ML18065B273

LLC Supplemental Response to NRC Request for Additional Information No. 36 (Erai No. 8815) on the NuScale Design Certification Application

ML18065B273
Person / Time
Site:	NuScale
Issue date:	03/05/2018
From:	Wike J NuScale
To:	Document Control Desk, Office of New Reactors
References
RAIO-0318-58840
Download: ML18065B273 (12)

Text

RAIO-0318-58840 March 05, 2018 Docket No.52-048 U.S. Nuclear Regulatory Commission ATTN: Document Control Desk One White Flint North 11555 Rockville Pike Rockville, MD 20852-2738

SUBJECT:

NuScale Power, LLC Supplemental Response to NRC Request for Additional Information No. 36 (eRAI No. 8815) on the NuScale Design Certification Application

REFERENCES:

1. U.S. Nuclear Regulatory Commission, "Request for Additional Information No. 36 (eRAI No. 8815)," dated May 26, 2017

2. NuScale Power, LLC Response to NRC "Request for Additional Information No. 36 (eRAI No.8815)," dated July 21, 2017 The purpose of this letter is to provide the NuScale Power, LLC (NuScale) supplemental

response to the referenced NRC Request for Additional Information (RAI).

The Enclosure to this letter contains NuScale's supplemental response to the following RAI

Question from NRC eRAI No. 8815:

v 15-2 This letter and the enclosed response make no new regulatory commitments and no revisions to

any existing regulatory commitments.

If you have any questions on this response, please contact Darrell Gardner at 980-349-4829 or

at dgardner@nuscalepower.com.

Sincerely, Jennie Wike Manager, Licensing NuScale Power, LLC Distribution: Samuel Lee, NRC, OWFN-8G9A Rani Franovich, NRC, OWFN-8G9A Prosanta Chowdhury NRC, OWFN-8G9A : NuScale Supplemental Response to NRC Request for Additional Information eRAI No. 8815 NuScale Power, LLC 1100 NE Circle Blvd., Suite 200 Corvalis, Oregon 97330, Office: 541.360.0500, Fax: 541.207.3928 www.nuscalepower.com

RAIO-0318-58840 :

NuScale Supplemental Response to NRC Request for Additional Information eRAI No. 8815 NuScale Power, LLC 1100 NE Circle Blvd., Suite 200 Corvalis, Oregon 97330, Office: 541.360.0500, Fax: 541.207.3928 www.nuscalepower.com

Response to Request for Additional Information Docket No.52-048 eRAI No.: 8815 Date of RAI Issue: 05/26/2017 NRC Question No.: 15-2 In accordance with 10 CFR 50 Appendix A GDC 35, Emergency Core Cooling, the emergency

core cooling system (ECCS) safety function shall be to transfer heat from the reactor core

following any loss of reactor coolant at a rate such that (1) fuel and clad damage that could

interfere with continued effective core cooling is prevented and (2) clad metal-water reaction is

limited to negligible amounts. Suitable redundancy in components and features, and suitable

interconnections, leak detection, isolation, and containment capabilities shall be provided to

assure that for onsite electric power system operation (assuming offsite power is not available)

and for offsite electric power system operation (assuming onsite power is not available) the

system safety function can be accomplished, assuming a single failure. The staff notes that the

applicant departs from GDC 35 by adopting principle design criteria (PDC) 35 presented in

FSAR Tier 2, Section 3.1.

To meet the requirements mentioned above, as they relate to the ECCS providing abundant

core cooling during an accident, the accident analysis should show that fuel and clad damage

that could interfere with continued effective core cooling is prevented assuming a single failure.

In FSAR Tier 2, Section 15.0.0.5, Limiting Single Failures, the applicant discusses, in general,

how single failures are applied throughout the accident analysis. However, the applicant does

not discuss an ECCS valve single failure, in terms of failing to remain closed when required to

be closed. The staff notes that when an ECCS valve fails by opening when required to stay

closed, the resulting transient could produce more limiting consequences in terms of minimum

critical heat flux ratio (MCHFR), containment pressure, etc. One example of this is given in

FSAR Tier 2, Section 15.6.6, Inadvertent Operation of Emergency Core Cooling System, and

is discussed in the following paragraph.

The staff understands that, for the NuScale design, as discussed in FSAR Tier 2, Section 6.3

and Section 15.6.6, in order for the ECCS valves to open, two things need to happen: 1.) the

direct current (DC) solenoid-operated trip pilot valve must open either on an ECCS actuation

signal or loss of power; and 2.) the inadvertent actuation block (IAB) valve must open. As stated

in FSAR Tier 2, Section 15.6.6.1, Identification and Causes of Accident Description, the staff

recognizes that the applicant does not analyze this event assuming the cause described above

where two things need to occur. However, the applicant analyzes this event assuming the cause

of the ECCS valve opening is a mechanical failure of the valve itself and takes no single failure NuScale Nonproprietary

in the analysis. Assuming a loss of all power and applying a single failure to one IAB valve in the applicants current analysis in FSAR Tier 2, Section 15.6.6, then, concurrent with the initiating event (i.e. one ECCS valve fails mechanically and opens) another ECCS valve opens at time t=0 due to a loss of power to its DC solenoid-operated trip pilot valve and a single failure of its IAB valve. Applying the above assumptions results in two ECCS valves opening at time t=0 with the reactor still at power (the staff notes there is a delay in reactor trip after a loss of all power at time t=0). The resulting minimum departure from nucleate boiling ratio (MDNBR) of this event could be more limiting than how the applicant currently analyzes the event in the FSAR.

Furthermore, reviewing other Chapter 15 events, the staff understands that taking the single failure of an IAB valve may produce more severe consequences than what the applicant has currently analyzed.

Based on docketed information, the staff is unable to determine if the applicants current Chapter 15 analyses represent the most limiting events because the applicant does not apply the single failure assumption to the IAB valve. Furthermore, the staff recognizes that GDC 35 requires application of the single failure. The staff requests the applicant provide justification in the FSAR for why it does not assume the single failure of an IAB valve in any of the Chapter 15 accident analyses. The staff requests the applicant to modify the FSAR as necessary to address the single failure of an IAB concern.

NuScale Response:

This response provides supplemental information to the response to RAI 8815 which was provided July 21, 2017 (ML17202V093). As a result of discussions with NRC staff during a FSAR Chapter 15 audit call on January 18, 2018, NuScale proposed to clarify the single failure discussion in FSAR Section 15.0.0.5 relating to the inadvertent actuation block (IAB) feature.

NuScale also proposed to clarify the discussion of initiating events for FSAR Section 15.6.6, Inadvertent Operation of Emergency Core Cooling System (ECCS), including the potential for an ECCS valve to partially open.

The IAB is a sub-component feature of an ECCS valve. A single failure discussion concerning the IAB was added to the FSAR Section 15.0.0.5 as part of the initial response to eRAI 8815.

This discussion is clarified in the attached FSAR pages to indicate that the IAB is a passive device that operates on stored energy and does not rely on external power sources or signals to perform its function. A reference was also added stating that the opening of an ECCS valve due to failure of the IAB function is evaluated as an initiating event in Section 15.6.6.

The discussion of the opening of an ECCS valve in Section 15.6.6 was expanded to provide more detail on the IAB function. Additional information was also provided on the determination of the limiting event and single failures evaluated.

The inadvertent opening of reactor vent valve (RVV) produces a more limiting minimum critical heat flux ratio (MCHFR) than the opening of a reactor recirculation valve (RRV) or a reactor NuScale Nonproprietary

safety valve (RSV). An ECCS Valve (RVV or RRV) will open when the force from the pressure in the valve control chamber is less than the opening force of the main valve spring plus the pressure force on the underside of the disc. Depressurization of the control chamber occurs when coolant is lost from the control chamber at a rate greater than is made up through the control chamber orifice that connects to the RCS. The principle method to depressurize the control chamber is by opening the associated ECCS trip valve, which drains the RCS fluid in the chamber to the containment unless it is blocked by the IAB function. The control chamber fluid can also be drained by a mechanical failure of the valve assembly.

If an ECCS trip valve opens, the IAB feature will stop the loss of fluid from the control chamber by blocking the trip line flow path which occurs if the differential pressure between the RCS and containment is greater than the IAB threshold. The threshold is determined by the opening force of a spring internal to the IAB device. The flowpath from the control chamber through the trip line is blocked by a rod in the IAB moving into its seat. The IAB is actuated by the differential pressure between the RCS on one side of the rod and the pressure in the trip line. When a trip valve opens, fluid drains into containment and the pressure in the trip line decreases, which creates a large differential pressure across the IAB rod. When the force from the differential pressure across the arming rod is greater than the IAB spring force, the rod moves into its seat and blocks the control chamber fluid from exiting through the trip line. The pressure in the control chamber is maintained by fluid entering through the orifice from the RCS, which prevents the main valve from opening.

The IAB function is passive as discussed in Section 15.0.0.5. A failure of one of the IAB devices on an ECCS valve could result in the opening of a single ECCS valve if an ECCS signal is present (due to a single active failure in the module protection system) or DC power (EDSS) is not available (concurrent failure). Since the IAB is a passive component, failure of this device is treated as an initiating event. Depressurization of the valve control chamber by a mechanical failure of the valve assembly, is a similar initiating event. The mechanical failure results in an ECCS valve opening independent of the status of an ECCS signal or DC power availability.

Single active failures were considered in each of these events but did not result in more limiting results for the acceptance criteria. The limiting event analyzed is a mechanical failure causing an RVV to open. The single failure evaluation considered one RVV failing to open, one RRV failing to open, or failure of one ECCS division to actuate causing one RVV and one RRV to fail to open. The evaluation compared the results to a scenario with no single failure. The limiting MCHFR occurs in the first one second of the RVV opening. No failures occur in a timeframe that affect this result. The evaluation concludes that the single failure cases have no adverse impact on the limiting MCHFR or other acceptance criteria evaluated in this analysis. Therefore, the scenario with no single failure is limiting for this analysis. The analysis also assumes AC and DC power are available because the loss of power causes an immediate reactor trip, which results in less limiting MCHFR and other acceptance criteria parameters.

A sub-component level Failure Modes and Effects Analysis (FMEA) evaluated the potential for a partial opening of an ECCS valve. The FMEA considered failures of the trip and reset valves, the IAB valve, valve tubing and the main valve components. None of the credible component NuScale Nonproprietary

failure mechanisms that could prevent an ECCS valve from actuating to the full open position have the potential to cause an ECCS valve to open. Therefore, a partial opening of an ECCS valve is not a credible initiating event. If an ECCS actuation were demanded on a valid signal or loss of DC power and one ECCS valve were to partially open, the results would be bounded by the existing single failure assumption that one ECCS valve, or an RVV and RRV pair, fail to open.

Impact on DCA:

FSAR Section 15.0.0.5 and Section 15.6.6 KDYHEHHQ revised as described in the response aboveand as shown in the markup provided in this response.

NuScale Nonproprietary

NuScale Final Safety Analysis Report Transient and Accident Analyses The principal considerations in applying the single-failure criterion to NPM design basis event evaluations are discussed below.

1) Active failures are considered for mechanical components.

• Design basis event mitigation credits valves that are classified as safety related.

Valves move to their safety or "fail safe" position when the externally-applied motive force is removed.

• Check valves in the feedwater system are used to mitigate the consequences of a DBE.

There is one safety-related check valve and one nonsafety-related backup check valve in each feedwater line (four total check valves per NPM). The feedwater system check valves are credited to mitigate the consequences of the feedwater line break event.

The feedwater system check valves are not credited for containment isolation but for short-term retention of decay heat removal system (DHRS) inventory, until the feedwater isolation valve (FWIV) or its backup (nonsafety-related) feedwater regulating valve closes. The FWIV performs the containment isolation function and the feedwater regulating valve serves as a backup to the FWIV.

2) Passive failure of a single SSC is considered a potential event initiator, but not as a single failure in the short term.

• Passive failures of fluid systems are considered only on a long-term basis except for check valves whose failure must be postulated coincident with its required response to a DBE.

• For the purpose of considering passive single failures, the short term is defined as the period up to 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> following an initiating event.

• Components whose proper function has been demonstrated and documented are not considered a credible single failure (e.g., American Society of Mechanical Engineers code safety valves).

RAI 15-2, RAI 15-2S1

• The ECCS valve inadvertent actuation block (IAB) is considered a passive component. The IAB feature prevents the ECCS valves from opening until RCS pressure drops below the IAB threshold. The IAB operates based on differential pressure between the RCS and containment and requires no external power, signals or motive force to maintain the ECCS valves closed. The IAB function meets the deterministic and probabilistic criteria set out in SECY-94-084 for passive components.The ECCS valve inadvertent actuation block (IAB) is a passive sub-component feature of the ECCS valve. The IAB feature prevents the ECCS valves from opening until RCS pressure drops below the IAB threshold established by the IAB opening spring. The IAB operates based on stored energy resulting from the differential pressure between the RCS and containment. The IAB requires no AC or DC power, actuation signals or external motive force to maintain the ECCS valves closed. The IAB function meets the deterministic and probabilistic criteria in SECY-94-084 for passive components.

Therefore, the failure of the ECCS IAB function is evaluated as an initiating event, described in Section 15.6.6.

Tier 2 15.0-6 Draft Revision 2

NuScale Final Safety Analysis Report Decrease in Reactor Coolant Inventory

2) Maximum cladding oxidation - The calculated maximum total oxidation of cladding shall not exceed 17 percent of the total cladding thickness before oxidation.

3) Maximum hydrogen generation - The calculated total amount of hydrogen generated from the chemical reaction of the cladding with water or steam shall not exceed 0.01 times the hypothetical amount that would be generated if all of the metal in the cladding surrounding the fuel, excluding the cladding surrounding the fuel rod plenum volume, were to react.

4) Coolable geometry - Calculated changes in core geometry shall be such that the core remains amenable to cooling.

5) Long-term cooling - After any calculated successful initial operation of the ECCS, the calculated core temperature shall be maintained at an acceptably low value and decay heat shall be removed for the extended period of time required by the long-lived radioactivity remaining in the core.

As discussed in Section 15.0.2, acceptance criteria 1 through 4 are met and no fuel failure occurs by demonstrating that the collapsed liquid level remains above the top of the active fuel, MCHFR remains greater than the safety limit, and containment pressure and temperature remains within design limits. Section 15.6.5.3.3 and Table 15.6-14 demonstrate that the collapsed level remains above the top of the active fuel (Figure 15.6-45), MCHFR remains greater than the safety limit, and containment pressure and temperature remain within design limits. Therefore, acceptance criteria 1 through 4 are met.

The long-term cooling acceptance criterion 5 is also met. As discussed in Section 15.6.5.3.3, the core temperature is maintained at an acceptably low value and decay heat is removed for 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> after the initiation of the event. The resultant core temperature and inventory is sufficient to preclude boron precipitation.

15.6.6 Inadvertent Operation of Emergency Core Cooling System 15.6.6.1 Identification of Causes and Accident Description RAI 15-2S1 An inadvertent operation of emergency core cooling system (ECCS) is defined as an accidental reactor vessel depressurization and decrease of reactor vessel coolant inventory that could be caused by a spurious electrical signal, hardware malfunction, or operator error. The NuScale design of ECCS is described in Section 6.3. The ECCS consists of three RVVs exiting the top of the RPV and two RRVs creating an opening to the RPV in the downcomer region above the core. Each ECCS valve includes an inadvertent actuation block (IAB) feature to reduce the frequency of inadvertent opening of the valve during power operation. Section 3.9.1 provides a description of possible failures of the ECCS valves, and concludes that the inadvertent opening of more than one ECCS valve is considered a beyond design basis event due to the ECCS valve IAB devicefeature. Thus, the inadvertent operation of ECCS consists of the Tier 2 15.6-19 Draft Revision 2

NuScale Final Safety Analysis Report Decrease in Reactor Coolant Inventory spurious opening of one RVV or one RRV. The failure of an ECCS valve to a partially open position was evaluated and determined not to be a credible initiating event.

RAI 15-2S1 An inadvertent ECCS signal coincident with a single failure of one of the IAB devices on an ECCS valve could result in opening of that valve at RCS operating pressure. A mechanical failure of an ECCS valve could also result in the opening of a single ECCS valve, where the valve opening is considered the initiating event. The mechanical failure of an ECCS valve bounds the inadvertent ECCS actuation signal coincident with a single failure of an IAB device because it takes two failures for an ECCS valve to open due to an inadvertent ECCS actuation signal. Therefore, the event analyzed for an inadvertent operation of ECCS is a mechanical failure of an RVV or RRV.The inadvertent opening of an RVV produces a more limiting MCHFR than the opening of an RRV or RSV.

An RVV will open when the force from the pressure in the valve control chamber is less than the opening force of the main valve spring plus the pressure force on the underside of the disc. Depressurization of the control chamber occurs when coolant is lost from the control chamber at a rate greater than is made up through the control chamber orifice that connects to the RCS. The principle method to depressurize the control chamber is by opening the associated ECCS trip valve, which drains the RCS fluid in the chamber to the containment unless it is blocked by the IAB function. The control chamber fluid can also be drained as a result of a mechanical failure of the valve assembly.

RAI 15-2S1 If an ECCS trip valve opens, the IAB feature will stop the loss of fluid from the control chamber by blocking the trip line flow path if the differential pressure between the RCS and containment is greater than the IAB threshold. The threshold is determined by the opening force of a spring internal to the IAB device. The flowpath from the control chamber through the trip line is blocked by a rod in the IAB arming valve moving into its seat. The IAB is actuated by the differential pressure between the RCS on one side of the rod and the pressure in the trip line. When a trip valve opens, fluid drains into containment and the pressure in the trip line decreases, which creates a large differential pressure across the rod. When the force from the differential pressure across the rod is greater than the IAB spring force, the rod moves into its seat and blocks the control chamber fluid from exiting through the trip line. The pressure in the control chamber is maintained by fluid entering through the orifice from the RCS, which prevents the ECCS valve from opening.

RAI 15-2S1 The IAB function is a passive sub-component feature of an ECCS valve as discussed in Section 15.0.0.5. A failure of one of the IAB features on an ECCS valve could result in the opening of a single ECCS valve if an ECCS actuation signal is present or DC power (EDSS) is not available (causes trip valve to fail open). Since the IAB is a passive component, failure of this device is an initiating event. Depressurization of the valve control chamber by a mechanical failure of the valve assembly is a similar initiating event. The mechanical failure results in an ECCS valve opening independent of the status of an ECCS signal or DC power availability. Single active failures, discussed in 15.6.6.2, were considered in each of these events but did not result in more limiting Tier 2 15.6-20 Draft Revision 2

NuScale Final Safety Analysis Report Decrease in Reactor Coolant Inventory results for the acceptance criteria. The limiting event analyzed is a mechanical failure of the valve that depressurizes the control chamber at operating pressure.

The spurious opening of a single ECCS valve is not expected to occur during the lifetime of a module. However the event is conservatively categorized as an AOO, as indicated in Table 15.0-1.

The inadvertent opening of an RPV valve analysis evaluates the primary system response to the transient to verify that the event meets the acceptance criteria specified in Table 15.0-2.

15.6.6.2 Sequence of Events and Systems Operation Sensitivity analyses are performed to identify the limiting event for the spurious operation of an ECCS valve. The limiting initiating event for this transient is the inadvertent opening of one RVV. The sequence of events is provided in Table 15.6-15.

Unless otherwise specified, the analysis of an inadvertent opening of an RVV assumes the plant control systems and engineered safety features perform as designed, with allowances for instrument uncertainty. No operator action is credited to mitigate the effects of the event.

15.6.6.3 Core and System Performance 15.6.6.3.1 Evaluation Model The thermal hydraulic response to an inadvertent opening of an ECCS valve event exhibits unique transient progression relative to other AOO events analyzed for the NPM. This progression is divided into two phases:

• The first phase is initiated with a spurious opening of an RPV valve (RSV, RVV, or RRV) that results in a blowdown of the RCS into the containment vessel. This breach can be characterized as a steam region breach (i.e., opening of an RSV or RVV) or a liquid region breach (i.e., opening of an RRV). For the limiting event of an inadvertent opening of an RVV, this phase ends when the remaining ECCS valves are actuated as designed by the MPS.

• The second phase begins with ECCS actuation through designed MPS operation and ends when the NPM reaches a safe, stable condition and transitions to long-term ECCS cooling.

These two phases align with the two phases of the LOCA transient progression for the NPM. The LOCA evaluation model and Reference 15.6-1 have:

• identified and ranked important phenomena which occur during these transient phases for the NPM,

• assessed NRELPA5 against separate effects tests and integral effects tests related to these phenomena,

• determined NRELAP5 to be applicable for evaluating these phenomena, and Tier 2 15.6-21 Draft Revision 2

NuScale Final Safety Analysis Report Decrease in Reactor Coolant Inventory

• The following conservative scram characteristics are assumed.

The maximum time delay from the MPS signal to control rod movement (scram) is applied.

The most reactive control rod is assumed to be stuck in the fully withdrawn position.

The bounding control rod drop rate, shown in Figure 15.0-2, is applied.

• Beginning-of-cycle kinetic parameters with an additional 6 percent biasing are used in order to prolong the fission power transient, consistent with Reference 15.6-1.

• Minimal reactivity feedback coefficents are conservatively applied in order to minimize negative feedback, consistent with Reference 15.6-1.

• A bounding bottom peaked axial power shape is applied to maximize the average volumetric coolant temperature in the core, yielding more void generation during the initial transient blowdown. Sensitivity studies confirm that the bottom peak shape is limiting.

• An energy deposition factor of 1.0 is implemented such that all the core power is conservatively deposited in the fuel, consistent with Reference 15.6-1.

• The following loss of power scenarios are considered.

No loss of power - In this scenario, all MPS and ESFs actuate as designed.

The ECCS valve opening is dependent on both the MPS ECCS actuation setpoints on high CNV water level and low RPV riser level, and the IAB release pressure setpoint. Sensitivity studies show that this scenario results in the limiting MCHFR. The all power available scenario is shown to yield the largest decrease in hot channel inlet flow at the time MCHFR occurs.

Reactor power also remains elevated during the time of MCHFR as a reactor trip has not yet occurred.

Loss of normal AC - When normal AC power is lost, the feedwater pumps coast down and a turbine trip is initiated, thus limiting RCS cooling via the secondary system. Reactor trip, containment isolation and DHRS actuation occur after a 60-second delay following a loss of normal AC power. ECCS actuation occurs after a 24-hour delay following a loss of normal AC power.

However, because DC power is still available, the MPS can still actuate a reactor trip containment isolation, and DHRS, earlier if a separate actuation limit is reached. However, DHRS is not credited in this analysis. The event sequence for a loss of normal AC power is similar to that when no power is assumed lost. The primary difference is an earlier termination of secondary cooling. This scenario is non-limiting for the reasons described above.

Loss of the normal DC power system (EDNS) and normal AC - Power to the reactor trip breakers is provided via the EDNS, so the primary difference to a loss of normal AC power is that the reactor trip will occur sooner. This scenario is non-limiting for the reasons described above.

RAI 15-2S1 Loss of the highly reliable DC power system (EDSS), EDNS, and normal AC -

This scenario results in an immediate actuation of the reactor trip system, Tier 2 15.6-24 Draft Revision 2

NuScale Final Safety Analysis Report Decrease in Reactor Coolant Inventory DHRS (although not credited in the analysis), the 24-hour timer for the ECCS valves, and containment isolation. As power to the MPS is lost, the ECCS valve opening is dependent only on the IAB pressure release setpointthreshold. This scenario is non-limiting for the reasons described above.

RAI 15-2S1

• Single failure evaluation of a single RVV to open, a single RRV to open, and failure of one ECCS division (one RVV and one RRV) to open was performed to determine the most conservative scenario. The evaluation showed that the single failure cases have no impact on MCHFR or other acceptance criteria evaluated in this analysis. Therefore, the scenario of no single failure is applied in this analysis.The single failure evaluation considered one RVV failing to open, one RRV failing to open, or failure of one ECCS division causing one RVV and one RRV to fail to open. The evaluation compared the results to a scenario with no single failure. The limiting MCHFR occurs within the first one second of the RVV opening. No failures occur in a timeframe that affect this result. The evaluation showed that the single failure cases have no adverse impact on the limiting MCHFR or other acceptance criteria evaluated in this analysis.

Therefore, the scenario with no single failure is limiting for this analysis.

RAI 15-2S1

• The failure modes that could lead to a partial opening of an ECCS valve were characterized as having a remote probability of occurrence or were determined to not be credible. None of the credible component failure mechanisms that could prevent a full stroke of the ECCS valve have the potential to cause an ECCS valve to open. Therefore, a partial opening of an ECCS valve is not a credible initiating event.

• Allowances for instrument inaccuracy are accounted for in the analytical limits of mitigating systems in accordance with the guidance provided in Regulatory Guide 1.105.

• No operator action is credited.

15.6.6.3.3 Results RAI 15.06.06-1 Figure 15.6-55 to Figure 15.6-68 show the system response to an inadvertent RVV opening event. Table 15.6-17 contains the results of the event. The limiting case is initiated by a spurious opening of an RVV. Sensitivity analysis show that the limiting scenario has all power available and no single failure occurs.

Upon the spurious RVV opening, the large blowdown of the RCS into the containment causes rapid depressurization of the RCS and rapid pressurization of the containment. Spurious RVV flow is shown in Figure 15.6-55 and Figure 15.6-56.

The RCS and containment pressures are shown in Figure 15.6-57. The high containment pressure analytical limit is reached shortly after event initiation. The MPS signal actuates control rod insertion, secondary system isolation, and DHRS actuation. However, DHRS operation is conservatively not credited in this analysis.

RAI 15.06.06-1 Tier 2 15.6-25 Draft Revision 2