ML17054C224

From kanterella
Revision as of 21:36, 26 April 2019 by StriderTol (talk | contribs) (Created page by program invented by StriderTol)
Jump to navigation Jump to search
License Amendment Request for the Transition to Westinghouse Core Design and Safety Analyses - WCAP-17658-NP, Rev 1, Transition of Methods for Core Design and Safety Analyses - Licensing Report.
ML17054C224
Person / Time
Site: Wolf Creek Wolf Creek Nuclear Operating Corporation icon.png
Issue date: 01/17/2014
From:
Wolf Creek
To:
Office of Nuclear Reactor Regulation
Shared Package
ML17054C103 List:
References
ET 17-0001
Download: ML17054C224 (446)
v • d • e


Text

Westinghouse Non-Proprietary Class 3 WCAP-17658-NP September 2016 Revision 1-C Wolf Creek Generating Station Transition of Methods for Core Design and Safety Analyses -

Licensing Report Westinghouse Non-Proprietary Class 3

  • Electronically approved records are authenticated in the electronic document management system. Westinghouse Electric Company LLC 1000 Westinghouse Drive Cranberry Township, PA 16066, USA © 2016 Westinghouse Electric Company LLC All Rights Reserved WCAP-17658-NP Revision 1-C Wolf Creek Generating Station Transition of Methods for Core Design and Safety Analyses - Licensing Report September 2016

iv WCAP-17658-NP September 2016 Licensing Report Revision 1-C TABLE OF CONTENTS TABLE OF CONTENTS .............................................................................................................

................ ivLIST OF TABLES ................................................................................................................

...................... viiLIST OF FIGURES ...............................................................................................................

....................... xLIST OF ACRONYMS ..............................................................................................................

................ xixPROFESSIONAL ENGINEERING STAMPS ......................................................................................... xxii1INTRODUCTION ..................................................................................................................

...... 1-11.1NUCLEAR STEAM SUPPLY SYSTEM PARAMETERS ............................................ 1-21.1.1Introduction ..................................................................................................... 1-21.1.2Input Parameters, Assumptions, and Acceptance Criteria ............................... 1-21.1.3Description of Analyses and Evaluation .......................................................... 1-31.1.4Conclusion ....................................................................................................... 1-42ACCIDENT AND TRANSIENT ANALYSIS .............................................................................. 2-12.1NON-LOCA ANALYSES INTRODUCTION ................................................................ 2-12.1.1Program Features ............................................................................................. 2-12.1.2Non-LOCA Transient Events Considered ....................................................... 2-22.1.3Analysis Methodology ..................................................................................... 2-52.1.4Computer Codes Used ..................................................................................... 2-82.1.5Initial Conditions ........................................................................................... 2-102.1.6Fuel Design Description ................................................................................ 2-122.1.7Power Distribution Peaking Factors .............................................................. 2-132.1.8Reactivity Feedback ...................................................................................... 2-132.1.9Pressure Relief Modeling .............................................................................. 2-132.1.10RTS and ESFAS Functions ............................................................................ 2-152.1.11Reactor Trip Characteristics .......................................................................... 2-162.1.12Operator Actions Credited ............................................................................. 2-172.1.13Results Summary ........................................................................................... 2-172.1.1 4References ..................................................................................................... 2-172.2INCREASE IN HEAT REMOVAL BY THE SECONDARY SYSTEM ..................... 2-372.2.1Feedwater System Malfunctions that Result in a Decrease in Feedwater Temperature (USAR Section 15.1.1) ............................................................. 2-372.2.2Feedwater System Malfunctions that Result in an Increase in Feedwater Flow (USAR Section 15.1.2)......................................................................... 2-452.2.3Excessive Increase in Secondary Steam Flow (USAR Section 15.1.3) ......... 2-542.2.4Inadvertent Opening of a Steam Generator Atmospheric Relief or Safety Valve (USAR Section 15.1.4) ........................................................................ 2-682.2.5Steam System Piping Failure (USAR Section 15.1.5) ................................... 2-812.3DECREASE IN HEAT REMOVAL BY THE SECONDARY SYSTEM .................. 2-1122.3.1Loss of External Electrical Load, Turbine Trip, Inadvertent Closure of Main Steam Isolation Valves, Loss of Condenser Vacuum and Other Events Resulting in Turbine Trip (USAR Sections 15.2.2, 15.2.3, 15.2.4, and 15.2.5) ................................................................................................... 2-112 v WCAP-17658-NP September 2016 Licensing Report Revision 1-C 2.3.2Loss of Non-Emergency AC Power to the Station Auxiliaries (USAR Section 15.2.6) ............................................................................................. 2-1282.3.3Loss of Normal Feedwater Flow (USAR Section 15.2.7) ........................... 2-1442.3.4Feedwater System Pipe Break (USAR Section 15.2.8) ............................... 2-1612.4DECREASE IN REACTOR COOLANT SYSTEM FLOW RATE ........................... 2-1802.4.1Partial and Complete Loss of Forced Reactor Coolant Flow (USAR Sections 15.3.1 and 15.3.2) ......................................................................... 2-1802.4.2Reactor Coolant Pump Shaft Seizure (Locked Rotor) and Shaft Break (USAR Sections 15.3.3 and 15.3.4) ............................................................ 2-2062.5REACTIVITY AND POWER DISTRIBUTION ANOMALIES ............................... 2-2252.5.1Uncontrolled Rod Cluster Control Assembly Bank Withdrawal from a Subcritical or Low Power Startup Condition (USAR Section 15.4.1) ........ 2-2252.5.2Uncontrolled Rod Cluster Control Assembly Bank Withdrawal at Power (USAR Section 15.4.2) ................................................................................ 2-2352.5.3Control Rod Misoperation (USAR Section 15.4.3) ..................................... 2-2562.5.4Startup of an Inactive Reactor Coolant Pump at an Incorrect Temperature (USAR Section 15.4.4) ................................................................................ 2-2642.5.5Chemical and Volume Control System Malfunction Resulting in a Decrease in Boron Concentration in the Reactor Coolant (USAR Section 15.4.6) .......................................................................................................... 2-2652.5.6Spectrum of Rod Cluster Control Assembly Ejection Accidents (USAR Section 15.4.8) ................................................................................ 2-2742.6INCREASE IN REACTOR COOLANT INVENTORY ............................................. 2-2882.6.1Inadvertent Operation of the Emergency Core Cooling System During Power Operation (USAR Section 15.5.1) .................................................... 2-2882.6.2Chemical and Volume Control System Malfunction that Increases Reactor Coolant Inventory (USAR Section 15.5.2) .................................... 2-2972.7DECREASE IN REACTOR COOLANT INVENTORY ............................................ 2-3102.7.1Inadvertent Opening of a Pressurizer Safety or Relief Valve (USAR Section 15.6.1) ............................................................................................. 2-3102.7.2Steam Generator Tube Rupture Margin to Overfill (USAR Section 15.6.3) .......................................................................................................... 2-3162.7.3Steam Generator Tube Rupture - Input to Dose (USAR Section 15.6.3).... 2-3362.7.4Loss-of-Coolant Accidents Resulting from a Spectrum of Postulated Piping Breaks within the Reactor Coolant Pressure Boundary (USAR Section 15.6.5) ............................................................................................. 2-3572.8ANTICIPATED TRANSIENTS WITHOUT SCRAM (USAR SECTIONS 15.8 AND 7.7.1.11) ............................................................................................................. 2-3 712.8.1Technical Evaluation ................................................................................... 2-3712.8.2Conclusion ................................................................................................... 2-3732.8.3References ................................................................................................... 2-3732.9RADIOLOGICAL DOSES .......................................................................................... 2-3832.10INSTRUMENT UNCERTAINTIES ........................................................................... 2-3832.11CONTROL SYSTEMS ANALYSIS ........................................................................... 2-3832.11.1NSSS Pressure Control Component Sizing (USAR Sections 5.4, 7.7, & 10.4.4)...................................................................................................... 2-383 vi WCAP-17658-NP September 2016 Licensing Report Revision 1-C 2.11.2Operational Analysis and Margin to Trip (USAR Section 7.7) ................... 2-3892.12THERMAL AND HYDRAULIC DESIGN ................................................................ 2-3942.12.1Introduction ................................................................................................. 2-3942.12.2Input Parameters and Acceptance Criteria ................................................... 2-3942.12.3Description of Analyses and Evaluations .................................................... 2-3972.12.4Results ......................................................................................................... 2-4012.12.5Conclusion ................................................................................................... 2-4012.12.6References ................................................................................................... 2-401APPENDIX ASAFETY EVALUATION REPORT COMPLIANCE ..................................................... A-1 vii WCAP-17658-NP September 2016 Licensing Report Revision 1-C LIST OF TABLES Table 1.1-1NSSS Design Parameters for WCGS TM Program ...................................................... 1-5Table 1.1-2NSSS Design Parameters for WCGS TM Program ...................................................... 1-6Table 2.1-1Non-LOCA Transient Events Analyzed or Evaluated ................................................ 2-19Table 2.1-2Summary of Initial Conditions and Computer Codes Used ....................................... 2-20Table 2.1-3Core Kinetics Parameters and Reactivity Feedback Coefficients ............................... 2-23Table 2.1-4Summary of RTS and ESFAS Functions Actuated ..................................................... 2-24Table 2.1-5Parameters Related to OTT and OPT Reactor Trip Setpoints ............................... 2-27Table 2.1-6Non-LOCA Results Summary .................................................................................... 2-28Table 2.2.1-1Time Sequence of Events - Decrease In Tfeed (Manual Rod Control) ........................ 2-41Table 2.2.1-2Decrease in T feed Minimum DNBR and Peak Core Average Thermal Power Results 2-41Table 2.2.2-1Increase in FW Flow Cases Analyzed ........................................................................ 2-49Table 2.2.2-2Time Sequence of Events - Increase in FW Flow (HFP, Multi-Loop, Manual Rod Control) ............................................................................................................... 2-49Table 2.2.2-3HFP FWM Flow Increase Minimum DNBR and Peak Core Average Thermal Power Results ............................................................................................................. 2-4 9Table 2.2.3-1Excessive Load Increase Incident Summary of Results ............................................. 2-58Table 2.2.3-2Time Sequence of Events for the Excessive Load Increase Incident ......................... 2-59Table 2.2.4-1Time Sequence of Events - Accidental Depressurization of the MSS at HZP Conditions .................................................................................................................. 2

-73Table 2.2.4-2Limiting Results - Accidental Depressurization of the MSS at HZP Conditions ...... 2-73Table 2.2.5.1-1Time Sequence of Events - Steam System Piping Failure at HZP Conditions .......... 2-87Table 2.2.5.1-2Limiting Results - Steam System Piping Failure at HZP Conditions ........................ 2-88Table 2.2.5.2-1Time Sequence of Events - Steam System Piping Failure at HFP Conditions ......... 2-107Table 2.2.5.2-2Limiting Results - Steam System Piping Failure at HFP Conditions ....................... 2-107Table 2.3.1-1Time Sequence of Events - Loss of External Electrical Load and/or Turbine Trip . 2-118Table 2.3.1-2Limiting Results - Loss of External Electrical Load and/or Turbine Trip ............... 2-118Table 2.3.2-1Time Sequence of Events for Limiting LOAC Case ................................................ 2-133Table 2.3.3-1Time Sequence of Events for Limiting LONF Case ................................................. 2-150Table 2.3.4-1Time Sequence of Events for Limiting FW Line Break Case With Offsite Power Available ................................................................................................................... 2

-169 viii WCAP-17658-NP September 2016 Licensing Report Revision 1-C Table 2.3.4-2Time Sequence of Events for Limiting FW Line Break Case Without Offsite Power Available ........................................................................................................ 2-169Table 2.4.1-1Time Sequence of Events - Loss of Forced Reactor Coolant Flow ......................... 2-184Table 2.4.1-2Results - Loss of Forced Reactor Coolant Flow ...................................................... 2-184Table 2.4.2-1Time Sequence of Events - RCP Locked Rotor/Shaft Break ................................... 2-211Table 2.4.2-2Limiting Results - RCP Locked Rotor/Shaft Break ................................................. 2-212Table 2.5.1-1Time Sequence of Events - Uncontrolled RCCA Bank Withdrawal from a Subcritical Condition ................................................................................................ 2-230Table 2.5.2-1Time Sequence of Events - Uncontrolled RCCA Bank Withdrawal at Power ......... 2-242Table 2.5.2-2Uncontrolled RCCA Bank Withdrawal at Power - Limiting Results ....................... 2-243Table 2.5.3-1Non-LOCA Analysis Limits and Analysis Results for the Dropped Rod Event ....... 2-263Table 2.5.3-2Summary of Initial Conditions and Computer Codes Used for the Dropped Rod Event .........................................................................................................................

2-263Table 2.5.5-1CVCS Malfunction Boron Dilution Event Results - Event Alarm to Loss of Shutdown Margin ..................................................................................................... 2-273Table 2.5.6-1Selected Input and Results of the Limiting RCCA Ejection Analyses ..................... 2-282Table 2.5.6-2Time Sequence of Events - RCCA Ejection ............................................................ 2-283Table 2.6.1-1Time Sequence of Events - Inadvertent ECCS ........................................................ 2-293Table 2.6.2-1Time Sequence of Events - CVCS Malfunction ...................................................... 2-301Table 2.7.1-1Time Sequence of Events - Accidental Depressurization of the RCS ...................... 2-313Table 2.7.1-2Results - Accidental Depressurization of the RCS ................................................... 2-313Table 2.7.2-1AFW Flows for Design Basis SGTR Analyses MDAFW Failure, All AFW Pumps Operating .................................................................................................................. 2-325Table 2.7.2-2AFW Flows for Design Basis SGTR Analyses MDAFW Failure, All AFW Pumps Operating, TDAFW Flow to Ruptured SG Isolated, MDAFW Pumps Operating ... 2-325Table 2.7.2-3AFW Flows for Design Basis SGTR Analyses MDAFW Failure, Ruptured SG Isolated, All AFW Pumps Operating, All AFW Flow to Ruptured SG Isolated, MDAFW Pumps Operating During Cooldown ........................................................ 2-325Table 2.7.2-4SI Flows for Design Basis SGTR Analyses .............................................................. 2-326Table 2.7.2-5Operator Action Times for Design Basis SGTR Margin to Overfill Analyses ......... 2-327Table 2.7.2-6Sequence of Events for Limiting Ma rgin to Overfill Analyses ................................ 2-327Table 2.7.3-1Operator Action Times for Design Basis SGTR T/H Analyses ................................ 2-344Table 2.7.3-2Sequence of Events for Limiting Input to Radiological Consequences Analyses .... 2-344 ix WCAP-17658-NP September 2016 Licensing Report Revision 1-C Table 2.7.3-3Break Flow and Flashed Break Flow........................................................................ 2-345Table 2.7.3-4Intact and Ruptured SG Steam Flow to Atmosphere ................................................ 2-345Table 2.7.4-1Subcriticality Analysis Input Parameters .................................................................. 2-364Table 2.7.4-2LTC Analysis Input Parameters ................................................................................ 2-364Table 2.7.4-3Boric Acid Solution Solubility Limit Data ............................................................... 2-365Table 2.8.1-1LOL ATWS Time Sequence of Events ..................................................................... 2-374Table 2.8.1-2LONF ATWS Time Sequence of Events .................................................................. 2-374Table 2.12-1T/H Design Parameters Comparison ........................................................................ 2-403Table 2.12-2Limiting Parameter Direction for DNB .................................................................... 2-405Table 2.12-3RTDP DNBR Margin Summary ............................................................................... 2-406 x WCAP-17658-NP September 2016 Licensing Report Revision 1-C LIST OF FIGURES Figure 2.1-1. Integrated DPC ................................................................................................

........ 2-31Figure 2.1-2. Reactor Core Safety Limits ..................................................................................... 2-32Figure 2.1-3. Illustration of OTT and OPT Protection ............................................................. 2-33Figure 2.1-4. Fractional Rod Insertion versus Time from Release ............................................... 2-34Figure 2.1-5. Normalized RCCA Reactivity Worth versus Fractional Rod Insertion ................... 2-35Figure 2.1-6. Normalized RCCA Reactivity Worth versus Time from Release ............................ 2-36Figure 2.2.1-1. Decrease in T feed at Full Power - Nuclear Power and Core Heat Flux versus Time .........................................................................................................................

2-42Figure 2.2.1-2.Decrease in T feed at Full Power - Vessel Delta-T and Core Average Moderator Temperature versus Time ........................................................................................ 2-43Figure 2.2.1-3. Decrease in T feed at Full Power - Pressurizer Pressure and DNBR versus Time..... 2-44Figure 2.2.2-1.Increase in FW Flow at Full Power - Multi-Loop Manual Rod Control Nuclear Power and Core Heat Flux versus Time .................................................... 2-50Figure 2.2.2-2.Increase in FW Flow at Full Power - Multi-Loop Manual Rod Control Core Average Moderator Temperature and Pressurizer Pressure versus Time ................ 2-51Figure 2.2.2-3.Increase in FW Flow at Full Power - Multi-Loop Manual Rod Control SG Mass Inventory and Pressure versus Time .............................................................. 2-52Figure 2.2.2-4.Increase in FW Flow at Full Power - Multi-Loop Manual Rod Control DNBR versus Time ................................................................................................. 2-53Figure 2.2.3-1.10% Step Increase in Heat Removal by Secondary System Minimum Reactivity Feedback, Manual Reactor Control ....................................................... 2-60Figure 2.2.3-2.10% Step Increase in Heat Removal by Secondary System Minimum Reactivity Feedback, Automatic Reactor Control ................................................... 2-62Figure 2.2.3-3.10% Step Increase in Heat Removal by Secondary System Maximum Reactivity Feedback, Manual Reactor Control ....................................................... 2-64Figure 2.2.3-4.10% Step Increase in Heat Removal by Secondary System Maximum Reactivity Feedback, Automatic Reactor Control ................................................... 2-66Figure 2.2.4-1. Accidental Depressurization of the MSS at HZP -Nuclear Power and Core Heat Flux versus Time ............................................................................................. 2-74Figure 2.2.4-2.Accidental Depressurization of the MSS at HZP Reactor Vessel Inlet Temperature and Core Average Temperature versus Time ...................................... 2-75Figure 2.2.4-3.Accidental Depressurization of the MSS at HZP - Pressurizer Pressure and Pressurizer Water Volume versus Time ................................................................... 2-76 xi WCAP-17658-NP September 2016 Licensing Report Revision 1-C Figure 2.2.4-4.Accidental Depressurization of the MSS at HZP Core Boron Concentration and Reactivity versus Time ..................................................................................... 2-77Figure 2.2.4-5.Accidental Depressurization of the MSS at HZP - Steam Pressure and Steam (Break) Flow versus Time ....................................................................................... 2-78Figure 2.2.4-6Accidental Depressurization of the MSS at HZP - FW Flow and SG Mass versus Time ............................................................................................................. 2-79Figure 2.2.4-7.Accidental Depressurization of the MSS at HZP Core Flow versus Time ........... 2-80Figure 2.2.5.1-1.Steam System Piping Failure at HZP (1.388 ft 2 Break with Offsite Power Available) Nuclear Power and Core Heat Flux versus Time ................................ 2-89Figure 2.2.5.1-2.Steam System Piping Failure at HZP (1.388 ft 2 Break with Offsite Power Available) Reactor Vessel Inlet Temperature and Core Average Temperature versus Time ............................................................................................................. 2-90Figure 2.2.5.1-3.Steam System Piping Failure at HZP (1.388 ft 2 Break with Offsite Power Available) Pressurizer Pressure and Pressurizer Water Volume versus Time ................................................................................................ 2-91Figure 2.2.5.1-4.Steam System Piping Failure at HZP (1.388 ft 2 Break with Offsite Power Available) Core Boron Concentration and Reactivity versus Time ............................................................................................ 2-92Figure 2.2.5.1-5.Steam System Piping Failure at HZP (1.388 ft 2 Break with Offsite Power Available) Steam Pressure and Steam (Break) Flow versus Time .................................................................................................... 2-93Figure 2.2.5.1-6.Steam System Piping Failure at HZP (1.388 ft 2 Break with Offsite Power Available) FW Flow and SG Mass versus Time ........................... 2-94Figure 2.2.5.1-7.Steam System Piping Failure at HZP (1.388 ft 2 Break with Offsite Power Available) Core Flow versus Time ................................................ 2-95Figure 2.2.5.1-8.Steam System Piping Failure at HZP (1.388 ft 2 Break without Offsite Power Available) Nuclear Power and Core Heat Flux versus Time ......... 2-96Figure 2.2.5.1-9.Steam System Piping Failure at HZP (1.388 ft 2 Break without Offsite Power Available) Reactor Vessel Inlet Temperature and Core Average Temperature versus Time .................................................................. 2-97Figure 2.2.5.1-10.Steam System Piping Failure at HZP (1.388 ft 2 Break without Offsite Power Available) Pressurizer Pressure and Pressurizer Water Volume versus Time ...... 2-98Figure 2.2.5.1-11.Steam System Piping Failure at HZP (1.388 ft 2 Break without Offsite Power Available) Core Boron Concentration and Reactivity versus Time ..................... 2-99Figure 2.2.5.1-12.Steam System Piping Failure at HZP (1.388 ft 2 Break without Offsite Power Available) Steam Pressure and Steam (Break) Flow versus Time ..................... 2-100Figure 2.2.5.1-13.Steam System Piping Failure at HZP (1.388 ft 2 Break without Offsite Power Available) FW Flow and SG Mass versus Time ................................................ 2-101 xii WCAP-17658-NP September 2016 Licensing Report Revision 1-C Figure 2.2.5.1-14.Steam System Piping Failure at HZP (1.388 ft 2 Break without Offsite Power Available) Core Flow versus Time ..................................................................... 2-102Figure 2.2.5.2-1.Steam System Piping Failure at HFP (1.04 ft 2 Break) Nuclear Power and Core Heat Flux versus Time .................................................................................. 2-108Figure 2.2.5.2-2.Steam System Piping Failure at HFP (1.04 ft 2 Break) Pressurizer Pressure and Pressurizer Water Volume versus Time .......................................................... 2-109Figure 2.2.5.2-3.Steam System Piping Failure at HFP (1.04 ft 2 Break) Reactor Vessel Inlet Temperature and Loop Average Temperature versus Time ................................... 2-110Figure 2.2.5.2-4.Steam System Piping Failure at HFP (1.04 ft 2 Break) Steam Pressure and Break Flow versus Time ........................................................................................ 2-111Figure 2.3.1-1.LOL/TT, Minimum DNBR Case Nuclear Power and SG Pressure versus Time ....................................................................................................................... 2-119Figure 2.3.1-2.LOL/TT, Minimum DNBR Case Pressurizer Pressure and Pressurizer Water Volume versus Time ................................................................. 2-120Figure 2.3.1-3.LOL/TT, Minimum DNBR Case RCS Temperatures and DNBR versus Time . 2-121Figure 2.3.1-4. LOL/TT, Peak MSS Pressure Case Nuclear Power and SG Pressure versus Time ....................................................................................... 2-122Figure 2.3.1-5.LOL/TT, Peak MSS Pressure Case Pressurizer Pressure and Pressurizer Water Volume versus Time .................................................................................... 2-123Figure 2.3.1-6.LOL/TT, Peak MSS Pressure Case RCS Temperatures versus Time ................. 2-124Figure 2.3.1-7.LOL/TT, Peak RCS Pressure Case Nuclear Power and SG Pressure versus Time ........................................................................................................... 2-125Figure 2.3.1-8.LOL/TT, Peak RCS Pressure Case RCS Pressures and Pressurizer Water Volume versus Time ................................................................. 2-126Figure 2.3.1-9.LOL/TT, Peak RCS Pressure Case RCS Temperatures versus Time ................. 2-127Figure 2.3.2-1. LOAC - Nuclear Power versus Time ................................................................... 2-134Figure 2.3.2-2. LOAC - Core Average Heat Flux versus Time ..................................................... 2-135Figure 2.3.2-3. LOAC - Reactor Coolant Loop Flow versus Time ............................................... 2-136Figure 2.3.2-4. LOAC - Hot Leg and Cold Leg Temperatures versus Time ................................. 2-137Figure 2.3.2-5. LOAC - Actual Pressurizer Pressure versus Time ................................................ 2-138Figure 2.3.2-6. LOAC - Pressurizer Water Volume versus Time ................................................. 2-139Figure 2.3.2-7. LOAC - SG Pressure versus Time ........................................................................ 2-140Figure 2.3.2-8. LOAC - Indicated SG Level versus Time ............................................................. 2-141Figure 2.3.2-9. LOAC - SG Mass versus Time ............................................................................. 2-14 2

xiii WCAP-17658-NP September 2016 Licensing Report Revision 1-C Figure 2.3.2-10. LOAC - Loop AFW Flow versus Time ................................................................ 2-143Figure 2.3.3-1. LONF - Nuclear Power versus Time .................................................................... 2-151Figure 2.3.3-2. LONF - Core Average Heat Flux versus Time...................................................... 2-152Figure 2.3.3-3. LONF - Reactor Coolant Loop Flow versus Time ............................................... 2-153Figure 2.3.3-4. LONF - HL and CL Temperatures versus Time .................................................... 2-154Figure 2.3.3-5. LONF - Actual Pressurizer Pressure versus Time ................................................ 2-155Figure 2.3.3-6. LONF - Pressurizer Water Volume versus Time ................................................... 2-156Figure 2.3.3-7. LONF - SG Pressure versus Time ........................................................................ 2-157Figure 2.3.3-8. LONF - Indicated SG Level versus Time ............................................................. 2-158Figure 2.3.3-9. LONF - SG Mass versus Time .............................................................................. 2-15 9Figure 2.3.3-10. LONF - Loop AFW Flow versus Time ................................................................. 2-160Figure 2.3.4-1.FW Line Break with Offsite Power Available Nuclear Power, Core Heat Flux and Total Core Reactivity versus Time ......................................................... 2-170Figure 2.3.4-2.FW Line Break with Offsite Power Available Pressurizer Pressure and Pressurizer Water Volume versus Time ................................................................. 2-171Figure 2.3.4-3.FW Line Break with Offsite Power Available Reactor Coolant Flow and FW Line Break Flow versus Time ............................................................................... 2-172Figure 2.3.4-4.FW Line Break with Offsite Power Available Faulted Loop and Intact Loop Reactor Coolant Temperatures versus Time .......................................................... 2-173Figure 2.3.4-5.FW Line Break with Offsite Power Available SG Shell Pressure versus Time ....................................................................................................................... 2-174Figure 2.3.4-6.FW Line Break without Offsite Power Nuclear Power, Core Heat Flux and Total Core Reactivity versus Time ........................................................................ 2-175Figure 2.3.4-7.FW Line Break without Offsite Power Pressurizer Pressure and Pressurizer Water Volume versus Time .................................................................................... 2-176Figure 2.3.4-8.FW Line Break without Offsite Power Reactor Coolant Flow and FW Line Break Flow versus Time ........................................................................................ 2-177Figure 2.3.4-9.FW Line Break without Offsite Power Faulted Loop and Intact Loop Reactor Coolant Temperatures versus Time .......................................................... 2-178Figure 2.3.4-10.FW Line Break without Offsite Power SG Shell Pressure versus Time ........... 2-179Figure 2.4.1-1. PLOF - Core Volumetric Flow Rate versus Time ................................................. 2-185Figure 2.4.1-2. PLOF - Loop Volumetric Flow Rates versus Time ............................................... 2-186Figure 2.4.1-3. PLOF - Nuclear Power versus Time ..................................................................... 2-187Figure 2.4.1-4. PLOF - Pressurizer Pressure versus Time ............................................................ 2-188 xiv WCAP-17658-NP September 2016 Licensing Report Revision 1-C Figure 2.4.1-5. PLOF - Core Average Heat Flux versus Time ...................................................... 2-189Figure 2.4.1-6. PLOF - Hot Channel Heat Flux versus Time ........................................................ 2-190Figure 2.4.1-7. PLOF - Minimum DNBR versus Time ................................................................. 2-191Figure 2.4.1-8. CLOF - Core Volumetric Flow Rate versus Time ................................................ 2-192Figure 2.4.1-9. CLOF - Loop Volumetric Flow Rates versus Time .............................................. 2-193Figure 2.4.1-10. CLOF - Nuclear Power versus Time .................................................................... 2-194Figure 2.4.1-11. CLOF - Pressurizer Pressure versus Time ............................................................ 2-195Figure 2.4.1-12. CLOF - Core Average Heat Flux versus Time ...................................................... 2-196Figure 2.4.1-13. CLOF - Hot Channel Heat Flux versus Time ....................................................... 2-197Figure 2.4.1-14. CLOF - Minimum DNBR versus Time ................................................................ 2-198Figure 2.4.1-15. CLOF-UF - Core Volumetric Flow Rate versus Time .......................................... 2-199Figure 2.4.1-16. CLOF-UF - Loop Volumetric Flow Rates versus Time ........................................ 2-200Figure 2.4.1-17. CLOF-UF - Nuclear Power versus Time .............................................................. 2-201Figure 2.4.1-18. CLOF-UF - Pressurizer Pressure versus Time ...................................................... 2-202Figure 2.4.1-19. CLOF-UF - Core Average Heat Flux versus Time ............................................... 2-203Figure 2.4.1-20. CLOF-UF - Hot Channel Heat Flux versus Time ................................................. 2-204Figure 2.4.1-21. CLOF-UF - Minimum DNBR versus Time .......................................................... 2-205Figure 2.4.2-1.RCP Locked Rotor/Shaft Break Overpressurization/PCT Case Core Volumetric Flow Rates versus Time ...................................................................... 2-213Figure 2.4.2-2.RCP Locked Rotor/Shaft Break Overpressurization/PCT Case Faulted Loop Volumetric Flow Rates versus Time ...................................................................... 2-214Figure 2.4.2-3.RCP Locked Rotor/Shaft Break Overpressurization/PCT Case Maximum RCS Pressure versus Time .................................................................................... 2-215Figure 2.4.2-4.RCP Locked Rotor/Shaft Break Overpressurization/PCT Case Nuclear Power versus Time ................................................................................................ 2-216Figure 2.4.2-5.RCP Locked Rotor/Shaft Break Overpressurization/PCT Case Core Heat Flux versus Time ................................................................................................... 2-217Figure 2.4.2-6.RCP Locked Rotor/Shaft Break Overpressurization/PCT Case PCT versus Time ....................................................................................................................... 2-218Figure 2.4.2-7.RCP Locked Rotor/Shaft Break Rods-in-DNB Case Core Volumetric Flow Rate versus Time ................................................................................................... 2-219Figure 2.4.2-8.RCP Locked Rotor/Shaft Break Rods-in-DNB Case Loop Volumetric Flow Rates versus Time .................................................................................................. 2-220 xv WCAP-17658-NP September 2016 Licensing Report Revision 1-C Figure 2.4.2-9.RCP Locked Rotor/Shaft Break Rods-in-DNB Case Pressurizer Pressure versus Time ............................................................................................. 2-221Figure 2.4.2-10.RCP Locked Rotor/Shaft Break Rods-in-DNB Case Nuclear Power versus Time ........................................................................................................... 2-222Figure 2.4.2-11.RCP Locked Rotor/Shaft Break Rods-in-DNB Case Core Average Heat Flux versus Time ................................................................................................... 2-223Figure 2.4.2-12.RCP Locked Rotor/Shaft Break Rods-in-DNB Case Hot Channel Heat Flux versus Time ........................................................................................................... 2-224Figure 2.5.1-1. Rod Withdrawal from Subcritical - Nuclear Power versus Time ......................... 2-231Figure 2.5.1-2. Rod Withdrawal from Subcritical - Core Average Heat Flux versus Time ........... 2-232Figure 2.5.1-3. Rod Withdrawal from Subcritical - Fuel Average Temperature versus Time ....... 2-233Figure 2.5.1-4. Rod Withdrawal from Subcritical - Cladding Surface Temperature versus Time 2-234Figure 2.5.2-1.RCCA Bank Withdrawal at Power - Minimum Reactivity Feedback 100 Percent Power - 110 pcm/sec Nuclear Power and Core Heat Flux versus Time ....................................................................................................................... 2-244Figure 2.5.2-2.RCCA Bank Withdrawal at Power - Minimum Reactivity Feedback 100 Percent Power - 110 pcm/sec Pressurizer Pressure and Water Volume versus Time ........................................................................................................... 2-245Figure 2.5.2-3.RCCA Bank Withdrawal at Power - Minimum Reactivity Feedback 100 Percent Power - 110 pcm/sec Vessel Average Temperature and DNBR versus Time ........................................................................................................... 2-246Figure 2.5.2-4.RCCA Bank Withdrawal at Power - Minimum Reactivity Feedback 100 Percent Power - 1 pcm/sec Nuclear Power and Core Heat Flux versus Time ....................................................................................................................... 2-247Figure 2.5.2-5.RCCA Bank Withdrawal at Power - Minimum Reactivity Feedback 100 Percent Power - 1 pcm/sec Pressurizer Pressure and Water Volume versus Time ........................................................................................................... 2-248Figure 2.5.2-6.RCCA Bank Withdrawal at Power - Minimum Reactivity Feedback

100 Percent Power - 1 pcm/sec Vessel Average Temperature and DNBR versus Time ........................................................................................................... 2-249Figure 2.5.2-7.RCCA Bank Withdrawal at Power -100 Percent Power Minimum DNBR versus Reactivity Insertion Rate ............................................................................ 2-250Figure 2.5.2-8.RCCA Bank Withdrawal at Power - 60 Percent Power Minimum DNBR versus Reactivity Insertion Rate ............................................................................ 2-251Figure 2.5.2-9.RCCA Bank Withdrawal at Power - 10 Percent Power Minimum DNBR versus Reactivity Insertion Rate ............................................................................ 2-252 xvi WCAP-17658-NP September 2016 Licensing Report Revision 1-C Figure 2.5.2-10.RCCA Bank Withdrawal at Power - Minimum Reactivity Feedback Limiting Overpressure Case Nuclear Power and Core Heat Flux versus Time ................ 2-253Figure 2.5.2-11.RCCA Bank Withdrawal at Power - Minimum Reactivity Feedback Limiting Overpressure Case Pressurizer Pressure and Water Volume versus Time .......... 2-254Figure 2.5.2-12.RCCA Bank Withdrawal at Power - Minimum Reactivity Feedback Limiting Overpressure Case Vessel Average Temperature and Peak RCS Pressure versus Time ........................................................................................................... 2-255Figure 2.5.6-1. Rod Ejection - BOL/HZP .....................................................................................

2-284Figure 2.5.6-2. Rod Ejection - BOL/HFP ......................................................................................

2-285Figure 2.5.6-3. Rod Ejection - EOL/HZP ......................................................................................

2-286Figure 2.5.6-4. Rod Ejection - EOL/HFP ......................................................................................

2-287Figure 2.6.1-1. Inadvertent ECCS - Nuclear Power and T avg versus Time .................................... 2-294Figure 2.6.1-2. Inadvertent ECCS - Pressurizer Pressure and Water Volume versus Time ........... 2-295Figure 2.6.1-3.Inadvertent ECCS - Total Steam Flow and Total Flow Injected to the RCS versus Time ................................................................................................... 2-296Figure 2.6.2-1.CVCS Malfunction, Maximum Reactivity Feedback, With Pressurizer Spray Nuclear Power and T avg versus Time ..................................................................... 2-302Figure 2.6.2-2.CVCS Malfunction, Maximum Reactivity Feedback, With Pressurizer Spray Pressurizer Pressure and Water Volume versus Time ............................................ 2-303Figure 2.6.2-3.CVCS Malfunction, Maximum Reactivity Feedback, Without Pressurizer Spray Nuclear Power and Tavg versus Time ....................................................... 2-304Figure 2.6.2-4.CVCS Malfunction, Maximum Reactivity Feedback, Without Pressurizer Spray Pressurizer Pressure and Water Volume versus Time .............................. 2-305Figure 2.6.2-5.CVCS Malfunction, Minimum Reactivity Feedback, With Pressurizer Spray Nuclear Power and T avg versus Time ..................................................................... 2-306Figure 2.6.2-6.CVCS Malfunction, Minimum Reactivity Feedback, With Pressurizer Spray Pressurizer Pressure and Water Volume versus Time ............................................ 2-307Figure 2.6.2-7.CVCS Malfunction, Minimum Reactivity Feedback, Without Pressurizer Spray Nuclear Power and Tavg versus Time ....................................................... 2-308Figure 2.6.2-8.CVCS Malfunction, Minimum Reactivity Feedback, Without Pressurizer Spray Pressurizer Pressure and Water Volume versus Time .............................. 2-309Figure 2.7.1-1. RCS Depressurization - Nuclear Power versus Time ........................................... 2-314Figure 2.7.1-2. RCS Depressurization - Pressurizer Pressure versus Time ................................... 2-314Figure 2.7.1-3. RCS Depressurization - Indicated Loop Average Temperature versus Time ........ 2-315Figure 2.7.1-4. RCS Depressurization - DNBR versus Time ........................................................ 2-315 xvii WCAP-17658-NP September 2016 Licensing Report Revision 1-C Figure 2.7.2-1. Pressurizer Level - Margin to Overfill Analysis ................................................... 2-328Figure 2.7.2-2. Pressurizer Pressure - Margin to Overfill Analysis ............................................... 2-329Figure 2.7.2-3. Secondary Pressure - Margin to Overfill Analysis ............................................... 2-330Figure 2.7.2-4. Primary to Secondary Break Flow - Margin to Overfill Analysis ........................ 2-331Figure 2.7.2-5. SG Water Volumes - Margin to Overfill Analysis ................................................ 2-332Figure 2.7.2-6. SG Steam Releases - Margin to Overfill Analysis ................................................ 2-333Figure 2.7.2-7. Ruptured Loop RCS Temperature - Margin to Overfill Analysis ......................... 2-334Figure 2.7.2-8. Intact Loops RCS Temperature - Margin to Overfill Analysis ............................. 2-335Figure 2.7.3-1. Pressurizer Level - Input to Radiological Consequences Analysis ....................... 2-346Figure 2.7.3-2. Pressurizer Pressure - Input to Radiological Consequences Analysis .................. 2-347Figure 2.7.3-3. Secondary Pressure - Input to Radiological Consequences Analysis ................... 2-348Figure 2.7.3-4. Primary to Secondary Break Flow - Input to Radiological Consequences Analysis ................................................................................................................. 2-34 9Figure 2.7.3-5.SG Steam Releases - Input to Radiological Consequences Analysis.................... 2-350Figure 2.7.3-6.Ruptured Loop Hot Leg and Cold Leg Temperatures - Input to Radiological Consequences Analysis ......................................................................................... 2-351Figure 2.7.3-7.Intact Loop Hot Leg and Cold Leg Temperatures - Input to Radiological Consequences Analysis ......................................................................................... 2-352Figure 2.7.3-8. Break Flow Flashing Fraction - Input to Radiological Consequences Analysis ... 2-353Figure 2.7.3-9. Integrated Flashed Break Flow - Input to Radiological Consequences Analysis . 2-354Figure 2.7.3-10. Ruptured SG Fluid Mass - Input to Radiological Consequences Analysis ........... 2-355Figure 2.7.3-11. Ruptured SG Water Volume - Input to Radiological Consequences Analysis ...... 2-356Figure 2.7.4-1. Post-LOCA Subcriticality Boron Limit Curve ...................................................... 2-366Figure 2.7.4-2. Boric Acid Solubility Limit .................................................................................

.. 2-367Figure 2.7.4-3.LBLOCA Boric Acid Concentration Analysis - Vessel Boric Acid Concentration, Boil-off, and Flushing Flow versus Time ..................................... 2-368Figure 2.7.4-4.SBLOCA Boric Acid Concentration Analysis - Vessel Boric Acid Concentration, Boil-off, and Flushing Flow versus Time ..................................... 2-369Figure 2.7.4-5. Core Dilution at 12 Hours for SBLOCA Pressure Hangup ................................... 2-370Figure 2.8.1-1. LOL ATWS Nuclear Power versus Time ........................................................... 2-375Figure 2.8.1-2. LOL ATWS Core Heat Flux versus Time .......................................................... 2-375Figure 2.8.1-3. LOL ATWS RCS Pressure versus Time ............................................................. 2-376 xviii WCAP-17658-NP September 2016 Licensing Report Revision 1-C Figure 2.8.1-4. LOL ATWS Pressurizer Water Volume versus Time .......................................... 2-376Figure 2.8.1-5. LOL ATWS Vessel Inlet Temperature versus Time ............................................ 2-377Figure 2.8.1-6. LOL ATWS RCS Flow versus Time .................................................................. 2-377Figure 2.8.1-7. LOL ATWS SG Pressure versus Time ............................................................... 2-378Figure 2.8.1-8. LOL ATWS SG Mass versus Time ..................................................................... 2-378Figure 2.8.1-9. LONF ATWS Nuclear Power versus Time ........................................................ 2-379Figure 2.8.1-10. LONF ATWS Core Heat Flux versus Time ........................................................ 2-379Figure 2.8.1-11. LONF ATWS RCS Pressure versus Time .......................................................... 2-380Figure 2.8.1-12. LONF ATWS Pressurizer Water Volume versus Time ....................................... 2-380Figure 2.8.1-13. LONF ATWS Vessel Inlet Temperature versus Time ......................................... 2-381Figure 2.8.1-14. LONF ATWS RCS Flow versus Time ................................................................ 2-381Figure 2.8.1-15. LONF ATWS SG Pressure versus Time ............................................................. 2-382Figure 2.8.1-16. LONF ATWS SG Mass versus Time .................................................................. 2-382 xix WCAP-17658-NP September 2016 Licensing Report Revision 1-C LIST OF ACRONYMS AC alternating current AEC Atomic Energy Commission AFW auxiliary feedwater AMSAC ATWS mitigation system actuation circuitry ANS American Nuclear Society ANSI American National Standards Institute AOOs anticipated operational occurrences AOR analysis of record ARV atmospheric relief valve ASME B&PV American Society of Mechanical Engineers Boiler & Pressure Vessel

AST Alternative Source Term ATWS anticipated transient without scram BAPC boric acid precipitation control eff effective delayed neutron fraction BOC beginning of cycle BOL beginning of life CCP centrifugal charging pump CDSA core design and safety analyses CFR Code Federa l Regulations CHF critical heat flux CL cold leg CLOF complete loss of flow COLR Core Operating Limits Report CRDM control rod drive mechanism

CST condensate storage tank CVCS chemical and volume control system DC direct current DHR decay heat removal DNB departure from nucleate boiling DNBR departure from nucleate boiling ratio DPC Doppler power coefficient DTC Doppler temperature coefficient ECCS emergency core cooling system EOC end of cycle EOL end of life EOP emergency operating procedure ESFAS engineered safety features actuation system FCV flow control valve F NH radial peaking factor FOI fraction of initial FON fraction of nominal F Q total peaking factor xx WCAP-17658-NP September 2016 Licensing Report Revision 1-C LIST OF ACRONYMS (cont.) FW feedwater FWI feedwater isolation FWM feedwater malfunction GDC general design criterion HFP hot full power HL hot leg HLSO hot leg switchover HZP hot zero power IFM intermediate flow mixing vanes ITC isothermal temperature coefficient Keff effective multiplication factor LBLOCA large-break LOCA LCO limiting condition for operation LOAC loss of non-emergency AC LOCA loss-of-coolant accident LOL loss of load LOL/TT loss of load/turbine trip LONF loss of normal feedwater LOOP loss of offsite power LTC long-term cooling MDAFW motor-driven AFW MMF minimum measured flow MSIV main steam isolation valve MSS main steam system MSSV main steam safety valve MTC moderator temperature coefficient MUR measurement uncertainty recapture NRS narrow-range span NSSS nuclear steam supply system OTT overtemperature T OPT overpower T pcm percent millirho PCT peak cladding temperature PLOF partial loss of flow PORV power operated relief valve ppm part per million PSV pressurizer safety valve PWR pressurized water reactor RCCA rod cluster control assembly RCP reactor coolant pump RCPB reactor coolant pressure boundary RCS reactor coolant system xxi WCAP-17658-NP September 2016 Licensing Report Revision 1-C LIST OF ACRONYMS (cont.) RFA-2 Robust Fuel Assembly-2 RG Regulatory Guide RHR residual heat removal RHRS residual heat removal system RMWS reactor makeup water system RPS reactor protection system RPV reactor pressure vessel RSE Reload Safety Evaluation RTD resistance temperature detectors RTDP Revised Thermal Design Procedure RTP rated thermal power RTS reactor trip system RWAP rod withdrawal at power RWST refueling water storage tank SAFDLs specified acceptable fuel design limits SAL safety analysis limit SBLOCA small-break LOCA SER Safety Evaluation Report SG steam generator SGTP steam generator tube plugging SGTR steam generator tube rupture SI safety injection SLB steam line break SLI steam line isolation STDP Standard Thermal Design Procedure T avg (reactor) vessel average temperature TCD thermal conductivity degradation T/H thermal-hydraulic TDAFW turbine-driven AFW TDF thermal design flow T feed feedwater temperature TM Transition of Methods TPI thimble plugs installed TPR thimble plugs removed TS Technical Specification TT turbine trip (Section 2.1 Tables only)

UF underfrequency

USAR Updated Safety Analysis Report USNRC United States Nuclear Regulatory Commission UV undervoltage VCT volume control tank WCAP Westinghouse Commercial Atomic Power (topical report)

WCGS Wolf Creek Generating Station WCNOC Wolf Creek Nuclear Operating Corporation xxii WCAP-17658-NP September 2016 Licensing Report Revision 1-C PROFESSIONAL ENGINEERING STAMPS This section contains the State of Kansas Professional Engineer certifications for each of the sections pertaining to technical services scope supporting the Wolf Creek Generating Station plant design or design configuration. Each Professional Engineer has designated applicable scope sections for which they provided Practice of Engineering oversight and for which their certification applies.

1-1 WCAP-17658-NP September 2016 Licensing Report Revision 1-C 1 INTRODUCTION General Overview This Transition of Methods (TM) for Core Design and Safety Analyses (CDSA) licensing report is provided by Wolf Creek Nuclear Operating Corporation (WCNOC) in support of the TM license amendment application for the Wolf Creek Generating Station (WCGS). WCNOC plans to transition from its current methodology for performing core desi gn, non-loss-of-coolant-accident (non-LOCA) and LOCA safety analyses (Post-LOCA Subcriticality and Cooling) to the Westinghouse methodologies for performing these analyses. Westinghouse currently holds the analysis of record (AOR) for both the small-break (SB) and large-break (LB) LOCA; therefore SBLOCA and LBLOCA are not included in the transition effort. For safety analyses that were reanalyzed, they were conservatively reanalyzed at the higher nominal power level associated with a Measurement Uncertainty Recapture (MUR) power uprate. The reanalysis effort did not assume any other plant or analysis input changes that may be required to support an actual MUR power uprate. Also, the core design effort did not assume any other plant or analysis input changes that may be required to support an actual MUR power uprate.

Note that even though some analyses were performed at an uprated power (representative of an MUR), the MUR conditions (i.e., NSSS power) would be bounding for plant operation at current rated thermal power (RTP).

It is not the intent of this licensing amendment application to request approval of an MUR power uprate. This document addresses the transition to the approved Westinghouse methodologies only.

This report summarizes the analyses that were performed to confirm that applicable acceptance criteria are met. Sections 2.0 through 2.12 of this TM CDSA licensing report provide the results of the accident analyses and core design efforts.

1-2 WCAP-17658-NP September 2016 Licensing Report Revision 1-C

1.1 NUCLEAR

STEAM SUPPLY SYSTEM PARAMETERS

1.1.1 Introduction

The nuclear steam supply system (NSSS) design parameters are the fundamental parameters used as input in all of the NSSS accident analyses. The current WCGS NSSS design parameters are summarized in Table 5.1-1 of the WCGS Updated Safety Analysis Report (USAR). The NSSS design parameters provide the primary and secondary side system conditions (thermal power, temperatures, pressures, and flows) that serve as the basis for all of the NSSS analyses and evaluations. As a result of the TM Program, the WCGS NSSS design parameters have been revised, as shown in Tables 1.1-1 and 1.1-2. Tables 1.1-1 and 1.1-2 provide information for the eight cases associated with the TM Program at current power and MUR Uprate conditions, respectively. These parameters have been incorporated, as appropriate, into the applicable CDSA, performed in support of the TM Program.

1.1.2 Input

Parameters, Assumptions, and Acceptance Criteria The NSSS design parameters provide the reactor coolant system (RCS) and secondary system conditions (thermal power, temperatures, pressures, and flows) that are used as the basis for the NSSS design transients, systems, structures, components, accident, and fuel analyses and evaluations. For the TM Program at the current licensed power level, the established majo r input parameters and assumptions used to calculate the four cases of NSSS design parameters are summarized as follows:

1. The parameters are based on Westinghouse Model F steam generators (SGs).
2. The NSSS power level of 3579 MWt (3565 MWt r eactor core power + 14 MWt net heat input) was assumed.
3. A nominal feedwater temperature (T feed) range of 400.0°F to 446.0°F was selected.
4. Two design core bypass flows were used: 8.4 percent, which accounts for fuel with thimble plugs removed (TPR) and intermediate flow mixing vanes (IFMs); and 6.4 percent, which accounts for fuel with thimble plugs installed (TPI) and IFMs.
5. A thermal design flow (TDF) of 90,300 gpm/loop was assumed based on a TDF of 90,324 gpm/loop rounded to the nearest hundred gpm/loop.
6. A full-power normal operating vessel average temperature (T avg) range of 570.7°F to 588.4°F was assumed. This provides the basis for the WCGS to operate within this window. Any exceptions to these values will be addressed in the affected sections.
7. Steam generator tube plugging (SGTP) levels of 0 and 10 percent were assumed.
8. A maximum SG moisture carryover of 0.25 percent was utilized.

1-3 WCAP-17658-NP September 2016 Licensing Report Revision 1-C For the TM Program at the MUR Uprate power level, the established major input parameters and assumptions used to calculate the four cases of NSSS design parameters are summarized as follows:

1. The parameters are based on Westinghouse Model F SGs.
2. An uprated NSSS power level of 3651 MWt (3637 MWt reactor core power + 14 MWt net heat input) was assumed for MUR Uprate conditions.
3. A nominal T feed range of 400.0°F to 448.6°F was selected.
4. Two design core bypass flows were used: 8.4 percent, which accounts for fuel with TPR and IFMs; and 6.4 percent, which accounts for fuel with TPI and IFMs.
5. A TDF of 90,300 gpm/loop was assumed based on a TDF of 90,324 gpm/loop rounded to the nearest hundred gpm/loop.
6. A full-power normal operating T avg range of 570.7°F to 588.4°F was assumed. This provides the basis for the WCGS to operate within this window. Any exceptions to these values will be addressed in the affected sections.
7. SGTP levels of 0 and 10 percent were assumed.
8. A maximum SG moisture carryover of 0.25 percent was utilized. Acceptance Criteria The acceptance criteria for determining the NSSS design parameters were that the results of the accident analyses and evaluations continue to comply with all WCGS applicable industry and regulatory requirements, and that they provide WCGS with adequate flexibility and margin during plant operation.

1.1.3 Description

of Analyses and Evaluation Table 1.1-1 provides the NSSS design parameter cases that were generated and serve as the WCGS basis for the analyses considering the current licensed power level. These cases are as follows: Cases 1 and 2 of Table 1.1-1 represent parameters based on a T avg of 570.7°F. Case 2, which is based on an average 10 percent SGTP, yields the minimum secondary side SG pressure and temperature. Note that all primary side temperatures are identical for these two cases. Cases 3 and 4 of Table 1.1-1 represent parameters based on the T avg of 588.4°F. Case 3, which is based on 0 percent SGTP, yields the higher secondary side SG pressure performance conditions. Note that all primary side temperatures are identical for these two cases. As provided via footnote 4 of Table 1.1-1, for instances where an absolute upper limit SG outlet pressure is conservative for any analyses, these data are based on the Case 3 parameters with 0 percent SGTP and also assume a SG fouling factor of 0 hr-ft 2-°F/BTU.

1-4 WCAP-17658-NP September 2016 Licensing Report Revision 1-C Table 1.1-2 provides the NSSS design parameter cases that were generated and serve as the WCGS basis for the analyses considering MUR Uprate conditions. These cases are as follows: Cases 1 and 2 of Table 1.1-2 represent parameters based on a T avg of 570.7°F. Case 2, which is based on an average 10 percent SGTP, yields the minimum secondary side SG pressure and temperature. Note that all primary side temperatures are identical for these two cases. Cases 3 and 4 of Table 1.1-2 represent parameters based on the T avg of 588.4°F. Case 3, which is based on 0 percent SGTP, yields the highest secondary side SG pressure performance conditions. Note that all primary side temperatures are identical for these two cases. As provided via footnote 4 of Table 1.1-2, for instances where an absolute upper limit SG outlet pressure is conservative for any analyses, these data are based on the Case 3 parameters with 0 percent SGTP and also assume a SG fouling factor of 0 hr-ft 2-°F/BTU. 1.1.4 Conclusion The resulting NSSS design parameters (Tables 1.1-1 and 1.1-2) were used by Westinghouse as the basis for CDSA efforts. Westinghouse performed the analyses and evaluations based on the parameter sets that were most limiting, so that the analyses would su pport operation over the entire range of conditions specified. In cases where the analyses performed do not bound the entire range of conditions specified (such as a restricted T avg operating range), the applicable report section identifies the range of conditions analyzed for the TM Program.

1-5 WCAP-17658-NP September 2016 Licensing Report Revision 1-C Table 1.1-1 NSSS Design Parameters for WCGS TM Program Thermal Design Parameters Current Power - Safety Analysis Only Case 1 Case 2 Case 3 Case 4 NSSS Power, MWt 3579 3579 3579 3579 10 6 Btu/hr 12,212 12,212 12,212 12,212 Reactor Power, MWt 3565 3565 3565 3565 10 6 Btu/hr 12,164 12,164 12,164 12,164 Thermal Design Flow, gpm/loop 90,300 90,300 90,300 90,300 Reactor 10 6 lb/hr 138.2 138.2 134.7 134.7 Reactor Coolant Pressure , psia 2250 2250 2250 2250 Core Bypass, % 8.4 (1, 2) 8.4 (1, 2) 8.4 (1, 3) 8.4 (1, 3) Reactor Coolant Temperature, °F Core Outlet 609.8(2) 609.8(2) 626.2(3) 626.2(3) Vessel Outlet 604.3 604.3 621.0 621.0 Core Average 575.3(2) 575.3(2) 593.2(3) 593.2(3) Vessel Average 570.7 570.7 588.4 588.4 Vessel/Core Inlet 537.1 537.1 555.8 555.8 Steam Generator Outlet 536.8 536.8 555.5 555.5 Steam Generator Steam Outlet Temperature, °F 520.8 518.3 539.9 (4) 537.5 Steam Outlet Pressure, psia 818 801 962 (4) 943 Steam Outlet Flow, 10 6 lb/hr total 14.86/15.83 14.86/15.82 14.95/15.93 (4) 14.94/15.91 Feed Temperature, °F 400.0/446.0 400.0/446.0 400.0/446.0 400.0/446.0 Steam Outlet Moisture, % max. 0.25 0.25 0.25 0.25 Tube Plugging Level, % 0 10 0 10 Zero-Load Temperature, °F 557 557 557 557 Hydraulic Design Parameters Mechanical Design Flow, gpm/loop 104,200 Minimum Measured Flow, gpm total 371,000 Notes: 1. Core bypass flow accounts for TPR and IFMs. 2. If thimble plugs are installed, the core bypass flow is 6.4%, core outlet temperature is 608.4°F, and core average temperature is 574.5°F. 3. If thimble plugs are installed, the core bypass flow is 6.4%, core outlet temperature is 624.9°F, and core average temperature is 592.5°F. 4. Where appropriate for NSSS analyses, a greater steam outlet pressure of 984 psia, steam outlet temperature of 542.6°F and total steam outlet flow of 15.94 x 10 6 lb/hr may be assumed. This envelops the possibility that the plant could operate with more efficient SG performance.

1-6 WCAP-17658-NP September 2016 Licensing Report Revision 1-C Table 1.1-2 NSSS Design Parameters for WCGS TM Program Thermal Design Parameters MUR Uprate Power - Safety Analysis Only Case 1 Case 2 Case 3 Case 4 NSSS Power, MWt 3651 3651 3651 3651 10 6 Btu/hr 12,458 12,458 12,458 12,458 Reactor Power, MWt 3637 3637 3637 3637 10 6 Btu/hr 12,410 12,410 12,410 12,410 Thermal Design Flow, gpm/loop 90,300 90,300 90,300 90,300 Reactor 10 6 lb/hr 138.3 138.3 134.9 134.9 Reactor Coolant Pressure , psia 2250 2250 2250 2250 Core Bypass, % 8.4 (1,2) 8.4 (1,2) 8.4 (1,3) 8.4 (1,3) Reactor Coolant Temperature, °F Core Outlet 610.5(2) 610.5(2) 626.9(3) 626.9 (3) Vessel Outlet 604.9 604.9 621.6 621.6 Core Average 575.4 (2) 575.4(2) 593.3(3) 593.3(3) Vessel Average 570.7 570.7 588.4 588.4 Vessel/Core Inlet 536.5 536.5 555.2 555.2 Steam Generator Outlet 536.2 536.2 554.9 554.9 Steam Generator Steam Outlet Temperature, °F 519.7 517.2 538.9 (4) 536.4 Steam Outlet Pressure, psia 810 793 954 (4) 934 Steam Outlet Flow, 10 6 lb/hr total 15.16/16.21 15.15/16.20 15.24/16.30 (4) 15.23/16.29 Feed Temperature, °F 400.0/448.6 400.0/448.6 400.0/448.6 400.0/448.6 Steam Outlet Moisture, % max. 0.25 0.25 0.25 0.25 Tube Plugging Level, % 0 10 0 10 Zero Load Temperature, °F 557 557 557 557 Hydraulic Design Parameters Mechanical Design Flow, gpm/loop 104,200 Minimum Measured Flow, gpm total 371,000 Notes: 1. Core bypass flow accounts for TPR and IFMs. 2. If thimble plugs are installed, the core bypass flow is 6.4%, core outlet temperature is 609.1°F, and core average temperature is 574.6°F. 3. If thimble plugs are installed, the core bypass flow is 6.4%, core outlet temperature is 625.6°F, and core average temperature is 592.6°F. 4. Where appropriate for NSSS analyses, a greater steam outlet pressure of 976 psia, steam outlet temperature of 541.6°F and total steam outlet flow of 16.32 x 10 6 lb/hr may be assumed. This envelops the possibility that the plant could operate with more efficient SG performance.

2-1 WCAP-17658-NP September 2016 Licensing Report Revision 1-C 2 ACCIDENT AND TRANSIENT ANALYSIS 2.1 NON-LOCA ANALYSES INTRODUCTION Chapter 15, "Accident Analysis," of the WCGS USAR (Reference 1) identifies the non-LOCA transient events that have been analyzed as part of the current WCGS licensing basis. In support of the TM Program for the WCGS, most of the non-LOCA licensing basis events have been reanalyzed using Westinghouse Electric Company safety analysis methods previously approved by the United States Nuclear Regulatory Commission (USNRC). The non-LOCA events summarized in this introduction section are those discussed in greater detail in Sections 2.2 through 2.7.1, as well as the Anticipated Transient without Scram (ATWS) event discussed in Section 2.8. Other non-LOCA events, i.e., steam generator tube rupture (SGTR), are discussed elsewhere in this report.

2.1.1 Program

Features Key features of the TM Program that were considered in the non-LOCA transient analyses are as follows. A NSSS power level of 3651 MWt, which includes all applicable uncertainties and a nominal reactor coolant pump (RCP) net heat input of 14 MWt (or 20 MWt for events where higher RCP heat is conservative) Westinghouse 1717 Robust Fuel Assembly (RFA-2) fuel design with IFMs and thimble plugs either removed or installed (see Note below) A nominal, full-power T avg window of 570.7°F to 588.4°F A RCS TDF of 361,200 gpm (90,300 gpm/loop), and a minimum measured flow (MMF) of 376,000 gpm (94,000 gpm/loop) As indicated in Table 2.1-2, a bounding MMF value of 371,000 gpm (92,750 gpm/loop) was applied in all but one analysis where MMF is used as the RCS flow. Westinghouse Model F SGs, with a maximum SGTP level of 10 percent A nominal, full-power main Tfeed window of 400°F to 448.6°F A nominal operating pressurizer pressure of 2250 psia A design core bypass flow of 8.4 percent and a statistical core bypass flow of 6.61 percent, conservatively corresponding to having the core TPR (see Note below) Whereas the statistical core bypass flow is used in some departure from nucleate boiling ratio (DNBR) analyses, the design core bypass flow is used for all other non-LOCA analyses; see Section 2.1.5, "Initial Conditions," for additional details.

Note: Except for the limiting DNBR analysis of the uncontrolled rod cluster control assembly (RCCA) bank withdrawal at power event, all analyses covered the bounding scenario of having the core TPR. As a result of the exception, the plant may be required to operate with the core TPI.

2-2 WCAP-17658-NP September 2016 Licensing Report Revision 1-C 2.1.2 Non-LOCA Transient Events Considered The non-LOCA transient events considered in support of the TM Program for the WCGS are identified in the plant condition classification discussion presented below. As noted at the beginning of Section 2.1, the non-LOCA events discussed in this section are a subset of the non-LOCA licensing basis events. Plant Condition Classification The American Nuclear Society (ANS) Standard ANS-51.1-1973 (ANSI-N18.2) (Reference 2) provides classification of plant conditions that are divided into four categories based on the anticipated frequency of occurrence and the potential radiological consequences to the public. The four categories, or conditions, are: Condition I - Normal Operation and Operational Transients Condition II - Faults of Moderate Frequency Condition III - Infrequent Faults Condition IV - Limiting Faults The basic principle applied in relating design requirements to each of the conditions is that the most probable occurrences should yield the least radiological risk to the public, and those extreme situations having the potential for the greatest risk to the public shall be those least likely to occur. Where applicable, and to the extent allowed, the reactor trip system (RTS) and/or engineered safeguards features are applied in fulfilling this principle. Each condition is described in more detail as follows. Condition I - Normal Operation and Operational Transients Condition I occurrences are those that are expected frequently or regularly during power operation, refueling, maintenance, or maneuvering of the plant. Condition I occurrences are accommodated with margin between any plant parameter and the value of the parameter that would require either automatic or manual protective action. As Condition I events occur frequently, they must be considered from the point of view of their effect on the consequences of fault c onditions (Conditions II, III, and IV). In this regard, analysis of each fault condition described is genera lly based on a conservative set of initial conditions corresponding to adverse conditions that can occur during Condition I operation. A typical list of Condition I events is given below. Steady state and shutdown operations

- Power operation

- Startup - Hot standby

- Hot shutdown

- Cold shutdown

- Refueling 2-3 WCAP-17658-NP September 2016 Licensing Report Revision 1-C Operation with permissible deviations Various deviations from normal operation but specifically allowed by the Technical Specifications (TS) that may occur during continued operation are considered in conjunction with other operational modes. These include:

- Operation with components or systems out of service (such as an inoperable RCCA)

- Leakage from fuel with limited clad defects

- Excessive radioactivity in the reactor coolant Fission products Corrosion products Tritium - Operation with SG leaks

- Testing Operational transients

- Plant heatup and cooldown

- Step load changes (up to +/-10 percent)

- Ramp load changes (up to 5 percent per minute)

- Load rejection up to and including design full-load rejection transient Condition II - Faults of Moderate Frequency Condition II faults (or events) occur with moderate frequency during the life of the plant, any one of which may occur during a calendar year. These events, at worst, result in a reactor trip with the plant being capable of returning to operation after corrective action. A Condition II event, by itself, does not propagate to a more serious event of the Condition III or Condition IV type without the occurrence of other independent incidents. In addition, Condition II events should not cause the loss of any barrier to the escape of radioactive products. The following list identifies the Condition II non-LOCA events considered herein in support of the TM Program for the WCGS. Feedwater (FW) system malfunctions that result in a decrease in T feed (USAR Section 15.1.1) FW system malfunctions that result in an increase in FW flow (USAR Section 15.1.2) Excessive increase in secondary steam flow (USAR Section 15.1.3) 2-4 WCAP-17658-NP September 2016 Licensing Report Revision 1-C Inadvertent opening of a SG atmospheric relief or safety valve (USAR Section 15.1.4) Loss of external electrical load (USAR Section 15.2.2) Turbine trip (USAR Section 15.2.3) Inadvertent closure of main steam isolation valves (MSIVs) (USAR Section 15.2.4) Loss of condenser vacuum and other events resulting in turbine trip (USAR Section 15.2.5) Loss of non-emergency AC power to the station auxiliaries (USAR Section 15.2.6) Loss of normal FW flow (USAR Section 15.2.7) Partial loss of forced reactor coolant flow (USAR Section 15.3.1) Uncontrolled RCCA bank withdrawal from a subcritical or low power startup condition (USAR Section 15.4.1) Uncontrolled RCCA bank withdrawal at power (USAR Section 15.4.2) RCCA misoperation (dropped RCCA, dropped RCCA bank, and statically misaligned RCCA) (USAR Section 15.4.3) Startup of an inactive RCP at an incorrect temperature (USAR Section 15.4.4) Chemical and volume control system (CVCS) malfunction that results in a decrease in the boron

concentration in the reactor coolant (boron dilution) (USAR Section 15.4.6) Inadvertent operation of the emergency core cooling system (ECCS) during power operation (USAR Section 15.5.1) CVCS malfunction that increases reactor coolant inventory (USAR Section 15.5.2) Inadvertent opening of a pressurizer safety or relief valve (USAR Section 15.6.1) Condition III - Infrequent Faults Condition III events occur very infrequently during the life of the plant, any one of which may occur during the plant's lifetime. Condition III events can be accommodated with the failure of only a small fraction of the fuel rods, although sufficient fuel damage might occur to preclude resumption of operation for a considerable outage time. The release of radioactivity due to a Condition III event will not be sufficient to interrupt or restrict public use of those areas beyond the exclusion area boundary. A Condition III event does not, by itself, generate a Condition IV event or result in a consequential loss of 2-5 WCAP-17658-NP September 2016 Licensing Report Revision 1-C function of the RCS or containment barriers. The following list identifies the Condition III non-LOCA events considered herein in support of the TM Program for the WCGS. Steam system piping failure (minor) (USAR Section 15.1.5) Complete loss of forced reactor coolant flow (USAR Section 15.3.2) RCCA misoperation (withdrawal of a single RCCA) (USAR Section 15.4.3) Condition IV - Limiting Faults Condition IV events are not expected to occur, but are postulated because their consequences have the potential for the release of significant amounts of radioactive material. Condition IV events are the most drastic occurrences that must be designed against, and represent the limiting design cases. Condition IV events should not cause a fission product release to the environment resulting in an undue risk to public health and safety in excess of the guideline values in 10 CFR 100 (Code of Federal Regulations). A single Condition IV event shall not cause a consequential loss of required functions of the systems needed to cope with the event, including those of the ECCS and the reactor containment system. The following list identifies the Condition IV non-LOCA events considered herein in support of the TM Program for the WCGS. Steam system piping failure (major) (USAR Section 15.1.5) FW system pipe break (USAR Section 15.2.8) RCP shaft seizure (locked rotor) (USAR Section 15.3.3) RCP shaft break (USAR Section 15.3.4) Spectrum of RCCA ejection accidents (USAR Section 15.4.8) Summary of Non-LOCA Events Considered Table 2.1-1 presents a list of all the non-LOCA transient events that were considered in support of the TM Program for the WCGS to which this introductory discussion applies. Also included in Table 2.1-1 are cross references to the applicable USAR sections, cross references to the event-specific sections within this report, and assertions as to which events were analyzed versus evaluated.

2.1.3 Analysis

Methodology The transient-specific analysis methodologies that were applied in analyzing the non-LOCA transient events have been reviewed and approved by the USNRC via transient-specific topical reports, e.g., WCAPs, and/or through the review and approval of various licensing amendment request submittals for the WCGS or other plants. The following non-LOCA transients analyzed for the WCGS have an approved transient-specific topical report, and each topical report is identified and discussed below. Steam system piping failure (steam line break (SLB)) (USAR Sections 15.1.4 and 15.1.5) Dropped RCCA/dropped RCCA bank (dropped rod) (USAR Section 15.4.3) RCCA ejection (USAR Section 15.4.8) 2-6 WCAP-17658-NP September 2016 Licensing Report Revision 1-C Steam Line Break Analysis Methodology The SLB licensing topical report, WCAP-9226-P-A Revision 1 (Reference 3), was approved by the USNRC via a safety evaluation report (SER) from A. C. Thadani (USNRC) to W. J. Johnson (Westinghouse), dated January 31, 1989. The SLB SER identifies two conditions of acceptance, which are summarized below, along with justification for application to the WCGS.

1. "Only those codes which have been accepted by the USNRC should be used for licensing application."

Justification As identified in Table 2.1-2, the computer codes used in the analysis of the SLB event are RETRAN, ANC, and VIPRE. These computer codes are discussed in Section 2.1.4, "Computer Codes Used," and it is confirmed that these codes have been accepted by the USNRC.

Therefore, this condition of acceptance is satisfied for the WCGS.

2. "For the pressure between 500 and 1000 psia, the 95/95 DNBR limit for the W-3 correlation is 1.45."

Justification As discussed in Section 2.12, "Thermal and Hydraulic Design," the W-3 DNB (departure from nucleate boiling) correlation has been replaced with the WLOP DNB correlation, which has a different 95/95 DNBR limit. Table 2.1-6 presents the DNBR safety analysis limit (SAL) applied in the SLB analysis for which the WLOP DNB correlation was used. No further justification is required for the WCGS. Dropped Rod Analysis Methodology The dropped rod licensing topical report, WCAP-11394-P-A (Reference 4), was approved by the USNRC via an SER from A. C. Thadani (USNRC) to R. A. Newton (Westinghouse Owners Group), dated October 23, 1989. The dropped rod SER identifies one condition of acceptance, which is summarized below along with justification for application to the WCGS.

1. "The Westinghouse analysis, results, and comparisons are reactor and cycle specific. No credit is taken for any direct reactor trip due to dropped RCCA(s). Also, the analysis assumes no automatic power reduction features are actuated by the dropped RCCA(s). A further review by the staff (for each cycle) is not necessary, given the utility assertion that the analysis described by Westinghouse has been performed and the required comparisons have been made with favorable results."

Justification For the reference cycle assumed in the WCGS TM Program, the methodology described in WCAP-11394-P-A was applied and the required co mparisons have been made with acceptable 2-7 WCAP-17658-NP September 2016 Licensing Report Revision 1-C results (DNBR remains greater than the limit). Future fuel cycles will be assessed as part of the Reload Safety Evaluation (RSE) process described in Reference 7. RCCA Ejection Analysis Methodology The RCCA ejection licensing topical report, WCAP-7588 Revision 1-A (Reference 5), was approved by the Atomic Energy Commission (AEC) via an SER from D. B. Vassallo (AEC) to R. Salvatori (Westinghouse), dated August 28, 1973. The RCCA ejection SER identifies two conditions of acceptance, which are summarized below, along with justification for application to the WCGS.

1. "The staff position, as well as that of the reactor vendors over the last several years, has been to limit the average fuel pellet enthalpy at the hot spot following a rod ejection accident to 280 cal/gm. This was based primarily on the results of the SPERT tests, which showed that, in general, fuel failure consequences for UO 2 have been insignificant below 300 cal/gm for both irradiated and unirradiated fuel rods as far as rapid fragmentation and dispersal of fuel and cladding into the coolant are concerned. In this report, Westinghouse has decreased their limiting fuel failure criterion from 280 cal/gm (somewhat less than the threshold of significant conversion of the fuel thermal energy to mechanical energy) to 225 cal/gm for unirradiated rods and 200 cal/gm for irradiated rods. Since this is a conservative revision on the side of safety, the staff concludes that it is an acceptable fuel failure criterion."

Justification The maximum fuel pellet enthalpy at the hot spot calculated for each WCGS-specific RCCA ejection case was less than 200 cal/gm (see Table 2.1-6). These results satisfy the currently-accepted fuel failure criterion.

2. "Westinghouse proposes a clad temperature limitation of 2700°F as the temperature above which clad embrittlement may be expected. Although this is several hundred degrees above the maximum clad temperature limitation imposed in the AEC ECCS Interim Acceptance Criteria, this is felt to be adequate in view of the relatively short time at temperature and the highly localized effect of a reactivity transient."

Justification As discussed in Westinghouse letter NS-NRC-89-3466 to the USNRC (Reference 6), the 2700°F cladding temperature limit was historically applied by Westinghouse to demonstrate that the core remains in a coolable geometry during an RCCA ejection transient. This limit was never used to demonstrate compliance with fuel failure limits and is no longer used to demonstrate core coolability. The RCCA ejection acceptance criteria applied by Westinghouse to demonstrate long-term core coolability and compliance with applicable offsite dose requirements are identified in Section 2.5.6, "Spectrum of Rod Cluster Control Assembly Ejection Accidents."

2-8 WCAP-17658-NP September 2016 Licensing Report Revision 1-C

2.1.4 Computer

Codes Used Summary descriptions of the principal computer codes used in the non-LOCA transient analyses are provided below. Table 2.1-2 lists the computer codes used in each of the non-LOCA analyses. FACTRAN FACTRAN calculates the transient temperature distribution in a cross-section of a metal-clad UO 2 fuel rod and the transient heat flux at the surface of the cladding. The inputs are the nuclear power and the time-dependent coolant parameters of pressure, flow, temperature, and density. This code uses a fuel model with the following features: A sufficiently large number of radial space increments to handle fast transients such as an RCCA ejection accident Material properties that are functions of temperature A sophisticated fuel-to-cladding gap heat transfer calculation Calculations to address post-DNB conditions (film boiling heat transfer correlations, zircaloy-water reaction, and partial melting of the fuel) The FACTRAN licensing topical report, WCAP-7908-A (Reference 8), was approved by the USNRC via an SER from C. E. Rossi (USNRC) to E. P. Rahe (Westinghouse), dated September 30, 1986. The FACTRAN SER identifies seven conditions of acceptance, which are summarized in Appendix A.2, "FACTRAN for Non-LOCA Thermal Transients," along with justifications for application to the WCGS.

RETRAN RETRAN is used for studies of a pressurized water reactor (PWR) system transient response to specified perturbations in process parameters. This code simulates a multi-loop system by a lumped parameter model containing the reactor vessel, hot and cold leg piping, RCPs, SGs (tube and shell sides), main steam lines, and pressurizer. The pressurizer heaters, spray, relief valves, and safety valves can also be modeled. RETRAN includes a point neutron kinetics model and reactivity effects of the moderator, fuel, boron, and control rods. The secondary side of the SG uses a detailed nodalization for the thermal transients. The reactor protection system (RPS) simulated in the code includes reactor trips on high neutron flux, high neutron flux rate, overtemperature T (OTT), overpower T (OPT), low reactor coolant flow, high pressurizer pressure, low pressurizer pressure, high pressurizer level, safety injection (SI) actuation, and low-low SG water level. Control systems are also simulated including rod control and pressurizer pressure control. Parts of the SI system, including the accumulators, are also modeled. Also, a conservative approximation of the transient DNBR, based on the core thermal limits, is calculated by RETRAN.

2-9 WCAP-17658-NP September 2016 Licensing Report Revision 1-C The RETRAN licensing topical report, WCAP-14882-P-A (Reference 9), was approved by the USNRC via an SER from F. Akstulewicz (USNRC) to H. Sepp (Westinghouse), dated February 11, 1999. The RETRAN SER identifies three conditions of acceptance, which are summarized in Appendix A.3, "RETRAN for Non-LOCA Safety Analysis," along with justifications for application to the WCGS. Note that the RETRAN nodalization modeling used in the WCGS analyses is consistent with the Westinghouse plant nodalization model described in WC AP-14882-P-A, except for the nodalization of the RCS hot legs (HLs). Since the approval of WCAP-14882-P-A, the HL modeling was enhanced to minimize code instabilities attributed to pressurizer insurge and outsurge. This HL model enhancement, which has been applied in other RETRAN analyses performed by Westinghouse, consisted of dividing each HL control volume into three equal control volumes. Although it was needed only for the HL connected to the pressurizer, all HLs were divided in the same manner. LOFTRAN The LOFTRAN computer code is used to study the tran sient response of a PWR to specified perturbations in process parameters. This code simulates a multi-loop system by a model containing the reactor vessel, hot and cold leg piping, SGs (tube and shell sides), the pressurizer, and the pressurizer heaters, spray, relief valves, and safety valves. LOFTRAN also includes a point neutron kinetics model and reactivity effects of the moderator, fuel, boron, and rods. The secondary side of the SG uses a homogeneous, saturated mixture for the thermal transients. The code simulates the RPS, which includes reactor trips on high neutron flux, OTT and OPT, high and low pressurizer pressure, low RCS flow, low-low SG water level, and high pressurizer level. Control systems are also simulated, including rod control, steam dump, and pressurizer pressure control. The SI system, including the accumulators, is also modeled. Also, a conservative approximation of the transient DNBR, based on the core thermal limits, is calculated by LOFTRAN. The LOFTRAN licensing topical report, WCAP-7907-P-A (Reference 10), was approved by the USNRC via an SER from C. O. Thomas (USNRC) to E. P. Rahe (Westinghouse), dated July 29, 1983. The LOFTRAN SER identifies one condition of acceptance, which is summarized in Appendix A.4, "LOFTRAN for Non-LOCA Safety Analysis," along with justification for application to the WCGS. TWINKLE TWINKLE is a multi-dimensional spatial neutron kinetics code. This code uses an implicit finite-difference method to solve the two-group transient neutron diffusion equations in one, two, and three dimensions. The code uses six delayed neutron groups and contains a detailed, multi-region fuel-cladding-coolant heat transfer model for calculating pointwise Doppler and moderator feedback effects. The code handles up to 8000 spatial points and performs steady-state initialization. Besides basic cross-section data and thermal-hydraulic (T/H) parameters, the code accepts as input basic driving functions such as inlet temperature, pressure, flow, boron concentration, and control rod motion. The code provides various outputs, such as channelwise power, axial offset, enthalpy, volumetric surge, pointwise power, and fuel temperatures. It also predicts the kine tic behavior of a reactor for transients that cause a major perturbation in the spatial neutron flux distribution.

2-10 WCAP-17658-NP September 2016 Licensing Report Revision 1-C The TWINKLE licensing topical report, WCAP-7979-P-A (Reference 11), was approved by the AEC via an SER from D. B. Vassallo (AEC) to R. Salvatori (Westinghouse), dated July 29, 1974. The TWINKLE SER does not identify any conditions, restrictions, or limitations that need to be addressed for application to the WCGS. ANC ANC is an advanced nodal code capable of two-dimensional (2-D) and three-dimensional (3-D) neutronics calculations. ANC is the reference model for certain safety analysis calculations, power distributions, peaking factors, critical boron concentrations, control rod worths, and reactivity coefficients. In addition, 3-D ANC validates one-dimensional (1-D) and 2-D results and provides information about radial (x-y) peaking factors as a function of axial position. It can calculate discrete pin powers from nodal information as well. The ANC licensing topical report, WCAP-10965-P-A (Reference 12), was approved by the USNRC via an SER from C. Berlinger (USNRC) to E. P. Rahe (Westinghouse), dated June 23, 1986. The ANC SER does not identify any conditions, restrictions, or limitations that need to be addressed for application to the WCGS. VIPRE The VIPRE computer program performs T/H calculations. This code calculates coolant density, mass velocity, enthalpy, void fractions, static pressure, and DNBR distributions along flow channels within a reactor core.

The VIPRE licensing topical report, WCAP-14565-P-A (Reference 13), was approved by the USNRC via an SER from T. H. Essig (USNRC) to H. Sepp (Westinghouse), dated January 19, 1999. The VIPRE SER identifies four conditions of acceptance, which are summarized in Appendix A.5, "VIPRE for Non-LOCA Thermal/Hydraulics," along with justifications for application to the WCGS.

2.1.5 Initial

Conditions The initial conditions applied in non-LOCA transient analyses are dependent on the analysis methodology employed for each transient. For the purpose of this discussion, the non-LOCA analyses are categorized as either DNB or non-DNB. DNB analyses include the transient cases analyzed for DNB concerns, and non-DNB analyses include the transient cases analyzed for concerns other than DNB, e.g., RCS overpressure. For most DNB analyses, the Revised Thermal Design Procedure (RTDP) methodology of Reference 14 was employed. With this methodology, nominal values are applied as the initial RCS conditions of power (see Note below), temperature, pressure, and flow, and the corresponding uncertainty allowances (identified later in this section) are accounted for statistically in defining the design limit DNBR. In RTDP DNB analyses, the nominal RCS flow is the MMF value and the core bypass flow is the statistical value (see Section 2.1.1, Program Features , for the MMF and bypass flow values). Note: The reactor power applied in all analyses is consistent with the NSSS power of 3651 MWt, which includes a bounding uncertainty of up to 2 percent.

2-11 WCAP-17658-NP September 2016 Licensing Report Revision 1-C As discussed in Section 2.12, "Thermal and Hydraulic Design," uncertainties in plant operating parameters, nuclear and thermal parameters, fuel fabrication parameters, computer codes, and DNB correlation predictions were combined statistically to obtain the overall DNB uncertainty factor, which was used to define the design limit DNBR. In other words, the design limit DNBR is a DNBR value that is greater than the WRB-2 DNB correlation limit by an amount that accounts for the RTDP uncertainties. To provide DNBR margin to offset various penalties such as those due to rod bow and instrument bias, and to provide flexibility in design and operation of the plant, the design limit DNBR was conservatively increased to a value designated as the safety analysis limit DNBR, to which transient-specific DNBR values were compared. For DNB analyses where RTDP is not employed, which are those DNB analyses that are initiated from zero power conditions, the initial conditions were defined by applying maximum, steady-state uncertainties to the nominal values in the most conservative direction, as appropriate; this is known as Standard Thermal Design Procedure (STDP) methodology, or non-RTDP. In non-RTDP DNB analyses, the initial RCS flow is the TDF value and the core bypass flow is the design value (see Section 2.1.1, "Program Features," for the TDF and bypass flow values). As discussed in Section 2.12, "Thermal and Hydraulic Design," the DNBR limits for non-RTDP DNB analyses correspond to the appropriate DNB correlation limit increased by sufficient margin to offset any applicable DNBR penalties. For each DNB analysis, Table 2.1-6 identifies whether RTDP or non-RTDP (STDP) was applied, the DNB correlation, and the DNBR limit. For non-DNB analyses, the initial conditions were defined by applying maximum, steady-state uncertainties to the nominal values in the most conservative direction. In these analyses, the initial RCS flow is the TDF value and the core bypass flow is the design value (see Section 2.1.1, "Program Features," for the TDF and bypass flow values). Steady-State Initial Condition Uncertainties The following bulleted items identify the maximum steady-state initial condition uncertainties for core power, RCS flow, T avg, and pressurizer pressure that had to be accounted for in the non-LOCA safety analyses. More limiting (bounding) uncertainties than those presented below may have been applied in some analyses. Table 2.1-2 summarizes the initial conditions applied in each analysis. 0 percent core power allowance for calorimetric measurement uncertainty As indicated above, all applicable uncertainties are accounted for in the applied initial core power value. +/-2.7 percent RCS flow allowance for steady-state fluctuations and me asurement uncertainties +6.5/-4.0°F T avg allowance for deadband and system measurement uncertainties and bias +50/-35 psi pressurizer pressure allowance for steady-state fluctuations and measurement uncertainties 2-12 WCAP-17658-NP September 2016 Licensing Report Revision 1-C Pressurizer Level Initial Condition The nominal pressurizer water level program used at the WCGS varies linearly from 27 percent of span at the no-load T avg of 557°F to 57 percent of span at a T avg of 586.5°F. For T avg values above 586.5°F and below 557°F, the program level is constant at the respective levels of 57 percent of span and 27 percent of span. For analysis purposes, the upper end of the pressurizer water level program was conservatively extrapolated out to 59 percent of span at the maximum full-power T avg value of 588.4°F. An uncertainty of at least 5 percent of span was applied when conservative. Steam Generator Initial Conditions The steam flow rate and steam pressure initial conditions are dependent on the initial conditions of power, T avg, RCS flow (TDF or MMF), Tfeed, SG water level, and SGTP level. The analyses considered a full power Tfeed range of 400.0°F to 448.6°F, a constant SG water level program of 50 percent narrow range span (NRS), and a SGTP level range of 0 percent to 10 percent. An uncertainty was applied to the initial SG levels when it was conservative to do so; the level uncertainties considered were +10 percent NRS and -12 percent NRS, which correspond to initial levels of 60 percent NRS and 38 percent NRS, respectively.

Residual Decay Heat The fission product contribution to decay heat applied in the non-LOCA analyses is consistent with the American National Standards Institute (ANSI)/ANS standard ANSI/ANS-5.1-1979 for decay heat power in light water reactors (Reference 15), including two standard deviations of uncertainty.

2.1.6 Fuel Design Description The fuel currently in use at the WCGS and considered in the safety analyses described herein is the Westinghouse 1717 RFA-2 fuel design with IFMs and thimble plugs either removed or installed (see Note below). The RFA-2 fuel rods contain enriched uranium dioxide (UO

2) fuel pellets and have ZIRLO High Performance Fuel Cladding Material 1 with an outer diameter of 0.374 inch. ZIRLO material is also used as the material for the mid-grids, guide thimble tubes, and instrumentation tubes. More detailed information on the RFA-2 fuel design is provided in Chapter 4.0 of the WCGS USAR (Reference 1). With respect to the non-LOCA transient analyses, the effects of fuel design mechanical features were accounted for in fuel-related input parameters such as fuel and cladding dimensions, cladding material, fuel temperatures, and core bypass flow.

Note: Except for the limiting DNBR analysis of the uncontrolled RCCA bank withdrawal at power event, all analyses covered the bounding scenario of having the core TPR. As a result of the exception, the plant may be required to operate with the core TPI. 1. ZIRLO is a trademark or registered trademark of Westinghouse Electric Company LLC, its affiliates and/or its subsidiaries in the United States of America and may be registered in other countries throughout the world. All rights reserved. Unauthorized use is strictly prohibited. Other names may be trademarks of their respective owners.

2-13 WCAP-17658-NP September 2016 Licensing Report Revision 1-C Regarding the issue of fuel thermal conductivity degradation (TCD) with Westinghouse codes and methods, Westinghouse provided a discussion of the TCD impact in Reference 16 and justified the continued safe operation of the plants analyzed with Westinghouse codes and methods. The Westinghouse codes and methods applied in the non-LOCA analyses discussed herein are consistent with those evaluated for TCD in Reference 16, and therefore the conclusions presented in Reference 16 are applicable to the WCGS.

2.1.7 Power

Distribution Peaking Factors Relative to the fuel, the power distribution is characterized by nuclear enthalpy rise hot channel factors (radial peaking factor, F NH) of 1.59 for RTDP DNB analyses and 1.65 for non-RTDP DNB analyses, and a full-power heat flux hot channel factor (total peaking factor, F Q) of 2.50. F NH is important for transients that are analyzed for DNB concerns. The DNB transients as well as the DNB methodology applied (RTDP or non-RTDP) in the DNB analyses are identified in Table 2.1-6. As F NH increases with decreasing power level, due to rod insertion, all transients analyzed for DNB concerns are assumed to begin with an F NH consistent with the F NH defined in the Core Operating Limits Report (COLR) for the assumed nominal power level. The F Q, for which the limits are specified in the COLR, is important for transients that are analyzed for overpower concerns, for example RCCA ejection.

2.1.8 Reactivity

Feedback The transient response of the reactor core is dependent on reactivity feedback effects, in particular the moderator temperature coefficient (MTC), Doppler temperature coefficient (DTC), and the Doppler power coefficient (DPC). Depending upon event-specific characteristics, conservatism dictates the use of either maximum or minimum reactivity coefficient values. Justification for the use of the reactivity coefficient values was treated on an event-specific basis. Table 2.1-3 presents the core kinetics parameters and reactivity feedback coefficients applied in the non-LOCA analyses. The maximum and minimum integrated DPCs applied in the safety analyses are provided in Figure 2.1-1. Note that a different DPC (not shown in Figure 2.1-1) was applied in the zero power SLB core response and zero power feedwater malfunction (FWM) analyses; this DPC is based on an RCCA being stuck out of the core.

2.1.9 Pressure

Relief Modeling RCS Pressure Relief Plant components that provide RCS pressure relief in the non-LOCA analyses include the pressurizer sprays, pressurizer power-operated relief valves (PORVs), and the pressurizer safety valves (PSVs). The modeling of these components in each non-LOCA safety analysis is dependent on the type of transient being analyzed and the applicable analysis methodology. Note that the sprays and PORVs are not safety grade components, and thus were modeled only if doing so lead to more limiting results, i.e., no credit was taken for the operation of these components if such operation were to mitigate transient results. In general, maximum RCS pressure relief is modeled when a minimum RCS pressure is conservative, e.g., for transients that are analyzed for DNB concerns, and minimum RCS pressure relief is modeled when a maximum RCS pressure is conservative. Modeling details for the sprays, PORVs, and PSVs are provided as follows, but note that more conservative modeling may have been applied in some analyses.

2-14 WCAP-17658-NP September 2016 Licensing Report Revision 1-C Sprays - The pressurizer sprays were modeled via a control valve that was set to initially open on a proportional-integral-derivative (PID) pressure signal of +25 psid from the nominal reference pressure of 2250 psia, and ramping to full-open when the PID pressure signal reaches +75 psid. This spray control logic is consistent with the as-designed logic. PORVs - Each of the two pressurizer PORVs were modeled based on a relief capacity of 210,000 lbm/hr at a pressure of 2350 psia. One PORV was modeled to actuate on an indicated pressure signal of 2350 psia and the other PORV was modeled to actuate on a PID pressure signal of 100 psid from the nominal reference pressure of 2250 psia. PSVs - Each of the three PSVs was modeled based on a relief capacity of 420,000 lbm/hr at a pressure of 2575 psia. Depending on the direction of conservatism for a given analysis, the nominal opening setpoint of 2460 psig was either increased by 2.9 percent, which accounts for a

+2.0 percent setpoint tolerance and a +0.9 percent set pressure shift associated with the water-filled PSV loop seals (see WCAP-12910, Reference 17), or decreased by 2.0 percent, which accounts for a -2.0 percent setpoint tolerance. Also, when conservative, a PSV opening delay of 1.153 seconds was modeled to account for the purging of the water in the PSV loop seals. The pressurizer heaters, which include proportional heaters and backup heaters, are related to the RCS pressure relief components in that they are included as part of the pressurizer pressure control system. The pressurizer heaters were modeled as-designed if doing so causes transient results to be more limiting. The proportional heaters were modeled with a maximum capacity of 416 kW and the backup heaters were modeled with a maximum capacity of 1384 kW. The heat output of the proportional heaters varies linearly as a function of the PID pressure signal. The proportional heaters are on at 50 percent capacity when the PID pressure signal is 0 psid, 100 percent capacity when the PID pressure signal is -15 psid, and 0 percent capacity when the PID pressure signal is +15 psid. The backup heaters turn on at full capacity when the PID pressure signal is -25 psid or if the pressurizer level deviates from the program level by +5 percent of span. Main Steam System (MSS) Pressure Relief Plant components that provide MSS pressure relief in the non-LOCA analyses include the control grade atmospheric relief valves (ARVs) and the safety grade main steam safety valves (MSSVs). No credit is taken for the automatic actuation of the ARVs. Rather, operator action to open an ARV is credited in the analysis described in Section 2.6.1, "Inadvertent Operation of the Emergency Core Cooling System During Power Operation." General modeling details fo r the MSSVs are provided as follows, but note that more conservative modeling may have been applied in some analyses. Five MSSVs per loop were modeled with opening setpoints based on nominal lift settings of 1185, 1197, 1210, 1222, and 1234 psig. Each MSSV was modeled with a +3.0 percent setpoint tolerance and a 5 psi ramp from closed to full-open, which accounts for accumulation. Because none of the non-LOCA transients is limiting with minimum MSSV setpoints, a negative setpoint tolerance was not explicitly modeled.

2-15 WCAP-17658-NP September 2016 Licensing Report Revision 1-C 2.1.10 RTS and ESFAS Functions Table 2.1-4 summarizes the RTS and engineered safety features actuation system (ESFAS) functions actuated in the non-LOCA transient analyses. The setpoints applied in the safety analyses and the associated time delays of each function are also presented in Table 2.1-4. Additional information related to the OTT and OPT reactor trip setpoints is provided as follows.

OTT and OPT Reactor Trip Setpoints Using the methodology described in WCAP-8745-P-A (Reference 18), the current OTT and OPT reactor trip setpoints were evaluated for the TM Program. The evaluation process first involved using conservative core thermal limits, developed based on the RTDP DNB methodology (as described in Section 2.12, "Thermal and Hydraulic Design"), to determine, under steady-state conditions, whether the OTT and OPT reactor trip setpoints provide sufficient protection for the core thermal limits. Based on this initial evaluation, it was determined that one coefficient of the OTT reactor trip setpoint equation, the pressure term coefficient, had to be increased from 0.000671/psi to 0.00095/psi to ensure that the core thermal limits are fully protected. The applied core thermal limits are presented in Figure 2.1-2. The OTT and OPT reactor trip setpoints are illustrated in Figure 2.1-3 and presented in Table 2.1-5. The boundaries of operation defined by the OTT and OPT trips are represented as "protection lines" in Figure 2.1-3. The protection lines were drawn to include all adverse instrumentation and setpoint errors so that under nominal conditions, a trip would occur well within the area bounded by these lines. These protection lines are based upon the OTT and OPT reactor trip setpoints applied in the safety analyses, which are the TS nominal values with allowances for instrumentation errors and acceptable drift between instrument calibrations. The diagram of Figure 2.1-3 is useful in the fact that the limit imposed by any given DNBR can be represented as a line (T avg versus T). The DNB lines represent the locus of conditions for which the DNBR equals the limit value. All points below and to the left of a DNB line for a given pressure have a DNBR greater than the SAL DNBR value. The area of permissible operation (power, temperature, and pressure) is bounded by the combination of the high neutron flux (fixed setpoint) reactor trip, the high and low pressurizer pressure reactor trips (fixed setpoints), the OTT (variable setpoint) and OPT (variable setpoint) reactor trips, and the opening of the MSSVs, which limits the maximum RCS average temperature. The final determination of the adequacy of the OTT and OPT reactor trip setpoints is demonstrated by showing that the design bases for DNB and fuel melting are met in the analyses of those events that credit these functions for accident mitigation. Table 2.1-4 identifies the event analyses that credit the OTT and OPT reactor trip functions. In these analyses, the dynamic compensation terms of the OTT and OPT setpoint equations, which compensate for inherent instrumentation delays and piping lags between the reactor core and the loop temperature sensors, were modeled. As the analysis results presented in Table 2.1-6 show that all applicable limits are met for the analyses that credit OTT and OPT, the OTT and OPT reactor trip setpoints (see Table 2.1-5) are confirmed to be adequate. Note that the OTT penalty function that is used to compensate for expected variations in the axial power shape, (I), although not explicitly credited in the analyses, was separately confirmed to be acceptable based on the method described in WCAP-8745-P-A (Reference 18).

2-16 WCAP-17658-NP September 2016 Licensing Report Revision 1-C Related to the OTT and OPT setpoint functions, the functional temperature ranges of the Tcold , Thot, and T avg resistance temperature detector instrumentation were reviewed to ensure that they cover the expected temperature ranges. It was determined that the current T cold and T avg ranges were acceptable, but the T hot range required an adjustment, as indicated below. T cold - 510°F - 630°F (same as current range) Thot - 540°F - 660°F (requires a revision from the current range of 530°F-650°F) T avg - 530°F - 630°F (same as current range) Finally, note that a temperature difference of up to 3°F between the nominal (reference) temperature used for the OTT and OPT reactor trip setpoints and the loop-specific, indicated, full-power T avg values has been covered for the analyses that rely on these reactor trip functions for protection.

2.1.11 Reactor Trip Characteristics The negative reactivity insertion following a reactor trip is a function of the acceleration of the RCCAs and the variation in rod worth as a function of rod position. With respect to the non-LOCA transient analyses, the critical parameter is the time from the start of RCCA insertion to when the RCCAs reach the dashpot region, which is located at an insertion point corresponding to approximately 86 percent of the total RCCA travel distance. For the non-LOCA analyses, the RCCA insertion time from fully withdrawn to dashpot entry was modeled as 2.7 seconds. The applied negative reactivity insertion following reactor trip is based on having the most reactive RCCA stuck in the full y withdrawn position. Three figures relating to RCCA drop time and reactivity worth are presented in this report. The RCCA position (fraction of full insertion) versus the time from release is presented in Figure 2.1-4. The normalized reactivity worth applied in the safety anal yses is shown in Figure 2.1-5 as a function of rod insertion fraction and in Figure 2.1-6 as a function of time. A total negative trip reactivity worth of

4.0 percent

k was modeled in the non-LOCA analyses, unless noted otherwise. In the analyses of zero power transients that have a potential for a return-to-power (FW system malfunction, steam system piping

failure, inadvertent opening of a SG atmospheric relief or safety valve), a minimum shutdown margin of

1.3 percent

k was conservatively modeled.

2-17 WCAP-17658-NP September 2016 Licensing Report Revision 1-C 2.1.12 Operator Actions Credited To help demonstrate compliance with applicable acceptance criteria, operator actions were credited in the analysis of the inadvertent operation of the ECCS during power operation event; see Section 2.6.1, "Inadvertent Operation of the Emergency Core Cooling System During Power Operation," for details of the credited operator actions. In addition, there are two events that were analyzed to demonstrate that there is sufficient time available for operators to recognize the event is in progress and to take necessary actions to terminate the event prior to reaching plant conditions that fail to comply with applicable acceptance criteria. Although operator actions are not modeled in the analyses of these events, actions by the plant operators are ultimately required to ensure plant safety is maintained. These two events are as follows.

Boron dilution (Section 2.5.5, "Chemical and Volume Control System Malfunction Resulting in a Decrease in Boron Concentrati on in the Reactor Coolant") CVCS malfunction that increases reactor coolant inventory (Section 2.6.2, "Chemical and Volume Control System Malfunction that Increases Reactor Coolant Inventory")

2.1.13 Results Summary Table 2.1-6 summarizes the results obtained for each of the non-LOCA transient analyses. The results demonstrate that all applicable safety analysis acceptance criteria are satisfied for the WCGS. Although the analyses and evaluations were performed with the intent to make them cycle-independent, the RSE process described in Reference 7 will be applied for futu re fuel reloads to verify that reload-related safety analysis inputs remain bounding.

2.1.14 References

1. Wolf Creek Generating Station, "Wolf Creek Updated Safety Analysis Report, Revision 29, March 10, 2016.
2. ANS-51.1-1973 (ANSI-N18.2), "Nuclear Safety Criteria for the Design of Stationary Pressurized Water Reactor Plants," August 1973.
3. Westinghouse Report WCAP-9226-P-A, Revision 1, "Reactor Core Response to Excessive Secondary Steam Releases," February 1998.
4. Westinghouse Report WCAP-11394-P-A, "Methodology for the Analysis of the Dropped Rod Event," January 1990.
5. Westinghouse Report WCAP-7588, Revision 1-A, "An Evaluation of the Rod Ejection Accident in Westinghouse Pressurized Water Reactors Us ing Spatial Kinetics Methods," January 1975.
6. NS-NRC-89-3466, Letter from W. J. Johnson (Westinghouse) to R. C. Jones (USNRC), "Use of 2700°F PCT Acceptance Limit in Non-LOCA Accidents," October 23, 1989.

2-18 WCAP-17658-NP September 2016 Licensing Report Revision 1-C

7. Westinghouse Report WCAP-9272-P-A, "Westinghouse Reload Safety Evaluation Methodology," July 1985.
8. Westinghouse Report WCAP-7908-A, "FACTRAN - A FORTRAN IV Code for Thermal Transients in a UO 2 Fuel Rod," December 1989.
9. Westinghouse Report WCAP-14882-P-A, "RETRAN-02 Modeling and Qualification for Westinghouse Pressurized Water Reactor Non-LOCA Safety Analyses," April 1999.
10. Westinghouse Report WCAP-7907-P-A, "LOFTRAN Code Description," April 1984.
11. Westinghouse Report WCAP-7979-P-A, "TWINKLE - A Multi-Dimensional Neutron Kinetics Computer Code," January 1975.
12. Westinghouse Report WCAP-10965-P-A, "ANC: A Westinghouse Advanced Nodal Computer Code," September 1986.
13. Westinghouse Report WCAP-14565-P-A, "VIPRE-01 Modeling and Qualification for Pressurized Water Reactor Non-LOCA Thermal-Hydraulic Safety Analysis," October 1999.
14. Westinghouse Report WCAP-11397-P-A, "Revised Thermal Design Procedure," April 1989.
15. ANSI/ANS-5.1-1979, "American National Standard for Decay Heat Power in Light Water Reactors," August 29, 1979.
16. Westinghouse Letter LTR-NRC-12-18, Letter from J. A. Gresham (Westinghouse) to USNRC Document Control Desk, "Westinghouse Response to December 16, 2011 NRC Letter Regarding Nuclear Fuel Thermal Conductivity Degradation (TAC No. ME5186) (Proprietary),"

February 17, 2012.

17. Westinghouse Report WCAP-12910, Revision 1-A, "Pressurizer Safety Valve Set Pressure Shift," May 1993.
18. Westinghouse Report WCAP-8745-P-A, "Design Bases for the Thermal Overpower T and Thermal Overtemperature T Trip Functions," September 1986.

2-19 WCAP-17658-NP September 2016 Licensing Report Revision 1-C Table 2.1-1 Non-LOCA Transient Events Analyzed or Evaluated Transient Event Report Section USAR Section Analyzed or Evaluated? Feedwater system malfunctions that result in a decrease in feedwater temperature 2.2.1 15.1.1 Analyzed Feedwater system malfunctions that result in an increase in feedwater flow 2.2.2 15.1.2 Analyzed Excessive increase in secondary steam flow 2.2.3 15.1.3 Analyzed Inadvertent opening of a steam generator atmospheric relief or safety valve 2.2.4 15.1.4 Analyzed Steam system piping failure (SLB) at zero power 2.2.5.1 15.1.5 Analyzed Steam system piping failure (SLB) at full power 2.2.5.2 15.1.6 Analyzed Loss of external electrical load, turbine trip, inadvertent closure of main steam isolation valves, and loss of condenser vacuum 2.3.1 15.2.2 15.2.3 15.2.4 15.2.5 Analyzed Loss of non-emergency AC power to the station auxiliaries 2.3.2 15.2.6 Analyzed Loss of normal feedwater flow 2.3.3 15.2.7 Analyzed Feedwater system pipe break 2.3.4 15.2.8 Analyzed Partial loss of forced reactor coolant flow 2.4.1 15.3.1 Analyzed Complete loss of forced reactor co olant flow 2.4.1 15.3.2 Analyzed RCP shaft seizure (locked rotor) and RCP shaft break 2.4.2 15.3.3 15.3.4 Analyzed Uncontrolled RCCA bank withdrawal from a subcritical or low power startup condition 2.5.1 15.4.1 Analyzed Uncontrolled RCCA bank withdrawal at power 2.5.2 15.4.2 Analyzed RCCA misoperation (dropped RCCA, dropped RCCA bank, statically misaligned RCCA, single RCCA withdrawal) 2.5.3 15.4.3 Analyzed Startup of an inactive RCP at an incorrect temperature 2.5.4 15.4.4 Evaluated CVCS malfunction that results in a decrease in the boron concentration in the reactor coolant (boron dilution) 2.5.5 15.4.6 Analyzed Spectrum of RCCA ejection accidents 2.5.6 15.4.8 Analyzed Inadvertent operation of the ECCS during power operation 2.6.1 15.5.1 Analyzed CVCS malfunction that increases reactor coolant inventory 2.6.2 15.5.2 Analyzed Inadvertent opening of a pressurizer safety or relief valve 2.7.1 15.6.1 Analyzed ATWS 2.8 15.8 Analyzed 2-20 WCAP-17658-NP September 2016 Licensing Report Revision 1-C Table 2.1-2 Summary of Initial Conditions and Computer Codes Used Event Case Distinction Computer Code(s) Used Initial Power (%) Reactor Vessel Coolant Flow(1)(gpm) Reactor Vessel Average Coolant Temperature (2) (°F) RCS Pressure (3)(psia) Feedwater system malfunctions that result in a decrease in feedwater temperature Bounding RETRAN 100 371,000 588.4 2250 Feedwater system malfunctions that result in an increase in feedwater flow Zero power RETRAN ANC VIPRE 0 361,200 557.0 2250 Full power RETRAN 100 371,000 588.4 2250 Excessive increase in secondary steam flow Bounding RETRAN 100 371,000 588.4 2250 Inadvertent opening of a steam generator atmospheric relief or safety valve Bounding RETRAN ANC VIPRE 0 361,200 557.0 2250 Steam system piping failure (SLB)

(core response only) Zero power RETRAN ANC VIPRE 0 361,200 557.0 2250 Full power RETRAN ANC VIPRE 100 371,000 588.4 2250 Loss of external electrical load, turbine trip, inadvertent closure of main steam isolation valves, and loss of condenser vacuum Minimum DNBR RETRAN 100 371,000 588.4 2250 Peak RCS Pressure RETRAN 100 361,200 581.9 2215 Peak MSS Pressure RETRAN 100 361,200 594.9 2200 Loss of non-emergency AC power to the station auxiliaries Bounding RETRAN 100 361,200 564.2 2300 Loss of normal feedwater flow Bounding RETRAN 100 361,200 564.2 2300 Feedwater system pipe break Bounding RETRAN 100 361,200 594.9 2200 Partial loss of forced reactor coolant flow Bounding RETRAN VIPRE 100 371,000 588.4 2250 Complete loss of forced reactor coolant flow Bounding RETRAN VIPRE 100 371,000 588.4 2250

2-21 WCAP-17658-NP September 2016 Licensing Report Revision 1-C Table 2.1-2 Summary of Initial Conditions and Computer Codes Used (cont.) Event Case Distinction Computer Code(s) Used Initial Power (%) Reactor Vessel Coolant Flow(1)(gpm) Reactor Vessel Average Coolant Temperature (2) (°F) RCS Pressure (3)(psia) RCP shaft seizure (locked rotor) and RCP shaft break DNB RETRAN VIPRE 100 371,000 588.4 2250 Peak RCS pressure/

PCT RETRAN VIPRE 100 361,200 594.9 2300 Uncontrolled RCCA bank withdrawal from a subcritical or low power startup condition Bounding TWINKLE FACTRAN VIPRE 0 160,662 557.0 2200 Uncontrolled RCCA bank withdrawal at power Minimum DNBR RETRAN VIPRE 100 371,000 and 376,000 (4) 588.4 2250 60 575.8 10 560.1 Peak RCS Pressure LOFTRAN Various (5) 361,200 Various (5) Various (5) Dropped RCCA(s) and Dropped RCCA bank All LOFTRAN ANC VIPRE 100 371,000 588.4 2250 Statically misaligned RCCA All ANC VIPRE 100 371,000 588.4 2250 Single RCCA withdrawal Manual Rod Control ANC VIPRE 100 371,000 588.4 2250 Startup of an inactive RCP at an incorrect temperature No analysis was performed; see Section 2.5.4, "Startup of an Inactive Reactor Coolant Pump at an Incorrect Temperature." CVCS malfunction that results in a decrease in the boron concentration in the reactor coolant (boron dilution) Mode 1 N/A 100 N/A 594.9 2250 Mode 2 5 565.1 Mode 3 0 350.0, 557.0 Mode 4 0 200.0 Mode 5 0 68.0 Mode 6 No analysis was performed; a Mode 6 boron dilution is precluded by administrative controls. Spectrum of RCCA ejection accidents Full power TWINKLE FACTRAN 100 361,200 594.9 2200 Zero power 0 160,662 557.0 2-22 WCAP-17658-NP September 2016 Licensing Report Revision 1-C Table 2.1-2 Summary of Initial Conditions and Computer Codes Used (cont.) Event Case Distinction Computer Code(s) Used Initial Power (%) Reactor Vessel Coolant Flow(1)(gpm) Reactor Vessel Average Coolant Temperature (2) (°F) RCS Pressure (3)(psia) Inadvertent operation of the ECCS during power operation Bounding RETRAN 100 361,200 566.7 2215 CVCS malfunction that increases reactor coolant inventory Bounding RETRAN 100 361,200 564.2 2200 Inadvertent opening of a pressurizer safety or relief valve Bounding RETRAN 100 371,000 588.4 2250 ATWS Bounding LOFTRAN 100 361,200 588.4 2250 Notes: 1. 361,200 gpm TDF 371,000 gpm Bounding MMF 376,000 gpm MMF 160,662 gpm Reactor vessel flow provided by two RCPs = 0.4448xTDF. 2. 594.9°F = High nominal full power T avg (588.4°F) + 6.5°F 588.4°F = High nominal full power T avg 581.9°F = High nominal full power T avg (588.4°F) - 6.5°F 575.8°F = 60% power T avg (linearly interpolated between T no-load and the high nominal full power T avg of 588.4°F) 570.7°F = Low nominal full power T avg 566.7°F = Low nominal full power T avg (570.7°F) - 4.0°F 565.1°F = 5% power T avg (linearly interpolated between T no-load and the high nominal full power Tavg of 588.4°F) + 6.5°F 564.2°F = Low nominal full power T avg (570.7°F) - 6.5°F 560.1°F = 10% power T avg (linearly interpolated between T no-load and the high nominal full power T avg of 588.4°F) 557.0°F = 0% power T avg = Tno-load = Mode 3 maximum Tavg 350.0°F = Mode 3 minimum T avg 200.0°F = Mode 4 minimum T avg 68.0°F = Mode 5 minimum Tavg 3. 2300 psia = Nominal + 50 psi 2250 psia = Nominal 2215 psia = Nominal - 35 psi 2200 psia = Nominal - 50 psi 4. As indicated in Section 2.12, "Thermal and Hydraulic Design," for the most limiting case in the uncontrolled RCCA withdrawal at power DNBR analysis, credit was taken for the higher MMF of 376,000 gpm to help demonstrate that the DNB design basis was met with adequate margin. 5. For the uncontrolled RCCA withdrawal at power peak RCS pressure analysis, a spectrum of initial power levels ranging from 8 to 100% was analyzed. The corresponding initial Tavg values were based on the high nominal full power T avg of 588.4°F (linear between 588.4°F at 100% power and 557°F at 0% power) plus uncertainty (6.5°F). Cases were analyzed with initial pressurizer pressures of 2200 psia (nominal minus uncertainty) and 2300 psia (nominal plus uncertainty).

2-23 WCAP-17658-NP September 2016 Licensing Report Revision 1-C Table 2.1-3 Core Kinetics Parameters and Reactivity Feedback Coefficients Parameter BOC (Minimum Feedback)

EOC (Maximum Feedback) Moderator temperature coefficient, pcm/°F 6.0 ( 70% RTP)(1) 0.0 (> 70% RTP) N/A Moderator density coefficient, k/(g/cc) N/A 0.47 Doppler temperature coefficient, pcm/°F -1.0 -3.5 Doppler-only power coefficient, pcm/% power (Q = power in %) -10.13 + 0.0342Q -19.33 + 0.0662Q Delayed neutron fraction 0.0075 (maximum) 0.0044 (minimum) Doppler power defect, pcm RCCA ejection 1007 925 RCCA withdrawal from subcritical 1007 N/A Note: 1. RTP rated thermal power

2-24 WCAP-17658-NP September 2016 Licensing Report Revision 1-C Table 2.1-4 Summary of RTS and ESFAS Functions Actuated Event Case Distinction RTS or ESFAS Signal(s) Actuated Analysis Setpoint Delay (seconds) Feedwater system malfunctions that result in a decrease in feedwater temperature Bounding OPT reactor trip See Table 2.1-5 7.0 (1) Low pressurizer pressure SI with feedwater isolation (FWI) on SI (2) 1715.0 psia 17.0 (FWI) Feedwater system malfunctions that result in an increase in feedwater flow Zero power Hi-hi SG water level turbine trip (TT) and FWI 100% NRS 2.5 (TT) 17.0 (FWI) Full power Excessive increase in secondary steam flow Bounding None N/A N/A Inadvertent opening of a steam generator atmospheric relief or safety valve Bounding Low pressurizer pressure SI with FWI on SI 1715.0 psia 27.0 (SI) 17.0 (FWI) Steam system piping failure (SLB)

(core response only) Zero power Low steam line pressure SI and steam line isolation (SLI) with FWI on SI 375.0 psia (lead/lag = 50/5 sec) 27.0 (SI) 17.0 (SLI) 17.0 (FWI) Full power OPT reactor trip See Table 2.1-5 7.0 (1) Loss of external electrical load, turbine trip, inadvertent closure of main steam isolation valves, and loss of condenser vacuum Minimum DNBR OTT reactor trip See Table 2.1-5 7.0 (1) Peak RCS Pressure High pressurizer pressure reactor trip 2425.0 psia 1.0 Peak MSS Pressure OTT reactor trip See Table 2.1-5 7.0 (1) Loss of non-emergency AC power to the station auxiliaries Bounding Low-low SG water level reactor trip and AFW system actuation 0% NRS 2.0 (reactor trip)60.0 (AFW) Loss of normal feedwater flow Bounding Feedwater system pipe break Bounding Low-low SG water level reactor trip and AFW system actuation 0% NRS 2.0 (reactor trip)60.0 (AFW) Partial loss of forced reactor coolant flow Bounding Low reactor coolant loop flow reactor trip 86.3% MMF 1.0 2-25 WCAP-17658-NP September 2016 Licensing Report Revision 1-C Table 2.1-4 Summary of RTS and ESFAS Functions Actuated (cont.) Event Case Distinction RTS or ESFAS Signal(s) Actuated Analysis Setpoint Delay (seconds) Complete loss of forced reactor coolant flow Bounding RCP undervoltage (UV) reactor trip (3) 1.5 RCP shaft seizure (locked rotor) and RCP shaft break DNB Low reactor coolant loop flow reactor trip 86.3% MMF 1.0 Peak RCS pressure/

peak cladding temperature (PCT) Uncontrolled RCCA bank withdrawal from a subcritical or low power startup condition Bounding Power range neutron flux (low setting) reactor trip 35% RTP 0.5 Uncontrolled RCCA bank withdrawal at power Minimum DNBR Power-range high neutron flux reactor trip (high setting) 118% RTP 0.5 OTT reactor trip See Table 2.1-5 6.25 (1) Peak RCS Pressure Power-range high neutron flux reactor trip (high setting) 118% RTP 0.5 OTT reactor trip See Table 2.1-5 7.0 (1) Power range neutron flux rate (high positive rate) reactor trip 6.9% RTP with a 2.0-second time constant 1.0 High pressurizer pressure reactor trip 2425.0 psia 2.0 Dropped RCCA(s) and Dropped RCCA bank See Note 4 Statically misaligned RCCA All None N/A N/A Single RCCA withdrawal Manual Rod Control None N/A N/A Startup of an inactive RCP at an incorrect temperature No analysis was performed; see Section 2.5.4, "Startup of an Inactive Reactor Coolant Pump at an Incorrect Temperature."

2-26 WCAP-17658-NP September 2016 Licensing Report Revision 1-C Table 2.1-4 Summary of RTS and ESFAS Functions Actuated (cont.) Event Case Distinction RTS or ESFAS Signal(s) Actuated Analysis Setpoint Delay (seconds) CVCS malfunction that results in a decrease in the boron concentration in the reactor coolant (boron dilution) Mode 1-manual OTT reactor trip See Table 2.1-5 7.0 (1) Mode 1-auto None N/A N/A Mode 2 None N/A N/A Mode 3 None N/A N/A Mode 4 None N/A N/A Mode 5 None N/A N/A Mode 6 N/A N/A N/A Spectrum of RCCA ejection accidents Full power Power range neutron flux (high setting) reactor trip 118% RTP 0.5 Zero power Power range neutron flux (low setting) reactor trip 35% RTP 0.5 Inadvertent operation of the ECCS during power operation Bounding See Note 5 N/A N/A CVCS malfunction that increases reactor coolant inventory Bounding None N/A N/A Inadvertent opening of a pressurizer safety or relief valve Bounding OTT reactor trip See Table 2.1-5 7.0 (1) ATWS All See Note 6 N/A N/A Notes: 1. The OTT and OPT reactor trip response times were modeled with a time constant (first order lag) of 4.0 seconds to account for the response of the resistance temperature detectors (RTDs), the RTD bypass piping fluid transport time, and the RTD bypass piping heatup thermal lag, and a pure delay of at least 2.25 seconds to account for protection system electronics delays, reactor trip breaker opening, and RCCA gripper release. A pure delay of 3.0 seconds was conservatively modeled in some analyses. 2. No SI flow was modeled because the transient is terminated by FWI before SI flow would be initiated. 3. The RCP UV reactor trip (initiation of rod motion) was assumed to occur 1.5 seconds following the loss of bus voltage. 4. Multiple cases were analyzed to cover bounding values for MTC, dropped RCCA(s) worth, and D-bank worth. The limiting cases do not result in actuation of any RTS or ESFAS functions. However, the low pressurizer pressure reactor trip, with an analysis setpoint of 1875 psia, was actuated for some cases that are non-limiting with respect to DNBR, e.g., dropped RCCA bank cases. 5. A reactor trip is conservatively modeled coincident with event initiation; see Section 2.6.1, "Inadvertent Operation of the Emergency Core Cooling System During Power Operation," for more information. No ESFAS functions are actuated for event mitigation. 6. The ATWS mitigation system actuation circuitry (AMSAC) is credited in the ATWS analysis; see Section 2.8, "Anticipated Transients Without Scram," for more information.

2-27 WCAP-17658-NP September 2016 Licensing Report Revision 1-C Table 2.1-5 Parameters Related to OTT and OPT Reactor Trip Setpoints OTT K 1 (safety analysis value) 1.205 OTT K 2 0.0137/°F OTT K 3 0.00095/psi OTT (I) deadband -23% I to +5% I OTT (I) negative gain -2.27 %/% I OTT (I) positive gain +1.84 %/% I T (OTT) and T (OPT) Note 1 P (OTT) 2250 psia OPT K 4 (safety analysis value) 1.169 OPT K 5 - for decreasing T avg 0.0/°F - for increasing T avg 0.02/°F OPT K 6 - for T avg > T 0.00128/°F - for T avg T 0.0/°F Allowable full-power T avg range 570.7°F to 588.4°F Pressurizer pressure range of applicability for OTT and OPT 1924.7 psia to 2459.7 psia (2) Notes: 1. The analyzed initial T avg is used as the reference T avg (T and T) in the OTT and OPT setpoint equations. 2. Values correspond to bounding SAL for the low and high pressurizer pressure reactor trip setpoints.

2-28 WCAP-17658-NP September 2016 Licensing Report Revision 1-C Table 2.1-6 Non-LOCA Results Summary Event Case Distinction Parameter Description Safety Analysis Result Safety Analysis Limit Feedwater system malfunctions that result in a decrease in feedwater temperature Bounding Minimum DNBR (RTDP, WRB-2 correlation) 1.77 1.52 (5) Maximum core average heat flux, FOI 1.192 1.21 (1) Feedwater system malfunctions that result in an increase in feedwater flow Zero power Minimum DNBR (non-RTDP, WLOP correlation) See Note 2 Maximum linear heat generation, kW/ft Full power Minimum DNBR (RTDP, WRB-2 correlation) 2.04 1.52 (5) Maximum core average heat flux, FOI 1.098 1.21 (1) Excessive increase in secondary steam flow Bounding Minimum DNBR (RTDP, WRB-2 correlation) 1.97 1.52 (5) Maximum core average heat flux, FOI 1.11 1.21 (1) Inadvertent opening of a SG atmospheric relief or safety valve Bounding Minimum DNBR (non-RTDP, WLOP correlation) 5.10 1.18 Maximum linear heat generation, kW/ft 6.924 22.4 (3) Steam system piping failure (SLB) (core response only) Zero power Minimum DNBR (non-RTDP, WLOP correlation) 1.80 1.18 Maximum linear heat generation, kW/ft 15.829 22.4 Full power Minimum DNBR (RTDP, WRB-2 correlation) 2.026 1.52 (5) Maximum linear heat generation, kW/ft 21.8 22.4 (3) Loss of external electrical load, turbine trip, inadvertent closure of main steam isolation valves, and loss of condenser vacuum Minimum DNBR Minimum DNBR (RTDP, WRB-2 correlation) 1.72 1.52 (5) Peak RCS Pressure Maximum RCS pressure, psia 2746.8 2750.0 Peak MSS Pressure Maximum MSS pressure, psia 1297.4 1318.5 Loss of non-emergency AC power to the station auxiliaries Bounding Maximum pressurizer mixture volume, ft3 1623.2 1800.0 Loss of normal feedwater flow Bounding Maximum pressurizer mixture volume, ft3 1384.1 1800.0 Feedwater system pipe break Bounding Minimum margin to hot leg saturation, °F 40.5 >0.0 Partial loss of forced reactor coolant flow Bounding Minimum DNBR (RTDP, WRB-2 correlation) 1.82 1.52 (5) Complete loss of forced reactor coolant flow Bounding Minimum DNBR (RTDP, WRB-2 correlation) 1.69 1.52 (5) 2-29 WCAP-17658-NP September 2016 Licensing Report Revision 1-C Table 2.1-6 Non-LOCA Results Summary (cont.) Event Case Distinction Parameter Description Safety Analysis Result Safety Analysis Limit RCP shaft seizure (locked rotor) and RCP shaft break DNB Maximum number of rods-in-DNB, % 0.7 5.0 Peak RCS pressure/PCT Maximum RCS pressure, psia 2675.1 2750.0 Maximum cladding temperature, °F 1786.6 2700.0 Maximum zirconium-water reaction, % of zirconium reacted by weight 0.29 16.0 Uncontrolled RCCA bank withdrawal from a subcritical or low power startup condition Bounding Minimum DNBR below first mixing vane grid (non-RTDP, ABB-NV correlation) 1.83 1.13 Minimum DNBR above first mixing vane grid (non-RTDP, WRB-2 correlation) 1.66 1.17 Maximum fuel centerline temperature, °F 2342 4800.0 (4) Uncontrolled RCCA bank withdrawal at power Minimum DNBR Minimum DNBR (RTDP, WRB-2 correlation) See Note 6 1.52 (5) Maximum core average heat flux, fraction of analyzed full power 1.174 1.21 (1) Peak RCS Pressure Maximum RCS pressure, psia 2707.9 2750.0 Dropped RCCA(s) and Dropped RCCA bank All Minimum DNBR (RTDP, WRB-2 correlation) >1.52 1.52 (5) Maximum linear heat generation, kW/ft <22.4 22.4 (3) Maximum uniform cladding strain, % <1.0 1.0 Statically misaligned RCCA All Minimum DNBR (RTDP, WRB-2 correlation) >1.52 1.52 (5) Single RCCA withdrawal Manual Rod Control Maximum number of rods-in-DNB, % <5.0 5.0 Startup of an inactive RCP at an incorrect temperature No analysis was performed; see Section 2.5.4, "Startup of an Inactive Reactor Coolant Pump at an Incorrect Temperature."

2-30 WCAP-17658-NP September 2016 Licensing Report Revision 1-C Table 2.1-6 Non-LOCA Results Summary (cont.) Event Case Distinction Parameter Description Safety Analysis Result Safety Analysis Limit CVCS malfunction that results in a decrease in the boron concentration in the reactor coolant (boron dilution) Mode 1-manual Minimum time from alarm to loss of shutdown margin, minutes 50.3 15 Mode 1-auto 112.9 Mode 2 56.0 Mode 3 15.6 Mode 4 15.8 Mode 5 15.7 Mode 6 No analysis was performed. N/A N/A Spectrum of RCCA ejection accidents Full power Maximum fuel pellet average enthalpy, cal/gm 176.4 200.0 Maximum fuel melt at the hot spot, % 4.62 10.0 Zero power Maximum fuel pellet average enthalpy, cal/gm 145.2 200.0 Maximum fuel melt at the hot spot, % 0.0 10.0 Inadvertent operation of the ECCS during power operation Bounding Maximum pressurizer mixture volume, ft3 1786.5 1800.0 CVCS malfunction that increases reactor coolant inventory Bounding Minimum time from alarm to filling the pressurizer water-solid, minutes 8.5 8.0 Inadvertent opening of a pressurizer safety or relief valve Bounding Minimum DNBR (RTDP, WRB-2 correlation) 2.00 1.52 (5) ATWS Bounding Maximum RCS pressure, psia 3129.0 3215.0 Notes: 1. The 1.21 fraction of initial power (or analyzed full power for part-power conditions) limit was confirmed to be less than that which would correspond to melting conditions at the fuel centerline. 2. The results for this case were determined to be bounded by the results of the zero power steam system piping failure case. 3. Corresponds to a conservative fuel melting temperature of 4700°F associated with a conservative EOC UO 2 peak burnup at the hot spot of ~65,000 MWD/MTU. 4. 4800°F is the fuel melting temperature corresponding to an EOC UO 2 peak burnup at the hot spot of ~48,276 MWD/MTU. 5. This SAL DNBR is conservatively used to demonstrate that the DNB design basis is satisfied for analyses performed using RTDP methods. Sufficient margin is maintained between the SAL DNBR and the design limit DNBR to offset the effects of rod bow, lower plenum flow anomaly, and plant instrumentation biases, as well as to provide flexibility in the design and operation of the plant. See Section 2.12, "Thermal and Hydraulic Design," for additional informat ion. 6. As discussed in Section 2.5.2, "Uncontrolled Rod Cluster Control Assembly Bank Withdrawal at Power," a detailed DNBR analysis of the most limiting case was performed using the VIPRE computer code. This was necessary because the minimum DNBR calculated with the RETRAN computer code was less than the SAL DNBR. Per Section 2.12, "Thermal and Hydraulic Design," the detailed DNBR analysis confirmed that the DNB design basis is met and sufficient DNBR margin was retained to allow for flexibility in the design and operation of the plant.

2-31 WCAP-17658-NP September 2016 Licensing Report Revision 1-C Figure 2.1-1. Integrated DPC 2-32 WCAP-17658-NP September 2016 Licensing Report Revision 1-C Figure 2.1-2. Reactor Core Safety Limits Unacceptable Consequences 1925 psia 2460 psia 2250 psia 2000 psia Acceptable Consequences 2-33 WCAP-17658-NP September 2016 Licensing Report Revision 1-C Figure 2.1-3. Illustration of OTT and OPT Protection Full-Power Operating Point for Tavg = T OPT Setpoint SG Safety Valve Line Thermal Limits:

1925 psia 2460 psia 2250 psia 2000 psia OTT Setpoints:

1925 psia 2460 psia 2250 psia 2000 psia 2-34 WCAP-17658-NP September 2016 Licensing Report Revision 1-C Figure 2.1-4. Fractional Rod Insertion versus Time from Release 2-35 WCAP-17658-NP September 2016 Licensing Report Revision 1-C Figure 2.1-5. Normalized RCCA Reactivity Worth versus Fractional Rod Insertion 2-36 WCAP-17658-NP September 2016 Licensing Report Revision 1-C Figure 2.1-6. Normalized RCCA Reactivity Worth versus Time from Release 2-37 WCAP-17658-NP September 2016 Licensing Report Revision 1-C

2.2 INCREASE

IN HEAT REMOVAL BY THE SECONDARY SYSTEM

2.2.1 Feedwater

System Malfunctions that Result in a Decrease in Feedwater Temperature (USAR Section 15.1.1) 2.2.1.1 Technical Evaluation 2.2.1.1.1 Introduction The opening of a low-pressure FW heater bypass valve, the tripping of the FW heater drain pumps, or isolating all high-pressure extraction steam will cause a reduction in Tfeed that increases the thermal load on the primary system. For this event, there is a sudden decrease in T feed into the SGs. At power, the increased subcooling caused by the decreased T feed creates a greater load demand on the RCS. With the plant at no-load conditions, the addition of cold FW may cause a decrease in RCS temperature, and thus a reactivity insertion because of the negative MTC of reactivity. However, because the rate of energy change decreases as the load and FW flow decrease, the no-load transient is less severe than the full-power case. Depending on the magnitude of the temperature decrease and the operation of the automatic rod control system, the net effect on the RCS can be similar to the effect of increasing secondary steam flow; that is, the reactor will reach a new equilibrium condition at a power level corresponding to the new temperature difference across the secondary-side of the SG. For large Tfeed reductions, the OPT reactor trip function will prevent a power increase that could lead to a DNBR that is lower than the SAL value. 2.2.1.1.2 Input Parameters, Assumptions, and Acceptance Criteria The decrease in Tfeed event is analyzed to confirm that the minimum DNBR and fuel centerline temperature design bases are met. Therefore, the analysis uses the following key modeling inputs and assumptions: The RTDP (Reference 1) was used. The initial RCS pressure and RCS temperature were assumed to be at the nominal values consistent with steady-state full-power operation. The reactor coolant MMF was also modeled. Uncertainties for these initial conditions were accounted for in the DNBR SAL as described in Reference 1. The analyses were performed at an initial NSSS power of 3651 MWt, which includes a nominal reactor coolant pump (RCP) net heat input of 14 MWt and all applicable uncertainties. The analyses model the WCGS SGs (Westinghouse Model F). An initial water level corresponding to the nominal level minus uncertainties was modeled in all four SGs.

2-38 WCAP-17658-NP September 2016 Licensing Report Revision 1-C All T feed reduction cases modeled a symmetric decrease in Tfeed to all four SGs. At the start of the transient, the FW enthalpy was reduced to bound a temperature reduction of 200°F (step change) and the FW mass flow remained constant throughout the event. The 200°F temperature reduction conservatively bounds the spurious opening of the low pressure FW heater bypass valve and the resulting bypass of all flow through the low pressure FW heaters. Pressurizer sprays and PORVs were modeled to reduce RCS pressure, resulting in a conservative evaluation of the margin to the DNBR SAL. All T feed reduction cases were initiated from hot full-power. Cases modeling manual and automatic rod control were analyzed. In addition, sensitivities were analyzed to ensure that conservative vessel mixing characteristics were used. The OPT reactor trip function was credited for this event. Based on its frequency of occurrence, the decrease in T feed event is considered to be a Condition II event as defined by the ANS document "Nuclear Safety Criteria for the Design of Stationary Pressurized Water Reactor Plants," ANSI N18.2-1973. As such, the applicable acceptance criteria for this incident are: Pressures in the RCS and the MSS should be maintained below 110 percent of the respective design pressures. Fuel cladding integrity is maintained by ensuring that the minimum DNBR remains greater than the 95/95 DNBR SAL of 1.52. Additionally, fuel melting is precluded by ensuring that the maximum transient core average thermal power does not exceed a value that would result in exceeding the kW/ft value corresponding to fuel centerline melting at the core hot spot. For the WCGS, it has been confirmed that power levels up to 121 percent of the analyzed power level meet this criterion. An incident of moderate frequency should not generate a more serious plant condition without other faults occurring independently. Demonstrating that the pressurizer does not become water-solid ensures a more serious plant condition is not generated. Because this event results in a cooldown of the RCS, the reactor coolant experiences a reduction in volume, and therefore pressurizer filling is not a concern. The primary acceptance criteria used in this analysis is that the minimum DNBR remains greater than the SAL and that the maximum transient core average thermal power does not exceed the value that could potentially result in fuel melt at the core hot spot. The event does not challenge the primary- or secondary-side pressure limits because the increased heat removal results in an RCS cooldown. The acceptance criteria identified above are based on meeting the relevant regulatory requirements of 10 CFR 50, Appendix A, "General Design Criteria for Nuclear Power Plants" (GDC). Brief discussions of the specific GDCs that are related to the FWM event acceptance criteria are provided as follows. GDC 10 (Reactor Design) requires that the reactor core and associated coolant, control, and protection systems be designed with appropriate margin so specified acceptable fuel design limits 2-39 WCAP-17658-NP September 2016 Licensing Report Revision 1-C are not exceeded during any condition of normal operation, including anticipated operational occurrences. For the FWM event, this is shown to be met by demonstrating that the fuel cladding integrity is maintained. GDC 15 (RCS Design) requires that the RCS and associated auxiliary, control, and protection systems be designed with sufficient margin so design conditions of the reactor coolant pressure boundary (RCPB) are not exceeded during any condition of normal operation, including anticipated operational occurrences. For the FWM event, this is shown to be met by demonstrating that the peak RCS pressure is less than 110 percent of the design pressure. GDC 26 (Reactivity Control System Redundancy and Capability) requires that one of the reactivity control systems consists of control rods capable of reliably controlling reactivity changes with appropriate margin for malfunctions like stuck rods so that specified acceptable fuel design limits are not exceeded under conditions of normal operation, including anticipated operational occurrences. For the FWM event, this is shown to be met by demonstrating that the fuel cladding integrity is maintained. 2.2.1.1.3 Description of Analyses and Evaluations The excessive heat removal due to a Tfeed reduction transient was analyzed with the RETRAN computer code (Reference 2). This code simulates a multi-loop RCS, core neutron kinetics, the pressurizer, pressurizer relief and safety valves, pressurizer spray and heaters, SGs, and MSSVs. The code computes pertinent plant variables including temperatures, pressures, and power level. RETRAN (Reference 2) is used to conservatively predict DNBR.

The Tfeed reduction analysis accounts for the spurious opening of the low pressure FW heater bypass valve which results in a maximum T feed reduction of 200°F to all SGs. Cases modeled both automatic and manual rod control. All cases assume a conservatively large moderator density coefficient characteristic of end-of-life (EOL) conditions. 2.2.1.1.4 Results Comparison of results for both analyzed cases confirms that the T feed reduction case modeling manual rod control and design vessel mixing coefficients is the most limiting case. This case produces the largest reactivity feedback, and therefore results in the greatest power increase. For both analyzed Tfeed reduction transient cases, the reactor trips on the OPT function which then causes a consequential turbine trip. Minimum DNBR and peak core average thermal power are reached shortly after the reactor trip. Following reactor trip, the event is terminated as a consequence of a SI trip due to low pressurizer pressure. This SI trip causes automatic FW isolation ending the event. Table 2.2.1-1 shows the time sequence of events for the limiting Tfeed decrease transient. Table 2.2.1-2 provides minimum DNBR and peak core average thermal power results of both analyzed cases. Figures 2.2.1-1 through 2.2.

1-3 show the transient responses of various system parameters for the limiting T feed decrease transient.

2-40 WCAP-17658-NP September 2016 Licensing Report Revision 1-C 2.2.1.2 Conclusion For the excessive T feed decrease event, the results show that the minimum DNBR remains above the applicable SAL and that the core average thermal power does not exceed a value that results in exceeding the kW/ft limit corresponding to fuel centerline melting at the core hot spot. Therefore, no fuel damage is predicted and all applicable acceptance criteria are satisfied for the WCGS. Based on this, it is concluded that the plant will continue to meet the requirements of GDCs 10, 15, and 26. 2.2.1.3 References

1. Westinghouse Report WCAP-11397-P-A, "Revised Thermal Design Procedure," April 1989.
2. Westinghouse Report WCAP-14882-P-A, "RETRAN-02 Modeling and Qualification for Westinghouse Pressurized Water Reactor Non-LOCA Safety Analyses," May 1999.

2-41 WCAP-17658-NP September 2016 Licensing Report Revision 1-C Table 2.2.1-1 Time Sequence of Events - Decrease In T feed (Manual Rod Control)

Event Time (seconds) Low Pressure FW Heater Bypass Valves Open 0.01 OPT Setpoint Reached in Two Loops 35.2 Reactor Trip (Rod Motion Starts) on OPT 38.2 Minimum DNBR Reached 38.5 Low Pressurizer Pressure SI Setpoint Reached 83.1 FW Isolation Initiated 100.0 Table 2.2.1-2 Decrease in Tfeed Minimum DNBR and Peak Core Average Thermal Power Results T feed Decrease Case Minimum DNBR (1) Time of Minimum DNBR (seconds) Peak Core Average Thermal Power (2) (FOI) Time of Peak Core Average Thermal Power(seconds) Automatic Rod Control 1.86 47.5 1.173 47.5 Manual Rod Control 1.77 38.5 1.192 38.5 Notes: 1. The SAL for DNBR is 1.52. 2. The SAL for peak core average thermal power (fraction of initial) is 1.21 of the analyzed power level.

2-42 WCAP-17658-NP September 2016 Licensing Report Revision 1-C Figure 2.2.1-1. Decrease in T feed at Full Power - Nuclear Power and Core Heat Flux versus Time 2-43 WCAP-17658-NP September 2016 Licensing Report Revision 1-C Figure 2.2.1-2. Decrease in T feed at Full Power - Vessel Delta-T and Core Average Moderator Temperature versus Time 2-44 WCAP-17658-NP September 2016 Licensing Report Revision 1-C Figure 2.2.1-3. Decrease in T feed at Full Power - Pressurizer Pressure and DNBR versus Time 2-45 WCAP-17658-NP September 2016 Licensing Report Revision 1-C

2.2.2 Feedwater

System Malfunctions that Result in an Increase in Feedwater Flow (USAR Section 15.1.2) 2.2.2.1 Technical Evaluation 2.2.2.1.1 Introduction The addition of excessive FW will cause an increase in heat removal from the RCS. An example of excessive FW flow would be a full opening of a main FW flow control valve (FCV) due to a FW control system malfunction or an operator error. At power, this excess flow causes a greater load demand on the RCS due to increased subcooling in the SG. With the plant at no-load conditions, the addition of excess FW may cause a decrease in RCS temperature, and thus a reactivity insertion due to the effects of the negative MTC of reactivity. 2.2.2.1.2 Input Parameters, Assumptions, and Acceptance Criteria The FW flow increase event is analyzed to confirm that the minimum DNBR and fuel centerline temperature design bases are met. Therefore, the analysis uses the following key modeling inputs and assumptions: The RTDP (Reference 1) was used for the cases initiated from full power. The initial RCS pressure and RCS temperature were assumed to be at the nominal values consistent with steady-state full-power operation. The reactor coolant MMF was also modeled. Uncertainties for these initial conditions were accounted for in the DNBR SAL as described in Reference 1. The analyses were performed at an initial NSSS power of 3651 MWt, which includes a nominal RCP net heat input of 14 MWt and all applicable uncertainties. The analyses model the WCGS SGs (Westinghouse Model F). For the single-loop FW flow increase event at full-power, one FW control valve was assumed to malfunction, resulting in a step increase to 200 percent of the nominal full-power FW flow to one SG. For the multiple-loop FW flow increase event at full-power, two FW control valves were assumed to malfunction, resulting in a step increase to 200 percent of the nominal full-power FW flow to two SGs. The increase in FW flow rate results in a decrease in the Tfeed (enthalpy) due to the reduced efficiency of the FW heaters. For full power, a 25 Btu/lbm decrease in the FW enthalpy was conservatively assumed to occur coincident with the FW flow increase. For the single-loop FW flow increase event at no-load conditions, one FW control valve was assumed to malfunction, resulting in a step increase to 250 percent of the full-power nominal flow to one SG.

2-46 WCAP-17658-NP September 2016 Licensing Report Revision 1-C For the multiple-loop FW flow increase event at no-load conditions, two FW control valves were assumed to malfunction, resulting in a step increase to 250 percent of the full-power nominal flow to two SGs. For the cases initiated at zero power, initial reactor power, RCS pressure, and RCS temperature were assumed to be at levels corresponding to no-load conditions. TDF was also modeled. In addition, the reactor was assumed to be at the minimum shutdown margin condition of -0.013 k/k. For the full-power cases, an initial water level corresponding to the nominal level minus uncertainties was modeled in all four SGs, whereas an initial water level corresponding to the nominal level was modeled for the zero-power cases. Pressurizer sprays and PORVs were modeled to reduce RCS pressure, resulting in a conservative evaluation of the margin to the DNBR SAL. The full-power cases were analyzed with manual and automatic rod control. For cases at zero-power conditions, the initial Tfeed was assumed to be 35°F. The heat capacities of the RCS and SG thick metal were not considered, thereby maximizing the potential temperature reduction of the reactor coolant. Based on its frequency of occurrence, the increase in FW flow event is considered to be a Condition II event as defined by the ANS's "Nuclear Safety Criteria for the Design of Stationary Pressurized Water Reactor Plants," ANSI N18.2-1973. As such, the applicable acceptance criteria for this incident are: Pressure in the RCS and MSS should be maintained below 110 percent of the design pressures. Fuel cladding integrity is maintained by ensuring that the minimum DNBR remains greater than the 95/95 DNBR SAL of 1.52 in the limiting fuel rods and that the centerline temperature of the fuel rods with the peak linear heat rate (kW/ft) does not exceed the UO 2 melting temperature. Fuel melting is precluded by ensuring that the maximum transient core average thermal power does not exceed a value that would result in exceeding the kW/ft value corresponding to fuel centerline melting at the core hot spot. For the WCGS, it has been confirmed that power levels up to 121 percent of the initial value meet this criterion. An incident of moderate frequency should not generate a more serious plant condition without other faults occurring independently. Demonstrating that the pressurizer does not become water-solid ensures a more serious plant condition is not generated. Because this event results in a cooldown of the RCS, the reactor coolant volume decreases, and therefore pressurizer filling is not a concern.

2-47 WCAP-17658-NP September 2016 Licensing Report Revision 1-C The primary acceptance criterion used in this analysis is that the minimum DNBR remains greater than the SAL, thus ensuring fuel cladding integrity is maintained. The fuel cladding integrity is also assured by ensuring that the maximum transient core average thermal power does not exceed the value that would result in exceeding the kW/ft value corresponding to fuel centerline melting at the core hot spot. The event does not challenge the primary- or secondary-side pressure limits because the increased heat removal results in an RCS cooldown. The acceptance criteria identified above are based on meeting the relevant regulatory requirements of 10 CFR 50, Appendix A, "General Design Criteria for Nuclear Power Plants." Brief discussions of the specific GDCs that are related to the FWM event acceptance criteria are provided as follows. GDC 10 (Reactor Design) requires that the reactor core and associated coolant, control, and protection systems be designed with appropriate margin so specified acceptable fuel design limits are not exceeded during any condition of normal operation, including anticipated operational occurrences. For the FWM event, this is shown to be met by demonstrating that the fuel cladding integrity is maintained. GDC 15 (RCS Design) requires that the RCS and associated auxiliary, control, and protection systems be designed with sufficient margin so design conditions of the RCPB are not exceeded during any condition of normal ope ration, including anticipated ope rational occurrences. For the FWM event, this is shown to be met by demonstrating that the peak RCS pressure is less than 110 percent of the design pressure. GDC 26 (Reactivity Control System Redundancy and Capability) requires that one of the reactivity control systems consist of control rods capable of reliably controlling reactivity changes with appropriate margin for malfunctions like stuck rods so that specified acceptable fuel design limits are not exceeded under conditions of normal operation, including anticipated operational occurrences. For the FWM event, this is shown to be met by demonstrating that the fuel cladding integrity is maintained. Note that a reactor trip is not modeled in the FWM analysis performed for the WCGS. 2.2.2.1.3 Description of Analyses and Evaluations The excessive heat removal due to a FW flow increase transient was analyzed with the RETRAN computer code (Reference 2). This code simulates a multi-loop RCS, core neutron kinetics, the pressurizer, pressurizer relief and safety valves, pressurizer spray and heaters, SGs, and MSSVs. The code computes pertinent plant variables including temperatures, pressures, and power level. The VIPRE computer code (Reference 3) is used to verify that the DNBR remains above the DNBR SAL for hot zero power (HZP) cases. For hot full power (HFP) cases, RETRAN (Reference 2) is used to conservatively predict DNBR.

The excessive FW flow event assumes an accidental opening of one or more FW control valves with the reactor at full- and zero-power conditions, and with automatic and manual rod control, where applicable. Both the automatic and manual rod control cases assume a conservatively large moderator density coefficient characteristic of EOL conditions. Table 2.2.2-1 summarizes the analyzed cases.

2-48 WCAP-17658-NP September 2016 Licensing Report Revision 1-C 2.2.2.1.4 Results For the cases initiated at HFP conditions, a comparison of the multiple-loop (failure of two FW control valves) and single-loop (failure of one FW control valve) cases demonstrates that the two-loop failure case with manual rod control is more limiting. The two-loop FW flow increase case with manual rod control produces the largest reactivity feedback, and therefore results in the greatest power increase. The cases initiated at HZP conditions are less limiting than the HZP SLB analysis described in Section 2.2.5. Therefore, the results of this case are not presented. Continuous addition of excessive FW is prevented by the SG high-high level trip, which initiates FWI and trips the turbine and main FW pumps. Subsequent to FWI initiated by a SG high-high level trip, the reactor continues to operate until the low-low SG level setpoint is reached. However, the reactor trip on low-low SG level is not modeled in the analysis because it occurs after the time of interest for the event. Table 2.2.2-2 shows the time sequence of events for the limiting multi-loop, full-power FW flow increase transient with manual rod control; Table 2.2.2-3 provides minimum DNBR and peak core average thermal power results of all cases. Figures 2.2.2-1 through 2.2.2-4 show the transient responses of various system parameters for the limiting multi-loop FW flow increase initiated from full-power conditions with manual rod control. 2.2.2.2 Conclusion For the excessive increase in FW flow event, the results show that the DNBRs encountered are above the applicable SAL value and that the core average thermal power does not exceed a value that results in exceeding the kW/ft limit corresponding to fuel centerline melting at the core hot spot. Therefore, no fuel damage is predicted and all applicable acceptance criteria are satisfied for the WCGS. Based on this, it is concluded that the plant will continue to meet the requirements of GDCs 10, 15, and 26. 2.2.2.3 References

1. Westinghouse Report WCAP-11397-P-A, "Revised Thermal Design Procedure," April 1989.
2. Westinghouse Report WCAP-14882-P-A, "RETRAN-02 Modeling and Qualification for Westinghouse Pressurized Water Reactor Non-LOCA Safety Analyses," May 1999.
3. Westinghouse Report WCAP-14565-P-A, "VIPRE-01 Modeling and Qualification for Pressurized Water Reactor Non-LOCA Thermal-Hydraulic Safety Analysis," October 1999.

2-49 WCAP-17658-NP September 2016 Licensing Report Revision 1-C Table 2.2.2-1 Increase in FW Flow Cases Analyzed Case Power Level Failure Affected Loop(s) Rod Control 1 HFP 1 FW FCV Loop 1 Manual 2 HFP 1 FW FCV Loop 1 Automatic 3 HFP 2 FW FCVs Loops 1 and 2 Manual 4 HFP 2 FW FCVs Loops 1 and 2 Automatic 5 HZP 1 FW FCV Loop 1 Manual 6 HZP 2 FW FCVs Loops 1 and 2 Manual Table 2.2.2-2 Time Sequence of Events - Increase in FW Flow (HFP, Multi-Loop, Manual Rod Control)

Event Time (seconds) Two FW Control Valves Fail Full-Open (Event Initiation) 0.01 SG Level Reaches High-High Setpoint of 100% NRS 36.9 Turbine Trip Initiated (from High-High SG Level Trip) 39.3 Minimum DNBR Occurs 41.5 FWI Initiated (from High-High SG Level Trip) 53.8 Table 2.2.2-3 HFP FWM Flow Increase Minimum DNBR and Peak Core Average Thermal Power Results HFP FW Flow Increase Case Minimum DNBR (1) Time of Minimum DNBR(seconds) Peak Core Average Thermal Power (2) (FOI) Time of Peak Core Average Thermal Power (seconds) Single Loop Auto Control 2.15 26.0 1.046 39.5 Single Loop Manual Control 2.10 28.0 1.073 45.5 Multiple Loop Auto Control 2.11 39.5 1.065 44.5 Multiple Loop Manual Control 2.04 41.5 1.098 45.0 Notes: 1. The SAL for DNBR is 1.52. 2. The SAL for peak core average thermal power (FOI) is 1.21.

2-50 WCAP-17658-NP September 2016 Licensing Report Revision 1-C Figure 2.2.2-1. Increase in FW Flow at Full Power - Multi-Loop Manual Rod Control Nuclear Power and Core Heat Flux versus Time 2-51 WCAP-17658-NP September 2016 Licensing Report Revision 1-C Figure 2.2.2-2. Increase in FW Flow at Full Power - Multi-Loop Manual Rod Control Core Average Moderator Temperature and Pressurizer Pressure versus Time 2-52 WCAP-17658-NP September 2016 Licensing Report Revision 1-C Figure 2.2.2-3. Increase in FW Flow at Full Power - Multi-Loop Manual Rod Control SG Mass Inventory and Pressure versus Time 2-53 WCAP-17658-NP September 2016 Licensing Report Revision 1-C Figure 2.2.2-4. Increase in FW Flow at Full Power - Multi-Loop Manual Rod Control DNBR versus Time 2-54 WCAP-17658-NP September 2016 Licensing Report Revision 1-C

2.2.3 Excessive

Increase in Secondary Steam Flow (USAR Section 15.1.3) 2.2.3.1 Technical Evaluation 2.2.3.1.1 Introduction An excessive load increase incident is defined as a rapid increase in steam flow that causes a power mismatch between the reactor core power and the SG load demand. The RCS is designed to accommodate a 10 percent step-load increase or a 5 percent-per-minute ramp-load increase in the range of 15 to 100 percent of full power. Any loading rate in excess of these values may cause a reactor trip actuated by the reactor trip system. If the load increase exceeds the capability of the RCS, the transient would be terminated in sufficient time to prevent the DNB design basis from being violated. This incident could result from either an administrative violation such as excessive loading by the operator or an equipment malfunction in the steam bypass control system, or turbine speed control. During power operation, steam dump to the condenser is controlled by reactor coolant condition signals, such as a high reactor coolant temperature, which indicates a need for steam dump. A single controller malfunction will not cause steam dump valves to open; an interlock is provided that blocks the opening of the valves unless a large turbine load decrease or a turbine trip has occurred. For all cases, the plant rapidly reaches a stabilized condition at a higher power level. Normal plant operating procedures would be followed to reduce power. The excessive load increase incident is an overpower transient for which the fuel temperatures will rise. Reactor trip may not occur for some cases, and the plant will reach a new equilibrium condition at a higher power level corresponding to the increase in steam flow. Protection against an excessive load increase incident, if necessary, is provided by the following reactor trip signals: OPT OTT Power range high neutron flux 2.2.3.1.2 Input Parameters, Assumptions, and Acceptance Criteria An evaluation was performed to show that the DNB design basis is satisfied for the excessive load increase incident. Key aspects of the evaluation are provided below. The RTDP (Reference 1) was applied. Initial reactor power, RCS pressure, and RCS temperature were assumed to be at their nominal values, consistent with steady-state full-power operation. MMF was also assumed. Uncertainties in initial conditions were accounted for in the safety analysis DNBR limit value, as described in Reference 1.

The evaluation was performed for a step-load increase of 10 percent steam flow from 100 percent of core power. The higher end of the T avg range (570.7°F to 588.4°F) is applied because it minimizes the initial margin to the DNBR limit.

2-55 WCAP-17658-NP September 2016 Licensing Report Revision 1-C The higher end of the full-power T feed range (400.0°F to 448.6°F) is applied, although the event is not very sensitive to Tfeed. Zero percent SGTP is modeled because this maximizes the primary-to-secondary heat transfer area, which is conservative for maximizing the cooldown of the RCS. The pressurizer heaters are not modeled because the pressurizer heaters would actuate to try and raise the pressurizer pressure, which is not conservative with respect to minimizing DNBR. The pressurizer sprays and PORVs are modeled to limit any RCS pressure increase. A lower RCS pressure is conservative for DNBR calculations.

Although the OTT, OP T, and power range high neutron flux react or trips are available to mitigate the event, the analysis conservatively does not credit these trips.

No credit is taken for the heat capacity of the RCS and SG metal mass in attenuating the resulting plant cooldown. This event is analyzed with automatic and manual rod control.

Because the event is not sensitive to the initial pressurizer and SG levels, the pressurizer level and SG level are modeled to be at the nominal values consistent with steady-state full-power operation.

The event is analyzed for both the beginning-of-life ((BOL) minimum reactivity feedback) and EOL (maximum reactivity feedback) conditions.

Based on its frequency of occurrence, the excessive load increase incident is considered to be a Condition II event as defined by the ANS's "Nuclear Safety Criteria for the Design of Stationary Pressurized Water Reactor Plants," ANSI N18.2-1973. The following items summarize the acceptance criteria associated with this event: The critical heat flux (CHF) should not be exceeded. This is met by demonstrating that the minimum DNBR does not go below the SAL value at any time during the transient. Pressures in the RCS and MSS should be maintained below 110 percent of the respective design pressures. The peak linear heat generation rate (expressed in kW/ft) should not exceed a value that would cause fuel centerline melt. This criterion is satisfied by demonstrating that the core average heat flux remains below the limit of 121 percent of the applied nominal core thermal power during the event. An incident of moderate frequency should not generate a more serious plant condition without other faults occurring independently.

2-56 WCAP-17658-NP September 2016 Licensing Report Revision 1-C 2.2.3.1.3 Description of Analyses and Evaluations The excessive load increase event is analyzed using the RETRAN computer code described in WCAP-14882-P-A (Reference 2). The RETRAN code model simulates the RCS, neutron kinetics, pressurizer, pressurizer relief and safety valves, pressurizer heaters, pressurizer spray, SG, FW system, and MSSVs. The code computes pertinent plant variables including SG mass, pressurizer water volume, reactor coolant average temperature, RCS pressure, and SG pressure. RETRAN (Reference 2) is used to conservatively predict DNBR. For the minimum reactivity feedback cases, the core has the least-negative MTC of reactivity and the least-negative Doppler-only power coefficient curve, and, therefore, the least-inherent transient response capability. For the maximum reactivity feedback cases, the core has the most-negative MTC of reactivity and the most-negative Doppler-only power coefficient curve. This results in the largest amount of reactivity feedback due to changes in coolant temperature. Normal reactor control systems and engineered safety systems are not required to function. 2.2.3.1.4 Results The analysis results for the 10 percent load increase event from full-power conditions show that in all cases analyzed the minimum DNBR remains above the SAL value and the peak linear heat generation does not exceed the limit value, thus demonstrating th at the fuel cladding integrity and fuel centerline melt acceptance criteria are met. The peak pressurizer water volume remains below the total volume of the pressurizer, demonstrating that this event does not generate a more serious plant condition. Following the initial load increase, the plant reaches a stabilized (steady-state) condition. The increase in the MSS flow rate results in a cooldown of the RCS and a decrease in the MSS pressure. The RCS and MSS pressure limits are not challenged during the event. The analysis inputs are intended to minimize the resultant minimum DNBR and not to maximize RCS and MSS pressures. The case that models minimum reactivity feedback conditions with automatic rod control is the most limiting case with respect to minimum DNBR. The key results are summarized in Table 2.2.3-1. The time sequence of events for each case is provided in Table 2.2.3-2. The transient responses for the four cases are shown in Figures 2.2.3-1 through 2.2.3-4. 2.2.3.2 Conclusion The excessive load increase analysis demonstrates that for this event at the WCGS, the DNBR does not decrease below the SAL value at any time during the transient for all cases. Also , the peak core average power (heat flux) remains below the limit of 121 percent of the applied nominal core thermal power; thus, no fuel or cladding damage is predicted. The event does not challenge the primary and secondary side pressure limits because the increased heat removal cools the RCS and depressurizes the MSS. The peak pressurizer water volume remains below the total volume of the pressurizer, demonstrating that this event does not generate a more serious plant condition. All applicable acceptance criteria are met for the WCGS.

2-57 WCAP-17658-NP September 2016 Licensing Report Revision 1-C 2.2.3.3 References

1. Westinghouse Report WCAP-11397-P-A (Proprietary) and WCAP-11397-A (Non-Proprietary), "Revised Thermal Design Procedure," April 1989.
2. Westinghouse Report WCAP-14882-P-A (Proprietary) and WCAP-15234-A (Non-Proprietary),

"RETRAN-02 Modeling and Qualification for Westinghouse Pressurized Water Reactor Non-LOCA Safety Analyses," April 1999 and May 1999, respectively.

2-58 WCAP-17658-NP September 2016 Licensing Report Revision 1-C Table 2.2.3-1 Excessive Load Increase Incident Summary of Results Case Minimum DNBR Core Heat Flux (FOI) Limits 1.52 1.21 Minimum reactivity feedback, manual rod control 2.29 1.02 Minimum reactivity feedback, automatic rod control 1.97 1.11 Maximum reactivity feedback, manual rod control 2.03 1.10 Maximum reactivity feedback, automatic rod control 2.00 1.10 2-59 WCAP-17658-NP September 2016 Licensing Report Revision 1-C Table 2.2.3-2 Time Sequence of Events for the Excessive Load Increase Incident Case Event Time of Event (seconds) Minimum reactivity feedback, manual rod control 10% step load increase

0.0 Minimum

DNBR reached 6.7 Steady-state conditions reached (approximate) ~300 (1) Peak heat flux reached 382.5 Minimum reactivity feedback, automatic rod control 10% step load increase 0.0 Peak heat flux reached 265.6 Steady-state conditions reached (approximate) ~300 (1) Minimum DNBR reached 377.6 Maximum reactivity feedback, manual rod control 10% step load increase 0.0 Steady-state conditions reached (approximate) ~350 (1) Peak heat flux reached 362.8 Minimum DNBR reached 395.7 Maximum reactivity feedback, automatic rod control 10% step load increase 0.0 Peak heat flux reached 368.5 Minimum DNBR reached 398.2 Steady-state conditions reached (approximate) ~400 (1) Note: 1. Time of equilibrium (steady-state conditions reached) was selected based on when the nuclear power leveled out after transient initiation.

2-60 WCAP-17658-NP September 2016 Licensing Report Revision 1-C Figure 2.2.3-1. 10% Step Increase in Heat Removal by Secondary System Minimum Reactivity Feedback, Manual Reactor Control 2-61 WCAP-17658-NP September 2016 Licensing Report Revision 1-C Figure 2.2.3-1. 10% Step Increase in Heat Removal by Secondary System (cont.) Minimum Reactivity Feedback, Manual Reactor Control 2-62 WCAP-17658-NP September 2016 Licensing Report Revision 1-C Figure 2.2.3-2. 10% Step Increase in Heat Removal by Secondary System Minimum Reactivity Feedback, Automatic Reactor Control 2-63 WCAP-17658-NP September 2016 Licensing Report Revision 1-C Figure 2.2.3-2. 10% Step Increase in Heat Removal by Secondary System (cont.) Minimum Reactivity Feedback, Automatic Reactor Control 2-64 WCAP-17658-NP September 2016 Licensing Report Revision 1-C Figure 2.2.3-3. 10% Step Increase in Heat Removal by Secondary System Maximum Reactivity Feedback, Manual Reactor Control 2-65 WCAP-17658-NP September 2016 Licensing Report Revision 1-C Figure 2.2.3-3. 10% Step Increase in Heat Removal by Secondary System (cont.) Maximum Reactivity Feedback, Manual Reactor Control 2-66 WCAP-17658-NP September 2016 Licensing Report Revision 1-C Figure 2.2.3-4. 10% Step Increase in Heat Removal by Secondary System Maximum Reactivity Feedback, Automatic Reactor Control 2-67 WCAP-17658-NP September 2016 Licensing Report Revision 1-C Figure 2.2.3-4. 10% Step Increase in Heat Removal by Secondary System (cont.) Maximum Reactivity Feedback, Automatic Reactor Control 2-68 WCAP-17658-NP September 2016 Licensing Report Revision 1-C

2.2.4 Inadvertent

Opening of a Steam Generator Atmospheric Relief or Safety Valve (USAR Section 15.1.4) 2.2.4.1 Technical Evaluation 2.2.4.1.1 Introduction The most severe core conditions resulting from an acci dental depressurization of the MSS are associated with an inadvertent opening of a SG atmospheric relief or safety valve. More specifically, an accidental depressurization of the MSS is a transient that is analyzed to bound the opening of a single turbine bypass valve or SG ARV because the inadvertent opening of one of these control valves is most likely to occur. Conversely, the inadvertent opening of a SG safety valve is not nearly as likely to occur because the design of a spring-loaded safety valve is passive in nature. However, because the relief capacity of a SG safety valve is larger than those associated with either of the other two types of valves, the failure of a SG safety valve is also conservatively considered in the analysis of an accidental depressurization of the MSS. The analyses that consider a major rupture of a main steam pipe are presented in Section 2.2.5. The steam release, as a consequence of an accidental depressurization of the MSS, results in an initial increase in steam flow, followed by a decrease in steam flow during the rest of the accident as the SG pressure decreases. The increased energy removal from the RCS causes a decrease in the reactor coolant temperature and pressure. In the presence of a negative MTC, the cooldown results in a positive reactivity insertion. The primary design features that provide protection for accidental depressurizations of the MSS are: Actuation of the SI system on any of the following:

- Two-out-of-four low pressurizer pressure signals

- Two-out-of-three low steam line pressure signals in any one loop Actuation of a reactor trip from the overpower signals (neutron flux and T) or upon the receipt of an SI signal. Redundant isolation of the main FW lines to prevent sustained main FW flow, which would cause additional cooldown. In addition to the primary means of protection, where an SI signal closes the main FW isolation valves, an SI signal will also rapidly close all main FW control valves and control bypass valves, trip the main FW pumps, and close the FW pump discharge valves. Closure of the fast-acting MSIVs on the following:

- Two-out-of-three low steam line pressure signals in any one loop (above Permissive P-11)

- Two-out-of-three high negative steam pressure rate signals in any one loop (below Permissive P-11) 2-69 WCAP-17658-NP September 2016 Licensing Report Revision 1-C 2.2.4.1.2 Input Parameters, Assumptions, and Acceptance Criteria The following summarizes the major input parameters and/or assumptions used in the analysis of an accidental depressurization of the MSS event at HZP conditions: HZP conditions were modeled with four loops in service and with offsite power available. A steam flow rate of approximately 240 lbm/sec at 1075 psia (corresponding to 268 lbm/sec at 1200 psia) was analyzed. This flow rate corresponds to the maximum capacity of any single turbine bypass, atmospheric relief, or safety valve. Minimum SGTP (0 percent) was modeled to conservatively maximize primary-to-secondary heat transfer. All control rods were modeled to be inserted except the most reactive RCCA, which was assumed to be stuck out of the core. A minimum, EOL shutdown margin corresponding to 1.30 percent k/k was modeled at event initiation. The SI system was modeled with a conservatively low flow capability, corresponding to only one high-head SI (centrifugal charging) pump injecting through the cold legs (CLs). The flow from the SI system that is delivered to the RCS was modeled with a temperature and boron concentration consistent with the minimum values for the refueling water storage tank, as required by the TS. The low pressurizer pressure signal was credited for SI system actuation. In addition, the SI signal that results from the low pressurizer pressure signal was credited for isolation of the main FW lines. The accumulators were modeled to be available; however, CL pressures never decreased to the point where flow from the accumulators was injected. The AFW system was modeled with a conservatively high flow capability, corresponding to all AFW pumps operating at maximum capacity and the maximum flow possible being delivered to the faulted SG. An accidental depressurization of the MSS is classified as a Condition II event, an incident of moderate frequency, as defined by the ANS's "Nuclear Safety Criteria for the Design of Stationary Pressurized Water Reactor Plants," ANSI N18.2-1973. The pressure limits for the primary and secondary systems are not challenged for this accident because the pressures in these systems each decrease from their initial values during the transient. The only criterion that has the potential to be challenged during this event is that associated with fuel damage. The analysis demonstrates that this criterion is met by showing that the DNB design basis is met. That is, this analysis 2-70 WCAP-17658-NP September 2016 Licensing Report Revision 1-C shows that the minimum DNBR does not go below the limit value at any time during the transient. In addition, it has been historical practice to assume that fuel failure will occur if centerline melting takes place. Therefore, the analysis also demonstrates that the peak linear heat generation rate (expressed in kW/ft) does not exceed the value that would cause fuel centerline melt. The acceptance criteria identified above are based on meeting the relevant regulatory requirements of 10 CFR 50, Appendix A, "General Design Criteria for Nuclear Power Plants." Brief discussions of the specific GDCs that are related to the accidental depressurization of the MSS event acceptance criteria are provided as follows. GDC 10 (Reactor Design) requires that the reactor core and associated coolant, control, and protection systems be designed with appropriate margin so specified acceptable fuel design limits are not exceeded during any condition of normal operation, including anticipated operational occurrences. For the accidental depressurization of the MSS event, this is shown to be met by demonstrating that the fuel damage criterion is satisfied. GDC 15 (RCS Design) requires that the RCS and associated auxiliary, control, and protection systems be designed with sufficient margin so design conditions of the RCPB are not exceeded during any condition of normal ope ration, including anticipated ope rational occurrences. For the accidental depressurization of the MSS event, this is shown to be met by demonstrating that the peak RCS pressure is less than 110 percent of the design pressure. GDC 20 (Protection System Functions) requires that the protection system be designed to initiate automatically the operation of appropriate systems including the reactivity control systems, so specified acceptable fuel design limits are not exceeded as a result of anticipated operational occurrences, and to sense accident conditions and initiate the operation of systems and components important to safety. For the accidental depressurization of the MSS event, this is shown to be met by demonstrating that the fuel damage criterion is satisfied. GDC 26 (Reactivity Control System Redundancy and Capability) requires that one of the reactivity control systems uses control rods capable of reliably controlling reactivity changes with appropriate margin for malfunctions like stuck rods so that specified acceptable fuel design limits are not exceeded under conditions of normal operation, including anticipated operational occurrences. For the accidental depressurization of the MSS event, this is shown to be met by demonstrating that the fuel damage criterion is satisfied. 2.2.4.1.3 Description of Analyses and Evaluations A detailed analysis was performed using the RETRAN computer code (Reference 1) to determine the plant transient conditions following an accidental depressurization of the MSS. The RETRAN model simulates the core neutron kinetics, RCS, pressurizer, SGs, SI system and AFW system. To properly model the system response to this event and prevent any non-physical behavior from being predicted when the pressurizer refills, the pressurizer and surge line were modeled as a single volume, as compared to the nodalization documented in Reference 1. The code computes pertinent plant variables, including the core heat flux and reactor coolant temperature and pressure. A detailed core analysis was then performed using the ANC code (Reference 2) to confirm the validity of the RETRAN-predicted reactivity 2-71 WCAP-17658-NP September 2016 Licensing Report Revision 1-C feedback model. The core models developed in ANC were also used to calculate the power peaking factors that were used as input to the detailed T/H digital computer code, VIPRE (Reference 3), which was used with a DNB correlation applicable to the low pressure condition (Reference 4) to determine if the DNB design basis was met. In addition, the core models developed in ANC were used to calculate the peak linear heat generation rate. 2.2.4.1.4 Results The calculated sequence of events for an accidental depressurization of the MSS at HZP initial conditions with offsite power available is shown in Table 2.2.4-1, and the limiting results are presented in Table 2.2.4-2. Figures 2.2.4-1 through 2.2.4-7 show the transient results for an accidental depressurization of the MSS. Because offsite power was assumed to be available in this analysis, there is full reactor coolant flow. If the core were to be critical at or near HZP conditions when the accidental depressurization occurs, the initiation of SI via a low pressurizer pressure signal would trip the reactor. In addition, sustained main FW flow is prevented by the isolation of the main FW lines on the SI signal that results from the low pressurizer pressure signal.

As shown in Figure 2.2.4-4, the core attains criticality with the RCCAs inserted (i.e., with the plant shut down assuming one stuck RCCA) before the transient is effectively terminated by boron injected from the SI system. The results of the analysis of an accidental depressurization of the MSS event demonstrate that the DNB design basis is met. The calculated minimum DNBR is well above the limit value. In addition, the peak linear heat generation rate (expressed in kW/ft) does not exceed the value that would cause fuel centerline melt. The pressure limits for the primary and secondary systems are not challenged for this accident because the pressures in these systems each decrease from their initia l values during the transient. Therefore, this event does not adversely affect the core or the RCS, and all applicable acceptance criteria are met. 2.2.4.2 Conclusion The analysis of the accidental depressurization of the MSS described above has been reviewed. It is concluded that the analysis has adequately accounted for operation of the plant at the analyzed power level and was performed using acceptable analytical models. It is further concluded that the analysis has demonstrated that the reactor protection and safety sy stems will continue to ensure that the applicable safety analysis design limits and the RCPB pressure limits will not be exceeded as a result of this event. Based on this, the conclusion is that the plant will continue to meet the requirements of GDCs 10, 15, 20, and 26.

2-72 WCAP-17658-NP September 2016 Licensing Report Revision 1-C 2.2.4.3 References

1. Westinghouse Report WCAP-14882-P-A, "RETRAN-02 Modeling and Qualification for Westinghouse Pressurized Water Reactor Non-LOCA Safety Analyses," April 1999.
2. Westinghouse Report WCAP-10965-P-A, "ANC: A Westinghouse Advanced Nodal Computer Code," September 1986.
3. Westinghouse Report WCAP-14565-P-A, "VIPRE-01 Modeling and Qualification for Pressurized Water Reactor Non-LOCA Thermal-Hydraulic Safety Analysis," October 1999.
4. Westinghouse Report WCAP-14565-P-A Addendum 2-P-A, "Addendum 2 to WCAP-14565-P-A Extended Application of ABB-NV Correlation and Modified ABB-NV Correlation WLOP for PWR Low Pressure Applications," April 2008.

2-73 WCAP-17658-NP September 2016 Licensing Report Revision 1-C Table 2.2.4-1 Time Sequence of Events - Accidental Depressurization of the MSS at HZP Conditions Case Event Time (sec) Inadvertent Opening of a Single Turbine Bypass, Atmospheric Relief, or Safety Valve Accidental Depressurization of the MSS Occurs 0.0 Pressurizer Empties 209.5 Low Pressurizer Pressure SI Setpoint Reached 216.3 SI Signal Generated (on low pressurizer pressure) 218.3 FW Isolation Complete 233.3 SI Flow Initiated 243.3 Core Re-criticality Occurs 270.5 Borated Water from SI System Reaches the Core 578.8 Peak Core Heat Flux Reached 581.5 Core Becomes Subcritical 590.5 Table 2.2.4-2 Limiting Results - Accidental Depressurization of the MSS at HZP Conditions Case Parameter Analysis Value Limit Inadvertent Opening of a Single Turbine Bypass, Atmospheric Relief, or Safety Valve Minimum DNBR 5.10 1.18 Peak Linear Heat Generation (kW/ft) 6.924 22.4

2-74 WCAP-17658-NP September 2016 Licensing Report Revision 1-C Figure 2.2.4-1. Accidental Depressurization of the MSS at HZP -Nuclear Power and Core Heat Flux versus Time 2-75 WCAP-17658-NP September 2016 Licensing Report Revision 1-C Figure 2.2.4-2. Accidental Depressurization of the MSS at HZP Reactor Vessel Inlet Temperature and Core Average Temperature versus Time 2-76 WCAP-17658-NP September 2016 Licensing Report Revision 1-C Figure 2.2.4-3. Accidental Depressurization of the MSS at HZP - Pressurizer Pressure and Pressurizer Water Volume versus Time 2-77 WCAP-17658-NP September 2016 Licensing Report Revision 1-C Figure 2.2.4-4. Accidental Depressurization of the MSS at HZP Core Boron Concentration and Reactivity versus Time 2-78 WCAP-17658-NP September 2016 Licensing Report Revision 1-C Figure 2.2.4-5. Accidental Depressurization of the MSS at HZP - Steam Pressure and Steam (Break) Flow versus Time 2-79 WCAP-17658-NP September 2016 Licensing Report Revision 1-C Figure 2.2.4-6 Accidental Depressurization of the MSS at HZP - FW Flow and SG Mass versus Time 2-80 WCAP-17658-NP September 2016 Licensing Report Revision 1-C Figure 2.2.4-7. Accidental Depressurization of the MSS at HZP Core Flow versus Time 2-81 WCAP-17658-NP September 2016 Licensing Report Revision 1-C

2.2.5 Steam

System Piping Failure (USAR Section 15.1.5) 2.2.5.1 Steam System Piping Failure at Hot Zero Power Conditions 2.2.5.1.1 Technical Evaluation 2.2.5.1.1.1 Introduction The steam release following a main steam pipe rupture would result in an initial increase in steam flow that decreases during the accident as the steam pressure decreases. The increased energy removal from the RCS causes a decrease in the reactor coolant temperature and pressure. In the presence of a negative MTC, the cooldown results in a positive reactivity insertion and subsequent reduction in core shutdown margin. If the most-reactive RCCA is assumed stuck in its fully withdrawn position after reactor trip, there is an increased possibility that the core will become critical and return to power. A return to power following a steam pipe rupture is a concern primarily because of the high power peaking factors that would exist with the most-reactive RCCA assumed to be stuck in its fully withdrawn position. The major rupture of a main steam pipe is the most limiting cooldown transient. It is analyzed at HZP conditions with no decay heat (decay heat would retard the cooldown, thus reducing the potential return to power). A detailed discussion of this transient with the most limiting break size (i.e., a double-ended rupture) is presented below. The primary design features that provide protection for steam pipe ruptures are:

Actuation of the SI system on any of the following:

- Two-out-of-four low pressurizer pressure signals

- Two-out-of-three low steam line pressure signals in any one loop

- Two-out-of-three high-1 containment pressure signals Actuation of a reactor trip from the overpower signals (neutron flux and T) or upon the receipt of an SI signal. Redundant isolation of the main FW lines to prevent sustained main FW flow, which would cause additional cooldown. In addition to the primary means of protection, where an SI signal closes the main FW isolation valves, an SI signal will also rapidly close all main FW control valves and control bypass valves, trip the main FW pumps, and close the FW pump discharge valves.

2-82 WCAP-17658-NP September 2016 Licensing Report Revision 1-C Closure of the fast-acting MSIVs on the following:

- Two-out-of-three high-2 containment pressure signals

- Two-out-of-three low steam line pressure signals in any one loop (above Permissive P-11)

- Two-out-of-three high negative steam pressure rate signals in any one loop (below Permissive P-11) For any break, in any location, no more than one SG would experience an uncontrolled blowdown, even if one of the MSIVs were to fail to close. For breaks downstream of the MSIVs, closure of all MSIVs would completely terminate the blowdown from all of the SGs. Thus, even with the worst possible break location (i.e., upstream of an MSIV), only one SG can blow down, minimizing the potential steam release and resultant RCS cooldown and depressurization. The remaining SGs would still be available for dissipation of decay heat after the initial transient is over. Following blowdown of the faulted SG, the plant can be brought to a stabilized, hot standby condition through control of AFW flow and SI flow, as prescribed by plant operating procedures. The operating procedures call for operator action to limit RCS pressure and pressurizer level by terminating SI flow, and to control SG level and reactor coolant temperature using the AFW system. 2.2.5.1.1.2 Input Parameters, Assumptions, and Acceptance Criteria The following summarizes the major input parameters and/or assumptions used in the analysis of a major rupture of a main steam pipe event at HZP conditions:

HZP conditions were modeled with four loops in service, both with and without offsite power available. A 1.388 ft 2 break size was analyzed. This break size corresponds to the maximum effective throat area of the integral flow restrictor that is built into the steam outlet nozzle of each SG. Minimum SGTP (0 percent) was modeled to conservatively maximize primary-to-secondary heat transfer. All control rods were modeled to be inserted except the most reactive RCCA, which was assumed to be stuck out of the core. A minimum, end-of-life shutdown margin corresponding to 1.30 percent k/k was modeled at event initiation. The SI system was modeled with a conservatively low flow capability, corresponding to only one high-head SI (centrifugal charging) pump injecting through the CLs.

2-83 WCAP-17658-NP September 2016 Licensing Report Revision 1-C The flow from the SI system that is delivered to the RCS was modeled with a temperature and boron concentration consistent with the minimum values for the refueling water storage tank (RWST), as required by the TS. The low steam line pressure signal was credited for SI system actuation and closure of the MSIVs. In addition, the SI signal that results from the low steam line pressure signal was credited for isolation of the main FW lines. The accumulators were modeled to be available; however, the flow that is injected from the accumulators was conservatively modeled to have a boron concentration of 0.0 ppm. The AFW system was modeled with a conservatively high flow capability, corresponding to all AFW pumps operating at maximum capacity and the maximum flow possible being delivered to the faulted SG. A major break in a steam system pipe is classified as a Condition IV event, a limiting fault, as defined by the ANS's "Nuclear Safety Criteria for the Design of Stationary Pressurized Water Reactor Plants," ANSI N18.2-1973. Minor secondary system pipe breaks are classified as ANS Condition III events, infrequent incidents. However, the major rupture of a main steam pipe event was conservatively analyzed to meet the more restrictive acceptance criteria associated with a Condition II event. The pressure limits for the primary and secondary systems are not challenged for this accident because the pressures in these systems each decrease from their initial values during the transient. The only criterion that has the potential to be challenged during this event is that associated with fuel damage. The analysis demonstrates that this criterion is met by showing that the DNB design basis is met. That is, this analysis shows that the minimum DNBR does not go below the limit value at any time during the transient. In addition, it has been historical practice to assume that fuel failure will occur if centerline melting takes place. Therefore, the analysis also demonstrates that the peak linear heat generation rate (expressed

in kW/ft) does not exceed the value that would cause fuel centerline melt. The acceptance criteria identified above are based on meeting the relevant regulatory requirements of 10 CFR 50, Appendix A, "General Design Criteria for Nuclear Power Plants." Brief discussions of the specific GDCs that are related to the major rupture of a main steam pipe event acceptance criteria are provided as follows.

GDC 27 (Combined Reactivity Control Systems Capability) requires that the reactivity control systems be designed to have a combined capability, in conjunction with poison addition by the ECCS, of reliably controlling reactivity changes so that, under postulated accident conditions and with appropriate margin for stuck rods, the capability to cool the core is maintained. For the steam system piping failure at HZP conditions event, this is shown to be met by demonstrating that the fuel damage criterion is satisfied, which ultimately ensures that the ability to insert control rods is maintained.

2-84 WCAP-17658-NP September 2016 Licensing Report Revision 1-C GDC 28 (Reactivity Limits) requires that the reactivity control system be designed with appropriate limits on the potential amount and rate of reactivity increase so that the effects of postulated reactivity accidents can neither result in damage to the RCPB greater than limited local yielding, nor sufficiently disturb the core, its support structures, or other reactor pressure vessel (RPV) internals to impair significantly the capability to cool the core. For the steam system piping failure at HZP conditions event, this is shown to be met by demonstrating that the peak RCS pressure is less than 110 percent of the design pressure, which ultimately ensures that the RCPB pressure limits are not exceeded. GDC 35 (Emergency Core Cooling) requires that the RCS and associated auxiliaries be designed with a safety system able to provide abundant emergency core cooling. For the steam system piping failure at HZP conditions event, this is shown to be met by demonstrating that the fuel damage criterion is met, which ultimately shows that the ECCS provides abundant core cooling, even with the most-limiting single failure considered. 2.2.5.1.1.3 Description of Analyses and Evaluations A detailed analysis was performed using the RETRAN computer code (Reference 1) to determine the plant transient conditions following a major rupture of a main steam pipe with and without offsite power available. The RETRAN model simulates the core neutron kinetics, RCS, pressurizer, SGs, SI system, and AFW system. To properly model the system response to this event and prevent any non-physical behavior from being predicted when the pressurizer refills, the pressurizer and surge line were modeled as a single volume, as compared to the nodalization documented in Reference 1. The code computes pertinent plant variables, including the core heat flux and reactor coolant temperature and pressure. A detailed core analysis was then performed for the case that assumes offsite power is available using the ANC code (Reference 2) to confirm the validity of the RETRAN-predicted reactivity feedback model. The core models developed in ANC were also used to calculate the power peaking factors that were used as input to the detailed T/H digital computer code, VIPRE (Reference 3), which was used with a DNB correlation applicable to the low pressure condition (Reference 4) to determine if the DNB design basis was met. In addition, core models developed in ANC were used to calculate the peak linear heat generation rate. The detailed core and DNB analyses for the case that assumes a loss of offsite power (LOOP) are not performed as the transient resulting at low RCS flow conditions has been judged to be less limiting than that resulting when full RCS flow is maintained. This is based on the fact that, as RCS forced flow decreases, heat transfer across the SG tubes also decreases. This decrease in heat transfer significantly reduces the rate and magnitude of the RCS cooldown and, consequently, th e final return to power level is also lower. The drop in RCS pressure is not as significant for this case as well. Furthermore, the loss of forced reactor coolant flow allows for more uniform flow and temperature distributions at the lower reactor plenum such that, as the coolant travels up into the core inlet and through the active core region, the radial temperature asymmetry is not as significant as in the case where forced flow is maintained. This reduced asymmetric temperature distribution results in less significant power peaking factors.

2-85 WCAP-17658-NP September 2016 Licensing Report Revision 1-C The reduced power peaking in the reactor core, comb ined with a lower return to power and higher RCS pressure, more than offsets the penalty associated with reduced flow at the location of minimum DNBR. As such, the minimum DNBR for such a case would be higher than that calculated for the case where offsite power remains available. This conclusion has also been previously validated with the linked neutronics and T/H code systems. Therefore, consistent with the previous discussion, only the minimum DNBR of the most limiting case (with offsite power available) is presented herein. 2.2.5.1.1.4 Results The calculated sequence of events for the complete severance of a main steam pipe at HZP initial conditions, both with and without offsite power available, is shown in Table 2.2.5.1-1. The results for the most limiting case, the case with offsite power available, are presented in Table 2.2.5.1-2.

Figures 2.2.5.1-1 through 2.2.5.1-7 show the transient results for the case with offsite power available. Because offsite power was assumed to be available in this case, there is full reactor coolant flow.

Figures 2.2.5.1-8 through 2.2.5.1-14 show the transient results for the case without offsite power available. Because offsite power was assumed to be lost in this case, the RCPs coast down and there is a decrease in reactor coolant flow. As can be seen from Figures 2.2.5.1-1 and 2.2.5.1-8, the return to power is considerably less significant for the case without offsite power, even when using the conservative RETRAN reactivity model calibrated for conditions where forced RCS flow was maintained. Similarly, Figures 2.2.5.1-3 and 2.2.5.1-10 show that RCS pressure is higher for the case with reduced RCS flow. If the core were to be critical at or near HZP conditio ns when the rupture occurs, the initiation of SI via a low steam line pressure signal would trip the reactor. Steam release from more than one SG is prevented by the automatic closure of the MSIVs in the steam lines on a low steam line pressure signal. In addition, sustained main FW flow is prevented by the isolation of the main FW lines on the SI signal that results from the low steam line pressure signal.

As shown in Figures 2.2.5.1-4 and 2.2.5.1-11 for the cases with and without offsite power available, respectively, the core attains criticality with the RCCAs inserted (i.e., with the plant shut down assuming one stuck RCCA) before the transient is effectively terminated by boron injected from the SI system. The results of the analysis of a major rupture of a main steam pipe event demonstrate that the DNB design basis is met. The calculated minimum DNBR is well above the limit value for the limiting case that assumes offsite power is available. In addition, the peak linear heat generation rate (expressed in kW/ft) does not exceed the value that would cause fuel centerline melt. The pressure limits for the primary and secondary systems are not challenged for this acci dent because the pressures in these systems each decrease from their initial values during the transient. Therefore, this event does not adversely affect the core or the RCS, and all applicable acceptance criteria are met.

2-86 WCAP-17658-NP September 2016 Licensing Report Revision 1-C 2.2.5.1.2 Conclusion The analysis of the steam system piping failure at HZP conditions described above has been reviewed. It is concluded that the analysis has adequately accounted for operation of the plant at the analyzed power level and was performed using acceptable analytical models. It is further concluded that the analysis has demonstrated that the reactor protection and safety systems will continue to ensure that the ability to insert control rods is maintained, the RCPB pressure limits will not be exceeded, and abundant core cooling will be provided. Based on this, the conclusion is that the plant will continue to meet the requirements of GDCs 27, 28 and 35. 2.2.5.1.3 References

1. Westinghouse Report WCAP-14882-P-A, "RETRAN-02 Modeling and Qualification for Westinghouse Pressurized Water Reactor Non-LOCA Safety Analyses," April 1999.
2. Westinghouse Report WCAP-10965-P-A, "ANC: A Westinghouse Advanced Nodal Computer Code," September 1986.
3. Westinghouse Report WCAP-14565-P-A, "VIPRE-01 Modeling and Qualification for Pressurized Water Reactor Non-LOCA Thermal-Hydraulic Safety Analysis," October 1999.
4. Westinghouse Report WCAP-14565-P-A Addendum 2-P-A, "Addendum 2 to WCAP-14565-P-A Extended Application of ABB-NV Correlation and Modified ABB-NV Correlation WLOP for PWR Low Pressure Applications," April 2008.

2-87 WCAP-17658-NP September 2016 Licensing Report Revision 1-C Table 2.2.5.1-1 Time Sequence of Events - Steam System Piping Failure at HZP Conditions Case Event Time (sec) Double-Ended Rupture (1.388 ft 2) with Offsite Power Available SLB Occurs 0.0 Low Steam Line Pressure Setpoint Reached in the Faulted

Loop (lead-lagged) 0.6 SI Signal Generated (on low steam line pressure) 2.6 Pressurizer Empties 15.8 Steam Line and FW Isolation Complete 17.6 Core Re-criticality Occurs 19.3 SI Flow Initiated 27.6 Peak Core Heat Flux Reached 320.0 Borated Water from SI System Reaches the Core 320.8 Core Becomes Subcritical 327.5 Accumulators Begin to Inject (Unborated Water) 343.5 Double-Ended Rupture (1.388 ft 2) without Offsite Power Available SLB Occurs 0.0 Low Steam Line Pressure Setpoint Reached in the Faulted

Loop (lead-lagged) 0.6 SI Signal Generated (on low steam line pressure) 2.6 RCPs Begin to Coast Down 3.0 Steam Line and FW Isolation Complete 17.6 Pressurizer Empties 18.0 Core Re-criticality Occurs 26.0 SI Flow Initiated 39.6 Borated Water from SI System Reaches the Core 366.5 Peak Core Heat Flux Reached 374.5 Core Becomes Subcritical 384.3 2-88 WCAP-17658-NP September 2016 Licensing Report Revision 1-C Table 2.2.5.1-2 Limiting Results - Steam System Piping Failure at HZP Conditions Case Parameter Analysis Value Limit Double-Ended Rupture (1.388 ft 2) with Offsite Power Available Minimum DNBR 1.80 1.18 Peak Linear Heat Generation (kW/ft) 15.829 22.4 2-89 WCAP-17658-NP September 2016 Licensing Report Revision 1-C Figure 2.2.5.1-1. Steam System Piping Failure at HZP (1.388 ft 2 Break with Offsite Power Available) Nuclear Power and Core Heat Flux versus Time 2-90 WCAP-17658-NP September 2016 Licensing Report Revision 1-C Figure 2.2.5.1-2. Steam System Piping Failure at HZP (1.388 ft 2 Break with Offsite Power Available) Reactor Vessel Inlet Temperature and Core Average Temperature versus Time 2-91 WCAP-17658-NP September 2016 Licensing Report Revision 1-C Figure 2.2.5.1-3. Steam System Piping Failure at HZP (1.388 ft 2 Break with Offsite Power Available) Pressurizer Pressure and Pressurizer Water Volume versus Time 2-92 WCAP-17658-NP September 2016 Licensing Report Revision 1-C Figure 2.2.5.1-4. Steam System Piping Failure at HZP (1.388 ft 2 Break with Offsite Power Available) Core Boron Concentration and Reactivity versus Time 2-93 WCAP-17658-NP September 2016 Licensing Report Revision 1-C Figure 2.2.5.1-5. Steam System Piping Failure at HZP (1.388 ft 2 Break with Offsite Power Available) Steam Pressure and Steam (Break) Flow versus Time 2-94 WCAP-17658-NP September 2016 Licensing Report Revision 1-C Figure 2.2.5.1-6. Steam System Piping Failure at HZP (1.388 ft 2 Break with Offsite Power Available) FW Flow and SG Mass versus Time 2-95 WCAP-17658-NP September 2016 Licensing Report Revision 1-C Figure 2.2.5.1-7. Steam System Piping Failure at HZP (1.388 ft 2 Break with Offsite Power Available) Core Flow versus Time 2-96 WCAP-17658-NP September 2016 Licensing Report Revision 1-C Figure 2.2.5.1-8. Steam System Piping Failure at HZP (1.388 ft 2 Break without Offsite Power Available) Nuclear Power and Core Heat Flux versus Time 2-97 WCAP-17658-NP September 2016 Licensing Report Revision 1-C Figure 2.2.5.1-9. Steam System Piping Failure at HZP (1.388 ft 2 Break without Offsite Power Available) Reactor Vessel Inlet Temperature and Core Average Temperature versus Time 2-98 WCAP-17658-NP September 2016 Licensing Report Revision 1-C Figure 2.2.5.1-10. Steam System Piping Failure at HZP (1.388 ft 2 Break without Offsite Power Available) Pressurizer Pressure and Pressurizer Water Volume versus Time 2-99 WCAP-17658-NP September 2016 Licensing Report Revision 1-C Figure 2.2.5.1-11. Steam System Piping Failure at HZP (1.388 ft 2 Break without Offsite Power Available) Core Boron Concentration and Reactivity versus Time 2-100 WCAP-17658-NP September 2016 Licensing Report Revision 1-C Figure 2.2.5.1-12. Steam System Piping Failure at HZP (1.388 ft 2 Break without Offsite Power Available) Steam Pressure and Steam (Break) Flow versus Time 2-101 WCAP-17658-NP September 2016 Licensing Report Revision 1-C Figure 2.2.5.1-13. Steam System Piping Failure at HZP (1.388 ft 2 Break without Offsite Power Available) FW Flow and SG Mass versus Time 2-102 WCAP-17658-NP September 2016 Licensing Report Revision 1-C Figure 2.2.5.1-14. Steam System Piping Failure at HZP (1.388 ft 2 Break without Offsite Power Available) Core Flow versus Time 2-103 WCAP-17658-NP September 2016 Licensing Report Revision 1-C 2.2.5.2 Steam System Piping Failure at Hot Full Power Conditions 2.2.5.2.1 Technical Evaluation 2.2.5.2.1.1 Introduction A rupture in the MSS piping from an at-power condition creates an increased steam load, which extracts an increased amount of heat from the RCS via the SGs. This results in decreased RCS temperature and pressure. In the presence of a strong negative MTC, t ypical of EOC conditions, the colder core inlet coolant temperature causes the core power to increase from its initial level due to the positive reactivity insertion. The power approaches a level equal to the total steam flow. Depending on the break size, a reactor trip may occur due to overpower conditions or as a result of a SLB protection function actuation. The steam system piping failure accident analysis described in Section 2.2.5.1 is performed assuming a HZP initial condition with the control rods inserted in the core, except for the most reactive rod in the fully withdrawn position. Such a condition could occur the following ways: When the reactor is at hot shutdown at the minimum required shutdown margin After the plant has been tripped automatically by the reactor protection system Manually by the operator. For an at-power SLB, the analysis of Section 2.2.5.1 represents the limiting condition with respect to core protection for the time period following reactor trip. The purpose of this section is to describe the analysis of a steam system piping failure occurring from at-power initial conditions, which demonstrates that core protection is maintained prior to and immediately following reactor trip. 2.2.5.2.1.2 Input Parameters, Assumptions, and Acceptance Criteria The following assumptions are made in the analysis of a main steam line rupture accident at full power: The initial reactor power, pressurizer pressure, and RCS T avg are assumed to be at the nominal full power values. The full power condition is more limiting than part power. The reactor coolant flow rate is the MMF value. The initial loop flows were assumed to be symmetric. Uncertainties for the initial conditions of pressurizer pressure, RCS T avg, and reactor coolant flow are statistically accounted for in the DNBR limit calculated using the RTDP methodology (Reference 4). Initial NSSS power was conservatively modeled to be at 3651 MWt, which includes all applicable uncertainties. The full power RCS T avg range is from 570.7°F to 588.4°F. Because the full power steam line rupture event is primarily a DNB event, assuming a maximum RCS average temperature is limiting. Therefore, an initial RCS average temperature of 588.4°F was assumed. The main FW analytical temperature range is from 400°F to 448.6°F. A higher Tfeed is more limiting for this event. Thus, a Tfeed of 448.6°F was assumed.

2-104 WCAP-17658-NP September 2016 Licensing Report Revision 1-C A spectrum of break sizes was analyzed. Typically, small breaks do not result in a reactor trip; in this case core power stabilizes at an increased level corresponding to the increased steam flow. Intermediate size breaks may result in a reactor trip on OPT as a result of the increasing core power. Larger break sizes result in a reactor trip soon after the break from the SI signal actuated by low steam line pressure, which includes lead/lag dynamic compensation. The limiting break size is the largest break that does not trip on a low steam pressure SI signal. To maximize the primary-to-secondary heat transfer rate, 0 percent SGTP is assumed. Maximum moderator reactivity feedback and minimum Doppler power feedback are assumed to maximize the power increase following the break. The protection system features that mitigate the effe cts of a SLB are described in Section 2.2.5.1. This analysis only considers the initial phase of the transient from at-power conditions. Protection in this phase of the transient is provided by reactor trip, if necessary. Section 2.2.5.1 presents the analysis of the bounding transient following reactor trip, where other protection system features are actuated to mitigate the effects of the SLB. In general, the results would be less severe as a result of normal control system operation.

Therefore, the mitigation effects of control systems have been ignored in the analysis. However, the main FW control system is assumed to operate in that FW flow is assumed to equal the steam flow prior to reactor trip. Depending on the size of the break, a rupture in a main steam line is classified as either a Condition III (infrequent fault) or Condition IV (limiting fault) event, as defined by the ANS's "Nuclear Safety Criteria for the Design of Stationary Pressurized Water Reactor Plants," ANSI N18.2-1973. However, for ease of interpreting the results, the more restrictive criteria associated with Condition II events are applied. The applicable acceptance criteria that may be challenged are that fuel damage due to DNB or fuel centerline melting should be precluded. Fuel cladding integrity and the prevention of fuel failure is demonstrated by showing that the calculated minimum DNBR is greater than the applicable limit value. The centerline temperature of the fuel rods with the peak linear heat rate (kW/ft) must not exceed the UO 2 melting temperature. The pressure limits for the primary and secondary systems are not challenged for this accident. The acceptance criteria identified above are based on meeting the relevant regulatory requirements of 10 CFR 50, Appendix A, "General Design Criteria for Nuclear Power Plants." Brief discussions of the specific GDCs that are related to the major rupture of a main steam pipe event acceptance criteria are provided below. GDC 27 (Combined Reactivity Control Systems Capability) requires that the reactivity control systems be designed to have a combined capability, in conjunction with poison addition by the ECCS, of reliably controlling reactivity changes so that, under postulated accident conditions and with appropriate margin for stuck rods, the capability to cool the core is maintained. For the steam system piping failure at HFP conditions event, this is shown to be met by demonstrating that the fuel damage criterion is satisfied, which ultimately ensures that the ability to insert control rods is maintained.

2-105 WCAP-17658-NP September 2016 Licensing Report Revision 1-C GDC 28 (Reactivity Limits) requires that the reactivity control system be designed with appropriate limits on the potential amount and rate of reactivity increase so that the effects of postulated reactivity accidents can neither result in damage to the RCPB greater than limited local yielding, nor sufficiently disturb the core, its support structures, or other RPV internals to impair significantly the capability to cool the core. For the steam system piping failure at HFP conditions event, this is shown to be met by demonstrating that the peak RCS pressure is less than 110 percent of the design pressure, which ultimately ensures that the RCPB pressure limits are not exceeded. 2.2.5.2.1.3 Description of Analyses and Evaluations A detailed analysis was performed using the RETRAN computer code to determine the plant transient conditions following a main steam line rupture at full power. Details of the RETRAN model are documented in Reference 1. The code computes pertinent variables, including the core power and reactor coolant temperature and pressure. Statepoints from RETRAN, consisting of core heat flux, RCS loop inlet temperatures, pressure, and core flow, are used as input to the DNB analysis and the calculation of the peak linear heat rate (kW/ft). A detailed core analysis was performed using the ANC code (Reference 2) to confirm the validity of the RETRAN-predicted reactivity feedback model. The core models developed in ANC were also used to calculate the power peaking factors for input to the DNB analysis and the calculation of the peak kW/ft. The detailed T/H digital computer code VIPRE (Reference 3) was used to calculate the DNBR for the limiting time in the transient. The DNBR calculations were performed using the WRB-2 DNB correlation and RTDP methodology (Reference 4). 2.2.5.2.1.4 Results The calculated sequence of events for the most limiting break size (1.04 ft

2) for a main steam line rupture at full power event is shown in Table 2.2.5.2-1. This is the largest break that does not trip on a low steam line pressure SI signal. The results for this case are presented in Table 2.2.5.2-2. Figures 2.2.5.2-1 through 2.2.5.2-4 show the transient response for selected parameters. The results of the analysis of a major rupture of a main steam pipe event at full power demonstrate that the DNB design basis is met. The calculated minimum DNBR is above the limit value. In addition, the peak linear heat generation rate (expressed in kW/ft) does not exceed the valu e that would cause fuel centerline melt. The pressure limits for the primary and secondary systems are not challenged for this accident because the pressures in these systems each decrease from their initial values during the transient. The steam pressure does not increase significantly following turbine trip. Therefore, this event does not adversely affect the core or the RCS, and all applicable acceptance criteria are met.

2-106 WCAP-17658-NP September 2016 Licensing Report Revision 1-C 2.2.5.2.2 Conclusion The analysis of the steam system piping failure at full power conditions described above has been reviewed. It is concluded that the analysis has adequately accounted for operation of the plant at the analyzed power level and was performed using acceptable analytical models. It is further concluded that the analysis has demonstrated that the reactor protection and safety systems will continue to ensure that the ability to insert control rods is maintained, the RCPB pressure limits will not be exceeded, and abundant core cooling will be provided. Based on this, the conclusion is that the plant will continue to meet the requirements of GDCs 27 and 28. Although a discussion of the steam system piping failure at full power analysis is not included in the current USAR, Section 15.1.6 will be revised to reflect the analysis described herein. 2.2.5.2.3 References

1. Westinghouse Report WCAP-14882-P-A, "RETRAN-02 Modeling and Qualification for Westinghouse Pressurized Water Reactor Non-LOCA Safety Analyses," April 1999.
2. Westinghouse Report WCAP-10965-P-A, "ANC: A Westinghouse Advanced Nodal Computer Code," September 1986.
3. Westinghouse Report WCAP-14565-P-A, "VIPRE-01 Modeling and Qualification for Pressurized Water Reactor Non-LOCA Thermal-Hydraulic Safety Analysis," October 1999.
4. Westinghouse Report WCAP-11397-P-A, "Revised Thermal Design Procedure," April 1989.

2-107 WCAP-17658-NP September 2016 Licensing Report Revision 1-C Table 2.2.5.2-1 Time Sequence of Events - Steam System Piping Failure at HFP Conditions Case Event Time (sec) Limiting Break Size (1.04 ft

2) Steam Line Ruptures 0.0 OPT Reactor Trip Setpoint Reached (in two loops) 17.7 Rods Begin to Drop 20.7 Peak Core Heat Flux Occurs 21.5 Minimum DNBR Occurs 21.5 Table 2.2.5.2-2 Limiting Results - Steam System Piping Failure at HFP Conditions Case Parameter Analysis Value Limit Limiting Break Size (1.04 ft
2) Minimum DNBR 2.026 1.52 Peak Linear Heat Generation (kW/ft) 21.8 22.4 2-108 WCAP-17658-NP September 2016 Licensing Report Revision 1-C Figure 2.2.5.2-1. Steam System Piping Failure at HFP (1.04 ft 2 Break) Nuclear Power and Core Heat Flux versus Time 2-109 WCAP-17658-NP September 2016 Licensing Report Revision 1-C Figure 2.2.5.2-2. Steam System Piping Failure at HFP (1.04 ft 2 Break) Pressurizer Pressure and Pressurizer Water Volume versus Time 2-110 WCAP-17658-NP September 2016 Licensing Report Revision 1-C Figure 2.2.5.2-3. Steam System Piping Failure at HFP (1.04 ft 2 Break) Reactor Vessel Inlet Temperature and Loop Average Temperature versus Time 2-111 WCAP-17658-NP September 2016 Licensing Report Revision 1-C Figure 2.2.5.2-4. Steam System Piping Failure at HFP (1.04 ft 2 Break) Steam Pressure and Break Flow versus Time 2-112 WCAP-17658-NP September 2016 Licensing Report Revision 1-C

2.3 DECREASE

IN HEAT REMOVAL BY THE SECONDARY SYSTEM 2.3.1 Loss of External Electrical Load, Turbine Trip, Inadvertent Closure of Main Steam Isolation Valves, Loss of Condenser Vacuum and Other Events Resulting in Turbine Trip (USAR Sections 15.2.2, 15.2.3, 15.2.4, and 15.2.5) 2.3.1.1 Technical Evaluation 2.3.1.1.1 Introduction A major load loss on the plant can result from either a loss of external electrical load or from a turbine trip. A loss of external electrical load can result from an abnormal variation in network frequency or other adverse network operating conditions. In either case, offsite power is available for the continued operation of plant components such as the RCPs.

The plant is designed to accept a 50 percent loss of electrical load while operating at full power, or a complete loss of load (LOL) while operating below the P-9 setpoint without actuating a reactor trip with all NSSS control systems in automatic. A 50 percent loss of electrical load is handled by the following: Steam dump system, which accommodates 40 percent of the nominal full-power load, Rod control system, which accommodates the remaining 10 percent of the load rejection by driving rods in to reduce coolant average temperature, Pressurizer, which absorbs the change in coolant volume due to the heat addition resulting from

the load rejection. Should a 100 percent LOL occur from full power, the reactor protection system automatically actuates a reactor trip. Based on this, a complete LOL from 100 percent power represents the most severe challenge to the system and, as such, it is the case explicitly analyzed and described in this section. The most likely source of a complete LOL on the NSSS is a trip of the turbine generator. In this case, if the reactor is operating above the P-9 setpoint, there is a direct reactor trip signal from either the turbine low fluid oil pressure or the turbine stop valve closure. Reactor temperature and pressure do not increase significantly if the steam dump system and pressurizer pressure control system are functioning properly. However, the RCS and MSS pressure-relieving capacities are designed to ensure the safety of the plant without requiring the use of automatic rod control, pressurizer pressure control, or steam dump control systems. In this analysis, the behavior of the plant is evaluated for a 100 percent loss of steam load from full power without direct reactor trip in order to demonstrate the adequacy of the pressure-relieving devices and core protection margins. In the event the steam dump valves fail to open following a large LOL, the MSSVs can lift and the reactor can be tripped by the high pressurizer pressure signal, the OTT signal, or the OPT signal. The SG shell-side pressure and reactor coolant temperatures increase rapidly. The PSVs and MSSVs are sized to protect the RCS and SGs against overpressurization for all load losses without assuming the operation of 2-113 WCAP-17658-NP September 2016 Licensing Report Revision 1-C the steam dump system, pressurizer sprays, pressurizer PORVs, automatic rod control, or the direct reactor trip on turbine trip. 2.3.1.1.2 Input Parameters, Assumptions, and Acceptance Criteria Three cases were analyzed for a loss of load / turbine trip (LOL/TT) event from full-power conditions. Maximum SGTP with automatic pressurizer pressure control (minimum DNBR case) Minimum SGTP with automatic pressurizer pressure control (peak MSS pressure case) Maximum SGTP without automatic pressurizer pressure control (peak RCS pressure case) The minimum DNBR case was analyzed using the RTDP (Reference 1). The initial NSSS power was conservatively modeled to be at 3651 MWt, which includes all applicable uncertainties. RCS temperature and pressurizer pressure were assumed to be at their nominal values consistent with steady-state, full-power operation. MMF was modeled. Uncertainties in initial conditions were included in the safety analysis DNBR limit, as described in Reference 1. The peak RCS and MSS pressure cases were analyzed with uncertainties on RCS temperature and pressurizer pressure applied in the direction required to obtain the most conservative initial plant conditions for the transient. Both cases modeled TDF. The LOL/TT transient was conservatively analyzed with minimum reactivity feedback (beginning of core life). All cases assumed the least-negative DPC and a 0 pcm/°F MTC, which bounds part-power conditions with a positive MTC. Minimum reactivity feedback conditions are conservative because reactor power is maintained until the time of reactor trip, which exacerbates the calculated minimum DNBR and peak RCS and MSS pressures. Manual rod control was modeled for all cases. If the reactor had been in automatic rod control, the control rod banks would have been driven into the core prior to reactor trip, thereby reducing the severity of the transient.

The LOL/TT event was analyzed both with and without automatic pressurizer pressure control. The pressurizer PORVs and sprays were assumed to be operable for the minimum DNBR case to minimize the increase in RCS pressure, which is conservative for the calculation of the minimum DNBR. The pressurizer PORVs and sprays were also assumed to be operable for the peak MSS pressure case to minimize the increase in RCS pressure. This delays or completely prevents a reactor trip from occurring on a high pressurizer pressure signal, which results in a conservative calculation of the peak MSS pressure. The peak RCS pressure case was analyzed without automatic pressurizer pressure control to conservatively maximize the RCS pressure increase. In all cases, the MSSVs and PSVs were assumed to be operable. A total PSV setpoint tolerance of 2 percent was accounted for in the analysis. For the minimum DNBR case and the peak MSS pressure case, the negative tolerance was applied to conservatively reduce the setpoint. For the peak RCS pressure case, the positive tolerance was applied to conservatively increase the setpoint. In addition, the peak RCS pressure case includes a 0.9 percent setpoint shift and a 1.153-second purge time delay to account for the existence of PSV water-filled loop seals, as described in Reference 2.

2-114 WCAP-17658-NP September 2016 Licensing Report Revision 1-C Main FW flow to the SGs was assumed to be lost at the time of turbine trip. The AFW system would be available for long-term heat removal. However, operation of the AFW system is not credited in the timeframe considered for this analysis. The following reactor trip functions are assumed to be operable: High pressurizer pressure OTT OPT The MSSVs were modeled with opening setpoints that account for a maximum setpoint tolerance of 3 percent and all appropriate line losses. Valve accumulation was modeled via a 5-psi ramp of the valve flow area from closed to full-open. The limiting single failure is the failure of one train of the reactor protection system. The remaining (operable) train trips the reactor. As described in USAR Section 3.1.1, the MSSVs and PSVs (that is, code safety valves) are considered to be qualified components exempt from active failure and are assumed to open on demand. Control systems are assumed to function only if their operation results in more severe transient conditions. Thus, a failure of a control system is not applicable as a limiting single failure. FW isolation (redundant valves), AFW (multiple pumps) and SI (multiple pumps) are susceptible to a single failure. However, none of these systems provides any mitigation for a LOL/TT event. Thus, these systems are not applicable as a limiting single failure. Furthermore, the protection system is designed to be single-failure-proof. Maximum SGTP (10 percent) is assumed in the minimum DNBR case and peak RCS pressure case because it maximizes the RCS temperature increase following event initiation. However, the peak MSS pressure case is analyzed with zero SGTP because this conservatively maximizes the primary-to-secondary side heat transfer; this assumption is slightly more limiting with respect to the secondary-side pressure transient. Based on its frequency of occurrence, the LOL/TT accide nt is considered a Condition II event, an incident of moderate frequency, as defined by the ANS's "Nuclear Safety Criteria for the Design of Stationary Pressurized Water Reactor Plants," ANSI N18.2-1973. The specific criteria for this accident are as follows:

Pressures in the RCS and MSS are maintained below 110 percent of their respective design values (for the WCGS, this represents an RCS pressure limit of 2750 psia and MSS pressure limit of 1318.5 psia). Fuel cladding integrity is maintained by demonstrating that the minimum DNBR remains above the 95/95 DNBR limit for PWRs (for the WCGS, the applicable safety analysis DNBR limit is 1.52).

2-115 WCAP-17658-NP September 2016 Licensing Report Revision 1-C An incident of moderate frequency does not generate a more serious plant condition without other faults occurring independently. This criterion is conservatively satisfied by verifying that the pressurizer does not fill. An incident of moderate frequency, in combination with any single active component failure or single operator error, is considered an event for which an estimate of the number of potential fuel failures is provided for radiological dose calculations. For such accidents, fuel failure is assumed for all rods for which the DNBR decreases below those values cited above for cladding integrity unless it can be shown that, based on an acceptable fuel damage model, fewer failures occur. There shall be no loss of function of any fission product barrier other than the fuel cladding. This criterion is satisfied by verifying that the minimum DNBR remains above the 95/95 DNBR limit, which is discussed above. The acceptance criteria identified above are based on meeting the relevant regulatory requirements of 10 CFR 50, Appendix A, "General Design Criteria for Nuclear Power Plants." Brief discussions of the specific GDCs that are related to the LOL/TT acceptance criteria are provided as follows. GDC 10 (Reactor Design) requires that the reactor core and associated coolant, control, and protection systems be designed with appropriate margin so specified acceptable fuel design limits are not exceeded during any condition of normal operation, including anticipated operational occurrences. For the LOL/TT event, this is shown to be met by demonstrating that the fuel cladding integrity is maintained. GDC 15 (RCS Design) requires that the RCS and associated auxiliary, control, and protection systems be designed with sufficient margin so design conditions of the reactor coolant pressure boundary are not exceeded during any condition of normal operation, including anticipated operational occurrences. For the LOL/TT event, this is shown to be met by demonstrating that the peak RCS pressure is less than 110 percent of the design pressure. GDC 26 (Reactivity Control System Redundancy and Capability) requires that one of the reactivity control systems consist of control rods capable of reliably controlling reactivity changes with appropriate margin for malfunctions like stuck rods so that specified acceptable fuel design limits are not exceeded under conditions of normal operation, including anticipated operational occurrences. For the LOL/TT event, which results in a reactor trip, this is shown to be met by demonstrating that the fuel cladding integrity is maintained. 2.3.1.1.3 Description of Analyses and Evaluations A detailed analysis using the RETRAN computer code (Reference 3) was performed to determine the plant transient conditions following a total LOL due to turbine trip without credit for a direct reactor trip. The RETRAN model simulates the core neutron kinetics, RCS, pressurizer, pressurizer PORVs and sprays, PSVs, SGs, MSSVs, and the AFW system. The code computes pertinent plant variables, including RCS pressures and temperatures, and SG pressure. The Westinghouse RETRAN model has been approved by the USNRC for the analysis of the LOL/TT transient (Reference 3).

2-116 WCAP-17658-NP September 2016 Licensing Report Revision 1-C 2.3.1.1.4 Results The calculated sequence of events for each of the cases is listed in Table 2.3.1-1, and the limiting results for each of the cases are presented in Table 2.3.1-2. 2.3.1.1.4.1 Minimum DNBR Case The minimum DNBR case was analyzed at the high nominal T avg (i.e., 588.4°F), nominal pressurizer pressure (i.e., 2250 psia), MMF, 10 percent SGTP, and the high main Tfeed (448.6°F) with automatic pressurizer pressure control operable. Plots of the transient response to a LOL/TT event for the minimum DNBR case are shown in Figures 2.3.1-1 through 2.3.1-3. The reactor was tripped on the OTT reactor trip function. The nuclear power remained essentially constant at full power prior to the reactor trip. The pressurizer sprays, PORVs, and safety valves actuated to minimize the RCS pressu re transient, which is conservative for the calculation of the minimum DNBR. Although the DNBR decreased below its initial value, it remained well above the SAL throughout the entire transient. The peak pressurizer water volume remained below the total volume of the pressurizer, demonstrating that this event does not generate a more serious plant condition. The MSSVs actuated to maintain the MSS pressure below 110 percent of the design value. 2.3.1.1.4.2 Peak MSS Pressure Case The peak MSS pressure case was analyzed at the high nominal T avg plus uncertainties (i.e., 588.4°F + 6.5°F), nominal pressurizer pressure minus uncertainties (i.e., 2250 psia - 50 psi), TDF, 0 percent SGTP and the high main T feed (448.6°F) with automatic pressurizer pressure control operable. Plots of the transient response to a LOL/TT event for the peak MSS pressure case are shown in Figures 2.3.1-4 through 2.3.1-6. The reactor was tripped on the OTT reactor trip function. The nuclear power remained essentially constant at full power prior to the reactor trip. The pressurizer sprays, PORVs, and safety valves actuated to minimize the RCS pressure transient, which is conservative because it prevented a reactor trip from occurring on high pressurizer pressure and exacerbated the peak MSS pressure. The MSSVs actuated to maintain the MSS pressure below 110 percent of the design value. The peak pressurizer water volume remained below the total volume of the pressurizer, demonstrating that this event does not generate a more serious plant condition.

2-117 WCAP-17658-NP September 2016 Licensing Report Revision 1-C 2.3.1.1.4.3 Peak RCS Pressure Case The most limiting peak RCS pressure case was that analyzed at the high nominal T avg minus uncertainties (i.e., 588.4°F - 6.5°F), nominal pressurizer pressure minus uncertainties (i.e., 2250 psi - 35 psi), TDF, 10 percent SGTP and the high main Tfeed (448.6°F) with automatic pressurizer pressure control inoperable.

Plots of the transient response to a LOL/TT event for the limiting peak RCS pressure case are shown in Figures 2.3.1-7 through 2.3.1-9. The reactor was tripped on the high pressurizer pressure reactor trip function. The nuclear power remained essentially constant at full power prior to the reactor trip. The PSVs actuated to maintain the RCS pressure below 110 percent of the design value. The MSSVs also actuated to maintain the MSS pressure below 110 percent of the design value. The peak pressurizer water volume remained below the total volume of the pressurizer, demonstrating that this event does not generate a more serious plant condition. 2.3.1.2 Conclusion From a review of the updated analyses for the LOL/TT event, it is concluded that these analyses have adequately accounted for operation of the plant at the analyzed power level and that they were performed using acceptable analytical models. The calculated results demonstrate that the reactor protection and safety systems will continue to ensure that the safety analysis DNBR limit is met and the RCS and MSS pressure boundary limits will not be exceeded as a result of the LOL/TT event. Furthermore, this event will not generate a more serious plant condition. Based on this, the WCGS will continue to meet the requirements of GDCs 10, 15, and 26. 2.3.1.3 References

1. Westinghouse Report WCAP-11397-P-A, "Revised Thermal Design Procedure," April 1989.
2. Westinghouse Report WCAP-12910, Rev. 1-A, "Pressurizer Safety Valve Set Pressure Shift," May 1993.
3. Westinghouse Report WCAP-14882-P-A, "RETRAN-02 Modeling and Qualification for Westinghouse Pressurized Water Reactor Non-LOCA Safety Analyses," April 1999.

2-118 WCAP-17658-NP September 2016 Licensing Report Revision 1-C Table 2.3.1-1 Time Sequence of Events - Loss of External Electrical Load and/or Turbine Trip Case Event Time (seconds) Minimum DNBR Case Loss of Electrical Load/Turbine Trip Occurs 0.0 Pressurizer PORVs Open 2.8 PSVs Open 9.7 MSSVs Open 9.7 OTT Reactor Trip Setpoint Reached 17.0 Minimum DNBR Occurs 19.8 Rods Begin to Drop 20.0 Peak MSS Pressure Case Loss of Electrical Load/Turbine Trip Occurs 0.0 Pressurizer PORVs Open

1.7 MSSVs

Open 4.7 PSVs Open 9.6 OTT Reactor Trip Setpoint Reached 15.8 Rods Begin to Drop 18.8 Peak Secondary Side Pressure Occurs 22.0 Peak RCS Pressure Case Loss of Electrical Load/Turbine Trip Occurs 0.0 High Pressurizer Pressure Reactor Trip Setpoint Reached 6.6 Rods Begin to Drop 7.6 PSVs Open 8.2 Peak RCS Pressure Occurs

9.7 MSSVs

Open 12.1 Table 2.3.1-2 Limiting Results - Loss of External Electrical Load and/or Turbine Trip Case Parameter Analysis Value Limit Minimum DNBR Case Minimum DNBR 1.72 1.52 Peak MSS Pressure Case Peak MSS Pressure (psia) 1297.9 1318.5 Peak RCS Pressure Case Peak RCS Pressure (psia) 2746.8 2750.0 2-119 WCAP-17658-NP September 2016 Licensing Report Revision 1-C Figure 2.3.1-1. LOL/TT, Minimum DNBR Case Nuclear Power and SG Pressure versus Time 2-120 WCAP-17658-NP September 2016 Licensing Report Revision 1-C Figure 2.3.1-2. LOL/TT, Minimum DNBR Case Pressurizer Pressure and Pressurizer Water Volume versus Time 2-121 WCAP-17658-NP September 2016 Licensing Report Revision 1-C Figure 2.3.1-3. LOL/TT, Minimum DNBR Case RCS Temperatures and DNBR versus Time 2-122 WCAP-17658-NP September 2016 Licensing Report Revision 1-C Figure 2.3.1-4. LOL/TT, Peak MSS Pressure Case Nuclear Power and SG Pressure versus Time 2-123 WCAP-17658-NP September 2016 Licensing Report Revision 1-C Figure 2.3.1-5. LOL/TT, Peak MSS Pressure Case Pressurizer Pressure and Pressurizer Water Volume versus Time 2-124 WCAP-17658-NP September 2016 Licensing Report Revision 1-C Figure 2.3.1-6. LOL/TT, Peak MSS Pressure Case RCS Temperatures versus Time 2-125 WCAP-17658-NP September 2016 Licensing Report Revision 1-C Figure 2.3.1-7. LOL/TT, Peak RCS Pressure Case Nuclear Power and SG Pressure versus Time 2-126 WCAP-17658-NP September 2016 Licensing Report Revision 1-C Figure 2.3.1-8. LOL/TT, Peak RCS Pressure Case RCS Pressures and Pressurizer Water Volume versus Time 2-127 WCAP-17658-NP September 2016 Licensing Report Revision 1-C Figure 2.3.1-9. LOL/TT, Peak RCS Pressure Case RCS Temperatures versus Time 2-128 WCAP-17658-NP September 2016 Licensing Report Revision 1-C 2.3.2 Loss of Non-Emergency AC Power to the Station Auxiliaries (USAR Section 15.2.6) 2.3.2.1 Technical Evaluation 2.3.2.1.1 Introduction A complete loss of non-emergency alternating current (AC) power (LOAC) may result in a loss of power to the plant auxiliaries, which include the RCPs, main FW pumps, condensate pumps, etc. The loss of power may be caused by a complete loss of the offsite grid accompanied by a turb ine generator trip at the station, or by a loss of the onsite AC distribution system. The LOAC event is analyzed as a LONF with a loss of power to the RCPs as a result of the reactor trip because this is a more severe event relative to long-term consequences than the LOAC event. In the LOAC event, the RCPs lose power at the beginning of the event and the reactor trips soon thereafter on low reactor coolant loop flow. The short-term consequences are bounded by those of the complete loss of reactor coolant flow event described in Section 2.4.1, "Partial and Complete Loss of Forced Reactor Coolant Flow." The immediate consequence following a loss of FW is a reduction in the SG water level, which, if left unmitigated, will ultimately result in a reactor trip and AFW system actuation on the low-low SG water level signal. Following reactor trip, the rate of heat generation in the RCS (core residual (decay) heat) may exceed the heat removal capability of the secondary system. If this occurs, the RCS heats up, and the resulting thermal expansion of the reactor coolant causes an insurge to the pressurizer and an increase in the pressurizer water level. This trend generally continues until the RCS heat generation rate decreases below the secondary-side heat removal capability, at which time a cooldown of the RCS commences. The LONF event without a LOOP is addressed in Section 2.3.3, "Loss of Normal Feedwater Flow."

The expected events following an LOAC with turbine and reactor trips are described in the sequence listed as follows.

Plant vital instruments are supplied by emergency direct current (DC) power sources. The SG ARVs are automatically opened to the atmosphere as the MSS pressure increases following the trip. The condenser is assumed to be unavailable for steam dump. If the steam flow rate through the ARVs is not sufficient or if the ARVs are not available, the MSSVs may lift to dissipate the sensible heat of the fuel and coolant plus the residual decay heat produced in the reactor. The SG ARVs (or safety valves, if the ARVs are not available) are used to dissipate the residual decay heat and to maintain the plant at the Mode 3 (hot standby) condition as the no-load temperature is approached. The diesel generators start on a loss of voltage to the plant engineered safety features busses and begin to supply plant vital loads. The AFW system is automatically actuated.

2-129 WCAP-17658-NP September 2016 Licensing Report Revision 1-C The plant safety features that are available to mitigate the consequences of an LOAC event are as follows. A reactor trip can be initiated by one of the following.

- Two-out-of-four low-low water level signals in any one SG

- Two-out-of-four high pressurizer pressure signals

- Two-out-of-three high pressurizer level signals

- Two-out-of-four OTT signals The MSSVs open and provide secondary-side pressure protection and a heat sink source that helps limit the RCS heatup. The PSVs may open to provide primary-side pressure protection. Backup FW for the SGs is provided by the AFW system, which is composed of two motor-driven AFW (MDAFW) pumps and one turbine-driven AFW (TDAFW) pump.

- The two MDAFW pumps are started on any of the following: Two-out-of-four low-low water level signals in any one SG Trip of both main FW pumps SI signal LOOP Manual pump start Manual AFW system actuation

- The TDAFW pump is started on any of the following:

Two-out-of-four low-low water level signals in each of two SGs LOOP Manual pump start Manual AFW system actuation The MDAFW pumps are supplied power by the diesel generators, and the TDAFW pump utilizes steam from the secondary system. The pump turbine exhausts the secondary steam to the atmosphere. Normally, the AFW pumps take suction from the condensate storage tank (CST), but if the CST is unavailable, the essential service water system is used as the water source for the AFW pumps. After power to the RCPs is lost, coolant flow necessary for core cooling and the removal of core decay heat is maintained by natural circulation in the RCS loops. Following the RCP coastdown, the natural circulation capability of the RCS will remove decay heat from the core, aided by the AFW flow in the secondary system. Demonstrating acceptable analysis results for this event proves that the resultant natural circulation flow in the RCS and the AFW flow are sufficient for removing the decay heat from the core.

2-130 WCAP-17658-NP September 2016 Licensing Report Revision 1-C 2.3.2.1.2 Input Parameters, Assumptions, and Acceptance Criteria Input Parameters and Assumptions The major inputs and assumptions applied in the analysis of the LOAC event are identical to those applied in the analysis of the LONF event described in Section 2.3.3, "Loss of Normal Feedwater Flow,"

with the following exceptions: The initial RCP heat is the nominal value of 14 MWt. Nominal RCP heat is conservative for the LOAC event because the initial core power is sligh tly higher compared to that associated with maximum RCP heat, and this translates into slightly higher core decay heat, which is the primary heat source of concern for this event; after coastdown, the RCPs cease to add heat to the primary coolant, and so it is conservative to maximize the core decay heat. The loss of power to the RCPs is assumed to be the result of an electrical disturbance on the offsite power grid caused by the reactor trip. The RCPs were assumed to lose power and begin coasting down 2 seconds after the start of rod motion. This time delay is considered to be reasonable, but it is not a critical parameter in the analysis because it is short relative to the overall transient time. Acceptance Criteria Based on the expected frequency of occurrence, the LOAC event is considered to be a Condition II event as defined by the ANS's "Nuclear Safety Criteria for the Design of Stationary Pressurized Water Reactor Plants," ANSI N18.2-1973. The following items summarize the acceptance criteria associated with the analysis of this event: Pressures in the RCS and MSS must remain less than 110 percent of the respective design pressures.

With respect to peak RCS and MSS pressures, the LOAC event is bounded by the LOL/TT event described in Section 2.3.1, "Loss of External Electrical Load, Turbine Trip, Inadvertent Closure of a Main Steam Isolation Valve, and Loss of Condenser Vacuum," in which assumptions are made to conservatively calculate the RCS and MSS pressure transients. For the LOAC event, turbine trip occurs after reactor trip, whereas for LOL/TT, the turbine trip is the initiating incident. Therefore, the power mismatch between the primary and secondary sides and the resultant temperature and pressure transients of the RCS and MSS are always more severe for LOL/TT than for LOAC. Based on this, no explicit calculation of maximum RCS or MSS pressure is performed for this event.

2-131 WCAP-17658-NP September 2016 Licensing Report Revision 1-C Fuel cladding integrity must be maintained by ensuring that the minimum DNBR remains above the 95/95 DNBR limit. With respect to the DNBR, the LOAC event is bounded by the complete loss of reactor coolant flow event described in Section 2.4.1, "Partial and Complete Loss of Forced Reactor Coolant Flow." Whereas the LOAC event has RCP coastdown (reactor coolant flow reduction) occurring after rod motion, the complete loss of reactor coolant flow event begins with a coastdown of all the RCPs, and reactor trip occurs after the core coolant flow has already degraded. As the limiting ratio of the core power to core flow is greater for the complete loss of reactor coolant flow event, it is more limiting with respect to the DNBR. Based on this, no explicit calculation of minimum DNBR is performed for this event. An incident of moderate frequency must not generate a more serious plant condition without other faults occurring independently.

This criterion is conservatively demonstrated to be met if the pressurizer does not become water-solid. The concern with filling the pressurizer water-solid is that it could lead to the failing open of one or more PSVs, which would provide an unisolable path for the loss of reactor coolant, and a LOCA is a more serious plant condition. Satisfying this criterion demonstrates the preclusion of a more serious plant condition, ensures that the RCS and MSS pressure criteria and minimum DNBR criterion are satisfied for the long-term portion of the event, and confirms the AFW system is adequate for long-term heat removal. The acceptance criteria identified above are based on meeting the relevant regulatory requirements of 10 CFR 50, Appendix A, "General Design Criteria for Nuclear Power Plants." Brief discussions of the specific GDCs that are related to the LOAC acceptance criteria are provided as follows. GDC 10 (Reactor Design) requires that the reactor core and associated coolant, control, and protection systems be designed with appropriate margin so specified acceptable fuel design limits are not exceeded during any condition of normal operation, including anticipated operational occurrences. For the LOAC event, this is shown to be met by demonstrating that the fuel cladding integrity is maintained. GDC 15 (RCS Design) requires that the RCS and associated auxiliary, control, and protection systems be designed with sufficient margin so design conditions of the RCPB are not exceeded during any condition of normal ope ration, including anticipated ope rational occurrences. For the LOAC event, this is shown to be met by demonstrating that the peak RCS pressure is less than 110 percent of the design pressure. GDC 26 (Reactivity Control System Redundancy and Capability) requires the use of control rods capable of reliably controlling reactivity changes with appropriate margin for malfunctions like stuck rods so that specified acceptable fuel design limits are not exceeded under conditions of normal operation, including anticipated operational occurrences. For the LOAC event, which results in a reactor trip, this is shown to be met by demonstrating that the fuel cladding integrity is maintained with a trip reactivity that accounts for the most reactive rod stuck out of the core.

2-132 WCAP-17658-NP September 2016 Licensing Report Revision 1-C 2.3.2.1.3 Description of Analyses and Evaluations A detailed analysis using the RETRAN computer code (Reference 1) was performed to determine the plant transient conditions for the LOAC event. A RETRAN input model specific to the WCGS was developed to simulate the core neutron kinetics, RCS, pressurizer, pressurizer heaters, pressurizer sprays, SGs, MSSVs, and the AFW system. Several LOAC cases were modeled for various combinations of initial conditions and pressurizer PORV availability, and the RETRAN code computed the time-dependent trends of pertinent variables, including the pressurizer pressure, pressurizer water volume, SG mass, and reactor coolant temperatures. 2.3.2.1.4 Results The most limiting LOAC case was with an initial Tavg of 564.2°F (low end of the full-power T avg window (570.7°F) minus uncertainties), an initial pressurizer pressure of 2300 psia (nominal (2250 psia) plus uncertainties), an initial main T feed of 400°F (low full-power value), maximum (10 percent) SGTP, and the pressurizer PORVs not available. The calculated sequence of events for the limiting LOAC case is presented in Table 2.3.2-1, and transient plots of the significant plant parameters are provided in Figures 2.3.2-1 through 2.3.2-10. Following the loss of FW from full power, the SG water level d ecreases to the low-low setpoint at 37.7 seconds, which actuates a reactor trip and the AFW system. The lack of FW causes the RCS temperature to increase. Rod motion and turbine trip are initiated at 39.7 sec onds and the RCPs begin coasting down at 41.7 seconds. Although a temporary cooldown of the RCS occurs as a result of the reactor trip, the RCS heats up rapidly in response to the continued lack of FW and also the turbine trip. The MSSVs open at 73.2 seconds to help dissipate the stored and generated heat, and at 97.7 seconds, one minute after being actuated, the AFW system begins to deliver 220 gpm of AFW flow to each SG. The pressurizer water volume reaches a maximum value of 1623.2 ft 3 at 2953.5 seconds after event initiation. As the maximum pressurizer water volume value is less than the total pressurizer volume of 1800 ft 3 , it is confirmed that the pressurizer does not reach a water-solid condition. 2.3.2.2 Conclusion Based on the above information, it is concluded that the LOAC event will not progress into a more serious plant condition. Thus, all applicable event acceptance criteria are satisfied, and the AFW system with natural circulation reactor coolant flow are confirmed to be adequate for long-term heat removal following an LOAC event. Therefore, it has been demonstrated that the reactor protection and safety systems ensure that the acceptable fuel design limits are met, and the RCS and MSS pressure limits will not be exceeded as a result of an LOAC event. Based on this, the plant continues to meet the requirements of GDCs 10, 15, and 26. 2.3.2.3 References

1. Westinghouse Report WCAP-14882-P-A, "RETRAN-02 Modeling and Qualification for Westinghouse Pressurized Water Reactor Non-LOCA Safety Analyses," April 1999.

2-133 WCAP-17658-NP September 2016 Licensing Report Revision 1-C Table 2.3.2-1 Time Sequence of Events for Limiting LOAC Case Event Time (seconds) Main FW Flow Stops 0.0 Low-Low SG Water Level Reactor Trip Setpoint Reached 37.7 Rods Begin to Drop and Turbine Trip Initiated 39.7 RCPs Begin Coasting Down 41.7 On Each Loop, the MSSV with the Lowest Setting Opens 73.2 Flow from Two MDAFW Pumps Initiated 97.7 SG Inventory Reduction Reverses 221.5 Maximum Pressurizer Water Volume Occurs 2953.5 2-134 WCAP-17658-NP September 2016 Licensing Report Revision 1-C Figure 2.3.2-1. LOAC - Nuclear Power versus Time 2-135 WCAP-17658-NP September 2016 Licensing Report Revision 1-C Figure 2.3.2-2. LOAC - Core Average Heat Flux versus Time 2-136 WCAP-17658-NP September 2016 Licensing Report Revision 1-C Figure 2.3.2-3. LOAC - Reactor Coolant Loop Flow versus Time 2-137 WCAP-17658-NP September 2016 Licensing Report Revision 1-C Figure 2.3.2-4. LOAC - Hot Leg and Cold Leg Temperatures versus Time 2-138 WCAP-17658-NP September 2016 Licensing Report Revision 1-C Figure 2.3.2-5. LOAC - Actual Pressurizer Pressure versus Time 2-139 WCAP-17658-NP September 2016 Licensing Report Revision 1-C Figure 2.3.2-6. LOAC - Pressurizer Water Volume versus Time 2-140 WCAP-17658-NP September 2016 Licensing Report Revision 1-C Figure 2.3.2-7. LOAC - SG Pressure versus Time 2-141 WCAP-17658-NP September 2016 Licensing Report Revision 1-C Figure 2.3.2-8. LOAC - Indicated SG Level versus Time 2-142 WCAP-17658-NP September 2016 Licensing Report Revision 1-C Figure 2.3.2-9. LOAC - SG Mass versus Time 2-143 WCAP-17658-NP September 2016 Licensing Report Revision 1-C Figure 2.3.2-10. LOAC - Loop AFW Flow versus Time 2-144 WCAP-17658-NP September 2016 Licensing Report Revision 1-C 2.3.3 Loss of Normal Feedwater Flow (USAR Section 15.2.7) 2.3.3.1 Technical Evaluation 2.3.3.1.1 Introduction A LONF flow (from pump failures, valve malfunctions, or a complete LOAC power) results in a reduction in the capability of the secondary system to remove the heat generated in the reactor core. If an alternative supply of FW is not provided, core residual (decay) heat following reactor trip would heat the primary system water to the point where water relief from the pressurizer could occur, resulting in a substantial loss of water from the RCS.

The expected events following an LONF (caused by either pump failures or valve malfunctions) with turbine and reactor trips are described in the sequence listed as follows: The SG ARVs are automatically opened to the atmosphere as the MSS pressure increases following the trip. The condenser is assumed to be unavailable for steam dump. If the steam flow rate through the ARVs is not sufficient or if the ARVs are not available, the MSSVs may lift to dissipate the sensible heat of the fuel and coolant plus the residual decay heat produced in the reactor. The SG ARVs (or safety valves, if the ARVs are not available) are used to dissipate the residual decay heat and to maintain the plant at the Mode 3 (hot standby) condition as the no-load temperature is approached. The AFW system is actuated automatically. The plant safety features that are available to mitigate the consequences of an LONF event are as follows. A reactor trip can be initiated by one of the following.

- Two-out-of-four low-low water level signals in any one SG

- Two-out-of-four high pressurizer pressure signals

- Two-out-of-three high pressurizer level signals

- Two-out-of-four OTT signals The MSSVs open and provide secondary-side pressure protection and a heat sink source that helps limit the RCS heatup. The PSVs may open to provide primary-side pressure protection.

2-145 WCAP-17658-NP September 2016 Licensing Report Revision 1-C Backup FW for the SGs is provided by the AFW system, which is composed of two MDAFW pumps and one TDAFW pump. The two MDAFW pumps are started on any of the following:

- Two-out-of-four low-low water level signals in any one SG

- Trip of both main FW pumps

- SI signal

- LOOP - Manual pump start

- Manual AFW system actuation The TDAFW pump is started on any of the following:

- Two-out-of-four low-low water level signals in each of two SGs

- LOOP - Manual pump start

- Manual AFW system actuation The MDAFW pumps are supplied power by offsite power sources, and the TDAFW pump utilizes steam from the secondary system. The pump turbine exhausts the secondary steam to the atmosphere. Normally, the AFW pumps take suction from the CST, but if the CST is unavailable, the essential service water system is used as the water source for the AFW pumps. The analysis of the LONF event demonstrates that the AFW system is capable of removing the stored and residual heat, and consequently ensures the core will remain covered with water, and the RCS and MSS will not overpressurize. With this, the plant is shown to be able to return to a safe condition following a LONF event. 2.3.3.1.2 Input Parameters, Assumptions, and Acceptance Criteria Input Parameters and Assumptions The following inputs and assumptions were applied in the analysis of the LONF event: An initial NSSS power of 3651 MWt, whic h includes all applicable uncertainties The initial RCP heat is the maximum value of 20 MWt. Maximum RCP heat is conservative for the LONF event because the RCPs operate continuously throughout the transient. The constant heat generated by the RCPs, in combination with the core decay heat, are the primary-side heat sources that provide the challenge to the long-term cooling (LTC) capability of the plant. Two initial full-power main Tfeed: - 400.0°F (low)

- 448.6°F (high) 2-146 WCAP-17658-NP September 2016 Licensing Report Revision 1-C Four initial full-power T avg values that cover the full range of the full-power T avg window (570.7°F to 588.4°F) including uncertainty (+/-6.5°F):

- 594.9°F (high T avg plus uncertainty)

- 581.9°F (high T avg minus uncertainty)

- 577.2°F (low T avg plus uncertainty)

- 564.2°F (low T avg minus uncertainty) Two initial pressurizer pressure values that cover the +/-50 psi uncertainty associated with the nominal operating value of 2250 psia:

- 2300 psia (nominal plus uncertainty)

- 2200 psia (nominal minus uncertainty) Two initial pressurizer water level values, which are dependent on the full-power T avg value, that cover the +7 percent span uncertainty associated with the nominal values of 59 percent span for high T avg cases and 41 percent span for low T avg cases: - 66 percent span (high nominal plus uncertainty (high T avg cases))

- 48 percent span (low nominal plus uncertainty (low T avg cases)) SGTP levels of 0 and 10 percent A minimum low-low SG water level setpoint of 0 percent NRS for reactor trip and AFW system actuation A maximum delay for reactor trip (rod motion) of 2 seconds A maximum delay for AFW flow initiation of 60 seconds A minimum total AFW flow of 880 gpm split evenly between the four loops This flow corresponds to having both MDAFW pumps available for event mitigation. As it is the worst single active failure for this analysis, the TDAFW pump was assumed to fail. A maximum AFW enthalpy of 96 Btu/lbm, which corresponds to a temperature of 125°F. The pressurizer proportional and backup heaters were modeled to maximize the heatup and thermal expansion of the water within the pressurizer. In addition, the pressurizer sprays were assumed to be operable, and cases were analyzed with and without the pressurizer PORVs available. Secondary system steam relief is achieved through the self-actuated MSSVs. Note that steam relief would normally be provided by the SG ARVs or condenser dump valves, but these were conservatively assumed to be unavailable.

2-147 WCAP-17658-NP September 2016 Licensing Report Revision 1-C The MSSVs were modeled with opening setpoints that account for a maximum setpoint tolerance of 3 percent and appropriate line losses. Valve accumulation was modeled via a 5 psi ramp of the valve open area from closed to full-open. The reactivity feedback parameters were chosen to maximize the heatup of the RCS. This included modeling a least-negative MTC, a least-negative DTC, and a most-negative Doppler-only power coefficient. Note that the applied MTC value, 0 pcm/°F, is the least-negative limit value for full power conditions; the applica tion of a zero MTC at full power conditions is bounding compared to the application of a positive MTC at part power conditions. Core residual/decay heat generation was based on the 1979 version of ANS 5.1 (Reference 1). ANSI/ANS-5.1-1979 is a conservative representation of the decay energy release rates. Long-term operation at the initial power level preceding the trip was assumed. Acceptance Criteria Based on the expected frequency of occurrence, the LONF event is considered to be a Condition II event as defined by the ANS's "Nuclear Safety Criteria for the Design of Stationary Pressurized Water Reactor Plants," ANSI N18.2-1973. The following items summarize the acceptance criteria associated with the analysis of this event: Pressures in the RCS and MSS must remain less than 110 percent of the respective design pressures.

With respect to peak RCS and MSS pressures, the LONF event is bounded by the LOL/TT event described in Section 2.3.1, "Loss of External Electrical Load, Turbine Trip, Inadvertent Closure of a Main Steam Isolation Valve, and Loss of Condenser Vacuum," in which assumptions are made to conservatively calculate the RCS and MSS pressure transients. For the LONF event, turbine trip occurs after reactor trip, whereas for LOL/TT, is the initiating incident. Therefore, the power mismatch between the primary and secondary sides and the resultant temperature and pressure transients of the RCS and MSS are always more severe for LOL/TT than for LONF.

Based on this, no explicit calculation of maximum RCS or MSS pressure is performed for this event. Fuel cladding integrity must be maintained by ensuring that the minimum DNBR remains above the 95/95 DNBR limit. With respect to the DNBR, the LONF event is bounded by the LOL/TT event described in Section 2.3.1, "Loss of External Electrical Load, Turbine Trip, Inadvertent Closure of a Main Steam Isolation Valve, and Loss of Condenser Vacuum." Each of these two events represents a reduction in the heat removal capability of the secondary system. For the LONF event, the RCS temperature increases gradually as the SGs boil down to the low-low water level trip setpoint, at which time reactor trip occurs, followed by turbine trip. For the LOL/TT event, the turbine trip is the initiating event, and the loss of heat sink is much more severe. As such, the initial RCS heatup will be much more severe for the LOL/TT event than for the LONF event, and the LOL/TT event 2-148 WCAP-17658-NP September 2016 Licensing Report Revision 1-C will always be more severe with respect to the minimum DNBR criterion. Based on this, no explicit calculation of minimum DNBR is performed for this event. An incident of moderate frequency must not generate a more serious plant condition without other faults occurring independently. This criterion is conservatively demonstrated to be met if the pressurizer does not become water-solid. The concern with filling the pressurizer water-solid is that it could lead to the failing open of one or more PSVs, which would provide an unisolable path for the loss of reactor coolant, and a loss of coolant accident is a more serious plant condition. Satisfying this criterion demonstrates the preclusion of a more serious plant condition, ensures that the RCS and MSS pressure criteria and minimum DNBR criterion are satisfied for the long-term portion of the event, and confirms the AFW system is adequate for long-term heat removal. The acceptance criteria identified above are based on meeting the relevant regulatory requirements of 10 CFR 50, Appendix A, "General Design Criteria for Nuclear Power Plants." Brief discussions of the specific GDCs that are related to the LONF acceptance criteria are provided as follows. GDC 10 (Reactor Design) requires that the reactor core and associated coolant, control, and protection systems be designed with appropriate margin so specified acceptable fuel design limits are not exceeded during any condition of normal operation, including anticipated operational occurrences. For the LONF event, this is shown to be met by demonstrating that the fuel cladding integrity is maintained. GDC 15 (RCS Design) requires that the RCS and associated auxiliary, control, and protection systems be designed with sufficient margin so design conditions of the RCPB are not exceeded during any condition of normal ope ration, including anticipated ope rational occurrences. For the LONF event, this is shown to be met by demonstrating that the peak RCS pressure is less than 110 percent of the design pressure. GDC 26 (Reactivity Control System Redundancy and Capability) requires the use of control rods capable of reliably controlling reactivity changes with appropriate margin for malfunctions like stuck rods so that specified acceptable fuel design limits are not exceeded under conditions of normal operation, including anticipated operational occurrences. For the LONF event, which results in a reactor trip, this is shown to be met by demonstrating that the fuel cladding integrity is maintained with a trip reactivity that accounts for the most reactive rod stuck out of the core. 2.3.3.1.3 Description of Analyses and Evaluations A detailed analysis using the RETRAN computer code (Reference 2) was performed to determine the plant transient conditions for the LONF event. A RETRAN input model specific to the WCGS was developed to simulate the core neutron kinetics, RCS, pressurizer, pressurizer heaters, pressurizer sprays, SGs, MSSVs, and the AFW system. Several LONF cases were modeled for various combinations of initial conditions and pressurizer PORV availability, and the RETRAN code computed the time-dependent trends of pertinent variables, including the pressurizer pressure, pressurizer water volume, SG mass, and reactor coolant temperatures.

2-149 WCAP-17658-NP September 2016 Licensing Report Revision 1-C 2.3.3.1.4 Results The most limiting LONF case was with an initial Tavg of 564.2°F (low end of the full-power T avg window (570.7°F) minus uncertainties), an initial pressurizer pressure of 2300 psia (nominal (2250 psia) plus uncertainties), an initial main Tfeed temperature of 400°F (low full-power value), and minimum (0 percent) SGTP. Although the pressurizer PORVs were modeled as being available in this limiting case, the pressurizer sprays were sufficient in controlling the pressurizer pressure below the setpoint of the PORVs. The calculated sequence of events for the limiting LONF case is presented in Table 2.3.3-1, and transient plots of the significant plant parameters are provided in Figures 2.3.3-1 through 2.3.3-10. Following the loss of FW from full power, the SG water level d ecreases to the low-low setpoint at 37.8 seconds, which actuates a reactor trip and the AFW system. The lack of FW causes the RCS temperature to increase. Rod motion and turbine trip are initiated at 39.8 seconds and the RCPs continue running. Although a temporary cooldown of the RCS occurs as a result of the reactor trip, the RCS heats up rapidly in response to the continued lack of FW and also the turbine trip. The MSSVs open at 68.0 seconds to help dissipate the stored and generated heat, and at 97.8 seconds, one minute after being actuated, the AFW system begins to deliver 220 gpm of AFW flow to each SG. The RCS heatup turns around shortly after the MSSVs open, and it is further controlled by the cooling effect of the AFW flow. The pressurizer water volume reaches a maximum value of 1384.1 ft 3 at 1372.0 seconds after event initiation. As the maximum pressurizer water volume value is less than the total pressurizer volume of 1800 ft 3 , it is confirmed that the pressurizer does not reach a water-solid condition. 2.3.3.2 Conclusion Based on the above information, it is concluded that the LONF event will not progress into a more serious plant condition. Thus, all applicable event acceptance criteria are satisfied, and the AFW system is confirmed to be adequate for long-term heat removal following an LONF event. Therefore, it has been demonstrated that the reactor protection and safety systems ensure that the acceptable fuel design limits are met, and the RCS and MSS pressure limits will not be exceeded as a result of an LONF event. Based on this, the plant continues to meet the requirements of GDCs 10, 15 and 26. 2.3.3.3 References

1. ANSI/ANS-5.1-1979, "American National Standard for Decay Heat Power in Light Water Reactors," August 1979.
2. Westinghouse Report WCAP-14882-P-A, "RETRAN-02 Modeling and Qualification for Westinghouse Pressurized Water Reactor Non-LOCA Safety Analyses," April 1999.

2-150 WCAP-17658-NP September 2016 Licensing Report Revision 1-C Table 2.3.3-1 Time Sequence of Events for Limiting LONF Case Event Time (seconds) Main FW Flow Stops 0.0 Low-Low SG Water Level Reactor Trip Setpoint Reached 37.8 Rods Begin to Drop and Turbine Trip Initiated 39.8 On Each Loop, the MSSV with the Lowest Setting Opens 68.0 Flow from Two MDAFW Pumps Initiated 97.8 SG Inventory Reduction Reverses 431.0 Maximum Pressurizer Water Volume Occurs 1372.0 2-151 WCAP-17658-NP September 2016 Licensing Report Revision 1-C Figure 2.3.3-1. LONF - Nuclear Power versus Time 2-152 WCAP-17658-NP September 2016 Licensing Report Revision 1-C Figure 2.3.3-2. LONF - Core Average Heat Flux versus Time 2-153 WCAP-17658-NP September 2016 Licensing Report Revision 1-C Figure 2.3.3-3. LONF - Reactor Coolant Loop Flow versus Time 2-154 WCAP-17658-NP September 2016 Licensing Report Revision 1-C Figure 2.3.3-4. LONF - HL and CL Temperatures versus Time 2-155 WCAP-17658-NP September 2016 Licensing Report Revision 1-C Figure 2.3.3-5. LONF - Actual Pressurizer Pressure versus Time 2-156 WCAP-17658-NP September 2016 Licensing Report Revision 1-C Figure 2.3.3-6. LONF - Pressurizer Water Volume versus Time 2-157 WCAP-17658-NP September 2016 Licensing Report Revision 1-C Figure 2.3.3-7. LONF - SG Pressure versus Time 2-158 WCAP-17658-NP September 2016 Licensing Report Revision 1-C Figure 2.3.3-8. LONF - Indicated SG Level versus Time 2-159 WCAP-17658-NP September 2016 Licensing Report Revision 1-C Figure 2.3.3-9. LONF - SG Mass versus Time 2-160 WCAP-17658-NP September 2016 Licensing Report Revision 1-C Figure 2.3.3-10. LONF - Loop AFW Flow versus Time 2-161 WCAP-17658-NP September 2016 Licensing Report Revision 1-C

2.3.4 Feedwater

System Pipe Break (USAR Section 15.2.8) 2.3.4.1 Technical Evaluation 2.3.4.1.1 Introduction A major FW line break is defined as a break in a FW line large enough to prevent the addition of sufficient FW to maintain shell-side fluid inventory in the SGs. If the break is postulated in a FW line between the check valve and the SG, fluid from the SG will be discharged through the break. Furthermore, depending upon the arrangement of the AFW piping, a break in this location could preclude the subsequent addition of AFW to the affected SG. A break upstream of the FW line check valve would affect the RCS only as a LONF accident. This event is addressed by the LONF analysis presented in Section 2.3.3, "Loss of Normal Feedwater Flow." Depending upon the size of the break and the plant operating conditions at the time of the rupture, the break could cause either an RCS cooldown or heatup. The potential RCS cooldown resulting from a secondary pipe rupture is evaluated in the SLB analysis presented in Section 2.2.5.1, "Steam System Piping Failure at HZP." Therefore, only the RCS heatup effects are evaluated for a FW line break. A FW line break reduces the ability of the secondary system to remove heat generated by the core from the RCS for the following reasons:

Reduction in FW flow to the SGs. The degradation in FW flow can cause the reactor coolant temperature to increase prior to reactor trip. Fluid inventory of the faulted SG may be discharged through the break, and therefore, would not be available for decay heat removal following reactor trip. The AFW system is provided to ensure that adequate FW is available to provide decay heat removal. Thus, the primary function of the FW line break analysis is to verify that the capacity of the AFW system is adequate. The AFW system is intended to provide an adequate supply of FW to ensure that: No substantial overpressurization of the RCS and MSS occurs , and Sufficient liquid is maintained in the RCS so that the core remains in place and geometrically intact with no loss of core cooling capability. The most limiting single failure in this event is the loss of one AFW train that results in the loss of one AFW pump, thus reducing the heat removal capability of the AFW system. The AFW flow rate modeled in the analysis bounds the consequences from the loss of either a MDAFW pump or a TDAFW pump. The FW line break event is analyzed at full power conditions that bound all other power levels and all other Modes, because decay heat and stored energy are most limiting following a trip from a full power condition.

2-162 WCAP-17658-NP September 2016 Licensing Report Revision 1-C The severity of the FW line rupture transient depends on a number of parameters, including break size, initial reactor power, and the functioning of various control and safety systems. Sensitivity studies presented in Reference 1 illustrate many of the limiting assumptions for the FW line rupture. In the analysis, the main FW control system is assumed to fail due to an adverse environment. As a result, the water levels in all the SGs decrease equally until the low-low SG water level reactor trip setpoint is reached. After reactor trip, a double-ended rupture of the largest FW line is modeled. This combination of events conservatively bounds the most limiting FW line break scenario that can occur. Analyses have been performed at full power, with and without LOOP, with credit taken for the pressurizer PORVs, but no SI actuation modeled. For the case without offsite power available, the power is assumed to be lost at the time of reactor trip. This is more conservative than the case in which power is lost at the initiation of the event. The plant safety features that are available to mitigate the consequences of a FW line break event are as follows. A reactor trip can be initiated by one of the following.

- Two-out-of-four low-low water level signals in any one SG

- Two-out-of-four high pressurizer pressure signals

- Two-out-of-three high pressurizer level signals

- Two-out-of-four OTT signals

- SI signal (from one of the following [1] two-out-of-three low steamline pressure signals in any one loop or [2] two-out-of-three high containment pressure signals)

- Two-out-of-four low pressurizer pressure signals The MSSVs open and provide secondary-side pressure protection and a heat sink source that helps limit the RCS heatup. The PSVs may open to provide primary-side pressure protection. Backup FW for the SGs is provided by the AFW system, which is composed of two MDAFW pumps and one TDAFW pump. The two MDAFW pumps are started on any of the following:

- Two-out-of-four low-low water level signals in any one SG

- Trip of both main FW pumps

- SI signal 2-163 WCAP-17658-NP September 2016 Licensing Report Revision 1-C

- LOOP - Manual pump start

- Manual AFW system actuation The TDAFW pump is started on any of the following:

- Two-out-of-four low-low water level signals in each of two SGs

- LOOP - Manual pump start

- Manual AFW system actuation The MDAFW pumps are supplied power by offsite power sources, and the TDAFW pump utilizes steam from the secondary system. The pump turbine exhausts the secondary steam to the atmosphere. Normally, the AFW pumps take suction from the CST, but if the CST is unavailable, the essential service water system is used as the water source for the AFW pumps. The analysis of the FW line break event demonstrates that the AFW system is capable of removing the stored and residual heat, and consequently ensures the core will remain covered with water. With this, the plant is capable of returning to a safe condition following a FW line break event. 2.3.4.1.2 Input Parameters, Assumptions, and Acceptance Criteria Input Parameters and Assumptions The following inputs and assumptions were applied in the analysis of the FW line break event: An initial NSSS power of 3651 MWt, which includes all applicable uncertainties. The initial RCP heat is the maximum value of 20 MWt for the case with offsite power available throughout the event. With offsite power available, maximum RCP heat is conservative for the FW line break event because the RCPs operate continuously throughout the transient. For the case with a LOOP, the nominal value of 14 MWt for the initial RCP heat is used because it is more conservative to model a slightly initial higher core power that increases the subsequent post-trip decay heat. Any post-trip heat generated by the RCPs, in combination with the core decay heat, are the primary-side heat sources that provide the challenge to the long-term cooling capability of the plant. A maximum initial full-power main Tfeed of 448.6°F. A maximum initial full-power T avg value of 594.9°F, which represents the nominal high T avg plus the uncertainty of 6.5°F. Main FW is assumed to be lost to all SGs at event initiation due to the FW line break. The reverse blowdown of the faulted SG is conservatively delayed and begins when the SG inventory reaches 0 percent NRS. The combination of conditions modeled is defined to produce the most severe FW

line break transient with the control and protection interaction considered.

2-164 WCAP-17658-NP September 2016 Licensing Report Revision 1-C The worst possible break area is modeled to maximize the blowdown discharge rate following the time of reactor trip, which maximizes the resultant heatup of the reactor coolant. Choked flow is modeled at the break. Operation of the pressurizer PORVs is modeled to minimize RCS pressure, which produces lower (more limiting) saturation temperatures within the RCS. To ensure the conservatism of this assumption, SI flow, which would increase with reduced RCS pressure, is set to zero. Pressurizer spray and heaters are both assumed to be inoperable. A minimum initial pressurizer pressure value of 2200 psia, which represents the nominal pressure of 2250 psia minus the uncertainty of 50 psi. The use of a low initial RCS pressure is consistent with modeling the operation of the pressurizer PORVs. A maximum initial pressurizer water level of 66 percent span, which conservatively bounds the high T avg nominal value plus the uncertainty of 7 percent span. The initial water level in all SGs is set at 60 percent span, which is the nominal valu e (50 percent span) plus a level uncertainty of 10 percent span. SGTP level of 10 percent (a maximum value). A minimum low-low SG water level setpoint of 0 percent NRS for reactor trip and AFW system

actuation. A maximum delay for reactor trip (rod motion) of 2 seconds. A maximum delay for AFW flow initiation of 60 seconds. The analysis conservatively accounts for the purging of the hotter main FW in the FW piping, which delays delivery of the relatively cold auxiliary FW flow to the SGs. Failure of one protection train is taken as the worst single failure and results in one AFW pump being inoperable. The total AFW flow modeled is 594.4 gpm delivered to the three intact SGs. This is a conservative minimum value for the AFW flow following a FW line break and bounds either a single failure of the TDAFW pump or one MDAFW pump. The distribution of AFW flow is 222.7 gpm to each of two intact SGs with the third intact SG receiving 149 gpm. No flow is modeled as being delivered to the SG in the faulted loop. A maximum AFW enthalpy of 96 Btu/lbm, which corresponds to a conservatively high temperature of 125°F. Secondary system steam relief is achieved through the self-actuated MSSVs. Note that steam relief would normally be provided by the SG ARVs or condenser dump valves, but these were conservatively assumed to be unavailable. The MSSVs were modeled with opening setpoints that account for a maximum setpoint tolerance of 3 percent and appropriate line losses. Valve accumulation was modeled via a 5 psi ramp of the valve open area from closed to full-open.

2-165 WCAP-17658-NP September 2016 Licensing Report Revision 1-C Both minimum and maximum reactivity feedback conditions have been c onsidered. Consistent with the limiting conditions determined for each scenario, the case analyzed with offsite power available throughout the transient models maximum reactivity feedback while the case without offsite power (i.e., with a LOOP) models minimum reactivity feedback. Note that the minimum reactivity feedback input includes a least negative MTC value of 0 pcm/°F. Core residual/decay heat generation was based on the 1979 version of ANS 5.1 (Reference 2). ANSI/ANS-5.1-1979 is a conservative representation of the decay energy release rates.

Long-term operation at the initial power level preceding the trip was assumed. No credit is taken for heat energy deposition in the RCS metal during the RCS heatup phase of

the transient. No credit is taken for charging or letdown. No credit is taken for the following potential protection logic signals to mitigate the consequences of the accident:

- High pressurizer pressure

- OTT - High pressurizer level

- High containment pressure Acceptance Criteria Based on the expected frequency of occurrence, the FW line break event is considered to be a Condition IV event as defined by "Nuclear Safety Criteria for the Design of Stationary Pressurized Water Reactor Plants," ANSI N18.2-1973. The following items summarize the acceptance criteria associated with the analysis of this event: Pressures in the RCS and MSS must remain less than 110 percent of the respective design pressures.

With respect to peak RCS and MSS pressures, the FW line break event is bounded by the LOL/TT event described in Section 2.3.1, "Loss of External Electrical Load, Turbine Trip, Inadvertent Closure of a Main Steam Isolation Valve, and Loss of Condenser Vacuum," in which assumptions are made to conservatively calculate the RCS and MSS pressure transients. For the FW line break event, turbine trip occurs after reactor trip, whereas for the LOL/TT event, the turbine trip is the initiating fault. Therefore, the primary to secondary power mismatch and resultant RCS and MSS heatup and pressurization transients are always more severe for the LOL/TT event. Based on this, no explicit calculation of maximum RCS or MSS pressure is performed for this event.

2-166 WCAP-17658-NP September 2016 Licensing Report Revision 1-C Any fuel damage calculated to occur must be sufficiently limited to the extent that the core will remain in place and intact with no loss of core cooling capability. With respect to fuel damage due to "dryout," where the water level in the vessel drops below the top of the core, Westinghouse has established an internal criterion that no bulk boiling occurs in the primary coolant system prior to event turn around. Turn around occurs when the heat removal capability of the SGs, being fed AFW, exceeds NSSS heat generation. This conservatively ensures that the core remains covered with water and thereby will remain in place and geometrically intact with no loss of core cooling capability. This criterion is very limiting and is adopted for convenience in interpreting the results of this study. Compliance can be determined by checking the temperature plots (HL saturation, HL, and CL) for all the loops and verifying that neither the HL nor CL temperatures exceed the saturation temperature prior to turn around. It should be noted that precluding bulk boiling in the RCS is the limiting criterion that is considered in the FW line break analysis. With respect to possible fuel damage due to DNB, the FW line break event would be bounded by either the SLB analysis presented in Section 2.2.5.1 or the LOL/TT analysis in Section 2.3.1. The acceptance criteria identified above are based on meeting the relevant regulatory requirements of 10 CFR 50, Appendix A, "General Design Criteria for Nuclear Power Plants." Brief discussions of the specific GDCs that are related to the FW line break acceptance criteria are provided as follows. GDC 27 (Combined Reactivity Control Systems Capability) requires that the reactivity control systems be designed to have a combined capability, in conjunction with poison addition by the ECCS, of reliably controlling reactivity changes so that, under postulated accident conditions and with appropriate margin for stuck rods, the capability to cool the core is maintained. For the FW line break event, this is shown to be met by demonstrating that the applicable fuel damage criterion is satisfied. It should be noted that in the FW line break analysis cases presented, poison addition via SI actuation is conservatively not credited but is available and would be actuated. GDC 28 (Reactivity Limits) requires that the reactivity control system be designed with appropriate limits on the potential amount and rate of reactivity increase so that the effects of postulated reactivity accidents can neither result in damage to the RCPB greater than limited local yielding, nor sufficiently disturb the core, its support structures, or other RPV internals to impair significantly the capability to cool the core. For the FW line break event, this is shown to be met by demonstrating that the peak RCS pressure is less than 110 percent of the design pressure, which ultimately ensures that the RCPB pressure limits are not exceeded, and by confirming that the fuel damage requirements are met. GDC 35 (Emergency Core Cooling) requires that the RCS and associated auxiliaries be designed with a safety system able to provide abundant emergency core cooling. For the FW line break event, this is shown to be met by demonstrating that the fuel damage criterion is met, which confirms that the AFW system provides abundant cooling for the RCS, even with the most-limiting single failure considered.

2-167 WCAP-17658-NP September 2016 Licensing Report Revision 1-C 2.3.4.1.3 Description of Analyses and Evaluations A detailed analysis using the RETRAN computer code (Reference 3) was performed to determine the plant transient conditions for the FW line break event. A RETRAN input model specific to WCGS was developed to simulate the core neutron kinetics, RCS, pressurizer, pressurizer sprays, SGs, MSSVs, and the AFW system. FW line break cases were modeled to address minimum and maximum reactivity feedback conditions with and without a LOOP occurring. The RETRAN code computed the time-dependent trends of pertinent variables, including the pressurizer pressure, pressurizer water volume, SG mass, and reactor coolant temperatures. 2.3.4.1.4 Results Calculated plant parameters following a major FW line break are shown in Figures 2.3.4-1 through 2.3.4-10. Results for the limiting case with offsite power available are presented in Figures 2.3.4-1 through 2.3.4-5. Results for the limiting case where offsite power is lost are presented in Figures 2.3.4-6 through 2.3.4-10. The calculated sequence of events for each of the reported cases is provided in Tables 2.3.4-1 and 2.3.4-2. The system response following the FW line break is similar for both cases analyzed. In both cases, the primary and secondary pressures increase prior to reactor trip. After reactor trip occurs on low-low SG water level, the pressure decreases sharply, due to the cooldown caused by the break, until SLI occurs. The pressure in the faulted SG continues to decrease, whereas the pressure in the intact SGs and the primary side begins to increase until the safety valve settings are reached. Results presented in Figures 2.3.4-2 an d 2.3.4-5 (with offsite power available) and Figures 2.3.4-7 and 2.3.4-10 (without offsite power) show the predicted pressures in the RCS and MSS. As was previously discussed in Section 2.3.4.1.3, the FW line break analysis is bounded by LOL/TT with respect to meeting maximum pressure limits for the RCS and MSS. This is especially true because the reported cases for the FW line break analysis model operation of the pressurizer PORVs to reduce transient RCS pressure which is conservative with respect to bulk boiling concerns. The primary temperatures are stable or increase slightly prior to reactor trip and decrease sharply during cooldown after reactor trip. Once the heat-up begins, the primary temperature increases until the heat removal capability of the intact SGs, with the inventory maintained by the AFW System, equals the decay heat generated in the core plus pump heat ("turn around" time). The peak primary temperature remains below the saturation temperature although the margin to boiling is decreased. At the predicted time of turn around, the minimum margin to HL saturation for the case with offsite power is 65.3°F, and 40.5°F for the case without offsite power. Thus, there is no bulk boiling in the RCS. 2.3.4.2 Conclusion Based on the above information, it is concluded that for the postulated FW line break event the modeled AFW system performance is adequate for long-term heat removal. The results confirm that for the FW line break event, the AFW system can adequately remove decay heat to preclude uncovering of the reactor core. Based on this, the plant continues to meet the requirements of GDCs 27, 28 and 35.

2-168 WCAP-17658-NP September 2016 Licensing Report Revision 1-C 2.3.4.3 References

1. Westinghouse Report WCAP-9230, "Report on the Consequences of a Postulated Main Feedline Rupture," January 1978.
2. ANSI/ANS-5.1-1979, "American National Standard for Decay Heat Power in Light Water Reactors," August 1979.
3. Westinghouse Report WCAP-14882-P-A, "RETRAN-02 Modeling and Qualification for Westinghouse Pressurized Water Reactor Non-LOCA Safety Analyses," April 1999.

2-169 WCAP-17658-NP September 2016 Licensing Report Revision 1-C Table 2.3.4-1 Time Sequence of Events for Limiting FW Line Break Case With Offsite Power Available Event/Parameter Time (sec) FW Line Break Occurs Causing Loss of FW to all SGs due to Harsh Environment 0.0 Pressurizer PORV Opens (First Occurrence) 13.9 Low-Low SG Water Level Reactor Trip Setpoint Reached in all SGs 36.2 Rods Begin to Drop and Faulted SG Begins Discharging Fluid Directly Out the Break 38.2 Pressurizer PORV Closes (First Occurrence) 41.7 AFW Flow is Delivered to Intact SGs 96.2 Low Steam Line Pressure SI Setpoi nt Reached in Ru ptured SG 132.7 Main Steam Line Isolation Valves Closed 149.7 SG Safety Valve Setpoint Reached in Intact SGs (First Occurrence) 579.0 Core Decay Heat plus RCP Heat Decreased to AFW Heat Removal Capacity

~1700.0 Table 2.3.4-2 Time Sequence of Events for Limiting FW Line Break Case Without Offsite Power Available Event/Parameter Time (sec) FW Line Break Occurs Causing Loss of FW to all SGs due to Harsh Environment 0.0 Pressurizer PORV Opens (First Occurrence) 13.9 Low-Low SG Water Level Reactor Trip Setpoint Reached in all SGs 36.3 Rods Begin to Drop and Faulted SG Begins Discharging Fluid Directly out the Break 38.3 Power Lost to RCPs 40.3 Pressurizer PORV Closes (First Occurrence) 42.1 AFW Flow is Delivered to Intact SGs 96.3 Low Steam Line Pressure SI Setpoint Reached in Ruptured SG 105.6 Main Steam Line Isolation Valves Closed 122.6 SG Safety Valve Setpoint Reached (first occurrence) 553.4 Core Decay Heat Decreased to AFW Heat Removal Capacity

~1100 2-170 WCAP-17658-NP September 2016 Licensing Report Revision 1-C Figure 2.3.4-1. FW Line Break with Offsite Power Available Nuclear Power, Core Heat Flux and Total Core Reactivity versus Time 2-171 WCAP-17658-NP September 2016 Licensing Report Revision 1-C Figure 2.3.4-2. FW Line Break with Offsite Power Available Pressurizer Pressure and Pressurizer Water Volume versus Time 2-172 WCAP-17658-NP September 2016 Licensing Report Revision 1-C Figure 2.3.4-3. FW Line Break with Offsite Power Available Reactor Coolant Flow and FW Line Break Flow versus Time 2-173 WCAP-17658-NP September 2016 Licensing Report Revision 1-C Figure 2.3.4-4. FW Line Break with Offsite Power Available Faulted Loop and Intact Loop Reactor Coolant Temperatures versus Time 2-174 WCAP-17658-NP September 2016 Licensing Report Revision 1-C Figure 2.3.4-5. FW Line Break with Offsite Power Available SG Shell Pressure versus Time 2-175 WCAP-17658-NP September 2016 Licensing Report Revision 1-C Figure 2.3.4-6. FW Line Break without Offsite Power Nuclear Power, Core Heat Flux and Total Core Reactivity versus Time 2-176 WCAP-17658-NP September 2016 Licensing Report Revision 1-C Figure 2.3.4-7. FW Line Break without Offsite Power Pressurizer Pressure and Pressurizer Water Volume versus Time 2-177 WCAP-17658-NP September 2016 Licensing Report Revision 1-C Figure 2.3.4-8. FW Line Break without Offsite Power Reactor Coolant Flow and FW Line Break Flow versus Time 2-178 WCAP-17658-NP September 2016 Licensing Report Revision 1-C Figure 2.3.4-9. FW Line Break without Offsite Power Faulted Loop and Intact Loop Reactor Coolant Temperatures versus Time 2-179 WCAP-17658-NP September 2016 Licensing Report Revision 1-C Figure 2.3.4-10. FW Line Break without Offsite Power SG Shell Pressure versus Time 2-180 WCAP-17658-NP September 2016 Licensing Report Revision 1-C

2.4 DECREASE

IN REACTOR COOLANT SYSTEM FLOW RATE

2.4.1 Partial

and Complete Loss of Forced Reactor Coolant Flow (USAR Sections 15.3.1 and 15.3.2) 2.4.1.1 Technical Evaluation 2.4.1.1.1 Introduction A loss of forced reactor coolant flow accident (USAR Sections 15.3.1 and 15.3.2) can result from the following: Mechanical or electrical failure in one or more RCPs Interruption in the power supplying one or more of the RCPs Reduction in RCP motor supply frequency If the reactor is at power at the time of the event, the immediate effect from the loss of forced coolant flow is a rapid increase in the coolant temperature. This increase in coolant temperature could result in DNB, with subsequent fuel damage, if the reactor is not promptly tripped.

The following signals provide protection against a loss of forced reactor coolant flow incident: Low reactor coolant loop flow reactor trip UV on RCP power supply busses reactor trip Underfrequency (UF) on RCP power supply busses reactor trip The reactor trip on low reactor coolant loop flow provides primary protection against partial loss-of-flow (PLOF) conditions. This function is generated by two-out-of-three low-flow signals in any reactor coolant loop. Above Permissive P-8, low flow in any loop will actuate a reactor trip. Between approximately 10 percent power (Permissive P-7) and the power level corresponding to Permissive P-8, low flow in two loops will actuate a reactor tr ip. Reactor trip on low flow is blocked below Permissive P-7 because there is insufficient heat production to be concerned about DNB. The reactor trip on RCP UV is provided to protect agai nst conditions that can cause a loss of voltage to all RCPs, that is, LOOP. An UV reactor trip serves as an anticipatory backup to the low reactor coolant loop flow trip. The UV trip function is blocked below approximately 10 percent power (Permissive P-7). The RCP UF reactor trip is provided to trip the reactor for an UF condition resulting from frequency disturbances on the power grid. The RCP UF reactor trip function is blocked below Permissive P-7. This trip function also serves as an anticipatory backup to the low reactor coolant loop flow trip. 2.4.1.1.2 Input Parameters, Assumptions, and Acceptance Criteria This accident was analyzed using the RTDP methodology (Reference 1). Initial NSSS power was conservatively modeled to be at 3651 MWt, which includes all applicable uncertainties. The RCS pressure and vessel average temperature were assumed to be at their nominal values. MMF was also 2-181 WCAP-17658-NP September 2016 Licensing Report Revision 1-C assumed. Uncertainties in initial conditions were accounted for in the DNBR limit value as described in the RTDP. A conservatively large absolute value of the Doppler-only power coefficient was used. The analysis also assumed a conservative MTC of 0 pcm/°F at HFP conditions. This resulted in the maximum core power and hot spot heat flux during the initial part of the transient when the minimum DNBR is reached. Engineered safety systems (such as SI) are not required to function. No single active failure in any system or component required for mitigation will adversely affect the consequences of this event. A partial loss of forced reactor coolant flow incident is classified as a Condition II event as defined by the ANS's "Nuclear Safety Criteria for the Design of Stationary Pressurized Water Reactor Plants," ANSI N18.2-1973. A complete loss of forced reactor coolant flow incident is classified by the ANS as a Condition III event. However, for conservatism, the incident was analyzed to Condition II criteria. The immediate effect from a complete loss of forced reactor coolant flow is a rapid increase in the reactor coolant temperature and subsequent increase in RCS pressure. The following two items identify the acceptance criteria associated with the analysis of the loss of flow events: The CHF is not to be exceeded. This is met by demonstrating that the minimum DNBR does not decrease below the SAL value at any time during the transient. Pressures in the RCS and MSS are maintained below 110 percent of their respective design pressures. With respect to peak RCS and MSS pressures, the loss of forced reactor coolant flow event is bounded by the LOL/TT event described in Section 2.3.1, "Loss of External Electrical Load, Turbine Trip, Inadvertent Closure of a Main Steam Isolation Valve, and Loss of Condenser Vacuum," in which assumptions are made to conservatively calculate the RCS and MSS pressure transients. For the loss of forced reactor coolant flow event, turbine trip occurs after reactor trip, whereas for loss of load, the turbine trip is the initiating incident. Therefore, the power mismatch between the primary and secondary sides and the resultant temperature and pressure transients of the RCS and MSS are always more severe for LOL/TT than for the loss of forced reactor coolant flow. Based on this, no explicit calculation of maximum RCS or MSS pressure is performed for this event. The above acceptance criteria are based on meeting the relevant regulatory requirements of 10 CFR 50, Appendix A, "General Design Criteria for Nuclear Power Plants." Brief discussions of the specific GDCs that are related to the loss of forced reactor coolant flow acceptance criteria are provided as follows. The specific acceptance criteria for this event are as follows: GDC 10 (Reactor Design) requires that the reactor core and associated coolant, control, and protection systems be designed with appropriate margin so specified acceptable fuel design limits are not exceeded during any condition of normal operation, including anticipated operational occurrences. For the loss of forced reactor coolant flow event, this is shown to be met by demonstrating that the DNBR remains above the 95/95 DNBR limit at all times during the transient.

2-182 WCAP-17658-NP September 2016 Licensing Report Revision 1-C GDC 15 (RCS Design) requires that the RCS and associated auxiliary, control, and protection systems be designed with sufficient margin so design conditions of the RCPB are not exceeded during any condition of normal ope ration, including anticipated ope rational occurrences. For the loss of forced reactor coolant flow event, this is shown to be met by demonstrating that the peak RCS pressure is less than 110 percent of the design pressure. GDC 26 (Reactivity Control System Redundancy and Capability) requires the use of control rods capable of reliably controlling reactivity changes with appropriate margin for malfunctions like stuck rods so that specified acceptable fuel design limits are not exceeded under conditions of normal operation, including anticipated operational occurrences. For the loss of forced reactor coolant flow event, which results in a reactor trip, this is shown to be met by demonstrating that the DNBR remains above the 95/95 DNBR limit at all times during the transient with a trip reactivity that accounts for the most reactive rod stuck out of the core. 2.4.1.1.3 Description of Analyses and Evaluations The following loss of forced reactor coolant flow cases were analyzed: Loss of power to two RCPs (PLOF) Loss of power to all RCPs (complete loss of flow (CLOF)) 5 Hz/second frequency decay of the RCPs power supply (CLOF-underfrequency (CLOF-UF)) The transients were analyzed with two computer codes. First, the RETRAN computer code (Reference 2) was used to calculate the following: Loop and core flows during the transient Time of reactor trip based on the calculated flows Nuclear power transient Primary system pressure and temperature transients The VIPRE computer code (Reference 3) was then used to calculate the heat flux and DNBR based on the nuclear power and RCS temperature (enthalpy), pressure, and flow from the output of the RETRAN transient run. The DNBR transients presented represent the minimum of the typical or thimble cell for the fuel. An evaluation of the P-8 permissive setpoint was performed and it was determined that the current plant-specific value continued to provide adequate protection. No change to the existing setpoint was deemed necessary. Additionally, the effects of loop-to-loop flow asymmetry due to 10 percent SGTP imbalance have been considered in the analysis.

2-183 WCAP-17658-NP September 2016 Licensing Report Revision 1-C 2.4.1.1.4 Results The PLOF case resulted in a low reactor coolant loop flow reactor trip signal and the CLOF case resulted in an UV RCP reactor trip signal. The CLOF-UF case resulted in an UF RCP reactor trip signal. The VIPRE (Reference 3) analysis for these scenarios confirmed that the minimum DNBR acceptance criterion was met. Fuel cladding damage criteria were not challenged in any of the loss of forced reactor coolant flow cases because the DNB criterion was met. The analyses of the loss of flow events also demonstrated that the peak RCS and MSS pressures were well below their respective limits.

The most limiting of these cases in terms of the minimum calculated DNBR was the CLOF case. The transient results for each case are presented in Figures 2.4.1-1 through 2.4.1-21. The sequence of events for each case is presented in Table 2.4.1-1. Numerical results for the analyses are shown in Table 2.4.1-2.

The analysis demonstrates that, for the aforementioned loss of flow cases, the DNBR did not decrease below the SAL value at any time during the transients. Therefore, no fuel or cladding damage is predicted. Also, the peak RCS and MSS pressures remained below their respective limits at all times. All applicable acceptance criteria were therefore met. The protection features identified in Section 2.4.1.1.1 provide mitigation for the loss of forced reactor coolant flow transients such that the above criteria are satisfied. Furthermore, the results and conclusions of the loss of flow analysis will be confirmed on a cycle-specific basis as part of the normal RSE process. 2.4.1.2 Conclusion The analyses of the decrease in forced reactor coolant flow event have been reviewed. It is concluded that the analyses have adequately accounted for plant operations at a nominal NSSS power of up to 3651 MWt, and were performed using acceptable analytical models. The review further concludes that the evaluation has demonstrated that the reactor protection and safety systems will continue to ensure that the specified acceptable fuel design limits and the RCS and MSS pressure limits will not be exceeded as a result of this event. Based on this, it is concluded that the plant will continue to meet the requirements of GDCs 10, 15, and 26. 2.4.1.3 References

1. Westinghouse Report WCAP-11397-P-A, "Revised Thermal Design Procedure," April 1989.
2. Westinghouse Report WCAP-14882-P-A, "RETRAN-02 Modeling and Qualification for Westinghouse Pressurized Water Reactor Non-LOCA Safety Analyses," April 1999.
3. Westinghouse Report WCAP-14565-P-A, "VIPRE-01 Modeling and Qualification for Pressurized Water Reactor Non-LOCA Thermal-Hydraulic Safety Analysis," October 1999.

2-184 WCAP-17658-NP September 2016 Licensing Report Revision 1-C Table 2.4.1-1 Time Sequence of Events - Loss of Forced Reactor Coolant Flow Case Event Time (seconds) Loss of Power to Two RCPs (PLOF) Flow Coastdown Begins 0.0 Reactor Coolant Low-Flow Trip Setpoint Reached 1.5 Rods Begin to Drop 2.5 Minimum DNBR Occurs 4.3 Loss of Power to All RCPs (CLOF) Flow Coastdown Begins 0.0 Rods Begin to Drop (1) 1.5 Minimum DNBR Occurs 3.5 5 Hz/sec Frequency Decay of the RCPs Power Supply (CLOF-UF) Frequency Decay Begins 0.0 Underfrequency Reactor Trip Setpoint Reached 0.6 Rods Begin to Drop 1.2 Minimum DNBR Occurs 3.3 Note: 1. UV reactor trip (rods begin to drop) is assumed to occur 1.5 seconds following the loss of bus voltage.

Table 2.4.1-2 Results - Loss of Forced Reactor Coolant Flow Minimum DNBR Limit Value Loss of Power to Two RCPs (PLOF) 1.82 1.52 Loss of Power to All RCPs (CLOF) 1.69 1.52 5 Hz/sec Frequency Decay of the RCPs Power Supply (CLOF-UF) 1.73 1.52 2-185 WCAP-17658-NP September 2016 Licensing Report Revision 1-C Figure 2.4.1-1. PLOF - Core Volumetric Flow Rate versus Time 2-186 WCAP-17658-NP September 2016 Licensing Report Revision 1-C Figure 2.4.1-2. PLOF - Loop Volumetric Flow Rates versus Time 2-187 WCAP-17658-NP September 2016 Licensing Report Revision 1-C Figure 2.4.1-3. PLOF - Nuclear Power versus Time 2-188 WCAP-17658-NP September 2016 Licensing Report Revision 1-C Figure 2.4.1-4. PLOF - Pressurizer Pressure versus Time 2-189 WCAP-17658-NP September 2016 Licensing Report Revision 1-C Figure 2.4.1-5. PLOF - Core Average Heat Flux versus Time 2-190 WCAP-17658-NP September 2016 Licensing Report Revision 1-C Figure 2.4.1-6. PLOF - Hot Channel Heat Flux versus Time 2-191 WCAP-17658-NP September 2016 Licensing Report Revision 1-C Figure 2.4.1-7. PLOF - Minimum DNBR versus Time 2-192 WCAP-17658-NP September 2016 Licensing Report Revision 1-C Figure 2.4.1-8. CLOF - Core Volumetric Flow Rate versus Time 2-193 WCAP-17658-NP September 2016 Licensing Report Revision 1-C Figure 2.4.1-9. CLOF - Loop Volumetric Flow Rates versus Time 2-194 WCAP-17658-NP September 2016 Licensing Report Revision 1-C Figure 2.4.1-10. CLOF - Nuclear Power versus Time 2-195 WCAP-17658-NP September 2016 Licensing Report Revision 1-C Figure 2.4.1-11. CLOF - Pressurizer Pressure versus Time 2-196 WCAP-17658-NP September 2016 Licensing Report Revision 1-C Figure 2.4.1-12. CLOF - Core Average Heat Flux versus Time 2-197 WCAP-17658-NP September 2016 Licensing Report Revision 1-C Figure 2.4.1-13. CLOF - Hot Channel Heat Flux versus Time 2-198 WCAP-17658-NP September 2016 Licensing Report Revision 1-C Figure 2.4.1-14. CLOF - Minimum DNBR versus Time 2-199 WCAP-17658-NP September 2016 Licensing Report Revision 1-C Figure 2.4.1-15. CLOF-UF - Core Volumetric Flow Rate versus Time 2-200 WCAP-17658-NP September 2016 Licensing Report Revision 1-C Figure 2.4.1-16. CLOF-UF - Loop Volumetric Flow Rates versus Time 2-201 WCAP-17658-NP September 2016 Licensing Report Revision 1-C Figure 2.4.1-17. CLOF-UF - Nuclear Power versus Time 2-202 WCAP-17658-NP September 2016 Licensing Report Revision 1-C Figure 2.4.1-18. CLOF-UF - Pressurizer Pressure versus Time 2-203 WCAP-17658-NP September 2016 Licensing Report Revision 1-C Figure 2.4.1-19. CLOF-UF - Core Average Heat Flux versus Time 2-204 WCAP-17658-NP September 2016 Licensing Report Revision 1-C Figure 2.4.1-20. CLOF-UF - Hot Channel Heat Flux versus Time 2-205 WCAP-17658-NP September 2016 Licensing Report Revision 1-C Figure 2.4.1-21. CLOF-UF - Minimum DNBR versus Time 2-206 WCAP-17658-NP September 2016 Licensing Report Revision 1-C

2.4.2 Reactor

Coolant Pump Shaft Seizure (Locked Rotor) and Shaft Break (USAR Sections 15.3.3 and 15.3.4) 2.4.2.1 Technical Evaluation 2.4.2.1.1 Introduction The event postulated is an instantaneous seizure of a RCP rotor or the sudden break of the RCP shaft. Flow through the affected reactor coolant loop is rapidly reduced, leading to initiation of a reactor trip on a low reactor coolant flow signal.

Following initiation of the reactor trip, heat stored in the fuel rods continues to be transferred to the coolant, causing the coolant to expand. At the same time, heat transfer to the shell side of the SGs is reduced, first because the reduced flow results in a decreased tube-side film heat transfer coefficient, and second because the temperature differential between the reactor coolant in the tubes and the shell-side fluid is decreased. The rapid expansion of the coolan t in the reactor core causes an insurge into the pressurizer and a pressure increase throughout the RCS. The insurge into the pressurizer compresses the steam volume, actuates the automatic spray system, opens the PORVs, and opens the PSVs, in that sequence. The PORVs are designed for reliable operation and are expected to function properly during the event. However, for conservatism, their pressure-reducing effect, as well as the pressure-reducing effect of the pressurizer spray, was not included in the analysis. The consequences of a locked rotor (that is, an instantaneous seizure of a pump shaft) are very similar to those of a pump shaft break. The initial rate of the reduction in coolant flow is slightly greater for the locked rotor event. However, with a broken shaft, the impeller could conceivably be free to spin in the reverse direction. The effect of reverse spinning is a reduced core flow when comp ared to the locked rotor scenario. The analysis considers only one scenario; it represents the most limiting (conservative) combination of conditions for the locked rotor and pump shaft break events. 2.4.2.1.2 Input Parameters, Assumptions, and Acceptance Criteria Input Parameters and Assumptions There were three locked rotor cases analyzed, with each being applicable to the WCGS: one for peak RCS pressure and PCT concerns with LOOP, one for peak RCS pressure and PCT concerns without LOOP, and a third to determine the percentage of rods-in-DNB. For the cases performed to evaluate peak RCS pressure and PCT concerns, one locked rotor and shaft break was simulated with all reactor coolant loops in operation; one of these cases accounted for a LOOP and the other considered a continued supply of offsite power. Inputs for these cases were designed to maximize the RCS pressure and cladding temperature transients; the STDP was applied for these cases. Initial core power, reactor coolant temperature, and pressurizer pressure were modeled to be at their maximum values consistent with full-power conditions, including allowances for calibration and instrument errors. The initial reactor coolant flow was the TDF. These inputs resulted in a conservative calculation of the coolant insurge into the pressurizer, which in turn resulted in a maximum calculated peak RCS pressure. The case that considered a LOOP conservatively modeled the intact RCPs as being tripped coincident with reactor trip.

2-207 WCAP-17658-NP September 2016 Licensing Report Revision 1-C The third case was run to confirm that the percentage of rods that experience DNB, also referred to as percentage of rods-in-DNB, with LOOP is less than that considered in the radiological analysis. As in the peak RCS pressure/PCT case, one locked rotor and shaft break was simulated with all reactor coolant loops in operation. Initial NSSS power was conservatively modeled to be at 3651 MWt, which includes all applicable uncertainties. The pressurizer pressure and T avg were modeled to be at their nominal values. The initial reactor coolant flow was the MMF. Uncertainties in initial pressure and temperature conditions were accounted for in the DNBR SAL value as described in the RTDP (Reference 1). A least negative MTC and a conservatively large (absolute value) Doppler-only power coefficient were modeled in the analysis. The negative reactivity from control rod insertion/scram was based on

4.0 percent

k/k trip reactivity from HFP conditions. Engineered safety systems (such as SI) are not required to function. No single active failure in any system or component required for mitigation will adversely affect the consequences of this event. Acceptance Criteria The RCP locked rotor/shaft break accident is classified as a Condition IV event as defined by the ANS's "Nuclear Safety Criteria for the Design of Stationary Pressurized Water Reactor Plants," ANSI N18.2-1973. An RCP locked rotor/shaft break results in a rapid reduction in forced reactor coolant loop flow that increases the reactor coolant temperature and subsequently causes the fuel cladding temperature and RCS pressure to increase. The following items summarize the acceptance criteria for the analysis of this event: The potential for fuel cladding damage due to the combination of high cladding temperature and the exothermic zirconium oxidation process (zirconium-water reaction) provides a failure mechanism that could affect the core cooling capability. With respect to fuel cladding temperature, the maximum cladding temperature at the core hot spot must remain below 2700°F, and the zirconium-water reaction at the core hot spot must be less than 16 percent by weight. Satisfying these criteria conservatively ensures that the core will remain in place and geometrically intact with no loss of core cooling capability. Pressures in the RCS and MSS are to be maintained below 110 percent of the respective design pressures. With respect to the MSS pressure transient, this event is bounded by the LOL/TT event discussed in Section 2.3.1, "Loss of External Electrical Load, Turbine Trip, Inadvertent Closure of a Main Steam Isolation Valve, and Loss of Condenser Vacuum." This is because the turbine trip occurs later, coincident with reactor trip, in this event compared to the LOL/TT event where the turbine trip is the initiating fault. The greater mismatch between the primary-side power and secondary-side power makes the MSS pressure transient more severe for the LOL/TT event.

Thus, the peak MSS pressure is not reported for the locked rotor analysis. Because it is a Condition IV event, the locked rotor/shaft break transient is allowed to result in a minimal release of radioactive material such that the calculated doses at the site boundary are within acceptable limits (see Section 4.3.5 of Enclosure IV of this LAR). For dose considerations, fuel failure is conservatively assumed for all fuel rods that are shown to experience DNB. In the dose analysis (see Section 4.3.5 of Enclosure IV of this LAR), 5 percent of the fuel rods were assumed to have failed and 2-208 WCAP-17658-NP September 2016 Licensing Report Revision 1-C released radioactive material as a result of a locked rotor/shaft break event. Theref ore, the total percentage of rods-in-DNB must be less than the 5 percent value used in the dose analysis. The acceptance criteria identified above are based on meeting the relevant regulatory requirements of 10 CFR 50, Appendix A, "General Design Criteria for Nuclear Power Plants." Brief discussions of the specific GDCs that are related to the locked rotor/shaft break acceptance criteria are provided as follows. GDC 27 (Combined Reactivity Control Systems Capability) requires that the reactivity control systems be designed to have a combined capability, in conjunction with poison addition by the ECCS, of reliably controlling reactivity changes under postulated accident conditions, with appropriate margin for stuck rods, to assure the capability to cool the core is maintained. In the locked rotor event analysis, the applied trip reactivity accounts for the highest worth rod being stuck fully out of the core, and the capability to cool the core is demonstrated by showing that the limits for fuel cladding temperature, zirconium-water reaction, and RCS pressure are met. GDC 28 (Reactivity Limits) requires that the reactivity control systems be designed to assure that the effects of postulated reactivity accidents can neither result in damage to the RCPB greater than limited local yielding, nor disturb the core, its support structures, or other reactor vessel internals so as to significantly impair the capability to cool the core. For the locked rotor event, this is shown to be met by demonstrating that the limits for fuel cladding temperature, zirconium-water reaction, and RCS pressure are met. GDC 31 (Fracture Prevention of Reactor Coolant Pressure Boundary) requires that the RCPB be designed with sufficient margin to assure that, under specified conditions, it will behave in a non-brittle manner and the probability of a rapidly propagating fracture is minimized. For the locked rotor event, this is shown to be met by demonstrating that the RCS pressure limit is met. 2.4.2.1.3 Description of Analyses and Evaluations The locked rotor transient was analyzed with two primary computer codes. First, the RETRAN computer code (Reference 2) was used to calculate the loop and core flows during the transient, the time of reactor trip based on the calculated flows, the nuclear power transient, and the primary system pressure and temperature transients. The VIPRE code (Reference 3) was then used to calculate the PCT using the nuclear power and RCS temperature (enthalpy), pressure, and flow from RETRAN. For the peak RCS pressure evaluation, the initial pressure was conservatively estimated to be 50 psi above the nominal pressure of 2250 psia, which accounts for initial condition uncertainties in the pressurizer pressure measurement and control channels. This was done to obtain the highest possible rise in the coolant pressure during the transient. The pressure response reported in Table 2.4.2-2 corresponds to the location in the RCS that has the maximum pressure, that is, in the lower plenum of the reactor vessel. No credit was taken for the pressure-reducing effect of the pressurizer PORVs, pressurizer spray, or steam dump. Although these systems are expected to function and would result in a lower peak pressure, an additional degree of conservatism was provided by not including their effect. The PSV model included a +2 percent valve opening tolerance above the nominal setpoint of 2460 psig plus a 1 percent set 2-209 WCAP-17658-NP September 2016 Licensing Report Revision 1-C pressure shift and a 1.153-second purge time delay to account for the existence of PSV water-filled loop seals, as described in Reference 4. Post-DNB heat transfer is limited to film boiling, and the film boiling coefficient was calculated in the VIPRE code (Reference 3) using the Bishop-Sandberg-Tong heat transfer correlation. The fluid properties were evaluated at film temperature. The code calculated the film coefficient at every time step based upon the actual heat transfer conditions at the time. The nuclear power, system pressure, bulk density, and RCS flow rate as a function of time were based on the RETRAN results.

The magnitude and time dependence of the heat transfer coefficient between the fuel and cladding (gap coefficient) has a pronounced influence on the thermal results. The larger the value of the gap coefficient, the more heat is transferred between the pellet and cladding. Based on investigations on the effect of the gap coefficient upon the maximum cladding temperature during the transient, the gap coefficient was assumed to increase from a steady-state value consistent with the initial fuel temperature to approximately 10,000 Btu/hr-ft 2-°F at the initiation of the transient. Therefore, the large amount of energy stored in the fuel because of the small initial gap coefficient was released to the cladding at the initiation of the transient. The zirconium-water reaction can become significant above 1800°F (cladding temperature). The Baker-Just parabolic rate equation was used to define the rate of zirconium-water reaction. The effect of the zirconium-water reaction was included in the calculation of the PCT temperature transient. 2.4.2.1.4 Results With respect to the peak RCS pressure, PCT and zirconium-water reaction, the analysis demonstrated that all applicable acceptance criteria were met for the WCGS. The calculated sequence of events is presented in Table 2.4.2-1 for the locked rotor/shaft break event. The results of the calculations (peak pressure, PCT and zirconium-water reaction) for the limiting case (with a LOOP) are summarized in Table 2.4.2-2. The transient results for the peak pressure/PCT cases (with a LOOP and without a LOOP) are provided in Figures 2.4.2-1 through 2.4.2-6, and the transient results for the rods-in-DNB case are provided in Figures 2.4.2-7 through 2.4.2-12. The locked rotor/shaft break analysis performed for the WCGS demonstrated that the PCT calculated for the hot spot remained considerably less than 2700°F, and the amount of zirconium-water reaction was small. Under such conditions, the core would remain in place and intact with no loss of core cooling capability. The analysis also confirmed that the peak RCS pressure reached during the transient was less than the acceptance limit, and thereby, the integrity of the primary coolant system was demonstrated. The total number of rods-in-DNB was less than 5 percent. The low reactor coolant flow reactor trip function provided mitigation for the locked rotor/shaft break transient such that the above criteria were satisfied. Furthermore, the results and conclusions of this analysis will be confirmed on a cycle-specific basis as part of the normal RSE process.

2-210 WCAP-17658-NP September 2016 Licensing Report Revision 1-C 2.4.2.2 Conclusion The analyses of the sudden decrease in core coolant flow due to a locked rotor/shaft break event have been examined. It is concluded that the analyses have adequately accounted for plant operation at the analyzed power level and were performed using acceptable analytical models. It is further concluded that the evaluation has demonstrated that the reactor protection and safety systems will continue to ensure that the ability to insert control rods is maintained, the RCS pressure limit will not be exceeded, the RCPB will behave in a nonbrittle manner, the probability of propagating fracture of the RCPB is minimized, and adequate core cooling will be provided. Based on this, it is concluded that the plant will continue to meet the requirements of GDCs 27, 28, and 31. 2.4.2.3 References

1. Westinghouse Report WCAP-11397-P-A, "Revised Thermal Design Procedure," April 1989.
2. Westinghouse Report WCAP-14882-P-A, "RETRAN-02 Modeling and Qualification for Westinghouse Pressurized Water Reactor Non-LOCA Safety Analyses," April 1999.
3. Westinghouse Report WCAP-14565-P-A, "VIPRE-01 Modeling and Qualification for Pressurized Water Reactor Non-LOCA Thermal-Hydraulic Safety Analysis," October 1999.
4. Westinghouse Report WCAP-12910, Rev. 1-A, "Pressurizer Safety Valve Set Pressure Shift,"

May 1993.

2-211 WCAP-17658-NP September 2016 Licensing Report Revision 1-C Table 2.4.2-1 Time Sequence of Events - RCP Locked Rotor/Shaft Break Case Event Time (seconds) Locked Rotor/Shaft Break - Overpressurization/PCT with LOOP Rotor on One Pump Locks or the Shaft Breaks 0.0 Reactor Coolant Low-Flow Reactor Trip Setpoint Reached 0.04 Rods Begin to Drop 1.04 Undamaged RCPs Lose Power and Begin to Coast Down (1) 1.04 Maximum Cladding Temperature Occurs 3.90 Maximum RCS Pressure Occurs 4.75 Locked Rotor/Shaft Break -

Overpressurization/PCT without LOOP Rotor on One Pump Locks or the Shaft Breaks 0.0 Reactor Coolant Low-Flow Reactor Trip Setpoint Reached 0.04 Rods Begin to Drop 1.04 Maximum Cladding Temperature Occurs 3.50 Maximum RCS Pressure Occurs 4.08 Locked Rotor/Shaft Break -

Rods-in-DNB Rotor on One Pump Locks or the Shaft Breaks 0.0 Reactor Coolant Low-Flow Reactor Trip Setpoint Reached 0.04 Rods Begin to Drop 1.04 Undamaged RCPs Lose Power and Begin to Coast Down (1) 1.05 Minimum DNBR Occurs 3.20 Note: 1. The undamaged RCPs were modeled to trip coincident with rod motion, but slight differences, which are considered to be negligible, occur because of the RETRAN code trip logic.

2-212 WCAP-17658-NP September 2016 Licensing Report Revision 1-C Table 2.4.2-2 Limiting Results - RCP Locked Rotor/Shaft Break Criterion Analysis Value Limit PCT at Core Hot Spot (°F) 1786.6 2700 Maximum Zirconium-Water Reaction at Core Hot Spot (%) 0.29 16.0 Maximum RCS Pressure (psia) 2675.1 2750 Maximum Number of Rods-in-DNB (%) 0.7 5 2-213 WCAP-17658-NP September 2016 Licensing Report Revision 1-C Figure 2.4.2-1. RCP Locked Rotor/Shaft Break Overpressurization/PCT Case Core Volumetric Flow Rates versus Time 2-214 WCAP-17658-NP September 2016 Licensing Report Revision 1-C Figure 2.4.2-2. RCP Locked Rotor/Shaft Break Overpressurization/PCT Case Faulted Loop Volumetric Flow Rates versus Time 2-215 WCAP-17658-NP September 2016 Licensing Report Revision 1-C Figure 2.4.2-3. RCP Locked Rotor/Shaft Break Overpressurization/PCT Case Maximum RCS Pressure versus Time 2-216 WCAP-17658-NP September 2016 Licensing Report Revision 1-C Figure 2.4.2-4. RCP Locked Rotor/Shaft Break Overpressurization/PCT Case Nuclear Power versus Time 2-217 WCAP-17658-NP September 2016 Licensing Report Revision 1-C Figure 2.4.2-5. RCP Locked Rotor/Shaft Break Overpressurization/PCT Case Core Heat Flux versus Time 2-218 WCAP-17658-NP September 2016 Licensing Report Revision 1-C Figure 2.4.2-6. RCP Locked Rotor/Shaft Break Overpressurization/PCT Case PCT versus Time 2-219 WCAP-17658-NP September 2016 Licensing Report Revision 1-C Figure 2.4.2-7. RCP Locked Rotor/Shaft Break Rods-in-DNB Case Core Volumetric Flow Rate versus Time 2-220 WCAP-17658-NP September 2016 Licensing Report Revision 1-C Figure 2.4.2-8. RCP Locked Rotor/Shaft Break Rods-in-DNB Case Loop Volumetric Flow Rates versus Time 2-221 WCAP-17658-NP September 2016 Licensing Report Revision 1-C Figure 2.4.2-9. RCP Locked Rotor/Shaft Break Rods-in-DNB Case Pressurizer Pressure versus Time 2-222 WCAP-17658-NP September 2016 Licensing Report Revision 1-C Figure 2.4.2-10. RCP Locked Rotor/Shaft Break Rods-in-DNB Case Nuclear Power versus Time 2-223 WCAP-17658-NP September 2016 Licensing Report Revision 1-C Figure 2.4.2-11. RCP Locked Rotor/Shaft Break Rods-in-DNB Case Core Average Heat Flux versus Time 2-224 WCAP-17658-NP September 2016 Licensing Report Revision 1-C Figure 2.4.2-12. RCP Locked Rotor/Shaft Break Rods-in-DNB Case Hot Channel Heat Flux versus Time 2-225 WCAP-17658-NP September 2016 Licensing Report Revision 1-C

2.5 REACTIVITY

AND POWER DISTRIBUTION ANOMALIES

2.5.1 Uncontrolled

Rod Cluster Control Assembly Bank Withdrawal from a Subcritical or Low Power Startup Conditi on (USAR Section 15.4.1) 2.5.1.1 Technical Evaluation The specific acceptance criteria applied for this event are as follows: The DNBR should remain above the applicable 95/95 DNBR limits at all times during the transient. Demonstrating that the DNBR limits are met satisfies the requirements of GDC 10. Per GDC 20, the protection system should be designed to automatically initiate the operation of appropriate systems, including the reactivity control systems, to ensure that specified acceptable fuel design limits are not exceeded as a result of anticipated operational occurrences and to sense accident conditions and initiate the operation of safety-related systems and components. For this event, protection is provided via the high neutron flux (low setting). GDC 25 requires that the protection system is designed to ensure that specified acceptable fuel design limits are not exceeded for any single malfunction of the reactivity control systems, such as accidental withdrawal (not ejection or dropout) of control rods. Demonstrating that the fuel design limits (that is, DNBR) are met satisfies the requirements of GDC 25. The following discussion demonstrates that all applicable acceptance criteria are me t for this event for the WCGS. 2.5.1.1.1 Introduction An uncontrolled RCCA withdrawal incident is defined as an uncontrolled addition of reactivity to the reactor core by withdrawal of RCCAs, resulting in a power excursion. Although the probability of a transient of this type is extremely low, such a transient could be caused by a malfunction of the reactor control rod drive system. This could occur with the reactor either subcritical or at power. The "at power" occurrence is discussed in Section 2.5.2. The uncontrolled RCCA withdrawal from a subcritical condition is classified as a Condition II event, a fault of moderate frequency, as defined by the ANS's "Nuclear Safety Criteria for the Design of Stationary Pressurized Water Reactor Plants," ANSI N18.2-1973. During startup, when bringing the reactor from a shutdown condition to a low-power level, reactivity is added at a prescribed and controlled rate by RCCA withdrawal or by reducing the core boron concentration. RCCA motion can cause much faster changes in reactivity than can result from changing boron concentration. The rods are physically prevented from withdrawing in other than their respective banks. Power supplied to the rod banks is controlled such that no more than two banks can be withdrawn at any time. The control rod drive mechanism (CRDM) is of the magnetic latch type and the coil actuation is sequenced to provide variable speed rod travel. The maximum reactivity insertion rate is analyzed in the detailed plant analysis 2-226 WCAP-17658-NP September 2016 Licensing Report Revision 1-C assuming the simultaneous withdrawal of the combination of the two rod banks with the maximum combined worth at maximum speed. The neutron flux response to a continuous reactivity insertion is characterized by a very fast flux increase terminated by the reactivity feedback effect of the negative Doppler coefficient. This self-limitation of the initial power increase results from a fast negative fuel temperature feedback (Doppler effect) and is of prime importance during a startup transient because it limits the power to an acceptable level prior to protection system action. After the initial power increase, the nuclear power is momentarily reduced and then, if the incident is not terminated by a reactor trip, the nuclear power increases again, but at a much slower rate.

Should a continuous RCCA withdrawal be initiated, the transient will be terminated by one of the following automatic protective functions: Source range neutron flux reactor trip - actuated when either of two independent source range channels indicates a flux level above a preselected, manually adjustable setpoint. This trip function may be manually bypassed only after an intermediate range neutron flux channel indicates a flux level above the source range cutoff power level. It is automatically reinstated when both intermediate channels indicate a flux level below the source range cutoff power level. Intermediate range neutron flux reactor trip - actuated when either of two independent intermediate range channels indicates a flux level above a preselected, manually adjustable setpoint. This trip function may be manually bypassed when two of the four power range channels are reading above approximately 10 percent of full power and is automatically reinstated when three of the four channels indicate a power level below this value. Power range neutron flux reactor trip (low setting) - actuated when two of the four power range channels indicate a power level above approximately 25 percent of full power. This trip function may be manually bypassed when two of the four power range channels indicate a power level above approximately 10 percent of full power. This trip function is automatically reinstated when three of the four channels indicate a power level below 10 percent power. Power range neutron flux reactor trip (high setting) - actuated when two out of the four power range channels indicate a power level above approximately 109 percent of full power. This trip function is active in Modes 1 and 2, when the low setting is bypassed. High nuclear flux rate reactor trip - actuated when the positive rate of change of neutron flux on two out of four nuclear power range channels indicates a rate above the preset nominal setpoint of approximately 4 percent of full power in 2 seconds. This trip function is always active in Modes 1 and 2, but it is not explicitly modeled in the analysis of this event. In addition, control rod stops on high intermediate range flux level (one out of two) and high power range flux level (one out of four) serve to discontinue rod withdrawal and prevent the need to actuate the intermediate range flux level trip and the power range flux level trip, respectively. This analysis credits the power range neutron flux trip (low setting) to initiate the reactor trip.

2-227 WCAP-17658-NP September 2016 Licensing Report Revision 1-C 2.5.1.1.2 Input Parameters, Assumptions, and Acceptance Criteria The accident analysis uses the STDP methodology because the conditions resulting from the transient are outside the range of applicability of the RTDP methodology. To obtain conservative results for the analysis of the uncontrolled RCCA bank withdrawal from subcritical event, the following input parameters and initial conditions are modeled: The magnitude of the nuclear power peak reached during the initial part of the transient, for any given reactivity insertion rate, is strongly dependent on the Doppler-only power defect. Therefore, a conservatively low absolute value is used (1007 pcm) to maximize the nuclear power transient. A most-positive MTC (+6 pcm/°F) is used because this yields the maximum rate of power increase. The contribution of the moderator temperature coefficient is negligible during the initial part of the transient because the heat transfer time constant between the fuel and moderator is much longer than the nuclear flux response time constant. However, after the initial neutron flux peak, the succeeding rate of power increase is affected by the moderator reactivity coefficient. The analysis assumes the reactor to be at HZP conditions with a nominal no-load temperature of 557°F. This assumption is more conservative than that of a lower initial system temperature (that is, shutdown conditions). The higher initial system temperature yields a larger fuel-to-moderator heat transfer coefficient, a larger specific heat of the moderator and fuel, and a less-negative (smaller absolute magnitude) Doppler defect.

The less-negative Doppler defect reduces the Doppler feedback effect, thereby increasing the neutron flux peak. The high neutron flux peak combined with a high fuel specific heat and larger heat transfer coefficient yields a larger peak heat flux. The analysis assumes the initial effective multiplication factor (Keff) to be 1.0 because it maximizes the peak neutron flux and results in the most severe nuclear power transient. Reactor trip is assumed on power range high neutron flux (low setting). A conservative combination of instrumentation error, setpoint error, delay for trip signal actuation, and delay for control rod assembly release is modeled. The analysis assumes a 10 percent uncertainty in the power range flux trip setpoint (low setting), increasing it from the nominal value of 25 percent of full power to 35 percent of full power. A delay time of 0.5 seconds is assumed for trip signal actuation and control rod assembly release. No credit is taken for the source range or intermediate range protection. During the transient, the increase in nuclear power is so rapid that the effect of errors in the trip setpoint on the actual time at which the rods release is negligible. In addition, the total reactor trip reactivity is based on the assumption that the highest worth RCCA is stuck in its fully withdrawn position. The maximum positive reactivity insertion rate assumed is greater than that for the simultaneous withdrawal of the two sequential control banks having the greatest combined worth at the maximum rod withdrawal speed. The assumed reactivity insertion rate is 75 pcm/sec, which is based on a rod worth of 100 pcm/inch and a maximum rod speed of 72 steps per minute.

2-228 WCAP-17658-NP September 2016 Licensing Report Revision 1-C The DNB analysis assumes the most limiting axial and radial power shapes possible during the fuel cycle associated with having the two highest combined worth banks in their highest worth position. The analysis assumes the initial power level to be below the power level expected for any shutdown condition (10

-9 fraction of nominal power). The combination of highest reactivity insertion rate and low initial power produces the highest peak heat flux. The analysis assumes two of the four RCPs to be in operation. This is conservative with respect to the DNB transient. This accident analysis uses the STDP methodology. The use of the STDP stipulates that the RCS flow rates will be based on a fraction of the thermal design flow for two pumps operating. Because the event is analyzed from HZP, the steady-state non-RTDP uncertainties are not considered in defining the initial conditions. The uncontrolled RCCA bank withdrawal from subcritical event is considered an ANS Condition II event, a fault of moderate frequency, and is analyzed to show that the core and RCS are not adversely affected by the event. This is demonstrated by showing that the DNB design basis is not violated and subsequently that there is little likelihood of core damage. It must also be shown that the peak hot spot fuel centerline temperature remains within the acceptable limit (4800°F), although for this event, the heatup is relatively non-limiting. 2.5.1.1.3 Description of Analyses and Evaluations The analysis of the uncontrolled RCCA bank withdrawal from subcritical conditions is performed in three stages. First, a spatial neutron kinetics computer code, TWINKLE (Reference 1), is used to calculate the core average nuclear power transient, including the various core feedback effects; that is, Doppler and moderator reactivity. Next, the FACTRAN computer code (Reference 2) uses the average nuclear power calculated by TWINKLE and performs a fuel rod transient heat transfer calculation to determine the core average heat flux and hot spot fuel temperature transients. Finally, the core average heat flux calculated by FACTRAN is used in the VIPRE computer code (Reference 3) for transient DNBR calculations. 2.5.1.1.4 Results The analysis shows that all applicable acceptance criteria are met for the WCGS. The minimum DNBR never decreases below the applicable limit values and the peak fuel centerline temperature is 2342°F. The peak temperatures are well below the minimum temperature at which fuel melting would be expected (4800°F). Figure 2.5.1-1 shows the nuclear power transient, Figure 2.5.1-2 shows the core average heat flux transient, and Figures 2.5.1-3 a nd 2.5.1-4 show the fuel average and cladding surface temperature transients at the hot spot. The time sequence of events for both cases is presented in Table 2.5.1-1.

2-229 WCAP-17658-NP September 2016 Licensing Report Revision 1-C In the event of an RCCA withdrawal event from subcritical conditions, the core and the RCS are not adversely affected because the combination of thermal power and coolant temperature results in a minimum DNBR greater than the SAL value. Furthermore, because the maximum fuel temperatures predicted to occur during this event are much less than those required for fuel melting to occur, no fuel damage is predicted as a result of this transient. Cladding damage is also precluded. 2.5.1.2 Conclusion Based on a review of the analysis of the uncontrolled RCCA withdrawal from a subcritical or low-power startup condition, it is concluded that the analysis adequately accounted for plant operation at the stated power level and were performed using acceptable analytical models. It is further concluded that the analysis demonstrates that the reactor protection and safety systems will continue to ensure that the specified acceptable fuel design limits are not exceeded. Based on this, it is concluded that the plant will continue to meet the requirements of GDCs 10, 20, and 25. 2.5.1.3 References

1. Westinghouse Report WCAP-7979-P-A (Proprietary) and WCAP-8028-A (Non-Proprietary), "TWINKLE - A Multi-dimensional Neutron Kinetics Computer Code," January 1975.
2. Westinghouse Report WCAP-7908-A, "FACTRAN - A FORTRAN IV Code for Thermal Transients in a UO 2 Fuel Rod," December 1989.
3. Westinghouse Report WCAP-14565-P-A, "VIPRE-01 Modeling and Qualification for Pressurized Water Reactor Non-LOCA Thermal-Hydraulic Safety Analysis," October 1999.

2-230 WCAP-17658-NP September 2016 Licensing Report Revision 1-C Table 2.5.1-1 Time Sequence of Events - Uncontrolled RCCA Bank Withdrawal from a Subcritical Condition Event Time (seconds) Initiation of Uncontrolled Rod Withdrawal 0.0 Power Range High Neutron Flux Low Setpoint is Reached 10.43 Peak Nuclear Power Occurs 10.57 Rod Motion Begins 10.93 Peak Heat Flux Occurs (0.3642) 12.73 Minimum DNBR Occurs (1.66) 12.73 Peak Average Cladding Temperature Occurs (683°F) 13.06 Peak Average Fuel Temperature Occurs (1934°F) 13.26 Peak Fuel Centerline Temperature Occurs (2342°F) 13.71 2-231 WCAP-17658-NP September 2016 Licensing Report Revision 1-C Figure 2.5.1-1. Rod Withdrawal from Subcritical - Nuclear Power versus Time 2-232 WCAP-17658-NP September 2016 Licensing Report Revision 1-C Figure 2.5.1-2. Rod Withdrawal from Subcritical - Core Average Heat Flux versus Time 2-233 WCAP-17658-NP September 2016 Licensing Report Revision 1-C Figure 2.5.1-3. Rod Withdrawal from Subcritical - Fuel Average Temperature versus Time 2-234 WCAP-17658-NP September 2016 Licensing Report Revision 1-C Figure 2.5.1-4. Rod Withdrawal from Subcritical - Cladding Surface Temperature versus Time 2-235 WCAP-17658-NP September 2016 Licensing Report Revision 1-C

2.5.2 Uncontrolled

Rod Cluster Control Assembly Bank Withdrawal at Power (USAR Section 15.4.2) 2.5.2.1 Technical Evaluation 2.5.2.1.1 Introduction An uncontrolled RCCA bank withdrawal at power that causes an increase in core heat flux can result from faulty operator action or a malfunction in the rod control system. Immediately following the initiation of the transient, the SG heat removal rate lags behind the core power generation rate until the SG pressure reaches the setpoint of the SG relief or safety valves. This imbalance between heat removal and heat generation rate causes the reactor coolant temperature to increase. Unless terminated, the power mismatch and resultant coolant temperature increase could eventually result in a violation of the DNBR SAL, fuel centerline melt, and/or RCS overpressurization. Therefore, to avoid core damage, the reactor protection system is designed to automatically terminate any such transient before the DNBR falls below the limit value, or the fuel rod linear heat generation rate (kW/ft) limit is exceeded. The reactor protection system and PSVs are designed to preclude exceeding the RCS pressure boundary safety limit. The automatic features of the reactor protection system that prevent core damage and preclude RCS overpressurization during an RCCA bank withdrawal incident at power include the following: Power range neutron flux instrumentation actuates a reactor trip if two-out-of-four channels exceed an overpower setpoint. Reactor trip actuates if any two-out-of-four cha nnels exceed the power ra nge neutron flux high positive rate setpoint. Reactor trip actuates if any two-out-of-four OTT channels exceed the corresponding setpoint. This setpoint is automatically varied with axial power distribution, coolant average temperature, and pressure to help protect the DNB design basis. Reactor trip actuates if any two-out-of-four OPT channels exceed the corresponding setpoint. This setpoint is capable of being automatically varied with axial power imbalance to help ensure that the allowable heat generation rate (kW/ft) is not exceeded. A high pressurizer pressure reactor trip actuates if any two-out-of-four pressure channels exceed the corresponding setpoint, which is set at a fixed point. This pressure setpoint is less than the set

pressure for the PSVs. MSSVs can open for this event and provide additional steam flow. A high pressurizer water level reactor trip actuates if any two-out-of-three channels exceed the trip setpoint, which is set at a fixed value, when the reactor power is above approximately 10 percent (Permissive P-7).

2-236 WCAP-17658-NP September 2016 Licensing Report Revision 1-C In addition to the above listed automatic features, there are the following RCCA withdrawal blocks: Power range neutron flux (one-out-of-four power range) OPT (two-out-of-four) OTT (two-out-of-four) 2.5.2.1.2 Input Parameters, Assumptions, and Acceptance Criteria A number of cases were analyzed assuming a range of reactivity insertion rates for both minimum and maximum reactivity feedback cond itions at various power levels for both DNB and RCS overpressure considerations. The cases presented below are representative for this event. For DNB considerations, the following assumptions were made for the analysis of the uncontrolled RCCA bank withdrawal at power transient in order to obtain conservative results with respect to core damage: This transient was analyzed with the RTDP (Reference 1). Initial RCS pressure and temperature were assumed to be at their nominal values. An initial NSSS power of 3651 MWt, which includes all applicable uncertainties, was modeled. MMF was also modeled. Uncertainties in initial conditions, with the exception of power, were included in the DNBR SAL as described in the RTDP. For reactivity coefficients, two sets were analyzed.

- Minimum reactivity feedback: A least negative or positive value of the MTC of reactivity is assumed corresponding to the beginning of core life. A conservatively small (in absolute magnitude) value of the Doppler coefficient is assumed.

- Maximum reactivity feedback: A conservatively large positive moderator density coefficient and a large (in absolute magnitude) negative Doppler coefficient are assumed. The reactor trip on power range neutron flux (high setpoint) was assumed to be actuated at the SAL of 118 percent of the analyzed full power level. The OTT and OPT trips included all adverse instrumentation and setpoint errors, and the delays for the trip signal actuation were assumed at their maximum values. The RCCA trip insertion characteristic was based on the assumption that the highest-worth RCCA was stuck in its fully-withdrawn position. A range of reactivity insertion rates was examined. The maximum positive reactivity insertion rate was greater than that which would be obtained from the simultaneous withdrawal of the two control rod banks having the maximum combined worth at a conservative speed (48.125 inches/minute, which corresponds to 77 steps/minute).

2-237 WCAP-17658-NP September 2016 Licensing Report Revision 1-C To be conservative with respect to DNB, the pressurizer sprays and relief valves were assumed operational because they limit the reactor coolant pressure increase. Power levels of 10, 60, and 100 percent of the assumed NSSS power were considered. For the RCS overpressure analysis, the preceding assumptions still apply with the following differences in order to obtain conservative results with respect to RCS overpressurization: This case is analyzed with the STDP. Initial RCS pressure and temperature were assumed to be within their respective allowable operating ranges with uncertainties applied in the conservative directions. As was done in the DNB case, an NSSS power of 3651 MWt, which includes all applicable uncertainties, was modeled. TDF was also modeled. Minimum reactivity feedback conditions were modeled. The pressurizer sprays were not modeled because operation of the pressurizer spray valves would minimize the pressure increase during the transient. Ranges of initial power levels (from 8 to 100 percent of the analyzed power level) and reactivity insertion rates (1 to 110 pcm/sec) were analyzed. The reactor trip on power range neutron flux high positive rate trip was assumed to be actuated at a conservative rate setpoint of 6.9 percent of the analyzed power level, with a conservative rate time constant and delay time. The PSVs were modeled with a positive set pressure tolerance (2 percent) applied to conservatively increase the opening pressure. In a ddition, this case includes a 1 percent setpoint shift and a 1.153-second purge time delay to account for the existence of PSV water-filled loop seals, as described in Reference 2. The pressurizer PORVs were not modeled because their operation would minimize the pressure increase during the transient. The MSSVs were modeled with bounding opening pressures in order to prolong the mismatch between core heat generation and secondary heat removal capability. Based on its frequency of occurrence, the uncontrolled RCCA bank withdrawal at power transient is considered to be a Condition II event as defined by the ANS's "Nuclear Safety Criteria for the Design of Stationary Pressurized water Reactor Plants," ANSI N18.2-1973. The following items summarize the acceptance criteria associated with the analysis of this event: Pressures in the RCS and MSS must remain less than 110 percent of the respective design pressures. With respect to peak MSS pressures, the RCCA withdrawal at power event is bounded by the LOL/TT event described in Section 2.3.1, "Loss of External Electrical Load, Turbine Trip, Inadvertent Closure of Main Steam Isolation Valves, Loss of Condenser Vacuum and Other Events Resulting in Turbine Trip," in which assumptions are made to conservatively calculate the 2-238 WCAP-17658-NP September 2016 Licensing Report Revision 1-C MSS pressure transients. For the LOL/TT event, the turbine trip is the initiating incident that maximizes the resultant power mismatch between the primary and secondary sides, and the resultant temperature and pressure transients of the MSS are always more severe for LOL/TT events than for RCCA withdrawal at power events. Based on this, no explicit calculation of maximum MSS pressure is performed for this event. Fuel cladding integrity must be maintained by ensuring that the DNBR remains above the 95/95 DNBR limit. In addition, it has been historical practice to assume that fuel failure will occur if centerline melting takes place. Therefore, the analysis evaluates whether the peak linear heat generation rate exceeds the value that would cause fuel centerline melt. For the WCGS, this is met by ensuring that the peak core average heat flux does not exceed 121 percent of the analyzed full power level. The acceptance criteria identified above are based on meeting the relevant regulatory requirements of 10 CFR 50, Appendix A, "General Design Criteria for Nuclear Power Plants." Brief discussions of the specific GDCs that are related to the uncontrolled RCCA bank withdrawal at power acceptance criteria are provided as follows. GDC 10 (Reactor Design) requires that the reactor core and associated coolant, control, and protection systems be designed with appropriate margin so specified acceptable fuel design limits are not exceeded during any condition of normal operation, including anticipated operational occurrences. For the RCCA bank withdrawal at power event, this is shown to be met by demonstrating that the fuel damage criterion is satisfied. GDC 15 (RCS Design) requires that the RCS and associated auxiliary, control, and protection systems be designed with sufficient margin so design conditions of the RCPB are not exceeded during any condition of normal ope ration, including anticipated ope rational occurrences. For the RCCA bank withdrawal at power event, this is shown to be met by demonstrating that the peak RCS pressure is less than 110 percent of the design pressure. GDC 26 (Reactivity Control System Redundancy and Capability) requires the use of control rods capable of reliably controlling reactivity changes with appropriate margin for malfunctions like stuck rods so that specified acceptable fuel design limits are not exceeded under conditions of normal operation, including anticipated operational occurrences. For the RCCA bank withdrawal at power event, which results in a reactor trip, this is shown to be met by demonstrating that the fuel damage criterion is satisfied.

The protection features presented in subsection 2.5.2.1.1 provide mitigation of the uncontrolled RCCA bank withdrawal at power transient such that the above criteria are satisfied.

2-239 WCAP-17658-NP September 2016 Licensing Report Revision 1-C 2.5.2.1.3 Description of Analyses and Evaluations The purpose of this analysis was to demonstrate the manner in which the protection functions described above actuate for various combinations of reactivity insertion rates and initial conditions. Insertion rate and initial conditions determined which trip function actuated first. The uncontrolled RCCA bank withdrawal at power event was analyzed with the RETRAN computer code (Reference 3) to demonstrate the manner in which the previously described protection functions provide adequate protection from core damage. The RETRAN model simulates the core neutron kinetics, RCS, pressurizer, pressurizer relief and safety valves, pressurizer pressure control systems, SGs, and MSSVs.

The code computes pertinent plant variables, including temperatures, pressures, power level, and core boron concentration. For the most limiting case analyzed, a detailed DNBR evaluation using the detailed T/H digital computer code, VIPRE (Reference 4), was used to determine if the DNB design basis was met. An analysis to confirm that the RCS pressure safety limit is protected was performed using the LOFTRAN code (Reference 5). For this analysis, numerous cases were examined to determine the set of conditions (power, conservative treatment of initial condition uncertainties, reactivity insertion rates, etc.) that resulted in the most limiting peak RCS pressure. As discussed in WCAP-14882-P-A (Reference 3), the RETRAN and LOFTRAN codes are essentially equivalent. However, the LOFTRAN code is better suited for running a large number of cases; as such, it is the preferred transient analysis code for addressing this RCS pressure acceptance criterion. The LOFTRAN code has l ong been an approved transient analysis code for non-LOCA analyses performed by Westinghouse, and has previously been used to perform RCCA withdrawal at power RCS overpressurization analyses for plants that otherwise utilize the RETRAN code for the DNB analyses. 2.5.2.1.4 Results Figures 2.5.2-1 through 2.5.2-3 sh ow the transient response for a rapid uncontrolled RCCA bank withdrawal incident (110 pcm/sec) starting from 100 percent power with minimum reactivity feedback. The neutron flux level in the core rises rapidly while the core heat flux and coolant system temperature lag behind due to the thermal capacity of the fuel and coolant system fluid. Reactor trip on power range neutron flux (high setpoint) occurs shortly after the start of the transient prior to significant increases in the heat flux and water temperature, and the resultant DNBR remains well above the SAL value throughout the transient. The transient response for a slow uncontrolled RCCA bank withdrawal (1 pcm/sec) from 100 percent power with minimum feedback is shown in Figures 2.5.2-4 through 2.5.2-6. With a lower insertion rate, the power increase rate is slower, the rate of increase of the average coolant temperature is slower, and the system lags and delays become less significant. A reactor trip on OTT occurs after a longer period of time than for a rapid RCCA bank withdrawal. Again, the DNBR remains greater than the SAL value throughout the transient.

2-240 WCAP-17658-NP September 2016 Licensing Report Revision 1-C Figure 2.5.2-7 shows the minimum DNBR as a function of reactivity insertion rate from 100 percent power for both minimum and maximum reactivity feedback conditions. The high neutron flux and OTT reactor trip functions provide DNB protection over the analyzed range of reactivity insertion rates because the minimum DNBR is never less than the SAL value.

Figures 2.5.2-8 and 2.5.2-9 show the minimum DNBR as a function of reactivity insertion rate for RCCA bank withdrawal incidents starting at 60 and 10 percent power, respectively. The results are similar to the 100-percent power case. However, as the initial power level is decreased, the range over which the OTT trip is effective is increased. Note that the conservative minimum DNBR approximation calculated by RETRAN for a number of the 60 and 10 percent power cases did not meet the SAL DNBR value. This limit was conservatively defined to demonstrate that the DNB design basis is satisfied for analyses performed using RTDP methods. Sufficient margin is maintained between the SAL DNBR and the design limit DNBR to offset the effects of rod bow, lower plenum flow anomaly, and plant instrumentation biases, as well as to provide flexibility in the design and operation of the plant. See Section 2.12, "Thermal and Hydraulic Design," for additional information. To demonstrate that the DNB design basis was satisfied, the VIPRE code was used to perform a detailed DNBR calculation of the most limiting part-power case (reactivity insertion rate of 12 pcm/sec from 10 percent power with minimum feedback). The results confirmed that the DNB design basis continues to be met and that sufficient DNBR margin is retained to allow for flexibility in the design and operation of the plant. To increase the amount of DNBR margin retained, the DNBR calculations performed for this event credited the following changes: A higher MMF of 376,000 gpm Thimble plugs were assumed to remain installed to reduce the core bypass flow (all other non-LOCA analyses covered the bounding scenario of having the core TPR) Finally, Figures 2.5.2-10 through 2.5.2-12 show the transient responses for the limiting RCS pressure case indicating that the applicable limit is met. The calculated sequences of events for four cases are shown in Table 2.5.2-1; the four cases include: a rapid RCCA bank withdrawal (110 pcm/sec) from 100 percent power with minimum feedback, a slow RCCA bank withdrawal (1 pcm/sec) from 100 percent power with minimum feedback, the limiting DNB case (withdrawal rate of 12 pcm/sec from 10 percent power with minimum feedback), the limiting overpressure case (withdrawal rate of 21 pcm/sec from 74 percent power with minimum feedback). With the reactor tripped, the plant eventually returns to a stable condition. The plant could subsequently be cooled down further by following normal plant shutdown procedures. The limiting results of the uncontrolled RCCA bank withdrawal at power analyses are shown in Table 2.5.2-2.

2-241 WCAP-17658-NP September 2016 Licensing Report Revision 1-C For the DNB cases, the power range neutron flux and OTT reactor trip functio ns provided adequate protection over the entire range of possible reactivity insertion rates. The results show that the DNB design basis is met and the peak linear heat generation rate is less than the limit. For the RCS overpressure cases, the power range neutron flux, OTT, power range neutron flux high positive rate, and high pressurizer pressure reactor trip functions, in conjunction with the PSVs and MSSVs, provide adequate protection over the entire range of possible reactivity insertion rates. The results showed that the peak RCS pressure remains below 110 percent of the design pressure. Therefore, the results of the analysis show that an uncontrolled RCCA bank withdrawal at power does not adversely affect the core, the RCS, or the MSS. 2.5.2.2 Conclusion Based on the above information, it is concluded that the analysis has adequately accounted for operation of the plant at the analyzed power level and was performed using acceptable analytical models. This analysis has also demonstrated that the reactor protection and safety systems will continue to ensure that the specified acceptable fuel design limits and RCS pressure safety limit are not exceeded. Based on this, it can be concluded that the plant will continue to meet the requirements of GDCs 10, 15, and 26. 2.5.2.3 References

1. Westinghouse Report WCAP-11397-P-A, "Revised Thermal Design Procedure," April 1989.
2. Westinghouse Report WCAP-12910, Rev. 1-A, "Pressurizer Safety Valve Set Pressure Shift,"

May 1993.

3. Westinghouse Report WCAP-14882-P-A, "RETRAN-02 Modeling and Qualification for Westinghouse Pressurized Water Reactor Non-LOCA Safety Analyses," April 1999.
4. Westinghouse Report WCAP-14565-P-A, "VIPRE-01 Modeling and Qualification for Pressurized Water Reactor Non-LOCA Thermal-Hydraulic Safety Analysis," October 1999.
5. Westinghouse Report WCAP-7907-P-A, "LOFTRAN Code Description," April 1984.

2-242 WCAP-17658-NP September 2016 Licensing Report Revision 1-C Table 2.5.2-1 Time Sequence of Events - Uncontrolled RCCA Bank Withdrawal at Power Case Event Time (sec) DNB Case 100 Percent Power, Minimum Feedback, Rapid RCCA Bank Withdrawal (110 pcm/sec) Initiation of Uncontrolled RCCA Bank Withdrawal 0.0 Power Range Neutron Flux - High Setpoint

Reached 1.25 Rods Begin to Drop 1.75 Minimum DNBR Occurs 3.05 DNB Case 100 Percent Power, Minimum Feedback, Slow RCCA Bank Withdrawal (1 pcm/sec) Initiation of Uncontrolled RCCA Bank Withdrawal 0.0 OTT Setpoint Reached 99.3 Rods Begin to Drop 101.6 Minimum DNBR Occurs 102.0 Limiting DNB Case 10 Percent Power, Minimum Feedback, RCCA Bank Withdrawal (12 pcm/sec) Initiation of Uncontrolled RCCA Bank Withdrawal 0.0 OTT Setpoint Reached 57.03 Rods Begin to Drop 59.28 Minimum DNBR Occurs 59.90 Limiting Overpressure Case 74 Percent Power, Minimum Feedback, Rapid RCCA Bank Withdrawal (21 pcm/sec) Initiation of Uncontrolled RCCA Bank Withdrawal 0.0 Power Range Neutron Flux High Positive Rate Setpoint Reached 12.54 Rods Begin to Drop 13.54 Maximum RCS Pressure Occurs 15.50 2-243 WCAP-17658-NP September 2016 Licensing Report Revision 1-C Table 2.5.2-2 Uncontrolled RCCA Bank Withdrawal at Power - Limiting Results Limiting value Analysis Limit Case Minimum DNBR See note (1) See note (1) 10% power, minimum feedback, 12 pcm/sec reactivity insertion rate Peak Core Heat Flux (fraction of analyzed full power) 1.174 1.21 10% power, maximum feedback, 36 pcm/sec Peak Primary System Pressure (psia) 2707.9 2750.0 74% power, minimum feedback 21 pcm/sec Note: 1. A detailed DNBR evaluation was performed using the VIPRE code confirming that the DNB design basis was satisfied for the limiting case.

2-244 WCAP-17658-NP September 2016 Licensing Report Revision 1-C Figure 2.5.2-1. RCCA Bank Withdrawal at Power - Minimum Reactivity Feedback 100 Percent Power - 110 pcm/sec Nuclear Power and Core Heat Flux versus Time 2-245 WCAP-17658-NP September 2016 Licensing Report Revision 1-C Figure 2.5.2-2. RCCA Bank Withdrawal at Power - Minimum Reactivity Feedback 100 Percent Power - 110 pcm/sec Pressurizer Pressure and Water Volume versus Time 2-246 WCAP-17658-NP September 2016 Licensing Report Revision 1-C Figure 2.5.2-3. RCCA Bank Withdrawal at Power - Minimum Reactivity Feedback 100 Percent Power - 110 pcm/sec Vessel Average Temperature and DNBR versus Time 2-247 WCAP-17658-NP September 2016 Licensing Report Revision 1-C Figure 2.5.2-4. RCCA Bank Withdrawal at Power - Minimum Reactivity Feedback 100 Percent Power - 1 pcm/sec Nuclear Power and Core Heat Flux versus Time 2-248 WCAP-17658-NP September 2016 Licensing Report Revision 1-C Figure 2.5.2-5. RCCA Bank Withdrawal at Power - Minimum Reactivity Feedback 100 Percent Power - 1 pcm/sec Pressurizer Pressure and Water Volume versus Time 2-249 WCAP-17658-NP September 2016 Licensing Report Revision 1-C Figure 2.5.2-6. RCCA Bank Withdrawal at Power - Minimum Reactivity Feedback 100 Percent Power - 1 pcm/sec Vessel Average Temperature and DNBR versus Time 2-250 WCAP-17658-NP September 2016 Licensing Report Revision 1-C Figure 2.5.2-7. RCCA Bank Withdrawal at Power -100 Percent Power Minimum DNBR versus Reactivity Insertion Rate Note that the minimum DNBR values presented were calculated using the RETRAN code and are representative of the trends for minimum DNBR and not indicative of final calculated DNBR values.

The detailed T/H code VIPRE was used to confirm that the limiting case (10 percent power, minimum reactivity feedback, 12 pcm/sec reactivity insertion rate) satisfied the DNB design basis.

2-251 WCAP-17658-NP September 2016 Licensing Report Revision 1-C Figure 2.5.2-8. RCCA Bank Withdrawal at Power - 60 Percent Power Minimum DNBR versus Reactivity Insertion Rate Note that the minimum DNBR values presented were calculated using the RETRAN code and are representative of the trends for minimum DNBR and not indicative of final calculated DNBR values.

The detailed T/H code VIPRE was used to confirm that the limiting case (10 percent power, minimum reactivity feedback, 12 pcm/sec reactivity insertion rate) satisfied the DNB design basis.

2-252 WCAP-17658-NP September 2016 Licensing Report Revision 1-C Figure 2.5.2-9. RCCA Bank Withdrawal at Power - 10 Percent Power Minimum DNBR versus Reactivity Insertion Rate Note that the minimum DNBR values presented were calculated using the RETRAN code and are representative of the trends for minimum DNBR and not indicative of final calculated DNBR values. The detailed T/H code VIPRE was used to confirm that the limiting case (10 percent power, minimum reactivity feedback, 12 pcm/sec reactivity insertion rate) satisfied the DNB design basis.

2-253 WCAP-17658-NP September 2016 Licensing Report Revision 1-C Figure 2.5.2-10. RCCA Bank Withdrawal at Power - Minimum Reactivity Feedback Limiting Overpressure Case Nuclear Power and Core Heat Flux versus Time 2-254 WCAP-17658-NP September 2016 Licensing Report Revision 1-C Figure 2.5.2-11. RCCA Bank Withdrawal at Power - Minimum Reactivity Feedback Limiting Overpressure Case Pressurizer Pressure and Water Volume versus Time 2-255 WCAP-17658-NP September 2016 Licensing Report Revision 1-C Figure 2.5.2-12. RCCA Bank Withdrawal at Power - Minimum Reactivity Feedback Limiting Overpressure Case Vessel Average Temperature and Peak RCS Pressure versus Time 2-256 WCAP-17658-NP September 2016 Licensing Report Revision 1-C

2.5.3 Control

Rod Misoperation (USAR Section 15.4.3) 2.5.3.1 Technical Evaluation 2.5.3.1.1 Introduction The RCCA misalignment events include the following: One or more dropped RCCAs from the same group A dropped RCCA bank A statically misaligned RCCA Withdrawal of a single RCCA Each RCCA has a position indicator channel that displays the position of the assembly. The displays of assembly positions are grouped for the operator's convenience. Fully inserted assemblies are further indicated by a rod at bottom signal, which actuates an alarm and a control room annunciator. Group demand position is also indicated. Full-length RCCAs are moved in preselected banks, and the banks are moved in the same preselected sequence. Each control bank of RCCAs is divided into two groups. The rods comprising a group operate in parallel through multiplexing thyristors. The two groups in a bank move sequentially such that the first group is always within one step of the second group in the bank. A definite schedule of actuation (or deactuation of the stationary gripper, movable gripper, and lift coils of a mechanism) is required to withdraw the RCCA attached to the mechanism. Because the stationary gripper, movable gripper, and lift coils associated with the four RCCAs of a rod group are driven in parallel, any single failure that would cause rod withdrawal would affect a minimum of one group. Mechanical failures are in the direction of insertion, or immobility. A dropped RCCA or RCCA bank is detected by one or more of the following: Sudden drop in the core power level as seen by the nuclear instrumentation system Asymmetric power distribution as seen on out-of-core neutron detectors or core exit thermocouples Rod-at-bottom signal Rod deviation alarm Rod position indication 2-257 WCAP-17658-NP September 2016 Licensing Report Revision 1-C Dropping of a full-length RCCA is assumed to be initiated by a single electrical or mechanical failure that causes any number and combination of rods from the same group of a given control bank to drop to the bottom of the core. The resulting negative reactivity insertion causes nuclear power to rapidly decrease. An increase in the hot channel factor can occur due to the skewed power distribution representative of a dropped rod configuration. For this event, it must be shown that the DNB design basis is met for the combination of power, hot channel factor, and other system conditions that exist following a dropped rod. Misaligned assemblies are detected by: Asymmetric power distribution as seen on out-of-core neutron detectors or core exit thermocouples Rod deviation alarm Rod position indicators For the WCGS, rod position is displayed in 6-step increments with an accuracy of +/-4 steps. Deviation of any RCCA from its group by twice this distance (12 steps) will not cause power distributions worse than the design limits. The deviation alarm alerts the operator to rod deviation with respect to the group position in excess of 12 steps. If the rod deviation alarm is not functional, the operator is required to take action per the Technical Requirements Manual (or equivalent document). If one or more rod position indicators should be out of service, detailed operating instructions shall be followed to assure the alignment of the non-indicated RCCAs. The operator is also required to take action per the TS. In the extremely unlikely event of simultaneous electrical failures that could result in single RCCA withdrawal, rod deviation and rod control urgent failure would both be displayed on the plant annunciator, and the rod position indicators would indicate the relative positions of the assemblies in the bank. The urgent failure alarm also inhibits automatic rod motion in the group in which it occurs. Withdrawal of a single RCCA by operator action, whether deliberate or by a combination of errors, would result in activation of the same alarm and the same visual indications. Withdrawal of a single RCCA results in both positive reactivity insertion tending to increase core power, and an increase in local power density in the core area associated with the RCCA. Automatic protection for this event is provided by the OTT reactor trip, but because the local power density increases, it is not possible in all cases to provide assurance that the core safety limits will not be violated. 2.5.3.1.2 Input Parameters, Assumptions, and Acceptance Criteria The dropped RCCA, dropped RCCA bank, and statically misaligned RCCA events are classified as Condition II events (faults of moderate frequency) as defined by the ANS's "Nuclear Safety Criteria for the Design of Stationary Pressurized Water Reactor Plants," ANSI N18.2-1973. The single RCCA withdrawal incident is classified as an ANS Condition III event, as discussed below.

2-258 WCAP-17658-NP September 2016 Licensing Report Revision 1-C The acceptance criteria applied to this event are based on meeting the relevant regulatory requirements of 10 CFR 50, Appendix A, "General Design Criteria for Nuclear Power Plants." Brief discussions of the specific GDCs that are related to the dropped RCCA, dropped RCCA bank, and statically misaligned RCCA events acceptance criteria are provided as follows. GDC 10, insofar as it requires that the reactor core be designed with appropriate margin to assure that specified acceptable fuel design limits (SAFDLs) are not exceeded during any condition of normal operation, including the effects of anticipated operational occurrences (AOOs) GDC 20, insofar as it requires that the protection system be designed to initiate the reactivity control systems automatically to assure that acceptable fuel design limits are not exceeded as a result of AOOs and to initiate automatically operation of systems and components important to safety under accident conditions GDC 25, insofar as it requires that the protection system be designed to assure that SAFDLs are not exceeded for any single malfunction of the reactivity control systems. The following discussion demonstrates that all applicable acceptance criteria are met for this event at the WCGS. No single electrical or mechanical failure in the rod control system could cause the accidental withdrawal of a single RCCA from the inserted bank at full-power operation. The operator could deliberately withdraw a single RCCA in the control bank since this feature is necessary in order to retrieve an assembly should one be accidentally dropped. The event analyzed could only occur from multiple wiring failures or multiple deliberate operator actions and subsequent and repeated operator disregard of event indication. The probability of such a combination of conditions is so low that it would be acceptable for the consequences to include slight fuel damage. T hus, consistent with the philosophy and format of ANSI N18.2, the event is classified as a Condition III event. By definition "Condition III occurrences include incidents, any one of which may occur during the lifetime of a particular plant," and "shall not cause more than a small fraction of fuel elements in the reactor to be damaged." See Tables 2.5.3-1 and 2.5.3-2 for detailed acceptance criteria and initial conditions used in the dropped RCCA/dropped RCCA bank analysis. For the statically misaligned RCCA and single RCCA withdrawal events, see the analysis descriptions and results in Sec tions 2.5.3.1.3 and 2.5.3.1.

4 for details of the inputs and acceptance criteria. 2.5.3.1.3 Description of Analyses and Evaluations One or More Dropped RCCAs from the Same Group The LOFTRAN computer code (Reference 1) calculates transient system responses for the evaluation of a dropped RCCA event. The code simulates the neutron kinetics, RCS, pressurizer, pressurizer relief and safety valves, pressurizer spray, SG, and MSSVs. The code computes pertinent plant variables including temperatures, pressures, and power levels.

2-259 WCAP-17658-NP September 2016 Licensing Report Revision 1-C Transient RCS statepoints (temperature, pressure, and power) are calculated by LOFTRAN. Nuclear models are used to obtain a hot-channel factor consistent with the primary-system conditions and reactor power. By incorporating the primary conditions from the transient analysis and the hot-channel factor from the nuclear analysis, it is shown that the DNB design basis is met using dropped rod limit lines developed with the VIPRE code (Reference 2). The transient response analysis, nuclear peaking factor analysis, and performance of the DNB design basis confirmation are performed in accordance with the approved methodology described in Reference 3. Dropped RCCA Bank A dropped RCCA bank results in a symmetric power change in the core. Assumptions made in the methodology (Reference 3) for the dropped RCCA(s) analysis provide a bounding analysis for the dropped RCCA bank. Statically Misaligned RCCA Steady-state power distributions are analyzed using the appropriate nuclear physics computer codes. The peaking factors are then compared to peaking factor limits developed using the VIPRE code, which are based on meeting the DNBR design criterion. The following cases are examined in the analysis assuming the reactor is at full power: the worst rod withdrawn with bank D inserted at the insertion limit, the worst rod dropped with bank D inserted at the insertion limit, and the worst rod dropped with all other rods out. It is assumed that the incident occurs at the time in the cycle with maximum predicted peaking factors. This assures a conservative FH for the misaligned RCCA configuration. Single RCCA Withdrawal Power distributions within the core are calculated. The peaking factors are then used by VIPRE to calculate the DNBR for the event. The case of the worst rod withdrawn from bank D inserted at the insertion limit, with the reactor initially at full power, was analyzed. This incident is assumed to occur at BOL because this condition results in a minimum MTC. This assumption maximizes the power increase and minimizes the tendency of increased moderator temperature to flatten the power distribution. 2.5.3.1.4 Control Rod Misalignment Results One or More Dropped RCCAs Single or multiple dropped RCCAs within the same group result in a negative reactivity insertion. The core is not adversely affected during this period because power is decreasing rapidly. Either reactivity feedback or control bank withdrawal will re-establish power.

For a dropped RCCA event in the automatic rod control mode, the rod control system detects the drop in power and initiates control bank withdrawal. Power overshoot may occur due to rod control movement, after which the control system will insert the control bank to restore nominal power. In all cases, the minimum DNBR remains above the limit value.

2-260 WCAP-17658-NP September 2016 Licensing Report Revision 1-C Following a dropped rod event in manual rod control, the plant will establish a new equilibrium condition. The equilibrium process without control system interaction is monoton ic, thus removing power overshoot as a concern, and establishing the automatic rod control mode of operation as the limiting case. Dropped RCCA Bank A dropped RCCA bank results in a large negative reactivity insertion. Due to the relatively large worth of the dropped bank, and if the turbine load is constant, a reactor trip may occur on low pressurizer pressure due to the mismatch between the reactor power and the turbine power. The core is not adversely affected during this period because power is decreasing rapidly. In the event a reactor trip does not occur, the initial power reduction from a dropped RCCA bank is large and the power return due to reactivity feedback and control bank withdrawal is far less than seen from one or more dropped RCCAs from the same group. In either instance, the minimum DNBR remains above the limit value. Following plant stabilization, the operator may manually retrieve the RCCA(s) by following applicable plant procedures. Statically Misaligned RCCA The most severe misalignment situations with respect to DNBR at significant power levels arise from cases in which one RCCA is fully inserted, or where bank D is fully inserted with one RCCA fully withdrawn. Multiple independent alarms, including a bank insertion limit alarm, alert the operator well before the postulated conditions are approached. The bank can be inserted to its insertion limit with any one assembly fully withdrawn without the DNBR decreasing below the limit value. The insertion limits in the TS may vary depending on a number of limiting criteria. It is preferable, therefore, to analyze the misaligned RCCA case at full power for a control bank insertion position that is as deep as allowed by the DNBR and power peaking factor limits. The full power insertion limits on control bank D must then be chosen to be above that position and will usually be dictated by other criteria. Detailed results will vary from cycle to cycle depending on fuel arrangements. For this RCCA misalignment, with bank D inserted to its full-power insertion limit and one RCCA fully withdrawn, the DNBR does not decrease below the limit value. This case is analyzed assuming the initial reactor power and RCS pressure and temperature are at their nominal values including uncertainties, but

with the increased radial peaking factor associated with the misaligned RCCA. DNB calculations have not been performed specifically for RCCAs missing from other banks. However, power shape calculations have been done as required for the RCCA ejection analysis. Inspection of the power shapes shows that the DNB and peak kW/ft situation is less severe than the bank D case discussed above, assuming insertion limits on the other banks are equivalent to a bank D full-in insertion limit. For RCCA misalignments with one RCCA fully inserted, the DNBR does not decrease below the limit value. This case is analyzed assuming the initial reactor power and RCS pressure and temperature are at their nominal values including uncertainties, but with the increased radial peaking factor associated with the misaligned RCCA.

2-261 WCAP-17658-NP September 2016 Licensing Report Revision 1-C DNB does not occur for the RCCA misalignment incident, and thus the ability of the primary coolant to remove heat from the fuel rod is not reduced. The peak fuel temperature co rresponds to a linear heat generation rate based on the radial peaking factor penalty associated with the misaligned RCCA and the design axial power distribution. The resulting linear he at generation is well below that which would cause fuel melting. Following the identification of an RCCA group misalignment condition, the operator is required to take action per the plant TS and applicable plant procedures. Single RCCA Withdrawal For the single rod withdrawal event, two cases have been considered as follows:

1. If the reactor is in the manual control mode, continuous withdrawal of a single RCCA results in both an increase in core power and coolant temperature, and an increase in the local hot channel factor in the area of the withdrawing RCCA. In terms of the overall system response, this case is similar to those presented for the uncontrolled RCCA bank withdrawal at power event. However, the increased local power peaking in the area of the withdrawn RCCA results in lower minimum DNBRs than for the withdrawn bank cases. Depending on initial bank insertion and location of the withdrawn RCCA, automatic reactor trip may not occur sufficiently fast enough to prevent the minimum DNBR from decreasing below the limit value. Evaluation of this case at the power and coolant conditions at which the OTT trip would be expected to trip the plant shows that an upper limit for the number of fuel rods with a DNBR less than the limit value is 5 percent of the total rods in the core.
2. If the reactor is in the automatic control mode, the multiple failures that result in the withdrawal of a single RCCA will result in the immobility of the other RCCAs in the controlling bank. The transient will then proceed in the same manner as Case (1) described above. For such cases as above, a reactor trip will ultimately ensue, although not sufficiently fast enough in all cases to prevent a minimum DNBR in the core of less than the limit value. Following reactor trip, normal shutdown procedures are followed. No single failure of the reactor trip system will negate the protection functions required for the single RCCA withdrawal accident, or adversely affect the consequences of the accident. 2.5.3.1.5 Results The evaluation of the dropped rod event using the methodology in Reference 3, encompassing all possible dropped RCCA or RCCA bank worths delineated in Reference 3, concluded that the minimum DNBR remains above the SAL value for the WCGS. For all cases of any single RCCA fully inserted, or bank D inserted to the rod insertion limit and any single RCCA in that bank fully withdrawn (static misalignment), the minimum DNBR remains above the limit value for the WCGS. Therefore, the DNB design criterion is met and the RCCA misalignments do not result in core damage. For the case of the accidental withdrawal of a single RCCA, with the reactor in the automatic or manual control mode and initially operating at full power with bank D at the insertion limit, an upper bound of the number of fuel rods experiencing DNB is 5 percent of the total number of fuel rods in the core for the WCGS.

2-262 WCAP-17658-NP September 2016 Licensing Report Revision 1-C 2.5.3.2 Conclusion The analyses of control rod misalignment events have been reviewed and it has been concluded that these were performed using acceptable analytical models. It was further concluded that the analyses have demonstrated that the reactor protection and safety sy stems will continue to ensure that the SAFDLs will not be exceeded during normal or antic ipated operational transients. Based on this, it is concluded that the plant will continue to meet the requirements of GDCs 10, 20, and 25. 2.5.3.3 References

1. Westinghouse Report WCAP-7907-P-A, "LOFTRAN Code Description," April 1984.
2. Westinghouse Report WCAP-14565-P-A, "VIPRE-01 Modeling and Qualification for Pressurized Water Reactor Non-LOCA Thermal-Hydraulic Safety Analysis," October 1999.
3. Westinghouse Report WCAP-11394-P-A, "Methodology for the Analysis of the Dropped Rod Event," January 1990.

2-263 WCAP-17658-NP September 2016 Licensing Report Revision 1-C Table 2.5.3-1 Non-LOCA Analysis Limits and Analysis Results for the Dropped Rod Event Result Parameter Analysis Result Analysis Limit Limiting Case Minimum DNBR (RTDP, WRB-2) 1.52 > 1.52 Peak Linear Heat Generation (kW/ft) 22.4 (1) < 22.4 Peak Uniform Cladding Strain (%) 1.0 < 1.0 Note: 1. Corresponds to a conservative UO 2 fuel melting temperature of 4700°F.

Table 2.5.3-2 Summary of Initial Conditions and Computer Codes Used for the Dropped Rod Event Computer Codes Used DNB Correlation RTDP Initial Power (%) Vessel Coolant Flow(gpm) Vessel Average Coolant Temp (°F) RCS Pressure (psia) LOFTRAN ANC VIPRE WRB-2 Yes 100 (3637 MWt - core power) 371,000 588.4 2250.0

2-264 WCAP-17658-NP September 2016 Licensing Report Revision 1-C

2.5.4 Startup

of an Inactive Reactor Coolant Pump at an Incorrect Temperature (USAR Section 15.4.4) 2.5.4.1 Technical Evaluation As described in USAR Section 15.4.4, the Startup of an Inactive Reactor Coolant Pump at an Incorrect Temperature event has historically been analyzed for the WCGS. If the plant is operating with one pump out of service, there is reverse flow through the inactive loop due to the pressure difference across the reactor vessel. The CL temperature in an inactive loop is identical to the CL temperature of the active loops (the reactor core inlet temperature). If the reactor is operated at power, and assuming the secondary side of the SG in the inactive loop is not isolated, there is a temperature drop acr oss the SG in the inactive loop and, with the reverse flow, the HL temperature of the inactive loop is lower than the reactor core inlet temperature. Starting of an idle RCP without bringing the inactive loop HL temperature close to the core inlet temperature would result in the injection of cold water into the core, which would cause a reactivity insertion and subsequent power increase. Because the WCGS TS (LCO 3.4.4) require all four RCS loops to be in operation while at power or in startup conditions (Modes 1 and 2), the Startup of an Inactive Reactor Coolant Pump at an Incorrect Temperature event is administratively precluded for the WCGS. Therefore, no explicit analysis of this event is required, and no further evaluation is necessary. 2.5.4.2 Conclusion Based on the above information, it is concluded that the Startup of an Inactive Reactor Coolant Pump at an Incorrect Temperature event is administratively precluded by the WCGS TS and no analysis of the event is required.

2-265 WCAP-17658-NP September 2016 Licensing Report Revision 1-C

2.5.5 Chemical

and Volume Control System Malfunction Resulting in a Decrease in Boron Concentration in the Reactor Coolant (USAR Section 15.4.6) 2.5.5.1 Technical Evaluation The specific acceptance criterion applied for the CVCS malfunction (also referred to as boron dilution) events is that adequate operator action time is available prior to a complete loss of shutdown margin. For boron dilution events in Modes 1 through 5, there must be at least 15 minutes from operator notification (that is, first alarm) until shutdown margin is lost. For the WCGS, a boron dilution event cannot occur during Mode 6 (Refueling) due to administrative controls that isolate the RCS from the potential sources of unborated water. Additionally, for conditions when no RCP is in operation, all dilution sources are isolated or under administrative control. Hence, a boron dilution event cannot occur during Mode 5 (Cold Shutdown) or Mode 4 (Hot Shutdown) once operation on the residual heat removal system (RHRS) begins. This is consistent with inadvertent boron dilution event analysis methodology approved by the USNRC for the WCGS (Reference 1). With shutdown margin maintained, there is no return to critical and no violation of the 95/95 DNBR limit (GDC 10), as well as no violation of the primary and secondary pressures limits (GDC 15). Furthermore, because a return to critical is precluded and fuel design limits are not exceeded, the requirements of GDC 26 are satisfied. For Modes 1 through 5, the boron dilution analysis is performed to ensure that adequate time is available from alarm to total loss of shutdown margin for the operator to identify and terminate the dilution.

The discussion below demonstrates that all applicable acceptance criteria are met for this event at the WCGS in operating Modes 1 through 5. 2.5.5.1.1 Introduction Reactivity can be added to the core by feeding primary-grade water into the RCS via the reactor makeup portion of the CVCS. Boron dilution is a manual operation under strict administrative controls with procedures calling for a limit on the rate and duration of dilution. A boric acid blend system is provided to allow the operator to match the boron concentration of the reactor coolant makeup water during normal charging to the RCS boron concentration. As discussed below, the CVCS is designed to limit, even under various postulated failure modes, the potential rate of dilution to a value that, after indication through alarms and instrumentation, provides the operator sufficient time to correct the situation in a safe and orderly manner. 2.5.5.1.2 Input Parameters, Assumptions, and Acceptance Criteria The opening of the primary water makeup control valves provides makeup to the CVCS and subsequently to the RCS, which can dilute the reactor coolant. Inadvertent dilution from this source can be readily terminated by closing the control valve. In order for makeup water to be added to the RCS at pressure, at least one charging pump must be running in addition to a primary makeup water pump. The limiting dilution flow path is identified as the lowest resistance flow path for an unintentional dilution. The boron dilution analysis excludes deliberate dilution operations from considerations. During intentional boron dilution operations, the plant operators are keenly aware of and continually monitor the 2-266 WCAP-17658-NP September 2016 Licensing Report Revision 1-C dilution process in progress for any sign of deviation or malfunction, such that the possibility of an undetected malfunction is considered remote. This is a standard assumption in the boron dilution analysis methodology. Thus, the limiting boron dilution flow path does not include either the normal dilute or the alternative dilute flow paths (these paths are used only for deliberate dilution operations). The limiting boron dilution flow path is the makeup flow path of the reactor makeup water system (RMWS) used in normal boration/blend operations. The most common causes of an inadvertent boron dilution are the opening of the primary water makeup control valve and failure of the blend system, either by controller or mechanical failure. The CVCS and the RMWS are designed to limit, even under various postulated failure modes, the potential rate of dilution to values that will allow sufficient time for operator response to terminate the dilution. An inadvertent dilution from the RMWS may be terminated by closing the primary water makeup control valve. All expected sources of dilution may be terminated by closing isolation valves in the CVCS. The lost shutdown margin may be regained by the opening of isolation valves to the RWST, thus allowing the addition of borated water to the RCS. The rate at which unborated water can be added to the RCS is limited by the design of the CVCS and RMWS. The maximum (limiting) boron dilution flow rate is 245 gpm for Modes 1 and 2 with rod control in manual mode, and 120 gpm in Mode 1 with rod control in automatic mode. For Modes 3 through 5, the maximum boron dilution flow rate is 157.5 gpm. Information on the status of the reactor coolant makeup is continually available to the operator. Lights are provided on the control board to indicate the operating condition of the pumps in the CVCS. Alarms are actuated to warn the operator when boric acid or makeup water flow rates deviate from preset values as a result of system malfunction. A CVCS malfunction is classified as an ANS Condition II event, a fault of moderate frequency as defined by the ANS's "Nuclear Safety Criteria for the Design of Stationary Pressurized Water Reactor Plants," ANSI N18.2-1973. Criteria established for Condition II events are as follows: The CHF must not be exceeded. This is met by demonstrating that the minimum DNBR does not decrease below the limit value at any time during the transient. Pressure in the RCS and MSS must be maintained below 110 percent of the respective design pressures. Fuel temperature and fuel cladding strain limits must not be exceeded. The peak linear heat generation rate should not exceed a value that would cause fuel centerline melt. This event is analyzed to show that there is sufficient time for mitigation of an inadvertent boron dilution prior to a complete loss of shutdown margin. A complete loss of plant shutdown margin results in a return of the core to a critical condition causing an increase in the RCS temperature and heat flux. This could violate the SAL DNBR value and challenge the fuel and fuel cladding integrity. A complete loss of plant shutdown margin could also result in a return of the core to a critical condition causing an increase in RCS pressure. This could challenge the pressure design limits for the RCS and/or MSS.

2-267 WCAP-17658-NP September 2016 Licensing Report Revision 1-C If the shutdown margin is shown not to be lost, the condition of the plant at any point in the transient is within the bounds of those calculated for other Condition II transients. By showing that the above criteria are met for those Condition II events, it can be concluded that they are also met for the boron dilution event. Operator action is relied upon to preclude a complete loss of plant shutdown margin. 2.5.5.1.3 Description of Analyses and Evaluations Dilution During Mode 6 - An analysis is not performed for an uncontrolled boron dilution accident during refueling. In this mode, the event is prevented by administrative controls that isolate the RCS from the potential source of unborated water. Dilution During Mode 5 Drained - The RCS water level can be dropped to the mid-plane of the HL for maintenance work that requires the SGs to be drained. When the water level is drained down to the mid-plane of the HL from a filled and vented condition in cold shutdown, an uncontrolled boron dilution accident is prevented by administrative controls that isolate the RCS from the potential source of unborated water. Consequently, an analysis is not performed in this configuration. Dilution During Mode 5 Filled - Typically, the plant is maintained in the Cold Shutdown mode when RCS ambient temperatures are required. Occasionally, reduced RCS inventory may be necessary. Mode 5 can also be a transition mode to either Refueling (Mode 6) or Hot Shutdown (Mode 4). Through the cycle, the plant may enter Mode 5 if reduced temperatures are required in containment or as the result of a TS required action. The plant is maintained in Mode 5 at the beginning of each cycle for startup testing of certain systems. During this mode of operation, the control banks are fully inserted. The following conditions are assumed for an uncontrolled boron dilution during cold shutdown. The assumed dilution flow (157.5 gpm) is the maximum flow from the RMWS assuming multiple simultaneous failures of control valves. The active RCS water volume for the WCGS is 8639.0 ft

3. This active volume assumes at least one RCP is in operation, with the volume of the pressurizer and surge line excluded to assure that conservative estimates are made. Additionally, because no consideration is given to mixing in the reactor vessel upper head region, the volumes for the upper head and the downcomer from the top of the CLs to the bottom of the upper head spray nozzles are also excluded. When no RCP is in operation, all dilution sources are isolated or under administrative control. This is consistent with inadvertent boron dilution event analysis methodology approved by the USNRC for the WCGS. The volume control tank (VCT) high water level alarm alerts the operators that a boron dilution may be in progress. This is consistent with inadvertent boron dilution event analysis methodology approved by the USNRC for the WCGS. The initial boron concentration is assumed to be 1925 ppm (parts per million) at an RCS temperature of 68°F, with all rods inserted (minus the most reactive RCCA), no xenon and shutdown margin of 1.3 percent k/k.

2-268 WCAP-17658-NP September 2016 Licensing Report Revision 1-C The critical boron concentration is assumed to be 1800 ppm at an RCS temperature of 68°F, with all rods inserted (minus the most reactive RCCA), and no xenon. The 125 ppm change from the initial boron concentration noted above is a conservative minimum value.

Dilution During Mode 4 - In Mode 4, the plant is being taken from a short-term mode of operation, Cold Shutdown (Mode 5), to a long-term mode of operation, Hot Standby (Mode 3). Typically, the plant is maintained in the Hot Shutdown mode to achieve plant heatup before entering Mode 3. The plant is maintained in Mode 4 at the beginning of each cycle for startup testing of certain systems. Throughout the cycle, the plant will enter Mode 4 if reduced temperatures are required in containment or as a result of a TS required action. During this mode of operation, the control banks are fully inserted. In Mode 4, the primary coolant forced flow that provides mixing can be provided by either the RHRS or a RCP, depending on system pressure. The following conditions are assumed for an uncontrolled boron dilution during Hot Shutdown: The assumed dilution flow (157.5 gpm) is the maximum flow from the RMWS assuming multiple, simultaneous failures of control valves. The active RCS water volume for the WCGS is 8639.0 ft

3. This active volume assumes at least one RCP is in operation, with the volume of the pressurizer and surge line excluded to assure that conservative estimates are made. Additionally, because no consideration is given to mixing in the reactor vessel upper head region, the volumes for the upper head and the downcomer from the top of the CLs to the bottom of the upper head spray nozzles are also excluded. When no RCP is in operation, all dilution sources are isolated or under administrative control. This is consistent with inadvertent boron dilution event analysis methodology approved by the USNRC for the WCGS (Reference 1). The VCT high water level alarm alerts the operators that a boron dilution may be in progress. This is consistent with inadvertent boron dilution event analysis methodology approved by the USNRC for the WCGS. The initial boron concentration is assumed to be 1930 ppm at an RCS temperature of 200°F, with all rods inserted (minus the most reactive RCCA), no xenon and shutdown margin of

1.3 percent

k/k. The critical boron concentration is assumed to be 1800 ppm at an RCS temperature of 200°F, with all rods inserted (minus the most reactive RCCA), and no xenon. The 130 ppm change from the initial boron concentration noted above is a conservative minimum value.

2-269 WCAP-17658-NP September 2016 Licensing Report Revision 1-C Dilution During Mode 3 - During this mode, rod control is in manual and the rods can be either withdrawn or inserted. In Mode 3, all RCPs may not be in operation. In an effort to balance the heat loss through the RCS and the heat removal of the SGs, one or more of the pumps may be off to decrease heat input into the system. In the approach to Mode 2, the operator must manually withdraw the control rods and may initiate a limited dilution according to shutdown margin requirements, but not simultaneously.

If the shutdown or control banks are withdrawn, the dilution scenario is similar to the Mode 2 analysis where the failure to block the source range trip results in a reactor trip and immediate shutdown of the reactor. The dilution scenario is more limiting if the c ontrol rods are not withdraw n and the reactor is shut down by boron to the TS minimum requirement for Mode 3. The following conditions are assumed for an uncontrolled boron dilution during hot standby: The assumed dilution flow (157.5 gpm) is the maximum flow from the RMWS assuming multiple, simultaneous failures of control valves. The active RCS water volume for the WCGS is 8639.0 ft

3. This active volume assumes at least one RCP is in operation, with the volume of the pressurizer and surge line excluded to assure that conservative estimates are made. Additionally, because no consideration is given to mixing in the reactor vessel upper head region, the volumes for the upper head and the downcomer from the top of the CLs to the bottom of the upper head spray nozzles are also excluded. The VCT high water level alarm alerts the operators that a boron dilution may be in progress. This is consistent with inadvertent boron dilution event analysis methodology approved by the USNRC for the WCGS. The initial boron concentration is assumed to be 1645 ppm and 1940 ppm at RCS temperatures of 557°F and 350°F, respectively, with all rods inserted (minus the most reactive RCCA), no xenon and shutdown margin of 1.3 percent k/k. The critical boron concentration is assumed to be 1500 ppm and 1800 ppm at RCS temperatures of 557°F and 350°F, respectively, with all rods inserted (minus the most reactive RCCA), and no xenon. The changes between the associated initial and critical boron concentrations noted above are conservative minimum values.

Dilution During Mode 2 - In this mode, the plant is being taken from one long-term mode of operation (Mode 3) to another (Mode 1). The plant is maintained in the Startup mode only for the purpose of startup testing at the beginning of each cycle. All normal actions required to ch ange power level, either up or down, require operator initiation. Assumed conditions at startup require the reactor to have available at least 1.3 percent k/k shutdown margin. The following conditions are assumed for an uncontrolled boron dilution during startup: The assumed dilution flow (245 gpm) is the maximum flow from the RMWS assuming multiple, simultaneous failures of control valves. Conservative estimates of the minimum active RCS water volume are made by excluding the pressurizer and surge line. For the WCGS, the active RCS water volume is 9810 ft

3.

2-270 WCAP-17658-NP September 2016 Licensing Report Revision 1-C The reactor trip on source range neutron flux level alerts the operators that a boron dilution may be in progress. The initial boron concentration is assumed to be 1935 ppm, which is a conservative maximum value for the critical concentration at the condition of HZP, with the rods at the insertion limits, and no xenon. The critical boron concentration following reactor trip is assumed to be 1500 ppm, corresponding to HZP, all rods inserted (minus the most reactive RCCA), no xenon conditions. The 435 ppm change from the initial condition noted above is a conservative minimum value. Mode 2 is a transitory operational mode in which the operator intentionally dilutes and withdraws control rods to take the plant critical. During this mode, the plant is in manual control with the operator required to maintain a high awareness of the plant status. For a normal approach to criticality, the operator must manually initiate a limited dilution and withdraw the control rods, a process that takes several hours. Prior to approaching criticality, the TS require that the predicted position of the rods is within the rod insertion limits. This ensures that the reactor did not go critical with the control rods below the insertion limits. Once critical, the power escalation must be sufficiently slow to allow the operator to manually block the source range reactor trip (nominally at 10 5 cps) after reaching permissive P-6. Too fast of a power escalation (due to an unknown dilution) would result in reaching P-6 unexpectedly, leaving insufficient time to manually block the source range reactor trip. Failure to perform this manual action results in a reactor trip and immediate shutdown of the reactor. However, in the event of an unplanned approach to criticality or dilution during power escalation while in Mode 2, the plant status is such that minimal impact will result. The plant will slowly escalate in power to a reactor trip on the power range neutron flux low setpoint. After reactor trip, more than 15 minutes is available for operator action prior to return to criticality. Mode 2 results are summarized in Table 2.5.5-1.

Dilution During Mode 1 - In this mode, the plant can be operated in either automatic or manual rod control. With the reactor in manual control and no operator action taken to terminate the transient, the power and temperature increase will cause the reactor to reach the power range high neutron flux trip setpoint or the OTT trip setpoint, resulting in a reactor trip. In this case, the boron dilution transient up to the time of trip is essentially equivalent to an uncontrolled RCCA bank withdrawal at power. Following reactor trip, there is at least 15 minutes prior to criticality. This is sufficient time for the operator to determine the cause of dilution and isolate the reactor makeup water source before the available shutdown margin is lost. With the reactor in automatic rod control, the power and temperature increase from the boron dilution results in insertion of the control rods and a decrease in the available shutdown margin. As the dilution and rod insertion continue, the rod insertion limit al arms (low and low-low settings) and axial flux difference alarm alert the operator at least 15 minutes prior to criticality that a dilution is in progress and that the TS requirement for shutdown margin may be challenged. This is sufficient time to determine the cause of dilution and isolate the reactor makeup water source before the available shutdown margin is lost.

2-271 WCAP-17658-NP September 2016 Licensing Report Revision 1-C The effective reactivity addition rate is primarily a function of the dilution rate, boron concentration, and boron worth. The following conditions are assumed for an uncontrolled boron dilution during full power: The assumed dilution flow (245 gpm with rod control in manual mode, and 120 gpm for rod control in automatic mode) is the maximum flow from the RMWS assuming multiple, simultaneous failures of control valves. Conservative estimates of the minimum active RCS water volume are made by excluding the pressurizer and surge line. For the WCGS, the active RCS water volume is 9810 ft

3. The reactor trip on power range neutron flux high or OTT alerts the operators that a boron dilution may be in progress. The initial boron concentration is assumed to be 1954 ppm, which is a conservative maximum value for the initial concentration at the condition of HFP, with the rods at the insertion limits, and no xenon. The critical boron concentration following reactor trip is assumed to be 1500 ppm, corresponding to the HZP, all rods inserted (minus the most reactive RCCA), and no xenon condition. The 454 ppm change from the initial condition noted above is a conservative minimum value. A 1.3 percent k/k minimum shutdown margin is assumed in the analysis. Bounding boron worths of -15 pcm/ppm and -5 pcm/ppm are conservatively considered. The larger absolute value maximizes the reactivity insertion rate, whereas the smaller absolute value minimizes the reactivity insertion rate thereby delaying the time to reach the reactor trip setpoint. 2.5.5.1.4 Results The boron dilution analysis concluded that all applicable acceptance criteria are met for the WCGS. This means that operator action to terminate the dilution flow within 15 minutes from operator notification (first alarm) in Modes 1, 2, 3, 4 and 5, precludes a complete loss of shutdown margin. The results of the boron dilution analysis are provided in Table 2.5.5-1. No analysis is presented for the Mode 5 drained condition or Mode 6 operation because dilution is precluded by administrative controls.

If an unintentional dilution of boron in the RCS does occur, numerous alarms and indications are available to alert the operator to the condition. The maximum reactivity addition due to the dilution is slow enough to allow the operator sufficient time to determine the cause of the addition and take corrective action before shutdown margin is lost. The acceptance criteria as specified in Section 2.5.5.1.2 are met.

2-272 WCAP-17658-NP September 2016 Licensing Report Revision 1-C 2.5.5.2 Conclusion The analyses of the decrease in boron concentration in the reactor coolant due to a CVCS malfunction have been reviewed. It is concluded that the analyses have adequately accounted for plant operation at the current and proposed uprated power levels and were performed using acceptable analytical models. Also, when there is a decrease in boron concentration event, the analyses demonstrate that the reactor protection and safety systems will continue to ensure that the specified acceptable fuel design limits and the RCS and MSS pressure limits will not be exceeded. Based on this, it is concluded that the WCGS will continue to meet the requirements of GDCs 10, 15, and 26. 2.5.5.3 References

1. USNRC Letter from James C. Stone (USNRC) to Neil S. Carns (WCNOC), "Wolf Creek Generating Station - Amendment No. 96 to Facility Operating License No. NPF-42 (TAC No. M94112)," March 1, 1996.

2-273 WCAP-17658-NP September 2016 Licensing Report Revision 1-C Table 2.5.5-1 CVCS Malfunction Boron Dilution Event Results - Event Alarm to Loss of Shutdown Margin Operating Mode Available Operator Action Time (minutes)

Limit (minutes) Mode 1 - Manual Rod Control 50.3 15 Mode 1 - Automatic Rod Control 112.9 15 Mode 2 56.0 15 Mode 3 - 557°F 15.8 15 Mode 3 - 350°F 15.6 15 Mode 4 - 200°F 15.8 15 Mode 5 - 68°F - Filled 15.7 15 Mode 5 - 68°F - Drained N/A (1) Mode 6 Note: 1. No analysis is presented for the Mode 5 drained condition or Mode 6 because boron dilution is precluded by administrative controls.

2-274 WCAP-17658-NP September 2016 Licensing Report Revision 1-C

2.5.6 Spectrum

of Rod Cluster Control Assembly Ejection Accidents (USAR Section 15.4.8) 2.5.6.1 Technical Evaluation The criterion applied to ensure the core remains in a coolable geometry following a rod ejection incident is that the average fuel pellet enthalpy at the hot spot must remain less than 200 cal/gm (360 Btu/lbm). The use of the initial conditions presented in Table 2.5.6-1 resulted in conservative calculations of the fuel pellet enthalpy. The results of the licensing basis analyses demonstrated that the fuel pellet enthalpy does not exceed 360 Btu/lbm for any of the rod ejection cases analyzed. Overpressurization of the RCS during a rod ejection event is generically addressed in WCAP-7588, Revision 1-A (Reference 1).

Another applicable acceptance criterion is that fuel melting must be limited to less than the innermost 10 percent of the fuel pellet at the hot spot, even if the average fuel pellet enthalpy at the hot spot is less than the limit of 360 Btu/lbm. Conservative fuel melt temperatures of 4900°F and 4800°F were assumed for the hot spot for the BOL and EOL cases, respectively. These fuel melting temperatures correspond to a specific burnup limit at the hot spot. The peak UO 2 burnup at the hot spot is based on the assembly with the maximum post-ejection F Q, which is typically a fresh fuel assembly. Therefore, the fuel melting temperatures represent bounding values for the assumed UO 2 burnup at the hot spot. The maximum burnup at the hot spot at BOL and EOL is confirmed to be below these values as part of the reload process. This assumption does not affect the maximum licensed fuel burnup limit. The results of the licensing basis rod ejection analyses demonstrated that the amount of fuel melting was limited to less than 10 percent of the fuel pellet at the hot spot for each of the rod ejection cases. 2.5.6.1.1 Introduction This accident is defined as a mechanical failure of a CRDM pressure housing resulting in the ejection of the RCCA and drive shaft. The consequence of this mechanical failure is a rapid, positive reactivity insertion together with an adverse core power distribution, possibly leading to localized fuel rod damage. The resultant core thermal power excursion is limited by the Doppler reactivity effect of the increased fuel temperature and terminated by reactor trip actuated by high nuclear power signals. A failure of a CRDM housing sufficient to allow a control rod to be rapidly ejected from the core is not considered credible for the following reasons: Each full-length CRDM housing is completely assembled and shop tested at 4100 psig. The mechanism housings are individually hydrotested after they are attached to the head adapters in the reactor vessel head and checked during the hydrotest of the completed RCS. Stress levels in the mechanism are not affected by anticipated system transients at power or by the thermal movement of the coolant loops. Moments induced by the design earthquake can be accepted within the allowable primary working stress ranges specified in the American Society of 2-275 WCAP-17658-NP September 2016 Licensing Report Revision 1-C Mechanical Engineers Boiler and Pressure Vessel Code (ASME B&PV),Section III, for Class I components. The latch mechanism housing and rod travel housing are each a single length of forged type-304 stainless steel. This material exhibits excellent notch toughness at all temperatures that will be encountered. A significant amount of margin of strength in the elastic range, together with the large energy absorption capability in the plastic range, gives additional assurance that the gross failure of the housing will not occur. The joints between the latch mechanism housing and rod housing are threaded joints reinforced by canopy-type rod welds. In general, the reactor is operated with the RCCAs inserted only far enough to permit load follow. Reactivity changes caused by the core depletion are compensated by boron changes. Furthermore, the location and grouping of control rod banks are selected during the nuclear design to lessen the severity of an RCCA ejection accident. Therefore, if an RCCA is ejected from its normal position during full-power operation, only a minor reactivity excursion, at worst, could be expected to occur. The position of all of the RCCAs is continuously indicated in the control room. An alarm will occur if a bank of RCCAs approaches its insertion limit or if one control rod assembly deviates from its bank. There are low and low-low level insertion alarm circuits for each bank. The control rod position monitoring and alarm systems are described in Reference 1. 2.5.6.1.2 Input Parameters, Assumptions, and Acceptance Criteria Input parameters for the analysis were conservatively selected on the basis of values calculated for this type of core. The most important parameters are discussed below. Table 2.5.6-1 presents the parameters used in this analysis.

Ejected Rod Worths and Hot Channel Factors The values for the ejected rod worths and hot channel factors were calculated using either 3-D static methods or a synthesis of 1-D and 2-D calculations. Standard nuclear design codes were used in the analysis. No credit was taken for the flux-flattening effects of reactivity feedback. The calculation was performed for the maximum allowed bank insertion at a given power level, as determined by the rod insertion limits. The analysis assumed adverse xenon distributions to provide worst-case results. Appropriate margins were added to the ejected rod worth and hot channel factors to account for any calculational uncertainties. Delayed Neutron Fraction, eff Calculations of the effective delayed neutron fraction (eff) typically yield values of approximately 0.75 percent at BOL and 0.40 percent at EOL. The ejected rod accident is sensitive to eff if the ejected rod worth is equal to or greater than eff , as in the zero-power transients. In order to allow for future fuel cycle flexibility, conservative estimates of eff of 0.49 percent at beginning of cycle and 0.44 percent at end of cycle were used in the analysis.

2-276 WCAP-17658-NP September 2016 Licensing Report Revision 1-C Reactivity Weighting Factor The largest temperature rises, and therefore the largest reactivity feedbacks, occur in channels where the power is higher than average. Since the weight of a region is dependent on flux, these regions have high weights. This means that the reactivity feedback is larger than that indicated by a simple channel analysis. Physics calculations have been carried out for temperature changes with a flat temperature distribution, and with a large number of axial and radial temperature distributions. Reactivity changes were compared and effective weighting factors determined. These weighting factors take the form of multipliers which, when applied to single-channel feedbacks, correct them to effective whole-core feedbacks for the appropriate flux shape. In this analysis, a 1-D (axial) spatial kinetics method was employed. Therefore, axial weighting is not necessary if the initial condition is made to match the ejected rod configuration. In addition, no weighting was applied to the moderator feedback. A conservative radial weighting factor was applied to the transient fuel temperature to obtain an effective fuel temperature as a function of time accounting for the missing spatial dimension. These weighting factors have also been shown to be conservative compared to 3-D analysis. Moderator and Doppler Coefficient The MTC and the DTC are combined and input as an isothermal temperature coefficient (ITC). The ITCs that were modeled are +7.695 pcm/°F at zero-power nominal T avg and +5.247 pcm/°F at full-power T avg for the BOL cases. These are very conservative values that easily bound the BOL MTC limit of +6 pcm/°F. For the EOL cases, the applicable zero-power ITC was -16.817 pcm/°F and the full-power MTC was -22.920 pcm/°F. The Doppler reactivity defect as a function of power level was adjusted in the nuclear code to a conservative design value using a Doppler weighting factor of 1.0. The Doppler weighting factor was increased under accident conditions, as discussed above. Heat Transfer Data The FACTRAN code (Reference 2), which contains standard curves of thermal conductivity versus fuel temperature, is used to determine the hot spot transient. During the transient, the peak centerline fuel temperature is nearly independent of the gap conductance. The cladding temperature is, however, strongly dependent on the gap conductance and is highest for high gap conductance. For conservatism, a low initial gap heat transfer coefficient was used at the beginning of the transient to maximize the initial fuel temperature and a high gap heat transfer coefficient value of 10,000 Btu/hr-ft 2 was used for the remainder of the transient to maximize the cladding temperature. This high gap heat transfer coefficient corresponds to a negligible gap resistance, and a further increase would have essentially no effect on the rate of heat transfer.

2-277 WCAP-17658-NP September 2016 Licensing Report Revision 1-C Coolant Mass Flow Rates When the core is operating at full power, all four RCPs are always operational. For zero-power conditions, the system was conservatively assumed to be operating with two pumps. The principal effect of operating at reduced flow is to reduce the film boiling heat transfer coefficient. This resulted in higher PCTs, but did not affect the peak centerline fuel temperature. Reduced flow also lowers the CHF. However, since DNB was always assumed at the hot spot, and since the heat flux rose very rapidly during the transient, this produced only second-order changes in the cladding and centerline fuel temperatures. Trip Reactivity Insertion The trip reactivity insertion was assumed to be 4.0 percent k from HFP conditions and 2.0 percent k from HZP conditions, including the effect of one stuck RCCA. These values were also reduced by the ejected rod reactivity. The shutdown reactivity was simulated by dropping a rod of the required worth into the core. The start of rod motion occurred 0.5 second after reaching the power range high neutron flux trip setpoint. It was assumed that insertion to dashpot did not occur until 2.7 seconds after the rods began to fall. The time delay to full insertion combined with the 0.5 second trip delay conservatively delayed insertion of shutdown reactivity into the core. Due to the extremely low probability of an RCCA ejection accident, this event is classified as a Condition IV event as defined by the ANS's "Nuclear Safety Criteria for the Design of Stationary Pressurized Water Reactor Plants," ANSI N18.2-1973. As such, some fuel damage is considered an acceptable consequence. The real physical limits of this accident are that the rod ejection event and any consequential damage to either the core or the RCS must not prevent long-term core cooling. More specific and restrictive criteria are applied to ensure that there is no fuel dispersal in the coolant and that gross lattice distortion or severe shock waves do not occur. Based on experimental data, Reference 1 concludes that the acceptance criteria to be applied for an RCCA ejection are: Average fuel pellet enthalpy at the hot spot must remain below 200 cal/gm for irradiated fuel. This bounds non-irradiated fuel, which has a slightly higher enthalpy limit. Peak reactor coolant pressure must be less than that which could cause RCS stresses to exceed the faulted-condition stress limits (Note: the peak pressure aspects of the rod ejection transient are addressed generically in Reference 1). Fuel melting is limited to less than the innermost 10 percent of the pellet volume at the hot spot even if the average fuel pellet enthalpy at the hot spot is below the 200 cal/gm fuel enthalpy limit.

2-278 WCAP-17658-NP September 2016 Licensing Report Revision 1-C 2.5.6.1.3 Description of Analyses and Evaluations This section describes the models used in the analysis of the rod ejection accident. Only the initial few seconds of the power transient are discussed since the long-term considerations are the same as those for a small LOCA. The calculation of the RCCA ejection transient was performed in two stages: first an average core channel calculation, and then a hot spot calculation. The average core calculation used spatial neutron-kinetics methods to determine the average power generation with time, including the various total core feedback effects; that is, Doppler reactivity and moderator reactivity. Enthalpy and temperature transients at the hot spot were then determined by multiplying the average core energy generation by the hot channel factor and performing a fuel rod transient heat transfer calculation. The power distribution calculated without feedback was conservatively assumed to continue throughout the transient. A detailed discussion of the method of analysis can be found in Reference 1. Average Core The spatial-kinetics computer code TWINKLE (Reference 3) was used for the average core transient analysis. This code solves the two-group neutron diffusion theory kinetic equation in one, two, or three spatial dimensions (rectangular coordinates) for six delayed neutron groups and up to 2000 spatial points. The computer code includes a detailed, multi-region, transient fuel-clad-coolant heat transfer model for calculation of pointwise Doppler and moderator feedback effects. This analysis used the code as a 1-D axial kinetics code since it allows a more realistic representation of the spatial effects of axial moderator feedback and RCCA movement. However, since the radial dimension was missing, it was still necessary to employ very conservative methods (descr ibed below) of calculating the ejected rod worth and hot channel factor. Hot Spot Analysis In the hot spot analysis, the initial heat flux is equal to the nominal heat flux times the design hot channel factor. During the transient, the heat flux hot channel factor is linearly increased to the transient value in 0.1 second, the time for full ejection of the rod. Therefore, the assumption is made that the hot spot before and after ejection are coincident. This is very conser vative since the peak after ejection will occur in or adjacent to the assembly with the ejected rod, and prior to ejection the power in this region will necessarily be depressed. The average core energy addition, calculated as described above, was multiplied by the appropriate hot channel factors. The hot spot analysis used the detailed fuel and cladding transient heat transfer computer code FACTRAN (Reference 2). This computer code calculates the transient temp erature distribution in a cross section of a metal-clad UO 2 fuel rod, and the heat flux at the surface of the rod, using the nuclear power versus time and local coolant conditions as input. The zirconium-water reaction is explicitly represented, and all material properties are represented as functions of temperature. A parabolic radial power distribution was assumed within the fuel rod.

2-279 WCAP-17658-NP September 2016 Licensing Report Revision 1-C FACTRAN uses the Dittus-Boelter or Jens-Lottes correlation to determine the film heat transfer before DNB, and the Bishop-Sandberg-Tong correlation to determine the film boiling coefficient after DNB. The Bishop-Sandberg-Tong correlation was conservatively used assuming zero bulk fluid quality. The DNB heat flux was not calculated. Instead, the code was forced into DNB by speci fying a conservative DNB heat flux. The gap heat transfer coefficient could be calculated by the code. However, it was adjusted to force the full-power, steady-state temperature distribution to agree with fuel heat transfer design codes. Reactor Protection The protection for this accident, as explicitly modeled in the analysis, is provided by the power range neutron flux trip (high and low settings). The power range high neutron flux positive rate trip complements the high flux trip function (high and low settings) to ensure that the criteria are met for rod ejection from partial power. 2.5.6.1.4 Results The results of the analyses performed for the rod ejection event, which cover BOL and EOL conditions at HFP and HZP for the WCGS, are discussed below. Beginning of Cycle, Zero Power The worst ejected rod worth and hot channel factor were conservatively calculated to be 0.78 percent k and 13.0, respectively. The peak hot spot average fuel pellet enthalpy reached 254.7 Btu/lbm (141.5 cal/gm). The peak fuel centerline temperature never reached the BOL melt temperature of 4900°F.

Therefore, no fuel melting is predicted. Beginning of Cycle, Full Power Control bank D was assumed to be inserted to its insertion limit. The worst ejected rod worth and hot channel factor were conservatively calculated to be 0.23 percent k and 6.6, respectively. The peak hot spot average fuel pellet enthalpy reached 317.6 Btu/lbm (176.4 cal/gm). The peak fuel centerline temperature reached the BOL melt temperature of 4900°F. However, fuel melting remained well below the limiting criterion of 10 percent of total pellet volume at the hot spot. End of Cycle, Zero Power The worst ejected rod worth and hot channel factor were conservatively calculated to be 0.86 percent k and 21.0, respectively. The peak hot spot average fuel pellet enthalpy reached 261.4 Btu/lbm (145.2 cal/gm). The peak fuel centerline temperature never reached the EOL melt temperature of 4800°F.

Therefore, no fuel melting is predicted.

2-280 WCAP-17658-NP September 2016 Licensing Report Revision 1-C End of Cycle, Full Power Control bank D was assumed to be inserted to its insertion limit. The ejected rod worth and hot channel factors were conservatively calculated to be 0.25 percent k and 7.1, respectively. The peak hot spot average fuel pellet enthalpy reached 305.4 Btu/lbm (169.7 cal/gm). The peak fuel centerline temperature reached the EOL melting temperature of 4800°F. However, fuel melting remained well below the limiting criterion of 10 percent of total pellet volume at the hot spot. A summary of the parameters used in the rod ejection analyses, and the analyses results, are presented in Table 2.5.6-1. The sequence of events for all four cases is presented in Table 2.5.6-2. Figure 2.5.6-1 shows the results for the BOL/HZP case and Figure 2.5.6-2 shows the BOL/HFP plot results. The EOL/HZP and EOL/HFP results are presented in Figures 2.5.6-3 and 2.5.6-4, respectively. A detailed calculation of the pressure surge for an ejected rod worth of 1 dollar at BOL HFP indicates that the peak pressure did not exceed that which would cause the RPV stress to exce ed the faulted condition stress limits (Reference 1). Since the severity of the present analysis di d not exceed the worst-case analysis, the accident for this plant will not result in an excessive pressure rise or further adverse effects on the RCS. 2.5.6.2 Conclusion Despite the conservative assumptions, the analyses indicate that the described fuel and cladding limits were not exceeded. It is concluded that there is no danger of sudden fuel dispersal into the coolant. Since the peak pressure did not exceed that which would cause stresses to exceed the faulted condition stress limits, it is concluded that there is no danger of further consequential damage to the RCS. Generic analyses demonstrated that the fission product release as a result of fuel rods entering DNB was limited to less than 10 percent of the fuel rods in the core. The results and conclusions of the analyses performed for the rupture of a CRDM housing RCCA ejection support operation up to the analyzed reactor core power of 3637 MWt.

Based on the review of the analyses of the rod ejection accident, it was concluded that the analyses have adequately accounted for plant operation at the stated power level and were performed using acceptable analytical models. It is further concluded that appropriate reactor protection and safety systems will prevent postulated reactivity accidents that could result in damage to the RCPB greater than limited local yielding, or cause sufficient damage that would significantly impair the capability to cool the core.

2-281 WCAP-17658-NP September 2016 Licensing Report Revision 1-C 2.5.6.3 References

1. Westinghouse Report WCAP-7588, Revision 1-A, "An Evaluation of the Rod Ejection Accident in Westinghouse Pressurized Water Reactors Using Special Kinetics Methods," January 1975.
2. Westinghouse Report WCAP-7908-A, "FACTRAN - A FORTRAN IV Code for Thermal Transients in a UO 2 Fuel Rod," December 1989.
3. Westinghouse Report WCAP-7979-P-A (Proprietary) and WCAP-8028-A (Non-Proprietary), "TWINKLE - A Multi-Dimensional Neutron Kinetics Computer Code," January 1975.

2-282 WCAP-17658-NP September 2016 Licensing Report Revision 1-C Table 2.5.6-1 Selected Input and Results of the Limiting RCCA Ejection Analyses Input BOC BOC EOC EOC Initial Reactor Core Power Level (MWt) 3637 0 3637 0 Ejected Rod Worth (%k) 0.23 0.78 0.25 0.86 Delayed Neutron Fraction (%) 0.49 0.49 0.44 0.44 Doppler Reactivity Weighti ng 1.433 2.309 1.499 3.078 Trip Reactivity (%k) 4.0 2.0 4.0 2.0 F Q Before Rod Ejection (fraction) 2.50 -- 2.50 --

F Q After Rod Ejection (fraction) 6.6 13.0 7.1 21.0 Number of Operating RCPs 4 2 4 2 Results BOC BOC EOC EOC Maximum Fuel Pellet Average Temperature (°F) 4041 3357 3911 3432 Maximum Fuel Centerline Temperature (°F) 4965 3867 4864 3869 Maximum Cladding Average Temperature (°F) 2270 2498 2191 2626 Maximum Fuel Stored Energy (cal/gm) 176.4 141.5 169.7 145.2 Maximum Fuel Melt at the Hot Spot (%) 4.62 0.00 3.96 0.00 2-283 WCAP-17658-NP September 2016 Licensing Report Revision 1-C Table 2.5.6-2 Time Sequence of Events - RCCA Ejection Event Time (seconds)

BOL HFP EOL HFP Initiation of Rod Ejection 0.0 0.0 Power Range Neutron Flux Setpoint Reached 0.05 0.04 Peak Nuclear Power Occurs 0.13 0.14 Rods Begin to Fall 0.55 0.54 Peak Fuel Average Temperature Occurs 2.22 2.33 PCT Occurs 2.28 2.37 Peak Heat Flux Occurs 2.30 2.38 Peak Fuel Centerline Temperature Occurs 4.00 4.09 BOL HZP EOL HZP Initiation of Rod Ejection 0.0 0.0 Power Range Neutron Flux Setpoint Reached 0.24 0.19 Peak Nuclear Power Occurs 0.28 0.22 Rods Begin to Fall 0.74 0.69 PCT Occurs 2.18 1.56 Peak Heat Flux Occurs 2.18 1.57 Peak Fuel Average Temperature Occurs 2.38 1.82 Peak Fuel Centerline Temperature Occurs 3.09 2.87 2-284 WCAP-17658-NP September 2016 Licensing Report Revision 1-C Figure 2.5.6-1. Rod Ejection - BOL/HZP 2-285 WCAP-17658-NP September 2016 Licensing Report Revision 1-C Figure 2.5.6-2. Rod Ejection - BOL/HFP 2-286 WCAP-17658-NP September 2016 Licensing Report Revision 1-C Figure 2.5.6-3. Rod Ejection - EOL/HZP 2-287 WCAP-17658-NP September 2016 Licensing Report Revision 1-C Figure 2.5.6-4. Rod Ejection - EOL/HFP 2-288 WCAP-17658-NP September 2016 Licensing Report Revision 1-C

2.6 INCREASE

IN REACTOR COOLANT INVENTORY

2.6.1 Inadvertent

Operation of the Emergency Core Cooling System During Power Operation (USAR Section 15.5.1) 2.6.1.1 Technical Evaluation 2.6.1.1.1 Introduction An inadvertent actuation of the ECCS at power event results in an increase in RCS inventory, leading to the potential filling of the pressurizer. Operator error or a spurious electrical actuating signal could cause the event. Following the actuation signal, the SI system is actuated, which results in borated water being pumped into the CL of each RCS loop. Normally, an SI act uation signal results in an immediate and automatic reactor trip, which in turn generates a turbine trip. However, even without an immediate reactor trip, the reactor will experience a negative reactivity excursion as a result of the borated water being injected. This negative reactivity results in a decrease in reactor power. In manual rod control, the primary-to-secondary system power mismatch causes a decrease in coolant temperature and a contraction of the reactor coolant. Assuming an immediate reactor trip signal is not received, the RCS responds with a decrease in pressurizer pressure and water level, and the turbine load will decrease because of reduced steam pressure once the turbine throttle valves are fully open. The decrease in RCS pressure results in an increase in SI flow because of the SI pump performance characteristics. In automatic rod control, RCCA withdrawal may compensate for the above effects as the control system responds to maintain programmed T avg. Once the rods have been fully withdrawn, the event continues as described for operation in manual rod control. The Inadvertent ECCS actuation at power event is performed to demonstrate that sufficient time is available for the appropriate operator actions to be taken to preclude a pressurizer water-solid condition. 2.6.1.1.2 Input Parameters, Assumptions, and Acceptance Criteria Input Parameters and Assumptions The following inputs and assumptions were applied in the analysis of the Inadvertent ECCS event: The initial NSSS power is 3651 MWt, which includes all applicable uncertainties. A full power T avg range of 570.7°F to 588.4°F was considered in the analysis. The limiting initial T avg is 566.7°F, which corresponds to the low nominal full power T avg minus uncertainties (including bias). The lower initial temperature corresponds to a higher reactor coolant mass, which leads to a more severe pressurizer water volume transient.

2-289 WCAP-17658-NP September 2016 Licensing Report Revision 1-C The initial Tfeed is 448.6°F, which corresponds to the high end of the full power T feed range (400.0°F to 448.6°F). The initial pressurizer water level is 46 percent span, which is the nominal pressurizer water level of 41 percent span at the low full power T avg of 570.7°F plus 5 percent span uncertainty. The initial pressurizer pressure is 2215 psia, which is the nominal value of 2250 psia minus 35 psi uncertainty. A lower initial RCS pressure is conservative because it allows higher SI flows to be injected into the RCS. The pressurizer proportional heaters and pressurizer sprays were modeled to function as-designed because their operation generates a more limiting condition with respect to filling the pressurizer. Because an SI signal causes the pressurizer backup heaters to be shed from their electric power supply, and they are not loaded onto another power supply automatically or manually until letdown flow is re-established, the backup heaters were not modeled. A maximum SGTP level of 10 percent was modeled. The total flow initially injected to the RCS corresponds to maximum flow from two centrifugal charging pumps (CCPs) and one normal charging pump; this total flow is reflective of SI flow to the CLs plus RCP seal injection flow. An immediate reactor trip on the SI actuation signal and a turbine trip derived from the reactor trip were modeled because these limit the primary-to-secondary heat transfer rate, thus minimizing the magnitude of the initial reactor coolant shrinkage. Within 6 minutes from event initiation, the plant operators are assumed to initiate actions to control RCS (CL) temperature to 557°F. This is conservatively modeled in the analysis by opening one of the four SG ARVs at 6 minutes after event initiation to control T cold to a temperature of 557°F. At 8 minutes after event initiation, operator action to terminate SI flow to the CLs was credited. After the SI flow is terminated, the only source of flow injection to the RCS is maximum RCP seal injection flow from one CCP. At 29.5 minutes after event initiation, operator action to re-establish letdown flow was credited. This was conservatively modeled by terminating the remaining flow injection to the RCS; no RCS inventory reduction was modeled in the analysis.

2-290 WCAP-17658-NP September 2016 Licensing Report Revision 1-C Acceptance Criteria Based on the expected frequency of occurrence, the Inadvertent ECCS event is considered to be a Condition II event as defined by the ANS's "Nuclear Safety Criteria for the Design of Stationary Pressurized Water Reactor Plants," ANSI N18.2-1973. The following items summarize the acceptance criteria associated with the analysis of this event: Fuel cladding integrity is maintained by ensuring that the minimum DNBR remains above the 95/95 DNBR SAL. Based on historical precedence, the Inadvertent E CCS event does not lead to a serious challenge of the DNB design basis. The conditions do not approach the core thermal DNB limits, as the core power, RCS pressure and RCS temperatures remain relatively unchanged. Therefore, the DNBR typically increases and does not approach the DNBR SAL following event initiation. As such, no explicit analysis of the event was performed to calculate a minimum DNBR value. Pressures in the RCS and MSS are maintained below 110 percent of the design pressures. With respect to the overpressure evaluation, the Inadvertent ECCS event is bounded by the LOL/TT event, discussed in Section 2.3.1, in which assumptions are made to conservatively maximize the RCS and MSS pressure transients. Fo r the Inadvertent ECCS event, turbine trip occurs following reactor trip, whereas for the LOL/TT event, the turbine trip is the initiating fault.

Therefore, the primary-to-secondary power mismatch and resultant RCS and MSS heatup and pressurization transients are always more severe for the LOL/TT event. For this reason, it is not necessary to calculate the maximum RCS or MSS pressures for the Inadvertent ECCS event. An incident of moderate frequency does not generate a more serious plant condition without other faults occurring independently. The major concern from an Inadvertent ECCS event is that associated with pressurizer filling. The pressurizer water volume increases for this event as a result of the flow injected to the RCS. This event is analyzed to demonstrate that sufficient time is available for the appropriate operator actions to be taken to preclude a pressurizer water-solid condition. The acceptance criteria identified above are based on meeting the relevant regulatory requirements of 10 CFR 50, Appendix A, "General Design Criteria for Nuclear Power Plants." Brief discussions of the specific GDCs that are related to the Inadvertent ECCS acceptance criteria are provided as follows. GDC 10 (Reactor Design) requires that the reactor core and associated coolant, control, and protection systems be designed with appropriate margin so specified acceptable fuel design limits are not exceeded during any condition of normal operation, including anticipated operational occurrences. For the Inadvertent ECCS event, this is shown to be met by demonstrating that the fuel cladding integrity is maintained.

2-291 WCAP-17658-NP September 2016 Licensing Report Revision 1-C GDC 15 (RCS Design) requires that the RCS and associated auxiliary, control, and protection systems be designed with sufficient margin so design conditions of the RCPB are not exceeded during any condition of normal ope ration, including anticipated ope rational occurrences. For the Inadvertent ECCS event, this is shown to be met by demonstrating that the peak RCS pressure is less than 110 percent of the design pressure. GDC 26 (Reactivity Control System Redundancy and Capability) requires the use of control rods capable of reliably controlling reactivity changes with appropriate margin for malfunctions such as stuck rods so that specified acceptable fuel design limits are not exceeded under conditions of normal operation, including anticipated operational occurrences. For the Ina dvertent ECCS event, which results in a reactor trip, this is shown to be met by demonstrating that the fuel cladding integrity is maintained with a trip reactivity that accounts for the most reactive rod stuck out of the core. 2.6.1.1.3 Description of Analyses and Evaluations The Inadvertent ECCS event was analyzed using the RETRAN computer code (Reference 1). The RETRAN model simulates the RCS, neutron kinetics, pressurizer, pressurizer relief and safety valves, pressurizer heaters, pressurizer spray, SI system, SGs, FW system, and MSSVs. The code computes pertinent plant variables including nuclear power, reactor coolant average temperature, RCS pressure, pressurizer water volume, and SG pressure. 2.6.1.1.4 Results The calculated sequence of events for the limiting Inadvertent ECCS case is presented in Table 2.6.1-1 and transient plots of the significant plant parameters are provided in Figures 2.6.1-1 through 2.6.1-3.

Reactor trip occurs at the event initiation followed by a rapid cooldown of the RCS. The initial coolant contraction results in a short-term reduction in pressurizer pressure and water level. The combination of the RCS heatup, due to residual RCS heat generation, and ECCS injected flow causes the pressure and level transients to rapidly turn around. The RCS heatup continues until a source of cooling is established, first via the automatic opening of the lowest-setting MSSV of each loop, and then via the single ARV that was modeled at 6 minutes after event initiation to simulate the plant operators taking action to control the RCS (CL) temperature to 557°F. The pressurizer water level increases rapidly until SI flow to the CLs is terminated at 8 minutes as a result of crediting operator action, after which the pressurizer level continues to increase at a much slower rate until letdown flow is assumed to be re-established (via operator action) at 29.5 minutes. The results of the analysis show that the pressurizer does not reach a water-solid condition provided that the plant operators initiate the required operator actions within the assumed time limits.

2-292 WCAP-17658-NP September 2016 Licensing Report Revision 1-C 2.6.1.2 Conclusion Based on the above information, it is concluded that the Inadvertent ECCS event will not progress into a more serious plant condition. Thus, all applicable event acceptance criteria are satisfied. It has been demonstrated that the reactor protection and safety systems ensure that the specified acceptable fuel design limits are met and the RCPB pressure limits will not be exceeded as a re sult of the Inadvertent ECCS event. Based on this, the plant will continue to meet the requirements of GDCs 10, 15, and 26. 2.6.1.3 References

1. Westinghouse Report WCAP-14882-P-A, "RETRAN-02 Modeling and Qualification for Westinghouse Pressurized Water Reactor Non-LOCA Safety Analyses," April 1999.

2-293 WCAP-17658-NP September 2016 Licensing Report Revision 1-C Table 2.6.1-1 Time Sequence of Events - Inadvertent ECCS Event Time Seconds Minutes Inadvertent ECCS/SI Signal Actuation 0.0 0.0 Reactor Trip due to SI Signal Turbine Trip from Reactor Trip Letdown Isolation On Each Loop, the MSSV with the Lowest Setting Opens 236.4 3.9 One ARV Begins to Open (1 st Operator Action) 360.0 6.0 All MSSVs Closed 373.5 6.2 SI Flow to CLs Terminated (2 nd Operator Action) 480.0 8.0 Letdown Flow Re-established (3 rd Operator Action) 1770.0 29.5 Maximum Pressurizer Water Volume (1786.5 ft

3) Reached 2450.0 40.8 2-294 WCAP-17658-NP September 2016 Licensing Report Revision 1-C Figure 2.6.1-1. Inadvertent ECCS - Nuclear Power and T avg versus Time 2-295 WCAP-17658-NP September 2016 Licensing Report Revision 1-C Figure 2.6.1-2. Inadvertent ECCS - Pressurizer Pressure and Water Volume versus Time 2-296 WCAP-17658-NP September 2016 Licensing Report Revision 1-C Figure 2.6.1-3. Inadvertent ECCS - Total Steam Flow and Total Flow Injected to the RCS versus Time 2-297 WCAP-17658-NP September 2016 Licensing Report Revision 1-C

2.6.2 Chemical

and Volume Control System Malfunction that Increases Reactor Coolant Inventory (USAR Section 15.5.2) 2.6.2.1 Technical Evaluation 2.6.2.1.1 Introduction Increases in reactor coolant inventory caused by a malfunction of the CVCS may be postulated to result from operator error or a false electrical signal. The transients examined in this section are characterized by increasing pressurizer level, increasing pressurizer pressure, and maintaining a constant boron concentration. The transients analyzed in this section are done to demonstrate that there is adequate time for the operator to take corrective action to prevent filling the pressurizer. An increase in reactor coolant inventory, which results from the addition of cold, unborated water to the RCS, is analyzed in Section 2.5.5, "Chemical and Volume Control System Malfunction That Results in a Decrease in Boron Concentration in the Reactor Coolant (USAR Section 15.4.6)." The most limiting case occurs if the charging system is in automatic control and the pressurizer level channel being used for charging control fails in a low direction. This causes the maximum charging flow to be delivered to the RCS and letdown flow to be isolated. The worst single failure for this event is a second pressurizer level channel failing in an as-is condition or a low condition. This defeats the reactor trip on two-out-of-three high pressurizer level channels. To prevent filling the pressurizer the operator must be relied upon to terminate charging flow.

2.6.2.1.2 Input Parameters, Assumptions, and Acceptance Criteria Input Parameters and Assumptions The following inputs and assumptions were applied in the analysis of the CVCS Malfunction event: The initial NSSS power is 3651 MWt, which includes all applicable uncertainties. A full power T avg range of 570.7°F to 588.4°F was considered in the analysis. The limiting initial T avg is 564.2°F, which corresponds to the low nominal full power T avg minus uncertainties (including bias). The lower initial temperature corresponds to a higher reactor coolant mass, which leads to a more severe pressurizer water volume transient. The initial Tfeed is 448.6°F, which corresponds to the high end of the full power T feed range (400.0°F to 448.6°F). The initial pressurizer water level is 46 percent level span, which is the nominal pressurizer water level of 41 percent span at the low full power T avg of 570.7°F plus 5 percent span uncertainty. The initial pressurizer pressure is 2200 psia, which is the nominal value of 2250 psia minus 50 psi uncertainty. A lower initial RCS pressure is conservative because it allows higher charging flows to be injected into the RCS.

2-298 WCAP-17658-NP September 2016 Licensing Report Revision 1-C The pressurizer heaters are modeled to function because their operation generates a more limiting condition with respect to filling the pressurizer. Cases were analyzed both with and without automatic pressurizer spray modeled. A maximum SGTP level of 10 percent was modeled. The flow injected to the RCS corresponds to maximum flow from one CCP. No reactor trip at event initiation. Cases were analyzed with both maximum and minimum reactivity feedback conditions. Cases were analyzed both with and without automatic rod control. Acceptance Criteria Based on the frequency of occurrence, the CVCS Malfunction event is considered to be a Condition II event as defined by the ANS's "Nuclear Safety Criteria for the Design of Stationary Pressurized Water Reactor Plants," ANSI N18.2-1973. The following items summarize the acceptance criteria associated with the analysis of this event: Fuel cladding integrity is maintained by ensuring that the minimum DNBR remains above the 95/95 DNBR SAL.

Based on historical precedence, the CVCS Malfunction event does not lead to a serious challenge of the DNB design basis. The conditions do not approach the core thermal DNB limits, as the core power, RCS pressure, and RCS temperatures remain relatively unchanged. Therefore, the DNBR typically increases and does not approach the DNBR SAL following event initiation. As such, no explicit analysis of the event was performed to calculate a minimum DNBR value. Pressures in the RCS and MSS are maintained below 110 percent of the design pressures. With respect to the overpressure evaluation, the CVCS Malfunction event is bounded by the LOL/TT event, discussed in Section 2.3.1, in which assumptions are made to conservatively maximize the RCS and MSS pressure transients.

For this event, a turbine trip would occur following a reactor trip, whereas for the LOL/TT event, the turbine trip is the initiating fault. Therefore, the primary-to-secondary power mismatch and resultant RCS and MSS heatup and pressurization transients are always more severe for the LOL/TT event. For this reason, it is not necessary to calculate the maximum RCS or MSS pressures for the CVCS Malfunction event.

2-299 WCAP-17658-NP September 2016 Licensing Report Revision 1-C An incident of moderate frequency does not generate a more serious plant condition without other faults occurring independently. The major concern from a CVCS Malfunction event is that associated with pressurizer filling. The pressurizer water volume increases for this event as a result of the flow injected to the RCS. This event is analyzed to demonstrate that sufficient time is available for the appropriate operator actions to be taken to preclude a pressurizer water-solid condition. The acceptance criteria identified above are based on meeting the relevant regulatory requirements of 10 CFR 50, Appendix A, "General Design Criteria for Nuclear Power Plants." Brief discussions of the specific GDCs that are related to the CVCS Malfunction acceptance criteria are provided as follows. GDC 10 (Reactor Design) requires that the reactor core and associated coolant, control, and protection systems be designed with appropriate margin so specified acceptable fuel design limits are not exceeded during any condition of normal operation, including anticipated operational occurrences. For the CVCV Malfunction event, this is shown to be met by demonstrating that the fuel cladding integrity is maintained. GDC 15 (RCS Design) requires that the RCS and associated auxiliary, control, and protection systems be designed with sufficient margin so design conditions of the RCPB are not exceeded during any condition of normal ope ration, including anticipated ope rational occurrences. For the CVCS Malfunction event, this is shown to be met by demonstrating that the peak RCS pressure is less than 110 percent of the design pressure. GDC 26 (Reactivity Control System Redundancy and Capability) requires the use of control rods capable of reliably controlling reactivity changes with appropriate margin for malfunctions like stuck rods so that specified acceptable fuel design limits are not exceeded under conditions of normal operation, including anticipated operational occurrences. For the CVCS Malfunction event, this is shown to be met by demonstrating that the fuel cladding integrity is maintained. 2.6.2.1.3 Description of Analyses and Evaluations The CVCS Malfunction event was analyzed using the RETRAN computer code (Reference 1). The RETRAN model simulates the RCS, neutron kinetics, pressurizer, pressurizer relief and safety valves, pressurizer heaters, pressurizer spray, SI system, SGs, FW system, and MSSVs. The code computes pertinent plant variables including nuclear power, reactor coolant average temperature, RCS pressure, pressurizer water volume, and SG pressure.

2-300 WCAP-17658-NP September 2016 Licensing Report Revision 1-C 2.6.2.1.4 Results In all cases analyzed, the core power and RCS temperatures remain relatively constant. Cases both with and without automatic rod control were examined. Because there was little or no change in core power and RCS average temperatures, the results showed that automatic control has no effect on the cases that model maximum reactivity feedback conditions and a relatively negligible effect on the cases that model minimum reactivity feedback conditions. Figures 2.6.2-1 through 2.6.2-8 show the transient responses for the cases with automatic rod control modeled. The calculated sequences of events for these cases are presented in Table 2.6.2-1. The cases that model maximum reactivity feedback show that the pressurizer level increases at a relatively constant rate; whereas, the cases that model minimum reactivity feedback show that the pressurizer level increases at a somewhat varying rate. This is because the reactivity feedback in the maximum feedback cases is of a magnitude that it is able to maintain T avg within the temperature deadband for the automatic rod control system, and no rod movement is predicted in these cases. However, rod movement is predicted in the minimum feedback cases, resulting in slight variations in T avg and ultimately in the pressurizer level increase in these cases. The pressurizer level rate of increase is slightly faster in the cases where the pressurizer spray is modeled operable, as compared to the cases in which the pressurizer sprays are modeled inoperable, because spray actuation tends to keep the RCS pressure lower for several minutes, which allows the charging pumps to deliver more flow to the RCS. However, pressurizer pressure does eventually increase enough to open the relief valves in the cases with the pressurizer spray modeled operable. The limiting case, shown in Figures 2.6.2-5 and 2.6.2-6, models minimum reactivity feedback conditions and the pressurizer sprays operable. In this case, the pressurizer high level alarm is reached in approximately 8.8 minutes and the pressurizer reaches a water-solid condition at approximately 17.3 minutes. This allows the operators 8.5 minutes from the time the pressurizer high level alarm is reached to terminate normal charging flow before pressurizer filling occurs. Thus, with respect to the criterion of precluding the generation of a more serious plant condition, there is sufficient time for the operators (more than 8 minutes) to respond to the event and terminate the reactor coolant inventory addition. 2.6.2.2 Conclusion Based on the above information, it is concluded that the CVCS Malfunction event will not progress into a more serious plant condition. Thus, all applicable event acceptance criteria are satisfied. It has been demonstrated that the reactor protection and safety systems ensure that the specified acceptable fuel design limits are met and the RCPB pressure limits will not be exceeded as a result of the CVCS Malfunction event. Based on this, the plant will continue to meet the requirements of GDCs 10, 15, and 26.

2.6.2.3 References

1. Westinghouse Report WCAP-14882 -P-A, "RETRAN-02 Modeling and Qualification for Westinghouse Pressurized Water Reactor Non-LOCA Safety Analyses," April 1999.

2-301 WCAP-17658-NP September 2016 Licensing Report Revision 1-C Table 2.6.2-1 Time Sequence of Events - CVCS Malfunction Case Event Time Seconds Minutes Maximum Reactivity Feedback, with pressurizer spray Two Pressurizer Level Channels Fail Low 0.0 0.0 Maximum Charging Flow from One CCP Begins 0.0 0.0 Letdown is Isolated 0.0 0.0 Low-Low Pressurizer Level Alarm 0.0 0.0 High Pressurizer Level Alarm 514.6 8.6 Pressurizer Fills 1049.5 17.5 Pressurizer Relief Valve Setpoint Reached 1054.3 17.6 End of Transient 1800.0 30.0 Maximum Reactivity Feedback, without pressurizer spray Two Pressurizer Level Channels Fail Low 0.0 0.0 Maximum Charging Flow from One CCP Begins 0.0 0.0 Letdown is Isolated 0.0 0.0 Low-Low Pressurizer Level Alarm 0.0 0.0 Pressurizer Relief Valve Setpoint Reached 15.4 0.3 High Pressurizer Level Alarm 609.1 10.2 Pressurizer Fills 1365.7 22.8 End of Transient 1800.0 30.0 Minimum Reactivity Feedback, with pressurizer spray Two Pressurizer Level Channels Fail Low 0.0 0.0 Maximum Charging Flow from One CCP Begins 0.0 0.0 Letdown is Isolated 0.0 0.0 Low-Low Pressurizer Level Alarm 0.0 0.0 High Pressurizer Level Alarm 529.3 8.8 Pressurizer Fills 1036.4 17.3 Pressurizer Relief Valve Setpoint Reached 1239.8 20.7 End of Transient 1800.0 30.0 Minimum Reactivity Feedback, without pressurizer spray Two Pressurizer Level Channels Fail Low 0.0 0.0 Maximum Charging Flow from One CCP Begins 0.0 0.0 Letdown is Isolated 0.0 0.0 Low-Low Pressurizer Level Alarm 0.0 0.0 Pressurizer Relief Valve Setpoint Reached 24.5 0.4 High Pressurizer Level Alarm 597.6 10.0 Pressurizer Fills 1345.7 22.4 End of Transient 1800.0 30.0 2-302 WCAP-17658-NP September 2016 Licensing Report Revision 1-C Figure 2.6.2-1. CVCS Malfunction, Maximum Reactivity Feedback, With Pressurizer Spray Nuclear Power and Tavg versus Time 2-303 WCAP-17658-NP September 2016 Licensing Report Revision 1-C Figure 2.6.2-2. CVCS Malfunction, Maximum Reactivity Feedback, With Pressurizer Spray Pressurizer Pressure and Water Volume versus Time 2-304 WCAP-17658-NP September 2016 Licensing Report Revision 1-C Figure 2.6.2-3. CVCS Malfunction, Maximum Reactivity Feedback, Without Pressurizer Spray Nuclear Power and Tavg versus Time 2-305 WCAP-17658-NP September 2016 Licensing Report Revision 1-C Figure 2.6.2-4. CVCS Malfunction, Maximum Reactivity Feedback, Without Pressurizer Spray Pressurizer Pressure and Water Volume versus Time 2-306 WCAP-17658-NP September 2016 Licensing Report Revision 1-C Figure 2.6.2-5. CVCS Malfunction, Minimum Reactivity Feedback, With Pressurizer Spray Nuclear Power and Tavg versus Time 2-307 WCAP-17658-NP September 2016 Licensing Report Revision 1-C Figure 2.6.2-6. CVCS Malfunction, Minimum Reactivity Feedback, With Pressurizer Spray Pressurizer Pressure and Water Volume versus Time 2-308 WCAP-17658-NP September 2016 Licensing Report Revision 1-C Figure 2.6.2-7. CVCS Malfunction, Minimum Reactivity Feedback, Without Pressurizer Spray Nuclear Power and Tavg versus Time 2-309 WCAP-17658-NP September 2016 Licensing Report Revision 1-C Figure 2.6.2-8. CVCS Malfunction, Minimum Reactivity Feedback, Without Pressurizer Spray Pressurizer Pressure and Water Volume versus Time 2-310 WCAP-17658-NP September 2016 Licensing Report Revision 1-C

2.7 DECREASE

IN REACTOR COOLANT INVENTORY

2.7.1 Inadvertent

Opening of a Pressurizer Safety or Relief Valve (USAR Section 15.6.1) 2.7.1.1 Technical Evaluation 2.7.1.1.1 Introduction An accidental depressurization of the RCS could occur as a result of an inadvertent opening of a pressurizer relief or spray valve. To conservatively bound this scenario, the Westinghouse methodology models the failure of a PSV, because a PSV is sized to relieve approximately twice the steam flow of a pressurizer PORV and thus results in a much more rapid depressurization upon opening. The depressurization resulting from an open PSV is also much more rapid than would occur from the accidental actuation of pressurizer spray. Therefore, the failure of a PSV yields the most severe core conditions resulting from an accidental depressurization of the RCS. It should be noted that a stuck-open PSV is not an event of moderate frequency (i.e., Condition II event) such as a control system failure would be. A stuck-open PSV is considered to be a SBLOCA (i.e., Condition III event) during which the RCS cannot be isolated, whereas the failure of a PORV can be terminated by the closure of the PORV block valve. The results of this analysis are shown to comply with the more restrictive Condition II acceptance criterion of ensuring that the DNB design basis is met. Initially, the event results in a rapidly decreasing RCS pressure, which could reach HL saturation conditions without reactor protection system intervention. If saturated conditions are reached, the rate of depressurization is slowed considerably. However, the pressure continues to decrease throughout the event. The power remains essentially constant throughout the initial stages of the transient. The reactor may be tripped by the following RTS signals: OTT Pressurizer low pressure 2.7.1.1.2 Input Parameters, Assumptions, and Acceptance Criteria To produce conservative results in calculating the DNBR during the transient, the following assumptions were made:

The accident was analyzed using the RTDP (Reference 1). Pressurizer pressure and RCS temperature were assumed to be at their nominal values, consistent with steady-state full-power operation. Reactor coolant minimum measured flow was modeled. Uncertainties in initial conditions were included in the DNBR SAL as described in Reference 1. The event is conservatively analyzed at an initial NSSS power level of 3651 MWt, which includes nominal RCP net heat input; no additional uncertainty on core power is modeled.

2-311 WCAP-17658-NP September 2016 Licensing Report Revision 1-C A zero moderator coefficient of reactivity was assumed. This is conservative for BOL operation in order to provide a conservatively low amount of negative reactivity feedback due to changes in moderator temperature. A small (absolute value) Doppler coefficient of reactivity is assumed, such that the resultant amount of negative feedback is conservatively low in order to maximize any power increase due to moderator feedback. The spatial effect of voids resulting from local or subcooled boiling was not considered in the analysis with respect to reactivity feedback or core power shape. In fact, it should be noted that the power peaking factors were kept constant at their design values, while the void formation and resulting core feedback effects would result in considerable flattening of the power distribution. Although this would increase the calculated DNBR, no credit was taken for this effect. The analysis performed assumes that the rod control system is in automatic. However, no rod motion occurs during the transient because the conditions do not change enough to demand any rod motion from the rod control system. Therefore, the transient results are identical with or without automatic rod control. Based on its frequency of occurrence, the accidental depressurization of the RCS accident is considered to be a Condition II event as defined by the ANS's "Nuclear Safety Criteria for the Design of Stationary Pressurized Water Reactor Plants," ANSI N18.2-1973. The following items summarize the acceptance criteria associated with this event: The critical heat flux should not be exceeded. This criterion was met by demonstrating that the minimum DNBR does not go below the limit value at any time during the transient. Pressure in the RCS and MSS should be maintained below 110 percent of the design pressures. Note that because this event is a depressurization event, these limits are not challenged. Both primary and secondary pressures decrease for the entire duration of the event. As discussed above, the accidental depressurization of the RCS event has historically been analyzed to show that the minimum DNBR limit is not exceeded. However, during the licensing pre-application meetings between Westinghouse, WCNOC, and the USNRC, the USNRC requested that the potential for pressurizer filling dur ing the event, due to the actuation of the SI system, be considered. Consistent with that request, an additional sensitivity was performed to show that the pressurizer would not overfill such th at the transient would not transition to a more serious plant condition. 2.7.1.1.3 Description of Analyses and Evaluations The purpose of this analysis was to demonstrate that the RTS functions and mitigates the consequences of the RCS depressurization event. This analysis is concerned with the transient from initiation through just past the time of reactor trip. With respect to long-term post-accident recovery, it is assumed that operators follow approved plant procedures to bring the plant to a safe post-accident condition.

2-312 WCAP-17658-NP September 2016 Licensing Report Revision 1-C The accident was analyzed by using the detailed digital computer code RETRAN (Reference 2). This code simulates the neutron kinetics, RCS, pressurizer, pressurizer relief and safety valves, pressurizer spray, SG, and SG safety valves. The code computes pertinent plant variables including temperatures, pressures, and power level. RETRAN was used to conservatively predict DNBR. 2.7.1.1.4 Results The system response to an inadvertent opening of a PSV is shown in Figures 2.7.1-1 through 2.7.1-4. Figure 2.7.1-1 illustrates the nuclear power transient. Nuclear power remains essentially unchanged until the reactor trip occurs on OTT. The pressurizer pressure transient is illustrated in Figure 2.7.1-2. Pressure decreases continuously throughout the transient. However, pressure decreases more rapidly after

core heat generation is reduced via the reactor trip. Figure 2.7.1-3 shows the loop average temperature transient. The loop average temperature decreases slowly until the reactor trip occurs. The DNBR decreases initially, but increases rapidly following the reactor trip as demonstrated in Figure 2.7.1-4. The DNBR remains above the SAL throughout the transient. The calculated sequence of events is shown in Table 2.7.1-1. The calculated minimum DNBR value is provided in Table 2.7.1-2.

The results of the analysis show that the OTT RTS function provides adequate protection against the RCS depressurization event because the minimum DNBR remains above the SAL throughout the transient. Therefore, no cladding damage or release of fission products to the RCS is predicted for this event. With regards to overfill, the WCGS has a pressurizer PORV interlock that is set to 2185 psig. When the pressurizer pressure reaches the PORV interlock setpoint, the PORV block valves are closed. A detailed RETRAN analysis was performed to demonstrate that the PORV block valves close prior to the pressurizer pressure reaching the Pressurizer Pressure - Low, SI setpoint. This will prevent the SI system from actuating; without the addition of SI, pressurizer filling does not occur. The RETRAN analysis conservatively modeled signal processing time, valve stroke time, and instrument uncertainties to increase the likelihood of SI actuation. 2.7.1.2 Conclusion The RCS depressurization analysis demonstrates that for this event at WCGS, the DNBR does not decrease below the SAL value at any time. The event does not challenge the primary and secondary side pressure limits because this is a depressurization event. Thus, all applicable acceptance criteria for this event are met for the WCGS operating at a nominal NSSS power of up to 3651 MWt. 2.7.1.3 References

1. Westinghouse Report WCAP-11397-P-A, "Revised Thermal Design Procedure," April 1989.
2. Westinghouse Report WCAP-14882-P-A, "RETRAN-02 Modeling and Qualification for Westinghouse Pressurized Water Reactor Non-LOCA Safety Analyses," April 1999.

2-313 WCAP-17658-NP September 2016 Licensing Report Revision 1-C Table 2.7.1-1 Time Sequence of Events - Accidental Depressurization of the RCS Event Time (seconds) One PSV opens fully 0.0 OTT Reactor Trip setp oint reached 21.4 Rods begin to drop 24.4 Minimum DNBR 25.0 Table 2.7.1-2 Results - Accidental Depressurization of the RCS Minimum Calculated DNBR DNBR SAL 2.00 1.52

2-314 WCAP-17658-NP September 2016 Licensing Report Revision 1-C Figure 2.7.1-1. RCS Depressurization - Nuclear Power versus Time Figure 2.7.1-2. RCS Depressurization - Pressurizer Pressure versus Time 2-315 WCAP-17658-NP September 2016 Licensing Report Revision 1-C Figure 2.7.1-3. RCS Depressurization - Indicated Loop Average Temperature versus Time Figure 2.7.1-4. RCS Depressurization - DNBR versus Time 2-316 WCAP-17658-NP September 2016 Licensing Report Revision 1-C

2.7.2 Steam

Generator Tube Rupture Marg in to Overfill (USAR Section 15.6.3) 2.7.2.1 Technical Evaluation 2.7.2.1.1 Introduction The major hazard associated with a SGTR event is the radiological consequences resulting from the transfer of radioactive primary coolant to the secondary side of the ruptured SG and subsequent release of radioactivity to the atmosphere. One major concern for an SGTR is the possibility of ruptured SG overfill because this could potentially result in a significant increase in the radiological consequences. Therefore, an analysis was performed to demonstrate that the ruptured SG does not overfill and release water from the main steam relief valves, assuming the limiting single failure relative to overfill. The analysis confirmed that water releases through the SG safety valves did not occur. The SGTR margin to overfill transient analysis was performed using the RETRAN computer program (Reference 1) following the methodology developed in WCAP-10698-P-A and its Supplement 1 (References 2 and 3). Modifications were made to address NSAL-07-11 (Reference 4), which identified a potential non-conservative assumption. This regards the direction of conservatism for decay heat in the Reference 2 methodology for demonstrating margin to overfill. The plant response to the SGTR was modeled using conservative assumptions of break size and location, condenser availability, and initial secondary water mass. The analyses include the simulation of the operator actions for recovery from an SGTR based on the WCGS Emergency Operating Procedures (EOPs), which are based on the Westinghouse Owners Group Emergency Response

Guidelines. The SGTR margin to overfill analysis was performed for the time period from the SGTR until the primary and secondary pressures equalized (break flow termination). In the ruptured SG secondary side, the water volume was calculated as a function of time to demonstrate that overfill did not occur.

The SGTR margin to overfill analysis supports operation at a core power up to 3637 MWt. The analysis supports a full power RCS T avg operating range from 575.0F to 588.4F, and a main Tfeed range from 400F to 448.6F, with up to 10 percent of the SG tubes plugged. 2.7.2.1.2 Input Parameters, Assumptions, and Acceptance Criteria The margin to overfill analysis modeled the plant operating at the lower end of the T avg range. A lower operating temperature results in a higher mass flow rate through the broken tube and less steam released from the ruptured SG. The analysis assumed that the plant was operating with the T feed at the low end of the temperature range. This results in a higher mass of water in the SG at the start of the event, which limits the amount of break flow and AFW that can accumulate in the ruptured SG without forcing water into the steam lines. The maximum SGTP was modeled because it reduces heat transfer to the ruptured SG, which reduces the mass released by steaming, which in turn reduces margin to overfill. The reduced heat transfer also prolongs the cooldown period, leading to delayed break flow termination. Sensitivity runs were made to confirm the conservative nature of these plant operating assumptions.

2-317 WCAP-17658-NP September 2016 Licensing Report Revision 1-C 2.7.2.1.2.1 Design Basis Accident The accident modeled was a double-ended break of one SG tube located at the top of the tube sheet on the outlet (cold leg) side of the SG. The location of the break on the cold side of the SG results in higher primary to secondary break flow than a break on the hot side of the SG. It was also assumed that a LOOP occurs at the time of reactor trip, and the highest worth control rod assembly was assumed to be stuck in its fully withdrawn position at reactor trip. 2.7.2.1.2.2 Single Failure Considerations An evaluation was performed to determine the limiting single failure with respect to margin to SG overfill for an SGTR. To identify the limiting single failure, sensitivity runs were performed considering the following failures: Failure of an Intact SG ARV or Failure of Multiple SG ARVs This scenario considered the failure of an ARV to open on one of the intact SGs when the operator performed the RCS cooldown. Because offsite power was assumed to be lost at reactor trip for the SGTR analyses, the SG ARVs were relied upon to cool the RCS. Failure of an ARV on an intact SG to open on demand reduced the steam release capability provided by the ARVs because only two intact SG ARVs are available for the cooldown. This increased the time required for the cooldown, resulting in increased break flow. A single failure that results in the failure of multiple SG ARVs does not exist in the WCGS design. Each SG ARV can be actuated by an independent safety-related compressed gas supply. A failure of any one of the four compressed gas supplies would only affect the associated SG ARV, and would not affect the other three SG ARVs. Failure of the MDAFW Control Valve This scenario considered the failure of the MDAFW control valve to isolate MDAFW flow to the ruptured SG when the TDAFW flow is isolated. This required additional operator action to manually isolate the MDAFW flow, resulting in increased AFW flow to the ruptured SG. The cooldown was performed using all three of the ARVs on the intact SGs. The MDAFW control valve failure was determined to be the limiting single failure. The penalty from the delay to terminate AFW flow to the ruptured SG that resulted from the AFW control valve failure resulted in the largest secondary side inventory. The effects of adding more inventory to the ruptured SG through longer AFW flow duration offset the effects of the other intact SG ARV failure, which prolonged cooldown and break flow termination. 2.7.2.1.2.3 Conservative Assumptions Plant responses until break flow termination were calculated using the RETRAN computer code. The conservative conditions and assumptions used in Reference 2 were also used in the analysis to determine margin to SG overfill with the exception of the following differences:

2-318 WCAP-17658-NP September 2016 Licensing Report Revision 1-C Turbine Runback The mass increase due to turbine runback is the mass corresponding to power at the end of turbine runback minus the mass at 100 percent power. A power reduction of 10%/min for turbine runback is assumed, where the turbine runback duration is the smaller value of reactor trip time or 3 minutes. The reduction in power that would result from the turbine runback during that period is used to develop a secondary mass penalty associated with the runback. SG Secondary Mass A higher initial secondary water mass in the ruptured SG was determined by Reference 2 to be conservative for overfill. The increase in mass that would result from a turbine runback to a lower power (discussed in the prior item) and the consideration of mass uncertainties are added to the initial secondary water mass. Intact SG Target Pressures The intact SG target pressures are calculated based on the target temperature and the intact loop T at the time cooldown is terminated instead of at the start of cooldown. This exception is justified because it is consistent with the WCGS EOPs. AFW Isolation Based Solely on SG Level The analysis modeled AFW flow isolation based on ruptured SG level with no consideration of a time component. The SG level for AFW isolation from the WCGS EOPs is 6 percent NRS. (Note that the analysis used a conservative SG level of 15 percent NRS.) This exception is justified because it is a more realistic modeling of the operator response to an SGTR accident. Decay Heat and NSAL-07-11 NSAL-07-11 (Reference 4) identifies a potential non-conservative assumption regarding the direction of conservatism for decay heat in the Reference 2 methodology for evaluating margin to overfill. For the margin to overfill analysis, higher decay heat yields a benefit by increasing steam releases from the ruptured SG, but results in a penalty from a longer cooldown and a conservatively delayed break flow termination. Conversely, lower decay heat yields a penalty by reducing steam releases from the ruptured SG, but results in a benefit from a shorter cooldown and earlier break flow termination. Similar impacts were identified for the AFW and SI flow enthalpies. The relative importance of these competing effects is plant-specific, and plant-specific analyses are required to determine the conservative assumption. Plant-specific sensitivities performed for WCGS showed the following to be conservative with respect to margin to overfill for the limiting cases:

- 1979-2 ANS decay heat was conservative compared to the 1971+20% ANS decay heat model specified in Reference 2. For this analysis, the 1979 ANS decay heat model minus 2 uncertainty was used.

2-319 WCAP-17658-NP September 2016 Licensing Report Revision 1-C

- Minimum AFW enthalpy was conservative compared to the maximum AFW enthalpy specified by Reference 2. For this analysis, the minimum AFW enthalpy of 18.1 Btu/lbm was modeled.

- Minimum SI enthalpy was conservative compared to the maximum SI enthalpy modeled in Reference 2. For this analysis, the minimum SI enthalpy of 11.53 Btu/lbm was modeled. 2.7.2.1.2.4 Plant Input The following significant WCGS input was used in the analysis:

1. SG ARV It was assumed that a LOOP occurs at reactor trip for the SGTR analyses, and thus the SG ARVs open to limit the secondary pressure. The ARV pressure setpoint is 1139.7 psia (1125 psig). The ARV capacity modeled in the analysis is 594,642 lbm/hr/valve at a reference pressure of 1107 psia (1092.3 psig).
2. Pressurizer PORV Capacity It was assumed that a LOOP occurs at reactor trip for the SGTR analyses, and thus the pressurizer PORV was relied upon to depressurize the RCS. The capacity of 210,000 lbm/hr at 2350 psia was used in the analysis.
3. AFW System Operation and Associated Single Failure Considerations The WCGS AFW system consists of two MDAFW pumps and one TDAFW pump. Each MDAFW pump normally feeds two SGs and the TDAFW pump feeds all four SGs. There is a control valve in the flow path from the MDAFW pump to each SG and a control valve in the flow path from the TDAFW pump to each SG. The control valves in the MDAFW pump and TDAFW pump flow paths are used to control the inventory in the SGs, and are closed to isolate AFW flow to the ruptured SG in accordance with WCGS Emergency Mitigation Guideline E-3 for SGTR recovery. The control valves for the MDAFW pumps are controlled to throttle the flow as required to maintain the level in the associated SG between 29 percent and 50 percent NRS, and can also be manually controlled by the operator to adjust flow to the SGs. Also, the automatic level control function of the MDAFW pump control valves is not credited to reduce the liquid inventory in the ruptured SG. The control valves for the TDAFW pump have no automatic control features. They are manually throttled to adjust flow to maintain the desired level in the SGs. The AFW flow rates for WCGS are dependent on the number of MDAFW and TDAFW pumps that are operating as well as the SG pressure. Flow to an SG from one or more pumps may be throttled or isolated depending on the time in the transient progression, the level in the SG, and the single failure being considered. All AFW pumps are assumed to be operating following reactor trip and LOOP. The operators will isolate flow from the TDAFW pump and then isolate flow from the MDAFW pump to the ruptured SG. The single failures are discussed in detail later in this report. The associated AFW flows are outlined below.

2-320 WCAP-17658-NP September 2016 Licensing Report Revision 1-C

a. MDAFW Failure AFW Flows The MDAFW failure is the failure of the MDAFW control valve to throttle or isolate on demand by the control system or by manual operator action. This failure would cause additional AFW flow to be delivered to the ruptured SG until the associated MDAFW pump is stopped. This terminates all AFW flow to the ruptured SG and one intact SG, and leaves the MDAFW pumps providing flow to two intact SGs. It is assumed that the AFW flow to the third intact SG is restored by the start of the cooldown. The AFW flow rates to the ruptured and intact SGs for the MDAFW failure are shown in Tables 2.7.2-1 through 2.7.2-3.
b. Intact SG ARV Failure AFW Flows The intact SG ARV failure is the failure of an ARV on one intact SG to open for cooldown. This failure has no impact on the AFW flows and the AFW system. The AFW flow rates to the intact SGs and to the ruptured SG prior to isolation are the same as shown in Table 2.7.2-3. 4. SI Flows The maximum SI flow was assumed to be initiated at the low pressurizer pressure setpoint of 1974.7 psia. This setpoint is based upon a nominal value with the instrument uncertainties applied in the conservative direction. The flow rates are presented in Table 2.7.2-4. 2.7.2.1.2.5 Operator Action Times In the event of an SGTR, the operator is required to take actions to stabilize the plant and terminate the primary to secondary break flow. The operator actions for SGTR recovery are provided in the WCGS EOPs, and major actions were explicitly modeled in these analyses. The operator actions modeled include isolation of the ruptured SG, cooldown of the RCS, depressurization of the RCS to restore inventory, and termination of SI to stop primary to secondary break flow. These operator actions are described below.
1. Identify the Ruptured SG High secondary side activity, as indicated by the main steamline radiation monitor (or other secondary monitors) or high SG sample activity typically will provide the first indication of an SGTR event. The ruptured SG can be identified by a mismatch between steam and FW flows, high activity in an SG water sample, or a high radiation indication on the corresponding main steamline radiation monitor. For an SGTR that results in a reactor trip at high power as assumed in these analyses, the SG water level, as indicated on the narrow range, will decrease significantly for all of the SGs. The AFW flow will begin to refill the SGs, distributing approximately equal flow to each of the SGs. Because primary to secondary break flow adds additional inventory to the ruptured SG, the water level will increase more rapidly in that SG. This response, as displayed by the SG water level instrumentation, provides confirmation of an SGTR event and also identifies the ruptured SG.

2-321 WCAP-17658-NP September 2016 Licensing Report Revision 1-C

2. Isolate the Ruptured SG Once the ruptured SG has been identified, recovery actions begin by isolating AFW flow to the ruptured SG and closing the MSIV on the ruptured SG steamline. In addition to minimizing radiological releases, this also reduces the possibility of filling the ruptured SG by minimizing the accumulation of AFW. The operator can also establish a pressure differential between the ruptured and intact SGs, which is a necessary step toward terminating primary to secondary break flow. In the WCGS EOPs for SGTR, the operator is directed to verify that the level in the ruptured SG is greater than a specified level on the NRS prior to isolating AFW. The required level is 6 percent NRS. (Note that the analysis used a conservative SG level of 15 percent NRS.) For the single failure involving the failure of MDAFW control valves, an additional 30 seconds is added after the narrow range level is reached until MDAFW isolation. For the single failure involving the failure of the SG ARV to open, the TDAFW and MDAFW flows to the ruptured SG are isolated simultaneously once the narrow range level is reached. All SG MSIVs were assumed to be closed at 8 minutes from reactor trip for both single failure scenarios.
3. Cooldown the RCS using the Intact SGs After isolation of the ruptured SG MSIV, dumping steam from only the intact SGs cools the RCS as rapidly as possible to less than the saturation temperature corresponding to the ruptured SG pressure. This ensures adequate subcooling in the RCS after depressurization to the ruptured SG pressure in subsequent actions. If offsite power is available, the normal steam dump system to the condenser can be used to perform this cooldown. If offsite power is lost, the RCS would be cooled using the ARVs on the intact SGs. The availability of relief valves for cooldown is dependent on the single failure assumption being modeled (See Section 2.7.2.1.2.2). The analysis assumed 23 minutes elapse from the time of reactor trip until the cooldown was initiated via the ARVs. The cooldown is terminated when the required core exit temperature for cooldown termination (without adverse environment) corresponding to the ruptured SG pressure is reached. The temperature is identified in the WCGS EOPs for SGTR. The ARVs on the intact SGs were then used as necessary to maintain that temperature.
4. Depressurize the RCS to Restore Inventory When the cooldown is completed, SI flow will tend to increase RCS pressure until break flow matches SI flow. Consequently, SI flow must be terminated to stop primary to secondary break flow. However, adequate inventory must first be assured. This includes both sufficient RCS subcooling and pressurizer inventory to maintain a reliable pressurizer level indication after SI flow is stopped. Because break flow from the primar y side will continue after SI flow is stopped until RCS and ruptured SG pressures equalize, an excess amount of inventory is needed to ensure that the pressurizer level remains on span. The excess amount required depends on the RCS pressure, and reduces to zero when the RCS pressure equals the pressure in the ruptured SG. The analyses assumed that 5 minutes elapsed from the time the cooldown was terminated until the depressurization was initiated. The RCS depressurization is performed using normal pressurizer spray if the RCPs are running. Because offsite power was assumed to be lost at the 2-322 WCAP-17658-NP September 2016 Licensing Report Revision 1-C time of reactor trip, the RCPs were not running and thus normal pressurizer spray was not available. Therefore, the depressurization was modeled using a pressurizer PORV. The RCS depressurization is continued until any of the following three conditions in the WCGS EOPs for SGTR (using setpoints without adverse environment) are satisfied: RCS pressure is less than the ruptured SG pressure and pressurizer level is greater than 6 percent, pressurizer level is greater than 75 percent, or RCS subcooling is less than required to address the subcooling uncertainty.
5. Terminate SI to Stop Primary to Secondary Break Flow The previous actions will have established adequa te RCS subcooling, a secondary side heat sink, and sufficient RCS inventory to ensure that the SI flow is no longer needed. When these actions have been completed, the SI flow must be stopped to terminate primary to secondary break flow. The analyses assumed that 4 minutes elapsed from the time the depressurization was terminated until SI could be stopped. SI can be stopped provided the following conditions in the WCGS EOPs for SGTR (using setpoints without adverse environment) are satisfied: RCS pressure is stable or rising, pressurizer level is greater than 6 percent, RCS subcooling is greater than required to address the subcooling uncertainty, and a secondary heat sink is confirmed. After SI termination, the analyses do not model specific actions leading to break flow termination, consistent with the Reference 2 method. The primary to secondary break flow continues after the SI flow is stopped until the RCS and ruptured SG pressures equalize. The total time required to complete the recovery op erations consists of both operator action time and system, or plant, response time. For instance, the time for each of the major recovery operations (i.e., RCS cooldown) is primarily due to the time required for the system response, whereas the operator action time is reflected by the time required for the operator to perform the intermediate action steps. The operator action times to isolate AFW flow to the ruptured SG, to isolate the MSIV on the ruptured SG, to initiate RCS cooldown, to initiate RCS depressurization, and to terminate SI were developed for the design basis analyses. WCGS has determined the corresponding operator action times to perform these operations. The operator actions and the corresponding operator action times used for the analyses are summarized in Table 2.7.2-5. 2.7.2.1.2.6 Acceptance Criteria The analyses were performed to demonstrate that the secondary side of the ruptured SG did not completely fill with water. The available secondary side volume of a single SG is 5852 ft³. Margin to overfill is demonstrated, provided the transient-calculated SG secondary side water volume is less than this value. No credit is taken for the volume of the nozzle or any steam piping. 2.7.2.1.3 Description of Analyses and Evaluations The RETRAN analysis for the limiting margin to overfill case is described below. The limiting case with respect to margin to SG overfill considered operation at the minimum operating temperature (575.0 F),

2-323 WCAP-17658-NP September 2016 Licensing Report Revision 1-C with the minimum main FW temperature (400.0F), the maximum SGTP level (10 percent), low AFW enthalpy, low SI enthalpy, low decay heat (1979-2), and the failure of the MDAFW control valve to close. The sequences of events for these transients are presented in Table 2.7.2-6. Following the tube rupture, water flowed from the primary into the secondary side of the ruptured SG because the primary pressure is greater than the SG pressure. In response to this loss of coolant, pressurizer level decreased (Figure 2.7.2-1). The RCS pressure (represented by the pressurizer pressure) also decreased (Figure 2.7.2-2) as the steam bubble in the pressurizer expanded. As the RCS pressure decreased due to the continued primary to secondary break flow, an automatic reactor trip occurred on an OTT trip signal. After reactor trip, core power rapidly decreased to decay heat levels. The turbine stop valves closed and steam flow to the turbine was terminated. The steam dump system is designed to actuate following reactor trip to limit the increase in secondary pressure, but the steam dump valves remained closed due to the loss of condenser vacuum resulting from the assumed LOOP at the time of reactor trip. Thus, the energy transfer from the primary system caused the secondary side pressure to increase rapidly after reactor trip (Figure 2.7.2-3), until the SG ARVs lifted to dissipate the energy. As a result of the assumed LOOP, main FW flow was assumed to be terminated and AFW flow was assumed to be automatically

initiated following reactor trip. The RCS pressure and pressurizer level continued to decrease after reactor trip as energy transfer to the secondary system shrank the primary coolant and the tube rupture break flow continued to deplete primary inventory. The decrease in RCS inventory resulted in a low pressurizer pressure SI signal. The SI flow increased the RCS inventory and the RCS pressure trended toward the equilibrium value, where the SI flow rate would equal the break flow rate. TDAFW flow to the ruptured SG was isolated at 368 seconds, MDAFW flow to the ruptured SG was isolated at 398 seconds, and the ruptured SG MSIV was closed at 625 seconds. The ruptured SG level was well above the level required for identification and isolation by these times as a conservatively high SG level was assumed in the analysis. Cooldown of the RCS was initiated 23 minutes after reactor trip. It was therefore assumed that the ARVs on three intact SGs were opened for the RCS cooldown at 1525 seconds (Figure 2.7.2-6). The cooldown was continued until the cooldown termination temperature obtained from WCGS EOPs was reached. When this condition was satisfied, the operator closed the ARVs to terminate the cooldown. This cooldown ensured that there would be adequate subcooling in the RCS after the subsequent depressurization of the RCS to the ruptured SG pressure. The reduction in the intact SG pressure required to accomplish the cooldown is shown in Figure 2.7.2-3. The pressurizer level and RCS pressure also decreased during this cooldown process due to shri nkage of the RCS (Figures 2.7.2-1 and 2.7.2-2). The ARVs on the intact SGs that were used for the cooldown also automatically opened as necessary to maintain the prescribed RCS temperature to ensure that subcooling was maintained. When the ARVs were opened, the increased energy transfer from the RCS to the secondary system also aided in the depressurization of the RCS to the ruptured SG pressure after the SI flow was terminated.

2-324 WCAP-17658-NP September 2016 Licensing Report Revision 1-C After termination of the cooldown, a 5-minute operator action time was imposed prior to the RCS depressurization. In these analyses, the RCS depressurization was terminated when the RCS pressure was reduced to less than the ruptured SG pressure and the pressurizer level was above the required value, because there was adequate subcooling margin and the high pressurizer level setpoint was not reached. The RCS depressurization is shown in Figure 2.7.2-2. The depressurization reduced the break flow (Figure 2.7.2-4) and increased SI flow to refill the pressurizer (Figure 2.7.2-1). After termination of the depressurization, a 4-minute operator action time was imposed prior to SI termination. The SI flow was terminated at this time because the requirements for SI termination were satisfied. (RCS subcooling was greater than the required allowance for subcooling uncertainty, minimum AFW flow was available or at least one intact SG level was in the narrow range, the RCS pressure was stable or increasing, and the pressurizer level was greater than the required value.) After SI termination, the RCS pressure began to decrease (Figure 2.7.2-2). Break flow was terminated at 4132 seconds. 2.7.2.1.4 Results The primary to secondary break flow rate throughout the recovery operations is presented in Figure 2.7.2-4. The water volume in the ruptured SG is presented as a function of time in Figure 2.7.2-5. The ruptured loop RCS temperature is presented in Figure 2.7.2-7. The intact loops RCS temperature is presented in Figure 2.7.2-8. The peak ruptured SG water volume is 5789 ft³ resulting in 63 ft³ of margin to overfill. Therefore, it is concluded that overfill of the ruptured SG will not occur for a design basis SGTR for WCGS. 2.7.2.2 Conclusion It is concluded that overfill of the ruptured SG causing water to pass through the main steam relief valves will not occur for a design basis SGTR for WCGS. 2.7.2.3 References

1. Westinghouse Report WCAP-14882-P-A, "RETRAN-02 Modeling and Qualification for Westinghouse Pressurized Water Reactor Non-LOCA Safety Analyses," April 1999.
2. Westinghouse Report WCAP-10698-P-A, "SGTR Analysis Methodology to Determine the Margin to Steam Generator Overfill," August 1987.
3. Westinghouse Report Supplement 1 to WCAP-10698-P-A, "Evaluation of Offsite Radiation Doses for a Steam Generator Tube Rupture Accident," March 1986.
4. Westinghouse Nuclear Safety Advisory Letter NSAL-07-11, "Decay Heat Assumption in Steam Generator Tube Rupture Margin-to-Overfill Analysis Methodology," November 2007.

2-325 WCAP-17658-NP September 2016 Licensing Report Revision 1-C Table 2.7.2-1 AFW Flows for Design Basis SGTR Analyses MDAFW Failure, All AFW Pumps Operating SG Pressure (psig) AFW Flow to Ruptured SG (gpm) AFW Flow to Intact SGs (gpm/SG) 1125 684.76 320.00 1000 787.93 332.67 900 862.25 367.13 800 931.00 398.64 700 995.51 428.37 Table 2.7.2-2 AFW Flows for Design Basis SGTR Analyses MDAFW Failure, All AFW Pumps Operating, TDAFW Flow to Ruptured SG Isolated, MDAFW Pumps Operating SG Pressure (psig) AFW Flow to Ruptured SG (gpm) AFW Flow to Intact SGs (gpm/SG) 1125 440.50 320.00 1000 500.80 332.67 900 544.60 367.13 800 585.50 398.64 700 623.90 428.37 Table 2.7.2-3 AFW Flows for Design Basis SGTR Analyses MDAFW Failure, Ruptured SG Isolated, All AFW Pumps Operating, All AFW Flow to Ruptured SG Isolated, MDAFW Pumps Operating During Cooldown SG Pressure (psig) AFW Flow to Intact SGs (gpm/SG) 1125 320.00 1000 332.67 900 367.13 800 398.64 700 428.37

2-326 WCAP-17658-NP September 2016 Licensing Report Revision 1-C Table 2.7.2-4 SI Flows for Design Basis SGTR Analyses Pressure (psig) Total Injection Flow Rate (gpm) 900 1282 1000 1224 1100 1165 1200 1100 1300 1029 1400 951 1500 858 1600 736 1700 538 1800 514 1900 489 2000 463 2100 436 2200 406 2235 395 2300 374 2400 340 3000 340 2-327 WCAP-17658-NP September 2016 Licensing Report Revision 1-C Table 2.7.2-5 Operator Action Times for Design Basis SGTR Margin to Overfill Analyses Action Time Operator action time to isolate TDAFW flow to ruptured SG 15% NRS Operator action time to isolate MDAFW flow to ruptured SG AFW control valve single failure - 30 seconds from TDAFW isolation Intact SG ARV single failure - coincident with TDAFW isolation Operator action time to isolate MSIV on ruptured SG 8 minutes from reactor trip Operator action time to initiate cooldo wn 23 minutes from reactor trip Cooldown Calculated by RETRAN Operator action time to initiate depressurization 5 minutes from end of cooldown Depressurization Calculated by RETRAN Operator action time to terminate SI following depressurization 4 minutes from end of depressurization Pressure equalization Calculated by RETRAN Table 2.7.2-6 Sequence of Events for Limiting Margin to Overfill Analyses Event Time (seconds) SGTR 100 Reactor Trip (OTT) and LOOP 145 AFW Initiated 145 SI Actuated 304 TDAFW Flow to Ruptured SG Isolated 368 MDAFW Flow to Ruptured SG Isolated 398 Ruptured SG MSIV Closed 625 RCS Cooldown Initiated 1525 RCS Cooldown Terminated 2149 RCS Depressurization Initiated 2449 RCS Depressurization Terminated 2481 SI Terminated 2721 Break Flow Terminated 4132 2-328 WCAP-17658-NP September 2016 Licensing Report Revision 1-C Figure 2.7.2-1. Pressurizer Level - Margin to Overfill Analysis 2-329 WCAP-17658-NP September 2016 Licensing Report Revision 1-C Figure 2.7.2-2. Pressurizer Pressure - Margin to Overfill Analysis 2-330 WCAP-17658-NP September 2016 Licensing Report Revision 1-C Figure 2.7.2-3. Secondary Pressure - Margin to Overfill Analysis 2-331 WCAP-17658-NP September 2016 Licensing Report Revision 1-C Figure 2.7.2-4. Primary to Secondary Break Flow - Margin to Overfill Analysis 2-332 WCAP-17658-NP September 2016 Licensing Report Revision 1-C Figure 2.7.2-5. SG Water Volumes - Margin to Overfill Analysis 2-333 WCAP-17658-NP September 2016 Licensing Report Revision 1-C Figure 2.7.2-6. SG Steam Releases - Margin to Overfill Analysis 2-334 WCAP-17658-NP September 2016 Licensing Report Revision 1-C Figure 2.7.2-7. Ruptured Loop RCS Temperature - Margin to Overfill Analysis 2-335 WCAP-17658-NP September 2016 Licensing Report Revision 1-C Figure 2.7.2-8. Intact Loops RCS Temperature - Margin to Overfill Analysis 2-336 WCAP-17658-NP September 2016 Licensing Report Revision 1-C

2.7.3 Steam

Generator Tube Rupture - Input to Dose (USAR Section 15.6.3) 2.7.3.1 Technical Evaluation 2.7.3.1.1 Introduction The major hazard associated with an SGTR event is the radiological consequences resulting from the transfer of radioactive primary coolant to the secondary side of the ruptured SG and subsequent release of radioactivity to the atmosphere. A T/H SGTR analysis was performed to determine the mass releases for use in calculating the radiological consequences, assuming the limiting single failure relative to radiological consequences without ruptured SG overfill. Section 2.7.2 confirmed that ruptured SG overfill did not occur. The SGTR T/H transient analysis was performed using the RETRAN computer program (Reference 1) following the methodology developed in Reference 2 and its Supplement 1 (Reference 3). The plant response to the event was modeled using conservative assumptions of break size and location, condenser availability, and initial secondary water mass. The analyses include the simulation of the operator actions for recovery from an SGTR based on the WCGS EOPs, which are based on the Westinghouse Owners Group Emergency Response Guidelines. A detailed SGTR T/H analysis was performed for the time period from the SGTR until the primary and secondary pressures equalized (break flow termination). In the T/H analysis, the primary to secondary break flow and the steam releases to the atmosphere from the ruptured and intact SGs were calculated for use in determining the activity released to the atmosphere. The mass releases were calculated with the RETRAN computer code from the initiation of the event until break flow termination. For the time period from break flow termination until all releases are terminated, steam releases from the intact and ruptured SGs were determined from a mass and energy balance. The SGTR T/H analysis supports operation at a core power up to 3637 MWt. The analysis supports a full power RCS T avg operating range from 570.7F to 588.4F, and a main Tfeed range from 400F to 448.6F, with up to 10 percent of the SG tubes plugged.

2.7.3.1.2 Input Parameters, Assumptions, and Acceptance Criteria The T/H analyses, which determined the mass releases for the radiological consequences analyses, modeled the plant operating at the higher end of the T avg range. A higher operating temperature results in increased steaming from the ruptured SG and a higher fraction of the break flow flashing to steam inside the ruptured SG. The analyses also assumed that the plant was operating at the high end of the Tfeed range. This results in increased steaming from the ruptured SG. A SG tube plugging level of 10 percent was modeled in the analyses because this results in a higher fraction of the break flow flashing to steam inside the ruptured SG.

2-337 WCAP-17658-NP September 2016 Licensing Report Revision 1-C 2.7.3.1.2.1 Design Basis Accident The design basis accident modeled was a double-ended break of one SG tube located at the top of the tube sheet on the outlet (cold leg) side of the SG. The location of the break on the cold side of the SG results in higher primary to secondary break flow than a break on the hot side of the SG, as determined by Reference 2. However, the break flow flashing fraction was conservatively calculated, assuming that all of the break flow comes from the hot leg side of the SG. The combination of these conservative assumptions results in a very conservative calculation of the radiological consequences. It was also assumed that LOOP occurred at the time of reactor trip, and the highest worth control rod assembly was assumed to be stuck in its fully withdrawn position at reactor trip. Due to the assumed LOOP, the condenser was not available for steam releases once the reactor was tripped. Consequently, after reactor trip, steam was released to the atmosphere through the SG ARVs. 2.7.3.1.2.2 Single Failure Consideration Based on Reference 3, the most limiting single failure with respect to radiological consequences (assuming no overfill) is a failed-open ARV on the ruptured SG. Failure of this ARV causes an uncontrolled depressurization of the SG, which increases primary to secondary break flow and the steam release to the atmosphere. The lower secondary pressure also results in a higher break flow flashing fraction. Pressure in the ruptured SG will remain below that in the primary system until the failed ARV can be isolated, and recovery actions completed. 2.7.3.1.2.3 Conservative Assumptions This section includes a discussion of the methods and assumptions used to analyze the SGTR event and to calculate the mass released, the sequence of events during the recovery operations, and the calculated results.

Most of the assumptions used for the margin to overfill analyses are also conservative for the radiological consequences analyses. The major differences in the assumptions that were used for the RETRAN analyses for radiological consequences compared to those used in the margin to overfill analyses are discussed below.

1. SG Secondary Mass A low secondary mass is conservative for the dose analyses because it promotes steam release from the ruptured SG. A low secondary mass also results in a lower ruptured SG pressure when the ruptured SG ARV is failed open. This was considered in the confirmation that the pressure did not decrease below 275 psig as noted in the operator action time discussion below.

2-338 WCAP-17658-NP September 2016 Licensing Report Revision 1-C

2. Decay Heat and NSAL-07-11 As noted in NSAL-07-11 (Reference 4), SGTR T/H analyses for input to the radiological consequences analyses have no competing effects with respect to decay heat. Higher decay results in increased steam releases from the ruptured SG and a longer cooldown, leading to a later break flow termination. These effects are conservative for the SGTR radiological consequences calculation, and thus, lower decay heat was not considered. Similarly, the maximum AFW and SI enthalpies were used. The following changes were made to the related assumptions used in the margin to overfill analyses:

- The 1971+20% ANS decay heat model specified by Reference 2 was used for these analyses.

- Maximum AFW enthalpy is conservative consistent with Reference 2. For this analysis, the maximum AFW enthalpy of 96.0 Btu/lbm was modeled.

- Maximum SI enthalpy is conservative consistent with Reference 2. For this analysis, the maximum SI enthalpy of 73.91 Btu/lbm was modeled.

3. Flashing Fraction When calculating the fraction of break flow that flashes to steam, 100 percent of the break flow was assumed to come from the hot leg side of the break. Because the tube rupture flow actually consists of flow from the hot leg and cold leg sides of the SG, the temperature of the combined flow will be less than the hot leg temperature and the flashing fraction would be correspondingly lower. Thus, this assumption is conservative. 2.7.3.1.2.4 Plant Input The significant WCGS input is the same as modeled in the margin to overfill analyses except for the AFW flow. It was assumed that the minimum AFW flow (285 gpm/SG) was delivered to the SGs following reactor trip and LOOP with a maximum delay (60 seconds). The maximum purge volume (138.4 ft³) was modeled to delay delivery of cold AFW to the SGs and maximize steam release. Flow to the ruptured SG continued at this rate until it was isolated by the operators. Flow to the intact SGs was throttled to maintain the level below 50 percent NRS. 2.7.3.1.2.5 Operator Action Times The major operator actions required for the recovery from an SGTR are discussed in Section 2.7.2.1.2.5, and the operator action times used for the analyses are presented in Table 2.7.3-1. With the exception of the time to isolate AFW flow to the ruptured SG, the operator action times assumed for the margin to overfill analyses were also used for the radiological consequences analyses. Earlier AFW isolation results in higher releases, so it was assumed that AFW flow to the ruptured SG was isolated when level in the SG reached the WCGS required level (but not before 8 minutes because earlier isolation is considered unrealistic). Assuming a minimum of 8 minutes from event initiation until AFW isolation used in the 2-339 WCAP-17658-NP September 2016 Licensing Report Revision 1-C input to dose analyses is not a critical operator action time, and does not impose a requirement on the operators. This time constraint was included to avoid unrealistic AFW isolation times. For the radiological consequences analyses, the ARV on the ruptured SG was assumed to fail open at the

time the ruptured SG is isolated. Before proceeding with the recovery operations, the failed-open ARV on the ruptured SG was assumed to be isolated by locally closing the associated block valve. An operator can locally close the block valve for the ARV on the ruptured SG within 30 minutes after the failure. Thus, it was assumed that the ruptured SG ARV was isolated at 30 minutes after the valve is assumed to fail open. After the ruptured SG ARV was isolated, an additional delay time of 10 minutes (Table 2.7.3-1) was assumed before initiation of the RCS cooldown. The cooldown was performed using the ARVs on all three of the intact SGs. The cooldown target temperature was selected based on the ruptured SG pressure. As specified in the WCGS EOPs for SGTR, this pressure must be above 275 psig. 2.7.3.1.2.6 Mass Release Calculations The mass releases were determined for use in evaluating the offsite and control room radiological consequences of the SGTR using the methodology of Reference 3. The steam releases from the ruptured and intact SGs, and primary to secondary break flow into the ruptured SG and the associated flashing fraction, were determined for the period from accident initiation until break flow termination and from break flow termination to 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> after the accident. In the RETRAN analyses, the SGTR recovery actions in the WCGS EOPs were simulated until the termination of primary to secondary break flow. After the primary to secondary break flow is terminated, the operators will continue the SGTR recovery actions. The plant is then cooled and depressurized to cold shutdown conditions. In accordance with the methodology in Reference 3, it was assumed that the operators perform the post-SGTR cooldown using steam dump to the atmosphere. This method results in a conservative evaluation of the long-term releases for use in the radiological consequences analyses compared to the other cooldown methods in the WCGS EOPs. This procedure for depressurizing the ruptured SG was assumed even though the RETRAN analyses performed to cal culate releases up until break flow termination assumed ruptured SG ARV isolation. The high level actions for the post-SGTR cooldown method using steam dump are discussed below.

1. Prepare for Cooldown to Cold Shutdown

The initial steps to prepare for cooldown to cold shutdown will be continued if they have not already been completed. A few additional steps are also performed prior to initiating cooldown. These include isolating the cold leg SI accumulators to prevent unnecessary injection, energizing pressurizer heaters as necessary to saturate the pressurizer water and to provide for better pressure control, and ensuring shutdown margin in the event of a potential boron dilution due to in-leakage from the ruptured SG.

2-340 WCAP-17658-NP September 2016 Licensing Report Revision 1-C

2. Cooldown RCS to RHRS Temperature The RCS is cooled by releasing steam from the intact SGs similar to a normal cooldown. Because all immediate safety concerns have been resolved, the cooldown rate should be maintained less than the maximum allowable rate of 100F/hr. The preferred means for cooling the RCS is via steam dump to the condenser, because this minimizes the radiological releases and conserves FW supply. The ARVs on the intact SGs can also be used if steam dump to the condenser is unavailable. Because a LOOP is assumed, it is assumed that the cooldown is performed using steam dump to the atmosphere via the ARVs on the intact SGs. When the RHRS operating temperature is reached, the cooldown is stopped until RCS pressure can also be decreased. This ensures that pressure/temperature limits will not be exceeded.
3. Depressurize RCS to RHRS Pressure When the cooldown to RHRS temperature is completed, the pressure in the ruptured SG is decreased by releasing steam from the ruptured SG. It was assumed that the ruptured SG is depressurized by releasing steam via the ARV. As the ruptured SG pressure is reduced, the RCS pressure is maintained equal to the pressure in the ruptured SG in order to prevent excessive in-leakage of secondary side water or additional primary to secondary break flow. Although normal pressurizer spray is the preferred means of RCS pressure control, auxiliary spray or a pressurizer PORV can be used to control RCS pressure if pressurizer spray is not available.
4. Cooldown to Cold Shutdown When RCS temperature and pressure have been reduced to the RHRS in-service values, RHRS cooling is initiated to complete the cooldown to cold shutdown. When cold shutdown conditions are achieved, the pressurizer can be cooled to terminate the event. 2.7.3.1.2.7 Acceptance Criteria The analyses were performed to calculate the mass transfer data for input to the radiological consequences analyses. As such, no acceptance criteria are defined. The results of the analyses were used as input to the radiological consequences analyses. 2.7.3.1.3 Description of Analyses and Evaluations The RETRAN results for the limiting input to dose analysis are described below. The limiting case with respect to the input to dose considered operation at the maximum operating temperature (588.4 F), with the maximum main T feed (448.6F), the maximum SGTP level (10 percent), and the failure of the ARV on the ruptured SG in the full open position. The sequences of events for these tran sients are presented in Table 2.7.3-2. Following the tube rupture, water flowed from the primary into the secondary side of the ruptured SG because the primary pressure was greater than the SG pressure. In response to this loss of coolant, pressurizer level decreased (Figure 2.7.3-1). The RCS pressure (represented by the pressurizer pressure) also decreased (Figure 2.7.3-2) as the steam bubble in the pressurizer expanded. As the RCS pressure decreased due to the continued primary to secondary break flow, automatic reactor trip occurred on an OTT trip signal.

2-341 WCAP-17658-NP September 2016 Licensing Report Revision 1-C After reactor trip, core power rapidly decreased to decay heat levels. The turbine stop valves closed and steam flow to the turbine was terminated. The steam dump system is designed to actuate following reactor trip to limit the increase in secondary pressure, but the steam dump valves remained closed due to the loss of condenser vacuum resulting from the assumed LOOP at the time of reactor trip. Thus, the energy transfer from the primary system caused the secondary side pressure to increase rapidly after reactor trip (Figure 2.7.3-3) until the SG ARVs lift to dissipate the energy (Figure 2.7.3-5). As a result of the assumed LOOP, main FW flow was assumed to be terminated and AFW flow was assumed to be automatically initiated following reactor trip. The RCS pressure and pressurizer level continued to decrease after reactor trip as energy transfer to the secondary system shrunk the RCS and the tube rupture break flow continued to deplete primary inventory. The decrease in RCS inventory resulted in a low pressurizer pressure SI signal. The SI flow increased the RCS inventory and the RCS pressure trended toward the equilibrium value where the SI flow rate would equal the break flow rate.

AFW flow to the ruptured SG was isolated when the ruptured SG level reached 6 percent NRS, and the ruptured SG MSIV was closed at 8 minutes after reactor trip.

The ruptured SG ARV was assumed to fail open when AFW flow to the ruptured SG was isolated at the time the ruptured SG level reached 6 percent NRS.

The failure caused the ruptured SG to depressurize rapidly, which resulted in an increase in primary to secondary break flow. The depressurization of the ruptured SG increased the break flow and energy transfer from primary to secondary, which resulted in RCS pressure and temperature decreasing more rapidly than in the margin to overfill analyses. The ruptured SG depressurization caused a cooldown in the intact SGs loops. The operators identified that the ruptured SG ARV had failed open and closed the associated block valve 30 minutes after the failure. Once the ruptured SG ARV block valve was closed, the ruptured SG pressure began to increase (Figure 2.7.3-3). The ruptured SG pressure was confirmed to be above 275 psig at all times in the transient. This was also confirmed for transients run with less limiting mass transfer results, but greater ruptured SG pressure reductions. The lowest ruptured SG pressure for all cases analyzed was greater than 360 psia. After the block valve for the ruptured SG ARV was closed, a 10-minute operator action time was imposed prior to initiating the cooldown. The ARVs on all three of the intact SGs were opened at approximately 60 minutes for the RCS cooldown (Figure 2.7.3-5). The depressurization of the ruptured SG due to the failed-open ARV affected the RCS cooldown target temperature. The target temperature was determined based upon the pressure in the ruptured SG at the time the cooldown was initiated. The cooldown was continued until the cooldown termination temperature obtained from WCGS EOPs was reached. When this condition was satisfied, the operators closed the ARVs to terminate the cooldown. The cooldown ensured that there would be adequate subcooling in the RCS after the subsequent depressurization of the RCS to the ruptured SG pressure. The reduction in the intact SG pressure required to accomplish the cooldown is shown in Figure 2.7.3-3. The pressurizer level and RCS pressure also decreased during this cooldown process due to shrinkage of the RCS (Figure 2.7.3-1). The ARVs on the intact SGs also automatically opened to maintain the prescribed RCS temperature to ensure that subcooling was maintained. When the ARVs were opened, the increased energy transfer from 2-342 WCAP-17658-NP September 2016 Licensing Report Revision 1-C the RCS to the secondary system also aided in the depressurization of the RCS to the ruptured SG pressure after the SI flow was terminated. After termination of the cooldown, a 5-minute operator action time was imposed prior to the RCS depressurization. In these analyses, the RCS depressurization was terminated when the RCS pressure was reduced to less than the ruptured SG pressure and the pressurizer level was above the required value, because there was adequate subcooling margin and the high pressurizer level setpoint was not reached. The RCS depressurization is shown in Figure 2.7.3-2. The depressurization reduced the break flow (Figure 2.7.3-4) and increased SI flow to refill the pressurizer (Figure 2.7.3-1). After termination of the depressurization, a 4-minute operator action time was imposed prior to SI termination. The SI flow was terminated at this time because the requirements for SI termination were satisfied. (RCS subcooling was greater than the required allowance for subcooling uncertainty, minimum AFW flow was available or at least one intact SG level was in the narrow range, the RCS pressure was stable or increasing, and the pressurizer level was greater than the required value.) After SI termination, the RCS pressure began to decrease (Figure 2.7.3-2). 2.7.3.1.3.1 Calculation of Mass Releases The operator actions for the SGTR recovery up to the termination of primary to secondary break flow were simulated in the RETRAN analyses. Thus, the steam releases from the ruptured and intact SGs along with the break flow into the ruptured SG were determined from the RETRAN results for the period from the initiation of the accident until the break flow was terminated. The operator actions for the SGTR recovery up to the termination of primary to secondary break flow were simulated in the RETRAN analyses. Thus, the steam releases from the ruptured and intact SGs along with the break flow into the ruptured SG were determined from the RETRAN results for the period from the initiation of the accident until the break flow was terminated. Because the condenser was in service until reactor trip, any radioactivity released to the atmosphere prior to reactor trip would be through the condenser vacuum exhaust. After reactor trip, the releases to the atmosphere were assumed to be via the SG ARVs. Following the termination of break flow, it was assu med that the RCS and intact SG conditions were maintained stable until the cooldown to cold shutdown was initiated. The ARVs for the intact SGs were then assumed to be used to start to cool down the RCS to the RHRS operating temperature of 350F, at the maximum allowable cooldown rate of 100F/hr. The RCS cooldown was assumed to continue until the RHRS operating temperature of 350 F was reached. Depressurization of the ruptured SG was then assumed to be performed immediately following the completion of the RCS cooldown. The ruptured SG was assumed to be depressurized to the RHRS operating pressure (using a bounding value of 375 psia) via steam release from the ruptured SG ARV. This maximizes the steam release from the ruptured SG to the atmosphere, which is conservative for the evaluation of the radiological consequences. The RCS pressure was also assumed to be reduced concurrently as the ruptured SG is depressurized. It was assumed that the RCS cooldown and depressurization to RHRS operating conditions were completed within 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> after the accident. The steam releases from break flow termination to 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> were determined for the intact SGs from a mass and energy balance using the RCS and intact SG conditions at break flow termination and at the RHRS in-service conditions. The steam released from the ruptured SG from break flow termination to 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> 2-343 WCAP-17658-NP September 2016 Licensing Report Revision 1-C was determined based on a mass and energy balance for the ruptured SG using the conditions at the time of break flow termination and saturated conditions at the RHRS operating pressure. After 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />, it was assumed that further plant cooldown to cold shutdown as well as LTC was provided by the RHRS. Therefore, the steam releases to the atmosphere were terminated at 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />. 2.7.3.1.4 Results 2.7.3.1.4.1 Results of RETRAN Analyses The primary to secondary break flow rate throughout the recovery operations is presented in Figure 2.7.3-4. The break flow flashing fraction was calculated using the ruptured hot leg loop temperature (Figure 2.7.3-6). The intact hot leg loop temperature is presented in Figure 2.7.3-7. The

flashing fraction is presented in Figure 2.7.3-8. The integrated flashed break flow is presented in Figure 2.7.3-9. The ruptured SG ARV steam release is presented in Figure 2.7.3-5. The ruptured SG fluid mass is shown in Figure 2.7.3-10 and ruptured SG water volume is shown in Figure 2.7.3-11. 2.7.3.1.4.2 Mass Release Results The mass release calculations were performed using the methodology discussed in Section 2.7.3.1.3.1. The transfer and release data are presented in Tables 2.7.

3-3 and 2.7.3-4. 2.7.3.2 Conclusion The analyses performed to calculate the mass transfer data for input to the radiological consequences analyses were completed and the data were tabulated for the limiting cases. The results of the analyses were used as input to the radiological consequences analyses. 2.7.3.3 References

1. Westinghouse Report WCAP-14882-P-A, "RETRAN-02 Modeling and Qualification for Westinghouse Pressurized Water Reactor Non-LOCA Safety Analyses," April 1999.
2. Westinghouse Report WCAP-10698-P-A, "SGTR Analysis Methodology to Determine the Margin to Steam Generator Overfill," August 1987.
3. Westinghouse Report Supplement 1 to WCAP-10698-P-A, "Evaluation of Offsite Radiation Doses for a Steam Generator Tube Rupture Accident," March 1986. 4. Westinghouse Nuclear Safety Advisory Letter NSAL-07-11, "Decay Heat Assumption in Steam Generator Tube Rupture Margin-to-Overfill Analysis Methodology," November 2007.

2-344 WCAP-17658-NP September 2016 Licensing Report Revision 1-C Table 2.7.3-1 Operator Action Times for Design Basis SGTR T/H Analyses Action Time Operator action time to isolate TDAFW flow to ruptured SG 6% NRS Operator action time to isolate MDAFW flow to ruptured SG Coincident with TDAFW isolation Operator action time to isolate MSIV on ruptured SG 8 minutes from reactor trip Operator action time to identify and isolate the failed-open ARV 30 minutes from AFW flow isolation Operator action time to initiate cooldown 10 minutes from closure of the failed-open SG ARV Cooldown Calculated by RETRAN Operator action time to initiate depressurization 5 minutes from end of cooldown Depressurization Calculated by RETRAN Operator action time to terminate SI following depressurization 4 minutes from end of depressurization Pressure equalization Calculated by RETRAN Table 2.7.3-2 Sequence of Events for Limiting Input to Radiological Consequences Analyses Event Time (seconds) SGTR 100 Reactor Trip (OTT) and LOOP 152 AFW Actuated 212 SI Actuated 425 Ruptured SG MSIV Closed 632 AFW Flow to Ruptured SG Isolated 1202 Ruptured SG ARV Fails Open 1202 Ruptured SG ARV Block Valve Closed 3002 RCS Cooldown Initiated 3602 Break Flow Flashing Terminated 3946 RCS Cooldown Terminated 4955 RCS Depressurization Initiated 5255 RCS Depressurization Terminated 5377 SI Terminated 5616 Break Flow Terminated 7627 Time RHRS Takes Over Cooling 43,300 2-345 WCAP-17658-NP September 2016 Licensing Report Revision 1-C Table 2.7.3-3 Break Flow and Flashed Break Flow Start of Period (sec) End of Period (sec) Total Break Flow during Period (lbm) Total Flashed Break Flow during Period (lbm) 0 152 2424 399 152 1202 41,847 2638 1202 3002 92,563 12,211 3002 3602 32,388 2396 3602 3946 17,119 551 3946 5255 55,930 5255 7627 37,424 7627 43,300 Table 2.7.3-4 Intact and Ruptured SG Steam Flow to Atmosphere Start of Period (sec) End of Period (sec) Total Intact SGs Steam Flow to Atmosphere during Period (lbm) Total Ruptured SG Steam Flow to Atmosphere during Period (lbm) 0 152 511,500 171,000 152 1202 63,525 24,972 1202 3002 0 136,228 3002 3602 0 0 3602 3946 85,734 0 3946 5255 118,909 0 5255 7627 89,233 0 7627 43,300 1,496,300 2300 Note: 1. Pre-trip steam releases are through the condenser.

2-346 WCAP-17658-NP September 2016 Licensing Report Revision 1-C Figure 2.7.3-1. Pressurizer Level - Input to Radiological Consequences Analysis

2-347 WCAP-17658-NP September 2016 Licensing Report Revision 1-C Figure 2.7.3-2. Pressurizer Pressure - Input to Radiological Consequences Analysis 2-348 WCAP-17658-NP September 2016 Licensing Report Revision 1-C Figure 2.7.3-3. Secondary Pressure - Input to Radiological Consequences Analysis 2-349 WCAP-17658-NP September 2016 Licensing Report Revision 1-C Figure 2.7.3-4. Primary to Secondary Break Flow - Input to Radiological Consequences Analysis 2-350 WCAP-17658-NP September 2016 Licensing Report Revision 1-C Figure 2.7.3-5. SG Steam Releases - Input to Radiological Consequences Analysis 2-351 WCAP-17658-NP September 2016 Licensing Report Revision 1-C Figure 2.7.3-6. Ruptured Loop Hot Leg and Cold Leg Temperatures - Input to Radiological Consequences Analysis 2-352 WCAP-17658-NP September 2016 Licensing Report Revision 1-C Figure 2.7.3-7. Intact Loop Hot Leg and Cold Leg Temperatures - Input to Radiological Consequences Analysis 2-353 WCAP-17658-NP September 2016 Licensing Report Revision 1-C Figure 2.7.3-8. Break Flow Flashing Fraction - Input to Radiological Consequences Analysis 2-354 WCAP-17658-NP September 2016 Licensing Report Revision 1-C Figure 2.7.3-9. Integrated Flashed Break Flow - Input to Radiological Consequences Analysis 2-355 WCAP-17658-NP September 2016 Licensing Report Revision 1-C Figure 2.7.3-10. Ruptured SG Fluid Mass - Input to Radiological Consequences Analysis 2-356 WCAP-17658-NP September 2016 Licensing Report Revision 1-C Figure 2.7.3-11. Ruptured SG Water Volume - Input to Radiological Consequences Analysis 2-357 WCAP-17658-NP September 2016 Licensing Report Revision 1-C 2.7.4 Loss-of-Coolant Accidents Resulting from a Spectrum of Postulated Piping Breaks within the Reactor Coolant Pressure Boundary (USAR Section 15.6.5) 2.7.4.1 Post-LOCA Subcriticality 2.7.4.1.1 Technical Evaluation 2.7.4.1.1.1 Introduction Post-LOCA subcriticality sump boron calculations were performed in support of the methodology transition. The methodology used to demonstrate compliance with the requirements of 10 CFR 50.46(b) is documented in WCAP-8339 (Reference 1). Reference 1 states that the core will remain subcritical post-LOCA by borated water from the various injected ECCS water sources. Post-LOCA sump boron calculations demonstrate the core will remain subcritical upon entering, and during, the sump recirculation phase of ECCS injection. Containment sump boron concentration calculations are used to develop a core reactivity limit that is confirmed as part of the Westinghouse RSE Methodology (Reference 2). 2.7.4.1.1.2 Input Parameters, Assumptions, and Acceptance Criteria The major input parameters and assumptions used in the sump boron calculations are given in Table 2.7.4-1. The sump boron concentration model is based on the following assumptions: The calculation of the sump mixed mean boron concentration assumes minimum mass and minimum boron concentrations for significant boron sources and maximum mass and minimum boron concentration for significant dilution sources. Boron is mixed uniformly in the sump. The post-LOCA sump inventory is made up of constituents that are equally likely to return to the containment sump; that is, selective holdup in containment is neglected. The sump mixed mean boron concentration is calculated as a function of the pre-trip RCS conditions. There are no specific acceptance criteria when calculating the post-LOCA sump boron concentration. The resulting sump boron concentration, which is calculated as a function of the pre-LOCA RCS boron concentration, is reviewed for each cycle-specific core design to confirm that adequate boron exists to maintain subcriticality in the long-term post-LOCA. 2.7.4.1.1.3 Description of Analyses and Evaluations A post-LOCA subcriticality boron limit curve was developed using Westinghouse methodology. Provided that the cycle-specific maximum critical boron concentration remains below the post-LOCA sump boron concentration limit curve (for all rods out, no Xenon, 68°F-212°F), the core will remain subcritical post-LOCA and the only heat generation will be that due to the remaining long-lived radioactivity. This criterion will be evaluated on a cycle-specific basis in accordance with the RSE Methodology (Reference 2).

2-358 WCAP-17658-NP September 2016 Licensing Report Revision 1-C 2.7.4.1.1.4 Results A post-LOCA subcriticality boron limit curve was developed for the methodology transition. The post-LOCA subcriticality boron limit curve is shown in Figure 2.7.4-1. 2.7.4.1.2 Conclusion A post-LOCA subcriticality sump boron curve was generated. The methodology used to generate the curve aids in demonstrating compliance with 10 CFR 50.46(b). The post-LOCA subcriticality sump boron curve will be tracked on a cycle-specific basis using the Westinghouse RSE Methodology and will aid in demonstrating continued compliance with 10 CFR 50.46(b).

2.7.4.1.3 References

1. Westinghouse Report WCAP-8339, "Westinghouse Emergency Core Cooling System Evaluation Model - Summary," June 1974.
2. Westinghouse Report WCAP-9272-P-A, "Westinghouse Reload Safety Evaluation Methodology," July 1985. 2.7.4.2 Post-LOCA Long-term Cooling 2.7.4.2.1 Technical Evaluation 2.7.4.2.1.1 Introduction A post-LOCA LTC analysis was performed for the methodology transition. There are two aspects to an LTC analysis: Boric acid precipitation control (BAPC) Long-term decay heat removal (DHR) This analysis satisfies the requirements of 10 CFR 50.46(b), Item (5). The 10 CFR 50 GDC contribute to supporting the conclusions that the following requirements are met: (5) Long-term cooling. After any calculated successful initial operation of the ECCS, the calculated core temperature shall be maintained at an acceptably low value and decay heat shall be removed for the extended period of time required by the long-lived radioactivity remaining in the core. The injection and sump recirculation ECCS modes are described in USAR Section 6.3: Emergency Core Cooling System.

2-359 WCAP-17658-NP September 2016 Licensing Report Revision 1-C 2.7.4.2.1.2 Input Parameters, Assumptions, and Acceptance Criteria Long-Term Cooling The major inputs to the boric acid precipitation calculation include core power assumptions, assumptions for boron concentrations, and water volume/mass assumptions for significant contributors to the containment sump. The input parameters used in the methodology transition boric acid precipitation calculations are given in Table 2.7.4-2. The accumulator maximum boron concentration utilized in the safety analysis is 2500 ppm and the RWST maximum boron concentration utilized in the safety analysis is 2500 ppm. The boric acid precipitation model is based on the following assumptions: meets USNRC guidance as presented in Reference 1, and is consistent with the interim methodology reported in Reference 2. Additional detailed input assumptions are given as follows: The boric acid concentration in the core region was computed over time by considering the effect of core voiding on liquid mixing volume. The boric acid concentration limit is the experimentally determined boric acid solubility limit as reported in Reference 3 and summarized in Table 2.7.4-3 and Figure 2.7.4-2. For large breaks, containment back pressure is not credited and the RCS is assumed atmospheric. The boric acid solubility limit credits an increased boiling point of 218°F (boiling point of saturated boric acid solution under atmospheric conditions). For break sizes where the RCS pressure might remain elevated (or instances where RCS depressurization is not complete), the boric acid solubility limit under atmospheric conditions is assumed. The liquid mixing volume used in the calculation includes 50 percent of the lower plenum as justified in Reference 2 and Reference 4. For SBLOCA scenarios, this analysis does not assume a specific start time for cooldown/depressurization emergency procedures. In reality, it is anticipated that operators will begin cooldown/depressurization within 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> of the initiation of the event. The effect of containment sump pH additives on increasing the boric acid solubility limit is not

credited. The boric acid concentration of the makeup containment sump coolant during recirculation is a calculated mixed mean boron concentration. The calculation of the sump mixed mean boron concentration assumes maximum mass and maximum boron concentrations for significant boron sources, and minimum mass and maximum boron con centrations for significant dilution sources.

2-360 WCAP-17658-NP September 2016 Licensing Report Revision 1-C USNRC requirements pertaining to the decay heat generation rate for both boric acid accumulation and decay heat removal (1971 ANS Standard for an infinite operating time with 20 percent uncertainty) was considered when performing the boric acid precipitation calculations. The assumed core power includes a multiplier to address uncertainty as identified by Section 1.A of 10 CFR 50, Appendix K. ECCS recirculation flows are evaluated by comparing the limiting single-failure minimum SI pump flows to the flows necessary to dilute the core and replace core boil-off, thus keeping the core quenched and amenable to cooling. The acceptance criteria for the LTC analysis are demonstrated by the capability to keep the core cool after a LOCA and by calculating a time to initiate the BAPC plan with methods, plant design assumptions, and operating parameters that are consistent with the interim methodology reported in Reference 2. 2.7.4.2.1.3 Description of Analyses and Evaluations The LTC phase of the accident begins at the transfer to CL recirculation. Prior to sump recirculation, core cooling is addressed for the full spectrum of break sizes by the LBLOCA and SBLOCA analyses areas. This satisfies the 10 CFR 50.46 acceptance criteria pertaining to PCT, maximum cladding oxidation, and maximum hydrogen generation. DHR checks are performed for the transfer to CL recirculation at transient times based upon full ECCS injection for the injection phase. Full ECCS injection for the injection phase consists of two residual heat removal (RHR) pumps (for low head injection), two SI pumps (for intermediate head injection), two centrifugal charging pumps (CCP) (for high head injection), and two containment spray pumps.

Maximizing the flow in the RWST drain down calculation conservatively bounds entry to CL recirculation. The earliest entry to CL recirculation for the LBLOCA scenario was conservatively assumed to be 13 minutes. The earliest entry to CL recirculation for the SBLOCA scenario was conservatively assumed to be 25 minutes. The adequacy of the CL recirculation flow is checked at the earliest entry to CL recirculation. Minimum flows are generated assuming the failure of a diesel generator. One RHR pump takes suction from the containment sump, while one IHSI pump and one CCP pump take suction from the RHR pump discharge. The RHR pump, SI pump, and CCP inject to all four CLs. The spilling line is assumed to be at atmospheric pressure to conservatively minimize the ECCS available for core cooling. The latest acceptable time to enter HL recirculation is determined by the calculated incipient boric acid precipitation time. The earliest acceptable time to enter hot leg recirculation is determined by subtracting 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> from the latest acceptable hot leg recirculation time. The latest acceptable HL recirculation time is determined from the calculated incipient boric acid precipitation time. An HL recirculation window provides the operators 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> of margin to establish HL recirculation. The adequacy of the earliest acceptable time to prevent core uncovery and to effectively remove the decay heat generated in the core is then confirmed. The earliest acceptable time to transfer to HL recirculation is also confirmed against the entrainment threshold. The transfer to the HL recirculation procedure instructs the operators to transfer the discharge of the SI pump from three CLs to two HLs. The SI pump is stopped to perform this transfer. The limiting flows for 2-361 WCAP-17658-NP September 2016 Licensing Report Revision 1-C performing HL recirculation flow checks with respect to DHR occur when the HL recirculation transfer process is complete. This is due to the RHR pump providing boosting to the SI pump. The limiting scenario for post-LOCA LTC for HL recirculation consists of one RHR pump taking suction from the containment sump and discharging to all four CLs. The CCP continues to take suction from the RHR pump discharge and inject to all four CLs. The SI pump takes suction from the RHR pump discharge and injects to two of the four HLs. The adequacy to effectively remove decay heat at the early entry to HL recirculation was checked for both a CL and HL break. The adequacy of the HL flow to halt and reverse the concentration of boric acid in the core was checked at the late entry to HL recirculation for a CL break. An HL break is not a concern with respect to the concentration of boric acid in the core. This is due to CL recirculation flow always being present and providing a forward flushing path. For small breaks, emergency procedures instruct operators to take action to depressurize and cool down the RCS. Although this depressurization and cooldown process typically begins within 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> after the event, the LTC analysis makes no specific assumptions regarding time to depressurize. However, the post-LOCA LTC safety analyses do assume the rate of cooldown is limited by the operating procedures to 100°F/hr. Depressurization to 120 psia (the threshold for boric acid precipitation concerns) may occur before or after the prescribed HL switchover (HLSO) time. 2.7.4.2.1.4 Results An incipient boric acid concentration time was calculated. This value is conservatively rounded down to the nearest half hour to determine the latest acceptable time to complete the transfer to HL recirculation. The latest acceptable time to complete the transfer to HL recirculation was determined to be 7.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> from the initiation of the accident. Figures 2.7.4-3 and 2.7.4-4 show the buildup of boric acid in the core along with the impacts of the HL dilution flow at the latest entry to HL recirculation. It is shown that the HL recirculation flow with one CL spilling is adequate to halt and reverse the concentration of boric acid in the core. One hour of margin was provided to the operators to complete the steps necessary to transfer from CL recirculation to HL recirculation. The adequacy of the ECCS to effectively remove decay heat at an early entry to HL recirculation of 6.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> from the initiation of the accident was checked. HL recirculation flow was shown to be adequate to effectively remove decay heat for a CL break, whereas CL recirculation flow was shown to be adequate to effectively remove decay heat for an HL break. The earliest HL recirculation time of 6.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> is well after the entrainment threshold.

Calculations were performed for a condition where HL dilution flow is not established until 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> from the initiation of the accident. This demonstrates the effectiveness of HL dilution flow for the scenario where the RCS remains at an elevated pressure for an extended period. Figure 2.7.4-5 shows the boric acid concentration in the core with the RCS at 120 psia for 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> assuming no SG heat removal, no dilution flow, and no benefit of reduced steaming due to SI subcooling. At 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />, the boric acid concentration is still below the boric acid solubility limit at the saturation temperature of concentrated boric acid associated with 120 psia. Figure 2.7.4-5 shows HL flow at 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> with the RCS at saturation conditions. The RCS is then cooled (with corresponding depressurization) at the maximum cooldown rate of 100°F/hr. It is shown that the 2-362 WCAP-17658-NP September 2016 Licensing Report Revision 1-C core boric acid concentration is still maintained below the incipient boric acid precipitation limit at the saturation temperature of concentrated boric acid at the associated pressure. A higher core region pressure has two significant eff ects on the calculation of the incipient precipitation time. A higher pressure would decrease core voiding and increase the available mixing volume. With no credit for subcooling, a higher pressure would increase the core boil-off due to the heat of vaporization decreasing with increasing pressure and thus increase the rate of concentration of boric acid in the core. Loop seal refilling would be significant to the calculations only if the loop seal closure was sustained. However, neither LOCA ECCS evaluation models nor observations during the Rig-of-Safety Assessment tests (Reference 5) predict sustained loop seal closure, but instead predict cyclic loop seal refilling and clearing. Cyclic loop seal refilling/clearing would promote mixing in the vessel by forcing liquid from the core region to the lower plenum and downcomer. Effective mixing resulting from this type of oscillatory behavior was observed in the modified VEERA test facility (Reference 6). Therefore, the calculations performed to determine the effect of the loop pressure resistance on the core mixing volume do not

consider loop seal refilling. In summary, the WCGS post-LOCA BAPC calculations used a conservative methodology to establish a 6.5 to 7.5 hour5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> timeframe to realign the ECCS to provide flushing flow to the HLs. Flushing flow to the HLs provides effective core dilution to halt and reverse the concentration of boric acid in the core prior to reaching the boric acid precipitation limit. This realignment addresses the requirements of 10 CFR 50.46(b), Item (5) LTC. ECCS flows during sump recirculation were shown to be sufficient to remove decay heat after a LOCA.

The post-LOCA LTC analyses for the methodology transition are applicable with the following modification to the Emergency Procedures (EMGs):

The modification of the transfer to an HL recirculation time of 10 hours1.157407e-4 days <br />0.00278 hours <br />1.653439e-5 weeks <br />3.805e-6 months <br /> to an early initiation time of 6.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> and a latest completion time of 7.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> 2.7.4.2.2 Conclusion A post-LOCA LTC analysis was completed. The capability to keep the core cool in the long-term post LOCA was shown and compliance with 10 CFR 50.46(b), Item (5) was demonstrated. A BAPC plan was established to keep the core cool post-LOCA and demonstrate compliance with 10 CFR 50.46(b), Item (5).

2-363 WCAP-17658-NP September 2016 Licensing Report Revision 1-C 2.7.4.2.3 References

1. USNRC letter D.S. Collins to J.A. Gresham, "Cla rification of NRC Letter Dated August 1, 2005, Suspension of NRC Approval for Use of Westinghouse Topical Report CENPD-254-P, 'Post-LOCA Long-Term Cooling Model,' Due to Discovery of Non-Conservative Modeling Assumptions During Calculations Audit (TAC NO. MB1365)," (USNRC ADAMS Accession Number ML052930272), November 23, 2005.
2. Westinghouse PWR Working Group Letter, "Slides for the Summary of August 23, 2006 Meeting with the Pressurized Water Reactor Owners Group (PWROG) to Discuss the Status of Program to Establish Consistent Criteria for Post Loss-of-Coolant (LOCA) Calculations," (USNRC ADAMS Accession Number ML062720565), October 3, 2006.
3. Westinghouse Report WCAP-1570, "Literature Values for Selected Chemical/Physical Properties of Aqueous Boric Acid Solutions," May 1960.
4. USNRC Document, "Safety Evaluation Related to Extended Power Uprate at Beaver Valley Power Station, Unit Nos. 1 and 2," July 19, 2006 (USNRC ADAMS Accession Number ML061720376).
5. Westinghouse Letter NSD-NRC-97-5092, "Core Uncovery Due to Loop Seal Re-Plugging During Post-LOCA Recovery, March 1997," April 28, 1997.
6. Tuunanen, J., Tuomisto, H., Raussi, P., "Experimental and Analytical Studies of Boric Acid Concentrations in a VVER-440 Reactor During the Long-Term Cooling Period of Loss-of-Coolant Accidents," Nuclear Engineering and Design, Vol. 148, July 1994, pgs. 217-231.

2-364 WCAP-17658-NP September 2016 Licensing Report Revision 1-C Table 2.7.4-1 Subcriticality Analysis Input Parameters Parameter Current Value RWST Boron Concentration, Minimum (ppm) 2400 RWST Delivered Volume, Minimum (gallons) 236,993 RWST Temperature, Maximum (°F) 120 Accumulator Boron Concentration, Minimum (ppm) 2300 Accumulator Liquid Volume, Minimum (gallons) 6122 Number of Accumulators 4 Accumulator Tank Temperature, Maximum (°F) 120 Table 2.7.4-2 LTC Analysis Input Parameters Parameter Current Value Analyzed Core Power (MWt) 3565 Analyzed Core Power Uncertainty (%)

2.0 Decay

Heat Standard 1971 ANS, Infinite Operation, plus 20% (10 CFR 50 Appendix K) H3BO3 Solubility Limit (wt %) See Table 2.7.4-3 RWST Boron Concentration, Maximum (ppm) 2500 RWST Delivered Volume, Maximum (gallons) 419,000 RWST Temperature, Minimum (°F) 37 Accumulator Boron Concentration, Maximum (ppm) 2500 Accumulator Liquid Volume, Maximum (gallons) 26,376 Accumulator Tank Temperature, Minimum (°F) 50 2-365 WCAP-17658-NP September 2016 Licensing Report Revision 1-C Table 2.7.4-3 Boric Acid Solution Solubility Limit Data Temperature °C (°F) Solubility g H 3 BO 3/100 g of Solution H 2 O Temperature °C (°F) Solubility g H 3 BO 3/100 g of Solution H 2 O P = 1 Atmosphere 75 (167) 17.41 0 (32) 2.70 80 (176) 19.06 5 (41) 3.14 85 (185) 21.01 10 (50) 3.51 90 (194) 23.27 15 (59) 4.17 95 (203) 25.22 20 (68) 4.65 100 (212) 27.53 25 (77) 5.43 103.3 (217.9) 29.27 30 (86) 6.34 P = P SAT 35 (95) 7.19 107.8 (226.0) 31.47 40 (104) 8.17 117.1 (242.8) 36.69 45 (113) 9.32 126.7 (260.1) 42.34 50 (122) 10.23 136.3 (277.3) 48.81 55 (131) 11.54 143.3 (289.9) 54.79 60 (140) 12.97 151.5 (304.7) 62.22 65 (149) 14.42 159.4 (318.9) 70.67 70 (158) 15.57 171 (339.8) = Congruent Melting of H 3 BO 3 2-366 WCAP-17658-NP September 2016 Licensing Report Revision 1-C Figure 2.7.4-1. Post-LOCA Subcriticality Boron Limit Curve 2-367 WCAP-17658-NP September 2016 Licensing Report Revision 1-C 0 10 20 30 40 50 60 70 0 50 100150 200250 300350Boric Acid Solubility Limit (w/o)Temperature (°F)

Figure 2.7.4-2. Boric Acid Solubility Limit 2-368 WCAP-17658-NP September 2016 Licensing Report Revision 1-C Figure 2.7.4-3. LBLOCA Boric Acid Concentration Analysis - Vessel Boric Acid Concentration, Boil-off, and Flushing Flow versus Time 2-369 WCAP-17658-NP September 2016 Licensing Report Revision 1-C Figure 2.7.4-4. SBLOCA Boric Acid Concentration Analysis - Vessel Boric Acid Concentration, Boil-off, and Flushing Flow versus Time 2-370 WCAP-17658-NP September 2016 Licensing Report Revision 1-C Figure 2.7.4-5. Core Dilution at 12 Hours for SBLOCA Pressure Hangup

2-371 WCAP-17658-NP September 2016 Licensing Report Revision 1-C

2.8 ANTICIPATED

TRANSIENTS WITHOUT SCRAM (USAR SECTIONS 15.8 AND 7.7.1.11)

2.8.1 Technical

Evaluation 2.8.1.1 Introduction The Final ATWS Rule, 10 CFR 50.62(c)(1) (Reference 1), requires the incorporation of a diverse (from the reactor trip system) actuation of the AFW system and turbine trip for Westinghouse-designed plants. The installation of the USNRC-approved AMSAC satisfies this Final ATWS Rule. However, it must also be demonstrated that the deterministic ATWS analyses that form the basis for this rule and the AMSAC design remain valid for the plant. This is typically done by confirming that the analyses documented in NS-TMA-2182 (Reference 2) remain valid or by performing new deterministic analyses for the proposed plant state. For the WCGS, the LOL and LONF ATWS events were analyzed to ensure that the analytical basis for the Final ATWS Rule continues to be met. The LOL and LONF ATWS events are the two most limiting RCS overpressure transients reported in NS-TMA-2182. The objective is to show that the ATWS pressure limit of 3200 psig is met for at least 95 percent of the cycle, and therefore the analytical basis for the Final ATWS Rule continues to be met. 2.8.1.2 Input Parameters, Assumptions, and Acceptance Criteria The LOL and LONF ATWS analyses for the WCGS used a plant-specific ATWS model consistent with the methodology described in NS-TMA-2182. The following analysis assumptions were used: The nominal and initial conditions were set consistent with the design parameters for an NSSS power of 3651 MWt. Westinghouse Model F SG characteristics were used. Consistent with the analysis basis for the Final ATWS Rule (NS-TMA-2182):

- TDF is assumed, no uncertainties are applied to the initial power, RCS average temperature or RCS pressure.

- 0 percent SGTP is assumed. 0 percent SGTP is more limiting (that is, results in a higher peak RCS pressure) for ATWS events.

- Control rod insertion was not assumed.

- 100 percent pressurizer PORV capacity was assumed.

- Turbine trip and AFW actuation are modeled to occur at plant-specific times after event initiation, using the WCGS AMSAC setpoint and delays.

2-372 WCAP-17658-NP September 2016 Licensing Report Revision 1-C

- A 25-second AMSAC response time was assumed. This delay time is added to the time at which the SG water mass reaches a mass equivalent to the water level at the AMSAC low SG water level setpoint of 12 percent of span. The AFW initiation time was determined by adding an additional 60-second delay to account for the time to get the AFW pumps up to speed, sensor delays, and logic delays. The turbine trip initiation time was determined by adding an additional 5-second delay. A WCGS best-estimate AFW flow of 1200 gpm was assumed. A WCGS-specific MTC of -8 pcm/°F was modeled to bound 95 percent of the cycle. This value is consistent with that assumed in generic ATWS analyses (Reference 2). The ATWS MTC limit is confirmed each cycle as part of the reload process. To remain consistent with the basis of the Final ATWS Rule and the supporting analyses documented in NS-TMA-2182, the peak RCS pressure reached in the WCGS ATWS evaluations should not exceed the ASME B&PV Code, Service Level C stress limit criterion of 3200 psig. This value corresponds to the maximum allowable pressure for the weakest component in the RPV (the nozzle safe end). 2.8.1.3 Description of Analyses and Evaluations The LONF and LOL ATWS events were analyzed based on a conservative NSSS power of 3651 MWt. The LOFTRAN computer code (Reference 3) was used to perform the WCGS ATWS analyses, consistent with the analysis basis for the Final ATWS Rule. 2.8.1.4 Results To remain consistent with the basis of the Final ATWS Rule (10 CFR 50.62), the peak RCS pressure calculated in both the LOL and the LONF ATWS analyses shall be less than 3200 psig (or 3215 psia). The calculated peak RCS pressure obtained for the LOL and LONF ATWS analyses is 2897.9 psia and 3129.0 psia, respectively. The time sequence of events is documented in Table 2.8.1-1 for the LOL ATWS and in Table 2.8.1-2 for the LONF ATWS. Key transient parameters are shown in Figures 2.8.1-1 through 2.8.1-8 for the LOL ATWS and in Figures 2.8.1-9 through 2.8.1-16 for the LONF ATWS. Based on these results, it has been demonstrated that the analytical basis for the Final ATWS Rule continues to be met for operation of the WCGS at an NSSS power level as high as 3651 MWt.

2-373 WCAP-17658-NP September 2016 Licensing Report Revision 1-C

2.8.2 Conclusion

The information related to ATWS has been reviewed and it was concluded that it has adequately accounted for the WCGS plant-specific effects on ATWS. The evaluation has demonstrated that the AMSAC continues to meet the requirements of 10 CFR 50.62. The evaluation has shown that the plant is not required by 10 CFR 50.62 to have a diverse scram system. Additionally, the evaluation has shown that the ATWS pressure limit of 3200 psig will be met for at least 95 percent of the cycle. The MTC assumed in this analysis will continue to be checked on a cycle-specific basis. Therefore, the WCGS is acceptable with respect to ATWS.

2.8.3 References

1. 10 CFR 50.62 and Supplementary Information Package, "Requirements for Reduction of Risk from ATWS Events for Light Water-Cooled Nuclear Power Plants."
2. Westinghouse Report NS-TMA-2182, "ATWS Submittal," December 1979.
3. Westinghouse Report WCAP-7907-P-A, "LOFTRAN Code Description," April 1984.

2-374 WCAP-17658-NP September 2016 Licensing Report Revision 1-C Table 2.8.1-1 LOL ATWS Time Sequence of Events Event Time (seconds) Turbine trip occurs 1.0 Loss of FW flow initiated 4.0 Peak RCS pressure reached [2897.9 psia] 104.7 AFW initiated 131.0 Table 2.8.1-2 LONF ATWS Time Sequence of Events Event Time (seconds) Loss of FW flow initiated 4.0 Turbine trip occurs 61.0 Peak RCS pressure reached [3129.0 psia] 90.2 AFW initiated 116.0 2-375 WCAP-17658-NP September 2016 Licensing Report Revision 1-C Figure 2.8.1-1. LOL ATWS Nuclear Power versus Time Figure 2.8.1-2. LOL ATWS Core Heat Flux versus Time 2-376 WCAP-17658-NP September 2016 Licensing Report Revision 1-C Figure 2.8.1-3. LOL ATWS RCS Pressure versus Time Figure 2.8.1-4. LOL ATWS Pressurizer Water Volume versus Time 2-377 WCAP-17658-NP September 2016 Licensing Report Revision 1-C Figure 2.8.1-5. LOL ATWS Vessel Inlet Temperature versus Time Figure 2.8.1-6. LOL ATWS RCS Flow versus Time 2-378 WCAP-17658-NP September 2016 Licensing Report Revision 1-C Figure 2.8.1-7. LOL ATWS SG Pressure versus Time Figure 2.8.1-8. LOL ATWS SG Mass versus Time 2-379 WCAP-17658-NP September 2016 Licensing Report Revision 1-C Figure 2.8.1-9. LONF ATWS Nuclear Power versus Time Figure 2.8.1-10. LONF ATWS Core Heat Flux versus Time 2-380 WCAP-17658-NP September 2016 Licensing Report Revision 1-C Figure 2.8.1-11. LONF ATWS RCS Pressure versus Time Figure 2.8.1-12. LONF ATWS Pressurizer Water Volume versus Time 2-381 WCAP-17658-NP September 2016 Licensing Report Revision 1-C Figure 2.8.1-13. LONF ATWS Vessel Inlet Temperature versus Time Figure 2.8.1-14. LONF ATWS RCS Flow versus Time 2-382 WCAP-17658-NP September 2016 Licensing Report Revision 1-C Figure 2.8.1-15. LONF ATWS SG Pressure versus Time Figure 2.8.1-16. LONF ATWS SG Mass versus Time 2-383 WCAP-17658-NP September 2016 Licensing Report Revision 1-C

2.9 RADIOLOGICAL

DOSES The WCGS radiological consequences analyses have been performed to follow Regulatory Guide (RG) 1.183 (Reference 1) which provides guidance on the application of Alternative Source Term (AST) methodology, as allowed by 10 CFR 50.67. The AST methodology is being used to calculate the offsite, control room, and Technical Support Center radiological consequences. The following accidents are analyzed: MSLB LOAC Locked rotor Rod ejection Letdown line break SGTR LOCA Waste gas decay tank failure Liquid waste tank failure Fuel handling accident (FHA) Detailed discussion of the input parameters, assumptions, event descriptions, acceptance criteria, analysis results, and conclusions for each accident is presented in Section 4.3 of Enclosure IV of this LAR. References

1. Regulatory Guide 1.183, Revision 0, "Alternative Radiological Source Terms for Evaluating Design Basis Accidents at Nuclear Power Reactors," July 2000.

2.10 INSTRUMENT UNCERTAINTIES Refer to Enclosures II and III of this LAR for the Revised Thermal Design Procedure Uncertainty Calculations for the WCGS.

2.11 CONTROL SYSTEMS ANALYSIS 2.11.1 NSSS Pressure Control Component Sizing (USAR Sections 5.4, 7.7, & 10.4.4) 2.11.1.1 Technical Evaluation 2.11.1.1.1 Introduction The following pressure control components were evaluated for the TM Program. The purpose of this evaluation is to ensure that the NSSS pressure control system component installed capacities are adequate and meet the plant design basis sizing requirements. Pressurizer PORVs 2-384 WCAP-17658-NP September 2016 Licensing Report Revision 1-C Pressurizer spray valves Pressurizer heaters Steam dump valves The analyses were performed to envelop the window of operating conditi ons, which include the full-power Tavg window, the full-power T feed window, and 0 to 10 percent average SGTP levels. The analyses utilized the potential MUR power level and conditions; the analysis results therefore, bound the current power level conditions. The pressure control components are described in the USAR, Section 5.4 ("Component and Subsystem Design"), Section 7.7 ("Control Systems not Required for Safety"), and Section 10.4.4 ("Turbine Bypass System"). 2.11.1.1.2 Input Parameters, Assumptions, and Acceptance Criteria Pressurizer PORVs The pressurizer PORV sizing analysis was performed at the MUR operating conditions shown in Section 1.1. The analysis at MUR power conditions bounds current power conditions. The pressurizer PORV sizing analysis was performed to confirm that the installed PORV capacity is adequate to meet the applicable sizing criteria. The analysis included the following key input parameters and assumptions: The design basis transient is modeled as a 50 percent step load rejection from full power. The analysis is performed at a full power T avg of 588.4°F (high T avg), 0 percent SGTP, and a Tfeed of 448.6°F, which bounds all other normal operating conditions. The analysis is best estimate and best estimate conditions are assumed except a 4°F T avg uncertainty and 0.6 percent power uncertainty were applied for conservatism. The secondary side water mass was reduced by 10 percent for conservatism. The initial pressurizer pressure is at the nominal pressure of 2250 psia. The initial pressurizer water level is at the nominal setpoint. There are a total of two pressurizer PORVs, each with a rated capacity of 210,000 lbm/hr at 2335 psig. The NSSS control systems (reactor, pressurizer pressure, pressurizer level, SG level, and steam dump control systems) are assumed to be operational and functioning as designed. The pressurizer PORV sizing analysis is completed using best estimate BOL fuel reactivity data.

BOL parameters have lower differential rod worths and least negative MTC; thus, using BOL parameters yields conservative results and bounds the entire fuel cycle.

2-385 WCAP-17658-NP September 2016 Licensing Report Revision 1-C Acceptance Criteria The Westinghouse sizing basis for the pressurizer PORVs is to prevent the pressurizer pressure from reaching the high pressurizer pressure RTS setpoint during the design basis large load rejection transient. This design basis large load rejection is defined as a 50 percent step load reduction from full power. The sizing criterion is conservatively met if the maximum pressurizer insurge during the transient is less than the total capacity of the PORVs. The sizing basis for the PORVs is documented in USAR Sections 5.4.13.1 and 7.7.1.5 and is consistent with the Westinghouse sizing basis. Pressurizer Spray Valves The pressurizer spray valves sizing analysis was pe rformed at the MUR power conditions shown in Section 1.1. The analysis at MUR power conditions bounds current power conditions. The pressurizer spray valves sizing analysis was performed to confirm that the installed spray valves capacity is adequate to meet the applicable sizing criteria. The analysis included the key input parameters and assumptions listed below: The design basis transient is modeled as a 10 percent step load decrease from full power. The analysis is performed at a full power T avg of 588.4°F (high T avg), 0 percent SGTP, and a Tfeed of 448.6°F, which bounds all other normal operating conditions. The analysis is best estimate and best estimate conditions are assumed except a 4°F T avg uncertainty and 0.6 percent power uncertainty were applied for conservatism. The secondary side water mass was reduced by 10 percent for conservatism. The initial pressurizer pressure is at the nominal pressure of 2250 psia. The initial pressurizer water level is at the nominal setpoint applicable to the full power T avg operating conditions. There are two pressurizer spray valves with a combined total capacity of 896 gpm. The NSSS control systems (rod, pressurizer level, pressurizer pressure, and SG level) are assumed to be operational and functioning as designed. The steam dump system is not actuated for load changes less than 10 percent; therefore, steam dump is not modeled for this analysis. The pressurizer spray valve sizing analysis is completed using best estimate BOL fuel reactivity data. BOL parameters have lower differential rod worths and least negative MTC; thus, using BOL parameters yields conservative results and bounds the entire cycle.

2-386 WCAP-17658-NP September 2016 Licensing Report Revision 1-C Acceptance Criteria The Westinghouse sizing basis for the pressurizer spray valves is to prevent the pressurizer pressure from reaching the pressurizer PORV actuation setpoint of 2335 psig (2350 psia) for the design basis 10 percent step load decrease transient. The sizing basis for the spray valves is documented in USAR Section 5.4.10.3.4 and is consistent with the Westinghouse sizing basis. Pressurizer Heaters The evaluation included the following key input parameters and assumptions: The total backup heater design capacity is 1384 kW and the total proportional heater design capacity is 416 kW. This provides a total heater design capacity of 1800 kW. The evaluation bounds reduced backup and proportional heater capacities of 1315 kW and 347 kW, respectively. The total pressurizer internal volume is 1800.0 ft

3. Acceptance Criteria The pressurizer heater capacity should be sufficient to 1) provide heat during cold plant startup, 2) regulate pressure to avoid reaching applicable RTS and ESFAS setpoints during Condition I transients, and 3) counteract the steady-state heat loss that occurs within the pressurizer to maintain steady state operating pressure. The design basis pressurizer heater capacity to meet these requirements is 1 kW of heater capacity per cubic foot of pressurizer volume. Additionally, limiting condition for operation (LCO) 3.4.9.b requires two groups of backup heaters to be operable with the capacity of each group 150 kW to ensure the normal operating pressure can be maintained after accounting for heat losses. Steam Dump Valves The steam dump valves sizing analysis was performed at the MUR power conditions shown in Section 1.1. The analysis at MUR power conditions bounds current power conditions. The steam dump valves sizing analysis was performed to confirm that the installed steam dump system capacity is adequate to meet the applicable sizing criteria. Two design basis transients were analyzed for the steam dump capacity sizing: the 50 percent load rejection from full power transient and the plant trip from full power transient. The 50 percent load rejection transient was modeled as a 50 percent step rejection in turbine load from full power and the plant trip was modeled as a turbine trip followed by a reactor trip from full power. The 50 percent load rejection transient was analyzed as part of the margin to trip analysis and the details of the input parameters and assumptions for this transient are defined in Section 2.11.2. The analysis of the plant trip transient included the following key input parameters and assumptions:

A two second delay is conservatively assumed for reactor trip on turbine trip.

2-387 WCAP-17658-NP September 2016 Licensing Report Revision 1-C The analysis is performed at a full power T avg of 588.4°F (high T avg), 0 percent SGTP, and a Tfeed of 448.6°F, which bounds all other normal operating conditions. The analysis is best estimate and best estimate conditions are assumed except a 4°F T avg uncertainty and 0.6 percent power uncertainty were applied for conservatism. The secondary side water mass was reduced by 10 percent for conservatism. The SG PORVs are not modeled in the analysis. The NSSS control systems (rod, pressurizer level, pressurizer pressure, and SG level) are assumed to be operational and functioning as designed. The steam dump system is operating in the reactor trip controller mode. Acceptance Criteria The Westinghouse sizing basis of the steam dump system is to enable the plant to survive a 50 percent load rejection without generating a reactor trip or challenging the MSSV, and by being able to survive a turbine trip with a reactor trip without challenging the MSSV actuation setpoint of 1185 psig (1200 psia). The sizing basis for the steam dump system is documented in USAR Section 10.4.4.1 "Power Generation Design Basis Three" and is consistent with the Westinghouse sizing basis. 2.11.1.1.3 Description of Analyses and Evaluations Transients for the pressure control component sizing analysis were analyzed using the LOFTRAN computer code (Reference 1). This computer code is a system-level code that models the overall NSSS, including detailed modeling for control and protection systems. A LOFTRAN computer model was developed for the WCGS. The key input parameters and assumptions for each transient are given in Section 2.11.1.1.2. No computer analyses were performed specifically for the pressurizer heater sizing evaluation; however, the operational and margin to trip analyses in Section 2.11.2 were performed using reduced heater capacity and show that an adequate transient response is maintained. Additionally, the impact of a reduced heater capacity is evaluated in Section 2.11.1.1.4. 2.11.1.1.4 Results Pressurizer PORVs The results of the analysis show a maximum pressurize r pressure of 2351 psia, which is less than the high pressurizer pressure RTS setpoint of 2400 psia. The results of the analysis also show that the maximum pressurizer insurge flow rate is 152,900 lbm/hr compared to the installed PORV capacity of 420,000 lbm/hr. The calculated peak pressurizer pressure on a design basis 50 percent load rejection was less than the high pressure RTS setpoint. Therefore, the PORVs have sufficient relief capacity to avoid a reactor trip on high 2-388 WCAP-17658-NP September 2016 Licensing Report Revision 1-C pressurizer pressure for the design basis load rejection. Similarly, it was shown that the required PORV capacity (i.e., the pressurizer insurge) during the transient was less than the total installed capacity. The PORVs are therefore adequately sized. Pressurizer Spray Valves The results of the 10 percent step load decrease from full power show a maximum pressurizer pressure of 2330 psia, which is less than the pressurizer PORV actuation setpoint of 2350 psia. Because the peak pressurizer pressure was less than the PORV actuation setpoint of 2350 psia, the total installed spray valves capacity of 896 gpm is adequate to avoid actuation of the pressurizer PORV during a 10 percent step load decrease from full power transient. Pressurizer Heaters The total design heater capacity of 1800 kW meets the design criteria of 1 kW/ ft 3 of pressurizer volume; however, as discussed in Section 2.11.1.1.2, the reduced heater capacities evaluated are 1315 kW for the backup heaters and 347 kW for the proportional heaters, for a total heater capacity of 1662 kW. Based on the reduced capacity of the heaters, the criterion of one kilowatt per one cubic foot is not met. Therefore, the sizing evaluation was performed for a total heater capacity of 1662 kW to confirm that the plant response to the design basis transients would remain acceptable with the reduced heater capacity. Design basis transients resulting in pressurizer insurges/outsurges such as loadings/unloadings, load rejections, and reactor trips show pressurizer pressure changes that are too rapid for the pressurizer heaters to significantly influence. In addition, past analyses have demonstrated only small differences in the maximum/minimum pressurizer pressure when it is assumed that a fraction of the pressurizer heaters are out of service. Analyses have demonstrated that a reduced heater capacity results in increased times for plant heatup. A reduction in pressurizer heater capacity of this magnitude is acceptable for transient mitigation based on the results of the operational transient analysis in Section 2.11.2. The reduced proportional heater capacity of 347 kW assumed in the analysis is greater than the 300 kW specified in LCO 3.4.9.b; therefore, the proportional heaters are capable of maintaining the normal operating pressure

as designed. It is concluded that a total heater capacity of 1662 kW is acceptable and this conclusion is further demonstrated by the results of the operational transient analyses documented in Section 2.11.2. Steam Dump Valves The results of the turbine trip followed by a reactor trip from full power analysis show a maximum SG pressure of 1158 psia, which provides 42 psi of margin to the first MSSV lift setpoint of 1200 psia. The results of the 50 percent load rejection analysis discussed in more detail in Section 2.11.2 show that acceptable margin is maintained to all applicable RTS setpoints, and the first MSSV lift setpoint is not exceeded. Because the SG pressure was less than the lowest MSSV actuation setpoint of 1200 psia for both design basis transients and no RTS setpoints are reached during the 50 percent load rejec tion transient, the total installed capacity steam dump system is adequate.

2-389 WCAP-17658-NP September 2016 Licensing Report Revision 1-C 2.11.1.2 Conclusion Pressure control component sizing analyses for the pressurizer PORV, pressurizer spray valves, pressurizer heaters, and steam dump valves were performed using Westinghouse methodology. The results of these analyses showed that the installed capacities of these components at WCGS are adequate at the current and MUR power levels. 2.11.1.3 References

1. Westinghouse Report WCAP-7907-P-A, "LOFTRAN Code Description," April 1984.

2.11.2 Operational Analysis and Margin to Trip (USAR Section 7.7) 2.11.2.1 Technical Evaluation 2.11.2.1.1 Introduction The following transients were analyzed or evaluated. These transients are listed in USAR Section 7.7.2 ("Analysis"), as design basis operational transients that the plant control systems described in USAR Section 7.7.1 should regulate without actuation of plant safety systems. 5 percent per minute unit loading and unloading (Condition I) 10 percent step load decrease (Condition I) 10 percent step load increase (Condition I) Large load rejection (Condition I) Additionally, the turbine trip without a reactor trip transient from the P-9 permissive setpoint was analyzed to demonstrate that adequate margin is maintained to the pressurizer PORVs actuation setpoint (NUREG-0737, item II.K.3.10). The transients were analyzed to envelop the window of operating conditions that include the full-power T avg window, the full-power Tfeed window, and 0 to 10 percent average SGTP levels. The analyses were performed at the potential MUR power uprate conditions and the results of the analyses bound the current power level conditions. 2.11.2.1.2 Input Parameters, Assumptions, and Acceptance Criteria The analyses included the following key input parameters and assumptions: The analyses were performed at the MUR operating conditions shown in Section 1.1. The analyses were based on the MUR NSSS power level of 3651 MWt and bound the current NSSS power level of 3579 MWt. Additionally, the analyses cover a full-power T avg range from 570.7°F to 588.4°F, full-power Tfeed range from 400.0°F to 448.6°F, and average SGTP levels between 0 percent and 10 percent.

2-390 WCAP-17658-NP September 2016 Licensing Report Revision 1-C The plant operational analysis is a best-estimate analysis; therefore, the plant conditions are at the nominal values and instrument uncertainties are not applied. However, a 0.6 percent power allowance was applied for conservatism. All NSSS control systems (reactor, pressurizer pressure, pressurizer level, SG level, and steam dump) are assumed to be operational and functioning as designed. Best-estimate reactor kinetics data (such as MTC, Doppler power defect, and control rod worth) were used as input to the analysis. BOL core conditions were used, which are bounding for the entire cycle. The analyses were performed using the currently installed control system settings and the nominal RTS and ESFAS settings. Acceptance Criteria The acceptance criteria for the NSSS control syst ems are based on GDC 13, which requires that instrumentation and control systems be provided to monitor variables and systems over their anticipated ranges during normal operation as well as anticipated operational occurrences, and maintain these variables and systems within prescribed operating ranges. There should be adequate operating margin to the relevant RTS and ESFAS setpoints during and following the Condition I (normal operating) transients. All control system responses should be smooth and stable without diverging oscillations. In addition to the limiting RTS and ESFAS setpoints, the 10 percent step load decrease transient should not challenge the pressurizer PORVs or MSSV lift

setpoints. The turbine trip without a reactor trip from the P-9 setpoint analysis is performed to demonstrate that adequate margin is maintained to the pressurizer PORVs actuation setpoint of 2350 psia. The results of this analysis are used to demonstrate that the requirements of NUREG-0737, item II.K.3.10 (Reference 1) are satisfied. Although it is not a design requirement of the turbine trip without a reactor trip from the P-9 permissive transient, it is desirable to ensure that the MSSVs do not lift during this transient. This is demonstrated by maintaining adequate margin to the first MSSV lift setting of 1185 psig (1200 psia). 2.11.2.1.3 Description of Analyses and Evaluations The transients were analyzed using the LOFTRAN computer code (Reference 2). This computer code is a system-level code that models the overall NSSS, including detailed modeling for control and protection systems. A LOFTRAN computer model was developed for the WCGS. The key input parameters and assumptions for the analyses are given in subsection 2.11.2.1.2. 5 Percent per Minute Unit Loading and Unloading The 5 percent per minute loading and unloading transi ents are not limiting transients and are enveloped by the 10 percent step load increase and decrease transients, respectively. Therefore, no specific analyses were performed for the 5 percent per minute loading and unloading transients.

2-391 WCAP-17658-NP September 2016 Licensing Report Revision 1-C 10 Percent Step Load Decrease This transient was analyzed as a step decrease in turbine load from 100 to 90 percent power which bounds lower power levels. The primary control systems that mitigate this transient are the reactor control system and pressurizer pressure control system. The steam dump system is blocked on load decreases less than 10 percent. The 10 percent step load decrease transient should not result in challenges to the pressurizer PORVs actuation setpoint and the maximum steam pressure should not challenge the first MSSV lift

setpoint. 10 Percent Step Load Increase This transient was analyzed as a step increase in turbine load from 90 to 100 percent power, which bounds lower power levels. The primary control systems that mitigate this transient are the reactor control system and pressurizer pressure control system. The 10 percent step load increase transient should not result in an automatic actuation of an RTS or ESFAS function. The limiting RTS and ESFAS functions are the high neutron flux, low pressurizer pressure, OTT, OPT, and low steam line pressure RTS and ESFAS setpoints. Large Load Rejection The large load rejection is the most severe operational transient and was analyzed as a step decrease in turbine load from 100 to 50 percent power, which bounds lower power levels. The primary control systems that mitigate this transient are the reactor control system, pressurizer pressure control system, and steam dump control system. The steam dump control system maintains the RCS temperature within the control range until a new equilibrium condition is reached. The RTS functions that are most limiting for this transient are the OTT, OPT, low pressurizer pressure, and high pressurizer pressure setpoints. Turbine Trip without Reactor Trip from P-9 Setpoint This transient was analyzed as a step change in steam flow from the P-9 setpoint of 50 to 0 percent power. A turbine trip from 50 percent power bounds all lower power levels. The analysis is performed to demonstrate that the pressurizer PORVs do not lift following a turbine trip without a reactor trip transient from the P-9 permissive setpoint to address NUREG-0737, Item II.K.3.10 (Reference 1). The analysis is best-estimate and credits the reactor control system, pressurizer pressure control system, and steam dump control systems. 2.11.2.1.4 Results The results of the analyses show that the current control system setpoints and RTS and ESFAS settings are acceptable and enable the plant to satisfy the requirements of the design basis operational transients.

2-392 WCAP-17658-NP September 2016 Licensing Report Revision 1-C Ten Percent Step Load Decrease Following the 10 percent step load decrease, the secondary side steam pressure and temperature initially increase, resulting in a Tavg and pressurizer pressure increase. The control system automatically inserts the control rods to restore T avg to the programmed value. Pressurizer spray restores the pressurizer pressure to the nominal value.

Based on the results, a 10 percent step load decrease transient can be accommodated without challenging the pressurizer PORVs setpoint of 2350 psia and the first MSSV setpoint of 1200 psia. The maximum pressurizer pressure was 2326 psia and the maximum steam line pressure was 1060 psia. This resulted in minimum margins of 24 psi to the pressurizer PORVs and 140 psi to the nominal MSSV actuation setpoints. The results indicated that no RTS or ESFAS setpoints were challenged and the control system responses were smooth and not oscillatory. Therefore, the 10 percent step load decrease transient can be successfully accommodated. Ten Percent Step Load Increase Following the 10 percent step load increase, the secondary side steam pressure and temperature initially decrease and the T avg and pressure also initially decrease. The control system automatically withdraws the control rods to restore T avg to the programmed value. Pressurizer heaters restore the pressurizer pressure to the nominal value. The 50 seconds/5 seconds lead/lag compensated steam pressure reached a minimum of 668.2 psia, which is above the low steam line pressure SI actuation setpoint of 630 psia. Therefore, the criterion of not challenging the low steam line pressure SI on a design basis 10 percent step load increase transient is met. The minimum pressurizer pressure was 2211 psia, which is greater than the low pressure RTS setpoint of 1955 psia. The power range neutron flux reached a maximum value of 104.4 percent, which is less than the RTS setpoint of 109 percent. Acceptable margins of 9.68 and 5.0 percent were maintained to the OTT and OPT RTS setpoints, respectively. The results indicated that no RTS or ESFAS setpoints were challenged and the control system response was stable and not oscillatory. Therefore, the 10 percent step load increase transient can be successfully accommodated. Large Load Rejection Following the large load rejection, the secondary side steam pressure and temperature initially increase, resulting in a T avg and pressurizer pressure increase. The steam dump valves open to mitigate the RCS temperature increase and the reactor control system automatically inserts the control rods to decrease reactor power and restore T avg to the programmed value. The steam dump valves modulate closed as the plant is brought to a new equilibrium condition. Pressurizer spray and relief valves prevent the pressure from reaching the high pressurizer pressure RTS setpoint.

Based on the results, a 50 percent step load rejec tion can be sustained over the range of operating conditions. Minimum margins of 6.02 and 8.88 percent of nominal T were maintained to the OTT and OPT RTS setpoints, respectively, which is acceptable. The pressurizer PORVs open and limit the pressure to less than the high pressurizer pressure RTS setpoint of 2400 psia. Following the opening of the 2-393 WCAP-17658-NP September 2016 Licensing Report Revision 1-C pressurizer PORVs, the minimum pressurizer pressure of 2139 psia maintains adequate margin to the low pressurizer pressure RTS setpoint of 1955 psia. The results indicated that no RTS or ESFAS setpoints were challenged and the control system response was stable and not oscillatory. Therefore, the large load rejection transi ent can be successfully accommodated. Turbine Trip without Reactor Trip from the P-9 Permissive Following the turbine trip, the secondary side steam pressure and temperature initially increase, resulting in a Tavg and pressurizer pressure increase. The steam dump valves open to mitigate the RCS temperature increase and the reactor control system automatically inserts the control rods to decrease reactor power and Tavg. Pressurizer spray prevents the pressure from reaching the pressurizer PORVs actuation setpoint. This transient is modeled as a step change in steam flow from the P-9 setpoint power level to 0 percent power. The analysis was performed from the current P-9 permissive setpoint of 50 percent RTP and covered the range of operating conditions. The current P-9 setpoint was found to be acceptable at conditions corresponding to the high full power T avg of 588.4°F; however, the results indicated that the pressurizer PORVs actuation setpoint was challenged for the case corresponding to low full- power T avg (i.e., 570.7°F) conditions. Further analyses showed that acceptable results are obtained for the current P-9 setpoint if the full-power T avg is restricted to no lower than 575°F. Therefore, the current P-9 setpoint of 50 percent RTP is acceptable for plant operation over a restricted full-power Tavg window of 575°F to 588.4°F. The limiting full-power T avg for the current P-9 setpoint is 575°F and the pressurizer pressure increases to a maximum pressure of 2339 psia, which results in acceptable margin of approximately 11 psi to the PORVs actuation setpoint. The case corresponding to high T avg (588.4°F) conditions resulted in a maximum pressurizer pressure of 2302 psia, which is well below the pressurizer PORVs actuation setpoint. The maximum SG pressure for all cases analyzed is 1071 psia, which is well below the first MSSV lift setting of 1200 psia. The analyses indicate the control system response was smooth during the transient with no oscillatory response noted. Therefore, the turbine trip without reactor trip transient from the P-9 permissive setpoint of 50 percent RTP can be successfully accommodated over a restricted full-power T avg window of 575°F to 588.4°F. WCNOC will administratively limit full-power T avg to greater than or equal to 575°F. 2.11.2.1.5 Conclusion Plant operational margin to trip analyses were performed using Westinghouse methodology. The results of these analyses conclude that the plant response is acceptable and sufficient margin exists to the relevant RTS and ESFAS setpoints during the design basis operational transients as described in USAR 7.7.2 at the WCGS for the current and MUR power levels. The results of the analyses show that the current control system setpoints and RTS and ESFAS settings are acceptable and enable the plant to satisfy the requirements of the design basis operational transients.

2-394 WCAP-17658-NP September 2016 Licensing Report Revision 1-C The current P-9 permissive setpoint of 50 percent RTP is acceptable for a restricted full-power T avg window between 575°F and 588.4°F. The results show that a turbine trip from the P-9 setpoint will not challenge the pressurizer PORVs actuation setpoint with all NSSS control systems operable in the automatic mode; therefore, the requirements of NUREG-0737, item II.K.3.10 are satisfied. The WCGS will administratively limit full-power Tavg to greater than or equal to 575°F. 2.11.2.1.6 References

1. NUREG-0737, "Clarification of TMI Action Plan Requirements," Item II.K.3.10, Proposed Anticipatory Trip Modification, October 1980.
2. Westinghouse Report WCAP-7907, "LOFTRAN Code Description," April 1984.

2.12 THERMAL AND HYDRAULIC DESIGN 2.12.1 Introduction This section describes the T/H analysis performed to support operation of the WCGS with a core containing 17x17 RFA-2 fuel at the nominal conditions described in Table 2.12-1.

2.12.2 Input Parameters and Acceptance Criteria For the purposes of the WCGS methodology transition, bounding fuel-related safety and design parameters have been chosen. These bounding parameters have been used in the analyses discussed in this section. Table 2.12-1 summarizes the current T/H design parameters used in the DNB analyses. The limiting direction for these parameters for DNB is shown in Table 2.12-2. The core inlet temperature used in the DNB analyses is based on the upper bound of the RCS temperature range for conditions corresponding to a conservatively higher core power. The current licensing basis for T/H design for the WCGS includes the prevention of DNB on the limiting fuel rod with a 95-percent probability at a 95-percent confidence level (95/95) and criteria to ensure fuel cladding integrity. The licensing basis is documented in USAR Section 4.4, Thermal and Hydraulic Design. The DNB analysis for the methodology transition is based on this licensing basis while incorporating a conservatively higher core power. The analysis addresses DNB performance and the effects of fuel rod bow, bypass flow and lower plenum flow anomalies. 2.12.2.1 Design Basis and Methodology The T/H DNB analysis of the fuel at the WCGS is based on the RTDP (Reference 1) and the WRB-2 DNB correlation (Reference 2) using the Westinghouse version of the VIPRE-01 subchannel analysis code (Reference 3). The STDP is used when RTDP is not applicable. For analyses that are outside of the range of applicability of the WRB-2 correlation, a W-3 alternative DNB correlation (ABB-NV or WLOP) is used (Reference 4). The RTDP methodology is applicable to accidents that initiate from normal operating conditions whereas the STDP methodology is typically applied to events that are initiated from shutdown conditions. The WRB-2 correlation is used for analysis of fuel regions above the first mixing vane grid whereas the ABB-NV correlation is used for analysis of fuel regions below the first mixing 2-395 WCAP-17658-NP September 2016 Licensing Report Revision 1-C vane grid. The WLOP correlation is used when the coolant conditions are outside the range of applicability of the WRB-2 and ABB-NV correlations. Specific methodologies and correlations for specific events are identified in other portions of Section 2.0 of this report. The analyses demonstrate that the 95/95 DNB design basis is met for the core in operation at the maximum analyzed core power in Table 2.12-1. 2.12.2.1.1 Subchannel Analysis Code The Westinghouse version of the VIPRE-01 code (VIPRE, Reference 3) is used for DNBR calculations. The use of VIPRE for the methodology transition is in full compliance with the c onditions specified in the USNRC SER in WCAP-14565-P-A (Reference 3) for THINC and FACTRAN replacement. See Appendix A of this WCAP for code applicability. 2.12.2.1.2 DNB Methodology With the RTDP methodology, uncertainties in plant operating parameters, nuclear and thermal parameters, fuel fabrication parameters, computer codes, and DNB correlation predictions are statistically considered to obtain the overall DNB uncertainty factors. Proprietary DNBR sensitivity factors, which are used to develop DNB uncertainty factors, are calculated over ranges of conditions that bound the events for which RTDP methodology is applied. Based on the DNB uncertainty factors, RTDP design limit DNBR values are determined such that there is a 95-percent probability with a 95-percent confidence level that DNB will not occur on the most limiting fuel rod during normal operation, operational transients, or transient conditions arising from faults of moderate frequency. The uncertainties included in the overall DNB uncertainty factor are: nuclear enthalpy rise hot channel factor, (F NH) enthalpy rise engineering hot channel factor, (F EH) uncertainties in the DNB correlations and the computer codes vessel coolant flow effective core flow fraction (1 - bypass flow fraction) core thermal power coolant temperature system pressure Instrumentation uncertainties in core thermal power, RCS flow, pressure, and inlet temperature were taken into account for the methodology transition. Only the random portion of each plant operating parameter uncertainty is included in the statistical combination for RTDP. Any adverse instrumentation bias is treated either as a DNBR penalty or a direct analysis input. In addition to the above considerations for uncertainties, DNBR margin is retained by performing the safety analyses to DNBR limits higher than the design limit DNBR values. Sufficient DNBR margin is conservatively maintained in the safety analysis DNBR limits to offset penalties for rod bow, lower plenum flow anomalies, and plant instrumentati on biases and to provide flexibility in design and operation of the plant. Table 2.12-3 provides a summary of the DNBR margin and penalties applicable at nominal conditions.

2-396 WCAP-17658-NP September 2016 Licensing Report Revision 1-C The STDP is used for those analyses where RTDP is not applicable. The DNBR limit for STDP is the appropriate DNB correlation limit increased by sufficient margin to offset the applicable DNBR penalties. 2.12.2.1.3 DNB Correlations and Limits The WRB-2 DNB correlation is based entirely on rod bundle data and takes credit for the significant improvements in DNB performance due to the mixing vane grid effects. USNRC acceptance of a 95/95 WRB-2 correlation DNBR limit of 1.17 for 17x17 RFA-2 fuel is documented in References 2, 3, and 5. For the methodology transition, the WRB-2 RTDP design limit DNBR is 1.24 for the 17x17 RFA-2 fuel at the WCGS. The RTDP DNB analyses are performed to a higher DNBR limit referred to as the SAL DNBR that includes additional margin. For cases in which WRB-2 is not applicable, the W-3 alternative correlations (ABB-NV or WLOP) are used as approved in Reference 4. For events in which STDP is used, the 95/95 correlation DNBR limits are 1.17 for WRB-2, 1.13 for ABB-NV, and 1.18 for WLOP.

The reactor core is designed to meet the following limiting T/H criteria: There is at least a 95-percent probability, at a 95-percent confidence level, that DNB will not occur during any anticipated normal operating condition, operational transients, or any condition of moderate frequency. Fuel melting will not occur during any anticipated normal operating condition, operational transients, or any conditions of moderate frequency. Thermo-hydrodynamic instabilities will not occur during any anticipated normal operating condition, operational transients, or any conditions of moderate frequency. DNBR is defined as the ratio of the heat flux causing DNB at a particular location in the core, as predicted by a DNB correlation, to the actual heat flux at the same location. Analytical assurance that DNB will not occur is provided by showing the calculated DNBR to be higher than the 95/95 limit DNBR for all conditions of normal operation, operational transients, and transient conditions of moderate frequency. The Design Limit DNBR is calculated by using the USNRC-approved RTDP methodology (Reference 1). Meeting the Design Limit assures compliance with the aforementioned DNB criteria. A SAL DNBR, which is higher than the Design Limit DNBR, is conservatively used in safety analyses to provide DNBR margin to offset the effect of rod bow, lower plenum flow anomalies, and plant instrumentation biases and to provide flexibility in the design and operation of the plant. The RCS lower plenum anomaly is applicable to the WCGS. The probable cause of the flow anomaly is an unsteady, vortex flow disturbance in the reactor vessel lower plenum. The vortex restricts flow into the core in the perturbed region and causes coolant temperature increases in the affected fuel assemblies. The higher coolant temperatures then depress the local neutron fluxes due to reactivity feedback. The flow disturbance in the reactor vessel lower plenum also increases the overall hydraulic resistance of the 2-397 WCAP-17658-NP September 2016 Licensing Report Revision 1-C reactor, and thus decreases the flow rate to all loops. The effect of the flow anomaly is a DNBR penalty, which is offset by available margin.

2.12.3 Description of Analys es and Evaluations For the methodology transition, a DNB re-analysis was required to define new core limits, axial offset limits, and Condition II and IV accident acceptability. The core limits, axial offset limits, and dropped rod limit lines are generated based on the SAL DNBR and a design F NH limit of 1.65. This F NH limit incorporates all applicable uncertainties, including a measurement uncertainty (Reference 6), and is adjusted for the power level using the following equation: )]1(3.01[*65.1 P F N H where P is the fraction of full power. Various DNB analyses that were performed in support of the methodology transition are described below; all analyses were performed at a conservatively high core power. The descriptions below supplement the write-up already provided in previous sections.

2.12.3.1 Core Thermal Limits The core thermal limits are required for the generation of the OTT and OPT trip setpoints. The core thermal limits define the loci of points of thermal power, primary system pressure, and coolant inlet temperature that satisfy the following criteria: The minimum DNBR is not less than the SAL DNBR. The hot channel exit quality is not greater than the upper limit of the quality range of the DNB correlation (adjusted for the analysis-specific quality uncertainty). Vessel T hot < T sat to ensure that the difference between T hot and T cold remains proportional to power. For the transition to Westinghouse methods and to support operation at a conservatively higher power, new core thermal limits were generated for the 17x17 RFA-2 fuel at the WCGS. The DNB-limited portion of the core thermal limits was generated with the VIPRE code using the WRB-2 DNB correlation and the RTDP methodology. 2.12.3.2 Axial Offset Limits The axial offset limits are used to reduce the core DNB limit lines to account for the effect of adverse axial power distributions that are more limiting for DNB than the axial power shap e used to generate the core thermal limits. For the transition to Westinghouse methods and to support operation at a conservatively higher power, new axial offset limits were generated for the 17x17 RFA-2 fuel at the WCGS. The axial offset limits were generated with the VIPRE code using the RTDP methodology. For the DNB analysis of axial power distributions that were limiting in the fuel region above the first mixing vane grid, the WRB-2 DNB correlation was used. For the DNB analysis of axial power distributions that 2-398 WCAP-17658-NP September 2016 Licensing Report Revision 1-C were limiting in the fuel region below the first mixing vane grid, the ABB-NV DNB correlation was used. The axial offset limits were used to define the f(I) reset function in the OTT reactor trip function such that the DNB design criterion is met for accidents terminated by the OTT reactor trip function. 2.12.3.3 Loss of Flow The DNB analysis of the loss-of-flow accident was performed using RTDP for three different cases, including partial loss of flow, complete loss of flow, and UF. Each case was checked to ensure that the limiting scenario was identified. The effect of fuel temperatures is included in the analysis of this event. The complete loss of flow case results in the lowest minimum DNBR. The minimum DNBRs calculated for each of the three cases are greater than the SAL, thereby demonstrating compliance with the DNB design criterion for this event. DNB analysis was also performed to confirm that the DNB criterion was met for low flow conditions supporting the P-8 setpoint. 2.12.3.4 Locked Rotor The locked rotor accident is classified as a Condition IV event. To calculate the radiation release as a consequence of the accident, calculations are performed using RTDP to quantify the inventory of rods that would experience DNB. Any rods in DNB are conservatively presumed to fail. For the WCGS, the locked rotor accident analysis indicates that the rods-in-DNB limit of 5 percent is met. The radiological consequences analysis conservatively assumes 5 percent of the fuel rods have failed and shows that the site dose limits are met. The Locked Rotor PCT analysis is performed using STDP and the VIPRE code. The acceptance criterion for this analysis is to demonstrate that the PCT is less than 2700°F. The PCT analysis for the WCGS satisfied this acceptance criterion, thus, confirming that the fuel melt limit for ZIRLO (2700°F) high performance fuel cladding materials is met. 2.12.3.5 RCCA Drop/Misoperation This section supplements the methodology discussion in Section 2.5.3, "Control Rod Misoperation." The USNRC-approved Westinghouse analysis methods in Reference 7 were used for analyzing the RCCA drop event. The dropped rod limit lines were generated to define the loci of points that would result in the RTDP SAL DNBR for a wide range of core conditions (inlet temperature, power, and pressure). Per the methodology described in Reference 8, these lines are used to verify that the DNB design basis is met each cycle. The maximum allowable F NH limit for RCCA misalignment was calculated using RTDP methodology.

This is the value of F NH at normal operating conditions that results in a minimum DNBR equal to the RTDP SAL DNBR. The limits provided for the RCCA drop and RCCA misalignment events were used to confirm that the DNB design basis was met for the methodology transition.

2-399 WCAP-17658-NP September 2016 Licensing Report Revision 1-C 2.12.3.6 Steam Line Break Accident The event descriptions for the HZP and HFP events ha ve been provided in Sect ions 2.2.5.1 and 2.2.5.2 respectively. SLB cases were analyzed at both HZP and HFP conditions. For each of these cases, the appropriate methodology was applied. For the HFP cases, the RTDP methodology and the WRB-2 correlation are used. The DNB analysis showed that the minimum DNBR values were above the SAL, thereby demonstrating that the DNBR design basis was met.

For the HZP cases, STDP and the WLOP DNB correlation were applied. The DNBR limit is the correlation limit increased by a small amount to account for any DNB penalties applicable at these conditions. The analysis showed that the minimum DNBR was greater than the DNBR limit, thereby demonstrating that the DNBR design basis was met. 2.12.3.7 Feedwater Malfunction The HZP FWM event is analyzed using the same method that is used for the HZP SLB analysis. For the methodology transition, Nuclear Design analyses indicated that the HZP FWM event was bounded by the HZP SLB event. The DNBR design basis was met for the HZP SLB event, thereby indicating that the DNBR design basis was met for the HZP FWM event at the WCGS.

2.12.3.8 Uncontrolled Rod Cluster Control Assembly Withdrawal from Subcritical Because the event is initiated from HZP conditions, the analysis for the uncontrolled RCCA withdrawal from subcritical accident is based on the STDP methodology. Results and additional information are contained in Section 2.5.1. This transient results in a power excursion and a bottom-skewed power shape due to the withdrawal of a rod bank. A conservative accident-specific power shape was applied. Two DNBR calculations are required for this accident. The ABB-NV correlation is applied for fuel assembly spans below the first mixing vane grid. The WRB-2 correlation is applied for spans above the first mixing vane grid. For the STDP application, the DNBR limits applied are the correlation limits for ABB-NV and WRB-2, increased by any applicable DNBR penalties. The results of the calculations showed that the calculated DNBR values remain above the respective DNBR limits, thereby demonstrating that the DNB design basis is met.

2-400 WCAP-17658-NP September 2016 Licensing Report Revision 1-C 2.12.3.9 Rod Withdrawal at Power A detailed DNB analysis of the rod withdrawal at power (RWAP) event was performed using the RTDP methodology. Statepoints for the limiting case described in Section 2.5.2, "Uncontrolled Rod Cluster Control Assembly Bank Withdrawal at Power," were analyzed using the VIPRE code. The DNB design basis was met with margin. Furthermore, in order to provide WCGS with adequate future flexibility in the design and operation of the plant relative to DNBR margin, the following credits were applied to the DNB analysis for this particular event: a reduced thimble bypass flow (since WCGS is currently operating with TPI), and an increased MMF of 376,000 gpm, since WCNOC decided to raise the MMF value by 5000 gpm. 2.12.3.10 Bypass Flow Two different bypass flow rates are used in the T/H design analysis. The thermal design bypass flow is the conservatively high core bypass flow used in conjunction with the TDF in power capability analyses that use standard (non-statistical) methods. The best estimate bypass flow is the core bypass flow that would be expected using nominal values for dimensions and operating parameters that affect bypass flow without applying uncertainty factors. The best estimate bypass flow is used in conjunction with the vessel MMF for power capability analyses using the RTDP design procedures. As discussed in Section 2.12.2.1.2, for RTDP, the bypass flow uncertainty is included in the statistical combination for the RTDP design limit DNBR. 2.12.3.11 Effects of Fuel Rod Bow on DNBR Rod bow can occur between mid-grids, reducing the spacing between adjacent fuel rods and reducing the margin to DNB. Rod bow must be accounted for in the DNB safety analysis of Condition I and Condition II events. Westinghouse has conducted tests to determine the impact of rod bow on DNB performance. The testing and subsequent analyses are documented in References 9 and 10. The rod bow penalties are included in the DNBR margin summary shown in Table 2.12-3. In the spans containing IFM grids in the 17x17 RFA-2 fuel, no rod bow penalty is necessary due to the short spacing between grids. The maximum rod bow penalty accounted for in the safety analysis is a function of assembly average burnup (References 9 and 10). Credit may also be taken for the effect of F NH burndown due to the decrease in fissionable isotopes and the buildup of fission products (Reference 11). 2.12.3.12 License Renewal Impact Evaluation A review of T/H design for impact on plant license renewal evaluations was not necessary because continued applicability of the safety analysis for the Westinghouse 17x17 RFA-2 fuel assemblies is re-evaluated during the RE process for each reload cycle. The reload design methodology includes evaluation of the reload core key safety parameters that comprise input to the safety evaluation for each reload cycle.

2-401 WCAP-17658-NP September 2016 Licensing Report Revision 1-C 2.12.4 Results Analyses described in the previous sections show that the DNB design basis is met for the methodology transition. The DNBR limits and margin summary are listed in Table 2.12-3. Cycle specific evaluation is to be performed in accordance with Reference 8.

2.12.5 Conclusion WCNOC has reviewed the analyses related to the effects of the proposed methodology transition on the T/H design of the core and the RCS. WCNOC concludes that the analyses demonstrated that the design (1) has been accomplished using acceptable analytical methods, (2) is equivalent to proven designs, (3) provides acceptable margins of safety from conditions that would lead to fuel damage during normal reactor operation and AOOs, and (4) is not susceptible to thermo-hydrodynamic instability. WCNOC further concludes that the analyses have adequately accounted for the effects of the proposed methodology transition on the hydraulic loads on the core and RCS components. Based on this, WCNOC concludes that the T/H design will continue to meet the requirements of GDCs 6 and 7 following implementation of the proposed methodology transition. Therefore, WCNOC finds the proposed methodology transition acceptable with respect to T/H design.

2.12.6 References

1. Westinghouse Report WCAP-11397-P-A, "Revised Thermal Design Procedure," April 1989.
2. Westinghouse Report WCAP-10444-P-A, "Reference Core Report - VANTAGE 5 Fuel Assembly," September 1985.
3. Westinghouse Report WCAP-14565-P-A, "VIPRE-01 Modeling and Qualification for Pressurized Water Reactor Non-LOCA Thermal-Hydraulic Safety Analysis," October 1999.
4. Westinghouse Report WCAP-14565-P-A Addendum 2-P-A, "Extended Application of ABB-NV Correlation and Modified ABB-NV Correlation WLOP for PWR Low Pressure Applications," April 2008.
5. Westinghouse Letter LTR-NRC-02-55, "Fuel Criterion Evaluation Process (FCEP) Notification of the RFA-2 Design, Revision 1," November 2002.
6. Westinghouse Report WCAP-7308-L-P-A, "Evaluation of Nuclear Hot Channel Factor Uncertainties," June 1988.
7. Westinghouse Report WCAP-11394-P-A, "Methodology for the Analysis of the Dropped Rod Event," January 1990.
8. Westinghouse Report WCAP-9272-P-A, "Westinghouse Reload Safety Evaluation Methodology," July 1985.
9. Westinghouse Report WCAP-8691-R1, "Fuel Rod Bow Evaluation," July 1979.

2-402 WCAP-17658-NP September 2016 Licensing Report Revision 1-C

10. Westinghouse Letter from Rahe, E. P., Jr. (Westinghouse) to Miller, J. R. (USNRC), "Partial Response to Request Number 1 for Additional Information on WCAP-8691, Revision 1," NS-EPR-2515, October 9, 1981; and Letter from Rahe, E. P., Jr. (Westinghouse) to Miller, J. R. (USNRC), "Remaining Response to Request Number 1 for Additional Information on WCAP-8691, Revision 1," NS-EPR-2572, March 16, 1982.
11. USNRC Letter from Berlinger, C. (USNRC) to Rahe, E. P., Jr. (Westinghouse), "Request for Reduction in Fuel Assembly Burnup Limit for Calculation of Maximum Rod Bow Penalty," USNRC Response to Westinghouse Letter NS-NRC-85-3901, June 18, 1986.

2-403 WCAP-17658-NP September 2016 Licensing Report Revision 1-C

12. Table 2.12-1 T/H Design Parameters Comparison T/H Design Parameters Current Design Value Methods Transition Analysis Value Reactor Core Heat Output, MWt 3565 3637 Reactor Core Heat Output, 10 6 BTU/hr 12,164 12,410 Heat Generated in Fuel, % 97.4 97.4 Core Exit Pressure, Nominal, psia 2270 2270 Pressurizer Pressure, Nominal, psia 2250 2250 Radial Power Distribution, F NH (1) 1.65[1+0.3(1-P)] 1.65[1+0.3(1-P)] HFP Nominal Coolant Conditions (uncertainties and biases not included)

Vessel TDF Rate (including bypass) 10 6 lbm/hr gpm 134.7 361,200 134.9 361,200 Core Flow Rate (excluding bypass)

(2) 10 6 lbm/hr gpm 123.4 330,859 123.6 330,859 Core Flow Area, ft 2 51.08 51.08 Core Inlet Mass Velocity, 106 lbm/hr-ft 2 2.416 2.419 Nominal Vessel/Core Inlet Temperature, °F 555.8 555.2 Vessel Average Temperature, °F 588.4 588.4 Core Average Temperature, °F 593.2 593.4 Vessel Outlet Temperature, °F 621.0 621.7 Core Outlet Temperature, °F 626.2 627.0 Average Temperature Rise in Vessel, °F 65.2 66.5 Average Temperature Rise in Core, °F 70.4 71.8 Heat Transfer Active Heat Transfer Surface Area, ft 2 59,742 59,742 Average Heat Flux, BTU/hr-ft 2 198,315 202,326 Average Linear Power, kW/ft 5.691 5.806 Peak Linear Power for Normal Operation, (3) kW/ft 14.23 14.52 2-404 WCAP-17658-NP September 2016 Licensing Report Revision 1-C Table 2.12-1 T/H Design Parameters Comparison (cont.) T/H Design Parameters Current Design Value Methods Transition Analysis Value Peak Linear Power for Prevention of Centerline Melt, kW/ft 22.4 22.4 Pressure Drop Across Core, psi (4) 28.7 28.7 Notes: 1. P = Power Thermal Rated Power Thermal 2. A design bypass flow of 8.4 percent was used. 3. Based on maximum F Q of 2.5. 4. The core pressure drop calculations are based on the same best estimate flows for 3565 MWt and 3637 MWt and full cores of 17x17 RFA-2 fuel.

2-405 WCAP-17658-NP September 2016 Licensing Report Revision 1-C Table 2.12-2 Limiting Parameter Direction for DNB Parameter Limiting Direction for DNB F NH, nuclear enthalpy rise hot-channel factor maximum Heat generated in fuel (%) maximum Reactor core heat output (MWt) maximum Heat flux (BTU/hr-ft

2) maximum Vessel/core inlet temperature (°F) maximum Core pressure (psia) minimum Pressurizer pressure (psia) minimum TDF for non-RTDP analyses (gpm) minimum MMF for RTDP analyses (gpm) minimum Bypass flow maximum 2-406 WCAP-17658-NP September 2016 Licensing Report Revision 1-C Table 2.12-3 RTDP DNBR Margin Summary Current Operation wi th 17x17 RFA-2 fuel(3565 MWt)

(1) DNB Correlation WRB-2 DNBR Correlation Limit 1.17 DNBR Design Limit(2) 1.24 Total DNBR Penalties (due to rod bow, instrumentation biases, lower plenum flow anomaly and RWAP) 14.9% Total DNBR Margin (3) > 14.9% Notes: 1. DNBR analyses for the methodology transition were performed at a bounding power level of 3637 MWt. 2. Design limit DNBR calculations are based on the measurement uncertainties and the sensitivity to changes in the parameters. 3. DNBR margin is the margin that exists between the SAL and the Design Limit DNBRs.

A-1 WCAP-17658-NP September 2016 Licensing Report Revision 1-C APPENDIX A SAFETY EVALUATION REPORT COMPLIANCE A.1 SAFETY EVALUATION REPORT COMPLIANCE INTRODUCTION This Appendix is a summary of USNRC-approved codes used in the LR. This appendix addresses compliance with the limitations, restrictions, and conditions specified in the approving safety evaluation

of the applicable codes. Table A.1-1 presents an overview of the SER by codes. For each SER, the applicable report subsections and Appendix A subsections are listed. Table A.1-1 Safety Evaluation Report Compliance Summary No. Subject Topical Report (Reference) Code(s) Limitation, Restriction, Condition Licensing Report Section Appendix A Section 1. Non-LOCA Thermal Transients WCAP-7908-A (Reference A.1-1) FACTRAN Yes 2.5.1 2.5.6 A.2 2. Non-LOCA Safety Analysis WCAP-14882-P-A (Reference A.1-2) RETRAN Yes 2.2.1 2.2.2 2.2.3 2.2.4 2.2.5.1 2.2.5.2 2.3.1 2.3.2 2.3.3 2.3.4 2.4.1 2.4.2 2.5.2 2.6.1 2.6.2 2.7.1 A.3 3. Non-LOCA Safety Analysis WCAP-7907-P-A (Reference A.1-3) LOFTRAN Yes 2.5.2 2.5.3 2.8 A.4 4. Non-LOCA Thermal / Hydraulics WCAP-11397-P-A Reference A.1-5 RTDP Yes 2.12 A.6 5. Neutron Kinetics WCAP-7979-P-A (Reference A.1-4) TWINKLE None for Non-LOCA Transient Analysis 2.5.1 2.5.6 Not Applicable

A-2 WCAP-17658-NP September 2016 Licensing Report Revision 1-C Table A.1-1 Safety Evaluation Report Compliance Summary (cont.) No. Subject Topical Report (Reference) Code(s) Limitation, Restriction, Condition Licensing Report Section Appendix A Section 6. Multi-dimensional Neutronics WCAP-10965-P-A (Reference A.1-6) ANC None for Non-LOCA Transient Analysis 2.2.2 2.2.4 2.2.5 2.5.3 Not Applicable 7. Non-LOCA Thermal /

Hydraulics WCAP-14565-P-A (Reference A.1-7) VIPRE Yes 2.2.2 2.2.4 2.2.5 2.4.1 2.4.2 2.5.1 2.5.2 2.5.3 2.12 A.5 8. Steam Generator Tube Rupture WCAP-10698-P-A (Reference A.1-8) WCAP-14882-P-A (Reference A.1-2) RETRAN None for Steam Generator Tube Rupture 2.7.2 2.7.3 Not Applicable A.3 A.1.1 References A.1-1 Westinghouse Report WCAP-7908-A, "FACTRAN - A FORTRAN IV Code for Thermal Transients in a UO 2 Fuel Rod," H. G. Hargrove, December 1989. A.1-2 Westinghouse Report WCAP-14882-P-A, "RETRAN-02 Modeling and Qualification for Westinghouse Pressurized Water Reactor Non-LOCA Safety Analyses," D. S. Huegel, et al., April 1999. A.1-3 Westinghouse Report WCAP-7907-P-A, "LOFTRAN Code Description," T. W. T. Burnett, et al., April 1984. A.1-4 Westinghouse Report WCAP-7979-P-A, "TWINKLE - A Multi-Dimensional Neutron Kinetics Computer Code," D. H. Risher, Jr. and R. F. Barry, January 1975. A.1-5 Westinghouse Report WCAP-11397-P-A, "Revised Thermal Design Procedure," A. J. Friedland and S. Ray, April 1989. A.1-6 Westinghouse Report WCAP-10965-P-A, "ANC: A Westinghouse Advanced Nodal Computer Code," Y. S. Liu, et al., September 1986.

A-3 WCAP-17658-NP September 2016 Licensing Report Revision 1-C A.1-7 Westinghouse Report WCAP-14565-P-A, "VIPRE-01 Modeling and Qualification for Pressurized Water Reactor Non-LOCA Thermal-Hydraulic Safety Analysis," Y. X. Sung, et al., October 1999. A.1-8 Westinghouse Report WCAP-10698-P-A, "SGTR Analysis Methodology to Determine the Margin to Steam Generator Overfill," R. N. Lewis, et al., August 1987.

A-4 WCAP-17658-NP September 2016 Licensing Report Revision 1-C A.2 FACTRAN FOR NON-LOCA THERMAL TRANSIENTS Table A.2-1 FACTRAN for Non-LOCA Thermal Transients Limitations, Restrictions, and Conditions 1. "The fuel volume-averaged temperature or surface temperature can be chosen at a desired value which includes conservatisms reviewed and approved by the USNRC."

Justification The FACTRAN code was used in the analyses of the following two transients for the WCGS: Uncontrolled RCCA Withdrawal from a Subcritical Condition (USAR Section 15.4.1) and RCCA Ejection (USAR Section 15.4.8). Initial fuel temperatures used as FACTRAN input in the RCCA Ejection analysis were calculated using the USNRC-approved PAD 4.0 computer code as described in WCAP-15063-P-A Revision 1 (Reference A.2-1). As indicated in WCAP-15063-P-A Revision 1, the USNRC has approved the method of determining uncertainties for PAD 4.0 fuel temperatures. 2. "Table 2 presents the guidelines used to select initial temperatures."

Justification In summary, Table 2 of the SER specifies that the initial fuel temperatures assumed in the FACTRAN analyses of the following transients should be "High" and include uncertainties: Loss of Flow, Locked Rotor, and Rod Ejection. As discussed above, fuel temperatures were used as input to the FACTRAN code in the RCCA Ejection analysis for the WCGS. The assumed fuel temperatures, which were calculated using the PAD 4.0 computer code (Reference A.2-1), include uncertainties and are conservatively high.

FACTRAN was not used in the Loss of Flow and Locked Rotor analyses. 3. "The gap heat transfer coefficient may be held at the initial constant value or can be varied as a function of time as specified in the input."

Justification The gap heat transfer coefficients applied in the FACTRAN analyses are consistent with SER Table 2. For the RCCA Withdrawal from a Subcritical Condition transient, the gap heat transfer coefficient is kept at a conservative constant value throughout the transient; a high constant value is assumed to maximize the peak heat flux (for DNB concerns) and a low constant value is assumed to maximize fuel temperatures. For the RCCA Ejection transient, the initial gap heat transfer coefficient is based on the predicted initial fuel surface temperature, and is ramped rapidly to a very high value at the beginning of the transient to simulate clad collapse onto the fuel pellet. 4. "-the Bishop-Sandberg-Tong correlation is sufficiently conservative and can be used in the FACTRAN code. It should be cautioned that since these correlations are applicable for local conditions only, it is necessary to use input to the FACTRAN code which reflects the local conditions. If the input values reflecting average conditions are used, there must be sufficient conservatism in the input values to make the overall method conservative."

Justification Local conditions related to temperature, heat flux, peaking factors and channel information were input to FACTRAN for each of the two transients analyzed for the WCGS: RCCA Withdrawal from a Subcritical Condition (USAR Section 15.4.1) and RCCA Ejection (USAR Section 15.4.8). Therefore, additional justification is not required.

A-5 WCAP-17658-NP September 2016 Licensing Report Revision 1-C Table A.2-1 FACTRAN for Non-LOCA Thermal Transients (cont.) Limitations, Restrictions, and Conditions 5. "The fuel rod is divided into a number of concentric rings. The maximum number of rings used to represent the fuel is 10. Based on our audit calculations we require that the minimum of 6 should be used in the analyses." Justification At least 6 concentric rings were assumed in FACTRAN for each of the two transients analyzed for the WCGS: RCCA Withdrawal from a Subcritical Condition (USAR Section 15.4.1) and RCCA Ejection (USAR Section 15.4.8). Therefore, additional justification is not required.

6. "Although time-independent mechanical behavior (e.g., thermal expansion, elastic deformation) of the cladding are considered in FACTRAN, time-dependent mechanical behavior (e.g., plastic deformation) is not considered in the code. -for those events in which the FACTRAN code is applied (see Table 1), significant time-dependent deformation of the cladding is not expected to occur due to the short duration of these events or low cladding temperatures involved (where DNBR Limits apply), or the gap heat transfer coefficient is adjusted to a high value to simulate clad collapse onto the fuel pellet." Justification The two transients that were analyzed with FACTRAN for the WCGS (RCCA Withdrawal from a Subcritical Condition (USAR Section 15.4.1) and RCCA Ejection (USAR Section 15.4.8)) are included in the list of transients provided in Table 1 of the SER; each of these transients is of short duration. For the RCCA Withdrawal from a Subcritical Condition transient, relatively low cladding temperatures are involved, and the gap heat transfer coefficient is kept constant throughout the transient. For the RCCA Ejection transient, a high gap heat transfer coefficient is applied to simulate clad collapse onto the fuel pellet. The gap heat transfer coefficients applied in the FACTRAN analyses are consistent with SER Table 2. 7. "The one group diffusion theory model in the FACTRAN code slightly overestimates at beginning of life (BOL) and underestimates at end of life (EOL) the magnitude of flux depression in the fuel when compared to the LASER code predictions for the same fuel enrichment. The LASER code uses transport theory. There is a difference of about 3 percent in the flux depression calculated using these two codes. When [T(centerline) - T(Surface)] is on the order of 3000°F, which can occur at the hot spot, the difference between the two codes will give an error of 100°F. When the fuel surface temperature is fixed, this will result in a 100°F lower prediction of the centerline temperature in FACTRAN. We have indicated this apparent nonconservatism to Westinghouse. In the letter NS-TMA-2026, dated January 12, 1979, Westinghouse proposed to incorporate the LASER-calculated power distribution shapes in FACTRAN to eliminate this non-conservatism. We find the use of the LASER-calculated power distribution in the FACTRAN code acceptable." Justification The condition of concern (T(centerline) - T(surface) on the order of 3,000°F) is expected for transients that reach, or come close to, the fuel melt temperature. As this applies only to the RCCA ejection transient, the LASER-calculated power distributions were used in the FACTRAN analysis of the RCCA ejection transient for the WCGS.

A-6 WCAP-17658-NP September 2016 Licensing Report Revision 1-C A.2.1 Reference A.2-1 Westinghouse Reports WCAP-15063-P-A (Proprietary) and WCAP-15064-NP-A (Non-Proprietary), Revision 1 (with Errata) "Westinghouse Improved Performance Analysis and Design Model (PAD 4.0)," July 2000.

A-7 WCAP-17658-NP September 2016 Licensing Report Revision 1-C A.3 RETRAN FOR NON-LOCA SAFETY ANALYSIS Table A.3-1 RETRAN for Non-LOCA Safety Analysis Limitations, Restrictions, and Conditions 1. "The transients and accidents that Westinghouse proposes to analyze with RETRAN are listed in this SER (Table 1) and the NRC staff review of RETRAN usage by Westinghouse was limited to this set. Use of the code for other analytical purposes will require additional justification." Justification The transients listed in Table 1 of the SER are: Feedwater system malfunctions Excessive increase in steam flow Inadvertent opening of a steam generator relief or safety valve Steam line break Loss of external load/turbine trip Loss of offsite power Loss of normal feedwater flow Feedwater line rupture Loss of forced reactor coolant flow Locked reactor coolant pump rotor/sheared shaft Control rod cluster withdrawal at power Dropped control rod cluster/dropped control bank Inadvertent increase in coolant inventory Inadvertent opening of a pressurizer relief or safety valve Steam generator tube rupture The transients explicitly analyzed for the WCGS using RETRAN are: Feedwater system malfunctions (USAR Sections 15.1.1 and 15.1.2), Excessive increase in secondary steam flow (USAR Section 15.1.3), Inadvertent opening of a steam generator atmospheric relief or safety valve (USAR Section 15.1.4), Steam system piping failure (steam line break) (USAR Section 15.1.5), Loss of external electrical load/turbine trip (USAR Sections 15.2.2, 15.2.3, 15.2.4, and 15.2.5), Loss of non-emergency alternating current (AC) power to the station auxiliaries (loss of offsite power) (USAR Section 15.2.6), Loss of normal feedwater flow (USAR Section 15.2.7), Feedwater system pipe break (feedwater line rupture) (USAR Section 15.2.8), Loss of forced reactor coolant flow (USAR Sections 15.3.1 and 15.3.2), Locked reactor coolant pump rotor/shaft break (USAR Sections 15.3.3 and 15.3.4), Uncontrolled RCCA bank withdrawal at power (USAR Section 15.4.2), Inadvertent operation of the ECCS (increase in coolant inventory) (USAR Section 15.5.1), CVCS malfunction that increases reactor coolant inventory (USA R Section 15.5.2), Inadvertent opening of a pressurizer safety or relief valve (USAR Section 15.6.1), Steam generator tube rupture (USAR Section 15.6.3).

As each transient analyzed for the WCGS using RETRAN matches one of the transients listed in Table 1 of the SER, additional justification is not required.

A-8 WCAP-17658-NP September 2016 Licensing Report Revision 1-C Table A.3-1 RETRAN for Non-LOCA Safety Analysis (cont.) Limitations, Restrictions, and Conditions 2. "WCAP-14882 describes modeling of Westinghouse designed 4-, 3, and 2-loop plants of the type that are currently operating. Use of the code to analyze other designs, including the Westinghouse AP600, will require additional justification."

Justification The WCGS consists of one 4-loop Westinghouse-designed unit that was "currently operating" at the time the SER was written (February 11, 1999). Therefore, additional justification is not required. 3. "Conservative safety analyses using RETRAN are dependent on the selection of conservative input. Acceptable methodology for developing plant-specific input is discussed in WCAP-14882 and in Reference 14 [WCAP-9272-P-A]. Licensing applications using RETRAN should include the source of and justification for the input data used in the analysis."

Justification The input data used in the RETRAN analyses performed by Westinghouse came from both WCNOC and Westinghouse sources. Assurance that the RETRAN input data is conservative for the WCGS is provided via Westinghouse's use of transient-specific analysis guidance documents. Each analysis guidance document provides a description of the subject transient, a discussion of the plant protection systems that are expected to function, a list of the applicable event acceptance criteria, a list of the analysis input assumptions, e.g., directions of conservatism for initial condition values, a detailed description of the transient model development method, and a discussion of the expected transient analysis results. Based on the analysis guidance documents, conservative plant-specific input values were requested and collected from the responsible WCNOC and Westinghouse sources. Consistent with the Westinghouse Reload Evaluation Methodology described in WCAP-9272 (Reference A.3-1), the safety analysis input values used in the WCGS analyses were selected to conservatively bound the values expected in subsequent operating cycles.

A.3.1 Reference A.3-1 Westinghouse Reports WCAP-9272-P-A (Proprietary) and WCAP-9273-NP-A (Non-Proprietary), "Westinghouse Reload Safety Evaluation Methodology," July 1985.

A-9 WCAP-17658-NP September 2016 Licensing Report Revision 1-C A.4 LOFTRAN FOR NON-LOCA SAFETY ANALYSIS Table A.4-1 LOFTRAN for Non-LOCA Safety Analysis Limitations, Restrictions, and Conditions 1. "LOFTRAN is used to simulate plant response to many of the postulated events reported in Chapter 15 of PSARs and FSARs, to simulate anticipated transients without scram, for equipment sizing studies, and to define mass/energy releases for containment pressure analysis. The Chapter 15 events analyzed with LOFTRAN are: Feedwater System Malfunction Excessive Increase in Steam Flow Inadvertent Opening of a Steam Generator Relief or Safety Valve Steamline Break Loss of External Load Loss of Offsite Power Loss of Normal Feedwater Feedwater Line Rupture Loss of Forced Reactor Coolant Flow Locked Pump Rotor Rod Withdrawal at Power Rod Drop Startup of an Inactive Pump Inadvertent ECCS Actuation Inadvertent Opening of a Pressurizer Relief or Safety Valve This review is limited to the use of LOFTRAN for the licensee safety analyses of the Chapter 15 events listed above, and for a steam generator tube rupture-"

Justification For the WCGS, the LOFTRAN code was used in the analysis of the uncontrolled RCCA bank withdrawal at power transient (USAR Section 15.4.2), in the analysis of the dropped rod transient (USAR Section 15.4.3), and in the analysis of the anticipated transients without scram (USAR Section 15.8). As each of these transients match one of the transients listed in the SER, additional justification is not required.

A-10 WCAP-17658-NP September 2016 Licensing Report Revision 1-C A.5 VIPRE FOR NON-LOCA THERMAL/HYDRAULICS Table A.5-1 VIPRE for Non-LOCA Thermal/Hydraulics Limitations, Restrictions, and Conditions 1. "Selection of the appropriate CHF correlation, DNBR limit, engineered hot channel factors for enthalpy rise and other fuel-dependent parameters for a specific plant application should be justified with each submittal."

Justification The WRB-2 correlation with a 95/95 correlation limit of 1.17 was used in the DNB analyses for the WCGS 17x17 RFA-2 fuel. The use of the WRB-2 DNB correlation was approved in WCAP-10444-P-A (Reference A.5-2). Applicability of the WRB-2 to 17x17 RFA-2 fuel was established through the Fuel Criterion Evaluation Process (FCEP) in LTR-NRC-02-55 (Reference A.5-3). For conditions where WRB-2 is not applicable, analyses were performed using approved secondary CHF correlations (such as ABB-NV and WLOP) in compliance with the SER conditions licensed for use in the VIPRE code.

(WCAP-14565-P-A and its Addendum 2-P-A, Reference A.5-4). The use of the plant specific hot channel factors and other fuel dependent parameters in the DNB analysis for the WCGS 17x17 RFA-2 fuel were justified using the same methodologies as for previously approved safety evaluations of other Westinghouse four-loop plants using the same fuel design. 2. "Reactor core boundary conditions determined using other computer codes are generally input into VIPRE for reactor transient analyses. These inputs include core inlet coolant flow and enthalpy, core average power, power shape and nuclear peaking factors. These inputs should be justified as conservative for each use of VIPRE."

Justification The core boundary conditions for the VIPRE calculations for the 17x17 RFA-2 fuel are all generated from USNRC-approved codes and analysis methodologies. Conservative reactor core boundary cond itions were justified for use as input to VIPRE. Continued applicability of the input assumptions is verified on a cycle-by-cycle basis using the Westinghouse reload methodology described in WCAP-9272-P-A (Reference A.5-1). 3. "The NRC Staff's generic SER for VIPRE set requirements for use of new CHF correlations with VIPRE. Westinghouse has met these requirements for using WRB-1, WRB-2 and WRB-2M correlations. The DNBR limit for WRB-1 and WRB-2 is 1.17. The WRB-2M correlation has a DNBR limit of 1.14. Use of other CHF correlations not currently included in VIPRE will require additional justification."

Justification As discussed in response to Condition 1, the WRB-2 correlation with a limit of 1.17 was used as the primary correlation in the DNB analyses of 17x17 RFA-2 fuel for WCGS. For conditions where the WRB-2 is not applicable, analyses were performed using approved secondary CHF correlations licensed for the VIPRE code in Reference A.5-4.

A-11 WCAP-17658-NP September 2016 Licensing Report Revision 1-C Table A.5-1 VIPRE for Non-LOCA Thermal/Hydraulics (cont.) Limitations, Restrictions, and Conditions 4. "Westinghouse proposes to use the VIPRE code to evaluate fuel performance following postulated design-basis accidents, including beyond-CHF heat transfer conditions. These evaluations are necessary to evaluate the extent of core damage and to ensure that the core maintains a coolable geometry in the evaluation of certain accident scenarios. The NRC Staff's generic review of VIPRE did not extend to post CHF calculations. VIPRE does not model the time-dependent physical changes that may occur within the fuel rods at elevated temperatures. Westinghouse proposes to use conservative input in order to account for these effects. The NRC Staff requires that appropriate justification be submitted with each usage of VIPRE in the post-CHF region to ensure that conservative results are obtained."

Justification For application to Wolf Creek safety analysis, the use of VIPRE in the post-critical heat flux region is limited to the PCT calculation for the locked rotor transient. The calculation demonstrated that the PCT in the reactor core is well below the allowable limit to prevent clad embrittlement. VIPRE modeling of the fuel rod is consistent with the model described in WCAP-14565-P-A (Reference A.5-4) and included the following conservative assumptions: DNB was assumed to occur at the beginning of the transient, Film boiling was calculated using the Bishop-Sandberg-Tong correlation, The Baker-Just correlation accounted for heat generation in fuel cladding due to zirconium-water

reaction. Conservative results were further ensured with the following input: Fuel rod input based on the maximum fuel temperature at the given power, The hot spot power factor was equal to or greater than the design linear heat rate, Uncertainties were applied to the initial operating conditions in the limiting direction.

A.5.1 References A.5-1 Westinghouse Report WCAP-9272-P-A, "Westinghouse Reload Safety Evaluation Methodology," S. L. Davidson (Ed.), July 1985. A.5-2 Westinghouse Report WCAP-10444-P-A, "Reference Core Report - VANTAGE 5 Fuel Assembly," S. L. Davidson (Editor), September 1985. A.5-3 Westinghouse Letter LTR-NRC-02-55, "Fuel Criterion Evaluation Process (FCEP) Notification of the RFA-2 Design, Revision 1," November 2002. A.5-4 Westinghouse Report WCAP-14565-P-A Addendum 2-P-A, "Extended Application of ABB-NV Correlation and Modified ABB-NV Correlation WLOP for PWR Low Pressure Applications," A. Leidich, et al., April 2008.

A-12 WCAP-17658-NP September 2016 Licensing Report Revision 1-C A.6 REVISED THERMAL DESIGN PROCEDURE FOR NON-LOCA THERMAL HYDRAULICS Table A.6-1 Revised Thermal Design Procedure for Non-LOCA Thermal Hydraulics Limitations, Restrictions, and Conditions 1. "Sensitivity factors for a particular plant and their ranges of applicability should be included in the Safety Analysis Report or reload submittal. Justification Sensitivity factors were evaluated using the WRB-2 and ABB-NV correlations and the VIPRE code for parameter values applicable to the 17x17 RFA-2 fuel at conditions corresponding to a conservatively higher nominal core power of 3637 MWt. These sensitivity factors were used to determine the RTDP design limit DNBR values which are to be included in the WCGS USAR.

2. "Any changes in DNB correlation, THINC-IV correlations, or parameter values listed in Table 3-1 of WCAP-11397 outside of previously demonstrated acceptable ranges require re-evaluation of the sensitivity factors and of the use of Equation (2-3) of the topical report." Justification Because the VIPRE code was used to replace the THINC-IV code, sensitivity factors were evaluated for using the VIPRE code. VIPRE has been demonstrated to be equivalent to the THINC-IV code in WCAP-14565-P-A (Reference A.6-1). See the response to condition 3 for a discussion of the use of Equation (2-3) of the topical report. Evaluations using both WRB-2 and ABB-NV correlations were done in compliance with the methodology described in WCAP-11397-P-A (Reference A.6-2).
3. "If the sensitivity factors are changed as a result of correlation changes or changes in the application or use of the THINC code, then the use of an uncertainty allowance for application of Equation (2-3) must be re-evaluated and the linearity assumption made to obtain Equation (2-17) of the topical report must be validated. Justification Equation (2-3) of WCAP-11397-P-A (Reference A.6-2) and the linearity approximation made to obtain Equation (2-17) were confirmed to be valid for the WCGS using the combination of the VIPRE code and the WRB-2 and ABB-NV correlations, at conditions corresponding to a conservatively higher nominal core power of 3637 MWt.
4. "Variances and distributions for input parameters must be justified on a plant-by-plant basis until generic approval is obtained." Justification The plant specific variances and distributions were justified for use at conditions corresponding to a conservatively higher nominal core power of 3637 MWt and are presented in Section 2.12 of the LR.
5. "Nominal initial condition assumptions apply only to DNBR analyses using RTDP. Other analyses, such as overpressure calculations, require the appropriate conservative initial condition assumptions." Justification Nominal conditions were only applied to the DNBR analyses which used RTDP.

A-13 WCAP-17658-NP September 2016 Licensing Report Revision 1-C Table A.6-1 Revised Thermal Design Procedure for Non-LOCA Thermal Hydraulics (cont.) Limitations, Restrictions, and Conditions 6. "Nominal conditions chosen for use in analyses should bound all permitted methods of plant operation. Justification Bounding nominal conditions corresponding to a conservatively higher nominal core power of 3637 MWt were used in the DNBR analyses using RTDP, consistent with the current methods of plant operation at WCGS. 7. "The code uncertainties specified in Table 3-1 (of WCAP-11397-P) (+/- 4 percent for THINC-IV and +/- 1 percent for transients) must be included in the DNBR analyses using RTDP." Justification The code uncertainties specified in Table 3-1 of WCAP-11397-P-A (Reference A.6-2) remained unchanged and were included in the DNBR analyses using RTDP. The THINC-IV uncertainty was applied to VIPRE, based on the equivalence of the VIPRE model approved in WCAP-14565-P-A to THINC-IV.

A.6.1 References A.6-1 Westinghouse Report WCAP-14565-P-A, "VIPRE-01 Modeling and Qualification for Pressurized Water Reactor Non-LOCA Thermal-Hydraulic Safety Analysis," Y. X. Sung, et al., October 1999. A.6-2 Westinghouse Report WCAP-11397-P-A, "Revised Thermal Design Procedure," Friedland, A. J. and Ray, S., April 1999.

Retrieved from "https://kanterella.com/w/index.php?title=ML17054C224&oldid=1518225"