Text

Final Safety Analysis Report Update, Revision 32, Chapter 14 - Safety Analysis - Sections
	ML16123A320
Person / Time
Site:	Palisades
Issue date:	04/18/2016
From:	; Entergy Nuclear Operations
To:	; Office of Nuclear Reactor Regulation
Shared Package
ML16120A302	List: ML16120A321; ML16120A325; ML16120A326; ML16120A327; ML16120A344; ML16120A345; ML16120A347; ML16120A359; ML16120A360; ML16120A361; ML16120A362; ML16120A379; ML16120A380; ML16120A381; ML16120A382; ML16120A415; ML16120A416; ML16120A417; ML16120A419; ML16120A420; ML16120A421; ML16120A571; ML16120A573; ML16120A574; ML16120A575; ML16120A588; ML16120A589; ML16120A590; ML16120A591; ML16120A596; ML16120A597; ML16120A598; ML16120A599; ML16120A602; ML16120A603; ML16120A604; ML16120A608; ML16120A609; ML16120A610; ML16123A314; ML16123A315; ML16123A316; ML16123A320; ML16123A321; ML16123A326; ML16123A328; ML16123A329; ML16126A109; PNP 2016-015, Final Safety Analysis Report Update, Revision 32, Table of Contents;
References
	PNP 2016-015
	Download: ML16123A320 (171)
	v • d • e

FSAR CHAPTER 14 - SAFETY ANALYSISRevision 30SECTION 14.17 Page 14.17-1 of 14.17-1614.17 LOSS OF COOLANT ACCIDENT14.17.1 LARGE BREAK LOCA (LBLOCA)14.17.1.1 Event DescriptionA Large Break Loss of Coolant Accident (LBLOCA) is initiated by apostulated large rupture of the Primary Coolant System (PCS) piping. Basedon deterministic studies, the worst break location is in the cold leg pipingbetween the Primary Coolant Pump (PCP) and the reactor vessel for the PCS loop containing the pressurizer. The break initiates a rapid depressurizationof the PCS. A reactor trip signal is initiated when the low pressurizerpressure trip setpoint is reached; however, the reactor trip is conservatively neglected in the analysis. The reactor is shut down by coolant voiding in the core.The plant is assumed to be operating normally at full power prior to theaccident. The large cold leg break is assumed to open instantaneously. Forthis break, a rapid primary system depressurization occurs, along with a coreflow stagnation and reversal. This causes the fuel rods to experienceDeparture from Nuclear Boiling (DNB). Subsequently, the limiting fuel rodsare cooled by film convection to steam. The coolant voiding creates a strongnegative reactivity effect and core fission ends. As heat transfer from the fuelrods is reduced, the cladding temperature rises.Coolant in all regions of the PCS begins to flash. At the break plane, the lossof subcooling in the coolant results in substantially reduced break flow. Thisreduces the depressurization rate and may also lead to a period of positivecore flow or reduced downflow as the PCPs in the intact loops continue tosupply water to the vessel. Cladding temperatures may be reduced andsome portions of the core may rewet during this period.This positive core flow or reduced downflow period ends as two-phaseconditions occur in the reactor coolant pumps, reducing their effectiveness.

Once again, the core flow reverses as most of the vessel mass flows out through the broken cold leg.Mitigation of the LBLOCA begins when the Safety Injection ActuationSignal (SIAS) is tripped. This signal is initiated by either high containmentpressure or low pressurizer pressure. Regulations require that a worst activesingle-failure be considered for Emergency Core Cooling System (ECCS) safety analysis. This worst active single failure was determined generically inthe Realistic Large Break LOCA (RLBLOCA) evaluation model (Reference 5)to be the loss of one ECCS train. The AREVA NP RLBLOCA methodology conservatively assumes a minimal time delay and a normal (no failure irrespective of the assumed worst single active failure) lineup of thecontainment sprays and fan coolers to reduce containment pressure and FSAR CHAPTER 14 - SAFETY ANALYSISRevision 30SECTION 14.17 Page 14.17-2 of 14.17-16increase break flow. The analysis assumes that one High Pressure SafetyInjection (HPSI) pump, one Low Pressure Safety Injection (LPSI) pump, all containment spray pumps and all containment fan coolers are operational.When the PCS pressure falls below the Safety Injection Tank (SIT) pressure,borated water from the SITs is injected into the cold legs. In the early deliveryof SIT water, high pressure and high break flow will cause some of this fluidto bypass the core. During this bypass period, core heat transfer remains poor and fuel rod cladding temperatures increase. As PCS and containmentpressures equilibrate, ECCS water begins to fill the lower plenum andeventually the lower portions of the core. This improves core heat transfer and cladding temperatures begin to decrease.Eventually, the relatively large volume of SIT water is exhausted and corerecovery relies solely on ECCS pumped injection. As the SITs empty, thenitrogen gas used to pressurize the SITs exits through the break. This gasrelease may result in a short period of improved core heat transfer as thenitrogen gas displaces water in the downcomer. After the nitrogen gas isexpelled, the ECCS may not be able to sustain full core cooling temporarily because of the core decay heat and the higher steam temperatures createdby quenching in the lower portions of the core. Peak fuel rod claddingtemperatures may increase for a short period until additional energy isremoved from the core by the LPSI and the decay heat continues to fall.Steam generated from fuel rod rewet will entrain liquid and pass through the core, vessel upper plenum, the hot legs, the steam generator and the PCPbefore it is vented out the break. The resistance of this flow path to the steamflow (including steam binding effects) is balanced by the driving force ofwater filling the downcomer. This resistance (steam binding) may act toretard the progression of core reflooding and postpone core-wide cooling.Eventually (within a few minutes of the accident), core reflooding willprogress sufficiently to ensure core-wide cooling. Full core quench occurswithin a few minutes after core-wide cooling. Long-term cooling is then sustained with the LPSI.The purpose of the RLBLOCA analysis is to demonstrate that the followingcriteria of 10 CFR 50.46(b) (Reference 11) are met:1.The calculated maximum fuel element cladding temperature shall notexceed 2,200

°F.2.The calculated total oxidation of the cladding shall nowhere exceed0.17 times the total cladding thickness before oxidation.3.The calculated total amount of hydrogen generated from the chemicalreaction of the cladding with water or steam shall not exceed 0.01times the hypothetical amount that would be generated if all of the FSAR CHAPTER 14 - SAFETY ANALYSISRevision 30SECTION 14.17 Page 14.17-3 of 14.17-16metal in the cladding cylinders surrounding the fuel excluding thecladding surrounding the plenum volume were to react.14.17.1.2 Thermal Hydraulics Analysis 14.17.1.2.1Analysis MethodThe RLBLOCA methodology is documented in topical report EMF-2103,Realistic Large Break LOCA Methodology (Reference 5). The methodologyfollows the Code Scaling Applicability and Uncertainty (CSAU) evaluation methodology (Reference 6). This method outlines an approach for definingand qualifying a best-estimate thermal-hydraulic code and quantifies theuncertainties in a LBLOCA analysis.The RLBLOCA methodology uses the following computer codes:

RODEX3A for computation of the initial fuel stored energy, fission gasrelease, and fuel-cladding gap conductance.

S-RELAP5 for the system calculation, including the containment pressure response.The governing two-fluid (plus non-condensibles) model with conservation equations for mass, energy and momentum transfer is used. The reactor coreis modeled in S-RELAP5 with heat generation rates determined from reactorkinetics equations (point kinetics) with reactivity feedback, and with actinide and decay heating.The two-fluid formulation uses a separate set of conservation equations andconstitutive relations for each phase. The effects of one phase on anotherare accounted for by interfacial friction, and heat and mass transferinteraction terms in the equations. The conservation equations have the same form for each phase; only the constitutive relations and physicalproperties differ.The modeling of plant components is performed by following guidelinesdeveloped to ensure accurate accounting for physical dimensions and thatthe dominant phenomenon expected during an LBLOCA event are captured.

The basic building block for modeling is the hydraulic volume for fluid paths and the heat structure for a heat transfer surface. In addition, special purposecomponents exist to represent specific components such as the pumps or thesteam generator separators. All geometries are modeled at a level of detail necessary to best resolve the flow field and the phenomena being modeledwithin practical computational limitations.A typical calculation using S-RELAP5 begins with the establishment of asteady-state initial condition with all loops intact. The input parameters and FSAR CHAPTER 14 - SAFETY ANALYSISRevision 30SECTION 14.17 Page 14.17-4 of 14.17-16initial conditions for this steady-state calculation are chosen to reflect planttechnical specifications or to match measured data. Additionally, the RODEX3A code provides initial conditions for the S-RELAP5 fuel models.Following the establishment of an acceptable steady-state condition, thetransient calculation is initiated by introducing a break into one of the loops(specifically, the loop with the pressurizer). The evolution of the transientthrough blowdown, refill, and reflood is computed continuously using S-RELAP5. Transient containment pressure is also calculated by S-RELAP5using containment models derived from the CONTEMPT-LT code (Reference 7).The methods used in the application of S-RELAP5 to the LBLOCA aredescribed in Reference 5. A detailed assessment of this computer code wasmade through comparisons to experimental data, with many benchmarks withcladding temperatures ranging from 1,700 °F (or less) to above 2,200 °F.These assessments were used to develop quantitative estimates of the abilityof the code to predict key physical phenomena in a PWR LBLOCA. Variousmodels, for example, the core heat transfer, the decay heat model and the fuel cladding oxidation correlation, are defined based on code-to-datacomparisons and are, hence, plant independent.The RV internals are modeled in detail based on specific inputs supplied byEntergy. Nodes and connectivity, flow areas, resistances and heat structures are all accurately modeled. The location of the hot assembly/hot pin(s) isunrestricted; however, the channel is always modeled to restrict appreciableupper plenum liquid fallback.The final step of the best-estimate methodology is to combine all theuncertainties related to the code and plant parameters and estimate the PeakClad Temperature (PCT) at a high probability level. The steps taken to derivethe PCT uncertainty estimate are summarized below:

1.Base Plant Input File DevelopmentFirst, RODEX3A and S-RELAP5 base input files for the plant(including a containment input file) are developed. Code inputdevelopment guidelines are followed to ensure that the modelnodalization is consistent with that used in the code validation.2.Sampled Case DevelopmentThe non-parametric statistical approach requires that many sampledcases be created and processed. For every set of input created, eachkey LOCA parameter is randomly sampled over a range establishedthrough code uncertainty assessment or expected operating limits(provided by plant technical specifications or data). Those parameters FSAR CHAPTER 14 - SAFETY ANALYSISRevision 30SECTION 14.17 Page 14.17-5 of 14.17-16considered "key LOCA parameters" are listed in Table 14.17.1-1. Thislist includes both parameters related to LOCA phenomena (based on the phenomena identification and ranking table provided inReference 5) and to plant operating parameters.

3.Determination of Adequacy of ECCSThe RLBLOCA methodology uses a non-parametric statisticalapproach to determine values of PCT at the 95 percent probabilitylevel with 95 percent confidence (95/95). Total oxidation and totalhydrogen generation are based on the 95/95 PCT case.

Theadequacy of the ECCS is demonstrated when these results satisfy theregulatory criteria set forth in Section 14.17.1.1.

14.17.1.2.2Bounding Event InputThe plant analysis presented herein is for a CE-designed PWR, which has a2x4-loop arrangement. There are two hot legs each with a U-tube steamgenerator and four cold legs each with a PCP. The PCS also includes onepressurizer connected to a hot leg. The core contains 204 15x15 AREVA NPfuel assemblies. The ECCS includes four SIT lines, each connecting to acold leg pipe downstream of the pump discharge. The HPSI and LPSI linestee into the SIT lines prior to their connection to the cold legs. The ECCS HPSI pumps are cross-connected. The single failure assumption renders oneLPSI pump, two LPSI injection motor operated valves, and a HPSI pumpinoperable. This results in one LPSI pump injecting through two valves intocold legs 1A (leg containing the break) and 1B, and one HPSI pump injectingthrough four valves in all four of the cold legs. This models the break in the same loop as the pressurizer, as directed by the RLBLOCA methodology.The RLBLOCA transients are of sufficiently short duration that the switchover to sump cooling water for ECCS pumped injection need not be considered.The S-RELAP5 model explicitly describes the PCS, reactor vessel,pressurizer, and the ECCS. The model also describes the steam generatorsecondary side that is instantaneously isolated (closed main steam isolationvalve and feedwater trip) at the time of the break. A steam generator tube plugging level of up to 15 percent per steam generator is assumed.

FSAR CHAPTER 14 - SAFETY ANALYSISRevision 30SECTION 14.17 Page 14.17-6 of 14.17-16Plant input modeling parameters were provided by Entergy specifically forPalisades. As described in the AREVA NP RLBLOCA methodology, many parameters associated with LBLOCA phenomenological uncertainties andplant operation ranges are sampled. A list of the sampled parameters isgiven in Table 14.17.1-1. The LBLOCA phenomenological uncertainties are provided in Reference 5. Values for process or operational parameters,including ranges of sampled process parameters, and fuel design parametersused in the analysis are given in Table 14.17.1-2. Plant data are analyzed to develop uncertainties for the process parameters sampled in the analyses.Table 14.17.1-3 presents a summary of the uncertainties used in theanalyses. Two parameters, Safety Injection and Refueling Water Tank (SIRWT) temperature for ECCS pumped injection flows and diesel start time,are set at conservative bounding values for all calculations. Whereapplicable, the sampled parameter ranges are based on technicalspecification limits. Plant and design data are used to define rangeboundaries for some parameters, such as loop flow and containmenttemperature.For the AREVA NP RLBLOCA evaluation model, significant containmentparameters, as well as Nuclear Steam Supply System (NSSS) parameters,were established via a Phenomena Identification and Ranking Table (PIRT)process. Other model inputs are generally taken as nominal orconservatively biased. The PIRT outcome yielded two important (relative toPCT) containment parameterscontainment pressure and temperature. Asnoted in Table 14.17.1-3, containment temperature is a sampled parameter.Containment pressure is indirectly ranged by sampling the containmentvolume (Table 14.17.1-3). The material, area, and thickness of thecontainment passive structural heat sinks, including new strainer sump, aregiven in Table 14.17.1-7. The containment initial and boundary conditionsare given in Table 14.17.1-8. The containment-related technical specificationminimum SIRWT temperature is used for the building sprays.

14.17.1.2.3Analysis of ResultsA case set of transient calculations was performed, 59 in total, whichsampled the parameters listed in Table 14.17.1-1. For each transient calculation, PCT was calculated for a UO 2 rod and for gadolinia-bearing rodswith concentrations of 2, 4, 6 and 8 w/o Gd 2 O 3. The limiting PCT of 1,740

°Foccurred in Case 22 for a 6 w/o Gd 2 O 3rod. The major parameters for thelimiting transient are presented in Table 14.17.1-4. Table 14.17.1-5 lists the limiting PCT results for the hot fuel rod. The fraction of total hydrogen generated is conservatively bounded by the calculated total percentoxidation, which is well below the 1 percent limit. A nominal 50/50 PCT case,based on the 2 w/o Gd 2 O 3 rod, was identified as Case 55. The nominal PCT is 1,403°F. This result can be used to quantify the relative conservatism inthe 95/95 result; in this analysis, it is 337

°F.

FSAR CHAPTER 14 - SAFETY ANALYSISRevision 30SECTION 14.17 Page 14.17-7 of 14.17-16The hot fuel rod results are given in Table 14.17.1-5 and event times for thelimiting PCT case are shown in Table 14.17.1-6, respectively.

Figure 14.17.1-1 shows linear scatter plots of the key parameters sampledfor the calculations. Parameter labels appear to the left of each individualplot. These figures show the parameter sample ranges used in the analysis.

Figures 14.17.1-2 and 14.17.1-3 are PCT scatter plots versus the time ofPCT and versus break size from the calculations, respectively.Figure 14.17.1-4 and Figure 14.17.1-5 show the maximum oxidation and total oxidation versus PCT scatter plots for the 59 calculations, respectively.Figures 14.17.1-6 through 14.17.1-16 present transient results for keyparameters from the S-RELAP5 limiting case. Figure 14.17.1-6 is a PCT elevation-independent plot; this figure clearly indicates that the transientexhibits a sustained and stable quench.14.17.1.3 Radiological ConsequencesThe radiological consequences from a loss of coolant accident are boundedby that for the Maximum Hypothetical Accident (MHA), described inSection 14.22.14.17.1.4 ConclusionsA RLBLOCA analysis was performed for Palisades using NRC-approvedAREVA NP RLBLOCA methods (Reference 5). Analysis results show thatthe limiting AREVA NP fuel case has a PCT of 1,740

°F, and a maximumoxidation thickness and hydrogen generation that fall well within regulatoryrequirements. Mixed-core effects are a non-issue since the core iscompletely fueled with 15x15 AREVA NP fuel assemblies.The analysis supports operation at a nominal power level of 2,565.4 MWt(plus uncertainty), a steam generator tube plugging level of up to 15 percentin both steam generators, a Linear Heat Rate (LHR) of 15.28 kW/ft, an TotalRadial Peaking Factor (F r T) of 2.04 with no axially-dependent power peakinglimit and peak rod average exposures of up to 62,000 MWd/MTU. For aLBLOCA, all 10 CFR 50.46(b) criteria are met and operation of Palisades with AREVA NP-supplied 15x15 M5 clad fuel is justified.

FSAR CHAPTER 14 - SAFETY ANALYSISRevision 30SECTION 14.17 Page 14.17-8 of 14.17-1614.17.2 SMALL BREAK LOCA14.17.2.1 Event DescriptionThe postulated SBLOCA is defined as a break in the PWR pressureboundary which has an area of up to approximately 10% of a cold leg pipe area. The most limiting break location is in the cold leg pipe on the discharge side of a Primary Coolant Pump (PCP). This break location resultsin the largest amount of inventory loss and the largest fraction of EmergencyCore Cooling System (ECCS) fluid being ejected out through the break. This produces the greatest degree of core uncovery, the longest fuel rod heatuptime, and consequently, the greatest challenge to the 10 CFR 50.46(b)criteria.The SBLOCA event is characterized by a slow depressurization of theprimary system with a reactor trip occurring on a Thermal Margin/LowPressure (TM/LP) trip signal (low pressure floor). The Safety InjectionActuation Signal (SIAS) occurs when the system has further depressurized.The capacity and shutoff head of the High Pressure Safety Injection (HPSI)pumps are important parameters in the SBLOCA analysis. For the limiting break size, the rate of inventory loss from the primary system is large enoughthat the HPSI pumps cannot preclude significant core uncovery. The primarysystem depressurization rate is slow, extending the time required to reachthe Safety Injection Tank (SIT) pressure or to recover core liquid level onHPSI flow. This tends to maximize the heatup time of the hot rod whichproduces the maximum Peak Cladding Temperature (PCT) and localcladding oxidation. Core recovery for the limiting break begins when the Safety Injection (SI) flow that is retained exceeds the mass flow rate out thebreak. For very small break sizes, the primary system pressure does not reach the SIT pressure.14.17.2.2 Thermal-Hydraulic Analysis 14.17.2.2.1Analysis ModelsThe AREVA NP SBLOCA evaluation model for event response of the plant and hot fuel rod used in this analysis (Reference 1) consists of two computercodes. The appropriate conservatisms, as prescribed by Appendix K of 10 CFR 50, are incorporated. This methodology has been reviewed andapproved by the NRC to perform SBLOCA analyses. The two AREVA NPcomputer codes used in this analysis are:

1.The RODEX2-2A code was used to determine the burnup-dependentinitial fuel conditions for the system calculations.

FSAR CHAPTER 14 - SAFETY ANALYSISRevision 30SECTION 14.17 Page 14.17-9 of 14.17-162.The S-RELAP5 code was used to predict the thermal-hydraulicresponse of the primary and secondary sides of the reactor system and the hot rod response.The gap conditions used to initialize S-RELAP5 are taken at end-of-cycle (EOC), although a sensitivity case for middle of cycle (MOC) axial power wasalso analyzed. The use of EOC fuel rod conditions along with an EOC powershape bounds beginning-of-cycle (BOC) because the gap conductance is higher at EOC, the power shape is more top-skewed at EOC, and becausethe initial stored energy, although higher at BOC, has a negligible impact onSBLOCA results because the stored energy is dissipated long before core

uncovery.Properties for M5 cladding are incorporated into AREVA NP methods by theReference 4 approved topical report.

14.17.2.2.2Plant Description and Summary of Analysis ParametersPalisades is a Combustion Engineering (CE) designed two-by-four loop PWRwith two hot legs, four cold legs, and two vertical U-tube SteamGenerators (SGs). The reactor has a rated core power of 2580.6 MWt(including uncertainty). The reactor vessel contains a downcomer, upper andlower plenums, and a reactor core containing 204 fuel assemblies. The hot legs connect the reactor vessel with the vertical U-tube SGs. Feedwater isinjected into the downcomer of each SG. There are three AuxiliaryFeedwater (AFW) pumps, two motor-driven and one turbine-driven. TheECCS contains two HPSI pumps, four SITs, and two Low Pressure SafetyInjection (LPSI) pumps.The primary coolant system (PCS) of the plant was nodalized in theS-RELAP5 model into control volumes interconnected by flow paths or"junctions." The model includes four SITs, a pressurizer, and two SGs withboth primary and secondary sides modeled. All of the loops were modeled explicitly to provide an accurate representation of the plant. It was assumedthat 15% of the tubes in each steam generator were plugged. The HPSIsystem was modeled to deliver to the four cold legs in the S-RELAP5 model.

LPSI flow was not modeled since system pressure was not expected to fall below the shutoff head of the LPSI pumps.The heat generation rate in the S-RELAP5 reactor core model wasdetermined from reactor kinetics equations with actinide and decay heatingas prescribed by Appendix K.

FSAR CHAPTER 14 - SAFETY ANALYSISRevision 30SECTION 14.17 Page 14.17-10 of 14.17-16The analysis (Reference 3) assumed loss of offsite power concurrent withreactor scram on low pressurizer pressure. This assumption bounds the energy input to the PCS relative to an assumption of Loss of OffsitePower (LOOP) at event initiation with an associated earlier scram time. Thesingle failure criterion required by Appendix K was satisfied by assuming the loss of one Emergency Diesel Generator (EDG), which resulted in thedisabling of one HPSI pump and one motor-driven AFW pump. Thus, a singleHPSI pump was assumed to be operable. No charging pump was credited.

Initiation of the HPSI system was delayed by 40 seconds beyond the time ofSIAS, representing the maximum Technical Specification delay required forEDG startup, sequencer delays for pump and motor-operated valve operation, and pump startup. The disabling of a motor-driven AFW pumpwould leave one motor-driven pump and the turbine-driven pump available.The initiation of the motor-driven pump was delayed 120 seconds beyond thetime of the Auxiliary Feedwater Actuation Signal (AFAS) indicating low SGlevel (23.7% narrow range). The operator startup of the turbine-driven AFWpump was not credited in the analysis.The input model included details of both main steam lines from the SGs tothe turbine control valve, including the short Main Steam SafetyValve (MSSV) inlet piping lines connected to the main steam lines. TheMSSVs were set to open at their nominal setpoints plus 3% tolerance. Thevalves were modeled to account for a blowdown of 4% of the nominal opening pressure.SG blowdown flow was not modeled since this has an insignificant effect onthe SBLOCA event. The initial secondary pressure was adjusted to beconsistent with a 15% SGTP level.Important system parameters and initial conditions used in the analysis aregiven in Table 14.17.2-1 14.17.2.2.3Analytical ResultsThe single failure considered in the analysis was a failure of an EDGcoincident with the loss of offsite power (Reference 3). This results in the loss of one HPSI pump (leaving only a single HPSI pump in operation) and a motor-driven AFW pump. Because the operator startup of the turbine-drivenAFW pump is not credited, this failure mode is limiting since it causes theminimum HPSI and AFW flow rates.SBLOCA break spectrum calculations were performed for break sizes of 0.04 ft 2 , 0.05 ft 2 , 0.06 ft 2 , 0.08 ft 2 , 0.10 ft 2 , and 0.15 ft

2. The PCT results arepresented in Table 14.17.2-2. The limiting break size was determined to be

0.08 ft 2. The break spectrum sizes were chosen to be fine enough to identifythe limiting break size and to capture different recovery phenomena. The

0.15 ft 2 break was the largest size considered since the PCT monotonically FSAR CHAPTER 14 - SAFETY ANALYSISRevision 30SECTION 14.17 Page 14.17-11 of 14.17-16decreased from the limiting 0.08 ft 2 break. Analysis of even larger sizeswould give lower PCTs as all four loop seals clear and SITs initiate earlier.Predicted event times are summarized in Table 14.17.2-3. Hot rod results arepresented in Table 14.17.2-4.The results for the limiting case, 0.08 ft 2 break, S-RELAP5 calculation areshown in Figure 14.17.2-1 through Figure 14.17.2-13. The followingdiscussion pertains to the limiting case. System behavior for the other cases was similar, although event timing was different.The break flow rate is shown in Figure 14.17.2-1. Single phase liquid flowbegan at the initiation of the break and continued until about 150 secondswhen primary pressure reached saturation pressure and the break flowbecame a two-phase mixture. The decrease in flow rate at about 300seconds was due to the transition from two-phase flow to single-phase vaporflow, which occurred following loop seal clearing.The primary and secondary pressure responses are shown inFigure 14.17.2-2. The primary pressure decreased immediately after break initiation. When the primary pressure reached the TM/LP trip low pressurefloor setpoint of 1585 psia, reactor scram occurred (Figure 14.17.2-3),followed by a turbine trip

1. The turbine trip caused the secondary pressure toincrease rapidly until the MSSVs opened, causing the secondary pressure to stabilize. Credit was not taken for non-safety grade plant systems, such as atmospheric dump valves (ADVs) and turbine bypass valves.The primary coolant pumps tripped at scram on the assumed loss of offsitepower and began to coastdown in speed, resulting in decreasing loop flow.The total HPSI flow rate is shown in Figure 14.17.2-4. At approximately96 seconds, HPSI flow began and increased as primary system pressuredecreased. SIT flow (Figure 14.17.2-5) did not begin until the primary pressure reached the SIT pressure of 215 psia at 1690 seconds.At approximately 282 seconds, liquid was expelled from the cold leg 1B loopseal piping (Figure 14.17.2-6), allowing steam to flow directly to the break, which allowed the primary pressure to decrease more rapidly. The loop sealin 1B cleared at 282 seconds; the loop seals in 1A, 2A and 2B (broken loop)did not clear. Figure 14.17.2-7 shows that the break flow transitioned to single-phase steam following loop seal clearing.The primary system and reactor vessel fluid masses, shown inFigure 14.17.2-8, declined rapidly after event initiation. After loop seal clearing at approximately 282 seconds, the system mass inventory continued 1 In the SBLOCA model, the only steam demand is the turbine. Other turbine building steam system loadslike air ejectors and gland seal are ignored. Therefore, when the turbine is tripped, there is no steamdemand.

FSAR CHAPTER 14 - SAFETY ANALYSISRevision 30SECTION 14.17 Page 14.17-12 of 14.17-16to decline, but at a reduced rate, and the reactor vessel mass reached aminimum at 1698 seconds. At approximately that time, SIT flow began to reach the reactor vessel, which significantly increased system inventories.The hot-channel-core-collapsed liquid level is shown in Figure 14.17.2-9.The core collapsed liquid level fell below the top of the core (11.05 feet)immediately after the break opened. The rate at which the level felldecreased after the break flow became two-phase (approximately 150 seconds). The hot node uncovery began at approximately 990 seconds,as shown by the increasing hot rod temperature shown in Figure 14.17.2-10. The liquid level continued to fall until PCS pressure fell low enough to initiate SIT flow at 1690 seconds.

In the 0.04 ft 2 , 0.05 ft 2 , and 0.06 ft 2 cases, the primary system pressure didnot fall low enough to initiate SIT flow. For breaks of 0.08 ft 2 and larger, SITdischarge, minimum PCS inventory, and PCT were nearly coincident.

The PCT was calculated to be 1734°F for the 0.08 ft 2 limiting case, as seenon Figure 14.17.2-10. The calculations for each case were continued untilwell past the time of PCT, when a significant decrease in hot rod temperatureand increase in hot channel liquid level were observed.Secondary side results are shown in Figures 14.17.2-11 through 14.17.2-13. The secondary liquid levels reached the AFAS setpoint (23.7% narrow range) at approximately 25 seconds. Flow from the one available motor-driven AFW pump started approximately 120 seconds later. A constant flowrate was then supplied to each steam generator. MSSV flow, shown inFigure 14.17.2-13, ended soon after AFW flow began.A calculation was also performed using the limiting middle-of-cycle (MOC)axial power shape for the limiting 0.08 ft 2 break case. In that case, the PCTwas 1663ºF, versus 1734ºF for the limiting EOC case.These calculations indicate that the case with an EOC axial power shapeprovides a bounding SBLOCA analysis.14.17.2.3 Radiological ConsequencesA radiological consequence analysis is not applicable to this event.14.17.2.4 ConclusionCalculations were performed for a spectrum of break sizes and axial powershapes. The limiting scenario for those calculations was a break size of

0.08 ft 2, EOC axial power shape and gap conductance, and the loss of onediesel generator. While stored energy at BOC is higher than EOC, EOC conditions were chosen because stored energy is dissipated long before core FSAR CHAPTER 14 - SAFETY ANALYSISRevision 30SECTION 14.17 Page 14.17-13 of 14.17-16uncovery and has a negligible impact on PCT. The PCT for this limiting casewas 1734°F.The analysis supports full-power operation at 2580.6 MW t includinguncertainty, a steam generator tube plugging level of up to 15% in eachsteam generator, a total radial peaking factor of 2.04, and a maximum LHR of15.28 kW/ft.14.17.3 REACTOR INTERNALS STRUCTURAL BEHAVIOR FOLLOWING A LOCA14.17.3.1 Event DescriptionIn the original Combustion Engineering (CE) analysis of this event, t heconsequences and effects of a postulated loss of coolant accident on the reactor internal structureswas analyzed for PCS pipe breaks up to adouble-ended rupture of a 42-inch pipe. Following a pipe rupture, two typesof loading occur sequentially. The first is an impulse load of 15 to30 milliseconds duration caused by rapid system depressurization from initialsubcooled conditions to saturated conditions. This initial blowdown phase isfollowed by a two-phase fluid blowdown which persists for time periods varying up to several seconds, depending on the size of the postulatedrupture. In the early portion of the blowdown, acoustic waves propagatethrough the PCS. For the saturated portion of the blowdown, the loadings onthe reactor internals are associated with the fluid drag forces imposed by thehigh-velocity, two-phase fluid in its flow to the break location. The short-termimpulse forces are generally greater than the long-term drag forces exceptfor the loads on some of the control rod shrouds in case of a pipe rupture near the pressure vessel outlet nozzle.Later, the structural adequacy of reactor internals was further evaluated aspart of the CE Owners Group Asymmetric Loads Program (References 8, 9,and 10). The initial phase of the evaluation consisted of a comparison of thedesign verification LOCA loads used in the original analysis and theasymmetric LOCA loads considering vessel motion. The three componentsof the load, including the vertical and horizontal shear forces and thehorizontal moment, were compared to the original loads to determine if anyportion of the load increased. Any area of the reactor internals with a loadcomponent higher than the original LOCA loads analysis was evaluated byperforming a new analysis using asymmetric loads. The results of the loadcomparison indicated that the only areas of the reactor internals which didnot show an increase in loads with the asymmetric load analysis were thecore support barrel upper and lower flanges. No further analysis wasperformed for these components. All other areas of the reactor internalswere reanalyzed using the asymmetric loads to compute stress intensities.

FSAR CHAPTER 14 - SAFETY ANALYSISRevision 30SECTION 14.17 Page 14.17-14 of 14.17-1614.17.3.2 Thermal-Hydraulic Analysis 14.17.3.2.1Analysis MethodIn the original analysis, the structural behavior of the core due topropagation of the blowdown acoustic waves following a pipe rupturewasevaluated using the Waterhammer Code (WHAM). WHAMcalculates the impulse-type pressure loadings which the system issubjected to during passage of the pressure waves through thesystem.The asymmetric loads analysis used CEFLASH-4B for the reactorinternal hydraulic loads calculations, and used various codes for thereactor internal structural loads calculations, as described in References 8, 9, and 10.

14.17.3.2.2Bounding Event Input Theoriginalanalysis for this event was performed by CE for theoriginal FSAR. All inputs and assumptions are contained in theoriginal calculation package, an internal CE document.The asymmetric loads analysis was also performed by CE. Inputs andassumptions are contained in the Asymmetric Loads Program FinalReport (Reference 8).

14.17.3.2.3Analysis of ResultsThe blowdown-induced stresses and deflections induced during theblowdown are well below failure conditions. The results from theoriginal FSAR analysis are given in Table 14.17.3-1. The results fromthe asymmetric loads analysis are given in Table 14.17.3-2.14.17.3.3 Radiological ConsequencesA radiological consequences analysis is not applicable for this event14.17.3.4 ConclusionsIt is concluded that the reactor vessel internal structures can withstand theforces caused by a large loss-of-coolant accident.

FSAR CHAPTER 14 - SAFETY ANALYSISRevision 30SECTION 14.17 Page 14.17-15 of 14.17-16REFERENCES1.EMF-2328(P)(A), PWR Small Break LOCA Evaluation Model, S-RELAP5Based, Framatome ANP, March 2001.

2.Delete 3.ANP-2712, Revision 0, Palisades Small Break LOCA Analysis with M5Cladding, AREVA NP, November 2008.4.BAW-10240(P)(A), Revision 0, Incorporation of M5 Properties in FramatomeANP Approved Methods, Framatome ANP, May 2004.

5.AREVA NP Document, EMF-2103(P)(A), Revision 0, Realistic Large BreakLOCA Methodology, Framatome ANP, Inc., April 2003.

6.Technical Program Group, Quantifying Reactor Safety Margins, NUREG/CR-5249, EGG-2552, October 1989.

7.Wheat, Larry L., CONTEMPT-LT A Computer Program for PredictingContainment Pressure-Temperature Response to a Loss-Of-Coolant-Accident, Aerojet Nuclear Company, TID-4500, ANCR-1219, June 1975 8.CE Owner's Group Asymmetric Loads Program Report, "Reactor CoolantSystem Asymmetric Loads Evaluation Program Final Report," Volumes 1, 2 and 3, dated June 30, 1980.

9.Combustion Engineering Report, "Response to Questions on the ReactorCoolant System Asymmetric Loads Evaluation Program Final Report,"submitted to the NRC on July 31, 1981.

10.Letter from AW De Agazio (NRC) to KW Berry (CP Co), "Safety Evaluationon Asymmetric LOCA Loads - MPA D-010 - Palisades (TAC No. MO8621)," October 27, 1989.

11.Code of Federal Regulation, Title 10, Part 50, Section 50.46, "Acceptance Criteria for Emergency Core Cooling Systems for Light Water Nuclear Power Reactors," and Appendix K to 10CFR50, ECCS Evaluation Models.12.Deleted 13.Deleted 14.Deleted 15.Deleted FSAR CHAPTER 14 - SAFETY ANALYSISRevision 30SECTION 14.17 Page 14.17-16 of 14.17-16 16.Deleted 17.Deleted 18.Deleted 19.Deleted 20.Deleted 21.Deleted 22.Deleted 23.Deleted 24.Deleted

FSAR CHAPTER 14 - SAFETY ANALYSISRevision 30SECTION 14.17 Page 14.17-1 of 14.17-1614.17 LOSS OF COOLANT ACCIDENT14.17.1 LARGE BREAK LOCA (LBLOCA)14.17.1.1 Event DescriptionA Large Break Loss of Coolant Accident (LBLOCA) is initiated by apostulated large rupture of the Primary Coolant System (PCS) piping. Basedon deterministic studies, the worst break location is in the cold leg pipingbetween the Primary Coolant Pump (PCP) and the reactor vessel for the PCS loop containing the pressurizer. The break initiates a rapid depressurizationof the PCS. A reactor trip signal is initiated when the low pressurizerpressure trip setpoint is reached; however, the reactor trip is conservatively neglected in the analysis. The reactor is shut down by coolant voiding in the core.The plant is assumed to be operating normally at full power prior to theaccident. The large cold leg break is assumed to open instantaneously. Forthis break, a rapid primary system depressurization occurs, along with a coreflow stagnation and reversal. This causes the fuel rods to experienceDeparture from Nuclear Boiling (DNB). Subsequently, the limiting fuel rodsare cooled by film convection to steam. The coolant voiding creates a strongnegative reactivity effect and core fission ends. As heat transfer from the fuelrods is reduced, the cladding temperature rises.Coolant in all regions of the PCS begins to flash. At the break plane, the lossof subcooling in the coolant results in substantially reduced break flow. Thisreduces the depressurization rate and may also lead to a period of positivecore flow or reduced downflow as the PCPs in the intact loops continue tosupply water to the vessel. Cladding temperatures may be reduced andsome portions of the core may rewet during this period.This positive core flow or reduced downflow period ends as two-phaseconditions occur in the reactor coolant pumps, reducing their effectiveness.

Once again, the core flow reverses as most of the vessel mass flows out through the broken cold leg.Mitigation of the LBLOCA begins when the Safety Injection ActuationSignal (SIAS) is tripped. This signal is initiated by either high containmentpressure or low pressurizer pressure. Regulations require that a worst activesingle-failure be considered for Emergency Core Cooling System (ECCS) safety analysis. This worst active single failure was determined generically inthe Realistic Large Break LOCA (RLBLOCA) evaluation model (Reference 5)to be the loss of one ECCS train. The AREVA NP RLBLOCA methodology conservatively assumes a minimal time delay and a normal (no failure irrespective of the assumed worst single active failure) lineup of thecontainment sprays and fan coolers to reduce containment pressure and FSAR CHAPTER 14 - SAFETY ANALYSISRevision 30SECTION 14.17 Page 14.17-2 of 14.17-16increase break flow. The analysis assumes that one High Pressure SafetyInjection (HPSI) pump, one Low Pressure Safety Injection (LPSI) pump, all containment spray pumps and all containment fan coolers are operational.When the PCS pressure falls below the Safety Injection Tank (SIT) pressure,borated water from the SITs is injected into the cold legs. In the early deliveryof SIT water, high pressure and high break flow will cause some of this fluidto bypass the core. During this bypass period, core heat transfer remains poor and fuel rod cladding temperatures increase. As PCS and containmentpressures equilibrate, ECCS water begins to fill the lower plenum andeventually the lower portions of the core. This improves core heat transfer and cladding temperatures begin to decrease.Eventually, the relatively large volume of SIT water is exhausted and corerecovery relies solely on ECCS pumped injection. As the SITs empty, thenitrogen gas used to pressurize the SITs exits through the break. This gasrelease may result in a short period of improved core heat transfer as thenitrogen gas displaces water in the downcomer. After the nitrogen gas isexpelled, the ECCS may not be able to sustain full core cooling temporarily because of the core decay heat and the higher steam temperatures createdby quenching in the lower portions of the core. Peak fuel rod claddingtemperatures may increase for a short period until additional energy isremoved from the core by the LPSI and the decay heat continues to fall.Steam generated from fuel rod rewet will entrain liquid and pass through the core, vessel upper plenum, the hot legs, the steam generator and the PCPbefore it is vented out the break. The resistance of this flow path to the steamflow (including steam binding effects) is balanced by the driving force ofwater filling the downcomer. This resistance (steam binding) may act toretard the progression of core reflooding and postpone core-wide cooling.Eventually (within a few minutes of the accident), core reflooding willprogress sufficiently to ensure core-wide cooling. Full core quench occurswithin a few minutes after core-wide cooling. Long-term cooling is then sustained with the LPSI.The purpose of the RLBLOCA analysis is to demonstrate that the followingcriteria of 10 CFR 50.46(b) (Reference 11) are met:1.The calculated maximum fuel element cladding temperature shall notexceed 2,200

°F.2.The calculated total oxidation of the cladding shall nowhere exceed0.17 times the total cladding thickness before oxidation.3.The calculated total amount of hydrogen generated from the chemicalreaction of the cladding with water or steam shall not exceed 0.01times the hypothetical amount that would be generated if all of the FSAR CHAPTER 14 - SAFETY ANALYSISRevision 30SECTION 14.17 Page 14.17-3 of 14.17-16metal in the cladding cylinders surrounding the fuel excluding thecladding surrounding the plenum volume were to react.14.17.1.2 Thermal Hydraulics Analysis 14.17.1.2.1Analysis MethodThe RLBLOCA methodology is documented in topical report EMF-2103,Realistic Large Break LOCA Methodology (Reference 5). The methodologyfollows the Code Scaling Applicability and Uncertainty (CSAU) evaluation methodology (Reference 6). This method outlines an approach for definingand qualifying a best-estimate thermal-hydraulic code and quantifies theuncertainties in a LBLOCA analysis.The RLBLOCA methodology uses the following computer codes:

RODEX3A for computation of the initial fuel stored energy, fission gasrelease, and fuel-cladding gap conductance.

S-RELAP5 for the system calculation, including the containment pressure response.The governing two-fluid (plus non-condensibles) model with conservation equations for mass, energy and momentum transfer is used. The reactor coreis modeled in S-RELAP5 with heat generation rates determined from reactorkinetics equations (point kinetics) with reactivity feedback, and with actinide and decay heating.The two-fluid formulation uses a separate set of conservation equations andconstitutive relations for each phase. The effects of one phase on anotherare accounted for by interfacial friction, and heat and mass transferinteraction terms in the equations. The conservation equations have the same form for each phase; only the constitutive relations and physicalproperties differ.The modeling of plant components is performed by following guidelinesdeveloped to ensure accurate accounting for physical dimensions and thatthe dominant phenomenon expected during an LBLOCA event are captured.