fuel, cladding, and other structural material are fuel type specific. The values given here are historical as discussed in Section 15.7.4.

The energy absorption on successive impacts is estimated by considering a plastic impact.

Conservation of momentum under a plastic impact shows that the fractional kinetic energy absorbed during impact is:

1 - M1 M1 + M2 where M1 is the impacting mass and M2 is the struck mass.

15.7.4.3.2 Input Parameters and Initial Conditions The assumptions used in the analysis of this accident are listed below:

a. The fuel assembly and grapple assembly are dropped from the maximum height allowed by the refueling platform (32 feet and 47 feet, respectively, when handling fuel) as two separate and independent units.

b. The entire amount of potential energy, referenced to the top of the reactor core, is available for application to the fuel assemblies involved in the accident. This CHAPTER 15 15.7-10 REV. 19, SEPTEMBER 2018

LGS UFSAR assumption neglects the dissipation of some of the mechanical energy of the falling fuel assembly and grapple assembly in the water above the core.

c. None of the energy associated with the dropped assemblies is absorbed by the fuel material (uranium dioxide).

d. The minimum water depth between the top of the fuel rods and the fuel pool surface is 22 feet.

e. Maximum fuel rod pressurization is 2072 psia.

f. The peak linear power density for the highest power assembly discharged is 13.4 kW/ft and the corresponding maximum centerline operating fuel temperature is 3412F.

g. Because the weights of the fuel assembly and grapple assembly are similar, the fractional energy losses are assumed to be the same for both assemblies.

15.7.4.3.3 Results 15.7.4.3.3.1 Energy Available Dropping a fuel assembly onto the reactor core from the maximum height allowed by the refueling platform (32 feet) results in an impact velocity of 45.4 fps. Dropping the fuel grapple assembly onto the reactor core from the maximum height allowed by the refueling platform (47 feet) results in an impact velocity of 55.0 fps.

The total kinetic energy acquired by the falling assemblies is approximately 45,900 ft-lb and is dissipated in one or more impacts. The total kinetic energy equals the sum of the kinetic energy of the dropped fuel assembly (32 ft x 700 lb = 22,400 ft-lb) and the dropped fuel grapple assembly (47 ft x 500 lb = 23,500 ft-lb).

A review has been made to determine whether there are any potential drops of loads lighter than a fuel bundle and full grapple assembly (i.e., 1200 lb) that could have a higher kinetic energy due to a higher carrying height. The following conclusions have been reached:

No load that weighs less than 540 lb can develop a higher kinetic energy than a fuel bundle and full grapple assembly if dropped over spent fuel. This value is based on a potential energy of 45,900 ft-lb with the load at the maximum lift height of the reactor enclosure crane and relative to the reactor core (worst case). The majority of light loads carried over spent fuel weigh less than 540 lb.

As listed in Table 15.7-22, the potential energy of the remaining few light loads which will be handled over spent fuel and which weigh more than 540 lb is less than 45,900 ft-lb because their maximum drop heights are less than the worst case. Infrequent or unexpected movement of light loads (i.e., weighing greater than 540 lb but less than 1200 lb) over spent fuel which are not identified in Table 15.7-22 are administratively controlled on a case-by-case basis. These infrequent or unexpected load handling situations use the load handling guidelines to ensure that the probability of a load drop is extremely small or that the consequences are acceptable.

CHAPTER 15 15.7-11 REV. 19, SEPTEMBER 2018

LGS UFSAR Based on the above review, the maximum kinetic energy resulting from the drop of each object weighing less than a fuel bundle and grapple assembly that could be handled over spent fuel will not exceed the effects of the fuel handling accident described above.

15.7.4.3.3.2 Energy Loss Per Impact Based on the fuel geometry in the reactor core and the long narrow shape of both dropped assemblies, four fuel assemblies are struck by each dropped assembly. The fractional energy loss on the first impact is approximately 80%.

The second impact is expected to be less direct. The broadside of each dropped assembly impacts approximately 24 more fuel assemblies, so that after the second impact less than 240 ft-lb (approximately 1% of the original kinetic energy) is available for a third impact. Because a single fuel rod is capable of absorbing 250 ft-lb in compression before cladding failure, it is unlikely that any fuel rod will fail on a third impact.

If each dropped assembly strikes only one or two fuel assemblies on its first impact, the energy absorption by the core support structure results in approximately the same energy dissipation on the first impact as in the case where four fuel assemblies are struck. The energy relations on the second and third impacts remain approximately the same as in the original case. Thus, the calculated energy dissipation is as follows:

First impact 80%

Second impact 19%

Third impact 1% (no cladding failures) 15.7.4.3.3.3 Fuel Rod Failures 15.7.4.3.3.3.1 First Impact Failures The first impacts dissipate 0.80 x 45,900 or 36,720 ft-lb of energy. It is assumed that 50% of this energy is absorbed by the dropped fuel assembly and that the remaining 50% is absorbed by the struck fuel assemblies in the core. In addition, it is conservatively assumed that 0% of this energy is absorbed by the dropped grapple assembly and 100% is absorbed by the struck fuel assemblies. Because the fuel rods of the dropped fuel assembly are susceptible to the bending mode of failure and because 1 ft-lb of energy is sufficient to cause cladding failure as a result of bending, all 62 rods of the dropped fuel assembly are assumed to fail.

Each assembly, fuel and grapple, hits four fuel assemblies in the reactor core. This results in 64 tie rod failures as follows: 2 dropped assemblies (fuel and grapple) x 4 struck fuel assemblies per dropped assembly x 8 tie rods per struck fuel assembly.

Because the remaining fuel rods of the struck assemblies are held rigidly in place in the core, they are susceptible only to the compression mode of failure. To cause cladding failure of one fuel rod as a result of compression, 250 ft-lb of energy is required. To cause failure of all the remaining rods of each group of four struck assemblies, 250 x 54 x 4 or 54,000 ft-lb of energy would have to be absorbed in cladding alone. Thus, it is clear that not all the remaining fuel rods of the struck assemblies can fail on the first impact. The number of fuel rod failures caused by compression is computed as follows:

CHAPTER 15 15.7-12 REV. 19, SEPTEMBER 2018

LGS UFSAR Dropped fuel assembly:

11 0.5 x 0.8 x 22,400 x 11 + 17 = 14 250 Dropped fuel grapple assembly:

11 1.0 x 0.8 x 23,500 x 11 + 17 = 30 250 44 Thus, during the first impact, fuel rod failures are as follows:

Dropped fuel assembly 62 rods (bending)

Struck assemblies 64 tie rods (bending)

Struck assemblies 44 rods (compression) 170 failed rods 15.7.4.3.3.3.2 Second Impact Failures Because of the less severe nature of the second impact and the distorted shape of each dropped assembly, it is assumed that the tie rods in only two of the 24 struck assemblies are subjected to bending failure. Because each dropped assembly strikes 24 fuel assemblies, 2 x 2 x 8 = 32 tie rods are assumed to fail. The number of fuel rod failures caused by compression on the second impact is computed as follows:

Dropped fuel assembly:

0.19 11 2 x 22,400 x 11 + 17 =3 250 Dropped fuel grapple assembly:

11 1.0 x 0.19 x 23,500 x 11 + 17 = 7 250 10 Thus, during the second impact, the fuel rod failures are as follows:

Struck assemblies 32 tie rods (bending)

Struck assemblies 10 rods (compression) 42 failed rods 15.7.4.3.3.3.3 Total Failures The total number of failed rods resulting from the accident is as follows:

First impact 170 rods Second impact 42 rods CHAPTER 15 15.7-13 REV. 19, SEPTEMBER 2018

LGS UFSAR Third impact 0 rods 212 total failed rods 15.7.4.4 Barrier Performance The RCPB and primary containment are assumed to be open. The transport of fission products from the refueling area is discussed in Sections 15.7.4.5.2.1 and 15.7.4.5.2.2.

15.7.4.5 Radiological Consequences for the FHA Regulation 10CFR50.67, "Accident Source Term," provides a mechanism for power reactor licensees to voluntarily replace the traditional TID-14844 (Ref. 15.7-4A) accident source term used in design-basis accident analyses with an "Alternative Source Term" (AST). The methodology of approach to this replacement is given in USNRC Regulatory Guide 1.183 (Ref.

15.7-5) and its associated Standard Review Plan 15.0.1 (Ref. 15.7-6).

Accordingly, Limerick Generating Station, Units 1 and 2, have applied the AST methodology for several areas of operational relief in the event of a Design Basis Accident (DBA), without fully crediting the use of previously assumed safety systems. Amongst these systems are the Control Room Emergency Fresh Air Supply System (CREFAS) and the Standby Gas Treatment System (SGTS).

In support of a full-scope implementation of AST as described in and in accordance with the guidance of Ref. 15.7-5, AST radiological consequence analyses are performed for the four DBAs that result in offsite exposure (i.e., Loss of Coolant Accident (LOCA), Main Steam Line Break (MSLB), Fuel Handling Accident (FHA), and Control Rod Drop Accident (CRDA)).

Implementation consisted of the following steps:

• Identification of the AST based on plant-specific analysis of core fission product inventory,

• Calculation of the release fractions for the four DBAs that could potentially result in control room and offsite doses (i.e., LOCA, MSLB, FHA, and CRDA),

• Analysis of the atmospheric dispersion for the radiological propagation pathways,

• Calculation of fission product deposition rates and removal mechanisms,

• Calculation of offsite and control room personnel Total Effective Dose Equivalent (TEDE) doses.

15.7.4.5.1 Regulatory Approach The analyses are prepared in accordance with the guidance provided by Regulatory Guide 1.183 (Ref. 15.7-5).

15.7.4.5.2 Dose Acceptance Criteria CHAPTER 15 15.7-14 REV. 19, SEPTEMBER 2018

LGS UFSAR The AST acceptance criteria for Control Room dose for postulated major credible accident scenarios such as those resulting in substantial meltdown of the core with release of appreciable quantities of fission products is provided by 10CFR50.67, which requires:

"Adequate radiation protection is provided to permit access to and occupancy of the control room under accident conditions without personnel receiving radiation exposures in excess of 0.05 Sv (5 rem) total effective dose equivalent (TEDE) for the duration of the accident."

This limit is applied by Regulatory Guide 1.183 to all of the accidents considered with AST.

The AST acceptance criteria for an individual located at any point on the boundary of the exclusion area (the Exclusion Area Boundary or EAB) are provided by 10 CFR 50.67 as 25 rem TEDE for any 2-hour period following the onset of the postulated fission product release.

The AST acceptance criteria for an individual located at any point on the outer boundary of the low population zone (LPZ) are provided by 10CFR50.67 as 25 rem TEDE during the entire period of passage of the radioactive cloud resulting from the postulated fission product release.

These limits are applied by Regulatory Guide 1.183 to events with a higher probability of occurrence (including CRDA, MSLB, and FHA considered herein) to provide the following acceptance criteria:

• For the BWR MSLB for the case of an accident assuming fuel damage or a pre-incident Iodine spike, doses at the EAB and LPZ should not exceed 25 rem TEDE for the accident duration (2-hour dose for EAB and 30-day dose for LPZ). For MSLB accidents assuming normal equilibrium Iodine activity, doses should not exceed 2.5 rem TEDE for the accident duration.

• For the BWR CRDA, doses at the EAB and LPZ should not exceed 6.3 rem TEDE for the accident duration (2-hour dose for EAB and 24-hour dose for LPZ).

• For the FHA, doses at the EAB and LPZ should not exceed 6.3 rem TEDE for the accident duration (2-hour dose for EAB and 30-day dose for LPZ).

15.7.4.5.3 Computer Codes New AST calculations were prepared for the FHA to simulate the radionuclide release, transport, removal, and dose estimates associated with the postulated accident.

The RADTRAD computer code (Ref. 15.7-9) endorsed by the NRC for AST analyses was used in the calculations for analyzing the FHA. The RADTRAD program is a radiological consequence analysis code used to estimate post-accident doses at plant offsite locations and in the control room. The FHA assessment takes no credit for SGTS operation, control room isolation, emergency ventilation or filtration of intake air for the duration of the accident event.

Offsite X/Qs were calculated with the PAVAN computer code (Ref. 15.7-10), using the guidance of Regulatory Guide 1.145 (Ref. 15.7-11). Control room X/Qs were calculated with the ARCON96 computer code (Ref. 15.7-12). The PAVAN and ARCON96 codes calculate relative concentrations in plumes from nuclear power plants at offsite locations and control room air intakes, respectively.

CHAPTER 15 15.7-15 REV. 19, SEPTEMBER 2018

LGS UFSAR All of these computer codes have been used by the NRC staff in its safety reviews.

15.7.4.5.4 Source Terms Core Inventory As with the LOCA analysis, the inventory of reactor core fission products used as input to RADTRAD for the AST FHA analysis is based on maximum full power operation at a power level of 3527 MWth, which includes a 2% instrument error per Reg. Guide 1.49 (Ref. 15.7-13).

The fission products used for the accidents are the 60 isotopes of the standard RADTRAD input library, determined by the code developer as significant in dose consequences. These were extracted from Attachment A of the LGS Design Analysis LM-0645 (Ref. 15.7-14), and correspond to 24 month cycle burnup parameters, conservatively calculated using the ORIGEN 2.1 code.

Release Fraction Current design basis accident evaluations as modified by Regulatory Guide 1.183 (Ref. 15.7-5) were used to determine the specific releases of radioactive isotopes at the given stages of fuel pin failure and provide these releases as a percentage of the total release for each accident, as summarized below.

15.7.4.5.5 Methodology Dose Calculations As per Regulatory Guide 1.183 (Ref. 15.7-5), Total Effective Dose Equivalent (TEDE) doses are determined as the sum of the CEDE and the Effective Dose Equivalent (EDE) using dose conversion factors for inhalation CEDE from Federal Guidance Report No. 11 (Ref. 15.7-15) and for external exposure EDE from Federal Guidance Report No. 12 (Ref. 15.7-16).

Fuel Handling Accident (FHA)

Table 15.7-16 lists the key assumptions and inputs used in the analysis. The AST FHA dose assessments use historical fuel damage assumptions of a total of 212 failed rods based on an 8x8 fuel design containing 62 fuel rods, but with a conservatively higher radial peaking factor (PF) of 1.7 instead of 1.5, as suggested by Reg. Guide 1.183. As per Section 15.7.4, the analytical methodology and licensing bases for determination of fuel damage in an FHA are provided in GESTAR II, and compliance with these bases is verified for each new fuel design.

The new radiological analysis applies additional conservative assumptions so as to continue to provide margin.

The assumed accident is an assembly and mast drop from the maximum height allowed by the refueling platform (a height of 32 feet for the fuel assembly, and 47 feet for the mast) over the reactor well onto fuel in the reactor. Based on fuel damage assessments in Ref. 15.7-17, this bounds the damage assessments for various 8x8 and 7x7 array fuel types with 60 and 49 fuel pins per bundle, respectively, and 111 failed pins and a 1.5 PF, as well as GE11 or GE13 9x9 array fuel types with 74 fuel pins per bundle, 140 failed pins and a 1.5 PF, and GE14 or GNF2 10x10 array fuel types with 172 failed pins per bundle and a 1.7 PF.

CHAPTER 15 15.7-16 REV. 19, SEPTEMBER 2018

LGS UFSAR The analysis assumes that the activity from the damaged fuel is released from the reactor building through the South Vent Stack with no further credit for reactor building holdup or dilution. No credit is taken for the control room emergency ventilation system or standby gas treatment system operation.

The analysis assumptions for the transport, reduction, and release of the radioactive material from the fuel and the reactor coolant are consistent with the guidance provided in Appendix B of Regulatory Guide 1.183, and are provided in the design analysis of Ref. 15.7-14 and Ref 15.7-17.

15.7.4.5.6 Atmospheric Dispersion Factors (X/Qs)

Table 15.7-17 lists X/Q values used for the control room dose assessments, as derived in UFSAR Chapter 2 and applied for the release point (south vent stack) applicable to the FHA, for a zero velocity vent release.

Table 15.7-15 lists X/Q values for the EAB and LPZ boundaries, as also derived in UFSAR Chapter 2 and applied for the release point (south vent stack) applicable to the FHA, for a zero velocity vent release.

15.7.4.5.7 Summary and Conclusions The radiological consequences of the postulated FHA are given in Table 15.7-18. As indicated, the control room, EAB, and LPZ calculated doses are within regulatory limits after AST implementation.

15.7.5 SPENT FUEL CASK-DROP ACCIDENT The spent fuel and/or ISFSI cask will be equipped with lifting lugs and yoke(s) which are single failure proof in accordance with NUREG-0612 compatible with the single failure proof reactor enclosure crane and main hook, thus precluding a cask-drop due to a single failure. Therefore, an analysis of the cask-drop is not required. Refer to Section 9.1.5 for a description of the reactor enclosure crane and the interlocks that prevent moving the cask over the fuel pool.

15.7.6 MOVEMENT OF LOADS WITHOUT SECONDARY CONTAINMENT The methodology provided in the reference 15.7-3 calculation allows the movement of various loads over irradiated fuel, without refueling area secondary containment integrity in place. The calculation provides the methodology to determine the consequences of dropping a load onto irradiated fuel, without secondary containment integrity, to remain bounded by the Fuel Handling Accident Analysis. Using the methodology provided in reference 15.7-3 ensures that the offsite dose values for the UFSAR Fuel Handling Accident Analysis will not be exceeded if the load being carried over irradiated fuel is dropped.

15.

7.7 REFERENCES

15.7-1 D. Nguyen, "Realistic Accident Analysis - The RELAC Code", NEDO-21142, (January 1978).

CHAPTER 15 15.7-17 REV. 19, SEPTEMBER 2018

LGS UFSAR 15.7-2 N.R. Horton, W.A. Williams, and J.W. Holtzclaw, "Analytical Methods for Evaluating the Radiological Aspects of the General Electric Boiling Water Reactor,"

APED 5756, (March 1969).

15.7-3 LGS Design Analysis LM-0033, Rev. 4, "Methodology to determine the acceptability of Moving Loads over Irradiated Fuel Without Secondary Containment Integrity" 15.7-4 Not Used 15.7-4A U. S. Atomic Energy Commission, Technical Information Document (TID) 14844, "Calculation of Distance Factors for Power and Test Reactor Sites," March 23, 1962.

15.7-5 U. S. Nuclear Regulatory Commission Regulatory Guide 1.183, "Alternative Radiological Source Terms for Evaluating Design Basis Accidents at Nuclear Power Reactors," July 2000.

15.7-6 U. S. Nuclear Regulatory Commission Standard Review Plan 15.0.1, "Radiological Consequence Analyses Using Alternative Source Terms," Revision 0, July 2000.

15.7-7 LGS Design Analysis LM-0646, Rev. 3, "Loss of Coolant Accident (LOCA) Using Alternative Source Terms."

15.7-8 NEDC-32868 P, "GE14 Compliance with Amendment 22 of NEDE-24011-P-A (GESTAR II)," Rev. 1, September 2000.

15.7-9 RADTRAD Code, "A Simplified Model for Radionuclide Transport and Removal and Dose Estimation," Version 3.03.

15.7-10 PAVAN Code, "An Atmospheric Dispersion Program for Evaluating Design Bases Accidental Releases of Radioactive Materials from Nuclear Power Stations."

15.7-11 U. S. Nuclear Regulatory Commission Regulatory Guide 1.145, "Atmospheric Dispersion Models for Potential Accident Consequence Assessments at Nuclear Power Plants," Revision 1, November 1982.

15.7-12 ARCON96 Code, "Atmospheric Relative Concentrations in Building Wakes."

15.7-13 U. S. Nuclear Regulatory Commission Regulatory Guide 1.49, "Power Levels of Nuclear Power Plants," Revision 1, December 1973.

15.7-14 LGS Design Analysis LM-0645, Rev. 3, "Re-analysis of Fuel Handling Accident (FHA) Using Alternative Source Terms."

15.7-15 Federal Guidance Report No. 11, "Limiting Values of Radionuclide Intake and Air Concentration and Dose Conversion Factors for Inhalation, Submersion, and Ingestion," 1988.

CHAPTER 15 15.7-18 REV. 19, SEPTEMBER 2018

LGS UFSAR 15.7-16 Federal Guidance Report No. 12, "External Exposure to Radionuclides in Air, Water, and Soil," 1993.

15.7-17 GNF2 Fuel Design Cycle Independent Analyses for Limerick Generating Station Units 1 and 2, Global Nuclear Fuels Document, NEDC-33627P, (latest approved revision).

CHAPTER 15 15.7-19 REV. 19, SEPTEMBER 2018

LGS UFSAR Table 15.7-1 SEQUENCE OF EVENTS FOR MAIN CONDENSER OFFGAS TREATMENT SYSTEM FAILURE TIME (sec) EVENTS 0 Event begins - system fails.

0 Noble gases are released.

<60 Area radiation alarms alert plant personnel.

<60 Operator actions begin with:

a. Initiation of appropriate system isolations.

b. Manual scram actuation.

c. Assurance of reactor shutdown cooling.

CHAPTER 15 15.7-20 REV. 13, SEPTEMBER 2006

LGS UFSAR Table 15.7-2 RADIOACTIVE GAS WASTE SYSTEM FAILURE: PARAMETERS TABULATED FOR POSTULATED ACCIDENT ANALYSES DESIGN REALISTIC BASIS BASIS ASSUMPTIONS ASSUMPTIONS I. Data and Assumptions Used to Estimate Radioactive Source from Postulated Accidents A. Power Level 3527 3527 B. Burnup NA NA C. Fission Product Released None None from Fuel (fuel damaged)

D. Release of Activity by Table 15.7-4 Table 15.7-5 Nuclide E. Iodine Fractions

1. Organic NA NA

2. Elemental NA NA

3. Particulate NA NA F. Reactor Coolant Activity NA NA before the Accident II. Data and Assumptions Used to Estimate Activity Released A. Primary Containment Leak NA NA Rate (%/day)

B. Secondary Containment Release NA NA Rate (%/day)

C. Valve Movement Times NA NA D. Adsorption and Filtration NA NA Efficiencies

1. Organic iodine NA NA

2. Elemental iodine NA NA

3. Particulate iodine NA NA

4. Particulate fission NA NA products E. Recirculation System NA NA Parameters

1. Flow rate NA NA

2. Mixing efficiency NA NA

3. Filter efficiency NA NA F. Containment Spray Parameters NA NA (flow rate, drop size, etc.)

G. Containment Volumes NA NA H. All Other Pertinent Data Section Section and Assumptions 15.7.1.1.5 15.7.1.1.5 CHAPTER 15 15.7-21 REV. 13, SEPTEMBER 2006

LGS UFSAR Table 15.7-2 (Cont'd)

DESIGN REALISTIC BASIS BASIS ASSUMPTIONS ASSUMPTIONS III. Dispersion Data A. EAB/LPZ distances (m) 731/2043 731/2043 B. X/Qs for EAB(2 hr) 2.9x10-4 1.2x10-4 LPZ(8 hr) 4.0x10-5 2.0x10-5 IV. Dose Data A. Method of Dose Calculation Section Reference 15.7-1 B. Dose Conversion Assumptions Section Reference 15.10 15.7-1 C. Peak Activity Concentrations NA NA in Containment D. Doses Table Table 15.7-9(b) 15.7-9(b)

CHAPTER 15 15.7-22 REV. 13, SEPTEMBER 2006

LGS UFSAR Table 15.7-3 OFFGAS EQUIPMENT FAILURE RELEASE ASSUMPTIONS:

RELEASE FRACTIONS ASSUMED FOR DESIGN BASIS AND REALISTIC ANALYSIS EQUIPMENT NOBLE GASES SOLID DAUGHTERS RADIOIODINE Charcoal Guard 1.0/1.0 NA NA Bed Charcoal Adsorbers 1.0/1.0 NA NA Afterfilter 1.00/1.00 NA NA CHAPTER 15 15.7-23 REV. 13, SEPTEMBER 2006

LGS UFSAR Table 15.7-7 FAILURE OF STEAM JET AIR EJECTOR LINES: PARAMETERS TABULATED FOR POSTULATED ACCIDENT ANALYSES DESIGN REALISTIC BASIS BASIS ASSUMPTIONS ASSUMPTIONS I. Data and Assumptions Used to Estimate Radioactive Source from Postulated Accidents A. Power Level 3527 3527 B. Burnup NA NA C. Fission Product from NA NA Fuel (fuel damaged)

D. Release of Activity by NA None Nuclide E. Iodine Fractions NA NA

1. Organic NA NA

2. Elemental NA NA

3. Particulate NA NA F. Reactor Coolant Activity NA NA before the Accident II. Data and Assumptions Used to Estimate Activity Released A. Primary Containment Leak NA NA Rate (%/day)

B. Secondary Containment Release NA NA Rate (%/day)

C. Valve Movement Times NA NA D. Adsorption and Filtration NA NA Efficiencies

1. Organic iodine NA NA

2. Elemental iodine NA NA

3. Particulate iodine NA NA

4. Particulate fission NA NA products E. Recirculation System NA NA Parameters

1. Flow rate NA NA

2. Mixing efficiency NA NA

3. Filter efficiency NA NA F. Containment Spray Parameters NA NA (flow rate, drop size, etc.)

G. Containment Volumes NA NA CHAPTER 15 15.7-27 REV. 13, SEPTEMBER 2006

LGS UFSAR Table 15.7-7 (Cont'd)

DESIGN REALISTIC BASIS BASIS ASSUMPTIONS ASSUMPTIONS H. All Other Pertinent Data Section Section and Assumptions 15.7.1.3.5 15.7.1.3.5 III. Dose Data A. Method of Dose Calculation Section Reference 15.10 15.7-1 B. Dose Conversion Assumptions Section Reference 15.10 15.7-1 C. Peak Activity Concentrations NA NA in Containment D. Doses Table Table 15.7-9(a) 15.7-9(a)

CHAPTER 15 15.7-28 REV. 13, SEPTEMBER 2006

LGS UFSAR Table 15.7-8 FAILURE OF STEAM JET AIR EJECTOR LINES:

ACTIVITY RELEASED TO THE ENVIRONMENT DESIGN BASIS ANALYSIS Activity Isotope (Ci)

Kr-83m 4.19x10+1 Kr-85m 3.91x10+1 Kr-85 2.52x10-1 Kr-87 2.41x10+2 Kr-88 2.47x10+2 Kr-89 5.56x10+2 Xe-131m 1.87x10-1 Xe-133m 3.60 Xe-133 1.04x10+2 Xe-135m 2.61x10+2 Xe-135 2.75x10+2 Xe-137 7.71x10+2 Xe-138 8.74x10+2 REALISTIC ANALYSIS Activity Isotope (Ci)

Kr-83m 7.18 Kr-85m 6.70 Kr-85 4.32x10-2 Kr-87 4.13x10+1 Kr-88 4.23x10+1 Kr-89 9.53x10+1 Xe-131m 3.21x10-2 Xe-133m 6.16x10-1 Xe-133 1.79x10+1 Xe-135m 4.48x10+1 Xe-135 4.72x10+1 Xe-137 1.32x10+2 Xe-138 1.50x102 CHAPTER 15 15.7-29 REV. 13, SEPTEMBER 2006

LGS UFSAR Table 15.7-9(a)

FAILURE OF STEAM JET AIR EJECTOR LINES:

RADIOLOGICAL EFFECTS DESIGN BASIS ANALYSIS TOTAL BODY DOSE (rem)

Exclusion Area Boundary 2.3x10-1 (731 meters - 2 hr(1) dose)

Low Population Zone 3.1x10-2 (2043 meters - 2 hr(1) dose)

REALISTIC ANALYSIS TOTAL BODY DOSE (rem)

Exclusion Area Boundary 1.6x10-2 (731 meters - 2 hr(1) dose)

Low Population Zone 2.7x10-3 (2043 meters - 2 hr(1) dose)

(1)

Duration of accident is 2 hours0.0833 days <br />0.0119 weeks <br />0.00274 months <br /> CHAPTER 15 15.7-30 REV. 13, SEPTEMBER 2006

LGS UFSAR Table 15.7-9(b)

MAIN CONDENSER OFFGAS TREATMENT SYSTEM FAILURE: RADIOLOGICAL EFFECTS DESIGN BASIS ANALYSIS TOTAL BODY DOSE (rem)

Exclusion Area Boundary 4.96x10-1 (731 meters - 2 hr dose)

Low Population Zone 6.82x10-2 (2043 meters - 2 hr(1) dose)

REALISTIC ANALYSIS TOTAL BODY DOSE (rem)

Exclusion Area Boundary 3.90x10-2 (731 meters - 2 hr dose)

Low Population Zone 6.40x10-3 (2043 meters - 2 hr(1) dose)

(1)

Duration of accident is 2 hours0.0833 days <br />0.0119 weeks <br />0.00274 months <br /> CHAPTER 15 15.7-31 REV. 13, SEPTEMBER 2006

LGS UFSAR Table 15.7-10 SEQUENCE OF EVENTS:

LIQUID RADWASTE TANK FAILURE TIME (min) SEQUENCE OF EVENTS 0.0 Event begins - failure occurs 1.0 (approx) Area radiation alarms alert plant personnel

<10.0 Operator action begins CHAPTER 15 15.7-32 REV. 13, SEPTEMBER 2006

LGS UFSAR Table 15.7-11 LIQUID RADWASTE TANK FAILURE: PARAMETERS TABULATED FOR POSTULATED ACCIDENT ANALYSES DESIGN REALISTIC BASIS BASIS ASSUMPTIONS ASSUMPTIONS I. Data and Assumptions Used to Estimate Radioactive Source from Postulated Accidents A. Power Level NA NA B. Burnup NA NA C. Fission Products Released NA NA from Fuel (fuel damaged)

D. Release of Activity by NA None Nuclide E. Iodine Partition Factors Table 15.7-12 Table 15.7-13

1. Organic 0.01 0.01

2. Elemental 0.01 0.01

3. Particulate 0.01 0.01 F. Reactor Coolant Activity NA NA before the Accident II. Data and Assumptions Used to Estimate Activity Released A. Containment Leak Rate (%/day) NA NA B. Secondary Containment Release NA NA Rate (%/day)

C. Valve Movement Times NA NA D. Adsorption and Filtration NA NA Efficiencies

1. Organic iodine NA NA

2. Elemental iodine NA NA

3. Particulate iodine NA NA

4. Particulate fission NA NA products E. Recirculation System NA NA Parameters

1. Flow rate NA NA

2. Mixing efficiency NA NA

3. Filter efficiency NA NA F. Containment Spray Parameters NA NA (flow rate, drop size, etc.)

G. Containment Volumes NA NA H. All Other Pertinent Data and Assumptions

1. Dilution factor afforded NA NA by public waterway CHAPTER 15 15.7-33 REV. 13, SEPTEMBER 2006

LGS UFSAR Table 15.7-11 (Cont'd)

DESIGN REALISTIC BASIS BASIS ASSUMPTIONS ASSUMPTIONS

2. Dilution of liquid NA NA ingestion

3. Aquatic life consumed NA NA (qms)

III. Dose Data A. Method of Dose Calculation Section Reference 15.10 15.7-1 B. Dose Conversion Assumptions Section Reference 15.10 15.7-1 C. Peak Activity Concentrations NA NA in Containment D. Doses Table 15.7-14 Table 15.7-14 CHAPTER 15 15.7-34 REV. 13, SEPTEMBER 2006

LGS UFSAR Table 15.7-12 LIQUID RADWASTE TANK FAILURE (RWCU PHASE SEPARATOR): ACTIVITY RELEASED TO THE ENVIRONMENT DESIGN BASIS ANALYSIS ACTIVITY ISOTOPE (Ci)

I-131 1.52x10+1 I-132 2.49x10+1 I-133 1.10x10+1 I-134 1.23x10+0 I-135 5.27x10+0 TOTAL 5.76x101 CHAPTER 15 15.7-35 REV. 13, SEPTEMBER 2006

LGS UFSAR Table 15.7-13 LIQUID RADWASTE TANK FAILURE (RWCU PHASE SEPARATOR): ACTIVITY RELEASED TO THE ENVIRONMENT REALISTIC ANALYSIS ACTIVITY ISOTOPE (Ci)

I-131 2.17 I-132 3.55 I-133 1.58 I-134 0.174 I-135 0.754 TOTAL 8.23 CHAPTER 15 15.7-36 REV. 13, SEPTEMBER 2006

LGS UFSAR Table 15.7-14 LIQUID RADWASTE TANK FAILURE (RWCU PHASE SEPARATOR): RADIOLOGICAL EFFECTS DESIGN BASIS ANALYSIS WHOLE BODY THYROID DOSE (rem) DOSE (rem)

Exclusion Area Boundary 5.41x10-3 2.91 (731 meters - 2 hr dose)

Low Population Zone 7.47x10-4 4.03x10-1 (2043 meters - 2 hr(1) dose)

REALISTIC ANALYSIS WHOLE BODY THYROID DOSE (rem) DOSE (rem)

Exclusion Area Boundary 3.2x10-4 1.72x10-1 (731 meters - 2 hr dose)

Low Population Zone 5.34x10-5 2.87x10-2 (2043 meters - 2 hr(1) dose)

(1)

Duration of accident is 2 hours0.0833 days <br />0.0119 weeks <br />0.00274 months <br /> CHAPTER 15 15.7-37 REV. 13, SEPTEMBER 2006

LGS UFSAR Table 15.7-15 SEQUENCE OF EVENTS FOR FUEL HANDLING ACCIDENT TIME (min) EVENT 0 Fuel assembly is being handled by refueling equipment. The fuel assembly and fuel grapple assembly drop onto the top of the core.

0 Some of the fuel rods in both the dropped assembly and reactor core are damaged, resulting in the release of gaseous fission products to the reactor coolant and eventually to the refueling area atmosphere.

<1 The refueling area ventilation radiation monitoring system alarms to alert plant personnel.

<5 Operator actions begin.

CHAPTER 15 15.7-38 REV. 14, SEPTEMBER 2008

LGS UFSAR Table 15.7-16 FHA - RADIOLOGICAL CONSEQUENCES KEY INPUTS AND ASSUMPTIONS Key FHA Analysis Inputs and Assumptions Input/Assumption Value Reactor Power 3527 MWth Core Damage 212 fuel pins (8 x 8 rod array)*

Radial Peaking Factor 1.7 Damaged Fuel Effective Power 26.83 MWth Fuel Decay Period 24 hours1 days <br />0.143 weeks <br />0.0329 months <br /> Fuel Pool Water Iodine DF = 200 (23 feet depth)

Decontamination Factor Release Location South Vent Stack Unfiltered, zero-velocity vent release CREFAS System Initiation No Credit Taken

• This combination bounds all configurations for fuels currently implemented at LGS.

CHAPTER 15 15.7-39 REV. 16, SEPTEMBER 2012

LGS UFSAR Table 15.7-17 FHA X/Q VALUES Onsite Control Room X/Q Values for the FHA Releases Time Period /Q (sec/m3)1 0 - 2 hrs 1.26E-03 Notes:

1. X/Q values for south vent stack release to control room based on ARCON96.

Offsite X/Q (sec/m3) Values for the FHA Releases Time Period EAB /Q (sec/m3) LPZ /Q (sec/m3) 0 - 2 hrs 3.18E-04 1 1.15E-04 1 Notes:

1. X/Q values for south vent stack release to offsite dose locations based on Regulatory Guide 1.145 methodology.

CHAPTER 15 15.7-40 REV. 14, SEPTEMBER 2008

LGS UFSAR Table 15.7-18 FHA RADIOLOGICAL CONSEQUENCES ANALYSIS RESULTS Regulatory Limit Location Duration TEDE (rem) TEDE (rem)

Control Room 30 days 4.47 5 EAB Maximum, 2 hours0.0833 days <br />0.0119 weeks <br />0.00274 months <br /> 1.52 6.3 LPZ 30 days 0.548 6.3 CHAPTER 15 15.7-41 REV. 18, SEPTEMBER 2016

LGS UFSAR Table 15.7-19 Table 15.7-19 Deleted CHAPTER 15 15.7-42 REV. 16, SEPTEMBER 2012

LGS UFSAR Table 15.7-20 Table 15.7-20 Deleted CHAPTER 15 15.7-43 REV. 14, SEPTEMBER 2008

LGS UFSAR Table 15.7-21 Deleted CHAPTER 15 15.7-44 REV. 14, SEPTEMBER 2008

LGS UFSAR Table 15.7-22 POTENTIAL ENERGY OF LIGHT LOADS TO BE HANDLED OVER SPENT FUEL Approximate Combined Weight, Potential Energy, Handling Tool (ft-lb)

Plus Load Normal Maximum Load (lb) Height Height

a. New fuel bundle or 700 21,000 29,000 dummy bundle (Reactor enclosure crane relative to spent fuel pool)

b. In-Vessel storage 600 21,000 33,000 rack (Refueling platform hoist relative to core)

CHAPTER 15 15.7-45 REV. 13, SEPTEMBER 2006

LGS UFSAR 15.8 ANTICIPATED TRANSIENTS WITHOUT SCRAM 15.8.1 REQUIREMENTS The LGS plant incorporates many features and systems designed to mitigate ATWS events.

These features were originally incorporated into LGS in response to NRC concerns. They were based on extensive assessments of ATWS mitigation and are consistent with Alternate 3A (Reference 15.8-1). These features and systems, which meet the current ATWS requirements of 10CFR50.62, are described briefly below.

15.8.2 PLANT CAPABILITIES The LGS design uses diverse, redundant, and reliable scram systems. This includes the normal scram systems plus the electrically diverse alternate rod insertion system. Each of these systems is frequently tested and would insert the control rods even if multiple component failures should occur, thus making the probability of an ATWS event extremely remote.

The ATWS-RPT feature prevents reactor vessel overpressure and possible short-term fuel damage for the most limiting postulated ATWS event by reducing reactor power. Subsequent to an ATWS event for which the ARI system does not insert the control rods, the long-term shutdown of the reactor can be accomplished by either manual insertion of the control rods or injection of sodium pentaborate solution into the vessel by the SLCS.

15.8.3 EQUIPMENT DESCRIPTION This section describes the equipment and control logic added or modified exclusively for ATWS prevention or mitigation. The description covers design and functional requirements and references that contain more detailed information. The dynamic and environmental qualifications are described in Sections 3.9, 3.10, and 3.11.

15.8.3.1 Redundant Reactivity Control System The RRCS determines that a transient is under way that exceeds expected operating parameters.

After deciding that ATWS mitigation is the appropriate action, the RRCS activates ATWS prevention equipment and then ATWS mitigation equipment. The RRCS uses transient detection sensors for high vessel dome pressure and low vessel water level and the actuation logic to initiate ARI, RPT, SLCS injection, and feedwater runback.

The RRCS consists of two completely redundant divisions. Each division is initiated automatically by the ATWS detection sensors, which are independent of the RPS sensors, or manually by switches that require the same type of operator actions as manual scram.

Additional information on the RRCS is contained in Sections 7.1 and 7.6.

15.8.3.2 Alternate Rod Insertion The ARI is designed to provide a parallel path for actuation of the scram valves, which results in control rod insertion. ARI consists of the redundant valves on the scram valve pilot air headers that are actuated by the RRCS logic. The RRCS logic is designed so that successful ARI CHAPTER 15 15.8-1 REV. 17, SEPTEMBER 2014

LGS UFSAR performance will avoid subsequent ATWS mitigation action (feedwater runback and SLCS initiation).

Additional information on the ARI system is contained in Sections 7.1 and 7.6.

15.8.3.3 Recirculation Pump Trip The recirculation pump motors are tripped by the RRCS logic. The purpose of the RPT is to reduce core flow and create core voids to decrease power generation, thus limiting any power or pressure disturbance. The RPT function is single failure proof and is provided with in service test capability (except for the action of the final breakers).

Additional information on the RPT function of the RRCS is contained in Sections 7.1 and 7.6.

15.8.3.4 Feedwater Runback Upon the receipt of a high pressure signal from the RRCS and after a specified time-delay, if core power is not reduced as evidenced by the APRMs reading downscale (not low water level),

feedwater flow would be automatically limited by the RRCS, thereby reducing power and steam discharge to the suppression pool. The system provides for manual operation to be returned to the operator after a time-delay to allow an increase in feedwater flow if needed.

Additional information on the feedwater runback function of the RRCS is contained in Sections 7.1 and 7.6.

15.8.3.5 Standby Liquid Control System The SLCS is automatically actuated by the RRCS or manually initiated by an operator in the main control room upon indication of a failure to scram and in accordance with plant operating procedures. The system is designed to inject sodium pentaborate solution through a core spray sparger. Simultaneous operation of at least two of the three pumps at full capacity allows adequate margin to control the power production. The system can be periodically tested without affecting its ability to respond to an actuation signal.

Additional information on the SLCS is provided in Sections 3.9, 7.1, 7.4, and 9.3.5.

15.8.3.6 Scram Discharge Volume The SDV of the CRD system minimizes the potential for a common mode failure of the scram function. Redundant instrument volume water level sensors for the CRDs and instrument line piping ensure the availability of sufficient capacity to receive water from a full reactor scram. The design employs redundant Class 1E sensors and redundant vent and drain valves. Performance of the safety functions is assured in the event of a single active failure or the bypass of the sensors during plant operation.

Additional information on the SDV is contained in Section 4.6. Instrumentation is described in Chapter 7.

15.8.3.7 HPCI Flow Split Modification CHAPTER 15 15.8-2 REV. 17, SEPTEMBER 2014

LGS UFSAR LGS, although a BWR/4, shares some design characteristics in common with BWR/5 reactors.

The HPCI system has been split into two components. About one-half of the flow goes into the core spray sparger, similar to the high pressure core spray system of a BWR/5. The remaining portion is routed to the feedwater sparger as is typical of BWR/4s. Also, as mentioned in Section 15.8.3.5, the SLCS flow is injected via the core spray sparger, which is also typical of BWR/5s.

The flow split modification maintains proper HPCI flow mixing with the reactor coolant and avoids encountering localized fuel channel hydrodynamic effects that might cause local power peaking, if an adjacent control rod should fail to fully insert. Drawing E41-1020-G-002 shows flow rates at the ATWS condition.

The additional HPCI flow split equipment consist of cross-tie piping between the HPCI and feedwater injection lines, an MOV with associated control logic and equipment, and two flow balancing orifices as shown on drawings M-55 and M-56.

15.8.3.8 Steam Flow Induced Process Measurement Error An additional steam flow induced process measurement error (SFIE) in the Level 3 (L3) scram was evaluated by GE in Reference 15.8-2 for the ATWS event and it was concluded that it is not affected by a change in the L3 analytical limit (AL) as there is no L3 function directly credited by the ATWS events. However since there is no scram there is bypass steam flow in the annular region outside the dryer, which causes an SFIE induced error in the L2 trip.

For the limiting A TWS events, the scenario involves pressurization due to the MSIV closure. The reactor isolation leads to a recirculation pump trip (ATWS APT) very early in the transient and the trip is usually reached at about the same time the MSIVs are full closed. The ATWS APT rapidly reduces power and steaming rate and is the key feature that reduces the steaming rate to be within the capacity of the Safety I Relief Valves. The post APT power level is on the order of 50 to 55% power and by the time the level is near the Level 2 AL, the power and steaming rate is below 50%.

With the reactor steaming rate reduced to 50%, the error will be significantly reduced, and the SFIE effect with be approximately 1/4 of the effect at rated conditions. This would reduce the SFIE of 6 inches, for example, at rated power to about 1.5 inches at these conditions. Since the RCIC I HPCI initiation at this water level for ATWS is not critical to the event mitigation, this error and delay to L2 is considered insignificant.

A small delay for the RCIC I HPCI initiation would be slightly beneficial as the water level would be lower during a portion of the transient and would result in a reduced reactor power and reduced steaming rate to the suppression pool.

The long-term mitigation of these events involves controlling water level to low levels in the vessel. Again the small error at these conditions (< 2 inches) is insignificant for water level control and power generation compared to the analysis.

Non-limiting ATWS events that may initiate the Level 2 ATWS-RPT or other L2 functions for ATWS would also be affected by L3 analytical limit error. An example would be the LOFW event. This event would result in recirculation runback associated with the loss of flow and low level (e.g., level 4). This would reduce the power and steaming rate. The power would also reduce due to the reduced subcooling associated with the loss of feedwater flow. The CHAPTER 15 15.8-3 REV. 17, SEPTEMBER 2014

LGS UFSAR combined effect would reduce the error to approximately half of the condition at rated power (based on an estimated power and steaming rate reduced to 70% prior to level 2). As events that trip ATWS-RPT on low level are power and pressure reduction events, they do not challenge the ATWS acceptance criteria and therefore a low level ATWS APT delay due to L3 scram error is not significant for compliance to the ATWS acceptance criteria.

Therefore, the expected SFIE (approximately half of the error at rated conditions) will have no significant effect on the power and pressure events, and these events will remain far from limiting.

15.

8.4 REFERENCES

15.8-1 Assessment of BWR Mitigation of ATWS (NUREG-0460 Alternate 3, Volume 4 [for comment]), NEDE-24222, GE, (1979).

15.8-2 GE-Hitachi Nuclear Energy, 0000-0077-4603-R1, "BWR Owners Group Evaluation of Steam Flow Induced Error (SFIE) Impact on the L3 Setpoint Analytic Limit," October 2008.

CHAPTER 15 15.8-4 REV. 17, SEPTEMBER 2014

LGS UFSAR 15.9 PLANT NUCLEAR SAFETY OPERATIONAL ANALYSIS (A SYSTEM LEVEL/QUALITATIVE-TYPE PLANT FMEA) 15.9.1 OBJECTIVES The objectives of the nuclear safety operational analysis are listed below:

a. Essential Protective Sequences: Identify and demonstrate that the essential protection sequences needed to accommodate normal plant operations, anticipated and abnormal operational transients, and DBAs are available and adequate. Each event considered in Chapter 15 is further examined and analyzed.

Specific essential protective sequences are identified. The appropriate sequence is discussed for all BWR operating modes.

b. Design Basis Adequacy: Identify and demonstrate that the safety design basis of the various structures, systems, or components needed to satisfy the plant essential protection sequences are appropriate, available, and adequate. Each protective sequence identifies the specific structures, systems, or components performing safety or power generation functions. Interrelationships between primary systems and secondary (or auxiliary equipment) in providing these functions are shown. The individual design bases (identified throughout the UFSAR for each structure, system, or component) are brought together by the analysis in this section. In addition to the individual equipment design bases, the plant-wide design bases are examined and presented here.

c. System Level/Qualitative-Type FMEA: Identify a system level/qualitative-type FMEA of essential protective sequences to show compliance with the single active component failure or single operator error criteria. Each protective sequence entry is evaluated relative to single active component failure or single operator error criteria. Safety classification aspects and interrelationships between systems are also considered.

d. NSOA Criteria Relative to Plant Safety Analysis: Identify the systems, equipment, or components' operational conditions and requirements which are essential to satisfy the nuclear safety operational criteria utilized in the Chapter 15 plant events.

e. Technical Specification Operational Basis: Establish limiting operating conditions, testing, and surveillance bases relative to plant Technical Specification operational requirements.

15.9.2 APPROACH TO OPERATIONAL NUCLEAR SAFETY 15.9.2.1 Classification of Plant Events The specified measures of safety used in this analysis are referred to as "unacceptable consequences." They are analytically determinable limits on the consequences of different classifications of plant events. The NSOA is thus an evaluation oriented to "event consequence."

Refer to Figure 15.9-1 for a description of the systematic process by which these unacceptable results are converted so as to conform to safety requirements.

CHAPTER 15 15.9-1 REV. 17, SEPTEMBER 2014

LGS UFSAR 15.9.2.2 NSOA Development The following guidelines are used to develop the NSOA:

15.9.2.2.1 Scope and Classification Of Plant Events The scope and classification of the situations analyzed include the following:

a. Normal Operations Normal operations are those under planned conditions without significant abnormalities. Operations subsequent to an incident (transient, accident, or special event) are not considered planned operations until the procedures being followed or equipment being used are identical to those used during any one of the defined planned operations. Specific events are listed in Table 15.9-1.

b. Anticipated Operational Transients Anticipated operational transients are deviations from normal conditions that are expected to occur with moderate frequency and, as such, the design should include capability to withstand the conditions without operational impairment.

Included are incidents that result from a single operator error, a control malfunction. These and other incidents are listed in Table 15.9-2.

c. Abnormal Operational Transients Abnormal operational transients are deviations from normal conditions that occur infrequently. The design should include a capability to withstand these conditions without operational impairment. Refer to Table 15.9-3 which lists events included within this classification.

d. Design Basis Accident A DBA is an hypothesized accident, whose characteristics and consequences are utilized in the design of those systems and components pertinent to the preservation of radioactive material barriers and the restriction of radioactive material release from the barriers. The potential radiation exposures resulting from a DBA are greater than for any similar accident postulated from the same general accident assumptions. DBAs are listed in Table 15.9-4.

e. Special Events Special events are postulated to demonstrate some special capability of the plant in accordance with NRC requirements. For analyzed events within this classification, see Table 15.9-5.

15.9.2.2.2 Safety and Power Generation Safety functions include:

CHAPTER 15 15.9-2 REV. 17, SEPTEMBER 2014

LGS UFSAR

a. Accommodation of abnormal operational transients and postulated DBAs

b. Maintenance of containment integrity

c. Assurance of ECCS

d. Continuance of RCPB Safety classified aspects are related to Regulatory Guide 1.183 and 10CFR50.67 dose limits, infrequent and low probability occurrences, single active component failure criteria, worst case operating conditions and initial assumptions, automatic (less than 10 minutes) corrective action, significant unacceptable dose and environmental effects, and the involvement of other coincident (mechanistic or nonmechanistic) plant and environmental situations.

Power generation classified considerations are related to continued plant power generation operation, equipment operational matters, component availability aspects, and long-term offsite public effects.

Power generation functions include:

a. Accommodation of planned operations and anticipated operational transients.

b. Minimization of radiological releases to appropriate levels.

c. Assurance of safe and orderly reactor shutdown and/or return to power generation operation.

d. Continuance of plant equipment design conditions to ensure long-term reliable operation.

Power generation is related to 10CFR20, 10CFR50, Appendix I, moderate and high probability occurrences, nominal operating conditions and initial assumptions, allowable immediate operator manual actions, and environmental effects.

15.9.2.2.3 Frequency of Events Consideration of the frequency of the initial (or initiating) event is reasonably straightforward.

Added considerations (e.g., further failures or operator errors) influence the classification grouping. The events in this Section are grouped according to initiating frequency occurrence.

The imposition of additional failures necessitates further classification to a lower frequency category.

The introduction of single active component failure or single operator error into the examination of planned operation, anticipated operational transients, or abnormal operational transient evaluations has not been previously considered a design basis or evaluation prerequisite. It is included and provided here to demonstrate the plant's capability to accommodate this requirement.

CHAPTER 15 15.9-3 REV. 17, SEPTEMBER 2014

LGS UFSAR 15.9.2.2.4 Conservative Analysis Margins The unacceptable consequences established in this section relative to public health and safety are in strict and conservative conformance to regulatory requirements.

15.9.2.2.5 Safety Function Definition The essential protective sequences shown for an event in this section list the minimum structures and systems that are required to satisfy the single active component failure or single operator error evaluation of the event. Protective success paths other than those shown exist in some cases. Not all the events involve the same natural, environmental, or plant conditional assumptions. In Event 40, control rod-drop accident is not assumed to be associated with any SSE or OBE occurrence. Therefore, seismic safety function requirements are not considered for Event 40. Some of the safety function equipment associated with the Event 40 protective sequence are also capable of more limiting events, such as Event 42.

The primary containment may perform a safety function for some events (when uncontained radiological release would be unacceptable), but for other events, it may not be applicable (e.g.,

during refueling). The requirement to maintain the containment in postaccident recovery is needed to limit doses to less than 10CFR50.67 and Regulatory Guide 1.183 limits. After radiological sources are depleted with time, the further use of primary containment is unnecessary. Thus, the "time domain" and "need for" aspects of a function should be, and are, taken into account when evaluating events.

The operation of ESF equipment for normal operational events should not be misunderstood to mean that ESF equipment requirements apply to this event category. Also, the interpretation of the use of ESF single active component failure capable systems for anticipated operational transient protective sequences should not imply that these equipment requirements (seismic, redundancy, diversity, testable, IEEE, etc.) are appropriately required for anticipated operational transients.

15.9.2.2.6 Envelope and Actual Event Analyses Study of the actual plant occurrences, their frequency, and their actual impact are reflected in their categorization in this section. This places the plant safety evaluations into a better perspective by focusing attention on the envelope analysis.

15.9.2.2.7 Analysis Consistency Figure 15.9-2 illustrates three inconsistencies. Panel A shows the possible inconsistency resulting from operational requirements being placed on separated levels of protection for one event. If the second and sixth levels of protection are important enough to warrant operational requirements, then so are the third, fourth, and fifth levels. Panel B shows the possible inconsistency resulting from operational requirements being arbitrarily placed on some action thought to be important to safety. In the case shown, scram represents different protection levels for two similar events in one category; if the fourth level of protection for Event B is important enough to warrant an operational requirement, then so is the fourth level for Event A.

Thus, to simply place operational requirements on all equipment needed for some action (scram, isolation, etc.) could be inconsistent and unreasonable if different protection levels are CHAPTER 15 15.9-4 REV. 17, SEPTEMBER 2014

LGS UFSAR represented. Panel C shows the possible inconsistency resulting from operational requirements being placed on some arbitrary level of protection for any and all postulated events. Here, the inconsistency is not recognizing and accounting for different event categories based upon cause or expected frequency of occurrence.

Inconsistencies of the types illustrated in Figure 15.9-2 are avoided in the NSOA by directing the analysis to event consequences oriented aspects. Analytical inconsistencies are avoided by treating all the events of a category under the same set of functional rules, by applying another set of functional rules to another category, and by having a consistent set of rules between categories. Thus, it is valid to compare the results of the analyses of the events in any one category and invalid to compare events of a different categories (with different rules). An example of this is the different rules (limits, assumptions, etc.) of accidents compared to anticipated transients.

15.9.2.3 Comprehensiveness of the Analysis The method of analysis must be sufficiently comprehensive so that all plant hardware and the full range of plant operating conditions are considered. The tendency to be preoccupied with "worst cases" (those that appear to give the most severe consequences) is recognized; however, the protection sequences essential to lesser cases may be different (more or less restrictive) from the worst case sequence. To assure that operational and design basis requirements are defined and appropriate for all equipment essential to attaining acceptable consequences, all essential protection sequences must be identified for each of the plant safety events examined. Only in this way is a comprehensive level of safety attained. Thus, the NSOA is also protection sequence oriented.

15.9.2.4 Systematic Approach of the Analysis In summary, the systematic method utilized in this analysis contributes to both the consistency and comprehensiveness of the analysis mentioned above. The desired characteristics representative of a systematic approach to selecting BWR operational requirements are as follows:

a. Specify measures of safety/unacceptable consequences.

b. Consider all normal operations.

c. Systematic event selection.

d. Common treatment analysis of all events of any one type.

e. Systematic identification of plant actions and systems essential to avoid unacceptable consequences.

f. Emergence of operational requirements and limits from system analysis.

Figure 15.9-1 illustrates the systematic process by which the operational and design basis nuclear safety requirements and technical specifications are derived. The process involves the evaluation of carefully selected plant events relative to the unacceptable consequences (specified measures CHAPTER 15 15.9-5 REV. 17, SEPTEMBER 2014

LGS UFSAR of safety). Those limits, actions, systems, and components found to be essential to achieving acceptable consequences are the subjects of operational requirements.

15.9.2.5 Relationship of Nuclear Safety Operational Analysis to Safety Analyses of Chapter 15 One of the main objectives of the operational analysis is to identify all essential protection sequences and establish the detailed equipment conditions essential to satisfy the nuclear safety operational criteria. The spectrum of events examined in Chapter 15 represent a complete set of plant safety considerations. The main objective of the earlier analyses of Chapter 15 was to provide detailed worst case (limiting or envelope) analyses of plant events. The worst cases are correspondingly analyzed and treated in this section. However, here the frequency of occurrence, unacceptable consequences, assumption categories, etc are taken into account.

Tables 15.9-1 through 15.9-5 provide cross-correlation between the NSOA event, its protection sequence diagram, and its safety evaluation in Chapter 15.

15.9.2.6 Relationship Between NSOA and Operational Requirements, Technical Specifications, Design Bases, and Single Active Component Failure Aspects By definition, an "operational requirement" is a requirement or restriction (limit) on either the value of a plant variable or the operability condition associated with a plant system. Such requirements must be observed during all modes of plant operation (not just at full power) to assure that the plant is operated safely to avoid unacceptable results. There are two kinds of operational requirements for plant hardware:

a. Limiting condition for operation: the required condition for a system while the reactor is operating in a specified state.

b. Surveillance requirements: the nature and frequency of tests required to ensure that the system is capable of performing its essential functions.

Operational requirements are systematically selected for one of two basic reasons:

a. To ensure that unacceptable consequences are mitigated following specified plant events by examining and challenging the system design.

b. To ensure the consequences of a transient or accident are acceptable with the existence of a single active component failure or single operator error.

The individual structures and systems that perform a safety function are required to do so under design basis conditions including environmental considerations and under single active component failure assumptions. The NSOA confirms the previous examination of the individual equipment (Section 15.0.3) requirement conformance analyses.

15.9.2.7 Unacceptable Consequences Criteria Tables 15.9-6 through 15.9-10 identify the unacceptable consequences associated with different event categories. In order to prevent or mitigate them, they are recognized as the major bases for identifying system operational requirements as well as the bases for all other safety analysis criteria throughout the UFSAR.

CHAPTER 15 15.9-6 REV. 17, SEPTEMBER 2014

LGS UFSAR 15.9.2.8 General Nuclear Safety Operational Criteria The following general nuclear safety operational criteria are used to select operational requirements:

Applicability Nuclear Safety Operational Criteria Planned operation The Plant shall be operated so as to anticipated, abnormal avoid unacceptable consequences.

operational transients, DBAs, additional special plant capability events Anticipated and abnormal The plant shall be operated such that no single active operational transients and component failure can prevent the safety actions DBA. essential to avoid the unacceptable consequences associated with anticipated or abnormal operational transients or DBAs. However, this requirement is not applicable during structure, system, or component repair if the availability of the safety action is maintained either by restricting the allowable repair time or by more frequent testing of a redundant structure, system, or component.

The unacceptable consequences associated with the different categories of plant operation and events are dictated by:

a. Probability of occurrence.

b. Allowable limits (per the probability) related to radiological, structural, environmental, etc., aspects.

c. Coincidence of other related or unrelated disturbances.

d. Time domain of event and consequences consideration.

15.9.3 METHOD OF ANALYSIS 15.9.3.1 General Approach The NSOA is performed on the plant as designed. The end products of the analysis are the nuclear safety operational requirements and the restrictions on plant hardware and its operation that must be observed both to satisfy the nuclear safety operational criteria and to show compliance of the plant safety and power generation systems with plant wide requirements.

Figure 15.9-1 shows the process used in the analysis. The following inputs are required for the analysis of specific plant events:

a. Unacceptable consequences criteria (Section 15.9.2.7).

CHAPTER 15 15.9-7 REV. 17, SEPTEMBER 2014

LGS UFSAR

b. General nuclear safety operational criteria (Section 15.9.2.8).

c. Definition of BWR operating states (Section 15.9.3.2).

d. Selection of events for analysis (Section 15.9.3.3).

e. Guidelines for event analysis (Section 15.9.3.5).

With the above information, each selected event can be evaluated systematically to determine the actions, systems, and limits essential to avoid unacceptable consequences. The essential plant components and limits so identified are then considered to be in agreement with, and subject to, nuclear operational design basis requirements and Technical Specification restrictions.

15.9.3.2 BWR Operating States The four BWR operating states in which the reactor can exist are defined in Section 15.9.6.2.4 and summarized in Table 15.9-11.

The main objective in selecting operating states is to divide the BWR operating spectrum into sets of initial conditions to facilitate consideration of various events in each state.

Each operating state includes a wide spectrum of values for important plant parameters. Within each state, these parameters are considered over their entire range to determine the limits on their values necessary to satisfy the nuclear safety operational criteria. Such limitations are presented in the sections of the UFSAR that describe the systems associated with the parameter limit. The plant parameters to be considered in this manner include the following:

a. Reactor coolant temperature

b. Reactor vessel water level

c. Reactor vessel pressure

d. Reactor vessel water quality

e. Reactor coolant forced circulation flow rate

f. Reactor power level (thermal and neutron flux)

g. Core neutron flux distribution

h. Feedwater temperature

i. Primary containment temperature and pressure

j. Suppression pool water temperature and level

k. Control rod worth 15.9.3.3 Selection of Events for Analysis CHAPTER 15 15.9-8 REV. 17, SEPTEMBER 2014

LGS UFSAR 15.9.3.3.1 Normal Operations Operations subsequent to an incident (transient, accident, or additional plant capability event) are not considered planned operations until the actions taken or equipment used in the plant are identical to those that would be used had the incident not occurred. As defined, planned operations can be considered in the following chronological sequence: refueling outage, achieving criticality, heatup, power operation, achieving shutdown, cooldown, refueling outage.

For the analyses in Section 15.9, the normal operations events are defined as follows:

a. Refueling Outage: Includes all the planned operations associated with a normal refueling outage except those tests in which the reactor is taken critical and returned to the shutdown condition. The following planned operations are included in a refueling outage:

1. Planned, physical movement of core components (fuel, control rods, etc.)

2. Refueling test operations (except criticality and shutdown margin tests)

3. Planned maintenance

4. Required inspection

b. Achieving Criticality: Includes all plant actions normally accomplished in bringing the plant from a condition in which all control rods are fully inserted to a condition in which nuclear criticality is achieved and maintained.

c. Heatup: Begins when achieving criticality ends and includes all plant actions normally accomplished in approaching nuclear system rated temperature and pressure by using nuclear power (reactor critical). Heatup extends through warmup and synchronization of the main turbine-generator.

d. Power Operation: Begins when heatup ends and includes continued plant operation at power levels in excess of heatup power.

e. Achieving Shutdown: Begins when the main generator is unloaded and includes all plant actions normally accomplished in achieving nuclear shutdown (more than one rod subcritical) following power operation.

f. Cooldown: Begins when achieving nuclear shutdown ends and includes all plant actions normal to the continued removal of decay heat and the reduction of reactor temperature and pressure.

The exact point at which some of the planned operations end and others begin cannot be precisely determined. It will be shown later that such precision is not required, because the protection requirements are adequately defined in passing from one state to the next.

Dependence of several planned operations on the one rod subcritical condition provides an exact point on either side of which protection (especially scram) requirements differ. Thus, where a CHAPTER 15 15.9-9 REV. 17, SEPTEMBER 2014

LGS UFSAR precise boundary between planned operations is needed, the definitions provide the needed precision.

Together, BWR operating states and planned operations define the full spectrum of conditions from which transients, accidents, and special events are initiated. The BWR operating states define only the physical condition (pressure, temperature, etc.) of the reactor; the planned operations define the condition of the plant. The separation of physical conditions from the operation being performed is deliberate and facilitates careful consideration of all possible initial conditions from which incidents may occur.

15.9.3.3.2 Anticipated Operational Transients To select anticipated operational transients, eight nuclear system parameter variations are considered as potential initiating causes of threats to the fuel and the RCPB. The parameter variations are as follows:

a. Reactor coolant pressure increase

b. Reactor coolant (moderator) temperature decrease

c. Control rod withdrawal

d. Reactor coolant inventory decrease

e. Reactor coolant flow decrease

f. Reactor coolant flow increase

g. Reactor coolant temperature increase

h. Reactor coolant inventory increase These parameter variations, if uncontrolled, could result in damage to the reactor fuel or RCPB or both. A nuclear system pressure increase threatens to rupture the RCPB from internal pressure. A pressure increase also collapses voids in the moderator, causing an insertion of positive reactivity that threatens fuel damage as a result of overheating. A reactor coolant temperature decrease results in an insertion of positive reactivity as density increases. This could lead to fuel overheating. Positive reactivity insertions are possible from causes other than nuclear system pressure or moderator temperature changes; such reactivity insertions threaten fuel damage caused by overheating. Both reactor coolant inventory decrease and a reduction in coolant flow through the core threaten the integrity of the fuel. An increase in coolant flow through the core reduces the void content of the moderator and results in an insertion of positive reactivity. Core coolant temperature increase threatens the integrity of the fuel; such a variation could be the result of a heat exchanger malfunction during operation in the shutdown cooling mode. An excess of coolant inventory could be the result of malfunctioning water level control equipment; such a malfunction can result in a turbine trip, which causes an expected increase in nuclear system pressure and power.

Anticipated operational transients are defined as transients resulting from an single active component failure or single operator error that can be reasonably expected (moderate probability CHAPTER 15 15.9-10 REV. 17, SEPTEMBER 2014

LGS UFSAR of occurrence, once per day to once in 20 years) during any mode of plant operation. Examples of single operational failures or operator errors in this range of probability are:

a. Opening or closing any single valve (a check valve is not assumed to close against normal flow).

b. Starting or stopping any single component.

c. Malfunction or maloperation of any single control device.

d. Any single electrical failure.

e. Any single operator error.

An operator error is defined as an active deviation from nuclear plant standard operating practices. A single operator error is the set of actions that is a direct consequence of a single reasonably expected erroneous decision. The set of actions is limited as follows:

a. Those that could be performed by only one person.

b. Those that would have constituted a correct procedure had the initial decision been correct.

c. Those that are subsequent to the initial operator error and that affect the designed operation of the plant, but are not necessarily directly related to the operator error.

Examples of single operator errors are as follows:

a. An increase in power above the established flow control power limits by control rod withdrawal in the specified sequences while observing all normal core power distribution related fuel thermal limits.

b. The selection and complete withdrawal of a single control rod out-of-sequence.

c. An incorrect calibration of an APRM.

d. Manual isolation of the main steam lines caused by operator misinterpretation of an alarm or indication.

The various types of single active component failure or single operator error are applied to various plant systems, with consideration for a variety of plant conditions, to discover events directly resulting in an undesired parameter variation. Once discovered, each event is evaluated for the threat it poses to the integrity of the radioactive material barriers.

15.9.3.3.3 Abnormal Operational Transients To select abnormal operational transients, eight nuclear system parameter variations are considered as potential initiating causes of gross corewide fuel failures and threats to the RCPB.

The parameter variations are as follows:

CHAPTER 15 15.9-11 REV. 17, SEPTEMBER 2014

LGS UFSAR

a. Reactor coolant pressure increase

b. Reactor coolant (moderator) temperature decrease

c. Control rod withdrawal

d. Reactor coolant inventory decrease

e. Reactor coolant flow decrease

f. Reactor coolant flow increase

g. Reactor coolant temperature increase

h. Reactor coolant inventory increase The eight parameter variations listed above include all effects within the nuclear system caused by abnormal operational transients that threaten gross corewide reactor fuel integrity, or seriously affect the reactor coolant pressure boundary. Variation of any one parameter may cause a change in another listed parameter; however, for analysis purposes, threats to barrier integrity are evaluated by groups according to the parameter variation originating the threat.

Abnormal operational transients are defined as incidents resulting from single or multiple equipment failures and/or single or multiple operator errors that are not reasonably expected (less than one event in 20 years to one in 100 years) during any mode of plant operation. Examples of single or multiple operational failures and/or single or multiple operator errors are:

a. Failure of major power generation equipment components.

b. Multiple electrical failures.

c. Multiple operator errors.

d. Combinations of equipment failure and an operator error.

Operator error is defined as an active deviation from nuclear plant standard operating practices.

A multiple operator error is the set of actions that is a direct consequence of several unexpected erroneous decisions.

An example of multiple operator errors is inadvertent loading of a fuel assembly in an improper position and operating with the fuel assembly in an improper position.

The various types of single errors and/or single malfunctions are applied to various plant systems, with consideration for a variety of plant conditions, to discover events directly resulting in an undesired parameter variation. Once discovered, each event is evaluated for the threat it poses to the integrity of the various radioactive material barriers.

CHAPTER 15 15.9-12 REV. 17, SEPTEMBER 2014

LGS UFSAR 15.9.3.3.4 Design Basis Accidents Accidents are defined as hypothesized events that affect the radioactive material barriers and are not expected during plant operations. These are plant events, equipment failures, and combinations of initial conditions that are of extremely low probability (once in 100 years to once in 10,000 years). The postulated accident types considered are as follows:

a. Mechanical failure of a single component leading to the release of radioactive material from one or more barriers. The components referred to here are not those that act as radioactive material barriers. An example of mechanical failure is the breakage of the coupling between a CRD and the control rod.

b. Arbitrary rupture of any single pipe up to, and including, complete severance of the largest pipe in the RCPB. This kind of accident is considered only under conditions in which the nuclear system is pressurized.

For purposes of analysis, accidents are categorized as those events that result in releasing radioactive material (Tables 15.9-4 and 15.9-5):

a. From the fuel with the RCPB and reactor enclosure initially intact (Event 40).

b. Directly to the primary containment (Event 42).

c. Directly to the reactor, or turbine enclosures, with the primary containment initially intact (Events 40, 43, 44, 45, 50).

d. Directly to the reactor enclosure with the primary containment not intact (Events 41, 50).

e. Directly to the spent fuel-containing facilities (Events 41, 50).

f. Directly to the turbine enclosure (Events 46, 47).

g. Directly to the environs (Events 48, 49).

The effects of various accident types are investigated, with consideration for the full spectrum of plant conditions, to examine events that result in the release of radioactive material.

15.9.3.3.5 Special Events A number of additional events are evaluated to demonstrate plant capabilities relative to special arbitrary nuclear safety criteria. These special events involve extremely low probability situations.

As an example, the adequacy of the redundant reactivity control system is demonstrated by evaluating the special event: "reactor shutdown without control rods." Another similar example, the capability to perform a safe shutdown from outside the main control room, is demonstrated by evaluating the special event: "reactor shutdown from outside the main control room."

CHAPTER 15 15.9-13 REV. 17, SEPTEMBER 2014

LGS UFSAR 15.9.3.4 Applicability of Events to Operating States The first step in performing an operational analysis for a given incident (transient, accident, or special event) is to determine in which operating states the incident can occur. An incident is considered applicable within an operating state if the incident can be initiated from the physical conditions that characterize the operating state. Applicability of the "normal operations" to the operating states follows from the definitions of planned operations. A planned operation is considered applicable within an operating state if the planned operation can be conducted when the reactor exists under the physical conditions defining the operating state.

15.9.3.5 Guidelines for Event Analysis Functional guidelines followed in performing single active component failure, operational, and design basis analyses for the various plant events are listed below:

a. An action, system, or limit shall be considered essential only if it is essential to avoid an unacceptable result or satisfy the nuclear safety operational criteria.

b. The full range of initial conditions (as defined in (c) below) shall be considered for each event analyzed so that all essential protection sequences are identified.

Consideration is not limited to worst cases, because lesser cases sometimes may require more restrictive actions or systems different from those of the worst cases.

c. The initial conditions for transients, accidents, and special events shall be limited to conditions that would exist during planned operations in the applicable operating state.

d. For normal operations, consideration shall be made only for actions, limits, and systems essential to avoid the unacceptable consequences during operation in that state (as opposed to transients, accidents, and special events that are followed through to completion). Normal operations are treated differently from other events, because the transfer from one state to another during planned operations is deliberate. For events other than normal operations, the transfer from one state to another may be unavoidable.

e. Limits shall be derived only for those essential parameters that are continuously available for monitoring. Parameter limits associated with the required performance of an essential system are considered to be included in the requirement for the operability of the system. Limits on frequently monitored process parameters are called "envelope limits," and limits on parameters associated with the operability of a safety system are called "operability limits."

Systems associated with the control of the envelope parameters are considered nonessential if it is possible to place the plant in a safe condition without using the system in question.

f. For transients, accidents, and special events, consideration shall be made for the entire duration of the event and aftermath until some planned operation is resumed. Normal operation is considered resumed when the procedures being followed or equipment being used are identical to those used during any one of the CHAPTER 15 15.9-14 REV. 17, SEPTEMBER 2014

LGS UFSAR defined planned operations. Where extended core cooling is an immediate integral part of the event, it will be included in the protection sequence. Where it may be an eventual part of the event, it will not be directly added but can be implied to be available.

g. Credit for operator action shall be taken on a case-by- case basis depending on the conditions that would exist at the time operator action would be required.

Because transients, accidents, and special events are considered through the entire duration of the event until normal operation is resumed, manual operation of certain systems is sometimes required following the more rapid or automatic portions of the event. Credit for operator action is taken only when the operator can reasonably be expected to accomplish the required action under the existing conditions.

h. For transients, accidents, and special events, only those actions, limits, and systems shall be considered essential for which there arises a unique requirement as a result of the event. For instance, if a system that was operating prior to the event (during planned operation) is to be employed in the same manner following the event, and if the event did not affect the operation of the system, then the system would not appear on the protection sequence diagram.

i. The operational analyses shall identify all the support or auxiliary systems essential to the functioning of the front-line safety systems. Safety system auxiliaries whose failure results in safe failure of the front line safety systems shall be considered nonessential.

j. A system or action that plays a unique role in the response to a transient, accident, or special event shall be considered essential unless (1) the effects of the system or action are not included in the detailed analysis of the event or (2) unless failure of the system or action results in an overall event probability less frequent than that within which the initiating event is categorized.

15.9.3.6 Steps in an Operational Analysis All information needed to perform an operational analysis for each plant event has been presented (Figure 15.9-1). The procedure followed in performing an operational analysis for a given event (selected according to the event selection criteria) is as follows:

a. Determine the BWR operating states in which the event is applicable.

b. Identify all the essential protection sequences (safety actions and front-line safety systems) for the event in each applicable operating state.

c. Identify all the auxiliary systems essential to the functioning of the front-line safety systems.

The preceding three steps are performed in Section 15.9.6. To derive the operational requirements and Technical Specifications for the individual components of a system included in any essential protection sequence, the following steps are taken:

CHAPTER 15 15.9-15 REV. 17, SEPTEMBER 2014

LGS UFSAR

a. Identify all the essential actions within the system (intrasystem actions) necessary for the system to function to the degree necessary to avoid the unacceptable consequences.

b. Identify the minimum hardware conditions necessary for the system to accomplish the minimum intrasystem actions.

c. If the single failure criterion applies, identify the additional hardware conditions necessary to achieve the plant safety actions (scram, pressure relief, isolation, cooling, etc.) in spite of single failures. This step gives the nuclear safety operational requirements for the plant components so identified.

d. Identify surveillance requirements and allowable out-of- service times for the essential plant hardware (Section 15.9.5).

e. Simplify the operational requirements determined in steps (c) and (d), so that Technical Specifications may be obtained that encompass the true operational requirements and are easily used by plant operations and management personnel.

15.9.4 DISPLAY OF OPERATIONAL ANALYSIS RESULTS 15.9.4.1 General To fully identify and establish the requirements, restrictions, and limitations that must be observed during plant operation, plant systems and components must be related to the needs for their actions in satisfying the nuclear safety operational criteria. This section displays these relationships in a series of block diagrams.

Tables 15.9-1 through 15.9-5 and Table 15.9-11 indicate in which operating states each event is applicable. For each event, a block diagram is presented showing the conditions and systems required to achieve each essential safety action. The block diagrams show only those systems necessary to provide the safety actions so that the nuclear safety operational and design basis criteria are satisfied. The total plant capability to provide a safety action generally is not shown; only the minimum capability essential to satisfy the operational criteria is shown. Only enough protective equipment is cited in the diagram to provide the necessary action. Many events can utilize many more paths to success than are shown. Operational analyses involve the minimum equipment needed to prevent or avert an unacceptable consequence. Thus, the diagrams depict all essential protection sequences for each event with the least amount of protective equipment needed. Once all of the these protection sequences are identified in block diagram form, system requirements are derived by considering all events in which the particular system is employed.

The analysis considers the following conceptual aspects:

a. The BWR operating state.

b. Types of operations or events that are possible within the operating state.

c. Relationships of certain safety actions to the unacceptable consequences and to specific types of operations and events.

CHAPTER 15 15.9-16 REV. 17, SEPTEMBER 2014

LGS UFSAR

d. Relationships of certain systems to safety actions, and to specific types of operations and events.

e. Supporting or auxiliary systems essential to the operation of the front-line safety systems.

f. Functional redundancy. (The single failure criterion applied at the safety action level. This is, in effect, a qualitative system level, FMEA-type analysis.)

Each block in the sequence diagrams represents a finding of essentiality for the safety action, system, or limit under consideration. Essentiality in this context means that the safety action, system, or limit is needed to satisfy the nuclear safety operational criteria. Essentiality is determined through an analysis in which the safety action, system, or limit being considered is completely disregarded in the analyses of the applicable operations or events. If the nuclear safety operational criteria are satisfied without the safety action, system, or limit, then the safety action, system, or limit is not essential, and no operational nuclear safety requirement would be indicated. When disregarding a safety action, system, or limit results in violating one or more nuclear safety operational criteria, the safety action, system, or limit is considered essential, and the resulting operational nuclear safety requirements can be related to specific criteria and unacceptable consequences.

15.9.4.2 Protection Sequence and Safety System Auxiliary Diagrams Block diagrams illustrate essential protection sequences for each event requiring unique safety actions. These protection sequence diagrams show only the required front-line safety systems.

The format and conventions used for these diagrams are shown in Figure 15.9-4.

The auxiliary systems essential to the correct functioning of the front-line safety systems are shown on safety system auxiliary diagrams. The format used for these diagrams is shown in Figure 15.9-5. The diagram indicates that auxiliary systems A, B, and C are required for proper operation of front-line safety system X.

With these three types of diagrams, it is possible to determine for each system the detailed functional requirements and conditions to be observed regarding system hardware in each operating state. The detailed conditions to be observed regarding system hardware include such nuclear safety operational requirements as test frequencies and the number of components that must be operable.

15.9.5 BASES FOR TECHNICAL SPECIFICATIONS 15.9.5.1 Surveillance Test Requirements After the nuclear safety systems and engineered safeguards have been identified by applying the nuclear safety operational criteria, surveillance requirements are established for the safety systems. The purpose of surveillance requirements is to assure, at appropriate intervals, that a failure or failures have not occurred in a safety system while that system is in the standby mode.

The appropriate surveillance interval is determined by consideration of the effect of system unavailability on plant safety and the effect of testing on plant safety.

15.9.5.2 Limiting Condition for Operation CHAPTER 15 15.9-17 REV. 17, SEPTEMBER 2014

LGS UFSAR Required operating conditions for safety systems, including number of operable channels, minimum or maximum setpoints, and other performance factors are established. If a safety system is found to be in a Limiting Condition for Operation, specified corrective action must be taken.

15.9.5.3 Maximum Allowable Out-of-Service Time When a safety system does not meet the specified Limiting Condition for Operation, the system should be repaired, retested, and returned to service as quickly as possible consistent with good maintenance practice. A maximum allowable out-of-service time is specified, after which time the specified corrective action must be taken to place the plant in a safer mode of operation. If the nature of the failed condition is such that it is apparent that repair will require longer than the allowable out-of-service time, the specified action should be taken immediately. The maximum allowable out-of-service time is determined by consideration of the effect of the out-of-service condition on plant safety and the effect of the specified corrective action on plant safety. As a general rule, the reactor should not be scrammed for an out-of-service condition, and the maximum allowable out-of-service time should be at least 12 hours0.5 days <br />0.0714 weeks <br />0.0164 months <br /> if the specified corrective action is plant shutdown. Other considerations include the need for a reasonable time for repair based on experienced or projected mean time to repair and resources involved in taking the specified corrective action.

15.9.6 OPERATIONAL ANALYSES Results of the operational analyses are discussed in the following paragraphs and displayed in Figures 15.9-7 through 15.9-12 and Tables 15.9-1 through 15.9-5.

15.9.6.1 Safety System Auxiliaries Figures 15.9-7 and 15.9-8 show the safety system auxiliaries essential to the functioning of each front-line safety system.

15.9.6.2 Normal Operations 15.9.6.2.1 General Requirements for the normal or planned operations normally involve limits (L) on certain key process variables and restrictions (R) on certain plant equipment. The control block diagrams for each operating state (Figures 15.9-9 through 15.9-12) show only those controls necessary to avoid unacceptable safety consequences 1-1 through 1-4 of Table 15.9-6.

Following is a description of the planned operations (Events 1 through 6) as they pertain to each of the four operating states. The description of each operating state contains a definition of that state, a list of the planned operations that apply to that state, and a list of the safety actions that are required to avoid the unacceptable safety consequences.

15.9.6.2.2 Event Definitions

a. Event 1 - Refueling Outage CHAPTER 15 15.9-18 REV. 17, SEPTEMBER 2014

LGS UFSAR Refueling outage includes all the planned operations associated with a normal refueling outage except those tests in which the reactor is made critical and returned to the shutdown condition. The following planned operations are included in refueling outage:

1. Planned, physical movement of core components (fuel, control rods, etc.)

2. Refueling test operations (except criticality and shutdown margin tests)

3. Planned maintenance

4. Required inspection

b. Event 2 - Achieving Criticality Achieving criticality includes all the plant actions normally accomplished in bringing the plant from a condition in which all control rods are fully inserted to a condition in which nuclear criticality is achieved and maintained.

c. Event 3 - Heatup Heatup begins where achieving criticality ends and includes all plant actions normally accomplished in approaching nuclear system-rated temperature and pressure by using nuclear power (reactor critical). Heatup extends through warmup and synchronization of the main turbine-generator.

d. Event 4 - Power Operation Power operation begins where heatup ends and includes plant operation at power levels in excess of heatup power and at steady-state operation. It also includes plant maneuvers such as:

1. Electrical load reduction and recoveries

2. Electrical grid frequency control adjustment

3. Control rod movements

4. Power generation surveillance testing involving:

(a) Turbine stop valve closing (b) Turbine control valve adjustments (c) MSIV exercising

e. Event 5 - Achieving Shutdown CHAPTER 15 15.9-19 REV. 17, SEPTEMBER 2014

LGS UFSAR Achieving shutdown begins where the main generator is unloaded and includes all plant actions normally accomplished in achieving nuclear shutdown (more than one rod subcritical) following power operation.

f. Event 6 - Reactor Cooldown Cooldown begins where achieving shutdown ends and includes all plant actions normal to the continued removal of decay heat and the reduction of nuclear system temperature and pressure.

15.9.6.2.3 Required Safety Actions/Related Unacceptable Consequences The following paragraphs describe the safety actions for planned operations. Each description includes a selection of the operating states that apply to the safety action, the plant system affected by limits or restrictions, and the unacceptable consequence that is avoided. The four operating states are defined in Table 15.9-11. The unacceptable consequences criteria are tabulated in Table 15.9-6.

15.9.6.2.3.1 Radioactive Material Release Control Radioactive materials may be released to the environs in any operating state; therefore, radioactive material release control is required in all operating states. Because of the significance of preventing excessive release of radioactive materials to the environs, this is the only safety action for which monitoring systems are explicitly shown. Limits are expressed on the gaseous, liquid, and solid radwaste systems, so that the planned releases of radioactive materials comply with the limits given in 10CFR20, 10CFR50, and 10CFR71 (related unacceptable safety result 1-1).

15.9.6.2.3.2 Core Coolant Flow Rate Control In State D, when above approximately 10% rated power, the core coolant flow rate must be maintained above certain minimums (i.e., limited) to maintain the integrity of the fuel cladding (1-2) and ensure the validity of the plant safety analysis (1-4).

15.9.6.2.3.3 Core Power Level Control The plant safety analyses of accidental positive reactivity additions have assumed as an initial condition that the neutron source level is above a specified minimum. Because a significant positive reactivity addition can only occur when the reactor is less than one rod subcritical, the assumed minimum source level need be observed only in States B and D. The minimum source level assumed in the analyses has been related to the counts/sec readings on the SRMs; thus, this minimum power level limit on the fuel is expressed as a required SRM count level. Observing the limit ensures the validity of the plant safety analysis (1-4). The count rate limit is conservatively applied to the ALL RODS INSERTED condition prior to initial control rod withdrawal. Any expected ALL RODS INSERTED count rate within the SRM monitoring range will fully satisfy the safety analysis criteria for noncritical initiating conditions. Maximum core power limits are also expressed for operating States B and D to maintain fuel integrity (1-2) and remain below the maximum power levels assumed in the plant safety analysis (1-4).

15.9.6.2.3.4 Core Neutron Flux Distribution Control CHAPTER 15 15.9-20 REV. 17, SEPTEMBER 2014

LGS UFSAR Core neutron flux distribution must be limited in State D; otherwise, core power peaking could result in fuel failure (1-2). Additional limits are expressed in this state, because the core neutron flux distribution must be maintained within the envelope of conditions considered by plant safety analysis (1-4).

15.9.6.2.3.5 Reactor Vessel Water Level Control In any operating state, the reactor vessel water level could, unless controlled, drop to a level that will not provide adequate core cooling; therefore, reactor vessel water level control applies to all operating states. Observation of the RPV water level limits protects against fuel failure (1-2) and ensures the validity of the plant safety analysis (1-4).

15.9.6.2.3.6 Nuclear System Pressure Control System pressure control is not needed in States A and B, because vessel pressure cannot be increased above atmospheric pressure. In State C, a limit is expressed on the reactor vessel to ensure that it is not hydrostatically tested until the temperature is above the NDTT plus 60F; this prevents excessive stress (1-3). Also, in States C and D a limit is expressed on the RHR system to ensure that it is not operated in the shutdown cooling mode when the RPV pressure is greater than the RHR shutdown cooling interlock pressure; this prevents excessive stress (1-3). In States C and D, a limit on the RPV pressure is necessitated by the plant safety analysis (1-4).

15.9.6.2.3.7 Nuclear System Temperature Control In operating States C and D, a limit is expressed on the reactor vessel to prevent the reactor vessel head bolting studs from being in tension when the temperature is less than the minimum bolt-up temperature to avoid excessive stress (1-3) on the reactor vessel flange. This limit does not apply in States A and B, because the head will not be bolted in place during criticality tests or refueling. In all operating states, a limit is expressed on the reactor vessel to prevent an excessive rate of change of the reactor vessel temperature to avoid excessive stress (1-3). In States C and D, where it is planned operation to use the feedwater system, a limit is placed on the reactor fuel, so that the feedwater temperature is maintained within the envelope of conditions considered by the plant safety analysis (1-4). For State D, a limit is placed on the temperature difference between the recirculation system and the reactor vessel to prevent the starting of the recirculation pumps when a large differential temperature exists. This operating restriction and limit prevents excessive stress in the reactor vessel (1-3).

15.9.6.2.3.8 Nuclear System Water Quality Control In all operating states, water of improper chemical quality could produce excessive stress as a result of chemical corrosion (1-3). Therefore, a limit is placed on reactor coolant chemical quality in all operating states. For all operating states where the nuclear system can be pressurized (States C and D), an additional limit on reactor coolant activity ensures the validity of the analysis of the main steam line break accident (1-4).

15.9.6.2.3.9 Nuclear System Leakage Control Because excessive nuclear system leakage could occur only while the reactor vessel is pressurized, limits are applied only to the reactor vessel in States C and D. Observing these limits CHAPTER 15 15.9-21 REV. 17, SEPTEMBER 2014

LGS UFSAR prevents vessel damage due to excessive stress (1-3) and ensures the validity of the plant safety analysis (1-4).

15.9.6.2.3.10 Core Reactivity Control In State A, during refueling outages, a limit is imposed on core loading (fuel) to ensure that core reactivity is maintained within the envelope of conditions considered by the plant safety analysis (1-4). In all states, limits are imposed on the control rod drive system to ensure adequate control of core reactivity, so that core reactivity remains within the envelope of conditions considered by the plant safety analysis (1-4).

15.9.6.2.3.11 Control Rod Worth Control Any time the reactor is not shut down and is generating less than the low power setpoint (State D), a limit is imposed on the control rod pattern to ensure that control rod worth is maintained within the envelope of conditions considered by the analysis of the control rod-drop accident (1-4).

15.9.6.2.3.12 Refueling Restriction By definition, planned operation Event 1 (refueling outage) applies only to State A. Observing the restrictions on the reactor fuel and on the operation of the CRD system within the specified limit maintains plant conditions within the envelope considered by the plant safety analysis (1-4).

15.9.6.2.3.13 Primary Containment Pressure and Temperature Control In States C and D, limits are imposed on the primary containment pressure and suppression pool temperature to maintain pressure and temperature within the envelope considered by plant safety analysis (1-4). These limits ensure an environment in which instruments and equipment can operate correctly within the drywell. Limits on the pressure-suppression pool apply to the water temperature and water level to ensure that it has the capability of absorbing the energy discharged during an SRV blowdown or a LOCA.

15.9.6.2.3.14 Stored Fuel Shielding, Cooling, and Reactivity Control Because both new and spent fuel will be stored during all operating states, stored fuel shielding, cooling, and reactivity control apply to all operating states. Limits are imposed on the spent fuel pool storage positions, water level, fuel handling procedures, and water temperature. Observing the limits on fuel storage positions ensures that spent fuel reactivity remains within the envelope of conditions considered by the plant safety analysis (1-4). Observing the limits on water level ensures shielding in order to maintain conditions within the envelope of conditions considered by the plant safety analysis (1-4), and provides the fuel cooling necessary to avoid fuel damage (1-2).

Observing the limit on water temperature avoids excessive fuel pool stress (1-3).

15.9.6.2.4 Operational Safety Evaluations

a. State A In State A, the reactor is in a shutdown condition, the vessel head is off, and the vessel is at atmospheric pressure. The applicable events for planned operations CHAPTER 15 15.9-22 REV. 17, SEPTEMBER 2014

LGS UFSAR are refueling outage, achieving criticality, and cooldown (Events 1, 2, and 6, respectively).

Figure 15.9-9 shows the necessary safety actions for planned operations, corresponding plant systems, and the event for which these actions are necessary.

As indicated in the diagram, the required safety actions are as follows:

1. Radioactive material release control

2. Reactor vessel water level control

3. Nuclear system temperature control

4. Nuclear system water quality control

5. Core reactivity control

6. Refueling restrictions

7. Stored fuel shielding, cooling, and reactivity control

b. State B In State B, the reactor vessel head is off, the reactor is not shutdown, and the vessel is at atmospheric pressure. Applicable planned operations are achieving criticality and shutdown (Events 2 and 5, respectively).

Figure 15.9-10 relates the necessary safety actions for planned operations, plant systems, and the event for which the safety actions are necessary. The required safety actions for planned operation in State B are as follows:

1. Radioactive material release control

2. Core power level control

3. Reactor vessel water level control

4. Nuclear system temperature control

5. Nuclear system water quality control

6. Core reactivity control

7. Rod worth control

8. Stored fuel shielding, cooling, and reactivity control

c. State C CHAPTER 15 15.9-23 REV. 17, SEPTEMBER 2014

LGS UFSAR In State C, the reactor vessel head is on and the reactor is shut down. Applicable planned operations are achieving criticality and cooldown (Events 2 and 6, respectively).

Sequence diagrams relating safety actions for planned operations, plant systems, and applicable events are shown in Figure 15.9-11. The required safety actions for planned operation in State C are as follows:

1. Radioactive material release control

2. Reactor vessel water level control

3. Nuclear system pressure control

4. Nuclear system temperature control

5. Nuclear system water quality control

6. Nuclear system leakage control

7. Core reactivity control

8. Primary containment pressure and temperature control

9. Stored fuel shielding, cooling, and reactivity control

d. State D In State D, the reactor vessel head is on and the reactor is not shut down.

Applicable planned operations are achieving criticality, heatup, power operation, and shutdown (Events 2, 3, 4, and 5, respectively).

Figure 15.9-12 relates safety actions for planned operations, corresponding plant systems, and events for which the safety actions are necessary. The required safety actions for planned operation in State D are as follows:

1. Radioactive material release control

2. Core coolant flow rate control

3. Core power level control

4. Core neutron flux distribution control

5. Reactor vessel water level control

6. Nuclear system pressure control

7. Nuclear system temperature control CHAPTER 15 15.9-24 REV. 17, SEPTEMBER 2014

LGS UFSAR

8. Nuclear system water quality control

9. Nuclear system leakage control

10. Core reactivity control

11. Rod worth control

12. Primary containment pressure and temperature control

13. Stored fuel shielding, cooling, and reactivity control 15.9.6.3 Anticipated Operational Transients 15.9.6.3.1 General The safety requirements and protection sequences for anticipated operational transients are described in the following paragraphs for Events 7 through 29. The protection sequence block diagrams show the sequence of front-line safety systems. (Figures 15.9-13 through 15.9-34 and 15.9-36). The auxiliaries for the front-line safety system are indicated in the auxiliary diagrams (Figures 15.9-7 and 15.9-8).

15.9.6.3.2 Required Safety Actions/Related Unacceptable Consequences Safety actions for anticipated operational transients that mitigate or prevent the unacceptable safety consequences are listed below. Refer to Table 15.9-7 for the unacceptable consequences criteria.

Related Unacceptable Consequence Safety Action Criteria Reason Action Required Scram and/or RPT 2-2 To prevent fuel damage and limit 2-3 nuclear system pressure rise Pressure relief 2-3 To prevent excessive nuclear system pressure rise Core and 2-1 To prevent fuel and primary primary 2-2 containment damage in the event containment 2-4 that normal cooling is cooling interrupted Reactor 2-2 To prevent fuel damage by reducing the outflow of vessel steam and water from the reactor vessel, thereby isolation limiting the decrease in reactor vessel water level Restore ac 2-2 To prevent fuel damage by restoring ac power power to systems essential to other safety actions CHAPTER 15 15.9-25 REV. 17, SEPTEMBER 2014

LGS UFSAR Prohibit rod 2-2 To prevent exceeding fuel limits during transients motion Primary 2-1 To minimize radiological effects containment 2-4 isolation 15.9.6.3.3 Event Definitions and Operational Safety Evaluations

a. Event 7 - Manual and Inadvertent Scram The deliberate manual or inadvertent automatic scram due to single operator error is an event that can occur under any operating condition. Although assumed to occur here for examination purposes, multiple operator error or action is necessary to initiate such an event.

While all the safety criteria apply, no unique safety actions are required to control the planned operation-like event after effects of the subject initiation actions. In all operating states, therefore, the safety criteria are met through the basic design of the plant systems. Figure 15.9-13 identifies the protection sequences for this event.

b. Event 8 - Loss of Plant Instrument/Service Air System Loss of the plant instrument and service air systems causes reactor shutdown and the closure of MSIVs. Although these actions occur, they are not a requirement to prevent unacceptable consequences in themselves. Multiple equipment failures would be necessary to cause the deterioration of the subject system to the point that the components supplied with instrument or service air would cease to operate normally and/or fail-safe. The resulting actions are identical to Event 14 described later.

Isolation of the main steam lines can result in a transient for which some degree of protection is required only in operating States C and D. In operating States A and B, the main steam lines are normally isolated.

The effect of isolation of all main steam lines is most severe in operating State D during power operation.

Figures 15.9-14 and 15.9-21 show how scram is accomplished by main steam line isolation through the actions of the RPS and CRD system. The MSRV system provides pressure relief. Pressure relief, combined with loss of feedwater flow, causes reactor vessel water level to fall. Either HPCI or RCIC supplies water to maintain water level and protect the core until normal steam flow (or other planned operation) is established.

Adequate reserve pneumatic supplies are maintained exclusively for the continual operation of the ADS SRVs until reactor shutdown is accomplished.

c. Event 9 - Inadvertent NSSS Pump Start (Moderator Temperature Decrease)

CHAPTER 15 15.9-26 REV. 17, SEPTEMBER 2014

LGS UFSAR An inadvertent pump start (temperature decrease) is defined as an unintentional start of any NSSS pump that adds sufficient cold water to the reactor coolant inventory to cause a measurable decrease in moderator temperature. This event is considered in all operating states, because it can potentially occur under any operating condition. Since the HPCI pump operates over nearly the entire range of the operating states and delivers by far the greatest amount of cold water to the vessel, the following analysis will describe its inadvertent operation rather than other NSSS pumps (e.g., RCIC, RHR, core spray).

While all the safety criteria apply, no unique safety actions are required to control the adverse effects of such a pump start (i.e., pressure increase and temperature decrease in States A and C). In these operating states, the safety criteria are met through the basic design of the plant systems, and no safety action is specified. In States B and D, where the reactor is not shut down, the operator or the plant's normal control system can control any power changes in the normal manner of power control.

Figure 15.9-15 illustrates the protection sequence for the subject event. Single failures to the plant's normal control system pressure regulator or the feedwater controller systems will result in further protection sequences. These are shown in Events 22 and 23. The single failure aspects of their protection sequences will, of course, not be required.

d. Event 10 - Startup of Idle Recirculation Pump The cold loop startup of an idle recirculation pump can occur in any state. The attendant reactivity insertion effects are most severe and rapid for those operating states in which the reactor may be critical (States B and D). If the reactivity insertion is sufficient to require safety action, a high neutron flux signal (IRM or APRM) that exceeds the specified trip setpoint will occur.

As shown in Figure 15.9-16, the required safety action is accomplished through the combined actions of the NMS, RPS, and CRD system.

e. Event 11 - Recirculation Flow Control Failure (Increasing Flow)

A recirculation flow control failure causing increased flow is applicable in States C and D. In State D, the resulting increase in power level is limited by a reactor scram. As shown in Figure 15.9-17, the required safety action is accomplished through the combined actions of the NMS, RPS, and CRD system.

f. Event 12 - Recirculation Flow Control Failure (Decreasing Flow)

This recirculation flow control malfunction causes a decrease in core coolant flow.

This event is not applicable to States A and B, because the reactor vessel head is off and the recirculation pumps normally would not be in use.

The number and type of flow controller failure modes determine the protection sequence for the event. ASD controller failures (for one or both ASD trains will CHAPTER 15 15.9-27 REV. 17, SEPTEMBER 2014

LGS UFSAR result in a transient bounded by the previous transient associated with the original configuration for the MG set controller failures (a transient bounded by one or two RPT transients (Figure 15.9-18)).

g. Event 13 - Trip of One or Both Recirculation Pumps The trip of one recirculation pump produces a milder transient than does the simultaneous trip of two recirculation pumps.

The transient resulting from this two-loop trip is not severe enough to require any unique safety action. The transient is compensated for by the inherent nuclear stability of the reactor. This event is not applicable in States A and B, because the reactor vessel head is off and the recirculation pumps normally would not be in use. Figure 15.9-19 provides the protection sequence for the event for one or both pump trip actuations for States C and D.

This event constitutes an acceptable operational technique to reduce or minimize the effects of other event conditions. To this end, an engineered recirculation pump trip capability is included in the plant design to reduce pressure and thermal-hydraulic transient effects.

A two-pump trip can result in a high water level trip of the main turbine, which further causes a stop valve closure and its subsequent scram actuation.

Containment isolation occurs and RCIC/HPCI systems initiate on low water level.

Relief valve actuation will follow.

h. Event 14 - Isolation of One or All Main Steam Lines Isolation of the main steam lines can result in a transient for which some degree of protection is required only in operating States C and D. In operating States A and B, the main steam lines are normally isolated.

Isolation of all main steam lines is most severe and rapid in operating State D during power operation.

Figure 15.9-20 shows how a scram is initiated by main steam line isolation triggering the actions of the RPS and CRD systems. The MSRV system provides pressure relief. Pressure relief, combined with loss of feedwater flow, causes reactor vessel water level to fall and either HPCI or RCIC supply water to maintain water level and protect the core until adequate long-term cooling is established.

Isolation of one main steam line causes a significant transient only in State D during operation above approximately 90% power. If the feedwater system and main condenser remain in operation following the event, no unique requirement arises for core cooling.

As shown in Figure 15.9-21, the required safety action is accomplished.

i. Event 15 - Inadvertent Opening of an MSRV CHAPTER 15 15.9-28 REV. 17, SEPTEMBER 2014

LGS UFSAR The inadvertent opening of an MSRV is only possible in operating States C and D.

In State C the water level cannot be lowered far enough to threaten fuel damage; therefore, no safety actions are required. The protection sequences in State D are shown in Figure 15.9-22.

In State D, there is a slight decrease in reactor pressure following the event. The pressure regulator closes the main turbine control valves enough to stabilize pressure at a level slightly below the initial value. There are no unique safety system requirements for this event.

j. Event 16 - Control Rod Withdrawal Error For Refueling and Startup Operations Because a control rod withdrawal error resulting in an increase of positive reactivity can occur under any operating condition, it must be considered in all operating states. For this specific event situation, only States A and B apply.

1. Refueling No unique safety action is required in operating State A for the withdrawal of one control rod, because the core is more than one control rod subcritical. Withdrawal of more than one control rod is precluded by the protection sequence shown in Figure 15.9-23. During core alterations, the mode switch is normally in the REFUEL position, which allows the refueling equipment to be positioned over the core and also inhibits control rod withdrawal. Therefore, this transient applies only to operating State A.

No safety action is required, because the total worth (positive reactivity) of one fuel assembly or control rod is not adequate to cause criticality.

Moreover, mechanical design of the control rod assembly prevents physical removal without removing the adjacent fuel assemblies.

2. Startup During low power operation, the NMS via the RPS will initiate scram if necessary (Figure 15.9-23).

k. Event 17 - Control Rod Withdrawal Error (During Power Operation)

Because a control rod withdrawal error resulting in an increase of positive reactivity can occur under any operating condition, it must be considered in all operating states. For this specific event situation, only States C and D apply.

During power operation (State D), a number of plant protective devices of various designs prohibit the control rod motion before critical levels are reached (Figure 15.9-24).

Below the low power setpoint, the selection of an out- of-sequence rod movement is prevented by the RWM which uses banked position withdrawal sequences. In addition, the movement of the rod is monitored and limited within acceptable intervals either by neutronic effects or actual rod motion. The RBM provides CHAPTER 15 15.9-29 REV. 17, SEPTEMBER 2014

LGS UFSAR movement surveillance. Beyond these rod motion control limits are the fuel/core scram protection systems.

While in State C, no protection action is needed.

l. Event 18 - Loss of Shutdown Cooling The loss of RHR system shutdown cooling can occur only during the low pressure portion of a normal reactor shutdown and cooldown.

As shown in Figure 15.9-25, for most single failures that could result in primary loss of shutdown cooling capabilities, no unique safety actions are required; in these cases, shutdown cooling is simply re-established using redundant shutdown cooling equipment. In the cases where the RHR shutdown cooling suction line becomes inoperative, a unique arrangement for cooling arises. In States A and B, in which the reactor vessel head is off, the LPCI and CS can be used to maintain RPV water level. In State C, in which the reactor vessel head is on and the system can be pressurized, the ADS or manual operation of relief valves in conjunction with any of the ECCS and the RHR suppression pool cooling mode (both manually operated) can be used to maintain water level and remove decay heat.

Suppression pool cooling is actuated to remove heat energy from the suppression pool system.

m. Event 19 - RHR Shutdown Cooling - Increased Cooling An RHR shutdown cooling malfunction causing a moderator temperature decrease must be considered in all operating states. However, this event is not considered in States C and D if nuclear system pressure is too high to permit operation of the RHR shutdown cooling (Figure 15.9-26). No unique safety actions are required to avoid the unacceptable safety consequences for transients as a result of a reactor coolant temperature decrease induced by misoperation of the shutdown cooling heat exchangers.

In States B and D, where the reactor is at or near critical, the slow power increase resulting from the cooler moderator temperature would be controlled by the operator in the same manner normally used to control power in the source or intermediate power ranges.

n. Event 20 - Loss of All Feedwater Flow A loss of feedwater flow results in a net decrease in the coolant inventory available for core cooling. A loss of feedwater flow can occur in States C and D. Appropriate responses to this transient include a reactor scram on low water level and restoration of reactor vessel water level by HPCI and RCIC.

As shown in Figure 15.9-27, the RPS and CRD systems effect a scram on low water level. The PCRVICS acts to isolate the containment. Either the RCIC or HPCI system can maintain adequate water level for initial core cooling and to restore and maintain water level.

CHAPTER 15 15.9-30 REV. 17, SEPTEMBER 2014

LGS UFSAR The requirements for operating State C are the same as for State D, except that the scram initiation is not required in State C.

o. Event 21 - Loss of a Feedwater Heater Loss of a feedwater heater must be considered with regard to the nuclear safety operational criteria only in operating State D, because significant feedwater heating does not occur in any other operating state.

A loss of feedwater heating transient causes a neutron flux increase that might reach the scram setpoint depending upon the degree of feedwater heating loss.

As shown in Figure 15.9-28 required safety action is accomplished through actions of the NMS, RPS, and CRD system.

p. Event 22 - Feedwater Controller Failure (Maximum Demand)

A feedwater controller failure, causing an excess of coolant inventory in the reactor vessel, is possible in all operating states. Feedwater controller failures considered are those that would give failures of automatic or manual level controls. In operating States A and B, no safety actions are required, since the vessel head is removed and the moderator temperature is low. In operating State D, any positive reactivity effects responses by the reactor caused by cooling of the moderator can be mitigated by a scram. As shown in Figure 15.9-29, scram is accomplished through the combined actions of the neutron monitoring, reactor protection, and CRD systems. Pressure relief is required in States C and D and is achieved through the operation of the MSRV system. Initial restoration of the core water level is by the RCIC and HPCI systems. Planned operations will proceed to achieve long-term cooling.

q. Event 23 - Pressure Regulator Failure (Open Direction)

A pressure regulator failure in the open direction, causing the opening of a turbine control or bypass valve, applies only in operating States C and D, because in other states the pressure regulator is not in operation. A pressure regulator failure is most severe and rapid in operating State D at low power.

The various protection sequences giving the safety actions are shown in Figure 15.9-30. Depending on plant conditions existing prior to the event, scram will be initiated either on main steam line isolation, main turbine trip or reactor vessel low water level. The sequence resulting in reactor vessel isolation also depends on initial conditions. With the mode switch in RUN, isolation is initiated when main steam line pressure drops below the low turbine inlet pressure setpoint. After isolation is completed, decay heat will cause nuclear system pressure to increase until limited by the operation of the relief valves. Core cooling following isolation can be provided by RCIC or HPCI. Shortly after reactor vessel isolation, normal core cooling can be re-established via the main condenser and feedwater systems or, if prolonged isolation is necessary, extended core and containment cooling will be manually actuated.

r. Event 24 - Pressure Regulator Failure (Closed Direction)

CHAPTER 15 15.9-31 REV. 17, SEPTEMBER 2014

LGS UFSAR A pressure regulator failure in the closed direction, causing the closing of turbine control valves, applies only in operating States C and D, because in other states the pressure regulator is not in operation.

A single pressure regulator failure would result in little or no effect on the plant operation. The second pressure regulator would provide control. Failure of the second unit, which would result in the worst situation, is much less severe than Events 25, 27, 30, and 31. The dual pressure regulator failures are most severe and rapid in operating State D at high power.

The various protection sequences giving the safety actions are shown in Figure 15.9-31. Upon failure of one pressure regulator, normally a backup regulator will maintain the plant in the normal status. An additional failure of the backup regulator will result in a high flux or pressure scram, containment isolation, and subsequent HPCI/RCIC actuations. Closure of the turbine stop valve and bypass valves effectively isolates the reactor vessel.

s. Event 25 - Main Turbine Trips With Bypass System Operation A main turbine trip can occur only in operating State D (during heatup or power operation). A turbine trip during heatup is not as severe as a trip at full power, because operation of the turbine bypass system minimizes the effects of the transient, enabling return to planned operations. For a turbine trip above the bypass capacity, a scram as well as RPT will occur via turbine stop valve closure.

Subsequent relief valve actuation will occur. Eventual containment isolation and RCIC and HPCI system initiation will result from low water level. Figure 15.9-32 depicts the protection sequences required for main turbine trips. Main turbine trip and main generator trip are similar anticipated operational transients, and the required safety actions are the same.

t. Event 26 - Loss of Main Condenser Vacuum (Turbine Trip)

A loss of vacuum in the main turbine condenser can occur any time steam pressure is available and the condenser is in use; it is applicable to operating States C and D. This nuclear system pressure increase transient is the most severe of the pressure increase transients. However, scram protection in State C is not needed, since the reactor is not coupled to the turbine system.

For State D, above the turbine stop valve closure scram bypass setpoint, loss of condenser vacuum will initiate a turbine trip with its attendant stop valve closures (which lead to scram and an RPT). RCIC and HPCI are initiated on low water level. Below the turbine stop valve closure scram bypass setpoint (State D), scram is initiated by a high neutron flux signal. Figure 15.9-33 shows the protection sequences. Decay heat will necessitate extended core and suppression pool cooling. When the RPV depressurizes sufficiently, the low pressure core cooling systems provide core cooling until a planned operation via RHR shutdown cooling is achieved.

u. Event 27 - Main Generator Trip With Bypass System Operation CHAPTER 15 15.9-32 REV. 17, SEPTEMBER 2014

LGS UFSAR A main generator trip with bypass system operation can occur only in operating State D (during heatup or power operation). Fast closure of the main turbine control valves is initiated whenever an electrical grid disturbance occurs, which results in significant loss of electrical load on the generator. The turbine control valves are required to close as rapidly as possible to prevent excessive overspeed of the main turbine-generator rotor. Closure of the turbine control valves will cause a sudden reduction in steam flow, which results in an increase in system pressure.

Above the turbine control valve closure scram bypass setpoint, scram and RPT will occur as a result of fast control valve closure. Subsequently, containment isolation will result, and pressure relief and initial core cooling by RCIC and HPCI will take place. Planned operation can be resumed to achieve shutdown. A generator trip during heatup is not severe when the turbine bypass system can accommodate decoupling the reactor and the turbine-generator unit. Figure 15.9-34 depicts the protection sequences required for a main generator trip. Main generator trip and main turbine trip are similar anticipated operational transients, and the required safety actions for both are the same sequence.

v. Event 28 - Loss of Auxiliary Power Transformers There are a variety of possible plant electrical component failures that could affect the reactor system. The total loss of ac auxiliary power is the most severe. The loss of auxiliary power results in a sequence of events similar to that resulting from a loss of all connections to the grid. The most severe situation occurs in State D during power operation. This event requires the same protection sequences as shown for Event 29 in Figure 15.9-36.

w. Event 29 - Loss of Offsite Power - Grid Loss There are a variety of plant grid electrical component failures that can affect reactor operation. The total loss of ac auxiliary power is the most severe. The loss of all auxiliary power sources results in a sequence of events similar to that resulting from a main generator trip with bypass (Event 27), with respect to response of reactor systems. The most severe case occurs in State D during power operation. Figure 15.9-36 shows the safety actions required for a total loss of offsite power in all States (A, B, C, and D).

Scram and RPT will be initiated by turbine control valve fast closure. Loss of condenser circulating water will reduce condenser vacuum, which will close the turbine bypass valves and MSIVs. After the MSIVs close, system pressure rises to the lowest relief valve setting. Pressure is relieved by the MSRV system. After the reactor is isolated and feedwater flow has been lost, decay heat continues to increase nuclear system pressure, periodically causing relief valves to lift and, therefore, causing reactor water level to decrease. The core and containment cooling sequence shown in Figure 15.9-36 shows the sequence for achieving adequate cooling.

15.9.6.4 Abnormal Operational Transients 15.9.6.4.1 General CHAPTER 15 15.9-33 REV. 17, SEPTEMBER 2014

LGS UFSAR The safety requirements and protection sequences for abnormal operational transients are described in the following paragraphs for Events 30 through 37. The protection sequence block diagrams show the sequence of front-line safety systems (Figures 15.9-37 through 15.9-39). The auxiliaries for the front-line safety systems are indicated in the auxiliary diagrams (Figures 15.9-7 and 15.9-8).

15.9.6.4.2 Required Safety Actions/Related Unacceptable Consequences The following list relates the safety actions for abnormal operational transients to mitigate or prevent the unacceptable safety consequences cited in Table 15.9-8.

Related Unacceptable Safety Action Consequence Reason Action Required Scram and/or RPT 3-2 To limit gross core-wide fuel damage and 3-3 to limit nuclear system pressure rise 3-5 Pressure relief 3-3 To prevent excessive nuclear system 3-5 pressure rise Core, suppression 3-2 To limit further fuel and containment pool, and primary 3-4 damage if normal cooling is interrupted containment cooling Reactor vessel 3-2 To limit further fuel damage by reducing the isolation outflow of steam and water from the reactor vessel, thereby limiting the decrease in reactor vessel water level Restore ac power 3-2 To limit initial fuel damage by restoring ac power to systems essential to other safety actions Primary containment 3-1 To limit radiological effects isolation 15.9.6.4.3 Event Definition and Operational Safety Evaluation

a. Event 30 - Main Generator Trip Without Bypass System Operation A main generator trip without bypass system operation can occur only in operating State D (during heatup or power operation). The thermal-hydraulic effects on the core are more severe than with the bypass operating (Event 27).

Figure 15.9-37 depicts the protection sequences required for a main generator trip with bypass failure. If the turbine control valve closure scram bypass setpoint is exceeded, a turbine control valve fast closure signal will initiate RPS and RPT.

CHAPTER 15 15.9-34 REV. 17, SEPTEMBER 2014

LGS UFSAR Containment isolation, relief valve actuation, and RCIC and HPCI operation will follow. Turbine control valve closure with bypass valve failure effectively isolates the reactor. Prolonged shutdown will necessitate extended core and containment/suppression pool cooling.

The load rejection and turbine trip are similar abnormal operational transients, and the required safety actions are the same.

b. Event 31 - Main Turbine Trip Without Bypass System Operation A main turbine trip without bypass can occur only in operating State D (during heatup or power operation). Figure 15.9-38 depicts the protection sequences required for main turbine trips. Turbine stop valve closure with bypass valve failure effectively isolates the reactor.

Turbine trips without bypass system operations result in severe thermal-hydraulic effects on the reactor core.

c. Event 32 - Inadvertent Loading and Operation with Assembly in Improper Position Operation with a fuel assembly in the improper position is shown in Figure 15.9-39 and can occur in all operating states. No protection sequences are necessary relative to this event. Calculated results of worst fuel bundle loading error will not cause fuel cladding integrity damage. It requires three independent equipment/operator errors to allow this situation to develop.

d. Events 33 through 37 - (Not Used) 15.9.6.5 Design Basis Accidents 15.9.6.5.1 General The safety requirements and protection sequences for accidents are described in the follow paragraphs for Events 38 through 49. The protection sequence block diagrams show the safety actions and the sequence of front-line safety systems used for the accidents (refer to Figures 15.9-40 through 15.9-49). The auxiliaries for the front-line safety systems are indicated in the auxiliary diagrams (Figures 15.9-7 and 15.9-8).

15.9.6.5.2 Required Safety Actions/Unacceptable Consequences The following list relates the safety actions for design basis accident to mitigate or prevent the unacceptable consequences cited in Table 15.9-9.

Related Unacceptable Safety Action Consequence Reason Action Required Scram 4-2 To prevent fuel cladding failure(1) and 4-3 prevent excessive nuclear system pressures Pressure relief 4-3 To prevent excessive nuclear system pressure CHAPTER 15 15.9-35 REV. 17, SEPTEMBER 2014

LGS UFSAR Core cooling 4-2 To prevent fuel cladding failure Reactor vessel 4-1 To limit radiological effect to not exceed the isolation values of 10CFR50.67 and Regulatory Guide 1.183 Establish primary 4-1 To limit radiological effects to not exceed the containment values of 10CFR50.67 and Regulatory Guide 1.183 Primary containment 4-4 To prevent excessive pressure in the cooling containment when containment is required.

Prevent control 4-2 To prevent fuel cladding failure rod ejection Restrict loss of 4-2 To prevent fuel cladding failure reactor coolant (passive)

Main control room 4-5 To prevent overexposure to radiation of environmental plant personnel in the control room control Limit reactivity 4-2 To prevent fuel cladding failure and insertion rate 4-3 excessive nuclear system pressure (passive)

(1)

Failure of fuel barrier includes fuel cladding fragmentation (LOCA) and excessive fuel enthalpy (control rod-drop accident).

15.9.6.5.3 Event Definition and Operational Safety Evaluations

a. Event 38 - Recirculation Pump Seizure A recirculation pump seizure event considers the instantaneous stoppage of the pump motor shaft of one recirculation loop pump. The case involves operation at design power in State D. It assumed that a main turbine trip will occur as reactor vessel water level swell exceeds the turbine trip setpoint. This in a scram and an RPT when the turbine stop valves close. Relief valve opening will occur to control pressure level and temperatures. RCIC or HPCI system will maintain vessel water level.

The protection sequence for this event is given in Figure 15.9-40. If reactor vessel swell does not exceed the turbine trip setpoint, then no safety actions are required.

b. Event 39 - Recirculation Pump Shaft Break CHAPTER 15 15.9-36 REV. 17, SEPTEMBER 2014

LGS UFSAR A recirculation pump shaft break event considers the degraded, delayed stoppage of the pump motor shaft of one recirculation loop pump. The case involves operation at design power in State D. It is assumed that a main turbine trip will occur as reactor vessel water level swell exceeds the turbine trip setpoint. This results in a scram and an RPT when the turbine stop valves close. Relief valve opening will occur to control pressure and temperature. RCIC or HPCI systems will maintain vessel water level.

The production sequence for this event is given in Figure 15.9-41. If reactor vessel swell does not exceed the turbine trip setpoint, then no safety actions arre required.

c. Event 40 - Control Rod-Drop Accident The control rod-drop accident results from an assumed failure of the control rod-to-drive mechanism coupling after the control rod (very reactive rod) becomes stuck in its fully inserted position. It is assumed that the control rod drive is then fully withdrawn before the stuck rod falls out of the core. The control rod velocity limiter, an engineered safeguard, limits the control rod-drop velocity. The resultant radioactive material release is maintained far below the values of 10CFR50.67 and Regulatory Guide 1.183.

No safety actions are required in States A or C where the plant is in a shutdown state by more than the reactivity worth of one rod prior to the accident. The control rod-drop accident is applicable only in States B and D. In State B the low fission product inventory assures inconsequential radiological releases should a control rod-drop accident occur. Direct radiation dose to personnel on the refueling floor is maintained acceptable by the shielding provided by water above the core and by administrative procedures controlling personnel access. For State B, control rod worth is limited by the RWM system such that damage to the reactor coolant pressure boundary is prevented. Under most instances fuel failures are not expected. Therefore, the only safety response required in State B is scram.

Figure 15.9-42 presents the different protection sequences for the control rod-drop accident. As shown in Figure 15.9-42, the reactor is automatically scrammed and, in some cases, isolated. For all design basis cases, the NMS, RPS, and CRD system will provide a scram from high neutron flux. Because LGS utilizes the banked position withdrawal sequence which mitigates rod-drop consequences, no fuel failures are expected.

After the reactor has been scrammed and isolated, the pressure relief system allows the steam (produced by decay heat) to be directed to the suppression pool.

Initial core cooling is accomplished by either the RCIC or HPCI or the normal feedwater system. With prolonged isolation, as indicated in Figure 15.9-42, the reactor operator initiates the RHR/suppression pool cooling mode and depressurizes the vessel with the manual mode of the ADS or via normal manual relief valve operation. The RHR/shutdown cooling mode accomplishes extended core cooling.

d. Event 41 - Fuel Handling Accident CHAPTER 15 15.9-37 REV. 17, SEPTEMBER 2014

LGS UFSAR Because a fuel handling accident can potentially occur any time when fuel assemblies are being manipulated, either over the reactor core or in a spent fuel pool, this accident is considered in all operating states. Considerations include mechanical fuel damage caused by drop impact and a subsequent release of fission products. The protection sequences pertinent to this accident are shown in Figure 15.9-43. Refueling area isolation and SGTS operation are automatically initiated by the ventilation radiation monitoring systems.

e. Event 42 - LOCAs Resulting from Postulated Piping Breaks Within RCPB Inside Containment (DBA LOCA)

Pipe breaks inside the containment are considered only when the nuclear system is significantly pressurized (States C and D). The result is a release of steam and water into the containment. Consistent with NSOA criteria, the protection requirements consider all size line breaks, from large liquid recirculation loop piping breaks down to small steam instrument line breaks. The most severe cases are the circumferential break of the largest (liquid) recirculation system pipe and the circumferential break of the largest main steam line.

As shown in Figure 15.9-44, in operating State C (reactor shutdown, but pressurized), a pipe break accident up to the DBA can be accommodated within the nuclear safety operational criteria through the various operations of the main steam line isolation valves, emergency core cooling systems (HPCI, ADS, LPCI, and CS), PCRVICS, containment, reactor enclosure, SGTS, control room heating, cooling and ventilation system, ESW and RHRSW systems, hydrogen control system, equipment cooling systems, and the incident detection circuitry. For small pipe breaks inside the containment, pressure relief is effected by the MSRV system, which transfers decay heat to the suppression pool. For large breaks, depressurization takes place through the break itself. In State D (reactor not shut down, but pressurized), the same equipment is required as in State C but, in addition, the RPS and the CRD system must operate to scram the reactor. The limiting items, upon which the operation of the above equipment is based, are the allowable fuel cladding temperature and the containment pressure capability. The CRD housing supports are considered necessary whenever the system is pressurized to prevent excessive control rod movement through the RPV following the postulated rupture of one CRD housing (a lesser case of the design basis LOCA and a related preventive of a postulated rod ejection accident).

After completion of the automatic action of the above equipment, manual operation of the RHR system (suppression pool cooling mode) or relief valves and ADS (controlled depressurization) is required to maintain containment pressure and fuel cladding temperature within limits during extended core cooling.

f. Events 43, 44, 45 - Piping Breaks Outside Containment Pipe break accidents outside the containment are assumed to occur any time the nuclear system is pressurized (States C and D). This accident is most severe during operation at high power (State D). In State C, this accident becomes a subset of the State D sequence.

CHAPTER 15 15.9-38 REV. 17, SEPTEMBER 2014

LGS UFSAR The protection sequences for the various possible pipe breaks outside the containment are shown in Figure 15.9-45. For small breaks, the reactor operator can use a large number of process indications to identify and isolate the break.

In operating State D (reactor not shut down, but pressurized), scram is accomplished through operation of the RPS and the CRD system. Reactor vessel isolation is accomplished through operation of the MSIVs and the PCRVICS.

For a main steam line break, initial core cooling is accomplished by HPCI, RCIC, ADS, or manual relief valve operation in conjunction with CS and LPCI. These systems provide parallel paths to effect initial core cooling, thereby satisfying the single failure criterion. Extended core cooling is accomplished by the single failure proof, parallel combination of CS and LPCI. The ADS or relief valve system operation and the RHR suppression pool cooling mode (both manually operated) are required to maintain containment pressure and fuel cladding temperature within limits during extended core cooling.

g. Event 46 - Gaseous Radwaste System Leak or Failure It is assumed that the line leading to the SJAE fails near the main condenser. This results in activity normally processed by the offgas treatment system being discharged directly to the turbine enclosure and subsequently through the ventilation system to the environment. This failure is indicated by a lack of flow in the offgas discharge line. This event can be considered only under States C and D and is shown in Figure 15.9-46.

The reactor operator initiates shutdown of the SJAEs/offgas system to reduce the gaseous activity being discharged. A loss of main condenser vacuum will result (timing depending on main condenser air inleakage rate) in a main turbine trip and ultimately a reactor shutdown. Refer to Event 26 for reactor protection sequence (Figure 15.9-33).

h. Event 47 - Augmented Offgas Treatment System Failure An evaluation of those events that could cause a gross failure in the offgas system has resulted in the identification of a postulated seismic event, more severe than the one for which the system is designed, as the only conceivable event that could cause significant damage.

The gross failure of this system requires a manual isolation of the system from the main condenser. The isolation results in a loss of main condenser vacuum (timing dependent on air inleakage rate). Protection sequences for this event are shown in Figure 15.9-47.

i. Event 48 - Liquid Radwaste System Leak or Failure Releases that could occur inside and outside of the containment, not covered by Events 38 through 47, include small spills and equipment leaks of radioactive materials inside structures housing the subject process equipment. Conservative CHAPTER 15 15.9-39 REV. 17, SEPTEMBER 2014

LGS UFSAR values for leakage have been assumed and evaluated in the plant under routine releases (Section 11.2). The offsite dose that results from any small spill that could occur outside containment will be negligible in comparison to the dose resulting from the accountable (expected) plant leakages.

The protective sequences for this event are provided in Figure 15.9-48.

j. Event 49 - Liquid Radwaste System - Storage Tank Failure Refer to Section 2.4 for a discussion of liquid tank failures.

The protective sequences for this event are provided in Figure 15.9-49.

15.9.6.6 Special Events 15.9.6.6.1 General Additional special events are postulated to demonstrate that the plant is capable of accommodating off-design occurrences. (refer to Events 50 through 53). As such, these events are beyond the safety requirements of the other event categories. The safety actions shown in the sequence diagrams (Figures 15.9-50 through 15.9-53) for the additional special events follow directly from the requirements cited in the demonstration of the plant's capability.

Auxiliary systems are shown in Figures 15.9-7 and 15.9-8.

15.9.6.6.2 Required Safety Action/Unacceptable Consequences The following list relates the safety actions for special events to prevent the unacceptable consequences cited in Table 15.9-10.

Related Unacceptable Safety Action Consequence Reason For Action Available Main Control Room Considerations Manually initiate 5-1 Local panel control has been provided all shutdown 5-2 and is available outside main control controls from room remote shutdown panel or local panels Manually initiate SLCS -3 SLCS to control reactivity to cold shutdown available 15.9.6.6.3 Event Definitions and Operational Safety Evaluation

a. Event 50 - Shipping Cask-Drop CHAPTER 15 15.9-40 REV. 17, SEPTEMBER 2014

LGS UFSAR Due to the redundant nature of the plant crane, the cask-drop accident is not believed to be a credible accident. However, the accident is hypothetically assumed to occur as a consequence of an unspecified failure of the cask-lifting mechanism, thereby allowing the cask to fall.

It is assumed that an ISFSI transfer cask and/or spent fuel shipping cask containing irradiated fuel assemblies is in the process of being moved with the cask suspended from the crane above the rail car. The fuel assemblies have been out of the reactor for at least 90 days.

Through some unspecified failure, the cask is released from the crane and falls onto the rail car. Some of the coolant in the outer cask structure may leak from the cask.

The reactor operator will ascertain the degree of cask damage and, if possible, make the necessary repairs and refill the cask coolant to its normal level if coolant has been lost.

It is assumed that if the coolant is lost from the external cask shield, the operator will establish forced cooling of the cask by introducing water into the outer structure annulus or by spraying water on the cask exterior surface. Maintaining the cask in a cool condition will, therefore, ensure no fuel damage as a result of a temperature increase due to decay heat.

Because the cask is still within the refueling area volume, any activity postulated to be released can be accommodated by the SGTS.

The protective sequences for this event are provided in Figure 15.9-50.

b. Event 51 - Reactor Shutdown, Anticipated Transient Without Scram Reactor shutdown from a plant transient occurrence without the use of control rods is applicable in State D only. The protection sequences for this extremely improbable class of events in shown in Figure 15.9-51.

On initiation of the plant transient situation by a turbine trip, for example, a scram is automatically initiated, but no control rods are assumed to move; the operator may attempt to insert control rods manually. The recirculation pumps are tripped as a consequence of the initial turbine trip. If the nuclear system becomes isolated from the main condenser, heat can be transferred from the reactor to the suppression pool via the relief valves; the HPCI and RCIC are initiated on low water level and then maintain reactor vessel water level. The RRCS, on detecting high pressure or low water level in the reactor, will also attempt to insert control rods by actuation of the ARI valves of the CRD system and will also initiate a recirculation pump trip (which has previously occurred for this transient). If the reactor power is still significant after appropriate time delays, the RRCS automatically initiates feedwater runback and SLCS operation. Operation of the SLCS results in a transition from low power neutron heat to decay heat. The RHR suppression pool cooling mode is used to remove the low power neutron and decay heat from the suppression pool as required. After attaining hot shutdown, further CHAPTER 15 15.9-41 REV. 17, SEPTEMBER 2014

LGS UFSAR depressurization to the suppression pool and use of the RHR shutdown cooling mode results in achieving a cold shutdown condition.

c. Event 52 - Reactor Shutdown From Outside Control Room Reactor shutdown from outside the control room is an event investigated to evaluate the capability of the plant to be safely shut down and cooled to the cold shutdown state from outside the control room.

Figure 15.9-52 shows the protection sequences for this event in operating States B, C and D. In State A, no sequence is shown, because the reactor is already in the condition finally required for the event. In State C, only cooldown is required, since the reactor is already shut down.

A scram from outside the control room can be achieved by opening the ac supply breakers for the RPS. Reactor pressure will be controlled and decay heat transferred to the suppression pool via the relief valves. Reactor water level will be maintained by the RCIC system, and the suppression pool will be cooled using the RHR suppression pool cooling mode. When system pressure is sufficiently reduced, the RHR shutdown cooling mode will be used for long-term cooling.

d. Event 53 - Reactor Shutdown Without Control Rods Reactor shutdown without control rods is an event requiring an alternate method of reactivity control: the SLCS. By definition, this event can occur only when the reactor is not already shut down. Therefore, this event is considered only in operating States B and D.

The SLCS must operate to meet capability demonstration requirement 5-3. The design bases for the SLCS result from these operating criteria when applied under the most severe conditions (State D at rated power). As indicated in Figure 15.9-53, the SLCS is manually initiated and controlled in States B and D.

15.9.7

SUMMARY

AND CONCLUSIONS With the information presented in the protection sequence block diagrams and the auxiliary diagrams, it is possible to examine the functional and hardware requirements for each system.

This is done by considering the events in which the systems are employed and deriving sets of operational requirements. This limiting set of operational requirements establishes the lowest acceptable level of performance for a system or component, or the minimum number of components or portions of a system that must be operable so that plant operation may continue, as indicated in Section 15.9.5.

Safety actions to maintain core cooling are, in general, automatically controlled by NSSS ESF systems. Required manual actions are limited to RHR system adjustment to control suppression pool temperatures.

For LOCA events, all short-term (t = 0 through 10 minutes) safety functions are automatically initiated and controlled. All safety actions to provide adequate core cooling over the long-term (t =

10 minutes to 30 days) are automatically provided by the necessary NSSS ESF systems. Control CHAPTER 15 15.9-42 REV. 17, SEPTEMBER 2014

LGS UFSAR of LOCA suppression pool thermal response, however, may require the operator to place one loop of the containment cooling system (RHR) into operation, but no such action is required earlier than 10 minutes into the event. Extended long-term NSSS ESF manual actions would be centered around RHR shutdown cooling aspects.

For anticipated operational transient events, no operator action is required in less than 10 minutes to mitigate the consequences of the event or to achieve a steady reactor condition or a controlled shutdown mode. Most events involve automatic process control systems (e.g., feedwater or pressure controls that are usually in operation). Some events allow operator manual control adjustments (e.g., control rod insertion) prior to an automatic protection action, but in no case will the failure or error of the operator manual action negate any protective function or cause a radiological safety problem. Operator actions may improve the course of a transient, but no credit is taken (ahead of 10 minutes) in the current safety evaluation analyses.

When the initial stages of these events are completed and the operator has taken over manual control, the EOPs govern all actions taken.

The operational requirements derived using the above process may be complicated functions of operating states, parameter ranges, and hardware conditions. The final step is to translate these results into technical specifications that encompass the operational requirements and can be used by plant operations and management personnel.

It is concluded that the nuclear safety operational and plant design basis criteria are satisfied when the plant is operated in accordance with the nuclear safety operational requirements determined by the method presented in this section.

CHAPTER 15 15.9-43 REV. 17, SEPTEMBER 2014

LGS UFSAR Table 15.9-1 NORMAL OPERATION NSOA NSOA EVENT UFSAR BWR OPERATING STATE EVENT NO. EVENT DESCRIPTION FIGURE NO. SECTION NO. A B C D 1 Refueling 15.9-9 - X

- Initial

- Reload 2 Achieving Criticality 15.9-9 through - X X X X 15.9-12 3 Heatup 15.9-12 X 4 Power Operation - Generation 15.9-12 - X

- Steady state

- Daily load reduction & recovery

- Grid frequency control response

- Control rod sequence exchanges

- Power generation surveillance Testing

1. Turbine stop valve surveillance tests

1. Turbine control valve surveillance tests

1. MSIV surveillance tests 5 Achieving Shutdown 15.9-10 and 15.9-12 - X X 6 Cooldown 15.9-9 and 15.9-11 X X CHAPTER 15 15.9-44 REV. 13, SEPTEMBER 2006

LGS UFSAR Table 15.9-2 ANTICIPATED OPERATIONAL TRANSIENTS NSOA NSOA EVENT UFSAR BWR OPERATING STATE EVENT NO. EVENT DESCRIPTION FIGURE NO. SECTION NO. A B C D 7 Manual or inadvertent scram 15.9-13 7.2 X X X X 8 Loss of plant instrument and 15.9-14 9.3.1 X X X X service air systems 9 Inadvertent startup of NSSS pump 15.9-15 15.5.1 X X X X 10 Inadvertent startup of idle 15.9-16 15.4.4 X X X X recirculation loop pump 11 Recirculation loop flow control 15.9-17 15.4.5 X X failure with increasing flow 12 Recirculation loop flow control 15.9-18 15.3.2 X X failure with decreasing flow 13 Recirculation loop pump trip 15.9-19 15.3.1 X X

- With one pump

- With two pumps 14 Inadvertent MSIV closure 15.2.4

- All main steam lines isolated 15.9-20 X X

- One main steam line isolated 15.9-21 X X 15 Inadvertent opening of an MSRV 15.9-22 15.6.1 X X 16 Control rod withdrawal error 15.9-23 15.4.1

- During startup X

- During refueling X 17 Control rod withdrawal rod error at power 15.9-24 15.4.2 X X 18 RHR shutdown cooling failure loss of cooling 15.9-25 15.2.9 X X X CHAPTER 15 15.9-45 REV. 13, SEPTEMBER 2006

LGS UFSAR Table 15.9-2 (Cont'd)

NSOA NSOA EVENT UFSAR BWR OPERATING STATE EVENT NO. EVENT DESCRIPTION FIGURE NO. SECTION NO. A B C D 19 RHR shutdown cooling failure 15.9-26 15.1.6 X X X X increased cooling 20 Loss of all feedwater flow 15.9-27 15.2.7 X X 21 Loss of feedwater heater 15.9-28 15.1.1 X 22 Feedwater controller failure 15.9-29 15.1.2 X X X X maximum demand 23 Pressure regulator failure 15.9-30 15.1.3 X X

- open 24 Pressure regulator failure 15.9-31 15.2.1 X X

- closed 25 Main turbine trip with bypass 15.9-32 15.2.3 X system operation 26 Loss of main condenser vacuum 15.9-33 15.2.5 X X 27 Main generator trip with bypass 15.9-34 15.2.2 X system operation 28 Loss of auxiliary transformers 15.9-36 15.2.6 X X X X 29 Loss of plant normal offsite 15.9-36 15.2.6 X X X X ac power - grid connection failure CHAPTER 15 15.9-46 REV. 13, SEPTEMBER 2006

LGS UFSAR Table 15.9-3 ABNORMAL OPERATIONAL TRANSIENTS NSOA NSOA EVENT UFSAR BWR OPERATING STATE EVENT NO. EVENT DESCRIPTION FIGURE NO. SECTION NO. A B C D 30 Main generator trip with bypass 15.9-37 15.2.2 X system failure 31 Main turbine trip with bypass 15.9-38 15.2.3 X system failure 32 Inadvertent loading and 15.9-39 15.4.7 X X X X operation of a fuel assembly in an improper position 33 Not Used - -

34 Not Used - -

35 Not Used - -

36 Not Used - -

37 Not Used - -

CHAPTER 15 15.9-47 REV. 13, SEPTEMBER 2006

LGS UFSAR Table 15.9-4 DESIGN BASIS ACCIDENTS NSOA NSOA EVENT UFSAR BWR OPERATING STATE EVENT NO. EVENT DESCRIPTION FIGURE NO. SECTION NO. A B C D 38 Recirculation Pump Seizure 15.9-40 15.3.3 X 39 Recirculation Pump Shaft Break 15.9-41 15.3.4 X 40 Control rod-drop accident 15.9-42 15.4.9 X X 41 Fuel handling accident 15.9-43 15.7.4 X X X X 42 LOCA resulting from spectrum 15.9-44 15.6.5 X X of postulated piping breaks within the RCPB inside containment 43 Piping breaks outside containment 15.9-45 15.6.4 X X 44 Instrument line break outside 15.9-45 15.6.2 X X drywell 45 Feedwater line break outside 15.9-45 15.6.6 X X containment 46 Gaseous radwaste system leak or 15.9-46 15.7.1 X X failure 47 Augmented offgas treatment 15.9-47 15.7.1 X X system failure 48 Liquid radwaste system leak or 15.9-48 15.7.2 X X X X failure 49 Liquid radwaste system storage 15.9-49 15.7.3 X X X X tank failure CHAPTER 15 15.9-48 REV. 13, SEPTEMBER 2006

LGS UFSAR Table 15.9-5 SPECIAL EVENTS NSOA NSOA EVENT UFSAR BWR OPERATING STATE EVENT NO. EVENT DESCRIPTION FIGURE NO. SECTION NO. A B C D 50 ISFSI Transfer Cask and/or 15.9-50 15.7.5 X X X X Shipping cask-drop

- Solid radwaste

- Spent fuel

- New fuel 51 Reactor shutdown from 15.9-51 15.8 X ATWS 52 Reactor shutdown 15.9-52 7.4.1.4 X X X from outside control room 53 Reactor shutdown 15.9-53 9.3.5 X X without control rods CHAPTER 15 15.9-49 REV. 16, SEPTEMBER 2012

LGS UFSAR Table 15.9-6 UNACCEPTABLE CONSEQUENCES CRITERIA PLANT EVENT CATEGORY - NORMAL OPERATION Unacceptable Consequences 1-1 Release of radioactive material to the environs that exceeds the limits of either 10CFR20 or 10CFR50.

1-2 Fuel failure to such an extent that were the freed fission products released to the environs via the normal discharge paths for radioactive material, the limits of 10CFR20 would be exceeded.

1-3 Nuclear system stress in excess of that allowed for planned operation by applicable industry codes.

1-4 Existence of a plant condition not considered by plant safety analyses.

CHAPTER 15 15.9-50 REV. 13, SEPTEMBER 2006

LGS UFSAR Table 15.9-7 UNACCEPTABLE CONSEQUENCES CRITERIA - PLANT EVENT CATEGORY - ANTICIPATED OPERATIONAL TRANSIENTS Unacceptable Consequences 2-1 Release of radioactive material to the environs that exceeds the limits of 10CFR20.

2-2 Reactor operation induced cladding failure.

2-3 Nuclear system stress in excess of that allowed for the transient classification by applicable industry codes.

2-4 Containment stresses in excess of that allowed for the transient classification by applicable industry codes when containment is required.

CHAPTER 15 15.9-51 REV. 13, SEPTEMBER 2006

LGS UFSAR Table 15.9-8 UNACCEPTABLE CONSEQUENCES CRITERIA PLANT EVENT CATEGORY - ABNORMAL OPERATIONAL TRANSIENTS Unacceptable Consequences 3-1 Release of radioactivity which results in dose consequences that exceed a small fraction of 10CFR100; 3-2 Failure of fuel cladding which could cause changes in core geometry such that core cooling would be inhibited; 3-3 Generation of a condition that results in consequential loss of function of the reactor coolant system; 3-4 Generation of a condition that results in a consequential loss of function of a necessary containment barrier; and 3-5 Nuclear system stresses in excess of those allowed for the accident classification by applicable industry codes.

CHAPTER 15 15.9-52 REV. 13, SEPTEMBER 2006

LGS UFSAR Table 15.9-9 UNACCEPTABLE CONSEQUENCES CRITERIA PLANT EVENT CATEGORY - DESIGN BASIS ACCIDENTS Unacceptable Consequences 4-1 Radioactive dose consequence exceeding the values of 10CFR50.67 and Regulatory Guide 1.183; 4-2 Failure of fuel cladding which could cause sufficient changes in core geometry such that core cooling would be inhibited; 4-3 Nuclear system stresses in excess of those allowed for the accident classification by applicable industry codes; 4-4 Containment stresses in excess of those allowed for the accident classification by applicable industry codes when containment is required; and 4-5 Radiation exposure to plant operations personnel in the main control room in excess of 5 rem whole body, 30 rem inhalation, and 75 rem skin.

CHAPTER 15 15.9-53 REV. 14, SEPTEMBER 2008

LGS UFSAR Table 15.9-10 UNACCEPTABLE CONSEQUENCES CONSIDERATIONS PLANT EVENT CATEGORY - SPECIAL EVENTS Special Events Considered A. Reactor shutdown from outside control room.

B. Reactor shutdown without control rods.

C. Reactor shutdown with ATWS.

D. ISFSI Transfer Cask and/or Shipping Cask-Drop.

Capability Demonstration 5-1 Ability to shut down reactor by manipulating controls and equipment outside the main control room.

5-2 Ability to bring the reactor to the cold shutdown condition from outside the main control room.

5-3 Ability to shut down the reactor independent of control rods.

5-4 Ability to contain radiological contamination.

5-5 Ability to limit radiological exposure.

CHAPTER 15 15.9-54 REV. 16, SEPTEMBER 2012

LGS UFSAR Table 15.9-11 BWR OPERATING STATES(1)

States Conditions(2) A B C D Reactor vessel head X X Reactor vessel head on X X Shut down X X Not shut down X X (1)

Further discussion is provided in Section 15.9.6.2.4.

(2)

Shutdown: Keff sufficiently less than 1 that the full withdrawal of any one control rod could not produce criticality under the most restrictive potential conditions of temperature, pressure, core age, and fission product concentrations.

CHAPTER 15 15.9-55 REV. 14, SEPTEMBER 2008

LGS UFSAR 15.10 ACCIDENT DOSE MODEL DESCRIPTIONS 15.10.1 OFFSITE DOSE MODEL This discussion identifies the models used to calculate offsite radiological doses that would result from releases of radioactivity due to various postulated accidents.

The following assumptions are basic to both the model for the whole body dose from immersion in a cloud of radioactivity and the model for the thyroid dose from inhalation of radioactivity:

a. Direct radiation from the source point is negligible compared with whole body radiation due to submersion in the radioactivity leakage cloud.

b. All radioactivity releases are treated as ground level releases regardless of the point of discharge.

c. The dose receptor is a standard man, as defined by the International Commission on Radiological Protection (Reference 15.10-1).

d. Isotopic data, such as decay constants, are taken from the Table of Isotopes (Reference 15.10-2). Table 15.10-1 lists those values.

e. Dose conversion factors are taken from TID-14844 (Reference 15.10-3), Federal Guidance Report 11 (Reference 15.10-16) and from Regulatory Guide 1.109.

Gamma and beta dose conversion factors are found by using the method of Meteorology and Atomic Energy (Reference 15.10-4). Table 15.10-1 lists those values.

15.10.1.1 Whole Body Gamma Dose Calculation of the gamma dose from an extended source, such as a cloud, starts with the consideration that the radiation received by the receptor from a differential area or volume is the same as if it came from a point source. If the dimensions of a homogeneous cloud of gamma-emitting material are large compared with the distance that the gamma rays travel, an equilibrium condition occurs, provided the receptor volume is small. A cloud with these dimensions acts as though the plume were an infinite source of gamma-emitting material. For a receptor at ground level, only half the passing cloud contributes to the gamma dose of the receptor.

The semi-infinite whole body gamma dose as described in Reference 15.10-4 is given by the following equation:

N D = X/Q (DCFi) Qi (EQ. 15.10-1) i=1 where:

D = gamma dose from semi-infinite cloud, rem CHAPTER 15 15.10-1 REV. 13, SEPTEMBER 2006

LGS UFSAR DCFi = gamma dose conversion factor for isotope (i), rem-m3/Ci-sec Qi = source strength for isotope (i), Ci X/Q = atmospheric dilution factor, sec/m3 15.10.1.2 Thyroid Inhalation Dose Assuming the atmospheric dilution factors given in Table 2.3.4-4, the thyroid dose for a given time is obtained from the following equation:

N DT = (X/Q) B Qi DCFi (EQ. 15.10-2) i=1 where:

DT = thyroid inhalation dose, rem X/Q = atmospheric dilution factor, sec/m3 N = number of isotopes B = breathing rate, m3/sec Qi = total activity of iodine isotope (i) released, Ci DCFi = dose conversion factor for iodine isotope (i), rem/Ci The isotopic data and breathing rates are given in Tables 15.10-1 and 15.10-3, respectively.

15.10.1.3 Beta Skin Dose Assuming the atmospheric dilution factor given in Table 2.3.4-4, the dose in air for a semi-infinite cloud of beta radiation is given by:

N D = (X/Q) Qi DCFi (EQ. 15.10-3) i=1 where:

D = beta dose from a semi-infinite cloud, rem X/Q = atmospheric dilution factor, sec/m3 N = number of isotopes Q = source strength for isotope (), Ci DCF1 = dose conversion factor, rem-m3/Ci-sec CHAPTER 15 15.10-2 REV. 13, SEPTEMBER 2006

LGS UFSAR 15.10.2 CONTROL ROOM DOSES 15.10.2.1 Calculation of Control Room X/Q This section describes the governing atmospheric dispersion modeling equations and assumptions in accordance with Draft Regulatory Guide 1111 (Reference 15.10-6). Estimates of atmospheric diffusion (X/Q) are made at the control room intake for releases from the North and South Stacks for periods of 2, 8, and 16 hours0.667 days <br />0.0952 weeks <br />0.0219 months <br /> and for 3 and 26 days. The NRC recommended model, ARCON96, in Reference 15.10-5 is utilized. Since the North and South Stacks are not 2.5 times the height of the adjacent structures, they do not qualify as an elevated release per DG-1111, therefore, ARCON96 is executed in vent release mode. With an assumed zero (0) vertical exit velocity, vent releases are treated as ground-level releases by ARCON96.

15.10.2.1.1 Diffusion Model (excerpted from NUREG/CR-6331 Rev. 1)

The ARCON96 code implements a straight-line Gaussian diffusion model. The basic model for a ground-level release is X 1 y 2

= exp -0.5 (15.10-4a)

Q' yzU y X/Q' = relative concentration (concentration divided by release rate) [(ci/m3)/(ci/s)]

y, z = diffusion coefficients (m)

U = wind speed (mls)

Y = distance from the center of the plume (m)

This equation assumes that the release is continuous, constant, and of sufficient duration to establish a representative mean concentration. It also assumes that the material being released is reflected by the ground. Diffusion coefficients are typically determined from atmospheric stability and distance from the release point using empirical relationships. A diffusion coefficient parameterization from the NRC PAYAN (Reference 15.10-6) and XOQDOQ (Reference 15.10-7) codes is used for y and z.

The diffusion coefficients have the general form

= axb + c were x is the distance from the release point, in meters, and a , b, and c are parameters that are functions of stability. The parameters are defined for 3 distance ranges - 0 to 100 m, 100 to 1000 m, and greater than 1000 m. The parameter values may be found in the listing of Subroutine NSIGMA1 in Appendix A of NUREG/CR-6331 Rev. 1.

Diffusion coefficient adjustments for wakes and low wind speeds are incorporated as follows:

To estimate diffusion in building wakes, composite wake diffusion coefficients, y and z, replace y and z. The composite wake diffusion coefficients are defined by CHAPTER 15 15.10-3 REV. 13, SEPTEMBER 2006

LGS UFSAR 1/2 y = 2 y + y1 2

+ y2 2

(15.10-4b) 1/2 z = z2 + z12 + z22 (15.10-4c)

Where y and z are the normal diffusion coefficients, y1 and z1 are the low wind speed corrections, and y2 and z2 are the building wake corrections. These corrections are described and evaluated in Ramsdall and Fosmire (Reference 15.10-8). The form of the low wind speed corrections is x -x y12 = 9.13 x 105 1 - 1 + exp (15.10-4d) 1000U 1000U x -x z12 = 6.67 x 102 1 - 1 + exp (15.10-4e) 100U 100U Where x is the distance from the release point to the receptor, in meters, and U is the wind speed in meters per second. It is appropriate to use the slant range distance for x because these corrections are made only when the release is assumed to be at the ground level and the receptor is assumed to be on the axis of the plume. The diffusion coefficients corrections that account for enhanced diffusion in the wake have a similar form. These corrections are x -x y22 = 5.24 x 10-2U2A 1 - 1 + exp (15.10-4f) 10A 10A x -x z22 = 1.17 x 10-2U2A 1 - 1 + exp (15.10-4g) 10A 10A Where A is the cross-sectional area of the building.

An upper limit is placed on y as a conservative measure. This limit is the standard deviation associated with a concentration uniformly distributed across a sector with width equal to the circumference of a circle with radius to the distance between the source and receptor. This value is 2x ymax =

CHAPTER 15 15.10-4 REV. 13, SEPTEMBER 2006

LGS UFSAR 12 1.81x (15.1-4h) 15.10.2.1.2 Meteorological Input The 1996-2000 meteorological database utilized in ARCON96 consists of Tower 1 hourly meteorological data observations of 30 and 175 foot wind speed and direction, and 171-26 foot Delta Temperature Stability Class from Tower 2 data were used only for substitution of any missing Tower 1 data as follows:

Instrument Elevations (above tower grade)

Tower 1 (primary) Tower 2 (backup)

(Grade: 250 ft msl) Grade: 121 ft msl)

Wind Speed:

Elevation 1 30 ft 159 ft Elevation 2 175 ft 304ft Wind Direction:

Elevation 1: 30 ft 159 ft Elevation 2: 175ft 304 ft Meteorological Evaluation Services Co., Inc. (MES) illustrated that the Tower 2 delta temperature data are sufficiently representative to be substituted for the Tower 1 delta temperature data; however, since the Tower 1 and Tower 2 delta temperature height intervals differ from each other somewhat, and also since for all years shown, the primary Tower 1 has data recovery rates well above the NRC's 90 percent requirements, it was deemed unnecessary to make such substitutions.

The designation of 'calm' is made to all wind speed observations 0.5 mph or less. The higher of the starting speeds of the Climatronics wind vane and anemometer equipment on each of the towers (i.e., 0.5 mph) was used as the threshold for calm winds, per Regulatory Guide 1.145, Section 1.1 Reference 15.10-9.

15.10.2.1.3 Model Input Parameters The parameters that were input into the ARCON96 model for use in calculating the Control Room X/Q are summarized below:

North Stack South Stack Release Height (m) 61 61 Intake Height (m) 37.8 37.8 Horizontal Distance from 16.5 64.8 Intake to Stack (m)

Elevation Difference between Stack Grade and 0 0 Intake Grade (m)

Building Area (m2) 5851 5851 CHAPTER 15 15.10-5 REV. 13, SEPTEMBER 2006

LGS UFSAR Direction from Intake to 180 180 Stack (o)

Vertical Velocity (m/s) 0 0 Stack Flow (m3/s) 0 0 Stack Radius (m) 0 0 15.10.2.1.4 Control Room X/Q Results A summary of the atmospheric diffusion estimates at the Control Room Intake for releases from the North and South Stacks is shown in Table 15.10-2.

15.10.2.2 Control Room Dose Model The design basis for control room ventilation and shielding design is to limit exposures received by control room operating personnel to 5 rem total effective dose equivalent (TEDE) per 10CFR50.67. This basis is consistent with GDC 19.

The control room shielding is designed to reduce gamma radiation shine from normal and postaccident radiation sources to levels consistent with the requirements of 10CFR20 and GDC 19.

The postaccident ventilation system is designed to preclude entrance of unfiltered air to the control room, and to maintain outleakage of air from this zone with respect to other plant ventilation zones and the air outside the plant.

Details of control room postaccident ventilation system design and instrumentation are discussed in Sections 9.4.1 and 6.4.

During postaccident ventilation system operation, approximately 525 cfm of filtered outside air is supplied to the control room if airborne radioactivity is present outside the control room. If a high radiation accident occurs with the control room in the chlorine isolation mode for testing purposes or as required by the Action statement of an associated Technical Specifications Limiting Condition of Operation, automatic isolation of the control room for high radiation would not occur.

Analysis of the event where the MCR HVAC is in a Chlorine Isolation has determined that the MCR HVAC can be in a chlorine isolation for the first seven hours, before it must be transferred into a Radiation Isolation Mode. This analysis assumes 0 scfm filtered air is supplied to the control room for the first seven hours.

In addition to the intake of air through the filter system, some air may enter the control room from inleakage through duct-work and other sources. An infiltration rate of 225 scfm (215 scfm unfiltered inleakage plus 10 scfm due to control room ingress/egress) has been assumed for these unfiltered sources. An assumed inleakage of 10 scfm through the control room doors has been justified by the use of a MCR door seal. The door seal is designed to be erected when thyroid dose in the Turbine Enclosure reaches 10 Rem/Hr. The design of the MCR door seal ensures a minimum cross sectional area through the door way during egress and ingress to ensure air velocity out of the MCR is sufficient to maintain a clean room environment.

Under accident conditions, radiation doses to control room personnel may come from several sources. While in the control room, personnel are exposed to beta and gamma radiation from gaseous fission products that enter after an accident through the ventilation system, or from CHAPTER 15 15.10-6 REV. 13, SEPTEMBER 2006

LGS UFSAR unfiltered air entering the control room. In addition, personnel are subject to gamma shine dose from fission products in the containment, and from fission products in the atmosphere outside the control room.

To evaluate the capability of the control room ventilation system and shielding to keep personnel doses within the specified criteria, an estimate of the average cloud activity concentration by time period prior to intake into the control room ventilation system was made. Since the plume is released as leakage from the containment, the released fission products were assumed to mix in the structure wake. The atmospheric dilution factors were determined using the assumptions and methods described in Reference 15.10-12.

The time-dependent concentration of activity outside the control structure is found by the following equation:

Co = A (X/Q) (EQ. 15.10-5) where:

A = activity release rate as a function of time, Ci/sec X/Q = atmospheric dilution factor, sec/m3 The activity in the control room is equal to the amount that enters during a given time, plus the amount present at the beginning of the period. The rate at which activity enters the control structure is given by:

Q = 1.7 (F (1.0-E) + F01)Co (EQ. 15.10-6) where:

Q = activity intake rate, Ci/hr F = ventilation flow rate of air into the control room (525 cfm) (0 cfm when control room HVAC system is in chlorine isolation mode)

E = efficiency of the intake filter (95% for iodine, 0% for the noble gases)

F01 = unfiltered air inleakage rate into the control room (225 scfm) (215 scfm unfiltered leakage plus 10 scfm for control room ingress/egress) 1.7 = conversion factor (cfm - 1.7 m3/hr)

Activity buildup in the control room is given by:

dA = Q - (60F + 60F01 + R + O)A (EQ. 15.10-7) dt V V where:

Q = activity intake rate, Ci/hr CHAPTER 15 15.10-7 REV. 13, SEPTEMBER 2006

LGS UFSAR A = activity present in control room, Ci V = control room free volume, ft3 R = Recirculation rate

• filter efficiency V

= (FR)(ER)

• 60 V

O = isotopic decay constant, hrs -1 FR = recirculation rate = 2475 cfm (3000 cfm when control room HVAC is in chlorine isolation mode)

ER = recirculation filter efficiency (95% for iodine, 0% for noble gases)

Equation 15.10-7 can be solved analytically to obtain the activity as a function of time in the control room, A(t), and this integrated over a time period to obtain the time integrated activity inventory in the control room, (I). The time integrated concentration (c) for a given time period is calculated by dividing the inventory (I) by the control room volume. Dose rates in the control room can then be computed by time period.

The whole body dose model for operators inside the control room assumes that the operator is at the center of a finite hemispherical cloud of uniform concentration, whose volume is the same as that of the control room. For a point gamma source, the whole body dose is given by:

Df = D/GF (EQ. 15.10-8) where:

Df = whole body gamma dose, rem/hr D = gamma dose from semi-infinite cloud given by Equation 15.10-10 GF = geometry factor of control room GF = Dose from an infinite cloud (EQ. 15.10-9)

Dose from a cloud of volume (V)

= 1173 V0.338 (Reference 15.10-12)

V = volume of control room, ft3 Whole body doses are given by the equation:

CHAPTER 15 15.10-8 REV. 13, SEPTEMBER 2006

LGS UFSAR N

D = 3600 DCFi Ci (EQ. 15.10-10) i=1 where:

DCFi = whole body gamma dose conversion factor, rem-m3/Ci-sec Ci = activity for isotope (i), Ci-hr/m3 Skin doses from beta radiation are given by the equation:

N Ds = 3600 Ci DCFi (EQ. 15.10-11) i=1 where:

Ds = beta skin dose, rem Ci = activity concentration, Ci-hr/m3 DCFi = beta dose conversion factor, rem-m3/Ci-sec 3600 = conversion from hrs to seconds The beta dose conversion factors are based on the work done by Berger (Reference 15.10-13),

and include the effect of attenuation by the layer of dead skin. Values for these dose conversion factors are given in Table 15.10-1.

The thyroid dose for a given time period is given by the equation:

N Dt = 3600 B Ci DCFi (EQ. 15.10-12) i=1 CHAPTER 15 15.10-9 REV. 13, SEPTEMBER 2006

LGS UFSAR where:

Dt = thyroid inhalation dose, rem B = breathing rate = 3.47x10-4 m3/sec DCFi = thyroid dose conversion factors, rem/Ci Ci = average iodine concentration, Ci-hr/m3 3600 = conversion from hrs to seconds 15.

10.3 REFERENCES

15.10-1 "Report of ICRP Committee II Permissible Dose for Internal Radiation (1959),"

Health Physics, Vol 3, pp 30, 146-153, (1960).

15.10-2 C.M. Leadered, et al, "Table of Isotopes", 6th ed, (1968) (or other recognized references).

15.10-3 J.J. Dinunno, et al, "Calculation of Distance Factors for Power and Test Reactor Sites", TID-14844, (March 1962).

15.10-4 D.H. Slade, ed, "Meteorology and Atomic Energy", TID-2419C, (1968).

15.10-5 "Atmospheric Relative Concentrations in Building Wakes"; NUREG/CR-6331, PNNL-10521, Rev. 1; prepared by J. V. Ramsdell, Jr., C. A. Simmons, Pacific Northwest National Laboratory; prepared for U.S. Nuclear Regulatory Commission; May 1997 (Errata, July 1997).

15.10-6 "Atmospheric Dispersion Code System for Evaluating Accidental Radioactivity Releases from Nuclear Power Stations", PAVAN, Version 2, Oak Ridge National Laboratory, U.S. Nuclear Regulatory Commission, December 1997.

15.10-7 "XOQDOQ: Computer Program for the Meteorological Evaluation of Routine Releases at Nuclear Power Stations"; NUREG/CR-2919; J. F. Sagendorf, J. T.

Goll, and W. F. Sandusky, U.S. Nuclear Regulatory Commission; Washington, D.C; 1982.

15.10-8 "Atmospheric Dispersion Estimates in the Vicinity of Buildings"; J. V. Ramsdell and C. J. Fosmire, Pacific Northwest Laboratory; 1995.

15.10-9 NRC, Regulatory Guide 1.145, "Atmospheric Dispersion Models for Potential Accident Consequence Assessments at Nuclear Power Plants (Revision 1)",

November 1982.

15.10-10 No longer used.

CHAPTER 15 15.10-10 REV. 13, SEPTEMBER 2006

LGS UFSAR 15.10-11 No longer used.

15.10-12 K.G. Murphy and K.M. Campe, "Nuclear Power Plant Control Room Ventilation System Design for Meeting General Criterion 19", 13th AEC Air Cleaning Conference.

15.10-13 M.J. Berger, "Beta Ray Dose in Tissue-Equivalent Material Immersed in a Radioactive Cloud", Health Physics, pp 1-12, (January 1974).

15.10-14 D.S. Duncan and A.B. Speir, "GRACE II - A Program for Computing Gamma Ray Attenuation and Heating in Cylindrical and Spherical Geometrics", Atomics International, (1959).

15.10-15 D.S. Duncan and A.B. Speir, "GRACE I - A Program Designed for Computing Gamma Ray Attenuation and Heating in Reactor Shields", Atomic International, (1959).

15.10-16 Federal Guidance Report Number 11, "Limiting Values of Radionuclides Intake and Air Concentration and Dose Conversion Factor for Inhalation, Submersion and Ingestion, "Office of Radiation Programs USEPA", 1989.

15.10-17 Federal Guidance Report Number 12, "External Exposure to Radionuclides in Air, Water, and Soil", 1993.

CHAPTER 15 15.10-11 REV. 13, SEPTEMBER 2006

LGS UFSAR Table 15.10-2 ACCIDENT ATMOSPHERIC DILUTION FACTORS - X/Q TIME NORTH STACK SOUTH STACK PERIOD X/Q X/Q (hrs) (sec/m3) (sec/m3) 0-2 6.88x10-3 1.26x10-3 2-8 5.17x10-3 9.64x10-4 8-24 2.04x10-3 3.80x10-4 24-96 1.29x10-3 2.39x10-4 96-720 9.63x10-3 1.80x10-4 CHAPTER 15 15.10-13 REV. 14, SEPTEMBER 2008

LGS UFSAR Table 15.10-3 BREATHING RATES FOR OFFSITE DOSE CALCULATIONS TIME PERIOD BREATHING RATE (hr) (m3/sec) 0-8 3.47x10-4 8-24 1.75x10-4 24-720 2.32x10-4 CHAPTER 15 15.10-14 REV. 13, SEPTEMBER 2006

LGS UFSAR 15.11 PROBABILISTIC RISK ASSESSMENT The LGS Probabilistic Risk Assessment was performed as requested by the NRC in its May 6, 1980 letter from D.G. Eisenhut (NRC) to E.G. Bauer, Jr. (PECo). The licensee submitted the PRA to the NRC in its March 17, 1981 letter from E.J. Bradley (PECo) to H.R. Denton (NRC).

CHAPTER 15 15.11-1 REV. 13, SEPTEMBER 2006

LGS UFSAR 15.12 STATION BLACKOUT 15.12.1 REQUIREMENTS AND LIMERICK RESPONSE 10 CFR 50.63 Loss of All Alternating Current Power defines the requirements for the Station Blackout and requires each light-water-cooled nuclear power plant licensed to operate to be able to withstand and recover from a station blackout as defined in 10 CFR 50.2. In 1988, the NRC issued Regulatory Guide 1.155, Station Blackout which describes a means acceptable to the NRC for meeting the requirements of 10 CFR 50.63. This regulatory guide endorses the document issued by the Nuclear Utility Management and Resources Council, NUMARC 87-00, Guidelines and Technical Bases for NUMARC Initiatives Addressing Station Blackout at Light Water Reactors.

LGS Units 1 and 2 were evaluated in accordance with the requirements of the Station Blackout Rule using guidance from NUMARC 87-00, except where RG 1.155 takes precedence. The results of the Limerick analyses and assessments are documented in letters to the NRC (References 15.12-2, 15.12-3, 15.12-4, and 15.12-5). The NRC acceptance of the Limerick responses to the Station Blackout Rule is documented in Safety Evaluation Reports -

(References 15.12-6, and 15.12-7).

15.12.2 DETERMINATION OF REQUIRED COPING DURATION 10CFR50.63 requires that the plant be capable of maintaining core cooling and appropriate containment integrity for the station blackout duration. Section 50.63 further requires the following Information:

• A proposed station blackout duration including a justification for the selection based on the redundancy and reliability of the onsite emergency AC power sources, the expected frequency of the loss of offsite power (LOOP), and the probable time needed to restore offsite power;

• A description of the procedures that will be implemented for station blackout events for the duration (as determined in the paragraph above) and for recovery there from; and a list and proposed schedule for any needed modifications to equipment and associated procedures necessary for the specified SBO duration.

The required coping duration category is based upon the following factors:

1. Offsite Power Design - NUMARC 87-00 distinguishes between sites having particular susceptibilities to losing off-site power to plant-centered, grid-related, and weather-related events. Three off-site power design groups are provided and are designed to be mutually exclusive. Of the three groups P2 includes those sites whose off-site power sources are less redundant or independent, or that are more susceptible to extended offsite power losses due to weather-initiated events or more frequent losses due to plant-centered events. Based upon NUMARC 87-00 guidance, Limerick Generating Station is determined to be in AC Power Design Characteristic Group, P2. This determination is based upon the following criteria of NUMARC 87-00.

a) The expected frequency of grid-related loss of offsite power (LOOP) does not exceed once per twenty years. As discussed in Limerick Generating Station UFSAR Section CHAPTER 15 15.12-1 REV. 16, SEPTEMBER 2012

LGS UFSAR 15.2.6, the loss of all grid connections is categorized as an incident of moderate frequency.

b) Sites are categorized in groups based upon the estimated frequency of LOOPs due to Extremely Severe Weather. The estimated frequency of loss of off-site power due to ESW is determined by the annual expectation of storms at the site with wind velocities greater than or equal to 125 mph. It has been determined that Limerick Generating Station falls within Extremely Severe Weather Group 3. This was determined utilizing Table 3-1, Extremely Severe Weather Groups Table and Table Extremely Severe Weather Data provided in NUMARC 87-00.

c) The estimated frequency of LOOPs due to severe weather places Limerick Generating Station in Severe Weather Group 2 based on site specific factors. This was determined utilizing Table 3-3, Severe Weather Data and Table 3-4, Severe Weather Group Table provided in NUMARC 87-00.

d) The potential for long duration loss of off-site power events can have a significant impact on station blackout risk and required coping duration. Long duration LOOP events are associated with grid failures due to severe weather conditions or unique transmission system features. Shorter duration LOOP events tend to be associated with specific switchyards features, in particular:

1) The independence of the off-site power source constituting the preferred power supply to the shutdown buses on-site, and

2) The power transfer schemes when the normal source of AC power is lost.

Limerick Generating Station has two off-site power systems that provide the preferred AC electrical power to all Class 1E loads as discussed in UFSAR Chapter 8 (NUMARC 87-00 Group A).

Limerick Generating Station also has two electrically-connected switchyards, and all safe shutdown busses are automatically transferred to the alternate power source on loss of the preferred source (NUMARC-87-00 Group 1 1/2).

2. Onsite Emergency AC (EAC) Power Configuration - After the likelihood of losing off-site power, the redundancy of the emergency AC power system is the next most important contributor to station blackout risk. With greater EAC system redundancy, the potential for station blackout diminishes, as does the likelihood of core damage. Each Limerick unit is equipped with four emergency diesel generators (EDG). Anyone of the EDGs is necessary to operate safe-shutdown equipment at either unit following a loss of offsite power for an extended period.

It is noted that the total shutdown-load requirements for both units combined is greater than the continuous rating of one EDG in each unit and that a minimum of three EDGs are required to support simultaneous shutdown of the two units. Limerick credits excess capacity from the non-blacked out (NBO) unit as the alternate AC (AAC) power source for the blacked out (BO) unit. Limerick does not rely on a single EDG from the NBO unit as the AAC source for the BO unit. Also, a limited amount of operator actions are credited to initiate cross-ties between electrical power sources in order to justify the excess capacity from the NBO unit's EDGs.

Shutdown-load requirements are such that the capacity of three EDGs is needed to shutdown CHAPTER 15 15.12-2 REV. 16, SEPTEMBER 2012

LGS UFSAR the two units following a LOOP. For any Individual unit, the shutdown loads will require the capacity of more than one EDG. Thus, two are the minimum required number of EDGs per unit. Since two of the four EDGs per unit are needed for shutdown, making the EAC classification of EAC Group B per NUMARC 87-00, Table 3-7.

a) Calculated EDG Reliability - The target emergency diesel generator reliability for Limerick Station is selected to be 0.95. The selection of this value is consistent with NUMARC 87-00 and is based upon having a nuclear unit average reliability for the last 100 demands greater than 0.95.

b) Allowed EDG Reliability - An EDG reliability program has been established to monitor and maintain the EDG target reliability of 0.95 utilizing guidance in RG 1.155, Regulatory Position C.1.2. If the EDG performance falls below the target reliability level of 0.95, action will be taken as required by the EDG reliability program to restore the affected EDG to the target reliability level.

In summary, using the above factors, LGS is a four hour coping duration plant per Table 3-8 in NUMARC 87-00 (Table 2 in RG 1.155).

15.12.3 USE OF ALTERNATE AC SOURCE The LGS offsite power supplies, the station auxiliary power system, and the onsite 4 kV Safeguard Power System are shown in Drawings E-1, E-15 and E-16. At Limerick, Station Blackout is supported by the use of the diesel generators (excess capacity on non-blacked out unit) as an alternate ac (AAC) power source required to be available within one hour from the initiation of a station blackout event to support safe shutdown and decay heat removal from the blacked out unit for the required four hour coping duration. The potential for excess EAC power sources to be used as AAC is directly related to the existing level of EAC redundancy.

Each Limerick unit is equipped with four emergency diesel generators (EDGs). Any one of the EDGs is necessary to operate safe-shutdown equipment at either unit following a loss of offsite power for an extended period. It is noted that the total shutdown-load requirements for both units combined is greater than the continuous rating of one EDG in each unit and that minimum of three EDGs are required to support simultaneous shutdown of the two units. The AAC design at Limerick Generating Station uses a limited amount of operator actions to initiate electrical cross-ties between power sources in order for the blacked-out (BO) unit to utilize the excess capacity from the NBO EDGs.

There are a number of mechanical systems at LGS whose functions are normally shared between units (e.g., Residual Heat Removal Service Water (RHRSW), and Emergency Service Water (ESW)). Accordingly, the loads for certain of these systems were assumed to be powered by the adjacent unit's power source. Due to the assumed loss of one of the NBO diesels, there is some likelihood that the failed EDG will power an ESW pump and that only one ESW loop will be available in the initial few minutes of the SBO event. The ESW loop will be restored during the cross-tie of the NBO 4kV busses. After the busses are cross-tied, ESW will be restored and the third diesel on the NBO can be restarted to support the BO unit shutdown loads. This is intended to be performed during the first 60 minutes of the SBO event.

For LGS Units 1 and 2, the AAC power source satisfies the requirements for station blackout in conformance with Regulatory Guide 1.155.

CHAPTER 15 15.12-3 REV. 16, SEPTEMBER 2012

LGS UFSAR 15.12.4 ASSESSMENT OF ABILITY TO COPE WITH A STATION BLACKOUT Coping with station blackout using the AAC approach entails a short period of time in an ac-independent state (up to one hour) while the operators initiate power from the AAC source.

Once AAC power is available, the plant transitions to the AAC source which provides decay heat removal until offsite or EAC power becomes available. Therefore, the LGS coping assessments must address the four hour coping duration but certain safe shutdown equipment such as RHR pumps, air compressors, and battery chargers can be repowered after the first hour and used for the remainder of the coping duration. Coping assessments were performed in the following areas: condensate inventory, Class 1E battery capacity, compressed air, loss of ventilation, and containment isolation. In each case, capability to successfully cope with blackout for the four hour period was demonstrated.

15.12.4.1 Condensate Inventory for Decay Heat Removal A supply of 92,100 gallons of water is required for decay-heat removal during a SBO 4-hour coping period. A calculation was performed to show that the Condensate Storage Tank (CST) provides 138,800 gallons of water, which exceeds the required quantity for coping with a four-hour station blackout. A leakage rate of 25 gpm per recirculation pump was assumed in the calculated analysis. Since the AAC power source will be available within one hour, the residual heat removal (RHR) system would be powered to provide suppression pool cooling. Therefore, the CST inventory will not be required at any time during the four-hour duration of the SBO event. The calculation demonstrates the acceptability of using only the suppression pool inventory for reactor pressure vessel (RPV) makeup and reactor heat removal. No credit for the water volume has been taken in the SBO analysis and the CST inventory is available as an additional heat removal source.

15.12.4.2 Class 1E Battery Capacity The Class 1E battery bank has sufficient capacity to independently supply the required loads for a design basis accident for 4 hours0.167 days <br />0.0238 weeks <br />0.00548 months <br />. The SBO loads are a subset of the design basis accident loads, the station battery capacity is sufficient to meet SBO shutdown requirements for 4 hours0.167 days <br />0.0238 weeks <br />0.00548 months <br />.

At 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> into the SBO event, with the AAC power source available, the ability to power selected battery chargers is available.

15.12.4.3 Compressed Gas The AAC power source is capable of energizing an instrument air compressor and an instrument gas compressor within one hour of a station blackout. The only air-operated valves relied upon during a station blackout are the Automatic Depressurization System (ADS) valves.

These valves have sufficient backup gas supplies to cope with a station blackout for the entire event and sufficient local gas supply is available such that reliance of the air compressor after an hour is not needed. Valves requiring manual operation or that need backup sources will be identified in station procedures.

15.12.4.4 Effects of Loss Of Ventilation Reasonable assurance of operability is established if the following criteria are met:

CHAPTER 15 15.12-4 REV. 16, SEPTEMBER 2012

LGS UFSAR

1) The temperature in the Dominant Area of Concern (DAC) are calculated to be equal to or less than 120, or

2) The system in the DAC is assumed to operate no longer than 10 minutes after the onset of the blackout, or

3) The methodology outlined in Appendix F of NUMARC 87-00 indicates that no components in the DAC have operability limits below the calculated bulk room temperature.

At Limerick Generating Station, the AAC power supply does not power cooling loads to some plant areas that contain station blackout response equipment during the hour after the onset of the station blackout event. Evaluation of the following specific areas was performed Units 1 and 2 APRM Inverters (Aux Equip Rm), Unit 2 RPS computer and Inverter rooms, RCIC Pump Room, Drywell and Main Control Room. These areas have been evaluated to establish reasonable assurance of operability for station blackout event.

15.12.4.5 Containment Isolation The station list of containment isolation valves has been reviewed to verify that the valves which must be capable of being closed or that must be operated (cycled) under station blackout conditions can be positioned (with indication) independent at the preferred and black-out unit's Class 1E power supplies.

No plant modifications were determined to be required to ensure that appropriate containment integrity can be provided under SSO conditions. Limerick Generating Station procedures include all actions necessary to assure containment integrity.

15.12.4.6 Reactor Coolant Inventory Adequate reactor coolant system (RCS) inventory is maintained to ensure core cooling for 4-hour duration. HPCI and RCIC system are capable at supplying sufficient inventory to keep the core covered. RCS makeup is necessary to remove decay heat, to compensate for RCS cool down, and to replenish an assumed RCS inventory loss of 50 gpm due to the reactor coolant pump seal leakage (25 gpm per pump) and to provide for Technical Specification maximum allowable leakage (30 gpm). The RCIC pump, which is steam-driven, injects at a rate of 600 gpm, which exceeds the average water injection rate necessary for decay heat removal and the 80 gpm leak rate.

The AAC source powers the necessary make-up systems within 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> to maintain adequate RCS inventory to ensure that the core is cooled for the required coping duration. The expected rates of reactor coolant inventory loss under SBO conditions do not result in uncovering the core in an SBO of four hours.

15.12.5 PROCEDURES FOR SBO Limerick Generating Station procedures comply with the guidelines of NUMARC 87-00, Section

4. SBO response guidelines provide for operator actions to be taken in a SBO event; guidance is provided to operations and load dispatcher personnel for actions to restore AC power in a station blackout; and guidance is given for operators to determine the proper actions due to the CHAPTER 15 15.12-5 REV. 16, SEPTEMBER 2012

LGS UFSAR onset severe weather. During the SBO event, for the NBO unit, excess capacity is not attained by load shedding. This ensures that there is no degradation of the normally available shutdown capability for the LOOP condition. Additionally, there is no load switching or disablement of information readouts or alarms in the main control room that would degrade the normal shutdown capability for a LOOP in the NBO unit. Limerick Generating Station procedures incorporate these guidelines and are described as follows:

Procedure E Loss of All AC Power (Station Blackout)

Procedure E-10/20 - Loss of Offsite Power Verifies Containment Isolation Valves Procedure SE Preparation for Severe Weather 15.

12.6 REFERENCES

15.12-1 NUMARC 87-00, "Guidelines and Technical Bases for NUMACR initiatives Addressing Station Blackout at Light Water Reactors."

15.12-2 Letter to NRC Document Control Desk from G. A. Hunger dated April 17, 1989, Limerick Generating Station, Units 1 and 2, Response to 10CFR50.63, "Loss of All Alternating Current Power" (DCS Sequence # 2890013820).

15.12-3 Letter to NRC Document Control Desk from G. A. Hunger dated April 9, 1990, Limerick Generating Station, Units 1 and 2, 10CFR50.63, "Loss of All Alternating Current Power" Supplemental Information (DCS Sequence # 2906110880).

15.12-4 Letter to NRC Document Control Desk from G.J. Beck dated September 4, 1991, Limerick Generating Station, Units 1 and 2, 10CFR50.63, "Loss of All Alternating Current", Response to NRC Safety Evaluation (DCS Sequence # 2916033730).

15.12-5 Letter to NRC Document Control Desk from G.J. Beck dated February 14, 1992, Limerick Generating Station, Units 1 and 2, 10CFR50.63, "Loss of All Alternating Current, Response to NRC Concerns (DCS Sequence # 2924001490).

15.12-6 Safety Evaluation by the Office of Nuclear Reactor Regulation, Station Blackout Safety Evaluation, Philadelphia Electric Company, Limerick Generating Station, Units 1 and 2, Docket Nos. 50-352/353, dated June 3, 1991 (DCS Sequence #

2916024860).

15.12-7 Supplemental Safety Evaluation by the Office of Nuclear Reactor Regulation, Station Blackout Rule (10CFR50.63), Philadelphia Electric Company, Limerick Generating Station, Units 1 and 2, Docket Nos. 50-352/353, dated June 10, 1992 (DCS Sequence # 2920013850).

CHAPTER 15 15.12-6 REV. 16, SEPTEMBER 2012

LGS UFSAR APPENDIX 15B 15B.ii REV. 18, SEPTEMBER 2016

LGS UFSAR APPENDIX 15B - RELOAD EVALUATIONS LIST OF TABLES Table Title 15B-1 Deleted 15B-2 Deleted 15B-3 Deleted APPENDIX 15B 15B.iii REV. 18, SEPTEMBER 2016

LGS UFSAR APPENDIX 15B - RELOAD EVALUATIONS LIST OF FIGURES Figure Title 15B-1 Deleted 15B-2 Deleted 15B-3 Deleted 15B-4 Deleted 15B-5 Deleted 15B-6 Deleted APPENDIX 15B 15B.iv REV. 18, SEPTEMBER 2016

LGS UFSAR APPENDIX 15B Limerick Generating Station, (LGS) Units 1 and 2 15B.0 INTRODUCTION This appendix summarizes the analyses performed in support of the LGS Units 1 and 2 operating power/flow map expansion and the contingency mode of operation with selected individual equipment out-of-service. The maximum extended operating domain consists of the maximum extended load line region and the increased core flow region. The equipment out-of-service analyses include turbine bypass system, feedwater heaters, end-of-cycle recirculation pump trip and single recirculation loop operation. The power/flow map expansion and equipment out-of-service analyses assume the rerate thermal power of 3458 MWt (References 1 through 6).

TRACG implementation analyses results (References 7 and 8) are based on a thermal power of 3,515 MWt.

15B.1 MAXIMUM EXTENDED OPERATING DOMAIN AND PARTIAL FEEDWATER HEATING ANALYSIS This analysis justifies the operation of LGS Units 1 and 2 in the maximum extended operating domain described in Figure 15.0-1. The safety impact evaluation of this extended region was performed with partial feedwater heating.

15B.1.1 MAXIMUM EXTENDED LOAD LINE LIMIT REGION The maximum extended load line limit (MELLL) region is defined as a power/flow operating domain bounded by:

a. 100% rated power.

b. the load line which intercepts 100% power, and

c. 100% rated rod line.

MELLL improves operational flexibility during power ascension by providing additional operating room above the original rated load line. It also provides a lower core flow condition at a rated power to allow for flow control reactivity compensation due to fuel burnup during an operating cycle and for improved fuel cycle economics.

The extended power/flow region has been created to provide relief from the operating restrictions inherently imposed during ascension to power by the previous power/flow region. The MELLL boundary (% core flow at the 100% rerated core power) was determined generically, based on safety and evaluations performed to meet required thermal and reactivity margins for BWR plants.

When compared to the initial power/flow operating domain, operating in the MELLL region results in plant operation at a higher load line, which allows for higher core power at a given core flow.

This condition increases the fluid subcooling in the downcomer region of the reactor vessel which affects the power distribution in the core and potentially affects steady-state operating thermal limits and transient accident/performances. The impact of this operating mode was evaluated to ensure safe plant operation.

The evaluations to support this operational domain at the rerated condition of 3458 Mwt are documented in Reference 1 and 6. The MELLL analyses also considered the equipment out-of-service assumptions.

APPENDIX 15B 15B.1 REV. 19, SEPTEMBER 2018

LGS UFSAR 15B.1.2 INCREASED CORE FLOW/FINAL FEEDWATER TEMPERATURE REDUCTION REGION The increased core flow (ICF) region (Figure 15.0-1) is defined as a power/flow operating domain bounded by:

a. 100% rated power.

b. 110% rated core flow, and

c. 100% rated core flow.

The ICF region is a feature that improves operational flexibility during power ascension by providing additional flow range at rated power to compensate for xenon variations during power changes. The ICF capability provides reactivity compensation due to fuel burnup during an operation cycle and additional reactivity to extend an operating cycle to improve fuel cycle economics.

The safety evaluation addresses ICF operation throughout the cycle, and ICF with Final Feedwater Temperature Reduction (FFWTR) during end-of-cycle extension and power coastdown. The amount of FFWTR considered in the analysis corresponds to a reduction of 105F from the nominal feedwater temperature conditions.

Limiting transients events were performed at the bounding condition of 110% of rated core flow, and the results are documented in Reference 3. These ICF/FFWTR evaluations also included various equipment out-of-service such as the turbine bypass system, and the end-of-cycle recirculation pump trip.

15B.1.3 FEEDWATER HEATING OUT-OF-SERVICE Feedwater heating out-of-service (FWHOOS) is defined as operation with feedwater heaters out-of-service, corresponding to operation with a reduction in feedwater temperature of up to 60F from nominal.

The FWHOOS feature provides potential improved plant availability by allowing continued unrestricted plant operation with feedwater heaters out-of-service.

The FWHOOS analysis was performed for a core thermal power of 3458 MWt, using the LGS expanded operating domain. The results are described in References 4 and 5.

15B.2 ARTS PROGRAM The ARTS program is a performance improvement feature which updates fuel thermal limits administration at partial power/flow conditions, improves instrumentation response and increases plant operating flexibility and efficiency.

ARTS provides limits for MCPR and MAPLHGR as a function of power and flow to better ensure fuel cladding integrity. It also modifies the basis of rod block monitor trips to terminate excessive reactivity insertions during rod withdrawal error events. The original flow-biased rod block monitor trips are replaced by local power biased trips.

APPENDIX 15B 15B.2 REV. 19, SEPTEMBER 2018

LGS UFSAR The ARTS analyses (References 2 and 6) were performed at the rerated power level of 3458 MWt and a maximum core flow of 110% of rated. The analysis also assumes equipment out-of-service such as turbine bypass and end-of-cycle recirculation pump trip and single loop operation. The results are summarized in Reference 2 for all equipment in-service and in Reference 6 for the equipment out-of-service conditions.

15B.3 SINGLE LOOP OPERATION Single Loop Operation (SLO) at a reduced power is a valuable feature from a plant availability/outage standpoint. The capability to operate with a single recirculation loop is highly desirable in the event that a recirculation pump or other component renders one loop inoperable.

The analyses necessary to justify SLO operation are evaluated in Reference 2.

15B.4 OTHER EQUIPMENT OUT-OF-SERVICE In addition to the FWHOOS feature, LGS also has the turbine bypass system out-of-service (TBSOOS) and the end-of-cycle recirculation pump trip out-of-service (EOC-RPTOOS) features.

Subsequent to the analysis supporting power/flow map expansion, an additional equipment out-of-service feature, power load unbalance out-of-service (PLUOOS), was implemented.

15B.4.1 TURBINE BYPASS SYSTEM OUT-OF-SERVICE Turbine bypass operation has a significant impact on the severity of fast pressurization events. Of these AOOs, the turbine trip no bypass (TTNBP) and load rejection no bypass (LRNBP) events already exclude the turbine bypass operation from their licensing event basis assumptions. The feedwater controller failure (FWCF) normally evaluated with an operable bypass system is therefore re-analyzed without the turbine bypass function.

The TBSOOS option was integrated in the power/flow map expansion and performance improvement programs (including power rerate) previously described. The results of the Anticipated Operating Occurrences (AOO) analysis with TBSOOS are described in Reference 1.

Turbine Bypass System OOS may be referred to as Turbine Bypass Valve (TBVOOS) in some documentation. Starting with Limerick 2 Cycle 14, "TBVOOS" was changed to be referred to as "TBSOOS" to reflect that the bypass valves are assumed to be unable to provide pressure control, and so transients that rely on the bypass system for pressure control (e.g., rod withdraw error), are analyzed accordingly for the TBSOOS condition.

15B.4.2 END-OF-CYCLE RECIRCULATION PUMP TRIP OUT-OF-SERVICE The purpose of the end-of-cycle recirculation pump trip (EOC-RPT) is to protect the integrity of the fuel cladding during fast pressurization transients, especially turbine generator trips. It supplements the reactor scram function during these events. The trip of the reactor recirculation pumps early in these transient events decreases the magnitude of the power excursion by adding negative reactivity to the core, consequently resulting in lower thermal operating limits.

For the power/flow map expansion and equipment-out-of-service features previously described, both the limiting TTNBP and FWCF events are analyzed with the EOC-RPTOOS option. The results of these analyses are described in Reference 1.

APPENDIX 15B 15B.3 REV. 19, SEPTEMBER 2018

LGS UFSAR 15B.4.3 POWER LOAD UNBALANCE OUT-OF-SERVICE The purpose of the power load unbalance (PLU) is to prevent turbine over-speed in the event of a load rejection. The PLU prompts the fast closure of the turbine control valves when an unbalance is detected while operating above 55% power. With the PLUOOS, a load rejection event will not cause fast closure of the TCVs. A backup trip from the generator protection system logic is credited and results in a turbine trip signal.

15B.4.4 PRESSURE REGULATOR OUT-OF-SERVICE The purpose of the Pressure Regulator Out-of-Service (PROOS) is to support operation when one pressure regulator is out-of-service and the system is no longer single failure proof. Failure of a pressure regulator downscale, when there is no second pressure regulator operable will cause slow closure of the turbine control valves. This event can require more limiting thermal limits.

The results of these analyses are described in References 7 and 8 and/or included as part of the cycle-specific reload analysis.

15B.5

SUMMARY

AND CONCLUSION Specific analyses have been performed to determine the impact of LGS plant operation with the above specified reactor performance improvements. The results demonstrate that all licensing basis criteria for the required safety analyses are acceptable. These include the following analysis evaluations.

a. Anticipated Operational Occurrences (AOOs) Analysis

b. Loss-Of-Coolant Analysis

c. Containment Response

d. Reactor Vessel and Internals Mechanical Integrity

e. Miscellaneous Impact Verifications (e.g. Anticipated Transients Without Scram).

The AOOs analyses are cycle-specific and are reanalyzed during subsequent fuel cycles as part of the reload licensing scope of work. The LOCA analysis is fuel type specific and is evaluated or reanalyzed as required. The containment dynamic loads, reactor internal components structural integrity and the miscellaneous analyses are cycle-independent. These tasks are performed during the initial application of the performance improvement programs and remain valid for subsequent fuel reloads, unless the analyses boundaries and/or analytical assumptions are subsequently changed.

15B.6 REFERENCES

1. GE Nuclear Energy, "Power Rerate Safety Analysis Report" for Limerick Generating Station Units 1 and 2, Licensing Topical Report NEDC-32225P, Class III (Proprietary), September 1993.

APPENDIX 15B 15B.4 REV. 19, SEPTEMBER 2018

LGS UFSAR

2. GE Nuclear Energy, "Maximum Extended Load Line Limit and ARTS Improvement Program Analyses" For Limerick Generating Station Units 1 and 2, NEDC-32193P (Revision 2), October 1993.

3. GE Nuclear Energy, "Safety Review for Limerick Generation Station Units 1 and 2- 110%

Increased Core Flow Operation and Final Feedwater Temperature Reduction' NEDC-32224P (Revision 1), October 1993.

4. GE Nuclear Energy, "Increased Core Flow and Partial Feedwater Heating Analysis" for Limerick Generation Station Unit 1 Cycle NEDC-31323, October 1986.

5. GE Nuclear Energy, "Impact of Power Rerate and Final Feedwater Temperature Reduction (FFWTR) or Limerick Feedwater Nozzle Fatigue," GE-Ne-523-102-0793, July 27, 1993.

6. GE-NE letter/Report transmittal to PECO, (G93-PEPR-327) Subject "Limerick ARTS Application with Equipment Out-of-service (EOOS)", December 10, 1993.

7. GE Hitachi Nuclear Energy, "Limerick Generating Station Units 1 and 2 TRACG Implementation for Reload Licensing Transient Analysis," 0000-0137-9500-R1, October 2017.

8. GE Hitachi Nuclear Energy, "Limerick Generating Station (LGS) Units 1 and 2 TRACG Cycle-Independent PROOS Analysis Report," 002N4397-R1, January 2016.

APPENDIX 15B 15B.5 REV. 19, SEPTEMBER 2018