ML18024A337

Updated Final Safety Analysis Report (Ufsar), Amendment 27, 14.5 Analyses of Abnormal Operational Transients

ML18024A337
Person / Time
Site:	Browns Ferry
Issue date:	10/05/2017
From:	Tennessee Valley Authority
To:	Office of Nuclear Reactor Regulation
Shared Package
ML18018A778	List: ML18018A780 ML18018A781 ML18018A783 ML18018A784 ML18018A785 ML18018A787 ML18018A788 ML18018A790 ML18018A792 ML18018A793 ML18018A795 ML18018A796 ML18018A797 ML18018A798 ML18018A800 ML18018A801 ML18018A802 ML18018A804 ML18018A806 ML18018A807 ML18022A114 ML18022A115 ML18022A116 ML18022A117 ML18022A118 ML18022A119 ML18022A120 ML18022A121 ML18022A123 ML18022A124 ML18022A125 ML18022A127 ML18022A128 ML18022A129 ML18022A130 ML18022A131 ML18022A132 ML18022A133 ML18022A148 ML18022A155 ML18022A156 ML18022A157 ML18022A158 ML18022A159 ML18022A161 ML18022A162 ML18022A163 ML18022A164 ML18022A165 ML18022A166 ... further results
References
Download: ML18024A337 (45)

Text

BFN-27 14.5 ANALYSES OF ABNORMAL OPERATIONAL TRANSIENTS - UPRATED 14.5.1 Objective This section contains general descriptions of abnormal operational transients analyzed for BFN Units 1, 2, and 3 at uprated conditions. The similar results at pre-uprated conditions can be found in Section 14.10.

The results of these analyses may change with subsequent core reloads. The bounding transients are re-analyzed for each fuel reload and subsequent operating cycle to determine which is most limiting. Events for which a newer fuel reload specific analysis need to be performed are noted. These results can be found in the appropriate reload licensing document.

BFN Units 1, 2, and 3 have a similar system geometry, reactor protection system (RPS) configuration and mitigation functions (as described in earlier sections of the UFSAR). Additionally, BFN Units 1, 2, and 3 have similar thermal-hydraulic and transient behavior characteristics. Therefore, trends are expected to be the same for all units. Consequently, the transient analyses described in this chapter were performed for BFN Unit 3 and used as the representative unit to quantify trends for the other unit.

The analyses are based on the core loading characteristics of BFN 24-month fuel equilibrium cycle with GE13 fuel. This is considered to be representative of future cycles, because specific fuel operating limits will continue to be calculated for each fuel cycle according to current reload practice. For the non-limiting transient events not re-analyzed on a reload specific basis, the 24-month cycle exposure assumption is also applicable to shorter fuel cycle length, since the fuel exposure variation has a negligible impact on the transient results and will not cause the severity trend to change significantly.

14.5.1.1 Transient Events Classification The transient analyses that have been analyzed in this document are classified into seven categories of events. These seven categories and the transient events which they include are:

A) Events Resulting in a Nuclear System Pressure Increase:

1. Generator Load Reject

2. Loss of Condenser Vacuum

3. Turbine Trip

4. Turbine Bypass Valve Malfunction

5. Main Steam Isolation Valve Closure

6. Pressure Regulator Downscale Failure 14.5-1

BFN-27 B) Events Resulting in a Reactor Vessel Water Temperature Decrease:

1. Loss of a Feedwater Heater

2. Shutdown Cooling (Residual Heat Removal System)

Malfunction-Decreasing Temperature

3. Inadvertent Pump Start C) Events Resulting in a Positive Reactivity Insertion:

1. Continuous Control Rod Withdrawal During Power Range Operation

2. Continuous Rod Withdrawal During Reactor Startup

3. Control Rod Removal Error During Refueling

4. Fuel Assembly Insertion Error During Refueling D) Events Resulting in a Reactor Vessel Coolant Inventory Decrease:

1. Pressure Regulator Failure Open

2. Inadvertent Opening of a Main Steam Relief Valve

3. Loss of Feedwater Flow

4. Loss of Auxiliary Power E) Events Resulting in a Core Coolant Flow Decrease:

1. Recirculation Flow Control Failure - Decreasing Flow

2. Trip of One Recirculation Pump

3. Trip of Two Recirculation Pumps

4. Recirculation Pump Seizure F) Events Resulting in a Core Coolant Flow Increase:

1. Recirculation Flow Controller Failure - Increasing Flow

2. Startup of Idle Recirculation Pump G) Events Resulting in Excess of Coolant Inventory:

1. Feedwater Control Failure - Maximum demand 14.5.1.2 Transient Events Conditions for UFSAR Analysis GE Analysis Computer Codes NRC-approved computer models have been used for the analysis of each event, consistent with the analyses guidelines established in "Generic Evaluation of General Electric Boiling Water Reactor Power Uprate Licensing Topical Report",

NEDC-31984P, July 1991. The computer codes used in the different transient events analyses are summarized as follows:

14.5-2

BFN-27 GE Computer Code Transient Event Description Used for Analysis Generator Trip (TCV Fast Closure) With Bypass Valves 1-D ODYN Model Failure Load Rejection No Bypass/EOC-RPT-OOS 1-D ODYN Model Loss of Condenser Vacuum 1-D ODYN Model Turbine Stop Valve Closure/Turbine Trip 1-D ODYN Model Bypass Valves Failure Following Turbine Trip, High Power 1-D ODYN Model Bypass Valves Failure Following Turbine Trip, Low Power 1-D ODYN Model Closure of All Main Steam Line Isolation Valves 1-D ODYN Model Closure of One Main Steam Line Isolation Valve 1-D ODYN Model Loss of a Feedwater Heater REDY Point Model

/PANACEA Inadvertent Pump Start REDY Point Model Continuous Rod Withdrawal During Power Range PANACEA Operation Continuous Rod Removal Error During Refueling PANACEA Fuel Assembly Insertion Error During Refueling None Pressure Regulator Failure Open REDY Point Model Inadvertent Opening of a Main Steam Relief Valve REDY Point Model Loss of Feedwater Flow - short term REDY Point Model Loss of Feedwater Flow - long term SAFER Model Loss of Auxiliary Power Transformers REDY Point Model Loss of Auxiliary All Grid Connections 1-D ODYN Model Recirculation Flow Control Failure-Decreasing Flow REDY Point Model Trip of One Recirculation Pump REDY Point Model Trip of Two Recirculation Pumps VFD:

1-D ODYN Model Recirculation Pump Seizure REDY Point Model Recirculation Flow Control Failure-Increasing Flow VFD:

1-D ODYN Model Startup of Idle Recirculation Loop VFD:

1-D ODYN Model Feedwater Control Failure- Maximum Demand 1-D ODYN Model Feedwater Control Failure- Maximum 1-D ODYN Model Demand/EOC-RPT-OOS Feedwater Control Failure- Maximum Demand/TBP-OOS 1-D ODYN Model The overpressurization transients and other events such as the Loss of Offsite Power due to loss of all connection grids and the Feedwater Controller Failure -

Maximum Demand have been analyzed using the one-dimensional kinetic thermal-hydraulic ODYN computer code. The ISCOR code models the core thermal-hydraulics, and TASC models the single hot channel with the boundary conditions 14.5-3

BFN-27 provided by ODYN and ISCOR. The TACLE driver runs simultaneously ODYN, ISCOR, and TASC.

Reactivity insertion transients, such as the Rod Withdrawal Error (RWE) transient, are analyzed with the 3-D core simulator PANACEA in order to eliminate over-conservatisms associated with the REDY point-kinetics model and to provide a more realistic simulation of this quasi steady-state transient. The Loss of Feedwater Heater (LFWH) transient is analyzed with PANACEA as well as with REDY assuming that the initial and final reactor condition are steady-state.

The limiting loss of inventory transient, Loss of Feedwater Flow, is run with the SAFER code for the analysis of the long-term inventory.

The following transients have been reanalyzed for Recirculation Pump VFDs using the one-dimensional kinetic thermal hydraulic ODYN computer code: Trip of Two Recirculation Pumps, Recirculation Flow Control Failure - Increasing Flow, and Startup of Idle Recirculation Loop.

All other transients described in this document have been analyzed using the point model kinetic thermal-hydraulic REDY computer code. ISCOR and TASC are run together by the DCPRF driver with the boundary conditions provided by REDY.

The events have been analyzed at the selected power/flow state points as shown in Table 14.5-1. These are the most limiting rated power/flow state points.

The ODYN and PANACEA computer models assume 3458 MWt as the initial core thermal power, except where noted. The Loss of Condenser Vacuum, Turbine Stop Valve Closure/Turbine Trip, Closure of all and one main steam line isolation valve(s)

(MSIV), and the Loss of all Auxiliary Power Grids transients are analyzed with the ODYN code at 3527 MWt or 102 percent of rated power because of the lack of specific statistical adders for power uncertainty. The REDY point model assumes 3527 MWt for its initial conditions. This 2 percent power increase is conservatively set because, unlike ODYN (except in the cases above described) and PANACEA, the REDY evaluation does not introduce a statistical adder for power uncertainty. All of the reload analysis events which are limiting from the viewpoint of fuel thermal margin do include the statistical consideration for power level (and other uncertainties as described in GESTAR, NEDE-24011-P.A.)

AREVA Analysis Computer Codes For AREVA reload licensing analyses, the 3-D core simulator code MICROBURN-B2 is used for quasi steady-state analyses such as the RWE and LFWH. For the slow recirculation flow run-up event for setting MCPRf limits, the XCOBRA steady-state core thermal hydraulics code is used. For fast transient (e.g.,

overpressurization) events, the one-dimensional kinetic thermal-hydraulic COTRANSA2 code is used for the reactor system analysis, with the XCOBRA/XCOBRA-T codes evaluating the initial and transient hot channel 14.5-4

BFN-27 hydraulics and delta-CPR. All of these analyses are performed at the nominal reactor power conditions; the application methodology provides conservatism by accounting for uncertainties in the computed results.

Reload Analysis Scope:

The bounding transients are re-analyzed for each fuel reload and subsequent operating cycle to determine which is most limiting. The results of these specific analyses may change with subsequent core reloads. These results can be found in the appropriate reload licensing document. Events for which a cycle-specific reload analysis are performed are the following:

a. Generator Load Reject (TCV Fast Closure) with Turbine Bypass Valve Failure (LRNBP)

b. Turbine Bypass Valve Failure Following Turbine Trip, High Power (TTNBP)

c. Feedwater Controller Failure Maximum Demand (FWCF)

d. LFWH or Inadvertent Pump Start

e. Continuous Rod Withdrawal During Power Range Operation (RWE)

f. Pump Seizure during Single Loop Operation If the thermal limits that result from any of the above events are clearly bounded by another event then that event is not analyzed.

14.5.1.3 Reactor Operating Domain The power/flow map at the uprated condition is shown in FSAR Chapter 3. It includes operation in the Maximum Extended Load Line Limit (MELLL) domain, which allows plant operation with core flow as low as 81 percent of rated at 3458 MWt. This boundary maintains the same maximum control rod load line as pre-uprate operation (i.e., 75 percent core flow at the pre-uprate 3293 MWt condition) and is consistent with the generic guidelines provided in "General Guidelines for General Electric Boiling Water Reactor Power Uprate,"

NEDC-31897P-1, June 1991. The Increased Core Flow (ICF) domain is bounded by the constant recirculation pump speed line corresponding to 105 percent core flow at 100 percent rated power.

14.5.1.4 Reactor Heat Balance The reactor heat balance defines the thermal-hydraulic parameter input and output within the vessel boundary at a selected core thermal power. These thermal-hydraulic parameters also initialize the conditions assumed for the plant safety analysis. The heat balance at 3458 MWt is shown in FSAR Chapter 1.

A computer program (ISCOR for GE analyses) is utilized to obtain heat balance parameters for operation at 100 and 102 percent power level (for events which 14.5-5

BFN-27 require a 2 percent power uncertainty) and other power/flow points considered for transient analyses on the operating domain power/flow map.

14.5.1.5 Reactor Operating Flexibility Features As previously stated, the BFN operating features include:

1) MELLL and average power range monitor (APRM)/rod block monitor (RBM) Technical Specification (ARTS) Improvements Program

[NEDC-32433-P, "Maximum Extended Load Line Limit and ARTS Improvement Program Analyses for Browns Ferry Nuclear Plant Units 1, 2, and 3", April 1995].

2) ICF up to 105 percent of rated core flow individually or combined with Final Feedwater Temperature Reduction (FFWTR), corresponding to a 55 degrees F reduction in feedwater temperature at rated conditions.

Additional analysis allows further reductions in feedwater temperature at low power with additional thermal limit penalties. It is not permissible to operate above the specified power with more than 55 degrees F reduction in feedwater temperature. [NEDO-22135, "Safety Review of Browns Ferry Nuclear Plant Unit No. 1 at Core Flow Conditions above Rated Flow During Cycle 5," October 1982; NEDO-22245, "Safety Review of Browns Ferry Nuclear Plant Unit No.

2 at Core Flow Conditions above Rated Flow During Cycle 5," October 1982; NEDO-22149, "Safety Review of Browns Ferry Nuclear Plant Unit No. 3 at Core Flow Conditions above Rated Flow During Cycle 5,"

June 1982; (b) Safety Review for Browns Ferry Unit 2 Cycle 7 Final Feedwater Temperature Reduction, NEDC-32356P, June 1994; Memo, J. M. Moose to A. W. Will, Evaluation of Thermal Margin During Startup With Reduced Feedwater Temperature-Phase 2, Revision 1, AWW:06:077R1, May 16, 2006].

3) Turbine Bypass Out-of-Service (TBP-OOS) [NEDC-32774P, Rev 1, "Safety Analyses for Browns Ferry NP Units 1, 2, and 3. Turbine Bypass and End-of-Cycle Recirculation Pump Trip Out-of-Service",

September 1997.

4) End-of-Cycle Recirculation Pump Trip Out-of-Service (EOC-RPT-OOS) [NEDC-32774P, Rev 1, "Safety Analyses for Browns Ferry NP Units 1, 2, and 3. Turbine Bypass and End-of-Cycle Recirculation Pump Trip Out-of-Service", September 1997.

5) 24 Month Fuel Cycle.

6) Main Safety/Relief Valves Setpoint Tolerance Relaxation (+3 percent) and One Main Safety/Relief Valve Out-of-Service (1 MSRV-OOS).

14.5-6

BFN-27

7) Improved Standard Technical Specifications.

8) Limiting transients with PLU-OOS These operating flexibility options, with the exception of PLU-OOS, have been included as part of the analyses assumptions for the BFN Power Uprate licensing analyses (Reference NEDC-32751P, "Power Uprate Safety Analysis for BFNP Units 2 and 3," September 1997). The EOC-RPT-OOS contingency mode of operation eliminates the automatic Recirculation Pump Trip signal when Turbine Trip or Load Rejection occurs. As such, the core flow decreases at a slower rate following the recirculation pump trip due to the anticipated transient without scram (ATWS) High Pressure recirculation system trip, thus increasing the severity of the transient responses. This EOC-RPT-OOS option will only be analyzed for the limiting events, LRNBP TTNBP, and FWCF. These limiting events bound the UFSAR events described in this section, even when it comes to applicability of these equipment OOS (EOOS) and setpoint relaxation options.

The Turbine Bypass Out-of-Service (TBP-OOS) contingency mode of operation produces a different evolution in the pressurization phases of the transients. The overpressurization is faster because the bypass system is not operable, thus the pressure setpoints are reached earlier. However, the positive reactivity insertion due to moderator void collapse is more severe; and this results in a higher delta-critical power ratio (delta-CPR) and, subsequently, a higher operating limit minimum critical power ratio (OLMCPR). The FWCF assumes that turbine bypass system is functional while other limiting transients do not. Consequently, this transient is strongly affected by TBP-OOS.

This option will only be analyzed for the FWCF transient which bounds the UFSAR events described in this section even when it comes to applicability of these EOOS and setpoint relaxation options.

The Main Steam Relief Valve (MSRV) Setpoint Tolerance Relaxation option is assumed for all the transients analyzed as long as the MSRV actuation (mainly for events resulting in a nuclear system pressure increase) results in a more severe transient response with these EOOS and setpoint relaxation options.

Under ARTS/MELLL conditions a new set of power and flow dependent CPR and maximum average planar linear heat generation rate (MAPLHGR) limits have been calculated in NEDC-32433-P, "Maximum Extended Load Line Limit and ARTS Improvement Program Analyses for Browns Ferry Nuclear Plant Units 1, 2 and 3",

April 1995, and "Power Uprate Evaluation Task Report for BFNP Units 1, 2 & 3 Transient Analysis", GE-NE-B13-01866-05, August 1997. Modified flow dependent MCPR corrections were later supplied in GE/GNF letter 262-00-021-01, TVA Unit 3 Cycle 10 MCPR(F) Limits, which will continue to apply to all follow-on Browns Ferry 14.5-7

BFN-27 Unit 1, 2, or 3 cores that contain only GE11 and later fuel designs. The power dependent MAPLHGR(P) and MCPR(P) limits and the flow dependent MAPLHGR(F) and MCPR(F) limits are included in the Core Operating Limits Report (COLR). The current COLR for each BFN unit is included in Appendix B of the corresponding Technical Requirements Manual (TRM). To ensure fuel protection during postulated transients at off-rated power and flow conditions, these calculations include extensive transient analyses at various off-rated state points.

Off-rated power/flow conditions were assumed in the references mentioned above such that the entire power/flow map is bounded by the results obtained for the chosen conditions. Power/flow state points outside the power/flow map were analyzed in order to include extra conservatism in the calculations. Other operating flexibility features as listed above were also included in the transients analyses assumptions. Therefore, the transients analyzed in this chapter are protected by these off-rated limits (MAPLHGR(P), MCPR(P), MAPLHGR(F), and MCPR(F)) in the entire power flow map domain.

For AREVA reload analyses, off-rated thermal limits are calculated on a cycle-specific basis.

14.5.1.6 Transient Input Parameters The range of system input parameters for transient analysis mainly consist of heat balance information, core characteristics, and reactor protection specifications. The inputs include the initial power and flow conditions, core pressure drop, void fraction, nuclear dynamic parameters (Doppler, void and scram reactivity coefficients), and plant operating configuration (such as scram speed, safety/relief valves setpoints, reactor scram setpoints, recirculation/feedwater pump trip).

Table 14.5-2 shows the analysis basis values of key parameters of BFN operation.

14.5.1.7 Transient Power/Flow/Exposure Conditions The following rated thermal power and core flow conditions from the BFN power/flow map are selected as representative for the standard (STD), MELLL, and ICF regions:

1. 100P/81F (MELLL domain)

2. 100P/100F (standard domain)

3. 100P/105F (ICF domain)

The 100P is defined as 100 percent of rated power or 3458 MWt. The 100F is defined as 100 percent of rated core flow or 102.5 E6 lbm/hr; 81F and 105F are defined as 81 percent and 105 percent of rated core flow, respectively. As 14.5-8

BFN-27 previously discussed, some transients are analyzed at 3527 MWt or 102 percent of rated power (i.e., 102P).

Table 14.5-1 lists the Power/Flow operating conditions for each transient analyzed in this chapter.

The UFSAR transient analyses have considered the full spectrum of core conditions from the beginning, middle, and end of the cycle (BOC, MOC, EOC), whichever is more limiting for the transient event under consideration. A bounding 24-month fuel cycle length is also included in the cycle exposure calculations.

14.5.2 Events Resulting in a Nuclear System Pressure Increase Events that result directly in significant nuclear system pressure increases are those that result in a sudden reduction of steam flow while the reactor is operating at power. A survey of the plant systems has been made to identify events within each system that could result in the rapid reduction of steam flow. The following events were identified:

a. Generator Load Reject

b. Loss of Condenser Vacuum

c. Turbine Trip

d. Turbine Bypass Valve Malfunction

e. Closure of Main Steam Isolation Valve

f. Pressure Regulator Malfunction 14.5.2.1 Generator Load Reject (Turbine Control Valve [TCV] Fast Closure) 14.5.2.1.1 Transient Description A loss of generator electrical load from high power conditions produces the following transient sequence:

a. Turbine-generator power/load unbalance circuitry operates the control valve fast acting solenoid valves to initiate turbine control valve (TCV) fast closure (minimum response time of TCV fast closure: 0.15 seconds),

b. Turbine control valve fast closure is sensed by the reactor protection system, which initiates a scram and simultaneous recirculation pump trip (for initial power levels above 30 percent rated),

c. The turbine bypass valves are opened simultaneously with turbine control valve closure, and reroute the vessel steam flow to the condenser.

14.5-9

BFN-27

d. Reactor vessel pressure rises to the MSRV setpoints, causing them to open for a short period of time.

e. The steam passed by the MSRVs is discharged into the suppression pool, and

f. The turbine bypass valve (TBV) system controls nuclear system pressure after the MSRVs close.

Below 30 percent of rated power, the TBV system will transfer steam around the turbine and thereby avoid reactor scram. This transient is not analyzed as it is bounded by the Generator Trip (TCV Fast Closure) With Turbine Bypass Valve Failure transient described in Section 14.5.2.2.

14.5.2.2 Generator Load Reject (TCV Fast Closure) with Turbine Bypass Valve Failure (LRNBP) 14.5.2.2.1 Transient Description The most severe transient for a full-power generator trip occurs if the turbine bypass valves fail to operate. Although the TCV fast closure time is slightly longer than that of the turbine stop valves, the control valves are considered to be partially closed initially. This results in the generator trip steam supply shutoff being faster than the turbine stop valve steam shutoff.

A generator trip from high power conditions produces a transient sequence similar to the sequence described in Section 14.5.2.1 except the turbine bypass valves are assumed to remain closed. The LRNBP event is caused by the fast closure of all turbine control valves (TCVs) due to significant loss of electrical load on the generator. This will cause a sudden reduction in steam flow that results in significant vessel pressurization. The turbine bypass system is conservatively assumed to be inoperable for this event. A reactor scram signal is initiated by the TCVs closure.

The LRNBP event is identified as one of the most limiting abnormal operational transients for the BFN licensing analyses (assuming all equipment in service).

Therefore, this event is analyzed to determine the operating limits and to verify the plant safety margins.

This abnormal operating transient is evaluated for each reload core to determine if this event could potentially alter the previous cycle MCPR operating limit. The analyses of this event for the most recent reload cycle is contained in the unit-specific and cycle-specific Reload Licensing Report.

14.5-10

BFN-27 14.5.2.2.2 Initial Conditions and Assumptions For GE reload analyses, the analysis described in this section was performed with the ODYN computer code at the limiting power/flow conditions at normal operation:

100 percent rated power (consistent with the current licensing methodology) and maximum core flow (ICF) conditions. For bounding purposes, normal feedwater temperature (as opposed to reduced feedwater temperature) is assumed since the reactor steam generation would be lower with a reduced feedwater temperature.

The EOC all-rods-out exposure is assumed to conservatively bound the control rod insertion effectiveness at any other cycle exposure. For AREVA reloads, computer codes and analysis methodology described in Section 3.7.7.1.2 MCPR Operating Limit Calculation Procedure are used.

14.5.2.2.3 Interpretation of Transient Results Figure 14.5-5 shows the plant-specific response to the generator load rejection without bypass at 100 percent rated power and 105 percent flow conditions. The neutron flux peaks at 568 percent of initial; the average heat flux peaks at 125 percent of its initial value. The peak pressure at the bottom of the vessel is 1283 psia which is well below the ASME upset code transients limit of 1375 psig while the peak steam line pressure is 1245 psia. The calculated delta-CPR at the stated conditions is 0.19 for GE13 fuel; this result is representative but not bounding for other GE fuel types.

At rated power, the delta-CPR for the LRNBP event is one of the most severe resulting from any other pressurization event. As power is reduced, the severity of the transient increases; but the fuel integrity is protected by the power-flow dependent thermal limits (see Section 14.5.8).

14.5.2.2.4 Generator Load Reject with Turbine Bypass Valve Failure with EOC-RPT-OOS The EOC-RPT-OOS condition eliminates the automatic Recirculation Pump Trip signal when Load Rejection occurs increasing the severity of the transient response.

At power levels below 30 percent of rated power (Pbypass), the RPT is always bypassed in conjunction with the scram on TSVs/TCVs closure. Therefore, these low power cases are not affected by the EOC-RPT-OOS condition.

Figure 14.5-6 shows the transient results for the 100 percent of rated power and 105 percent of rated core flow case. EOC exposure and normal feedwater temperature conditions have been assumed for this transient analysis, the same as in the transient analysis with TBV in service described above.

The neutron flux peaks at 674 percent of initial, the average heat flux peaks at 130 percent of its initial value. The peak pressure at the bottom of the vessel is 14.5-11

BFN-27 1293 psia which is well below the ASME upset code transients limit of 1375 psig while the peak steam line pressure is 1248 psia. The calculated delta-CPR of this transient at the stated conditions is 0.23.

The penalty associated with EOC-RPT-OOS is about 0.04 in delta-CPR. At less than rated core flow, the penalty is smaller because of the relatively reduced beneficial effect of EOC-RPT.

The impact of the EOC-RPT-OOS on the transient fuel protection at off-rated power/flow conditions has been addressed with the appropriate revision to the ARTS-based power-dependent MCPR and MAPLHGR limits, as required

[NEDC-32774P, Rev 1, "Safety Analyses for Browns Ferry Nuclear Plant Units 1, 2 and 3 Turbine Bypass and End-of-Cycle Recirculation Pump Trip Out-of-Service",

September 1997].

For AREVA reload fuels, power-dependent LHGR(P) limits are used instead of MAPLHGR(P) limits. Power and flow dependent MAPLHGR, LHGR, and MCPR limits are developed on a cycle-specific basis.

14.5.2.3 Loss of Condenser Vacuum (LCV) 14.5.2.3.1 Transient Description This case is a severe abnormal operational transient resulting directly in a nuclear system pressure increase. It represents the events that would follow an assumed instantaneous loss of vacuum; main and feedwater turbines trip when their vacuum protection setpoints are reached (19 in Hg), main turbine trip (TT) initiates reactor scram, recirculation pump trip (RPT), and turbine bypass opening. Later in the transient, the condenser vacuum is assumed to drop to the setpoints for closure of TBVs.

14.5.2.3.2 Initial Conditions and Assumptions Because it is an overpressurization transient, it has been analyzed with the ODYN code. Two cases have been analyzed: ICF (105 percent of rated core flow) and MELLL (81 percent of rated core flow), both at 102 percent of rated power. The EOC exposure has been used because the top peaked axial power shape degrades the effectiveness of rod insertion during the reactor scram. Normal feedwater temperature is assumed in this analysis to maximize the vessel steam flow during the transient.

The turbine bypass system opens from turbine stop valve (TSV) closure and closes at 5 seconds due to loss of condenser vacuum signal (at 7 inches Hg, assuming rate of loss of vacuum -2 inches Hg/second to conservatively give only 5 seconds of bypass flow).

14.5-12

BFN-27 The feedwater system trips at time 0 with a 5 seconds coastdown. This transient is modeled with a MSIV closure initiation at 5 seconds as the vacuum protection setpoint is reached. (Although BFN does not have the MSIV closure signal on low vacuum protection setpoint, this assumption has no impact on the transient responses. The key transient parameters such as peak neutron heat flux, peak surface heat flux, and peak vessel pressure occurs prior to 4 seconds and, thus, are not affected by the MSIV closure action at 5 seconds.) One MSRV is assumed out of service with the resulting relief capacity of 73.8 percent of rated steam flow used in the analysis.

14.5.2.3.3 Interpretation of Transient Results Figures 14.5-7a and b illustrate this transient at ICF conditions which results in the most severe response. Peak neutron flux reaches 435 percent of rated; however, the fuel surface heat flux reaches 121 percent of its initial value. The relief valves open fully to limit the pressure rise, then sequentially reclose as the stored energy is dissipated. The peak nuclear system pressure at the bottom of the vessel (1243 psia) is also well below the nuclear process barrier transient pressure limit of 1375 psig.

This transient is equivalent to a turbine trip with bypass operable event. Therefore, this transient is bounded by the Turbine Trip No Bypass and Load Rejection No Bypass events; and no damage to the fuel results from this transient.

14.5.2.4 Turbine Trip (TSV Closure) 14.5.2.4.1 Transient Description A turbine trip is the result of a turbine or reactor system malfunction which results in a TSV fast closure (0.1 second closure time). This event represents a fast steam flow shutoff; and therefore, the potential for one of the most severe pressure-induced transients. Position switches on the stop valves provide the means of sensing the trip and initiating immediate reactor scram (for initial power levels above 30 percent). The bypass valves are opened by the control system upon a turbine trip. The bypass system regulates reactor pressure during reactor shutdown.

Although the TCV fast closure time is slightly longer (0.15 second) than that of the TSV (0.1 second), the control valves are considered to be partially closed initially.

This results in the generator trip steam supply shutoff being faster than the turbine stop valve steam shutoff while the protection system response is almost the same for each case (see Section 14.5.2.1).

14.5-13

BFN-27 14.5.2.4.2 Initial Conditions and Assumptions The calculation of this transient has been performed with the ODYN computer code at the most limiting conditions: 100 percent of rated power, 105 percent of rated core flow, EOC exposure conditions, and normal feedwater temperature. The turbine bypass system is assumed to be operable.

14.5.2.4.3 Interpretation of Transient Results Figure 14.5.8 illustrates this transient. The reactor scrams very early in the transient along with the fast opening of the TBV. A recirculation pump trip (RPT) is initiated upon the turbine trip. The reactor pressure rises to the MSRV setpoints causing them to open for a short period. The TBV system continues operating throughout the transient.

The fuel thermal transient is mild relative to the limiting events. Peak neutron flux reaches 447 percent of the rated power; the fuel surface heat flux reaches 122 percent of its initial value. The delta-CPR resulting from this event is bounded by the TTNBP transient. No damage to the fuel results from the transient. Peak pressure in the bottom of the vessel (1246 psia) and at the steam lines is below the ASME code limits for the nuclear process barrier (1375 psig).

Turbine trips from lower initial power levels decrease in severity because the vessel pressurization transient is milder with the reduced vessel steam flow rate. At core power less than 30 percent of rated, the turbine bypass system is capable of handling the vessel steam flow from a turbine trip event; and thus, the reactor scram signal from a turbine stop valve closure is bypassed.

14.5.2.5 Turbine Bypass Valves Failure Following Turbine Trip, High Power (TTNBP) 14.5.2.5.1 Transient Description This event is included to illustrate that a single failure could prevent the turbine bypass valves from opening in conjunction with a turbine trip.

The turbine trip with no bypass (TTNBP) event is similar to the LRNBP event. Even though the TTNBP has been shown to be bounded by the LRNBP, it is analyzed in the UFSAR for completeness.

14.5.2.5.2 Initial Conditions and Assumptions The calculation of this transient has been performed with the ODYN computer code at the most limiting conditions: 100 percent of rated power, 105 percent of rated core 14.5-14

BFN-27 flow, EOC exposure conditions, and normal feedwater temperature. The EOC exposure has been used because the top peaked axial power shape degrades the effectiveness of rod insertion during the reactor scram. The turbine bypass system is assumed to be inoperable.

14.5.2.5.3 Interpretation of Transient Results Figure 14.5-9 illustrates this transient. This transient evolves in a similar way to the TTBP event, although the bypass failure produces a more severe transient. Peak neutron flux reaches 564 percent of rated power while peak heat flux reaches 125 percent of rated power. Peak steam line pressure and peak vessel pressure reach 1243 and 1281 psia, respectively.

The results show a delta-CPR of 0.19 for this event. This trend is similar to that observed above for the LRNBP event. The TTNBP event is bounded by the LRNBP event.

14.5.2.6 Bypass Valves Failure Following Turbine Trip, Low Power 14.5.2.6.1 Transient Description This abnormal operational transient is of interest because it is initiated at the highest power for which turbine stop valve closure and turbine control valve fast closure scrams and Recirculation Pump Trip (RPT) is automatically bypassed by an interlock with a turbine load signal. The highest power level to bypass reactor scram is about 30 percent of rated power. Reactor scram is initiated by high dome pressure.

14.5.2.6.2 Initial Conditions and Assumptions The calculation of this transient has been performed with the ODYN computer code at 30 percent of rated power and 50 percent of rated core flow, EOC exposure, and normal feedwater temperature.

14.5.2.6.3 Interpretation of Transient Results Figures 14.5-10a and b illustrate this transient. Reactor scram is initiated at about 5.5 seconds by high vessel pressure (peak vessel pressure: 1217 psia). Peak neutron flux reaches 61 percent of rated while peak heat flux reaches 41 percent of rated. No bypass flow is assumed; however, a portion of the MSRVs open to relieve the pressure transient. The peak steam line pressure (1199 psia) remains below the ASME code limits. No fuel damage occurs since fuel integrity is protected by the application of the ARTS based power-flow dependent MCPR and MAPLHGR limits

[NEDC-32433-P, "Maximum Extended Load Line Limit and ARTS Improvement 14.5-15

BFN-27 Program Analyses for Browns Ferry Nuclear Plant Units 1, 2 and 3", April 1995 and "Power Uprate Evaluation Task Report for BFNP Units 1, 2 & 3 Transient Analysis",

GE-NE-B13-01866-05, August 1997].

14.5.2.7 Main Steam Isolation Valve (MSIV) Closure Automatic circuitry or operator action can initiate closure of the main steam isolation valves. Position switches on the valves provide reactor scram if valve(s) in three or more main steam lines are less than 90 percent open, and the mode switch is in the Run position. However, protection system logic does permit the test closure of one valve without initiating scram from the position switches. Inadvertent closure of one or all of the isolation valves from reactor scrammed conditions (such as Appendix G) will produce no significant transient. Closures during plant heatup (Operating State D) will be less severe than the maximum power cases (maximum stored and decay heat) which follow.

14.5.2.7.1 Closure of All Main Steam Isolation Valves 14.5.2.7.1.1 Transient Description This transient represents the simultaneous isolation of all MSIVs while the reactor is operating at power. Reactor scram is initiated by the MSIVs position switches before the valves have traveled more than 10 percent from the initial open position.

The closure of all MSIVs causes an abrupt pressure increase in the reactor vessel.

The system pressure increase is mitigated by the actuation of the MSRVs.

The closure of all MSIVs event with direct scram failure (reactor scram on high neutron flux signal) is the design basis event to demonstrate compliance to the ASME vessel overpressure protection criteria (upset condition). The MSIVF (Flux Scram) is included in every cycle-specific reload licensing process to ensure that the ASME code allowable value for peak vessel pressure (1375 psig) is not exceeded.

14.5.2.7.1.2 Initial Conditions and Assumptions This transient has been run with the ODYN computer code at 102 percent power, 105 percent core flow, normal feedwater temperature, EOC exposure conditions, and 1 MSRV-OOS. The EOC exposure has been used because the top peaked axial power shape degrades the effectiveness of rod insertion during the reactor scram.

The MSIV closure event is analyzed with 12 out of 13 MSRVs in-service (with one of the MSRVs with lowest opening setpoint assumed out-of-service) and 3 percent setpoint tolerance. The reduced relief capacity also increases the severity of the reactor vessel pressure transient. The fastest MSIV closure curve has been considered for this analysis (3 second closure time) which represents the bounding closure characteristics.

14.5-16

BFN-27 14.5.2.7.1.3 Interpretation of Transient Results Figure 14.5-11 illustrates the transient results. Scram is initiated very early into the event, before any significant steam flow interruption occurs; therefore, no fuel center temperature or fuel surface heat flux peaks take place. A small neutron flux peak occurs near 0.5 seconds. All 12 operable MSRVs open when pressure reaches the lowest setpoint at about 4 seconds after the start of the isolation. They close sequentially as the stored heat is being dissipated and continues to intermittently discharge the decay heat. The fuel delta CPR resulting from this event is bounded by other more limiting pressurization event, such as the TTNBP event.

The calculated peak bottom vessel pressure is 1234 psia for BFN specific MSIV closure characteristics and is still below the 1375 psig ASME overpressure limit.

14.5.2.7.2 Closure of One Main Steam Isolation Valve 14.5.2.7.2.1 Transient description Full closure of only one isolation valve without scram is permitted for testing purposes.

Normal procedures for such a test will normally require an initial power reduction to less than or equal to 75 percent in order to avoid high flux or pressure scram or high steam flow isolation from the active steam lines. During the transient from full power, the steam flow disturbance may raise vessel pressure and reactor power resulting in a high neutron flux scram.

14.5.2.7.2.1 Initial Conditions and Assumptions This transient has been analyzed with ODYN at 102 percent of rated power, 105 percent of rated core flow (ICF conditions), and EOC exposure. The exposure used has been EOC because the top peaked axial power shape degrades the effectiveness of rod insertion during the reactor scram.

A typical value of 60 psid pressure drop in the steam line is assumed in the analysis.

An increase in the steam line pressure drop has a small impact on the results and does not require a re-analysis of this event as long as this event remains a non limiting transient.

14.5.2.7.2.1 Interpretation of Transient Results Figures 14.5-12a and b illustrate this transient. The steam flow disturbance raises vessel pressure and reactor power causing a high neutron flux scram at about 4 seconds; the peak neutron flux reaches 131 percent of rated. The peak surface heat flux reaches about 110 percent of rated. Peak steam line pressure (1113 psia) remains below the setting of the lowest MSRVs. Peak vessel pressure (1155 psia) 14.5-17

BFN-27 remains below the 1375 psig ASME overpressure limit. The peak fuel parameters are well below those from the limiting pressurization transient (LRNBP).

14.5.2.8 Pressure Regulator Failure Approval to remove the pressure regulator downscale failure event as an abnormal operational transient was approved by license Amendment Nos. 244, 281, and 239 to Facility Operating Licenses Nos. DPR-33, DPR-52, and DPR-68 by NRC on April 4, 2003, based on the installation of a fault-tolerant electro-hydraulic turbine control system on Units 2 and 3, and a commitment to similarly modify Unit 1 prior to return to power operation. The reliability of the upgraded electro-hydraulic control system is such that a system failure that results in the simultaneous closure of all turbine control valves is not an anticipated failure and, hence, the PRDF transient no longer merits evaluation as an AOT.

14.5.3 Events Resulting in a Reactor Vessel Water Temperature Decrease Events that result directly in a reactor vessel water temperature decrease are those that either increase the flow of cold water to the vessel or reduce the temperature of water being delivered to the vessel. The events that result in the most severe transients in this category are the following:

a. Loss of a Feedwater Heater

b. Shutdown Cooling (RHR) Malfunction - Decreasing Temperature

c. Inadvertent pump start The most limiting conditions for these type of transients have been assumed, i.e.

102 percent of rated power and 81 percent of rated flow (MELLL conditions).

Normal feedwater temperature is also assumed as the larger void coefficient produces a more severe transient.

14.5.3.1 Loss of Feedwater Heater (LFWH) 14.5.3.1.1 Transient Description The purpose of evaluating this event is to determine the impact on the delta-CPR and on the fuel thermal and mechanical design limits. The LFWH event for BFN assumes a feedwater temperature reduction of 100 degrees F (from 382 degrees F to 282 degrees F).

The LFWH transient may be initiated by the accidental closure of the feedwater steam extraction shut-off valves or by bypassing feedwater around the feedwater heater. In either case, the feedwater temperature falls below its rated value; therefore, increasing the subcooling to the reactor core. The negative void reactivity coefficient results in an increase in core power, change in power distribution, and 14.5-18

BFN-27 decrease in bundle CPR. In the first case, a gradual subcooling transient is produced since there is stored heat in the heat exchanger. In the second case, a more abrupt subcooling transient is initiated due to the instantaneous removal of all feedwater heating. The maximum feedwater temperature loss (100 degrees F) due to a single equipment failure is the worst condition analyzed for BFN using this procedure.

14.5.3.1.2 Initial Conditions and Assumptions This transient was analyzed for thermal-hydraulic dynamic description purposes with REDY and for delta-CPR calculations with PANACEA 3-D reactor simulator code due to the quasi steady-state nature of the LFWH transient.

The LFWH analysis was conducted at two different conditions, 105 percent of rated core flow (ICF) and 81 percent of rated core flow (MELLL), in order to ascertain the most limiting condition for the transient results. Both codes, REDY and PANACEA, result in the same limiting conditions, 81 percent of rated flow and BOC exposure.

The analysis was performed at 102 percent of rated power with REDY and 100 percent of rated power with PANACEA.

14.5.3.1.3 Interpretation of Transient Results Figures 14.5-13a and b illustrate this transient with the recirculation control system in the manual flow control mode analyzed at the BOC exposure for the MELLL condition as it resulted in the most severe transient. The introduction of subcooled water into the reactor causes reactor power to slowly increase, neutron flux responds immediately, and surface heat flux lags behind. The power increase raises the turbine steam flow but does not reach the high neutron flux scram setpoint.

The plant eventually reaches a steady state condition at an increased power level.

Because of the nature of the LFWH event, it results in a slow, monotonic increase in reactor power and surface heat flux. Because of the quasi steady-state nature of the LFWH event, the core thermal margins can be evaluated by analysis of the beginning and end-points of the event with a qualified steady-state 3-D reactor simulator code. For the LFWH event, PANACEA 3-D reactor simulator code showed a peak neutron and surface heat flux of 117%, and delta-CPR of 0.11. (For FANP analyses, the MICROBURN-B2 3-D reactor simulator code is used to calculate LFWH results which are included in the Reload Licensing Analysis Report.)

Therefore, the LFWH is not a significant threat to fuel thermal margins, the Operating Limit CPR is established by other more limiting transients.

The average power range monitors provide an alarm to the operator at about 20 seconds after the cooler feedwater reaches the reactor vessel. Because nuclear system pressure remains essentially constant during this transient, the nuclear 14.5-19

BFN-27 system process barrier is not threatened by high internal pressure. All fuel parameters remain bounded by the results of other limiting pressurization transients.

This transient is less severe from lower power levels for two main reasons: (1) lower initial power levels will have initial fuel parameter values less limiting than the values assumed here, and (2) the magnitude of the power rise decreases with the initial power condition. Therefore, transients from other reactor operating states or lower power levels within Operating State F will be less severe.

14.5.3.2 Shutdown Cooling (RHR) Malfunction-Decreasing Temperature A shutdown cooling malfunction leading to a moderator temperature decrease could result from misoperation of the controls for the Residual Heat Removal (RHR) system heat exchangers. The resulting temperature decrease causes a slow insertion of positive reactivity into the core. If the reactor were critical or near critical (operating states B or D), a very slow reactor power increase could result. If no operator action were taken to control the power level, a high neutron flux reactor scram would terminate the transient without fuel damage and without any measurable nuclear system pressure increase.

14.5.3.3 Inadvertent Pump Start 14.5.3.3.1 Transient Description Several systems are available for providing high pressure supplies of cold water to the vessel for normal or emergency functions. The control rod drive system and the makeup water system, normally in operation, can be postulated to fail in the high flow direction introducing the possibility of increased power due to higher core inlet subcooling. The same type of transient would be produced by inadvertent startup of either the reactor core isolation cooling (RCIC) or the high pressure core injection (HPCI) System. In all of these cases, the normal feedwater flow would be correspondingly reduced by the water level controls. A portion of the feedwater flow (at rated power condition) is replaced with a colder HPCI flow, and the net result is a mixed feedwater flow at a reduced temperature.

Since a single failure can only initiate one of the cold water systems, the system with the highest flow rate is usually analyzed. The severity of the resulting transient is highest for the largest of these abnormal events; for BFN, this is the inadvertent startup of the large, 5000 gpm, HPCI System.

This transient is evaluated to determine the MCPR response to a decrease in feedwater temperature due to the inadvertent startup of the HPCI system. This event is qualitatively reviewed as part of the reload licensing analysis to verify its non-limiting trend versus the cycle specific operating limits.

14.5-20

BFN-27 Since the startup of the steam-turbine driven pump takes approximately 25 seconds, the transient that occurs is very similar to the loss of feedwater heater transient described above. As in that case, the most threatening transient would occur where minimum initial fuel thermal margins exist (maximum power within reactor Operating State F).

14.5.3.3.2 Initial Conditions and Assumptions This transient was analyzed by AREVA using the COTRANSA1/XCOBRA/XCOBRAT methodology. This analysis considered various cycle exposures and initial core flows.

As explained above, the inadvertent startup of the large, 5000 gpm, HPCI has been considered. The HPCI pump setpoint was assumed to be 10% higher than this value to ensure that the actual HPCI setpoint is bounded; an additional 10% was then added for additional conservatism. During the initiation and acceleration transient for the HPCI, the pump flow can overshoot the rated flow making the event more severe. An overshoot of 20 percent was used in this transient. The water temperature of the HPCI was assumed to be 40ºF.

The system was assumed to be in manual flow control, which results in higher flux, pressure and level peaks.

For an inadvertent HPCI start, the water level may rise to the L8 setpoint. All logic associated with this setpoint such as turbine, feedwater, HPCI trips, and RPT/ATWS options was considered.

14.5.3.3.3 Interpretation of Transient Results The introduction of subcooled water due to the inadvertent HPCI startup causes an increase in reactor power, neutron and surface heat fluxes. Pressure and water level show a small increase. The power increase raises turbine steam flow slightly.

The flux scram setpoint is not reached during this event.

The plant eventually reaches a steady state condition at an increased power level but with no significant threat to the fuel thermal margins. The AREVA analysis found the delta-CPR results for inadvertent HPCI startup was 0.04 greater than that for LFWH, but both events have considerable margin to the limiting generator load rejection without bypass and feedwater controller failure events. No fuel clad barrier damage results for the malfunction or inadvertent startup of HPCI or other auxiliary cold water supply systems.

The AREVA analysis also considered the effect of asymmetric HPCI flow distribution entering the reactor pressure vessel. The analysis considered various cycle exposures and initial core flows. The CPR result at rated power and 105% core 14.5-21

BFN-27 flow was 0.02 more limiting than the case with symmetric HPCI injection, and the change in peak LHGR increased by less than 3%. Therefore, the results of the HPCI injection event continue to be much less limiting than results for the generator load rejection without bypass transient (Section 14.5.2.2).

14.5.4 Events Resulting in a Positive Reactivity Insertion Events that result directly in positive reactivity insertions are the results of rod withdrawal errors and errors during refueling operations. The following events result in a positive reactivity insertion:

a. Continuous Rod Withdrawal During Power Range Operation

b. Continuous Rod Withdrawal During Reactor Startup

c. Control Rod Removal Error During Refueling

d. Fuel Assembly Insertion Error During Refueling 14.5.4.1 Continuous Rod Withdrawal During Power Range Operation 14.5.4.1.1 Transient Description The RWE event is initiated by an operator erroneously selecting and continuously withdrawing a single high worth control rod.

Control rod withdrawal errors are considered over the entire power range from any normally expected rod pattern. The continuous withdrawal from any normal rod pattern of the maximum worth rod (approximately 0.2 percent delta-k) results in a very mild core transient. The system will stabilize at a higher power level with neither fuel damage nor nuclear system process barrier damage.

The limiting control rod withdrawal error during power range operation is examined each reload cycle. The methodology in NEDE-24011-P-A is used for licensing analysis performed by GE. NRC approved methodology is used for licensing analysis performed by FANP. The result is presented in the Reload Licensing Report.

As part of the RBM system modification included in the ARTS Improvement program

[NEDC-32433-P, "Maximum Extended Load Line Limit and ARTS Improvement Program Analyses for Browns Ferry Nuclear Plant Units 1, 2 and 3", April 1995 and "Power Uprate Evaluation Task Report for BFNP Units 1, 2 & 3 Transient Analysis",

GE-NE-B13-01866-05, August 1997], the fuel thermal-mechanical protection for a postulated RWE event is provided by the RBM power-dependent setpoints. The RWE event is re-analyzed every cycle to confirm the applicability of these ARTS generic limits when the licensing analysis is performed by GE. For licensing analysis performed by AREVA, the thermal-mechanical protection is verified in the cycle specific RWE analysis.

14.5-22

BFN-27 14.5.4.1.2 Initial Conditions and Assumptions The core nuclear dynamic parameters are based on the cycle peak hot excess reactivity, and the control rod pattern used to simulate the RWE are assumed to be at nominal conditions. The analysis assumes the error rod is withdrawn continuously from its initial position. During this event, the core average power increases until the event is terminated by a rod block signal.

14.5.4.1.3 Interpretation of Transient Results For licensing analysis performed by GE, a specific RWE analysis has been performed based on a bounding 24-month GE13 equilibrium cycle core design. The analysis included a statistical evaluation of a range of control rod withdrawal errors conditions such that the rod with the maximum possible error worth can be determined. This type of error could only be achieved by deliberate operator action or by numerous operator errors during rod pattern manipulation prior to the selection and complete withdrawal of the rod. Abnormal indications and APRM alarms would warn the operator as he approaches this abnormal rod pattern. The power-dependent RBM setpoint stops the rod withdrawal. Neither nuclear system process barrier damage nor fuel damage occur as long as the OLMCPR is established by more limiting transients, a condition which is verified every cycle specific evaluation. The results are shown in the following table.

Rod Withdrawal Error Results Rod Block Power Monitor ARTS generic Calculated MCPR Range Setpoint (%) Maximum DELTA-CPR/ Operating Limit***

(%) DELTA-CPR ICPR95/95**

/ICPR95/95*

85-100 108 0.14 0.13 1.28 70-85 112 0.17 0.19 1.31 30-70 118 0.17 0.28 1.32

• Evaluated at the 95% probability and 95% confidence level

• • From NEDC-32433-P, "Maximum Extended Load Line Limit and ARTS Improvement Program Analyses for Browns Ferry Nuclear Plant Units 1, 2 and 3", April 1995

• • • OLMCPR = SLMCPR/(1- Delta-CPR/ICPR95/95)

Where ICPR = Initial CPR & SLMCPR = Safety Limit MCPR FANP Licensing Analysis 14.5-23

BFN-27 For licensing analysis performed by FANP, a cycle specific RWE analysis is performed. The RWE analysis is a bounding analysis that evaluates the withdrawal of maximum reactivity worth rods with conservative starting control rod patterns.

The starting control rod patterns are conservatively selected to place the fuel near the fully inserted error rod at or near thermal limits. The analysis assumes that the reactor operator ignores the LPRM and RBM alarms and continues to withdraw the error rod until the motion is stopped by the RBM trip. The RBM trip setpoints for the cycle are selected to ensure that the RWE is not limiting compared to the limiting plant transients. The power dependent RMB trip setpoints are documented in the cycle specific COLR.

14.5.4.2 Continuous Rod Withdrawal during Reactor Startup 14.5.4.2.1 Transient Description Control rod withdrawal errors are considered when the reactor is at a power level below the power range involving the startup range of the power/flow operating map.

The most severe case occurs when the reactor is just critical at room temperature, and an out-of-sequence rod is continuously withdrawn. The rod worth minimizer would normally prevent withdrawal of such a rod. It is assumed that the Intermediate Range Neutron Monitoring (IRM) channels are in the worst conditions of allowed bypass. The scaling arrangement of the IRMs is such that for unbypassed IRM channels a scram signal is generated before the detected neutron flux has increased by more than a factor of ten. In addition, a high neutron flux scram is generated by the APRM at 15 percent and at 120 percent of rated power depending on the initial power level.

The pre-uprate UFSAR analysis was performed for a 2.5 percent delta-k control rod withdrawal at the rod drive speed of 3 in./sec starting from an average moderator temperature of 82 degrees F.

The results of these analyses indicate a maximum fuel temperature well below the melting point of UO2 and a maximum fuel clad temperature which is less than the normal operating temperature of the clad. The possible failure of the fuel clad due to strain was analyzed using the following conservative assumptions:

1 The total volume expansion of UO2 is in the radial direction,

2. There is no thermal expansion of the fuel cladding, and

3. The fuel is assumed to be incompressible.

The results of these analyses indicate a maximum radial strain analogous to a radial expansion of 0.6 mils, which is much less than the postulated cladding damage limit of 1 percent plastic strain, which corresponds to 3.3 mils radial expansion.

14.5-24

BFN-27 Thus, no fuel damage will occur due to a continuous rod withdrawal during reactor startup.

The Continuous Rod Withdrawal during Reactor Startup transient does not need to be re-analyzed for uprated conditions, as the licensing basis criteria for fuel failure is that the fuel enthalpy must not exceed 170 cal/gm. At the uprated power, it is possible that a slightly higher fuel enthalpy above 60 cal/gm (reported in the previous analysis) can be reached due to the higher enrichment or other changes; but due to the considerable margin that exists to the 170 cal/gm limit, the result will be well below 170 cal/gm should a new analysis be performed. There existed several conservatisms in the original design basis analysis, such as:

1. The furthest possible distance between a control rod being withdrawn and a scram initiating IRM detector is used.

2. The rod shape function depicts the control rod being withdrawn at 0.3 ft/sec until the entire rod is withdrawn, but, in reality, the rod is withdrawn only 2.44 feet before the scram starts to reinsert the rod.

3. The RBM is assumed to fail to block the continuous withdrawal of an out-of-sequence rod.

4. No power flattening due to Doppler feedback is assumed.

Therefore, a re-analysis is not needed for the UFSAR at the uprated conditions.

14.5.4.3 Control Rod Removal Error During Refueling The nuclear characteristics of the core ensure that the reactor is subcritical even in its most reactive condition with the most reactive control rod fully withdrawn during refueling.

When the mode switch is in Refuel, only one control rod can be withdrawn.

Selection of a second rod initiates a rod block, thereby preventing the withdrawal of more than one rod at a time.

Therefore, the refueling interlocks will prevent any condition which could lead to inadvertent criticality due to a control rod withdrawal error during refueling when the mode switch is in the Refuel position.

In addition, the design of the control rod, incorporating the velocity limiter, does not physically permit the upward removal of the control rod without the simultaneous or prior removal of the four adjacent fuel assemblies, thus, eliminating any hazardous condition.

14.5-25

BFN-27 14.5.4.4 Fuel Assembly Insertion Error During Refueling The core is designed such that it can be made subcritical under the most reactive conditions with the strongest control rod fully withdrawn. Therefore, any single fuel assembly can be positioned in any available location without violating the shutdown criteria, providing all the control rods are fully inserted. The refueling interlocks require that all control rods must be fully inserted before a fuel bundle may be inserted into the core.

14.5.5 Events Resulting in a Reactor Vessel Coolant Inventory Decrease Events that result directly in a decrease of reactor vessel coolant inventory are those that either restrict the normal flow of fluid into the vessel or increase the removal of fluid from the vessel. Four events have been considered in this category:

a. Pressure Regulator Failure Open

b. Inadvertent Opening of a MSRV

c. Loss of Feedwater Flow

d. Loss of Auxiliary Power Normal feedwater temperature and minimum reactor water level have been assumed for these types of transients. The smaller initial water inventory in the vessel and the larger steam flow maximizes the inventory loss.

14.5.5.1 Pressure Regulator Failure Open 14.5.5.1.1 Transient Description Should the pressure regulation function of the Turbine Control System fail in an open direction, the turbine admission valves can be fully opened with the turbine bypass valves partially or fully opened. This condition results in an initial decrease in the coolant inventory in the reactor vessel as the mass flow of steam leaving the vessel exceeds the mass flow of water entering the vessel. The total steam flow rate resulting from a pressure regulation malfunction is limited by the turbine controls to about 130 percent of rated flow.

The reactor water level swelling due to the decreasing reactor vessel pressure may reach the high level L8 setpoint initiating a TSV closure. Following this action, feedwater pumps trip, recirculation pumps trip, and reactor scram will take place. If L8 is not reached, the vessel depressurizes and the turbine header pressure may drop to the low pressure setpoint for reactor isolation (843 psig); the MSIVs will then close, and a reactor scram will be initiated.

14.5-26

BFN-27 There is no significant threat to the fuel thermal margins, but there is a small but rapid decrease in the saturated temperature to which the reactor system components are exposed, which might affect the hardware components.

14.5.5.1.2 Initial Conditions and Assumptions Per Reference 1, multiple General Electric models (REDY, ODYN, TRCG) have shown that the Critical Power Ratio (CPR) for the fuel increases during the depressurization transient, so there is no threat to the fuel thermal margins.

Therefore, this event does not need to be considered when setting thermal limits for each reload cycle. The new General Electric models (ODYN, TRACG) have determined that the level swell may not be sufficient to reach the L8 trip, in which case the depressurization would be terminated by MSIV closure at the low pressure isolation setpoint (LPIS), followed by a reactor scram.

Per Reference 2, AREVA has also concluded that this event is non-limiting with respect to CPR limits. The analysis in Reference 2 evalutes if the LPIS for the MSIVs is adequate to support the low steam dome pressure safety limit being maintained during the time that the reactor is above 25% rated themal power during the PRFO event.

The Reference 2 analysis considers sensitivities to multiple power/flow statepoints, variations in feedwater temperature and dome pressure, MSIV closure times between 3.0 and 5.0 seconds, multiple cycle exposure values, multiple scram insertion speeds, and variations in core average gap conductance.

The physical LPIS setpoint for the MISVs has been set to 843 psig, which will result in a less sever depressurization than the allowed value of 825 psig.

14.5.5.1.3 Interpretation of Transient Results Previous analyses (Reference 1) support the conclusion that fuel thermal limits are not challenged by this event. No fuel damage occurs.

The analysis in Reference 2 yields the following results:

Initial conditions of low core flow are more conservative than high core flow.

Lower feedwater temperatures (feedwater heaters out-of-service) and the corresponding lower dome pressure values are conservative.

Slow MSIV closure time (5 seconds vs. 3 seconds) is conservative.

Minimum pressure during the PRFO event is relatively insensitive to cycle exposure.

Faster scram times provide a lower minimum steam dome pressure during the event.

High core average gap conductance provides a lower minimum steam dome pressure during the event.

14.5-27

BFN-27 Results from the Reference 2 case yielding the lowest steam dome pressure values are shown in Figure 14.5-15a and 14.5-15b.

Reference 2 concludes that the lowest pressure calculated for BFN does not change the low pressure safety limit value of 585 psig.

References:

1. GE 10 CFR Part 21 Communications SC05-03, Potential to Exceed Low Pressure Technical Specification Safety Limit, GE Nuclear, March 2005.

2. ANP-32459 Revision 1, Browns Ferry Evaluation of PRFO Low Pressure Technical Specification Value, AREVA NP, February 2014.

14.5.5.2 Inadvertent Opening of a MSRV (IORV) 14.5.5.2.1 Transient Description The opening of a MSRV on the main steam line allows steam to be discharged into the primary containment. The sudden increase in the rate of steam flow leaving the reactor vessel causes the reactor vessel coolant (mass) inventory to decrease. The result is a mild depressurization transient. The turbine pressure regulator senses the pressure decrease and drops turbine flow to maintain pressure control. The reactor settles out at nearly the initial power.

14.5.5.2.2 Initial Conditions and Assumptions This transient was analyzed with REDY. The transient begins with the system at nominal operating conditions with 102 percent of rated power and one of the relief valves open, remaining open throughout the transient. Two cases have been run for this transient: 100 percent of rated core flow and BOC exposure conditions and 105 percent of rated core flow and EOC exposure conditions. This event is not sensitive to initial core flow; therefore, the 100F and 105F conditions are chosen to reflect the most likely operating state at BOC and EOC. The worst case is BOC and rated core flow conditions. The capacity assumed for the opening of the relief valve is 6.15 percent of rated nuclear system steam flow.

14.5.5.2.3 Interpretation of Transient Results Figures 14.5-16a and b illustrate this transient with BOC exposure and rated core flow. The inadvertent opening of one of the relief valves on the main steam line produces a mild depressurization transient. The turbine pressure regulator senses the pressure decrease and drops turbine flow to maintain pressure control. The reactor settles out at nearly the initial power. The peak neutron flux and fuel surface heat flux do not exceed the initial power. No fuel damage results from the transient.

14.5-28

BFN-27 Because pressure decreases throughout the transient, the nuclear system process barrier is not threatened by high internal pressure. The small amounts of radioactivity discharged with the steam are contained inside the primary containment; the situation is not significantly different, from a radiological viewpoint, from that normally encountered in cooling the plant using the relief valves to remove decay heat.

14.5.5.3 Loss of Feedwater Flow 14.5.5.3.1 Transient Description A loss of feedwater flow results in a situation where the mass of steam leaving the reactor vessel exceeds the mass of water entering the vessel, resulting in a net decrease in the coolant inventory available to cool the core.

This transient has been analyzed with the transient model REDY for the initial portion of the event. In order to evaluate the water level behavior, a long term evaluation has been performed with the LOCA computer model SAFER.

As part of the short-term REDY analysis, the feedwater control system failures or feedwater pump trips can lead to partial or complete loss of feedwater flow.

Following the trip of all feedwater pumps, feedwater system inertia results in a 5 second feedwater flow decrease before flow is completely stopped. The decrease in feedwater flow produces a slight decrease in core pressure drop and in core inlet subcooling, both of which increase core void fraction. This condition results in an initial reactor power decrease and reduces the reactor vessel water level drop for the first few seconds of the transient. The water level continues to decrease until a low level scram is initiated at L3. Decay and stored heat continue to create steam and the level continues to drop. When the wide range (WR) sensed level reaches the L2 setpoint, the recirculation pumps trip, and the RCIC system is actuated. No credit is taken for HPCI actuation, and RCIC maintains adequate water inventory. The MSIVs are closed if wide range sensed level reaches the L1 setpoint.

The limiting parameter to be considered in this event is the water level which is calculated as part of the long-term analysis. The design criteria for this event is that downcomer water level must remain above L1 (approximately at the top of active fuel, (TAF) elevation).

The loss of feedwater flow event is evaluated to confirm that this event remains non-limiting at rated conditions and to assess whether the water level can be sufficiently maintained by the RCIC system without initiation of the low pressure emergency core cooling systems. This event does not pose any direct threat to the fuel in terms of a power increase from the initial conditions. The fuel will be protected provided the water level inside the shroud does not drop below the TAF.

14.5-29

BFN-27 14.5.5.3.2 Initial Conditions and Assumptions This evaluation has been performed taking into account the lowering of the MSIV reactor water level set point [NEDE-30012, December 1982]. This long-term evaluation was performed using the Appendix K evaluation models with the following conservative assumptions:

a. Conservative decay heat values (ANS-5.1-1979 +10 percent) are used to maximize heat addition to the vessel, MSRV challenges, and inventory loss.

b. This transient is most severe from high power conditions, because the rate of level decrease is greatest and the amount of stored and decay heat to be dissipated is highest. Therefore, the analysis was performed at the 102 percent of rated power condition and 100 percent of rated core flow. This event is not sensitive to initial core flow, and the 100 percent core flow condition is chosen as typical representation of the plant operating condition. Conditions are assumed such that all cycle exposures are bounded.

c. Water level was considered to be at normal level, since this transient is relatively insensitive to changes in initial water level above L3.

d. The feedwater pumps are assumed to coast down in one second. This is also consistent with the Appendix K loss of coolant accident (LOCA) analysis.

e. Only RCIC will initiate at Level 2. Since the HPCI injection rate is about 10 times that of RCIC, this assumption provides the most severe challenge to the reactor core cooling.

f. The RCIC system was initiated with a 30 second time delay after WR level had reached the L2 setpoint.

g. The RCIC flow enthalpy (temperature) was considered to be equal to the feedwater flow enthalpy for the first 2 minutes of the transient. This accounts for the warmer feedwater flow entering the vessel before the colder RCIC flow can actually reach the vessel.

h. For the short term calculation, recirculation pumps were tripped off when WR level reached the L2 setpoint. However, for the long term calculation the pump trip is assumed to occur at L4 in order to simulate the pump runback and minimize the vessel water inventory during the transient.

14.5-30

BFN-27

i. The avoidance of the low level L1 setpoint is treated as an operational criteria; therefore, no MSIV closure takes place.

The major change from earlier analytical approach for this transient is that the main steam lines are no longer isolated with the startup of RCIC when the reactor water level reaches the reactor water level 2 setpoint.

14.5.5.3.3 Interpretation of Transient Results Figures 14.5-17a and b illustrate the short-term transient at BOC and rated core flow conditions. From the REDY analysis, feedwater pump system inertia results in a 5 second feedwater flow decrease before flow is completely stopped. The decrease in feedwater flow produces a slight pressure drop and a decrease in core inlet subcooling, both of which increase core void fraction, reducing reactor power initially and helps moderate the decrease in actual reactor vessel water level for the first few seconds of the transient. The water level continues to decrease until a low level scram is initiated at L3 at 7 seconds. Decay and stored heat continues to create steam and the level continues to drop. When the WR sensed level reaches the L2 setpoint (20 seconds), the recirculation pumps trip and the RCIC system is actuated with a 30 second time delay. This maintains adequate water inventory.

The MSIVs remain open and the main condenser remain as a heat sink. Pressure in the reactor vessel decreases gradually with the power reduction so that no threat is posed for the nuclear system process barrier. The vessel pressure reaches the turbine pressure and remains at this value.

As shown in Figure 14.5-17c (long-term), the feedwater flow coastdown occurred within one minute of initiation; and RCIC alone is still capable of maintaining adequate core coverage with the MSIVs open. RCIC also maintains reactor water level above the MSIV water level isolation setpoint; therefore, the MSIVs remain open and the main condenser remains as a heat sink. Reactor pressure is maintained by the pressure control system and the turbine bypass valve. Pressure suppression pool heatup is not a concern since there is no actuation of the MSRVs.

14.5.5.4 Loss of Auxiliary Power Loss of auxiliary power is defined as an event which de-energizes all electrical buses that supply power to the unit auxiliary equipment such as recirculation, feedwater, and condenser circulating water pumps. The reactor is subjected to a complex sequence of events when the plant loses all auxiliary power. This can occur if all external grid connections are lost or if faults occur in the auxiliary power system itself causing, therefore, two types of transients: Loss of Auxiliary Power Transformers and Loss of Auxiliary Power Grids.

Estimates of the responses of the various reactor systems to loss of auxiliary power provided the following simulation sequence:

14.5-31

BFN-27

a. All pumps are tripped at 0 seconds. Normal coastdown times were used for the recirculation and feedwater pumps.

b. At 5 seconds, the reactor protection system instrumentation power is lost. This initiates closure of the MSIVs which also produces a scram signal.

By about 20 seconds after the simulated loss of power, both transients look essentially identical. Pressure is cycling at approximately the lowest MSRV setpoint, and water level is dropping gradually until RCIC (or HPCI) operation restores water level control. The long-term water level transient is bounded by the Loss of Feedwater Flow long-term water level transient analyzed in Section 14.5.5.3.

14.5.5.4.1 Loss of All Auxiliary Power Transformers 14.5.5.4.1.1 Transient Description All pumps are tripped initially. Normal coastdown times are considered for the recirculation (3.5 seconds with VFD) and feedwater pumps. The trip of the main condenser circulating water pumps causes the loss of the condenser vacuum. When vacuum protection setpoints are reached, turbine trip and closure of the TBVs take place.

14.5.5.4.1.2 Initial Conditions and Assumptions This transient was analyzed with REDY at 102 percent of rated power, 100 percent of rated core flow, and BOC exposure. Conservative scram, void and Doppler reactivity multipliers for power decrease are used.

BFN has relay-type circuitry (RTS) which will generate an independent reactor scram and MSIV closure signal due to loss of power to the scram and MSIV solenoids.

Both signals are assumed to actuate at 5 seconds after the loss of offsite power.

Loss of main condenser circulating water pumps causes the condenser vacuum to drop to the turbine trip setting by about 6 seconds. Since the MSIVs close at 5 seconds, the turbine trip and bypass closure have no effect on the transient. The bounding 3 seconds MSIV closure time is assumed.

14.5.5.4.1.3 Interpretation of Transient Results Figures 14.5-18a and b illustrate this transient with BOC exposure conditions. The initial portion of the transient is very similar to the loss of all feedwater described above except for the recirculation pump trip. Initiation of scram, isolation valve closure, and turbine trip all occur between 5 to 6 seconds and the transient changes to that of an isolation event. Bypass operation lasts for about 2 seconds until MSIV 14.5-32

BFN-27 total closure, after which the MSRVs open and close at their respective pressure setpoints as the remainder of the stored heat is dissipated. Both peak neutron flux and peak heat flux reach only 102 percent of rated, their initial values. Peak vessel pressure reaches 1217 psia, and peak steam line pressure reaches 1200 psia; therefore, the ASME reactor pressure limit is not challenged. With one of the lowest opening setpoint MSRV assumed OOS, the MSRVs reopened and reclosed as the generated heat drops down into the decay heat characteristic. This pressure relief cycle continues with slower frequency and shorter relief discharges as the decay heat drops off up to the time the Residual Heat Removal system, in the shutdown cooling mode, can dissipate the heat. Sensed level does not drop to the RCIC, HPCI, and MSIV isolation initiation setpoints during the analyzed time.

14.5.5.4.2 Loss of All Auxiliary Power Grids 14.5.5.4.2.1 Transient Description An alternate transient results if complete connection with the external grid is lost.

The same sequence as above would be followed except that the reactor would also experience a generator load rejection and its associated scram at the beginning of the transient.

14.5.5.4.2.2 Initial Conditions and Assumptions This transient has been run with the ODYN computer code because of the initial pressurization at 102 percent of rated power and 105 percent of rated core flow. The EOC exposure has been used because the top peaked axial power shape degrades the effectiveness of rod insertion during the reactor scram.

Turbine bypass valves open at 0.1 seconds due to turbine/generator trip and function per design until forced close after reaching the loss of condenser vacuum setpoint.

BFN has relay-type RTS circuitry which will generate an independent reactor scram and MSIV closure signal due to loss of power to the scram and MSIV solenoids.

This condition will occur about 5 seconds after the loss of offsite power. The bounding 3 seconds MSIV closure time is assumed.

14.5.5.4.2.3 Interpretation of Transient Results Figures 14.5-19a and b show the results obtained for this transient. At 0.0 seconds, a full load rejection takes place with its associated scram. Recirculation pumps, condenser circulatory water pumps, and feedwater pumps trip off following the loss of all grid connections. Turbine bypass valves open at 0.1 seconds due to turbine/generator trip and remain available until closed due to reaching the condenser vacuum setpoint at 8 seconds. MSIV closure is completed at 5 seconds after the loss of offsite power. MSRVs open and close at their respective pressure 14.5-33

BFN-27 setpoints. WR sensed level does not drop to the RCIC, HPCI, and MSIV isolation initiation setpoints during the transient event.

Peak vessel pressure reaches 1240 psia and peak steam line pressure reaches 1213 psia; peak heat flux reaches 118 percent of rated and peak neutron flux reaches 373 percent of rated. These results are bounded by other limiting pressurization events such as the LRNBP event.

14.5.6 Events Resulting in a Core Coolant Flow Decrease Events that result directly in a core coolant flow decrease are those that affect the reactor recirculation system. Transients beginning from operating state F are the most severe since only in this state do power levels approach fuel thermal limits.

The following events have been analyzed:

a. Recirculation Flow Control Failure-Decreasing Flow

b. Trip of One Recirculation Pump

c. Trip of Two Recirculation Pumps

d. Recirculation Pump Seizure 14.5.6.1 Recirculation Flow Control Failure - Decreasing Flow 14.5.6.1.1 Transient Description VFD Speed Control:

Several varieties of recirculation flow control malfunctions can cause a decrease in core coolant flow. The manual runback controller could malfunction in such a way to continually command both VFDs to decelerate at the normal runback rate until both pumps are stopped. This event is less severe than the simultaneous tripping of both recirculation pumps as evaluated in paragraph 14.5.6.3.

The remaining recirculation flow controller malfunction is one in which a single flow controller fails and applies a braking action to a single recirculation pump. The pump speed reduction is slower than a recirculation pump seizure as evaluated in paragraph 14.5.6.4.

14.5.6.1.2 Initial Conditions and Assumptions This transient was analyzed with REDY at 102 percent of rated power, 100 percent of rated core flow, and BOC fuel exposure conditions.

Conservative scram, void and Doppler reactivity multipliers for power decrease were used. In loss of recirculation flow transients, less negative void reactivity feedback is more severe since it results in a slower power decay.

14.5-34

BFN-27 For VFD recirculation flow control, it can be conservatively assumed that the pump shaft seizes as in a recirculation pump seizure event. For FANP reload analyses, a more realistic analysis is made that considers the maximum potential braking torque in decreasing flow for the VFD controller to determine the recirculation pump speed deceleration.

14.5.6.1.3 Interpretation of Transient Results VFD speed control:

The results of the VFD controller failure - decreasing flow transient were the same as for a recirculation pump seizure because it was analyzed as a shaft seizure and the near instantaneous stoppage of the pump. The peak neutron and heat fluxes do not increase above initial conditions. The calculated delta-CPR is 0.10, well below that for other types of transients analyzed; therefore, no impact on fuel integrity occurs.

14.5.6.2 Trip of One Recirculation Pump 14.5.6.2.1 Transient Description Normal trip of one VFD driven recirculation loop is accomplished through trip of the VFD or VFD supply breaker. Coastdown with only pump and motor inertia occurs.

This condition is assumed for this calculation.

An abrupt reduction in core flow due to the trip of one of the recirculation pumps increases the core void fraction and, thereby, increases water level and reduces reactor power. The fuel surface heat flux decreases at a slower rate than the flow due to the inherent time constants of the fuel, thus momentarily reducing thermal margins. Should the flow decrease too rapidly, fuel is threatened with a momentary high power/low flow situation. This transient is, therefore, evaluated to ensure adequate thermal margins.

14.5.6.2.2 Initial Conditions and Assumptions This transient was analyzed with REDY at 102 percent of rated power, 100 percent of rated core flow, and BOC fuel exposure conditions. This event is not sensitive to initial core flow and exposure, thus the 100% core flow and BOC condition is chosen as typical representation of the plant operating condition.

In loss of recirculation flow transients, the less negative void reactivity feedback is more severe since it results in a slower power decay. Therefore, conservative scram, void and Doppler reactivity multipliers are used.

14.5-35

BFN-27 The recirculation pump-motor shaft inertia time constants are at minimum values, because it will result in a more severe transient due to the sharper decrease in core flow.

14.5.6.2.3 Interpretation of Transient Results Figures 14.5-21a and b illustrate this transient. The condition assumed for this calculation is a trip of the VFD or VFD supply breaker. A coastdown with only pump and motor inertia occurs. Diffuser flow on the tripped side reverses at about 2 seconds; however, M-ratio in the active jet pumps increases greatly producing about 165 percent of normal diffuser flow. Neither the high level setpoint L8 or low level setpoint L2 are reached during the transient event.

The change in MCPR is small, bounded by the Recirculation Pump Seizure event (Section 14.5.6.4); therefore, no impact on fuel integrity occurs. Neutron and heat flux and vessel and steam line pressure do not exceed their initial values.

14.5.6.3 Trip of Two Recirculation Pumps 14.5.6.3.1 Transient Description VFD speed control:

This two-loop trip provides the evaluation of the fuel thermal margins maintained by the rotating inertia of the recirculation drive equipment. With the VFDs, all two recirculation pump trips will only have the pump and motor inertia during coastdown.

Other than loss of auxiliary power covered in Section 14.5.5.4, loss of Raw Cooling Water (RCW) or an inadvertent RPT System trip could cause a trip to the power of both recirculation pumps.

14.5.6.3.2 Initial Conditions and Assumptions VFD speed control:

This transient was analyzed with ODYN. The initial conditions are 100% power and flow and BOC fuel exposure. The recirculation pump-motor shaft inertia time constants are assumed to be at their minimum values. Because this event is a power decrease event, with no impact on fuel thermal margins, it is sufficient to use representative conditions.

14.5.6.3.3 Interpretation of Transient Results VFD speed control:

14.5-36

BFN-27 An abrupt reduction in core flow, due to the trip of both recirculation pumps, increases the core void fraction and thereby, reduces reactor power and increases water level. The water level change, during the event, is not sufficient to reach either L8 (high level) or L2 (low level). The neutron flux, surface heat flux, steam line pressure and vessel pressure do not increase over the initial conditions. There is no reduction in fuel thermal martins. No scram is initiated directly by the RPT and the power settles out at part-load, natural circulation conditions. Figures 14.5-22c through -22f illustrate this transient.

14.5.6.4 Recirculation Pump Seizure 14.5.6.4.1 Transient Description This case represents an assumed instantaneous seizure of the pump motor shaft of one recirculation pump. Flow through the affected loop is rapidly reduced due to the large hydraulic resistance introduced by the stopped rotor. This causes the core thermal power to decrease and reactor water level to swell. The sudden decrease in core coolant flow while the reactor is at power results in a degradation of core heat transfer which could result in fuel damage.

14.5.6.4.2 Initial Conditions and Assumptions This transient was analyzed with REDY at 102 percent of rated power and 100 percent of rated core flow, at BOC fuel exposure.

In loss of recirculation flow transients, a less negative void reactivity feedback is more severe, since it results in a slower power decay and, thus, results in the smallest margin to the fuel safety limit. Therefore, conservative scram, void and Doppler reactivity multipliers for power decrease are used.

The recirculation pump-motor shaft inertia time constants are at their minimum values, because it will result in a more severe transient due to the sharper decrease in core flow.

14.5.6.4.3 Interpretation of Transient Results Figures 14.5-23a and b illustrate this transient. The drive flow in the seized loop decreases rapidly due to the large pressure loss introduced by the stopped rotor.

Core coolant flow reaches its minimum value at about 1.5 seconds. The reactor water level swells due to this rapid flow reduction, reaching the high water level L8 setpoint at about 3 seconds. This causes a turbine trip (turbine stop valve closure) and reactor scram, feedwater pumps trip, and trip of the remaining recirculation pump. The resulting increase in peak vessel pressure (1152 psia) and peak steam line pressure (1137 psia) do not significantly affect the nuclear system process barriers. The low level L2 setpoint is not reached in this transient.

14.5-37

BFN-27 The peak neutron and heat fluxes did not increase above the initial conditions. The calculated delta-CPR is 0.10, well below that for other types of transients analyzed; therefore, no impact on fuel integrity occurs.

14.5.6.4.4 Recirculation Pump Seizure for Single Loop Operation This case represents an assumed instantaneous seizure of the pump motor shaft of the operating recirculating pump during single loop operation (SLO). Flow through the affected loop is rapidly reduced due to the large hydraulic resistance introduced by the stopped rotor. With both recirculation loops idle, the core transitions to natural convection cooling. This sudden decrease in core coolant flow while the reactor is at power results in a degradation of core heat transfer, which could result in fuel damage.

The SLO pump seizure is potentially more severe than the two loop case due to the complete loss of recirculation drive flow.

For AREVA designed fuel cycles, the SLO pump seizure transient is analyzed on a cycle specific basis to determine if this event could set the MCPR operating limit for SLO conditions. The results of this analysis for the most recent reload cycle are reflected in the unit-specific and cycle-specific reload safety analysis report.

14.5.7 Events Resulting in a Core Coolant Flow Increase Events that result directly in a core coolant flow increase are those that affect the reactor recirculation system. The following events have been analyzed:

a. Recirculation Flow Control Failure - Increasing Flow

b. Startup of Idle Recirculation Pump For both transients, no credit is conservatively taken for the APRM flow-biased flux scram occurrence.

14.5.7.1 Recirculation Flow Controller Failure - Increasing Flow 14.5.7.1.1 Transient Description VFD speed control:

In this event, it is postulated that a single flow controller fails and signals the VFD to increase the pump speed. (The VFD controls are designed such that expected failures only affect one pump.) The maximum pump run-up rate is defined by using the maximum pump motor torque. The maximum pump motor torque is defined by the breakdown torque (maximum torque the motor develops under increasing load 14.5-38

BFN-27 without abruptly loosing speed). The breakdown torque is applied to the pump, and the transient model determines the resultant pump run-up rate. The average run-up rate, for the first second, is 745 rpm/sec. At about 2.4 sec the pump speed reaches 1725 rpm. A pump trip is nominally designed to occur at the frequency (57.5Hz) associated with this speed. No credit is taken for this trip. The rapid increase in core inlet flow causes a large neutron flux peak which may exceed the high flux scram setpoint.

14.5.7.1.2 Initial Conditions and Assumptions VFD speed control:

This transient was analyzed with ODYN starting from the power level and flow corresponding to the lower end of the normal design flow control range on the maximum control rod line when the reactor is initially at 75 percent of rated and core flow is at 52 percent of rated.

One recirculation pump is driven with the physical maximum torque-breakdown torque. The high frequency pump trip is conservatively not credited. However, to assess the control system responses, a pump trip is simulated to occur at 3 seconds, which is after the time of MCPR.

14.5.7.1.3 Interpretation of Transient Results VFD speed control:

Figures 14.5-24c through -24f illustrate this transient. At a time of one second, upward failure of the speed controller causes the VFD to increase the frequency at a rate such that the pump-motor operates at breakdown torque continuously. The resulting increase in core flow causes an increase in reactor power. No credit is conservatively taken for the APRM flow-flow biased flux scram. High flux scram setpoint is reached at 1.9 seconds. The rapid increase in core flow causes the void fraction to initially decrease and the water level to drop. As the system pressure decreases, following the reactor scram, the reactor water level rises but does not reach the high level L8 setpoint. Subsequently, the water level turns around but does not decrease to the low level L2 setpoint.

The changes in the nuclear system pressure are not significant with regard to overpressure. The pressure decreases over most of the transient. Peak steam line pressure reaches 1017 psia while peak vessel pressure reaches 1053 psia. Peak neutron flux reaches 181 percent of rated at 2.1 seconds. The maximum heat flux is 94% of rated at 2.4 seconds. The calculated delta-CPR is 0.14 (at 2.7 seconds),

less than that for the bounding transients (TTNBP, LRNBP, and FWCF).

Considering that additional margin is provided by the ARTS-based off-rated power and flow dependent thermal limits (NEDC-32433-P, Maximum Extended Load Line 14.5-39

BFN-27 Limit and ARTS Improvement Program Analyses for Browns Ferry Nuclear Plant Units 1, 2, and 3, April 1995), it is clear that there is substantial margin between this event and the bounding transients, i.e., no violation of fuel integrity occurs.

14.5.7.2 Startup of Idle Recirculation Loop 14.5.7.2.1 Transient Description The normal procedure for the startup of an idle recirculation loop requires the warm up of the idle drive loop water to within 50 degrees F of the active drive loop water by permitting the pressure head by the active jet pumps to cause reverse flow through the idle loop. This transient considers the failure wherein the loop drive water has been allowed to cool down to near ambient temperature, and the idle recirculation loop starts up without warming the drive loop water. The thermal-hydraulic perturbation will cause a spike in core thermal power.

14.5.7.2.2 Initial Conditions and Assumptions VFD speed control:

The transient has been analyzed with ODYN. The following initial conditions were assumed:

a. One recirculation loop is idle and filled with cold water (100 degrees F minimum).

b. The active recirculation pump is operating at a speed that produces about 150 percent of normal rated jet pump diffuser flow in the active jet pumps.

c. The core is receiving 51.6 percent of its normal rated flow; the remainder of the coolant flows in the reverse direction through the inactive jet pumps.

d. The initial core power level is 75% of rated. This power level is the highest anticipated power for single loop operation. No high flux scram is anticipated with the VFDs; therefore, the 75% power case is the limiting condition. A 30% power case is not required.

e. Startup acceleration rate is 150 rpm/sec.

f. Startup maximum pump speed is 400 rpm.

g. The idle recirculation pump suction valve is open, the pump discharge valve is closed.

14.5-40

BFN-27

h. No credit is given to the functionality of the APRM flow-biased flux scram. Only the high neutron flux scram is assumed in the analysis.

The loop startup transient sequence is:

a. The idle loop pump is started at 0 seconds, with a startup rate of 150 rpm/sec.

b. The pump reaches maximum speed of 400 rpm in less than 4 seconds.

c. The pump discharge valve is opened, coincident with the startup of the idle loop pump at 0 seconds. A nonlinear 30 second valve opening characteristic is used (normal procedure would delay valve opening to separate the two portions of the flow transient and make sure the idle loop water is properly mixed with the hot water in the vessel.)

14.5.7.2.3 Interpretation of Transient Results VFD speed control:

Figures 14.5-25c through -25f illustrate this transient. While the pump quickly reaches maximum speed (in less than 4 seconds), the loop flow increases slowly mirroring the flow area of the discharge valve. Between 8 and 10 seconds, the discharge valve flow area increases rapidly. After 10 seconds, the discharge valve offers little hydraulic resistance and is essentially full open. In response to the discharge valve flow area increase, the loop flow increases rapidly between 8 and 10 seconds. The core flow and neutron flux likewise shows surges in the same time frame. The high neutron flux scram setpoint is not reached. Subsequent to this early power surge, driven by flow change, the power continues increasing slowly as the cooler water of the idle loop makes its way into the core. The power increase is terminated once all of the cooler water is discharged from the idle loop.

An early neutron flux peak, in response to the rapid core flow increase, of 87% of rated occurs at 9 seconds. The peak neutron flux of 93% of rated occurs at 75 seconds (time at which the cooler water is finally discharged from the idle loop).

The corresponding peak heat flux is 93% of rated. Peak steam line and vessel pressures are 1017 and 1045 psia, both occurring at about 76 seconds. No damage occurs to the clad barrier.

Application of the MCPR(P), MCPR(F), MAPFAC(P), and MAPFAC(F) limit curves assures no fuel damage occurs from events originated from low power/flow conditions.

The results show that this event is non-limiting for fuel thermal margins.

14.5-41

BFN-27 14.5.8 Events Resulting in Excess of Coolant Inventory 14.5.8.1 Feedwater Controller Failure Maximum Demand (FWCF) 14.5.8.1.1 Transient Description An event which can cause directly an excess of coolant inventory is one in which makeup water flow is increased without changing other core parameters. The FWCF is the limiting event of the excess coolant inventory type. The FWCF to maximum demand is one of several potentially limiting events normally included in the cycle-specific reload licensing analyses to establish the MCPR operating limits.

The analysis results for the FWCF to Maximum Demand event are present in the Reload Licensing Report for each cycle.

The FWCF event is a direct failure of a control device which results in the feedwater controller being forced to its upper limit, creating the maximum flow demand.

Increases in feedwater flow result in increases in the core inlet subcooling and in the reactor water level. When the high water level setpoint is reached, the main turbine and feedwater pumps are tripped; and scram occurs due to the turbine stop valves closure.

14.5.8.1.2 Input Data and Assumptions For GE reload analyses, the ODYN model was used to simulate this transient event, consistent with the current reload licensing methodology [General Electric Company, "General Electric Standard Application for Reactor Fuel", NEDE-24011-P-A-13, August 1996, and the US Supplement, NEDE-24011-P-A-13-US, August 1996]. For AREVA reload analyses, computer codes and analysis methodology described in Section 3.7.7.1.2 MCPR Operating Limit Calculation Procedure are used.

The FWCF event was analyzed at 100% power and at 75% rated power as a typical off-rated operating condition. Since the ICF condition produces top peaked axial power shapes which degrade scram effectiveness, ICF was assumed for both power levels (e.g., 100P/105F and 75F/108F). Normal feedwater temperature was assumed for the rated power condition while reduced feedwater temperature was assumed for the off-rated power case for a maximum subcooling effect on the off-rated transient response. The EOC exposure was assumed to maximize the transient severity because the scram effectivity is reduced with the all-rods-out condition and the top peak power shape.

Normal feedwater temperature conditions, at 100 percent power, were found to be more limiting than reduced temperature conditions because of the large pressurization component of delta-CPR caused by the reduced steam line pressure drop. The large pressurization component of delta-CPR dominates over the 14.5-42

BFN-27 subcooling component of delta-CPR; therefore, the case with larger steam flow was more severe.

The feedwater runout flow will be adjusted as needed for reload licensing analyses to reflect updated equipment performance information.

14.5.8.1.3 Interpretation of Transient Results A plant-specific response of the BFN plant to a FWCF event is shown in Figures 14.5-28 and 14.5-29. The transient was initiated from 75P/108F as a typical off-rated operating state point. This low power high flow condition produces a more severe steam/feed flow mismatch and level transient (Figure 14.5-28) than at high power high flow condition, as shown in Figure 14.5-29. The feedwater pumps are assumed to accelerate to the maximum feedwater controller speed.

From Figure 14.5-28, sensed and actual water level increase during the initial part of the transient at about 3.0 inches/second. The high water level (L8) main turbine trip and feedwater turbine trip is initiated at 10 seconds preventing excessive carryover from damaging the turbines. The EOC-RPT is tripped simultaneously with the high reactor water level trip signals. A reactor scram occurs following the turbine trip event, limiting the neutron flux peak (283 percent of rated), surface heat flux peak (98 percent of rated), and fuel thermal transient excursion (delta-CPR = 0.24). The application of the ARTS-based MCPR(P), MCPR(F), MAPLHGR(P), and MAPLHGR(F) curves ensure the fuel integrity at off-rated power/flow conditions

[NEDC-32433-P, "Maximum Extended Load Line Limit and ARTS Improvement Program Analyses for Browns Ferry Nuclear Plant Units 1, 2 and 3", April 1995 and "Power Uprate Evaluation Task Report for BFNP Units 1, 2 & 3 Transient Analysis",

GE-NE-B13-01866-05, August 1997]. For FANP reload fuels, LHGR(P) and LHGR(F) limits are used instead of MAPLHGR(P) and MAPLHGR(F) limits. For FANP reload analyses, the power and flow dependent MAPLHGR, LHGR and MCPR limits are developed on a cycle-specific basis.

The turbine bypass system opens to limit the pressure rise. The lower set relief valves open only momentarily and no excessive overpressure of the nuclear system process barrier occurs (peak steam line pressure 1140 psia). The bypass valves close later bringing the pressure in the vessel (peak vessel pressure 1165 psia) under control during reactor shutdown.

In Figure 14.5-29, for 100 percent rated power and ICF, a peak neutron flux of 475 percent of rated and a peak heat flux of 127 percent of rated are reached. Peak steam line pressure reaches a value of 1217 psia while peak vessel pressure reaches a value of 1250 psia. No fuel damage occurs (delta-CPR = 0.19) with the application of the adequate operating limit CPR associated with this limiting transient.

14.5-43

BFN-27 At rated power, the delta-CPR resulting from the LRNBP and FWCF events is more severe than the delta-CPR resulting from any other pressurization events. As power is reduced to 75 percent of rated power or less, the delta-CPR resulting from the FWCF event is higher than the one from the LRNBP event. For the FWCF, the power decrease results in a greater mismatch between runout and initial feedwater flow resulting in an increase in reactor subcooling and a more severe change in thermal limits during the event. Therefore, this transient along with the LRNBP defines the MCPR(P) and MAPLHGR(P) or LHGR(P) curves which protect the fuel integrity for low power.

For power operation below the Pbypass, the transient characteristics change due to the bypass of the direct scram on the closure of the TCVs or TSVs. The high neutron flux scram signal is conservatively bypassed, and the high pressure scram is delayed until the vessel pressure reaches this setpoint. The relatively large differences in delta-CPR between the LRNBP and FWCF which are seen between 75 percent and 30 percent rated are significantly reduced below Pbypass.

14.5.8.2 Feedwater Control Failure/Maximum Demand with EOC-RPT-OOS EOC-RPT-OOS eliminates the automatic Recirculation Pump Trip signal when Turbine Trip occurs increasing the severity of the transient responses.

Figure 14.5-30 shows the transient results for the 100 percent of rated power and 105 percent of rated core flow event. EOC exposure and normal feedwater temperature have been the conditions assumed for this transient analysis, the same as in the transient analysis with EOC-RPT in service described above.

The neutron flux peaks at 570 percent of initial, the average heat flux peaks at 132 percent of its initial value. The peak pressure at the bottom of the vessel is 1260 psia which is well below the ASME upset code limit transients limit of 1375 psig while the peak steam line pressure is 1219 psia. The calculated delta-CPR of this transient at the stated conditions is 0.23.

The penalty of EOC-RPT-OOS is around 0.04 in delta-CPR. At off-rated power/flow conditions, such as the 75P/52F point, the penalty is smaller because of the relatively reduced beneficial effect of EOC-RPT.

The impact of the EOC-RPT-OOS on the transient fuel protection at off-rated power/flow conditions has been addressed with the appropriate revision to the ARTS-based power-dependent MCPR and MAPLHGR limits, as required

[NEDC-32774P, Rev 1, "Safety Analyses for Browns Ferry NP Units 1, 2 and 3.

Turbine Bypass and End-of-Cycle Recirculation Pump Trip Out-of-Service",

September 1997]. For AREVA reload analyses, cycle-specific RPT-OOS fuel thermal limits are determined.

14.5-44

BFN-27 14.5.8.3 Feedwater Control Failure/Maximum Demand with TBP-OOS The Turbine Bypass Out-of-Service produces a different evolution in the limiting overpressurization transients. The overpressurization is faster because the bypass system is not operable, thus the pressure setpoints are reached earlier. The positive reactivity insertion due to moderator void collapse is more severe, and this results in a higher delta-CPR and, subsequently, a higher OLMCPR.

The FWCF event normally assumes that turbine bypass system is functional, and therefore, this transient is strongly affected by TBP-OOS.

Figure 14.5-31 shows the transient response at 100 percent of rated power and 105 percent of rated core flow. EOC exposure and normal feedwater temperature have been the conditions assumed for this transient analysis.

The neutron flux peaks at 628 percent of initial; the average heat flux peaks at 134 percent of its initial value. The peak pressure at the bottom of the vessel is 1280 psia which is well below the ASME upset code limit transients limit of 1375 psig while the peak steam line pressure is 1248 psia. The calculated delta-CPR of this transient at the stated conditions is 0.24. At rated power the impact on delta-CPR caused by TBP-OOS is approximately 0.05.

The impact of the TBP-OOS on the transient fuel protection at off-rated power/flow conditions has been addressed with the appropriate revision to the ARTS-based power-dependent MCPR and MAPLHGR limits, as required [NEDC-32774P, Rev 1, "Safety Analyses for Browns Ferry NP Units 1, 2 and 3. Turbine Bypass and End-of-Cycle Recirculation Pump Trip Out-of-Service", September 1997]. For AREVA reload analyses, cycle-specific TBP-OOS fuel thermal limits are determined.

14.5.9 Loss of Habitability of the Control Room Loss of habitability of the control room is arbitrarily postulated as a special event to demonstrate the ability to safely shutdown the reactor from outside the control room.

(For additional information, see Section 7.18 - Backup Control System.)

14.5-45