Text

Braidwood, Units 1 and 2 and Byron, Units 1 and 2, Updated Final Safety Analysis Report, Revision 14, Chapter 15.0 - Accident Analyses
	ML13004A041
Person / Time
Site:	Byron, Braidwood
Issue date:	12/14/2012
From:	; Exelon Generation Co
To:	; Office of Nuclear Material Safety and Safeguards, Office of Nuclear Reactor Regulation
References
	RS-12-221
	Download: ML13004A041 (722)
	v • d • e

B/B-UFSAR 15.0-1 REVISION 4 - DECEMBER 1992 CHAPTER 15.0 - A CCIDENT ANALYSES 15.0 ACCIDENT ANALYSES

This chapter address es the representative initiating events listed on pages 15-10, 1 5-11, and 15-12 of Reg ulatory Guide 1.70, as they apply.

Certain items in the guide w arrant comme nt, as follows:

Items 1.3 and 2.1 - There are no pressure regulators in the nuclear steam supply system (NSSS) press urized water reactor (PWR) design whose m alfunction or failure could cause a steam flow transient.

In compliance with t he requirements of Regul atory Guide 1.70, a failure mode and effects analysis (FMEA) has been provided for each safety system nee ded to mitigate the consequences of the accidents analyzed in Chapter 15.0. A FMEA for the emergency core cooling system is provided in Secti on 6.3.2.5; for the residual heat removal sy stem in Subsection 5

.4.7.2.5; for the engineered safety features a ctuation system in Subsection 7.3.2; for the c ontrol rod drive system in Subsection 4.6.2; for the reactor trip s ystem in Subsection 7.2.2.1; for the chemical and volume control syst em in Subsection 9.3.4.1.3.9; for the containment spray syst em in Subsection 6.5.2.2; and, for the auxiliary feedwater sy stem in Subsection 10.4.9.3.

Once actuated, t he equipment of a safety system operates in the same manner regardle ss of initiating accident. However, performance depends on the type of acc ident that is being mitigated.

15.0.1 Classification of Plant Conditions

Since 1970, the American Nuclear Society (ANS) c lassification of plant conditions has been used which divides plant conditions into four categories in accordance with anticipated frequency of occurrence and potential radiological consequences to the public.

The four categories are as follows:

Condition I: Normal Operation and Operational Transients. Condition II: Faults of Moderate Frequency. Condition III: Infr equent Faults. Condition IV: Limiting Faults.

The basic principle applied in relating design requirements to each of the conditions is that the most probable occurrences should yield the lea st radiological risk to the public and those extreme situatio ns having the potentia l for the greatest risk to the public sha ll be those least likely to occur. Where applicable, reactor trip system and engineered safeguards functioning is assumed to the extent allowed by considerations

B/B-UFSAR 15.0-2 REVISION 5 - DECEMBER 1994 such as the single failure criterion , in fulfilling this principle.

15.0.1.1 Condition I - Normal Operation and Operational Transients Condition I occurrences are those which are expected frequently or regularly in the course of power op eration, refueling, maintenance, or maneuver ing of the plant.

As such, Condition I occurrences are accommod ated with margin between any plant parameter and the va lue of that parameter which would require either automatic or ma nual protective ac tion. Inasmuch as Condition I occurren ces occur frequently or regularly, they must be consider ed from the point of v iew of affecting the consequences of fault conditions (Conditions II, III and IV).

In this regard, analysis of each fault c ondition described is generally based on a conservat ive set of initial conditions corresponding to adverse conditi ons which can occur during Condition I operation.

A typical list of Condit ion I events is listed below:

a. Steady-state and shutdown operations

1. Power operation (>5 to 100% of r ated thermal power), 2. Startup (keff > 0.99 to 5% of rated thermal power), 3. Hot standby (subcritical, residual h eat removal system isolated),

4. Hot shutdown (subcriti cal, residual heat removal system in operation), 5. Cold shutdown (subcritic al, residual heat removal system in operation), and

6. Refueling

b. Operation with p ermissible deviations Various deviations w hich may occur during continued operation as permitted by the plant Technical Specifications must be considered in conjunction with other operational mode

s. These include:

1. Operation with compone nts or systems out of service, 2. Radioactivity in the r eactor coolant, due to leakage from fuel wi th cladding defects, B/B-UFSAR 15.0-3 REVISION 8 - DECEMBER 2000 (a) Fission products (b) Corrosion products (c) Tritium

3. Operation with steam generator l eaks up to the maximum allowed by the Technic al Specification 3.4.13, and

4. Testing as allowed by Technical Specif ications and the Technical Requirem ents Manual (TRM)

c. Operational transients

1. Plant heatup and cooldown (up to 100

°F/hour for the reactor coolant system; 200

°F/hour for the pressurizer during cooldown and 100

°F/hour for the pressurizer duri ng heatup), 2. Step load changes (up to +/- 10%),

3. Ramp load changes (up to 5%/minute), and

4. Load rejection up to and including design full load rejection transient

15.0.1.2 Condition II - F aults of Moderate Frequency These faults, at worst, result in the reactor trip with the plant being capable of returning to op eration. By definition, these faults (or events) do not pr opagate to cause a more serious fault, i.e., Con dition III or IV events.

In addition, Condition II events are not expected to result in fuel r od failures or reactor coolant system or secondary system overpressurization.

For the purposes of this report, the following faults are included in this category:

a. Feedwater system malfunc tions that result in a decrease in feedwater temper ature (Subsection 15.1.1), b. Feedwater system malfunc tions that result in an increase in feedwater fl ow (Subsecti on 15.1.2),

c. Excessive increase in secondary steam flow (Subsection 15.1.3), d. Inadvertent opening of a steam generator relief or safety valve (Su bsection 15.1.4),

B/B-UFSAR 15.0-4 REVISION 5 - DECEMBER 1994 e. Loss of external electri cal load (Subsection 15.2.2), f. Turbine trip (Subsection 15.2.3), g. Inadvertent closure of m ain steam isolation valves (Subsection 15.2.4), h. Loss of condenser vacuum and other events resulting in turbine trip (Su bsection 15.2.5),

i. Loss of nonemergency ac power to the station auxiliaries (Subsection 15.2.6), j. Loss of normal feedwater flow (Subse ction 15.2.7), k. Partial loss of forced react or coolant flow (Subsection 15.3.1), l. Uncontrolled rod clust er control assembly bank withdrawal at a subcriti cal or low power startup condition (Sub section 15.4.1), m. Uncontrolled rod clust er control assembly bank withdrawal at power (Subsection 15.4.2), n. Rod cluster control assembly misalignment (dropped full length assembly , dropped full length assembly bank, or statically misaligned full le ngth assembly) (Subsection 15.4.3), o. Deleted

p. Chemical and volume cont rol system mal function that results in a decrease in the boron concentration in the reactor coolant (Sub section 15.4.6),

q. Inadvertent operation of the emergency core cooling system during power operation (Subsection 15.5.1), r. Chemical and volume cont rol system mal function that increases reactor coolant inventory (Subsection 15.5.2),

s. Inadvertent opening of a pressurizer safety or relief valve (Se ction 15.6.1), and

t. Break in instrument line or other lines from reactor coolant pressure boundary th at penetrate containment (Subsection 15.6.2).

B/B-UFSAR 15.0-5 REVISION 7 - DECEMBER 1998 15.0.1.3 Condition III - Infrequent Faults By definition Condition III occurrences are faults which may occur very infrequently during the life of t he plant. They will be accommodated with the failure of only a s mall fraction of the fuel rods although sufficient fu el damage might occur to preclude resumption of the oper ation for a considerab le outage time. The release of radioactivity will not be sufficient to interrupt or restrict public use of those areas beyond th e exclusion radius.

A Condition III fault wi ll not, by itself, generate a Condition IV fault or result in conseque ntial loss of function of the reactor coolant system or containment barriers.

For the purposes of this report the following faults are included in this category:

a. Steam system piping fail ure from zero power and full power (minor) (Subsections 15.1.5 and 15.1.6), b. Complete loss of forced reactor coolant flow (Subsection 15.3.2), c. Rod cluster control assembly misalignment (single rod cluster control assembly wit hdrawal at full power) (Subsection 15.4.3), d. Inadvertent loading and operation of a fuel assembly in an improper position (Subsection 15.4.7), e. Loss of coolant accidents resulting from a spectrum of postulated piping breaks within the reactor coolant pressure boundary (small break) (Subsection 15.6.5), f. Gaseous radwaste system leak or failure (Subsection 15.7.1), g. Liquid radwaste system leak or f ailure (Subsection 15.7.2), h. Postulated rad ioactive releases due to liquid tank failures (Subsection 15.7.3), and

i. Spent fuel cask drop accidents (Subsection 15.7.5).

15.0.1.4 Condition IV - Limiting Faults Condition IV occurrences are fau lts which are not expected to take place, but are po stulated because their consequences would include the potential of the release of significant amounts of radioactive material.

They are the most drastic which must be designed against and represent l imiting design cases. Condition IV faults are not to cause a fission product release to the environment resulting in an undue risk to public health and

B/B-UFSAR 15.0-6 REVISION 13 - DECEMBER 2010 safety in excess of guidelines v alues of 10 CFR 100 for TID-14844 based dose analyses and 10 CFR 50.67 for AST based analyses. A single Condition IV fault is not to cause a consequential loss of required functions of systems ne eded to cope w ith the fault including those of t he emergency core coolin g system and the containment. For th e purposes of this r eport, the following faults have been classif ied in this category:

a. Steam system piping fail ure from zero power and full power (major) (Subsections 15.1.5 and 15.1.6), b. Feedwater system pipe break (Subsection 15.2.8), c. Reactor coolant pump shaft seizure (locked rotor) (Subsection 15.3.3), d. Reactor coolant pump shaft break (Su bsection 15.3.4), e. Spectrum of rod cluster control assembly ejection accidents (Sub section 15.4.8), f. Steam generator tube failure (Subsection 15.6.3), g. Loss of cool ant accidents re sulting from the spectrum of postulated pipin g breaks within the reactor coolant pressure bou ndary (large break) (Subsection 15.6.5), and

h. Design basis f uel handling acc idents (Subsection 15.7.4). 15.0.1.5 Summary of Results For all Condition II transients analyzed, the calculated minimum DNBR was greater than the li mit value. For each of these transients, the peak RCS pressure was less t han the safety limit of 110% of design pr essure (2750 psia) and there was no failed fuel as a result of the transients. Since D NB does not occur for any Condition II transients, peak cladding tempe rature does not increase sufficiently above nomi nal values for these events.

For all of the applica ble Condition III tran sients, the minimum DNBR was greater than the limit value and there was no failed fuel except for a si ngle RCCA withdrawal at full power. For this transient, the up per bound of the number of fuel rods experiencing DNBR less than the limit value was 5% of the total rods in the core. A ll of the applicable Con dition III transients experienced a peak RCS p ressure less than 27 50 psia. The only Condition III transient for which claddi ng temperature was calculated was the small LOCA and the peak value was less than 2200°F.

B/B-UFSAR 15.0-7 REVISION 9 - DECEMBER 2002 All the applicable Con dition IV transien ts analyzed met the applicable condition IV acceptance criteria.

For the locked rotor event, DNB was assumed to occur at the i nitiation of the transient and the pe ak cladding temperature was calculated to be less than 2700

°F. For the L OCA the amount of failed fuel calculated was equal or less than 100% a nd for rod ejection it was equal or less than 10%. T he locked rotor ac cident results in cladding failure in less than 1% of the fuel rods. There was no failed fuel predicted for the feed line brea k, the steam line break, or the steam generator tube rup ture. All of the applicable Condition IV transients exp erienced a peak RCS pressure less than 2750 psia. The peak cladding temperature calculated for LOCA was less than 2200

°. The average fuel pellet enthalpy at the hot spot for rod ejection was less than 200 cal/gm. 15.0.2 Optimization of Control Systems

A control system setpoint study is performed in order to simulate performance of the react or control and prote ction systems. In this study, emphasis is placed on the develo pment of a control system which will au tomatically maintain pre scribed conditions in the plant even under a conservative set of reactivity parameters with respect to both system stability and tr ansient performance.

For each mode of plant operation, a group of optimum controller setpoints is determined. In a reas where the r esultant setpoints are different, comprom ises based on the optimum overall performance are made a nd verified. A consis tent set of control system parameters is derived satisfying plant operational requirements throughout the core life and fo r various levels of power operation.

The study comprises an a nalysis of the following control systems:

rod cluster control asse mbly, steam dump, steam generator, level, pressurizer pressure, and pressurizer level.

15.0.3 Plant Characteri stics and Initial Co nditions Assumed in the Accident Analyses Each of the four RCS loops are equipped with loop isolation valves. However, th e stations are not c urrently licensed for less than all loops in operation. Therefore , the UFSAR presents the licensing basis for four-loop operation only.

15.0.3.1 Design P lant Conditions Table 15.0-1 lists t he principal power ratin g values which are assumed in analyses perf ormed in this report.

B/B-UFSAR 15.0-8 REVISION 9 - DECEMBER 2003 Allowances for e rrors in the determinati on of the steady-state power level are made as described in Sub section 15.0.3.2. The thermal power values used for each transient analyzed are given in Table 15.0-2.

The values of other pertinent pl ant parameters u tilized in the accident analyses are given in Tables 15.0-3 and 15.0-4.

15.0.3.2 Initial Conditions

For most accidents which are D NB limited, nominal values of initial conditions are assumed. The all owances on power, temperature, and pressure are de termined on a statistical basis and are included in the limit DN BR, as described in WCAP-11397 (Reference 10). Thi s procedure is known as the "Revised Thermal Design Procedure," and is discussed more fully in Section 4.4.

For accidents which are not DNB limited, or in which the Revised Thermal Design Procedure is not employed, th e initial conditions are obtained by adding t he maximum steady st ate errors to rated values. The followi ng conservative steady state errors were assumed in the analysis:

a. Core power

+/- 2% allowance for calorimetric error

B/B-UFSAR 15.0-9 REVISION 7 - DECEMBER 1998 b. Average reactor

+9.1 -7.6°F allowance coolant system for co ntroller deadband and temperature measurement error

c. Pressurizer

+/- 43 pounds per square inch pressure (psi) al lowance for steady state fluctuations and measurement error Table 15.0-2 summarizes initial conditions and computer codes used in the accident a nalysis, and shows whi ch accidents employed a DNB analysis using the revised therm al design procedure.

15.0.3.3 Power Distribution The transient response of the reactor system is dependent on the initial power distributi on. The nuclear des ign of the reactor core minimizes a dverse power distribution through the placement of control rods and op erating instructions.

Power distribution may be characterized by the radial factor (FH) and the total peaking factor (F Q). The peaking factor limits are given in the technical specifications.

For transients which may be DNB limited, the radial peaking factor is of importanc

e. The radial pea king factor increases with decreasing power le vel due to rod inserti on. This increase in FH is included in the core limits illustrated in Figure 15.0-1. All transie nts that may be DNB limited are assumed to begin with a FH consistent with the init ial power level defined in the technical specifications.

The axial power shape us ed in the DNB calculat ion is discussed in Section 4.4.

The radial and axial power distributions described above are input to the THINC Code as described in Section 4.4.

For transients which may be over power limited, the total peaking factor (F Q) is of importance. All transient s that may be overpower limited are assumed to begin with plant conditions including power distri butions which are consis tent with reactor operation as defined in the technical sp ecifications.

For overpower transients which are slow with respect to the fuel rod thermal time constant, for example, the chemical volume control syste m malfunction that resul ts in a decrease in the boron concentration in the reactor c oolant incident which lasts many minutes, and the excessive in crease in secondary steam flow incident wh ich may reach equilibr ium without causing a reactor trip, the fuel rod thermal evalu ations are performed as discussed in Sect ion 4.4. For over power transients which are fast with respect to the fuel rod thermal time constant, B/B-UFSAR 15.0-10 REVISION 9 - DECEMBER 2003 for example, the uncontr olled rod cluster cont rol assembly bank withdrawal from subcri tical or low power sta rtup and rod cluster control assembly ejection incidents which re sult in a large power rise over a few seconds, a detailed fuel heat transfer calculation must be performed. Alth ough the fuel rod thermal time constant is a fun ction of system conditions, fuel burnup and rod power, a typical value at beginning-of-life for high power rods is approxim ately 5 seconds.

15.0.4 Reactivity Coe fficients Assumed in t he Accident Analyses The transient response of the reactor system is dependent on reactivity feedback effects, in partic ular the moderator temperature coefficient and the Doppler power co efficient. These reactivity coefficients and their values are discussed in detail in Chapter 4.0.

In the analysis of certain events, conse rvatism requires the use of large reactivity co efficient values whereas in th e analysis of other events, conservati sm requires the use of small reactivity coefficient values. Some analys es such as loss of reactor coolant from cracks or breaks in the reactor coolant system do not depend on reactivity feedback effects. The values are given in Table 15.0-2. Figure 15.0-2 shows the Technical Specifications limit for the moderator temperature c oefficient as a function of power level. Some analyses conser vatively assume a

+7 pcm/°F coefficient at full power, although this is not permitted by the Technical Speci fications. Figure 15.0-3 shows the least negative (upper boun d), least negative at End-of-Life, and most negative (lower bound) bound Doppler po wer coefficients as a function of power, used in the transient an alysis. The justification for use of conse rvatively large versus small reactivity coefficient values are treated on an event-by-event basis. In some cases co nservative combinations of parameters are used to bound the effects of core life, although these combinations may not represent possible realistic situations.

15.0.5 Rod Cluster Control Asse mbly Insertion Characteristics The negative reactivity insertion following a reactor trip is a function of the position versus time of the rod cluster control assemblies and the variation in rod worth as a funct ion of rod position. With resp ect to accident anal yses, the critical parameter is the time of insertion up to the dashpot entry or approximately 85% of t he rod cluster travel.

The rod cluster control assembly position versus time assumed in accident analyses is shown in Fi gure 15.0-4. The rod cluster control assembly insertion time to dashpot ent ry is taken as 2.7 seconds. Drop time testing requ irements are dep endent on the type of cluster control assemblies actua lly used in the plant and are specified in the plant technical specifications.

Figure 15.0-5 shows the fraction of total negative reactivity insertion versus normalized rod position for a core where the axial distribution is skewed to the lower region of the core.

An axial distribution which is skewed to the lower region of B/B-UFSAR 15.0-11 REVISION 9 - DECEMBER 2003 the core can arise from an unbalanced xenon di stribution. This curve is used to compute the negativ e reactivity insertion versus time following a reactor trip which is input to all point kinetics core models used in t ransient analyses.

The bottom skewed power dis tribution itself is not input into t he point kinetics core model.

There is inherent conservatism in the use of Figure 15.0-5 in that it is based on a skewed flux distributi on which would exist relatively infrequently. For ca ses other than t hose associated with unbalanced xeno n distributions, s ignificant negative reactivity would have been ins erted due to the more favorable axial distribution exist ing prior to trip.

The normalized rod clust er control assembly negative reactivity insertion versus time is shown in Figure 15.0-6. The curve shown in this figure was o btained from Figures 15.

0-4 and 15.0-5. A total negative r eactivity insertion fo llowing a trip of 4% k is assumed in the t ransient analyses except where specifically noted otherwise. This assumption is c onservative with respect to the calculated trip reacti vity worth available as shown in Table 4.3-3. For Figures 15.0-4 and 1 5.0-6, the rod cluster control assembly drop time is normalized to 2.7 seconds, unless otherwise noted for a pa rticular event.

The normalized rod clust er control assembly negative reactivity insertion versus time curve for an axial pow er distribution skewed to the bottom (Figure 15.0-6) is used in those transient analyses for which a point kin etics core model is used. Where special analyses require use of three dimensio nal or axial one dimensional core models, the n egative reactivity insertion resulting from the rea ctor trip is calcu lated directly by the reactor kinetics code and is n ot separable from the other reactivity feedback effects. In this case, the rod cluster control assembly position versus tim e of Figure 15.0-4 is used as code input.

15.0.6 Trip Points and Time Delays to Trip Assumed in Accident Analyses A reactor trip signal acts to open two t rip breakers connected in series feeding po wer to the contr ol rod drive mechanisms.

The loss of power to the mecha nism coils causes the mechanisms to release the rod c luster control ass emblies which then fall by gravity into the co re. There are var ious instrumentation delays associated with each trip function, i ncluding delays in signal actuation, in opening the trip breakers, and in the release of the rods by t he mechanisms. The to tal delay to trip is defined as the time delay from the time that trip conditions are reached to the time the rods are free and begin to fall.

Limiting trip setpoints assumed in accident analyses and the time delay assumed for each trip function are given in Table 15.0-5.

B/B-UFSAR 15.0-12 REVISION 9 - DECEMBER 2002 Reference is made in that table to overt emperature and overpower T trips shown in Figure 1 5.0-1. This figure presents the allowable reactor coolant loop avera ge temperature and T for the design flow and power distri bution, as descr ibed in Section 4.4, as a function of primary coolant pressure.

The boundaries of operation defined by the overpower T trip and the overtemperature T trip are represented as "protection lines" on this diagram. Th e protection lines are drawn to include all adverse instrumentation and setpoint errors so that under nominal conditions trip would occur well within the ar ea bounded by these lines. The utility of this diagram is in the fact that the limit imposed by any given DNBR can be represented as a line. The DNB lines represent the locus of conditions for which the DNBR equals the limit value (1.33 for the thimble cell and t he typical cell).

All points below and to the left of a DNB line for a given pressure have a DNBR greater than the limit valu

e. The diagram shows that DNB is pr evented for all cases if the area enclosed with the maximum protection lines is not traversed by the applicable DNBR line at any point.

The area of acceptable operation during transient conditions (power, pressure and tem perature) is bounded by the combination of reactor trips:

high neutron flux (fixed setpoint); high pressure (fixed setpoi nt); low pressure (fixed setpoint);

overpower and overtemperature T (variable setpoints).

The difference between t he limiting trip poi nt assumed for the analysis and the normal trip poi nt represents an allowance for instrumentation channel error and setpoint err or. Nominal trip setpoints are specified in the plant tec hnical specifications.

During plant sta rtup tests, it will be d emonstrated that actual instrument time delays are equal to or less than the assumed values. Additionally, protection system cha nnels are calibrated and instrument respo nse times determin ed periodically in accordance with the te chnical specifications.

15.0.7 Instrumentation Drift and Calori metric Errors - Power Range Neutron Flux The instrumentation drift and ca lorimetric errors used in establishing the power range high neutron flux setpoint are presented in Table 15.0-6.

The calorimetric error is the er ror assumed in the determination of core thermal powe r as obtained from secondary plant measurements. The total ion chamber current (sum of the top and bottom sections) is cali brated (set equal) to this measured power on a periodic basis.

The secondary power is obtained from mea surement of feedwater flow, feedwater inlet te mperature to the ste am generators and steam pressure.

High accuracy instr umentation is provided for

B/B-UFSAR 15.0-13 REVISION 11 - DECEMBER 2006 these measurements w ith accuracy toleran ces much tighter than those which would be require d to control feedwater flow.

The nuclear instrumentation syst em is calibrated by comparing individual power level indications with the power obtained calorimetrically. T he error assumed in the calorimetric determination of power l evel (for the purpos e of establishing the maximum overpower trip setpoint) is

+/- 2% at the 95% confidence level, as given in Table 15.0-6.

An analysis has been prepared which took the effects of measurement errors and their confidence leve ls into account and provided the basis f or the selection of protection system setpoints. The analysis was performed in ac cordance with NRC requirements.

15.0.8 Plant Systems and Compon ents Available f or Mitigation of Accident Effects The NSSS is designed to afford proper protection against the possible effects of natural phenomen a, postulated environmental conditions and d ynamic effects of postul ated accidents. In addition, the design incorporates features which minimize the probability and effects of fires and explosions. Chapter 17.0 discusses the quality assura nce program whic h has been implemented to assure th at the NSSS will sat isfactorily perform its assigned safety fu nctions. The incorpor ation of these features in the NSSS, couple d with the reliabili ty of the design, ensures that the normally operat ing systems and comp onents listed in Table 15.0-7 will be available for mi tigation of the events discussed in Chapter 15.0. Table 15.0-7 identifies plant systems and equipment credited f or transients and ac cident conditions.

In determining w hich systems are neces sary to mitigate the effects of these postu lated events, the clas sification system of ANSI-N18.2-1973 is utili zed. The design of "s ystems important to safety" (including pro tection systems) is co nsistent with IEEE Standard 379-1972 and Regulatory Gui de 1.53 in the a pplication of the single failu re criterion.

In the analysis of the Chapter 15.0 ev ents, control system action is considered o nly if that action results in more severe accident results. No credit is taken for control system operation if that oper ation mitigates the results of an accident.

For some accidents, the analysis is performed bo th with and without control system operation to determin e the worst case.

The response times f or the air-operated and motor-operated valves in the auxiliary feedwater and main steam systems are verified during preo perational testing.

B/B-UFSAR 15.0-14 REVISION 12 - DECEMBER 2008 15.0.9 Fission Prod uct Inventories 15.0.9.1 Activities in the Core For the accidents evaluated using TID-14844, the calculation of the core iodine fission product inventory wa s modeled using the computer code ORIGEN2 (Reference 1) which is a versatile point-depletion and radioact ive-decay code for use in simulating nuclear fuel cycles and calculating the nuclide compositions and characteristics of mater ials contained therein. Thi s code takes into account the transmu tation of all the isot opes in the fuel.

The core fission product inventories were determined for end-of-cycle conditions, assuming an eq uilibrium fuel c ycle. These inventories are given in Table 15.0-8. The is otopes included in Table 15.0-8 are the controlling isotopes from c onsiderations of thyroid dose (iodines) and from external dos e due to immersion (noble gases).

The isotopic yields used in the calculations are from the data of NEDO-12154-1, utilizing the isotopic yield da ta for thermal fissioning of U-235 as the sole fissioning source. The change in fission product i nventory resulting f rom the fissioning of other fissionable atoms has been reviewed.

The results of this review indicated that inclusion of all f ission source data would result in a sm all (less than 10%)

change in the isotopic inventories.

For the accidents evaluated using Alternative Source Terms, the calculation of the core iodine fission product inventory was also modeled using computer code ORIGEN2 (Referen ce 1), based on reactor operation at 3586.6 MWth and an equilibrium 542.9 Effective Full Power D ays (EFPD) eighteen month cycle design.

The maximum of the 100 EFPD and End of Cycle values for each isotope were selected to generate the bo unding isotopic core inventory activity and composition results.

15.0.9.2 Activities in the Fuel Pellet Cladding Gap The fuel clad gap activities a re defined differently for the different accidents which model gap activity r eleases. These accidents include the locked pump rotor, rod eje ction, and fuel handling accidents. The specific gap activity model used for each of these events is described in t he associated accident analysis discussion.

The NRC staff has completed its review of the revised Westinghouse fuel ro d internal press ure design crite ria and has decided on an acceptab le amended criterion:

"The internal pressu re of the lead fuel rod in the reactor will be limi ted to a value below that which could cause (1) the diametri cal gap to increase due to outward cladding cre ep during steady-s tate operation, and (2) extensive DNB pr opagation to occur."

B/B-UFSAR 15.0-15 REVISION 12 - DECEMBER 2008 WCAP-8963, "Safety Analysis for the Re vised Fuel Internal Design Basis," was found to be acceptable to support the conclusion that an i nsignificant number of additional DNB events would occ ur during transients a nd accidents as a result of operating with fu el rod pressure (1) greater than nominal system pressure, and (2) lim ited by the above criterion.

For all Condition III and IV overpower event s, the number of rods that are assumed to fail is less than 10%.

Therefore, the analyses for the Byron/Braidwood OFA amendment (Amendment 30) are bounded by the analy sis presented in the W CAP. The results presented in the WCAP are ba sed on the detai led probability analysis performed to de termine the maximum exte nt of core damage that could lead to DNB propagation. It was shown that the propagation mechanis m causes only a small incremental increase in the percentage of rods in DNB. In view of the conservative nature of the failure pr opagation scheme and the small percentage increase in the number of failed rods, the p otential increase in site release is inconsequential.

Although this effect, resulting from the revised fuel rod internal pressure design criteri on, is small, it was factored into the number of rods predicted to fail.

15.0.9.3 Activities in the Primary Coolant The accident dose an alyses consider the releases of radioactive iodines and noble gases. The noble gas activity in the primary coolant is based on op eration with 1

.0 percent fuel defects and with no credit for s tripping of gases fr om the prima ry coolant for processing by th e gaseous waste proc essing system. The primary coolant noble gas activities are provi ded in Subsection 11.1 and are also repeat ed here in Table 15.0-9.

While Subsection 11.1 identifies the iodine concentrations associated with operat ion with 1.0 perce nt fuel defects, the iodine activity in the primary coolant is controlled to an equilibrium concentration of no more than 1.0 µCi/g of dose equivalent (DE) I-131.

The determination of DE I-131 is based on five iodine isotopes: I-131, I-132, I-133, I-1 34, and I-135. In the event of an accident invol ving depressur ization of the primary coolant system or reactor trip, the rate at which iodine enters the primary system is assumed to increase by a factor of 500. This is referred to as an accident-ini tiated or concurrent iodine spike.

There is also the pote ntial for an accident to occur during the time in which an iodine spike has already occurred, initiated by changes in plant operati on (e.g., power redu ction). This is referred to as a pre-exi sting iodine spike.

The maximum iodine concentration associated with a pre-existing i odine spike is 60

µCi/g of DE I-131.

Table 15.0-10 lists the equilibrium iodine concentrations associated with 1.0 µC i/g of DE I-131, t he equilibri um iodine appearance rates into the prim ary coolant, t he iodine spike B/B-UFSAR 15.0-15a REVISION 12 - DECEMBER 2008 appearance rates (50 0 times equilibrium), and the iodine concentrations associa ted with 60 µC i/g of DE I-131.

15.0.9.4 Activities in the Secondary Coolant

It is assumed that there is pr imary to secondary coolant leakage that transports activity to the secondary system.

However, there is no significant amount of noble gas in the s econdary coolant since non-condensable ga ses entering the secon dary system are rapidly expelled to the environment. The io dine concentration in the secondary coolant is controlled to be le ss than 0.1 µCi/g of DE I-131 (values for individual isotopes are ide ntified in Table 15.0-10).

15.0.10 Residual Decay Heat 15.0.10.1 Total Residual Heat Residual heat in a subcritical c ore is calculated for the loss of coolant accident per the requirements of Appendix K of 10 CFR 50.46 (Re ference 3) as descri bed in (Referenc es 4 and 5).

These requirements inc lude assuming infinite irradiation time before the core goes subcritical to de termine fission product decay energy. F or all other a ccidents, unless o therwise noted in the text, the same models are used except th at fission product decay energy is based on core average exposure at the end of the equilibrium cycle.

15.0.10.2 Distribution of Decay Heat Following Loss of Coolant Accident During a loss-of-coolant acciden t, the core is rapidly shut down by void for mation or rod cluste r control assembly insertion, or both, and a large fraction of the heat generation to be considered comes from fiss ion product decay gamma rays.

This heat is not distributed in the same manner as steady state fission power. Local peaking effects which are important for the neutron dependent part of the heat generation do not apply to the gamma ray contribution.

The steady stat e factor of 97.4% which represents the fraction of h eat generated within the clad and pellet drops to 9 5% for the hot rod in a loss-of-coolant accident.

For example, in the transient resulting from the postulated double ended break of the largest reactor coolant system pipe, 1/2 second after the break, about 30% of the heat generated in the fuel rods is from gamma ray absorption. T he power shape, reducing the energy deposited in the hot rod at the expense of adjacent colder rods. A conserv ative estimate of this effect is a reduction of 10% of the gamma ray cont ribution or 3% of the total. Since the water density is considera bly reduced at this time, an average of 98%

of the available heat is deposited in the fuel rods, the remaining 2% being absorb ed by water, thimbles, sleeves and grids. The net effe ct is a factor of 0.95 rather than 0.974, to be appl ied to the heat pr oduction in the hot rod.

B/B-UFSAR 15.0-16 REVISION 6 - DECEMBER 1996 15.0.11 Computer Codes Utilized Summaries of some of the pri ncipal computer codes used in transient analyses are g iven below. Other c odes, in particular very specialized codes in which the modeling has been developed to simulate one given accident, such as those used in the analysis of the reactor coolant system pipe break (Section 15.6), are summarized in their respective accident analyses sections.

The codes used in the analysis of each transient have been listed in Table 15.0-2.

15.0.11.1 FACTRAN FACTRAN calculates the transient temperature distribution in a cross section of a metal clad UO 2 fuel rod and the transient heat flux at the surface of the clad using as input the nuclear power and time-dependent coola nt parameters (p ressure, flow, temperature, and densi ty). The code uses a fuel model which exhibits the following features simu ltaneously.

a. A sufficiently large number of radial space increments to handle fast transients such as rod ejection accidents.

b. Material properties wh ich are functions of temperature and a so phisticated fuel-t o-clad gap heat transfer calculation.

c. The necessary calculatio ns to handle post-DNB transients: film boiling heat transfer correlations, zirconium-water reacti on and partial melting of the materials.

FACTRAN is furth er discussed in Reference 6.

15.0.11.2 LOFTRAN The LOFTRAN program is used for stud ies of trans ient response of a PWR system to specified perturbations in process parameters. LOFTRAN s imulates a multiloop s ystem by a model containing reactor vessel, h ot and cold leg piping, steam generator (tube and shell side s) and the pressurizer. The pressurizer heaters, s pray, relief and safet y valves are also considered in the program. Po int model neutron kinetics, and reactivity effects of the modera tor, fuel, boron and rods are included. The secondary side of the steam gen erator utilizes a homogeneous, satur ated mixture for the thermal transients and a water level correlation for indication and control. The reactor protection system is simulated to in clude reactor trips on high neutron flux , overtemperature T, overpower T, high and low pressure, low flow, and high pressur izer level. Control systems are also simulat ed including rod con trol, steam dump, feedwater control and pressuri zer pressure control. The

B/B-UFSAR 15.0-17 REVISION 4 - DECEMBER 1992 emergency core cooling s ystem, including the acc umulators is also modeled. LOFTRAN is a versatile program which is suited to both accident evaluation and c ontrol studies as well as parameter sizing.

LOFTRAN also has the capability of calcu lating the transient value of DNBR based on t he input from the co re limits illustrated on Figure 15.0-1. T he core limits represent s the minimum value of DNBR as calculate d for typical or thimble cell.

LOFTRAN is furth er discussed in Reference 7.

15.0.11.3 TWINKLE The TWINKLE program is a multi-d imensional spatial neutron kinetics code, which was patte rned after ste ady state codes presently used for rea ctor core design.

The code uses an implicit finite-difference method to solve the two-group transient neutron diffusion eq uations in one, two and three dimensions. The code uses s ix delayed neutr on groups and contains a detailed multi-regi on fuel-clad-coolant heat transfer model for cal culating pointwise Dop pler and moderator feedback effects. The code ha ndles up to 2000 spatial points, and performs its own steady state initialization. Aside from basic cross section data and the rmal-hydraulic p arameters, the code accepts as inpu t basic driving func tions such as inlet temperature, pressure, f low, boron concentra tion, control rod motion, and others. V arious edits are p rovided e.g., channel-wise power, axial offset, enth alpy, volumetric s urge, pointwise power, and fuel temperatures.

The TWINKLE Code is used to pred ict the kinetic behavior of a reactor for transients w hich cause a major perturbation in the spatial neutron flux distribution.

TWINKLE is furth er discussed in Reference 8.

15.0.11.4 THINC The THINC Code is de scribed in Section 4.4.

15.0.11.5 RETRAN RETRAN-02 MOD003 is a best-est imate code used to predict the behavior of complex thermal-hy draulic systems subjected to postulated transient conditions in light water reactors. It solves the equat ions of one component, two-phase compressible flow systems coupled with heat conducting elements. It contains two neutron kinetics models for the reactor core; a point kinetics model and a o ne-dimensional, space-ti me kinetics model.

It can solve problem s of steady-state distri bution as well as transient phenomena. It has been used for a v ariety of fluid

B/B-UFSAR 15.0-17a REVISION 12 - DECEMBER 2008 flow and heat transfer p roblems and has been dem onstrated to be a very effective tool wi th which to accomp lish the following:

1. plant transient analysis,

2. system or subsystem performance assessments, 3. control syst em behavior, and

4. set point va riation analysis.

RETRAN may also be u sed to calculate t he dynamic piping load (imbalance force) due to hydra ulic transients, to verify emergency or operational proce dures, and to train operation personnel.

RETRAN is further di scussed in Reference 11.

15.0.11.6 RADTRAD RADTRAD is used to d etermine accident do ses at the appropriate dose points cited in Regulatory Guide 1.183; the Exclusion Area Boundary (EAB), Low Popu lation Zone (LPZ), and Control Room (CR).

RADTRAD is a sim plified model of RAD ionuclide T ransport and R emoval A nd D ose Estimation developed fo r, and endor sed by, the NRC as an acceptable methodology for reanalysis of the radiological consequences of design basis accidents.

In accident analyses R ADTRAD is used to estimate the releases using the Alternative Source Term assumptions. The RADTRAD code uses a combination of tables and/or nume rical models of source term reduction p henomena to determine the time-dependent dose at user-specified locations for a given acciden t scenario. The code system also provides t he inventory, decay chain, and dose conversion factor tables needed for the dose cal culation. The technical basis for the RADTRAD code is docu mented in Reference

15. 15.0.11.7 ARCON96 ARCON96 was developed to calculate relative concentrations in plumes from nuclear power plants at control ro om air intakes in the vicinity of the release point.

ARCON96 implements a str aight-line Gaussian di spersion model with dispersion coefficie nts that are modified to account for low wind meander and building wake ef fects. Hourly, normalized concentrations (/Q) are calculated fr om hourly meteorological data. The hourly values are averaged to form /Qs for periods ranging from 2 to 72 0 hours0 days 0 hours 0 weeks 0 months in duration. The calculated values for each period are used to form cumulative frequency distributions.

The technical basis for the AR CON96 code is documented in Reference 16.

B/B-UFSAR 15.0-17b REVISION 12 - DECEMBER 2008 15.0.11.8 PAVAN PAVAN estimates down-wind ground-level air c oncentrations for potential accidental releases of radioactive material from nuclear facilities. Op tions can account for variation in the location of release points, addi tional plume d ispersion due to building wakes, plume me ander under low wind speed conditions, and adjustments to c onsider non-straight trajectories. It computes an effective pl ume height using the physical release height which can be reduced by inputted terrain features.

Using joint frequency distributions of wind direction and wind speed by atmospheric s tability, the program pr ovides relative air concentration (/Q) values as functions of direction for various time periods at the ex clusion area boundary (E AB) and the outer boundary of the low population z one (LPZ). Cal culations of /Q values can be made f or assumed ground-level releases or elevated releases from free-sta nding stacks. The /Q calculations are based on the theory that material re leased to the atmosphere will be normally distributed (Gaussian) about the plume centerline. A straight-line trajectory is assu med between the point of release and all distances for which /Q values are calculated.

The technical basis for the PAVAN code is docu mented in Reference

17. 15.0.12 Radiological Consequences This chapter also an alyzes the effects of postulated accidents with respect to radi ological consequen ces. The analysis considers a broad spectrum of events. The radiological consequences of each accident are shown to be within the guidelines of 10 CFR 100, or, for those accidents evaluated using Alternative Source Terms, the limits of 10 CFR 50.67 and the guidance of Regulato ry Guide 1.183.

Chapter 15 also documents a set of r adiological consequence analyses utilizing Alt ernative Source Terms (AST) methodology per Regulatory Guide (RG) 1.183, "

Alternative Radi ological Source Terms for Evaluating Design Basis Accide nts at Nuclear Power Reactors" for the following accidents:

Loss of Coolant Accident (LOCA),

Fuel Handling Ac cident (FHA),

Control Rod Ejection Accident (CREA),

Locked Rotor Acc ident (LRA)

Main Steam Line Break Accident (MSLBA), and Steam Generator Tube Rup ture Accident (SGTRA).

B/B-UFSAR 15.0-18 REVISION 12 - DECEMBER 2008 The analyses use design-basis assumptions and parameters to demonstrate the adequacy of the plant design w ith regard to the guidelines of 10 CFR 1 00 and 10 CFR 50.67.

The parameters and ass umptions used for each analysis, as well as the results, are pr esented in tabular form for each limiting accident. The sequence of events for each transient is listed in tables in the appli cable sections of this chapter.

In addition, the accident sequences are provided in Figur e 15.0-7 through 15.0-25. Tables 15.0-11 and 15.0-12 present the accident doses for the Exclusion Area Bound ary (EAB), the L ow Population Zone (LPZ), and the control room for the Byron/Braidwood S tations respectively.

This format of table identification is used consistently within the text of Chapter 15.0 to identify Bra idwood Station.

Figures 15.0-24, 15.0-25a and 15.0-25b symboli cally show event sequences of steam generator t ube rupture and loss-of-coolant accidents. Included w ith the events ill ustrated are operator actions and systems ne cessary to mitigate the effects of the accidents. The figures were prepared using a protection sequence event diagram format to illustrate acc ident sequences. A description of operator actions required for s ystem operation along with a reference to a listing of process instr umentation available to the operator following an accident is noted on the diagrams.

Response times for react or trip resulting from steam gen erator tube rupture and loss-of-coolant accidents are as lis ted in Table 7.2-3.

Response times of the engineered saf ety features actuation system for these accidents are as stated in S ubsection 7.3.1.2.5.

The sequence of even ts for a steam generator tube rupture is given in Tables 15.6-6a an d 15.6-6b. This informa tion is included in Table 15.6-1 for large and small break loss-of-coolant accidents.

Tables 15.0-13 and 15.0-14 list the atmo spheric dilution factors

(/Q) used in the TID-14844 analyses. The 5 th percentile atmospheric dilution factors are used in the analyses.

The assumptions and meth odology for the TID-14844 radiological dose analysis are discussed in Attachment 15A.

Table 15.0-17 lists the /Q factors used in the AST analyses, as derived in Section 2

.3. The AST radio logical dose analyses assumptions and method ology are discussed in the applicable accident's Radiological Consequences sec tions of this chapter.

B/B-UFSAR 15.0-18a REVISION 12 - DECEMBER 2008 The effects of Optimized and VANTAGE 5 fuel on the radiological consequence evaluations pres ented in Chapter 1 5.0 were assessed.

The effects of extended fuel burnup were considered.

Analyses of core and fuel gap fission product in ventories were performed for burnups of 33,000 MWd/Mtu and 60

,000 MWd/Mtu (Reference 13), as well as 33,000 MWd/Mtu and 48,000 MWD/Mtu (Reference 14).

B/B-UFSAR 15.0-19 REVISION 12 - DECEMBER 2008 Analyses of core inventories show that increasing burnup from 33,000 MWd/Mtu to 60,000 MWd/Mtu produces negl igible changes in the fission product inventories of short-lived noble gases and iodines. The effect of increased burnup on long-lived Kr-85 is essentially a linear i ncrease in core invent ory (Reference 14).

Since Kr-85 is not a s ignificant contributor to the radiological impact of postulated accidents, the results presented in Chapter 15.0 change only slightly due to the use of extended burnup fuel and remain well with in the NRC regul atory limits.

Analyses show that the f raction of an isotope that is released to the fuel rod gap can increase wi th fuel burnup i ncreasing from 33,000 to 60,000 MWd/Mtu (Refe rence 13). Th is analysis was performed assuming t he peak fuel rod in terms of burnup during normal operations and was applied to the fuel handling accidents in Section 15.7. Radiological consequences anal yses, of the six Alternative Source Term (AST) Design Basis A ccidents (DBAs) that result in control room and offsite exposure, were performed to support a full-scope implementation of A ST as described in Regulatory Guide (RG) 1.183, "

Alternative Radi ological Source Terms for Evaluating Design Basis Accide nts at Nuclear Power Reactors". The results of the plant-s pecific AST analyses used the guidance in RG 1.1 83 and met the require ments of 10CFR50.67 "Accident source term". Technical Information Document (TID) 14844, "Calculation of Distance Factors for Power and Test Reactor Sites," will continue to be used as the radiation dose basis for equipment qualification. Su pport of full scope implementation of AS T consisted of t he following steps.

Analysis of the atmospheric dispersion for the radiological propagation pathways

Calculation of offsite Exclusion Area Bounda ry (EAB) and Low Population Zone (LPZ

), Control Room (CR), and, for LOCA only, Technical Supp ort Center (TSC) personnel Total Effective Dose Equiv alent (TEDE) doses

Identification of the AST based on plant-specific analysis of a bounding core fis sion product inventory

Calculation of fission produ ct deposition rates and transport and removal mechanisms

Calculation of the rel ease fractions for the DBAs that result in the most s ignificant CR and offsite doses (i.e., LOCA, FHA, CREA, LRA , MSLB, and SGTR)

The analysis assumptions for the transport, reduction, and release of the radioacti ve material from the f uel and the reactor coolant are consistent w ith the guidance provided in applicable appendices of RG 1.183 f or the analy zed DBAs.

AST calculations for the LOCA, F HA, CREA, LRA, MSLB, and SGTR B/B-UFSAR 15.0-19a REVISION 12 - DECEMBER 2008 were prepared for the simulati on of the radionuc lide release, transport, removal, and dose estimates a ssociated with the postulated accidents. The RADTRAD computer code deve loped for and endorsed by the NRC for AST analyses was used in the calculations.

The RADTRAD program is a radiologica l consequence analysis code used to estimate post-accident doses at plant offsit e locations and in the contr ol room.

Vendor fuel supply d ata were used in the calculation of the reactor core fission products for RADT RAD analysis. The inventories were determined based on the licensed core power le vel following power uprate of 3586.6 megawat ts thermal (MWt) and further adjusted to 102% (3658.3 MWt) in s upport of the AST evaluations.

Control room and offsite atmos pheric dispers ion factors (/Qs) developed for the releas es from each plant at the containment wall, plant vent, Steam Generator (S G) power operated relief valves (PORVs)/safety valves, and through a main st eam line break were utilized. Offsite /Qs were calculated with the PAVAN computer code, using the guidance of Regulatory Guide 1.145, and control room /Qs were calculated wi th the ARCON96 compu ter code. The PAVAN and ARCON96 codes calculate relative concentrations in plumes from nuclear power plants at offsite locations and control room air intakes, respectively (refer to section 2.3).

All of these codes have previously been used by the NRC in their safety reviews.

The Byron Station and Braidwood Station meteorol ogical databases for the five-year period 1994-19 98 were applied in the ARCON96 modeling analysis. Wind measure ments at Byron Stati on were taken at 30 ft and 250 ft; and the v ertical temperature difference was measured between 250 ft and 30 ft. Braidwoo d Station wind measurements were taken at 34 ft and 203 ft; and the vertical temperature difference w as measured between 199 ft and 30 ft.

"Calm" wind speeds at bo th stations were assigned a value of 0.4 mph (i.e., one-half the thre shold value) per UFSAR Section 2.3.4.

The minimum wind speed (i.e.

wind threshold) w as set to the ARCON96 default value of 0.5 m/sec in ac cordance with RG 1.1 94, Table A-2.

Other ARCON96 parameters are provided in section 2.3.

The atmospheric disper sion factors (/Qs) utilized a re as found in Sections 2.3 a nd Table 15.0-17.

The key inputs/assumptions used in the A ST analysis for each of the six major accidents and their results/conclusi ons are presented in the applicable U FSAR sections.

Hence the results of the radio logical consequence evaluations presented in Chapter 15.0 rema in acceptable as a res ult of the use of extended bu rnup fuel.

B/B-UFSAR 15.0-19b REVISION 12 - DECEMBER 2008 15.0.13 Limiting Single Failures The most limiting single failure of safety-relat ed equipment, where one exists, is identified in each analysis description, and the consequences of this failure are described there in. In some instances, because of redundan cy in protection e quipment, no single failure which could adversely aff ect the conseq uences of the transient has been identified. The fail ure assumed in each analysis is listed in Table 15.0-15.

All accident and safety analyses in the UFSAR th at require safety valves actuation assume operation of three pressurizer safety valves to limit increa ses in RCS pressur

e. The overpressure protection analysis is also based on ope ration of three safety valves.

B/B-UFSAR 15.0-20 REVISION 12 - DECEMBER 2008 15.0.14 Operator Actions For most of the events analy zed in Chapter 15.

0, the plant will be in a safe and stable hot standby conditio n following the automatic actuation of r eactor trip. This c ondition will in fact be similar to p lant conditions following any normal, orderly shutdown of the reactor. At this point, the actions taken by the operato r would be no diff erent than normal operating procedures. The e xact actions taken, and the time these actions would oc cur, will depend on what systems are available (e.g., steam dump syst em, main feedwater system) and the plans for furthe r plant operation.

As a minimum, to maintain the hot stabilized cond ition, decay heat must be removed via the steam ge nerators. The m ain feedwater system and the steam dump or atmospheric relief system could be used for this purpose. Alternative ly, the auxiliary feedwater system and the s team generator safety va lves, both of which are safety grade systems, may be used. Although auxiliary feed may be started manually, it will be automa tically actuated, if needed, by one of th e signals shown in Drawing 108D6 85, Sheet 15, such as low steam gene rator level. If hot s tandby conditions are maintained for an exte nded period of tim e, operator action may be required to transfer the auxiliary feedwa ter system to the long-term source of auxiliary fe edwater. The time when such action is required dep ends on the design of the auxiliary feed system, but will be sufficiently long to permit operator action. Also, if the hot standby condition is maintained for an extended period of time (greater tha n approximately 18 hours2.083333e-4 days 0.005 hours 2.97619e-5 weeks 6.849e-6 months ), operator action may be required to add boric acid via the CVCS to compensate for xenon decay and to ma intain shutdown margin. The CVCS could also be used to control pressurizer level according to t he operating procedu res. Again, the actions taken by the o perator would be no di fferent than during a normal plant shutdown.

For several events inv olving breaks in the reactor coolant system or secondary sy stem piping, addit ional requirements for operator action can be i dentified as describ ed in the following.

Following the hypothetical steam line break inc ident, a safety injection signal (generated a few seconds after the break) will cause main feedwater i solation to occur. Th e only source of water available to the faulted s team generator is then the auxiliary feedwater system.

Following steam line isolation, steam pressure in th e steamline with the faulted steam generator will continue to fall rapidly, while the pressure stabilizes in the remaining three steamlines.

The indication of the different ste am pressures will be available to the operator within a few seconds of steamline isolation. This will provide the information n ecessary to iden tify the faulted steam generator so t hat auxiliary feed water to it can be isolated. Manual controls are provided in the control room for start and stop of th e auxiliary feedwater pumps and for the control valves associated with the auxiliary feedwater system.

The means for detect ing the faulted steam generator and isolating auxiliary fe edwater to it requires only the use of B/B-UFSAR 15.0-20a REVISION 12 - DECEMBER 2008 safety grade equ ipment available followi ng the break. The removal of decay heat in the l ong-term, (followi ng the initial cooldown) using the remaining steam gene rators, requires only the auxiliary feedwater system as a water source and the secondary system safety valv es to relieve steam.

For a feedwater line break, emergency op erating procedures provide guidance to the operator during long-t erm cooling to prevent pressurization of the reactor co olant system. The operator is provided with th e necessary cont rols to start, operate, and shutdown the units to assure safe and reliable operation under normal a nd accident conditions.

For the boron dilution t ransient, the operator is required to open RWST isolation valves LCA-112D and E, and close CVCS isolation valves LCV-112B and C.

This action will allow 2300 ppm borated water to enter t he RCS and terminate the RCS dilution.

Operator action (both short-term and l ong-term) required for the various modes of ECCS operation to mitigate the consequences of a loss-of-coolant accident (LOCA) or steamline break, as well as ot her accident conditions, are presented in the Emergency Operating Procedures. These procedures discuss

B/B-UFSAR 15.0-21 REVISION 10 - DECEMBER 2004 the alarm/indications av ailable to the opera tor to lead him to take the appropriate actions.

The discussion provided below, constitutes an outline of the operator actio n required following a LOCA or steamline break.

The primary function of the safety injection s ystem (SIS) is to provide emergency core cooling (ECC) in the event of a LOCA resulting from a break in the primary reactor coolant system (RCS) or to provide emergency boration in the event of a steamline break accident resulting from a br eak in the secondary steam system.

ECC following a LOCA is divided into three phases:

a. Short-Term Core Cooling/

Cold Leg Injection Phase The cold leg injection phase is defined as that period during which borated water is delivered from the refueling water st orage tank (RWST) and accumulators to the RCS cold legs.

During this phase, no operator actions are requi red to ensure proper ECCS operation.

b. Long-Term Core Cooli ng/Cold Leg Recirculation The cold leg recirculati on phase is that period during which borated water is recirc ulated from the containment sump to the RCS cold legs. Operator actions are required to establish the cold leg recirculation phase. Th ese actions are detailed in Table 6.3-7 and are not required prior to 10 minutes following event initiation.

c. Long-Term Core Cooling/H ot Leg Recircu lation Phase The hot leg recirculation ph ase is that period during which borated water is r ecirculated from the containment sump to both the R CS hot legs and RCS cold legs. Operator acti ons required to es tablish hot leg recirculation are detailed until approximately 6.0 hours0 days 0 hours 0 weeks 0 months following even t initiation.

The emergency boration following a steam break accident would occur only during th e injection phase. The function of the SIS during this phase would be to inject borated water into the RCS with sufficient shutdo wn reactivity to compens ate for the change in RCS volume and co unteract any reactiv ity increase caused by the resulting cooldown.

The SIS would continue to inject borated water from the RWST until the RCS conditions have stabilized, the accident has been identified as a steam break, a nd the criteria for safety injection t ermination are satisfi ed. The operator should then take action to t erminate ECCS operation.

B/B-UFSAR 15.0-22 REVISION 10 - DECEMBER 2004 For a secondary system b reak, such as a steaml ine or feedwater line break, the operator is inst ructed to comp lete specific actions in the W estinghouse Owners Gro up Emergency Response Guidelines (ERG). These act ions instruct the operator to identify the faulted steam gen erator and terminate auxiliary feedwater to it. When acceptable plant conditio ns exist (i.e., RCS subcooling, RCS pres sure, pressurizer leve l, secondary heat sink), the operator is i nstructed to termina te SI. Postaccident monitoring instrumenta tion which meets a ppropriate safety criteria is provided to monitor the course of various postulated accidents, including feedwater line break and steamline break (see Section 7.5).

In regard to overpressurizing the reactor coolant system, the small break LOCA is less limiting th an the steamline break for the following reasons:

a. A small break LOCA is a relative ly slow transient with the RCS liquid remainin g at saturated condition for an extended period of time.

b. In all cases due to a break in the R CS, the system depressurizes.

c. Even for very small break sizes, a large enough amount of water leaks from the s ystem so that level would not return to the pres surizer for a relatively long period of time.

d. For small and large LOCA s, the operator utilizes the emergency core c ooling system for long-term cooling so that the operator d oes not initiate normal cooldown procedures.

The Byron/Braidwood abno rmal and emergency o perating procedures provide instructions to the operator on appropriate post-LOCA manual actions, as follows:

a. The operator is instructed to align the ECCS to cold leg recirculation when the R WST level reache s the auto switchover level setpoint an d to hot leg recirculation at 6.0 hours0 days 0 hours 0 weeks 0 months .

B/B-UFSAR 15.0-23 REVISION 4 - DECEMBER 1992 b. The operator is instruct ed to control the steam generator and pressure levels utilizing the respective level indications.

c. If acceptable plant conditions e xist (i.e., RCS subcooling, RCS pressure, pressurizer level, secondary heat sink), the operator is instructed to terminate SI.

d. If leakage past the PORVs is i ndicated by valve position or by conditions in the pressurizer relief tank, the operator is instructed to isolate the pressurizer PORVs.

e. If the RCS l ow pressure setpoint for the reactor coolant pumps is reached and SI flow is being delivered, the o perator is instr ucted to trip the RCPs. All of the previous in dications are located inside the control room (see Section 7.5).

For a steam generator tu be rupture (SGTR

), the operator is instructed to comple te specific actions per the plant-specific emergency procedures a ddressing the SGTR accid ent. The emergency procedures are b ased on the latest revis ion of the W estinghouse Owners Group gen eric emergency response guidel ines and are, therefore, consistent with the lates t guidelines regarding SGTR mitigation. The transient is identified as an S GTR in the E-0 procedure. Procedure E-3 directs the operator to mitigate the transient and terminate the break flow f or the purpose of preventing SG overfill.

The tube rupture results in a reactor trip and safety injection due to low pressurizer pressure, and the E-3 procedure inst ructs the operator to pe rform the following major actions:

1. The operator has already identified the accident as a SGTR from the E-0 proc edure. Since the posttrip checks have been performed, the operator now enters the E-3 procedure to mitigat e and recover from the accident. The operator identified the ruptured steam generator by noting abnormal main steamline radiation monitor readings, high SG sample activity, or the faster recovery of level in the ruptured steam generator due to the add itional break flow. The operator then isolates the s econdary side of the ruptured steam generator. M anual controls for the isolation of the ruptured steam generator are located on the main control board.

2. The next major step has the op erator cool down the RCS below the saturation tem perature at the ruptured steam generator pressure by openin g the steam dumps or PORVs on the intact steam generators.

B/B-UFSAR 15.0-23a REVISION 9 - DECEMBER 2002 3. The steam generator PORV con trols and RCS temperature indication are both available in the control room to allow the operator to cool down the RCS.

4. After verifying adequate RCS subcooling exists, the operator uses the pressurizer spray valve or PORV to depressurize the RCS b elow the r uptured steam generator pressure to terminate the break flow.

5. The final major step is for the operator to terminate the safety injection flow to prevent repressurization of the RCS, rees tablishment of the break flow, and potential overfilling of the ruptured st eam generator.

6. After completing these a ctions, the tube rupture break flow has been terminated and t he operator is ready to transition the p lant to cold s hutdown conditions utilizing the appropriate recovery procedure.

See Reference 12 for further informati on regarding the SGTR analysis performed.

15.0.15 References

1. CCC-371, "ORIGEN2.1:

Isotope Generation and Depletion Code -

Matrix Exponential M ethod," RSIC Computer Code Collection, Oak Ridge National Lab oratory, February 1996.

2. Deleted

3. "Acceptance Criteria for Eme rgency Core Cooling Systems for Light Water Cooled N uclear Power Reactors," 10 CFR 50.46 and Appen dix K of 10 CFR 50.

Federal Register, Volume 39, Number 3, January 4, 1974.

4. Bordelon, F. M., et al., "SA TAN-VI Program:

Comprehensive Space-Time Dependent Ana lysis of Loss of Coolant," WCAP-8302 (Proprietary), and WCAP-8306 (Nonproprietary), June 1974.

5. Bordelon, F. M., et al., "LO CTA-IV Program: Loss of Coolant Transient An alysis," WCAP-8301 (Proprietary) and WCAP-8305 (Nonpropri etary), June 1974.

6. Hargrove H. G., "FACTRAN - A Fortran-IV Code for Thermal Transients in a UO 2 Fuel Rod," WCAP-7908-A, December 1989.

7. Burnett, T. W. T., et al., "LOFTRAN Code Des cription," WCAP-7907-P-A (Proprietary), WCAP-7907-A (Non proprietary), April 1984.

B/B-UFSAR 15.0-24 REVISION 12 - DECEMBER 2008 8. Risher, D. H., Jr. and Barry, R.

F., "TWINKLE - A Multi-Dimensional Neutron Kinetics Computer Code," WCAP-7979-P-A (Proprieta ry), and WCAP-8028-A (Non-Proprietary), January 1975.

9. "Westinghouse Nu clear Energy Systems Division Quality Assurance Plan," WCAP-8370-A.

10. Friedland, A. J., and Ra y, S., "Revised Thermal Design Procedure," WCAP-11397-P-A and WCAP-1139 7-A, April 1989.

11. McFadden, J. H.

et al., "RETRAN A Program for Transient Thermal-Hydraulic Analysis of Complex Fluid Flow Systems," Volumes 1-3, EPRI NP-185 0-CCM-A, Rev. 3, June 1987.

12. Commonwealth Edi son Company, "Steam Ge nerator Tube Rupture Analysis for Byron a nd Braidwood Plants Revi sion 1," Nuclear Fuel Services, March 1990.

13. "Assessment of the U se of Extended Bur nup Fuel in Light Water Power Reactors

," NUREG/CR-5009 , February 1988.

14. "Extended Burnup Evaluation of Westinghouse Fuel," WCAP-10125-P-A, December 1985.

15. NUREG/CR-6604, "RADTRAD:

A Simplified Model for Radionuclide Transpo rt and Removal a nd Dose Estimation,"

April 1998.

16. NUREG-6331, "Atmospheric Relative Concentrations in Building Wakes," Revision 1, May 1997.

17. NUREG-2858, "PAVAN:

An Atmospheric Disp ersion Program for Evaluating Design Ba sis Accidental Rel eases of Radioactive Materials from Nucle ar Power Station s," November 1982.

B/B-UFSAR 15.1-1 15.1 INCREASE IN HEAT REMOVAL BY THE SECONDARY SYSTEM A number of events have been postulated whic h could result in an increase in heat removal from the re actor coolant system by the secondary system. A nalyses are presented fo r several such events which have been identifi ed as limiting cases.

Discussions of the fol lowing reactor coo lant system cooldown events are pre sented in this section:

a. Feedwater system malfunc tion causing a reduction in feedwater temperature.

b. Feedwater system malfunc tion causing an increase in feedwater flow.

c. Excessive increase in secondary steam flow.

d. Inadvertent opening of a steam generator relief or safety valve.

e. Steam system piping failure.

The above are considered to be ANS Condition II events, with the exception of a major steam system pipe b reak, which is considered to be an ANS Condition IV event.

Subsection 1 5.0.1 contains a discussion of ANS classificati on and applica ble acceptance criteria.

15.1.1 Feedwater System Malfu nctions Causing a Reduction in Feedwater Temperature 15.1.1.1 Identification of Caus es and Accident Description Reductions in feedwater temperature will cause an increase in core power by decreasing react or coolant temperature. Such transients are a ttenuated by the thermal capacity of the secondary plant and of t he reactor coolant s ystem (RCS). The overpower - overtemperature pr otection (neutron overpower, overtemperature and overpower T trips) prevent any power increase which could l ead to a DNBR less than the limit value.

A reduction in feedwat er temperature may be caused by the accidental opening of a feedwater bypass valve which diverts flow around a portion of the feedwater heaters. In t he event of an accidental opening of the bypa ss valve, there co uld be a sudden reduction in feedwater inlet temperature to the steam generators.

At power, this increased subcool ing will create a greater load demand on the RCS.

With the plant at no-load cond itions, the addition of cold feedwater may cause a decrease in RCS temper ature and thus a reactivity insertion d ue to the effects of t he negative moderator temperature coefficient of reactivity. Howe ver, the rate of

B/B-UFSAR 15.1-2 REVISION 11 - DECEMBER 2006 energy change is reduced as load and feedwater f low decrease, so the no-load transient is less severe than th e full power case.

The net effect on the RCS due to a reduc tion in feedwater temperature would be similar to the ef fect of increasing secondary steam flow , i.e., the reactor will reach a new equilibrium condition at a power level corresponding to the new steam generator T. A decrease in normal feedwater temperatu re is classified as an ANS Condition II event, fault of moderate frequency. See Subsection 15.0.1 fo r a discussion of Co ndition II events.

The protection credited for miti gating the con sequences of a decrease in feedwater temperature is the same as that for an excessive steam flow i ncrease, as discussed in Section 15.0.8 and listed in Table 15.0-7.

15.1.1.2 Analysis of Ef fects and Consequences Method of Analysis

The reduction in feedwat er temperature due to a feedwater system malfunction transient is analyzed by using the detailed digital computer code, LOFTRAN (Reference 1). T his code simulates a multiloop system, neutron kine tics, the pressuri zer, pressurizer relief and safety valv es, pressurizer spray, steam generator, and steam generator safety v alves. The code computes pertinent plant variables including temperature, pre ssure, and power level.

The system is analyzed to demons trate plant behavior following a reduction in feedwat er temperature due to the simultaneous opening of the l ow pressure feed water heater str ing bypass valve and isolation of a low pressure feedwater he ater string due to a high-two level in a first stage feedwater heat er. The loss of a low pressure feedwater heater string causes a redistribution of flow to the other tw o parallel heate r strings and the bypass line. The bypass line takes 40% of the total flow, which effectively increases the temper ature differential since less flow passes through the heaters. This r eduction in feedwater temperature results in c ascading feedwater h eater instability with the end result being a loss of all feedwater heating downstream of the fourth stage f eedwater heaters. This bypass case results in the most severe decrease in feedwater temperature. For the purpos e of this analysis, it is conservatively assumed t hat the temperature redu ction that occurs is due to the loss of multiple trains of feedw ater heaters along with the opening of the feed water heater bypass valves.

This accident is analyzed with t he revised thermal design procedure as describ ed in WCAP-11397-P-A (Reference 8). The following assumptions are made:

a. Initial reactor power, pressure, and RCS temperatures are assumed to be at t heir normal values.

B/B-UFSAR 15.1-2a REVISION 9 - DECEMBER 2002 b. For the main f eedwater malfunction transient, the limiting temperature reduction failure is the loss of an entire train of feed water heaters.

To conservatively bound this failure, a lo ss of multiple trains of feedwater heaters is modeled along with the opening of the feedwater heater b ypass valves. It is assumed that 40% of the feedwater flows through t he bypass line. A conservative feedwater temperature of 200 o F is used after the initiating failure for this event.

This event is only analyzed at hot full power (HFP) conditions.

c. The rate of feedwater flow to the steam generators is assumed to remain the sa me as it was immediately preceding the accident.

d. Changes in turbi ne performance due to changes in RCS performance and process stea m extraction rates are neglected.

e. The temperature tran sient resulting from the bypass of an entire string of low pre ssure feedwater heaters is terminated by an overpower T trip signa l, which trips the reactor, and by a safety injection system low pressurizer pressure s ignal, which clo ses the feedwater control and isol ation valves.

f. In order to determine the most limiting feedwater temperature reduction case for this acci dent, both of the Byron/Braidwood steam generator designs (BWI and D5) are analyzed for this event. Th e most limiting case of the two steam generator designs is documented and presented in the Results s ection that follows.

Plant characteristics and initial conditions are discussed in Subsection 15.0.3.

Normal reactor control s ystems and eng ineered safety systems are not required to functi on. The reactor p rotection system may function to trip the reactor due to an overpower con dition. No single active failure wi ll prevent opera tion of the reactor protection system.

Results Following the initiation of th is event as described above, feedwater temperature is conservatively modeled to instantaneously decr ease from 446.6 o F to 200 o F. This reduction in feedwater temperature increases the thermal load on the primary system. The r esultant temperatu re and power t ransient causes a reactor trip on an overpower T signal. When the pressurizer pressure reaches the low pressure setpoint, the safety injection system is actuated, the feedwater control and isolation valves are closed, and feedwater isolation occurs.

B/B-UFSAR 15.1-2b REVISION 9 - DECEMBER 2002 Transient results for the most limiting feedwater temperature reduction case, as shown in Figu res 15.1-1a and 15.1-1b, show the increase in nuclear power and loop T associated with the increased thermal load on the reactor. Following reactor trip and feedwater isolation, the pla nt will approach a stabilized condition, which in this case, is hot standby.

Normal plant operating procedures may then be followed. The operating procedures would call for operator action to control reactor coolant system boron concentration and p ressurizer level using the chemical volume and control system (CVCS) and to maintain steam generator level th rough control of the m ain or auxiliary feedwater system.

Since the power level rises during the r eduction in feedwater temperature event, the fuel temperatures wil l also rise until after reactor trip occ urs. This portion of the event is bounded by the excessive feedw ater flow event, as analyzed in Section 15.1.2. Since the peak fuel temperature duri ng the excessive feedwater flow event r emains below the f uel melting temperature, the fuel temperature l imits are also met for the feedwater temperature re duction event.

The transient results sh ow that departure fr om nucleate boiling (DNB) does not o ccur at any time during the feedwater temperature reduction transient; t hus, the ability of the primary coolant to remove heat from the fuel rod is not reduced.

The fuel cladding temperature, therefore, does not rise signif icantly above its initial value during the transient.

The calculated sequence of events for the mo st limiting feedwater temperature reduction ca se for this accident is shown in Table 15.1-1. 15.1.1.3 Radiological Consequences The radiological consequ ences will be less severe than the steamline break accident analyzed in Subsection 15.1.5.3.

15.1.1.4 Conclusions The results show that the DNB ratios (DNBRs) encountered for the reduction in feedwater temperature at power are above the limit value at all times; therefore, no fuel or clad damage is predicted. The radiol ogical consequences of this event are bounded by the steam line break accident analyzed in Subsection 15.1.5.3.

B/B-UFSAR 15.1-3 REVISION 7 - DECEMBER 1998 15.1.2 Feedwater System Malfu nctions Causing an Increase in Feedwater Flow 15.1.2.1 Identification of Caus es and Accident Description Additions of excessi ve feedwater will cause an increase in core power by decreasing reac tor coolant temperature.

Such transients are attenuated by the thermal capacity of th e secondary plant and of the RCS. The overp ower - overtemperature protection (neutron overpower, overtempera ture and overpower T trips) prevent any power increase which could lead to a D NBR less than the limit value.

An example of excessive feedwater flow would be a full opening of one or more feedwater co ntrol valves due to a feedwater control system malfunction or an operator error. At p ower this excess flow causes a greater lo ad demand on the RCS due to increased subcooling in the steam generato rs. With the plant at no-load conditions, the addition of an excess of feedw ater may cause a decrease in RCS temperat ure and thus a reactiv ity insertion due to the effects of the negative moderat or coefficient of reactivity. Excessive feedwater flow at no-load conditions results in a less severe trans ient than at full power.

Therefore, only the full power case was analyzed.

Continuous addition of excessive feedwater is prevented by the steam generator high-high level trip, which cl oses the feedwater valves.

An increase in normal feedwater flow is clas sified as an ANS Condition II event, a fault of moderate frequency. (See Subsection 15.0.1 for a discussi on of ANS Cond ition II events.)

B/B-UFSAR 15.1-4 REVISION 11 - DECEMBER 2006 Plant systems and equi pment credited for mit igating the effects of the accident are di scussed in Subsection 15

.0.8 and listed in Table 15.0-7.

15.1.2.2 Analysis of Ef fects and Consequences Method of Analysis

The excessive heat remov al due to a feedwate r system malfunction transient is analyzed by using the detailed di gital computer code LOFTRAN (Reference 1).

This code simula tes a multiloop system, neutron kinetics, the pressurizer, pressuriz er relief and safety valves, pressurizer spra y, steam generator, and steam generator safety valves. The code computes pertinent plant variables including temperatures, pres sures, and p ower level.

The system is analyzed to demons trate plant behavior in the event that excessive f eedwater addition, due to a control system malfunction or operator error which allows one or more feedwater control valves to open f ully occurs. The lim iting case analyzed is the accidental opening of one or more feedwater control valves with the reactor in manual con trol at full power.

This accident is analyzed with t he revised thermal design procedure as described in WCAP-11397-P-A.

Plant characteristics and initial conditions are discussed in Subsec tion 15.0.3. The reactivity insertion rate following a fe edwater system malfunction is calculated with the follo wing assumptions:

a. Initial reactor power, pressure, and RCS temperatures are assumed to be at the ir nominal values.

Uncertainties in initial con ditions are included in the limit DNBR as desc ribed in WCAP-11397-P-A.

b. For the limiting fee dwater control valve accident at full power, one feedwa ter control valve is assumed to malfunction resulting in a step increase to 175% of nominal feedwater flow to one steam generator. The temperature of the feedwater was reduced from 446.6 o F to 381 o F to all four ste am generators.

c. No credit is taken f or the heat capa city of the RCS and steam generator thick metal in att enuating the resulting plant cooldown.

d. The feedwater flow resulting from a fully open control valve is terminated by a ste am generator high-high level trip signal which closes all f eedwater control and isolation valves , trips the main feedwater pumps, and trips the turbine.

e. In order to determine the most limiting excessive feedwater flow case for this accident, both of the Byron/Braidwood stea m generator designs (BWI and D5) are analyzed for thi s event. The mo st limiting case of the two steam generator designs is documented and presented in the Resul ts section that follows.

B/B-UFSAR 15.1-4a REVISION 9 - DECEMBER 2002 Plant characteristics and init ial conditions are further discussed in Sub section 15.0.3.

B/B-UFSAR 15.1-5 REVISION 9 - DECEMBER 2002 Normal reactor control s ystems and eng ineered safety systems are not required to functi on. The reactor p rotection system may function to trip the reactor due to an overpower con dition. No single active failure wi ll prevent opera tion of the reactor protection system.

Results The accidental opening of one feedwater control valve at full power (maximum moderator reactivity feedback and minimum end-of-life Doppler-only power coefficients, manual rod control) gives the largest reactivity f eedback and results in t he greatest power increase. Assuming the reactor to be in the automatic rod control mode results in a slightly less severe transient. The rod control system is, however, not required to function for an excessive feedwater flow event.

When the steam generat or water level in the faulted loop reaches the high-high level setp oint, all feedwater is olation valves and feedwater pump dischar ge valves are automatica lly closed and the main feedwater p umps are tripped. T his prevents continuous addition of the feedwater. In a ddition, a turbi ne trip and a reactor trip are initi ated at that time.

Following turbine trip, the reactor will be automatically tripped, either directly due to turbine trip or due to one of the reactor trip signals as analyzed in Subs ection 15.2.

3 (turbine trip event). If the reactor were in the automatic control mode, the control rods would be inserted at the ma ximum rate following turbine trip, and

B/B-UFSAR 15.1-6 REVISION 9 - DECEMBER 2002 the ensuing transient would be l ess severe in terms of peak pressure.

Transient results for the most limiting excessive feedwater flow case, see Figures 15.1-2a an d 15.1-2b, show the increase in nuclear power and T associated with the inc reased thermal load on the reactor.

Following reactor trip and feedwater isolation, the plant will approach a stabilized conditi on at hot standby.

Normal plant ope rating procedures may th en be followed. The operating procedures would call for oper ator action to control reactor coolant system b oron concentration a nd pressurizer level using the CVCS and to maintain steam gen erator level through control of the main or auxiliary feedwater s ystem. Any action required of the operator to maintain the plant in a stabilized condition will be in a time frame in e xcess of ten minutes following reactor trip.

Since the power level rises during the exces sive feedwater flow event, the fuel temperatures will also rise until after the reactor trip occ urs. The core heat flux lags behind the neutron flux due to fuel rod thermal time constant and the peak linear rod power reached is limited to a value below that which would result in exceeding the fuel melting temperatu re. Hence, fuel melting is precluded for this event.

The transient results sh ow that DNB does not occur at any time during the exces sive feedwater flow inci dent; thus, the ability of the primary c oolant to remove heat fr om the fuel rod is not reduced. The fuel cladding temp erature, therefore, does not rise significantly above its initial value during the transient.

The calculated sequence of events for the mo st limiting excessive feedwater flow case for this accident is sho wn in Table 15.1-1.

15.1.2.3 Radiological Consequences The radiological consequ ences will be less severe than the steamline break accident analyzed in Subsection 15.1.5.3.

15.1.2.4 Conclusions The results of the analysis show that the DNBRs encountered for an excessive feedwater addition at power are at all times above the limit value; hence, no fuel or clad damage is predicted.

The radiological consequence s of this event will be

B/B-UFSAR 15.1-7 REVISION 9 - DECEMBER 2002 less than the steam line break accident analyz ed in Subsection 15.1.5.3.

15.1.3 Excessive Increase In Secondary Steam Flow 15.1.3.1 Identification of Caus es and Accident Description An excessive increase in secondary system st eam flow (excessive load increase incident) is defined as a rapi d increase in steam flow that causes a power mismatch between the reactor core power and the steam generator load demand. The re actor control system is designed to accommo date a 10% step load increase of a 5% per minute ramp load increase in t he range of 15% to 100% of full power. Any loading rate in excess of these values may cause a reactor trip actuated by the reactor pro tection system.

Steam flow increases great er than 10% are anal yzed in Subsections 15.1.4 and 15.1.5.

This accident could result from either an administrative violation such as excessive lo ading by the operator or an equipment malfunction in the steam dump control or turbine speed control.

During power ope ration, steam dump to the condenser is controlled by reactor coolant c ondition signals, i.

e., high reactor coolant temperature indicates a need for steam dump.

A single controller malfunction does not cause steam dump; an interl ock is provided which blocks the opening of the valves unless a large turbine load decrease or a tur bine trip has occurred.

Protection against an excessive load i ncrease accident is provided by the following reactor protection system (RPS) signals:

a. Low pressurizer pressure, b. Overtemperature T, and c. Power range high neutron flux.

An excessive load increase inc ident is considered to be an ANS Condition II event, a fault of moderate freq uency. See Subsection 15.0.1 fo r a discussion of Co ndition II events.

15.1.3.2 Analysis of Ef fects and Consequences Method of Analysis This accident is analyzed using the LOFTRAN Code (Reference 1).

The code simulates the neutron kinetics, rea ctor coolant system, (RCS) pressurizer, p ressurizer relief and safety valves, pressurizer spray, steam gener ator, steam generator safety valves, and feedwater sy stem. The code comp utes pertinent plant variables including temperatures, pressures, a nd power level.

B/B-UFSAR 15.1-8 REVISION 6 - DECEMBER 1996 Four cases are analy zed to demonstrate t he plant behavior following a 10% step load increa se from rated load.

These cases are as follows:

a. reactor control in manual with m inimum reactivity feedback, b. reactor control in manual with m aximum reactivity feedback,

c. reactor control in automatic with mi nimum reactivity feedback, and

d. reactor control in automatic with ma ximum reactivity feedback.

For the minimum reactivi ty feedback cases, t he core has a zero moderator temperature coefficient of reactivity and therefore, the least inherent t ransient capability. For the maximum reactivity feedback ca ses, the moderator tem perature coefficient of reactivity has its highest absolute value.

This results in the largest amount of reactivi ty feedback due to changes in coolant temperature.

A conservative limit on the turbine valve op ening is assumed, and all cases are studied without credit tak en for pressurizer heaters. This accident is analyzed with t he revised thermal design procedure as described in WCAP-11397-P-A.

Plant characteristics and initial conditions a re discussed in Subs ection 15.0.3.

Initial reactor power, p ressure, and RCS temperatures are assumed to be at their nomin al values. Uncert ainties in initial conditions are i ncluded in the l imit DNBR as described in WCAP-11397-P-A.

Normal reactor control s ystems and eng ineered safety systems are not required to function. T he reactor protect ion system is assumed to be operable; however, reactor trip is not encountered for many cases due to the error allowances assumed in the setpoints. No single ac tive failure will prevent the reactor protection system from performing it s intended function.

The cases which assume automatic rod control are analyzed to ensure that the worst case is presented.

The automatic rod control system is not re quired to mitigate t he consequences of an accident.

Results Figures 15.1-3 through 1 5.1-6 illustrate the transient with the reactor in manual rod control mode. As expected, for the minimum reactivity feedback ca se there is a slight power increase, and the average core temperature sho ws a large decrease. This results in a DNBR which increases above its initial value. For the maximum reactivity f eedback manually contr olled case, there is a much B/B-UFSAR 15.1-9 REVISION 9 - DECEMBER 2002 larger increase in react or power due to the moderator feedback.

A reduction in DNBR is experienced, but DNBR remains above the limit value. For th ese cases, the pla nt rapidly reaches a stabilized condition at the higher power level. Normal plant operating procedures would t hen be followed to reduce power.

Figures 15.1-7 through 1 5.1-10 illustrate th e transient assuming the reactor is in the automatic rod control mo de and no reactor trip signals occur.

Both the minimum and maximum reactivity feedback cases show that core po wer increases, t hereby reducing the rate of decrease in cool ant average temperature and pressurizer pressure.

For both of these cases, the minimum DNBR remains above the limit value.

The excessive load inc rease incident is an overpower transient for which the fuel tem peratures will rise.

Reactor trip may not occur for some of the cases analyzed, and th e plant reaches a new equilibrium condition at a higher power level corresponding to the increase in steam flow.

Since DNB does not o ccur at any time dur ing the excessive load increase transients, the ability of the primary coolant to remove heat from the fuel r od is not reduced. Thus , the fuel cladding temperature does not rise signif icantly above its initial value during the t ransient.

The calculated sequence of events for the excessive load increase incident is shown on Table 15.1-1.

As can be seen from Figures 15.1-4, 15.1-6, 15.1-8, and 15.1-10, for the excessive increase in secondary steam flow accident analysis, the conservative ass umptions made in this analysis result in no reactor trip for all cases analyzed. The plant analyses show that a new stead y-state condition is reached.

15.1.3.3 Radiological Consequences There are no radiological conseq uences associated with this event and activity is contai ned within the fuel rods and reactor coolant system withi n design limits.

15.1.3.4 Conclusions The analysis discussed above shows that for a 10% step load increase, the DNBR remains abo ve the limit value, thereby precluding fuel or clad damage. The pla nt rapidly reaches a stabilized condition fol lowing the load increase.

B/B-UFSAR 15.1-10 REVISION 7 - DECEMBER 1998 15.1.4 Inadvertent Opening of a Steam Generator Relief or Safety Valve The inadvertent opening of a steam generator relief or safety valve event (i.e., t he credible steamline break) creates a depressurization of the secondary side with an effective opening size that is within the spectrum of break sizes analyzed by the hypothetical steamline break event. The refore, the credible steamline break is b ounded by the hypo thetical steamline break discussed in Subsect ions 15.1.5 and 15.1.6.

B/B-UFSAR 15.1-11 through 15.1-13 REVISION 7 - DECEMBER 1998

Pages 15.1-11 through 15.1-13 have been deleted intentionally.

B/B-UFSAR 15.1-14 REVISION 12 - DECEMBER 2008 15.1.5 Steam System Pip ing Failure at Zero Power 15.1.5.1 Identification of Caus es and Accident Description The steam release arising from a break of a main steamline would result in an initial increase in steam f low which decreases during the accident as the steam pressure falls. The energy removal from the RCS causes a reduction of coolant temperature and pressure. In the presence of a negative moderator temperature coefficient, the coo ldown results in an insertion of positive reactivity. If the most reactive rod cluster control assembly (RCCA) is ass umed stuck in its full y withdrawn position after reactor trip, there is an increased possibility that the core will become critical and re turn to power. A return to power following a steamline br eak is a potential probl em mainly because of the high power peaking factors which exist as suming the most reactive RCCA to be stuck in its fully withdrawn pos ition. The core is ultimately s hut down by the bo ric acid injection delivered by the safety injection system.

The analysis of a main steamline break is performed to demonstrate that the followi ng criteria are satisfied:

a. Assuming a stuck RCCA wi th or without offsite power, and assuming a single fa ilure in the engineered safety features, the core remains in place and intact. Radiation doses do not exceed the guidelines of 10 CFR 50.67.

b. Although DNB and possible clad perforati on following a steam pipe bre ak are not neces sarily unacceptable, the following analys is, in fact, sho ws that DNBR never falls below the analys is limit for any break assuming the most reactive assemb ly stuck in its fully withdrawn position. The DNBR design basis is discussed in Section 4.4.

A major steamline br eak is classified as an ANS Condition IV event. See Subsection 1 5.0.1 for a discussi on of Condition IV events.

Effects of minor seconda ry system pipe breaks are bounded by the analysis presented in this section.

Minor secondary system pipe breaks are class ified as Condition III e vents, as described in Subsection 15.0.1.3.

B/B-UFSAR 15.1-15 REVISION 10 - DECEMBER 2004 The major break of a steamline is the mo st limiting cooldown transient and is analyzed at z ero power with no decay heat.

Decay heat would retard the cooldown thereby reducing the return to power. A detailed analysis of this transie nt with the most limiting break size, a double ended break, is presented here.

The following functions provide the protecti on for a steamline break: a. Safety injection system actuation fr om any of the following:

1. Two-out-of-three low s teamline press ure signals in any one loop

2. Two-out-of-four low pres surizer pressure signals.

3. Two-out-of-three high-1 containment pressure signals. b. The overpower reactor tr ips (neutron flux and T) and the reactor trip occurring in conjunction with receipt of the safety injection signal.

c. Redundant isolation of t he main feedwater lines.

Sustained high feedwater flo w would cause additional cooldown. Therefore, in addition to the normal control action which will close the main feedwater valves a safety injection signal will rapidly close all feedwater contro l valves and backup feedwater isolation valves, trip the main feedwater pumps, and close the feedwater pu mp discharge valves.

d. Trip of the fast acting steamline stop valves (designed to close in le ss than 5 se conds) on:

1. Two-out-of-three low s teamline press ure signals in any one loop.

2. Two-out-of-three high-2 containment pressure signals. 3. Two-out-of-three high ne gative steamline pressure rate signals in any one loop (used only during cooldown and heatup operations).

The blocking of safe ty injection from the low pressurizer pressure and/or low st eamline pressure signa ls is permitted following receipt of the P-11 pe rmissive to allow the plant to be intentionally cooled down with out the initiation of safety injection. To ensure that the hot zero power steamline break analysis is bounding when these automatic signals are blocked, the RCS must be bora ted to ensure su bcriticality at 200

°F. Prior to manually blocking these automatic s ignals, meeting the subcriticality b oron concentra tion for 200

°F and meeting the normal shutdown margin b oron concentration at the current core conditions are both required.

B/B-UFSAR 15.1-15a REVISION 10 - DECEMBER 2004 For breaks downstream of the isolation valve s, closure of all valves would com pletely terminate the blowdown.

For any break, in any location, no more than one steam generator would experience an uncontrolled blowd own even if one of the isolation valves fails to close. A description of ste amline isolation is included in Chapter 10.0.

B/B-UFSAR 15.1-16 REVISION 9 - DECEMBER 2002 Steam flow is measured by monitoring dynamic head in nozzles located in the t hroat of the steam gener ator. The effective throat area of the nozzl es is 1.1 square feet for Unit 1 and 1.4 square feet for Unit 2, which is considerably less than the main steam pipe area; thus, the nozzles also serve to limit the maximum steam flow for a break at any location.

Table 15.1-2 lists the equipment required in the recovery from a high energy line break.

Not all equipment is required for any one particular break, si nce the requirements w ill vary depending upon postulated break location and details of balance of plant design and pipe break criteria as disc ussed elsewhere in this application. Design criteria and methods of protection of safety-related equipment fro m the dynamic effects of postulated piping breaks are prov ided in Section 3.6.

15.1.5.2 Analysis of Ef fects and Consequences Method of Analysis

The analysis of the st eam pipe break h as been performed to determine:

a. The core heat flux and R CS temperature and pressure resulting from the coold own following the steamline break. The LOFTRAN code (Refe rence 1) has been used.

b. The thermal and hydraulic behavior of the core following a steamline break.

A detailed thermal and hydraulic digital-computer code, THINC, has been used to determine if DNBR falls below the safety analysis limit for the core condi tions computed in item a above. The following conditions were assumed to exist at the time of a main steam break accident:

a. End-of-life shutdown m argin at no-load, equilibrium xenon conditions, and the mo st reactive RCCA stuck in its fully withdrawn posi tion. Operation of the control rod banks during core burnup is restricted in such a way that addition of positive reactivity in a steamline break accident wil l not lead to a more adverse condition than the case analyzed.

b. A negative moderator c oefficient corresp onding to the end-of-life rodded c ore with the mos t reactive RCCA in the fully withdrawn position.

The varia tion of the coefficient with temperature and pressure has been included. The K eff versus temper ature at 1150 psi corresponding to the neg ative moderator temperature coefficient used is shown in Figure 15.1-11. The effect of power gene ration in the core on overall reactivity is shown in Figure 15.1-14.

B/B-UFSAR 15.1-17 REVISION 6 - DECEMBER 1996 The core properties asso ciated with the sector nearest the affected ste am generator and those associated with the re maining sector were conservatively combi ned to obtain average core properties for reactivity feedback calculations.

Further, it was conservative ly assumed that the core power distribution w as uniform. These two conditions cause underprediction of the reactivity feedback in the high power region near the stuck r od. To verify the conservatism of this met hod, the reactivity as well as the power distributi on was check ed for the limiting statepoints for the cases analyzed.

This core analysis considere d the Doppler reactivity from the high fuel tempe rature near the stuck RCCA, moderator feedback from the high water e nthalpy near the stuck RCCA, power redist ribution and non-uniform core inlet tempe rature effects. For cases in which steam generation occurs in the high flux regions of the core, the effect of void formation was also included. It was determ ined that the reactivity employed in the kinetics analy sis was always larger than the reactivity calculat ed including the above local effects for the statep oints. These results verify conservatism; i.e., underpredic tion of negative reactivity feedback fr om power generation.

c. Minimum capabi lity for injecti on of concentrated boric acid (2,300 ppm) s olution correspo nding to the most restrictive single failure in the high head safety injection (HH SI) system. The emergency core cooling system (ECCS

), consists of t hree systems:

(1) the passive accumulators , (2) the residual heat removal system (RHRS

), and (3) the low head safety injection system (LHSIS), an d the HHSI system. Only the HHSI system is modeled f or the steam line break accident analysis.

The actual modeling of the HHSI system in LOFTRAN is described in Reference 1.

The flow co rresponds to that delivered by one ch arging pump delivering its full flow to the cold leg he ader. No credit has been taken for the low concen tration borated water, which must be swept fr om the lines d ownstream of the refueling water storage tank prior to the delivery of concentrated boric acid to the react or coolant loops.

For the cases where offsite po wer is assumed, the sequence of events in the HHSI system is the following. After the generation of the safety injection signal (appr opriate delays for instrumentation, logic, and signal transport included), the appro priate valves be gin to operate and the charging pump starts. In 17 seconds, the B/B-UFSAR 15.1-18 REVISION 9 - DECEMBER 2002 valves are assumed to be in their final position and the pump is assumed to be at full speed. This does not include sequential transfer of high head safety injection pump sucti on from the VCT to t he RWST. The additional 10 seconds for valves CV112B and C to close after CV112D a nd E are open ha s been evaluated and is consistent wi th the accident an alysis results.

Transfer of the pump suction would be completed in 27 seconds. The volume con taining the low concentration borated water is swe pt before the 2, 300 ppm borated water reaches the co re. This delay, described above, is inherently includ ed in the modeling.

In cases where o ffsite power is not available, an additional 13-second del ay is assumed to start the diesels and to load the nece ssary safety injection equipment onto them.

d. Design value of the steam generator heat transfer coefficient includin g allowance for fouling factor.

e. Since the steam generators are provi ded with integral flow restrictors with a 1.1 square foot throat area for Unit 1 and a 1.4 square foot throat area for Unit 2, any break with a break area greater than the area of the flow restrict or, regardless of location, would have the same effect on the NSSS as the break equal to the area of the flow restrictor.

The following cases have been cons idered in determining the core power and RCS transients:

Case 1: Complete severance of a pipe, with the plant initially at no-load conditions, full reactor coolant flow with offs ite power available.

Case 2: Case 1 w ith loss of offsite power coincident with the steamline break.

Loss of offsite power results in reactor coolant pump coastdown, which is as sumed to begin at 3 seconds. f. Power peaking fa ctors corresponding to one stuck RCCA and nonuniform core inlet co olant temperatures are determined at end of core life. The coldest core inlet temperatures a re assumed to occur in the sector with the stuck rod. T he power peaki ng factors account for the effect of the local void in the region of the stuck cont rol assembly during the return to power phas e following the st eamline break.

This void in conjuncti on with the large negative moderator coefficient partia lly offsets the effect of the stuck assembly. The power peaking f actors depend upon the core power, tempera ture, pressure, and flow, and, thus, are different for each case studied.

B/B-UFSAR 15.1-19 REVISION 9 - DECEMBER 2002 The core parameters used for both with and without offsite power cases correspond to values determined from the respective transient analysis.

Both cases above assume initial hot shutdown conditions at time zero since this represents the most pessimistic initial condi tion. The hot shutdown initial conditions w ere considered for cases assuming full power operation at both the high (588.0 o F) and low (575.0 o F) HFP Tavg conditions. S hould the reactor be just critical or operating at power at the time of a steamline break, the reactor will be tripped by the normal overpower protection system when power level reaches a trip p oint. Following a t rip at power, the RCS contains more stored ene rgy than at no-load, the average coolant temp erature is higher than at no-load and there is appreciable ene rgy stored in the fuel.

Thus, the additional stored energy is removed via the cooldown caused by the s teamline break before the no-load conditions of RCS temperature and shutdown margin assumed in th e analyses are rea ched. After the additional stored energy has been removed, the cooldown and reactiv ity insertions pro ceed in the same manner as in the analysis which assu mes no-load condition at time zero.

A spectrum of steamline breaks at various power levels has been analyzed in Reference 4.

g. In computing the steam f low during a s teamline break, the Moody Curve (Reference 3) for f(L/D) = 0 is used.

h. Perfect moisture separation in the steam generator is assumed. These assumptions are discussed more ful ly in Reference 4.

Results The calculated sequence of events for the li miting case (Unit 2, low Tavg , offsite power available) is shown in Table 15.1-1.

The results presented are a conservative indic ation of the events which would occur assuming a s teamline break since it is postulated that all of the conditions described above occur simultaneously.

Core Power and Reactor Coolant System Transient Figures 15.1-18 through 15.1-20 for Unit 2 show the RCS transient and core heat flux fol lowing a main stea mline break (complete severance of a pipe) at initial no-load condition.

Offsite power is assumed available so that f ull reactor coolant flow exists. The tran sient shown assumes an uncontrolled steam release from only on e steam generator.

Should the core be critical at near zero power when the break occurs, the initiation of safety injection by low steamline pressure will B/B-UFSAR 15.1-20 REVISION 9 - DECEMBER 2002 trip the reactor. Steam rel ease from more than one steam generator will be prev ented by automatic trip of the fast acting isolation valves in the steamlin es by low steamline pressure signals, high containment pressu re signals, or high negative steamline pressure r ate signals. Even w ith the failure of one valve, release is limited to no more than 10 seconds for the other steam generato rs while the one generat or blows down. The steamline stop valves are designed to be fully closed in less than 5 seconds from rece ipt of a closure signal.

As shown in Figure 15.

1-20 the core attains criticality with the RCCAs inserted (with the design shutdown ass uming one stuck RCCA) before boron solution at 2,300 ppm enters the RCS. A peak core power lower than the n ominal full power value is attained.

The calculation assumes the boric acid is mixed with, and diluted by, the water flowing in the RCS prior to en tering the reactor core. The concentra tion after mixing depend s upon the relative flow rates in the RCS and in t he HHSI system. T he variation of mass flow rate in the RCS due to water densi ty changes is included in the calculat ion as is the variation of flow rate in the HHSI system due to changes in the RCS pressure. The HHSI system flow calculation includes the line lo sses in the system as well as the pump head curve.

The loss of offsite power case corre sponds to the case discussed above with additional loss of offsite power at the time the safety injection signal is generated. The safety injection system delay time incl udes 13 seconds to sta rt the diesel in addition to 17 seconds to start the safety i njection pump and open the valves. An additional 10 seconds is re quired to close valves CV112B and C after CV112D and E are o pen to transfer the high head safety injecti on pump suction from the VCT to the RWST.

This additional 10 s econd delay has been evaluated and is consistent with the ac cident analysis result

s. In 40 seconds, the diesel and pump are assumed to start and the valves are assumed to be in their final position wi th the pump suction transferred from the VCT to the RWST. Criticali ty is achieved later and the core power increase is slower th an in the similar case with offsite power availabl

e. The ability of the emptying steam generator to extra ct heat from the RCS is reduced by the decreased flow in the RC S. The peak power r emains well below the nominal full power value.

It should be noted that following a st eamline break only one steam generator blows do wn completely. Thus, the remaining steam generators are s till available f or dissipation of decay heat after the initial tran sient is over. In the case of loss of offsite power this heat is removed to the atmosphere via the steamline safety valves.

B/B-UFSAR 15.1-21 REVISION 12 - DECEMBER 2008 Margin to Crit ical Heat Flux DNB analyses were pe rformed for both uni ts, with and without offsite power and High and Low T avg programs. The minimum DNBR is greater than the limit v alue in all cases and the limiting case is that for Unit 2 (D5 SGs), low HFP Tavg case, with offsite power available. The results of this case are presented herein.

15.1.5.3 Radiological Consequences of a Postula ted Steamline Break Using AST The key inputs and ass umptions used in the M ain Steam Line Break (MSLB) radiological cons equence analysis are s ummarized below and provided in Table 15.1-3. Altho ugh this analysis is presented in the section describing a steam system piping failure at zero power, it is also ap plicable for the full power event (described in section 15.1.6).

The MSLB accident is p ostulated as a break of one of the large steam lines leading from a steam gen erator. This break results in the release of radioactive material from the Byron and Braidwood containment system.

For the three intact Steam Generator (SG) loops, primary to secondary coolant leakage transfers activity i nto the Secondary Coolan

t. This makes it available for release into the environment via steaming through the SG Power-Operated Re lease Valves (PORV).

For the coolant loop with the broken s team line (referred to as the faulted steam generator), primary to s econdary coolant leaka ge is assumed to be released from the RCS directly into the environment without passing through any se condary coolant. This is due to assumed "dry-out" conditions in the faulted steam ge nerator. Consistent with Regulatory Guide (RG) 1.183, two re actor transients that maximize the radioactivity avail able for release were modeled.

In addition to these two transients, the release of the maximum allowed operational conc entration of iod ine activity in the secondary coolant system, 0.1 µC i/gm is analyzed.

This Case simulates the initial blowdown of all fluid in the faulted SG (assuming a 2-minute d uration), and the PORV release of secondary coolant activity of the inta ct SGs. The dose co nsequence of this simulation is added to each of the o ther modeled cases.

Case 1: Dose Due to P re-accident Iodine Spike The first case involves a 60 uCi/gm pre-accident Iodine spike.

This 60 µCi/gm spike is consistent w ith the Technical Specification operational Reactor Coolant System (RCS) activity concentration limit for an assumed spike.

In this scenario, it is assumed that all of the spike activity is homogeneously mixed in the primary coola nt, prior to accid ent initiation.

B/B-UFSAR 15.1-21a REVISION 12 - DECEMBER 2008 Case 2: Dose Due to Accident Initiated Concurrent Iodine Spike The second case involves an acci dent initiated i odine spike that occurs concurrently with the release of flui d from the primary and secondary coolant systems. Regulatory guidance specifies that this spike shou ld result in a relea se rate from the operating limit defect ive fuel fraction that is 500 times the normal rate.

Case 3: Dose Due to Equilibrium Secondary Coo lant System Iodine The third case simulates the dose contribution t hat results from the initial blowdown of all fluid in the faulted SG (assuming a 2-minute duration), and the PORV release of secondary coolant through the intact SGs.

These releases of s pecifically secondary coolant activity, exis ting prior to the MSLB accident, are analyzed, and the dose is added to each of the other modeled cases. Fuel Damage and Core Source Term The design basis assumes no fuel damage for the post ulated main steam line break event.

For this MSLB accid ent, the source terms are defined by the Techn ical Specification a ctivity release rates from a maximum f ailed fuel fraction assu med during operation, which are characterized by the equilibri um 1.0 µCi/gm Dose Equivalent(DE) I-131 iod ine activity concentrati on in the primary reactor coolant system.

The noble gas i nventory in the RCS is based on operation with a conservative worst-case 1% core fuel defects. Because no fuel da mage is assumed for this accident, only iodine and noble gas isotopes are modeled to co ntribute to dose, as given in Table 15.0-16. To identify the worst-case MSLB accident, however, t wo different cases of iodine spiking are analyzed, per regulatory guidance.

Case 1: Pre-Acc ident Iodine Spike Source Terms The first case is simply ident ified as a react or pre-accident, transient induced, iodine spike, which raises the pr imary coolant iodine concentration to the maximum 60 µ Ci/gm DE I-131 value permitted by Technic al Specifications at ful l power operations, prior to the initiation of the accident.

Therefore this case is termed the pre-accident iodine spike case.

B/B-UFSAR 15.1-21b REVISION 12 - DECEMBER 2008 Case 2: Concurrent Iodi ne Spike Source Terms The second case assumes that the postulated MSLB event causes a primary reactor system t ransient. This tran sient, in turn, is associated with an i odine spike which as sumes that t he iodine release rate from the fuel rods to the p rimary coolant increases to a value 500 times greater than the re lease rate corresponding to the 1.0 µCi/gm DE I-131 equilibrium iodine concentration as given in the Technical Specifications. This 500 times activity release rate spike is assumed to occur for a d uration of 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months , as this period has been shown to conse rvatively deplete the available gap activity in the assumed op erating damaged fuel fraction. Also, this assumption has historically been used as the design basis for this acci dent at Byron and Braidwood. In RADTRAD a Nuclide Inve ntory File (NIF) is de signed to input the total isotopic iodine ac tivity that is associated with 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months of activity release at the 500 times ra te specified. Then, this NIF is used in conju nction with a modified Release Fraction and Timing (RFT) file, w hich defines the com plete release of this activity over a 6-ho ur period.

Case 3: Equilibrium Secondary Coolant System Iodine S ource Terms The case 3 source term consists simply of the 0.1 µCi/gm DE I-131 equilibrium secondary co olant activity c oncentration limit in Technical Specifications.

Activity Removal Mecha nisms in Containment The design basis MSLB releases activity direct ly into the primary RCS, therefore no pl ateout, or other act ivity deposition, is credited.

Decay Credited:

Decay of radioactivity is credited in all compartments, prior to release. This is implemented in RADTRAD using the half-lives in the NIFs. The RADTRAD d ecay option is used. Depletion from L eakage Credited:

For analyses of doses due to release from the RCS volume, the dose results from leak age. It is reasonable to credit the small amount of depletion from the a vailable RCS act ivity inventory associated with this leakage. T his is calculated inherently by the RADTRAD code.

B/B-UFSAR 15.1-21c REVISION 12 - DECEMBER 2008 Release Rates, Steaming Rates, and Par titioning Factors:

Activity that originates in the primary RCS is r eleased to the secondary coolant by means of the primary-to-secondary coolant leak rate. This design basis leak rate v alue is 0.21 8 gpm, per intact SG, totaling 0.654 gpm, and 0.5 gpm for the faulted SG with the broken steam line. For input into RADTRAD these rates were converted from ga llons per minute to cu bic feet per minute, making them 0.02914 cfm, per int act SG, totaling 0.08743 cfm, and 0.06684 cfm for the faulted SG.

Primary to secon dary coolant leakage t hrough the faulted steam generator conservatively goes directly to th e environment, without mixing with any secondary coolant.

Therefore, under the assumed dry-out condit ions, no partitioning of any nuclides is expected to occur in t his release pathway.

For all post-accident re leases through t he PORVs of the intact SG loops, the mecha nism for release to the environment is steaming of the secondary coolant. Becau se of this rel ease dynamic, RG 1.183 allows for a reduction in the amount of activity released to the environme nt based on partitioning of nuclides between the liquid and gas s tates of water. For I odine, the partitioning factor of 0.01 was taken directly from the suggested guidance of RG 1.183. Reviewing the specifi ed AST release fract ions, it is concluded that the only nuclides other than iodines to be released from the core source te rm are noble g as nuclides.

Because of the volatility of noble gases, no partitioning is assumed for any such isotopes.

The methodology used to model steaming of acti vity through PORVs following the postulated MSLB event, assumes an average cumulative release r ate through the SG valve s that is reduced in steps. The parti tioning factors are appl ied to these release rates, which were de rived from the tot al time increment mass releases. Incremental steam mass releases are in pounds.

Release rates were deriv ed by dividing these totals by the time increment. This data was then c onverted using the assumption of cooled liquid conditions (i.e., 62.4 lbm/ft 3), as specified by the applicable guidance of RG 1.183. The steaming release and primary-to-secondary coo lant leakage is postulated to end at 40 hours4.62963e-4 days 0.0111 hours 6.613757e-5 weeks 1.522e-5 months , when the RCS and secondary loop have equilibr ated. The following table below sh ows the time steps, is otopic partitioning factors, and associa ted release rates:

B/B-UFSAR 15.1-21d REVISION 12 - DECEMBER 2008 MSLB Partitioning Factors And Associated Release Rates Time Interval (hrs) Total Steam Mass Release (lbm) Iodine Partitioning Factor Noble Gas Partitioning Factor Steam Release Rate for Iodines (cfm) Steam Release Rate for Noble Gases (cfm) 0 - 2.0 442,000 0.01 1 5.9001E-01 5.9001E+01 2.0 - 8.0 977,000 0.01 1 4.3472E-01 4.3472E+01 8.0 - 40 2,216,000 0.01 1 1.8488E-01 1.8488E+01 For the loop with the br oken steam line, i.e., the faulted SG, it is postulated that the entire release of the secondary coolant of that loop will take 2 minutes. Therefor e, for input into RADTRAD the faulted SG coolant volume of 2675 ft 3 is divided by 2 minutes to arrive at a design ba sis value of 1.3375E+03 cfm.

/Q Calculations (Meteorology)

Releases from the SG PORVs were considered eleva ted releases due to the high steaming rat es and the associated /Qs were reduced by a factor of 5 per guidance in RG 1.194, as described in Section 15.4.8.3. The atmospheric dispersio n factors are given in Table 15.0-17.

Assumptions and Inputs The following inputs and assumpt ions were used in the MSLB analysis.

a. Core inventory is ba sed on a DBA power l evel of 3658

.3 MWth, which is 102% of the Rated Therm al Power Level of 3586.6 MWth, to account for measu rement uncertainty.

b. There is no fuel damage as a r esult of the p ostulated main steam line break accident.

c. In the case of a postu lated Iodine activity release rate spike, the spike release is assumed to occur for a period of 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months , when the activity available for release from the fuel has been conservatively depleted.

d. The activity release d from the fuel is assumed to be instantaneously mixe d with the RCS.

e. All iodine released from the S Gs is assumed to be of the elemental species. This is do ne for RADTRAD simulation considerations, and is consistent wi th the RG 1.183 specification of 97% element al and 3% or ganic, because elemental and organic iodine a re treated identically by the computer model.

B/B-UFSAR 15.1-21e REVISION 13 - DECEMBER 2010

f. The Control Room HVAC system is realigned to the emergency mode of operation 30 minu tes after the initia tion of this design basis accident.

g. The faulted steam generator is a ssumed to be in a "dry-out" condition, and does not inhibit activity rel ease from the RCS through that c oolant loop.

h. It is conservatively assumed that blowdown of the faulted steam generator 167,000 lbm fluid ta kes two minutes to complete.

Dose Results Radiological doses res ulting from a desi gn basis MSLB for a control room operator and a person located at EAB or LPZ are to be less than the regulatory dose limits as given below.

Regulatory Dose Limits - MSLB Dose Type Control Room (rem) EAB and LPZ (rem) Case 1 TEDE Dose 5 a 25 b Case 2 TEDE Dose 5 a 2.5 b Notes: a 10 CFR 50.67 b 10 CFR 50.67 as modified by Regulato ry Guide 1.183 (Table 6, Page 1.183-20)

The table below provides the results from the Case 1 and Case 2 simulations that were mo deled using the RADTRAD 3.03 code. The total dose for t he two cases includes the dose resul t from the Case 3 simulations. Ther efore for convenience, the doses shown in the Table include the Case 3 dose.

Main Steam Line Break Accident Radiological A nalysis Results Case 1: Pre-Accident 60 uCi/

gm DE I-131 Spike RADTRAD Dose Ass essment Results Control Room (REM TEDE)

EAB (REM TEDE)

LPZ (REM TEDE) 0.581 0.127 0.073 Case 2: Accident Initiated 5 00 times Equilibrium Iodine Release Rate Spike RADTRAD Dose Ass essment Results Control Room (REM TEDE)

EAB (REM TEDE)

LPZ (REM TEDE) 2.844 0.175 0.406

B/B-UFSAR 15.1-22 REVISION 12 - DECEMBER 2008

THIS PAGE WAS IN TENTIONALLY DELETED

B/B-UFSAR 15.1-23 REVISION 12 - DECEMBER 2008 15.1.5.4 Conclusions The analysis has shown that the criteria sta ted in Subsection 15.1.5.1 are satisfied f or operation of all un its at the uprated power conditions. Alt hough DNB and possible cladding perforation following a steam pipe break are not necessarily unacceptable and not precluded by the cri teria, the above analy sis, in fact, shows that the DNB design basis is met as stated in Section 4.4.

The radiological consequences of thi s event are with in the dose acceptance criteria of 10 CFR 50.67 and Regu latory Guide 1.183.

15.1.6 Steam System Pip ing Failure at Full Power 15.1.6.1 Identification of Caus es and Accident Description The steam system piping failure accident ana lysis described in Subsection 15.1.5 wa s performed assuming hot zero power conditions with the co ntrol rods fully inserted in the core with the exception for the mo st reactive rod. Su ch a condition could occur while the reactor is in hot shutdown at the minimum required shutdown margin or after the plant has been tripped automatically by the rea ctor protection system or manually by the operator. For an at-power s teamline break, the analysis of Subsection 15.1.5 represents t he limiting condition with respect to core protection f or the period foll owing reactor trip.

Analysis of a steam system piping failure occurring from at-power initial conditions is performed to dem onstrate that core protection is maintained prior to and immediately following reactor trip.

Depending on the size of the bre ak, this event is classified as either a Condition III (infrequent fault) or Condition IV (limiting fault) event. The acc eptance criteria for this event are defined in Subsection 15.0.1.

15.1.6.2 Analysis of Ef fects and Consequences Method of Analysis

The analysis of the st eamline break at-power was performed as follows:

a. The LOFTRAN code (Reference

1) was used to calculate the nuclear power, c ore heat flux, a nd reactor coolant system temperature a nd pressure transi ents resulting from the cooldown follow ing the steamline break.

b. The core radial and axial peaking factors were determined using the thermal-hydraulic conditions from LOFTRAN as input to the nucl ear core models. A detailed thermal-hydraulic code, THINC, was used to calculate the DNBR for t he limiting time during the transient.

B/B-UFSAR 15.1-23a REVISION 9 - DECEMBER 2002 The analysis was performed w ith the revised thermal design procedure as describ ed in WCAP-11397-P-A (Reference 8). Plant characteristics and initial co nditions area discussed in Subsection 15.0.3.

Assumptions

a. Initial conditions - The initial core power, reactor coolant temperature, and reactor coolant system pressure were assumed to be at t heir nominal full-power values at uprated power cond itions. Cases assuming full power operation at both the high (588 o F) and low 575 o F) HFP T avg conditions are consid ered. In addition, cases reflecting both uniform and asymmetric initial loop flow conditions are con sidered. The asymmetric flow cases assume a maxi mum 5% loop-to-loop asymmetric flow variation.

b. Break size - The limiting break size w as calculated to be 0.968 ft 2 for Unit 1. The results for this case bound all other brea k sizes for both U nit 1 and Unit 2.

c. Break flow - In computing the steam flow during a steamline break, the Moody curve for f(L/D)=0 is used.

d. Reactivity coe fficients - The an alysis assumed maximum moderator reactivity feedbac k and minimum end-of-life Doppler power feedback to maximize the power increase following the break.

e. Protection system - The protection sys tem features that mitigate the effects of a st eamline break are described in Subsection 15.1.5.

This analysis o nly considers the initial phase of the t ransient from at-power conditions. Protection in th is phase of the transient is provided by react or trip, if necess ary. Subsection 15.1.5 presents the an alysis of the bo unding transient following reactor trip, where other prot ection system features are actuated to mit igate the effects of the steamline break.

f. Control systems -

The pressurizer spra ys are modeled to minimize RCS pressur e, which is cons ervative with respect to DNBR. Other control systems were not credited in mitigating the e ffects of the transient since doing so would not make the results more limiting.

B/B-UFSAR 15.1-23b REVISION 12 - DECEMBER 2008 Results The sequence of events f or the limiting case (Unit 1) is shown in Table 15.1-1. Altho ugh a break spectrum was analyzed, plots from only one break size (0.968 ft 2 break) are shown. Figures 15.1-27 through 15.1-29 show the transient responses for Unit 1.

Conclusions The 0.968 ft 2 break with symmetric RCS f low for Unit 1 is the most limiting case for both k W/ft and DNB considera tions. The Unit 1 results bound the resu lts of Unit 2.

For radiological consequences of a postulated steamline break, see section 15.1.5.3.

15.1.7 References

1. Burnett, T. W. T., et al

., "LOFTRAN Co de Description," WCAP-7907-P-A (Proprie tary), WCAP-7907-A (Non-Proprietary), April 1984.

2. Deleted.

3. Moody, F. S., "Trans actions of the ASME," Journal of Heat Transfer , Figure 3, page 134, February 1965.

4. Hollingsworth, S. D.

and Wood, D. C., "Reactor Core Response to Excessive Seconda ry Steam Releases," WCAP-9226, Revision 1, (Proprietary), January, 1 978, and WCAP-9227, Revision 1, (Non-Proprietary), January 1978.

5. Deleted.

6. Deleted.

7. NUREG-0800, "Sta ndard Review Plan," Subsection 15.1.5, Appendix A, "Radiological Cons equences of Main Steamline Failure Outside Contai nment for a PWR," Revision 2, July 1981. 8. Freidland, A. J., et al., "R evised Thermal D esign Procedure," WCAP-11397-P-A (Propriet ary) and WCAP-11397-A (Nonproprietary), April 1989.

B/B-UFSAR 15.1-24 REVISION 9 - DECEMBER 2002 TABLE 15.1-1 TIME SEQUENCE OF EVENT F OR INCIDENTS WHICH CAUSE AN INCREASE IN HEAT REMOVAL BY THE SECONDARY SYSTEM TIME ACCIDENT EVENT (SEC.) Limiting Excessive FW One main feedwater valve fails 0.0 Flow Case open High-High steam generator water 61.6 level setpoint reached Single-Loop Excessive Turbine trip occurs 64.1 FW Flow to Model D5 steam generator -

Minimum DNBR occurs 64.4 manual rod control Reactor trip on turbine trip 66.6 occurs Feedwater isolation occurs 68.6 Limiting Feedwater Feedwater heater bypass valves 0.0 Temperature Reduction fail open and a loss of multiple Case trains of feedwater heaters occurs

Feedwater Temperature Overpower T reactor trip 6.1 Reduction to Model D5 setpoint reached steam generator -

manual rod cotnrol Rod motion occurs 14.1 Minimum DNBR occurs 14.8 Low Pressurizer Pressure SI 38.0 setpoint reached

Feedwater isolation occurs 45.0 B/B-UFSAR 15.1-24a REVISION 9 - DECEMBER 2002 TABLE 15.1-1 (Cont'd)

TIME ACCIDENT EVENT (SEC.) Excessive Increase in Secondary Steam Flow

1. Manual Reactor 10% step load increase 0.0 Control (Minimum moderator feedback)

Equilibrium conditions 400 reached (approximate time only) 2. Manual Reactor 10% step load increase 0.0 Control (Maximum moderator feedback)

Equilibrium conditions 150 reached (approximate time only)

3. Automatic Reactor 10% step load increase 0.0 Control (Minimum moderator feedback)

Equilibrium conditions 300 reached (approximate time only)

4. Automatic Reactor 10% step load increase 0.0 Control (Maximum moderator feedback) Equilibrium conditions 200 reached (approximate time only)

Steam system piping

failure at zero power

1. Unit 2, low Tavg Steamline breaks 0.0 (Offsite power available) Criticality attained 24.8 Pressurizer empties 25.2 Boron reaches core 98.0 B/B-UFSAR 15.1-25 REVISION 9 - DECEMBER 2002 TABLE 15.1-1 (Cont'd)

TIME ACCIDENT EVENT (sec.)

Steam system piping failure at full power

1. Unit 1 - 0.968 ft 2 Steamline breaks 0.0 break with uniform flow Overpower T reactor 8.7 trip setpoint reached Rods begin to drop 16.7 Peak core heat flux 17.4 occurs

B/B-UFSAR

15.1-26

REVISION 3 - DECEMBER 1991 TABLE 15.1-2 EQUIPMENT REQUIRED F OLLOWING A BREAK OF A MAIN STEAM LINE SHORT TERM (REQUIRED FOR MITIGATION OF ACCIDENT) HOT STANDBY REQUIRED FOR COOLDOWN Reactor trip and safeguards Auxiliary feedwater system Steam generator power actuator channels including including pumps, water supply,oper ated relief valves sensors, circuitry, and and system valves and piping (can be manually operated processing equipment (the (this system must be placed locally).

protection circuits used in service to supply water to to trip the reactor on operable steam generators no undervoltage, underfrequency, later than 10 minutes after and turbine trip the incident). may be excluded).

HHSI system including the Reactor containment Resi dual heat removal system pumps, the refueling water ventilation cooling units.

including pumps, heat storage tank, and the exchanger, and system valves systems valves and piping. Capability for obtaining a and piping necessary reactor coolant system sample.to cool and maintain the reactor coolant system in a cold shutdown condition. Standby diesel generators and Class IE power distribution equipment.

Essential service water and plant component cooling water system. Containment safeguards cooling equipment.

B/B-UFSAR 15.1-27 TABLE 15.1-2 (Cont'd)

SHORT TERM (REQUIRED FOR MITIGATION OF ACCIDENT) HOT STANDBY REQUIRED FOR COOLDOWN Auxiliary Feedwater System including pumps, water supplies, piping and valves. Main feedwater control valves (trip closed feature).

Bypass feedwater control valves (trip closed feature). Primary and secondary safety valves.

Circuits and/or equipment required to trip the main feedwater pumps. Main feedwater isolation valves (trip closed feature). Main steam line stop valves (trip closed feature). Main steam line stop valve bypass valves (trip closed feature). Steam generator blowdown isolation valves (automatic closure feature).

B/B-UFSAR 15.1-28 TABLE 15.1-2 (Cont'd)

SHORT TERM (REQUIRED FOR MITIGATION OF ACCIDENT) HOT STANDBY REQUIRED FOR COOLDOWN Batteries (Class 1E).

Control Room air conditioning.

Control Room equipment must not be damaged to an extent where any equipment will be spuriously actuated or any of the equipment contained elsewhere in this list cannot be operated.

Emergency lighting.

Post Accident Monitoring System

a.

ESF and HHSI/charging pump cubicle unit coolers

a See Section 7.5 for a discussion of the Posta ccident Monitoring System.

B/B-UFSAR 15.1-29 REVISION 12 - DECEMBER 2008 TABLE 15.1-3 INPUT PARAMETERS FOR THE MSLB RADIOLOGICAL CONSE QUENCE ANALYSIS USING AST Parameter Unit Value Notes Steam Released to Environment:

Faulted SG (in 2 minutes)

Intact SGs:

0 - 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months 2 - 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months 8 - 40 hours4.62963e-4 days 0.0111 hours 6.613757e-5 weeks 1.522e-5 months Primary to Secondary Leakage: Faulted SG Intact SG (each) lbm lbm lbm lbm gpm gpm 167,000 442,000 977,000 2,216,000 0.5 0.218 The total leakage to be evenly divided for the four steam generators is 1 gpm. For events involving a faulted steam generator, 0.5 g pm leak rate shall be used for faulted generator and 0.

218 gpm shall be used for each of the intact generators.

Assumed to be based on water at cold conditions.

Duration of steam releases from intact SGs hr 40 Duration of activity release due to leakage of primary coolant to the faulted SG hr 40 Accident Iodine Spike Factor of 500 In addition to pre-accident iodine spike case.

Primary and secondary coolant volumes: Primary Secondary: 3 Intact SGs Faulted SG gm gm gm 2.063E8 1.017E8 7.575E7 B/B-UFSAR TABLE 15.1-3 INPUT PARAMETERS FOR THE MSLB RADIOLOGICAL CONSE QUENCE ANALYSIS USING AST (continued) 15.1-29a REVISION 12 - DECEMBER 2008 Parameter Unit Value Notes Noble gas releases through the faulted SG due to primary to secondary leakage: KR-85m KR-85 KR-87 KR-88 XE-131m XE-133m XE-133 XE-135m XE-135 XE-138 Curies Curies Curies Curies Curies Curies Curies Curies Curies Curies 3.713E2 1.467E3 2.372E2 6.911E2 6.829E2 7.530E2 5.178E4 1.007E2 1.593E3 1.368E2 These values, ba sed on operation with 1% fuel defects.

The values are also consistent with a RCS "vo lume" of 2.063E8 gm.

B/B-UFSAR 15.1-30 REVISION 9 - DECEMBER 2002 This page has been i ntentionally deleted.

B/B-UFSAR 15.1-30a REVISION 9 - DECEMBER 2002 TABLE 15.1-3a This page has been i ntentionally deleted.

B/B-UFSAR

15.1-31

REVISION 7 - DECEMBER 1998 TABLE 15.1-4

Table 15.1-4 has been deleted intentionally.

BYRON-UFSAR

15.1-32

REVISION 9 - DECEMBER 2002 TABLE 15.1-4a

This page has been i ntentionally deleted.

BRAIDWOOD-UFSAR

15.1-33

REVISION 9 - DECEMBER 2002 TABLE 15.1-4a

This page have been in tentionally deleted.

BRAIDWOOD-UFSAR

15.1-33a

REVISION 7 - DECEMBER 1998 TABLE 15.1-4b This page have been in tentionally deleted.

B/B-UFSAR 15.2-25 REVISION 11 - DECEMBER 2006 TABLE 15.2-1

TIME SEQUENCE OF EVENTS FOR INCIDENTS WHICH CAUSE A DECREASE IN HEAT REMOVAL BY THE SECONDARY SYSTEM

ACCIDENT EVENT TIME (sec) Turbine Trip

1. Unit 1 Turbine trip, loss of main 0.0 Pressure Case feedwater flow

High pressurizer pressure 5.4 reactor trip setpoint reached

Rods begin to drop 7.4

Peak pressurizer pressure 7.6

Initiation of steam release 9.8 from steam generator safety valves Minimum DNBR occurs (1)

2. Unit 1 Turbine trip, loss of main 0.0 DNB Case feedwater flow

Overtemperature T reactor 6.0 trip setpoint reached Initiation of steam release 6.5 from steam generator safety valves

Peak pressurizer pressure 8.5 occurs

Rods begin to drop 14.0

Minimum DNBR occurs 15.1 3. Unit 2 Turbine trip, loss of main 0.0 Pressure Case feedwater flow

High pressurizer pressure 4.5 reactor trip setpoint reached B/B-UFSAR 15.2-26 REVISION 11 - DECEMBER 2006 TABLE 15.2-1(Cont'd)

TIME SEQUENCE OF EVENTS FOR INCIDENTS WHICH CAUSE A DECREASE IN HEAT REMOVAL BY THE SECONDARY SYSTEM

ACCIDENT EVENT TIME (sec) Initiation of steam release 5.9 from steam generator safety valves

Peak pressurizer pressure 6.3 occurs Rods begin to drop 6.5

Minimum DNBR occurs (1)

4. Unit 2 Turbine trip, loss of 0.0 DNB Case main feedwater flow

Overtemperature T reactor 4.0 trip setpoint reached Initiation of steam release 8.6 from steam generator safety valves

Peak pressurizer pressure 8.7 occurs Rods begin to drop 12.0 Minimum DNBR occurs 13.1

B/B-UFSAR 15.2-27 REVISION 11 - DECEMBER 2006 TABLE 15.2-1 (Cont'd)

ACCIDENT EVENT TIME (sec) Loss of Nonemergency Main feedwater flow 10 a-c Power stops Low-low steam generator 65.5 water level trip

Rods begin to drop 67.5

Reactor coolant pumps 69.5 begin to coastdown Four steam generators 128.5 begin to receive auxiliary feedwater from one motor driven auxiliary feedwater pump

Core decay heat decreases ~345 to auxiliary feedwater heat removal capacity

Cold auxiliary feedwater 682 is delivered to the steam generators

Peak water level in 740 pressurizer occurs

B/B-UFSAR 15.2-27a REVISION 11 - DECEMBER 2006 TABLE 15.2-1 (Cont'd)

ACCIDENT EVENT TIME (sec) Loss of Normal Feed- Main feedwater flow 10 water Flow stops Low-low steam generator 51.3 water level trip

Rods begin to drop 53.3

Four steam generators 106.3 begin to receive auxiliary feedwater from one motor-driven auxiliary feedwater pump

Cold auxiliary feedwater 302 is delivered to the steam generators

Peak water level in 1774 pressurizer occurs

Core decay heat plus pump ~1950 heat decreases to auxiliary feedwater heat removal capacity

B/B-UFSAR 15.2-28 REVISION 9 - DECEMBER 2002 TABLE 15.2-1 (Cont'd)

ACCIDENT EVENT TIME (sec) Feedwater System Pipe Break

1. With offsite power Main feedline break 10 available occurs

Low-low steam generator 32 water level reactor trip setpoint reached in faulted steam generator Rods begin to drop 34 One motor-driven auxiliary 87 feedwater pump starts and supplies three intact steam generators

Low steam line pressure 204 setpoint reached in faulted steam generator All main steam line 212 isolation valves close Cold auxiliary feedwater 268 is deliv ered to intact steam generators

Steam generator safety 510 valve setpoint reached in intact steam generators Pressurizer water relief 1234 begins Core decay heat and ~

4900 pump heat decreases to auxiliary feedwater heat removal capacity

B/B-UFSAR 15.2-29 REVISION 9 - DECEMBER 2002 TABLE 15.2-1 (Cont'd)

ACCIDENT EVENT TIME (sec) 2. Without offsite Main feedline break 10 power occurs Low-low steam generator 32 level reactor trip setpoint reached in faulted steam generator

Rods begin to drop 34 Power lost to the 36 reactor coolant pumps.

One auxiliary feedwater 95 pump starts and supplies three intact steam generators

Low steam line pressure 256 setpoint reached in faulted steam generator All main steam line 264 isolation valves close Cold auxiliary feedwater 276 is deliv ered to intact steam generators

Steam generator safety 795 valve setpoint reached in intact steam generators Core decay heat decreases ~

1800 to auxiliary feedwater heat removal capacity

___________________

(1) DNBR does not decrea se below its initial value.

B/B-UFSAR 15.2-30 and 15.2-31 REVI SION 7 - DECEMBER 1998

Tables 15.2-2 and 15

.2-3 have been deleted intentionally

B/B-UFSAR 15.2-32 REVISION 9 - DECEMBER 2002 TABLE 15.2-4

This page has been i ntentionally deleted.

B/B-UFSAR 15.3-1 15.3 DECREASE IN REACTOR CO OLANT SYSTEM FLOW RATE A number of faults a re postulated which could result in a decrease in reactor coolant system f low rate. These events are discussed in this section. De tailed analyses are presented for the most limiting of these events.

Discussions of the follo wing flow decrease e vents are presented in Section 15.3:

a. partial loss of forced react or coolant flow, b. complete loss of forced reactor coolant flow, c. reactor coolant pump shaft seizure (locked rotor), and

d. reactor coolant pump shaft break.

Item a. above is conside red to be an ANS Condi tion II event, item

b. an ANS Condition III event, and items c.

and d. ANS Condition IV events. Subs ection 15.0.1 co ntains a discussion of ANS classifications.

15.3.1 Partial Loss of Forced Reactor Coolant Flow 15.3.1.1 Identification of Caus es and Accident Description

A partial loss of coolant fl ow accident can re sult from a mechanical or electrical failu re in a reactor coolant pump, or from a fault in the power supply to the pump or pumps supplied by a reactor coolant pu mp bus. If the reactor is at power at the time of the accident, the immediate effect of loss of coolant flow is a rapid incr ease in the coolant temperature. This increase could result in DNB with subsequent fuel damage if the reactor is not t ripped promptly.

Normal power for two of the reactor coolant pumps is supplied through individual buses connected to the gene rator, whereas the other two reactor coolant pumps are supplied f rom offsite power.

When a generator trip occurs, the buses whic h are normally fed from the generator a re automatically tra nsferred to an offsite power supply. The p umps will continue to supply coolant flow to the core. Following any tur bine trip where there are no electrical faults or thrust bearing fail ure, which require tripping the generator from the network, the generator remains connected to the network for a pproximately 30 seconds. The two reactor coolant pumps normally fed from the generator remain connected to the generator thus ensuring full flow for approximately 30 seconds after t he reactor t rip before any transfer is made.

This event is classified as an A NS Condition II incident (an incident of moderate f requency) as defined in Subsection 15.0.1.

B/B-UFSAR 15.3-2 REVISION 9 - DECEMBER 2002 The necessary protection against a p artial loss of coolant flow accident is provided by the low primary coolant flow reactor trip signal which is actuated in any reactor cool ant loop by two out of three low flow signals.

Above Permissive 8 (r efer to Table 7.2-2 for a discussion of permissives), lo w flow in any loop will actuate a reactor trip. Between approxi mately 10% power (Pe rmissive 7) and the power level correspo nding to Permissive 8, l ow flow in any two loops will actuate a rea ctor trip. A reactor trip signal from the pump breaker position is provided as a backup to the low flow signal. When op erating above Permissive 7, a breaker open signal from any two pumps w ill actuate a reactor trip. Reactor trip on reactor coolant pump breakers open signal is blocked below Permissive 7.

15.3.1.2 Analysis of Ef fects and Consequences Method of Analysis One case has been analyzed:

Loss of two pumps with f our loops in operation.

This transient is anal yzed by three digital co mputer codes. First, the LOFTRAN Code (Reference 1) is us ed to calculate the loop and core flow during the transient, the time of reactor trip based on the calculated flows, the nuclear power transien t, and the primary system pressure and te mperature transients.

The FACTRAN Code (Reference 2) is then used to calculate the heat flux transient based on the nuclear p ower and flow from LOFTR AN. Finally, the THINC Code (see Section 4.4 ) is used to cal culate the DNBR during the transient based on the heat flux from FACT RAN and flow from LOFTRAN. The DNBR transients pr esented represent the minimum of the typical or thimble cell.

This accident is analyzed with the revis ed thermal design procedure as described in WCAP-11397-P-A (Refere nce 3). Plant characteristics and init ial conditions are dis cussed in Subsection 15.0.3. Initial Conditions Initial reactor power (c onsistent with uprated power conditions) and pressure are assumed to be at their nominal values. The initial temperature is assum ed to be at the no minal value for the high Tavg program plus a 1.5 o F bias. Uncertain ties in initial conditions are i ncluded in the l imit DNBR as described in WCAP-11397-P-A.

Reactivity Coefficients A conservatively large absolute value of the Doppler-only power coefficient is used (see Fig ure 15.0-3). This is equivalent to a total integrated Doppler reactivity from 0% to 1 00% power of 0.016 k.

B/B-UFSAR 15.3-3 REVISION 11 - DECEMBER 2006 A moderator temperat ure coefficient (M TC) of 0 pcm/

o F is assumed in the analysis. The use of this MTC is consistent with the analysis initial conditions assu mptions and corr esponds to the applicable MTC limit at hot full power (HFP) initial conditions.

The HFP analysis resul ts using a 0 pcm/

o F MTC bound those for part-power initial con ditions with a positive MTC at the licensed allowable MTC limit.

Flow Coastdown

The flow coastdown analy sis is based on a momentum balance around each reactor coolant loop an d across the rea ctor core. This momentum balance is combined with the continuity equation, a pump momentum balance and the pump charac teristics and is based on high estimates of syst em pressure losses.

Plant systems and equi pment credited for mit igating the effects of the accident are di scussed in Subsection 15

.0.8 and listed in Table 15.0-7. No sing le active failure in a ny of these systems or equipment will adversely affect the conse quences of the accident.

Results Figures 15.3-1 and 15.3-2 show the transient response for the loss of two reactor cool ant pumps with four loops in operation.

The reactor is assumed to be tripped on a low flow signal.

Figure 15.3-2 shows the DNBR to be greater than the limit value.

For the case analyzed, s ince DNB does not occu r, the ability of the primary coolant to remove he at from the fu el rod is not greatly reduced. Thus, the average fuel and c lad temperatures do not increase significant ly above their respective initial values.

The calculated sequence of events for the ca se analyzed is shown on Table 15.3-1. The affected reactor coolant pumps will continue to coast down, and the core flow will reach a new equilibrium value corr esponding to t he number of pum ps still in operation. With the reactor t ripped, a stable p lant condition will eventually be attained. Normal p lant shutdown may then proceed. 15.3.1.3 Radiological Consequences A partial loss of reactor co olant flow from full load would result in a reactor and turbine trip. Assum ing that the condenser is not available, at mospheric steam dump may be required.

B/B-UFSAR 15.3-4 REVISION 9 - DECEMBER 2002 There are only minimal radiological conseque nces associated with this event. The refore, this event is not limiting.

The radiological consequences re sulting from a tmospheric steam dump would be less sev ere than the steamline break event analyzed in Subsection 15.1.5.3.

15.3.1.4 Conclusions The analysis shows t hat the DNBR will not decrease below the limit value at any t ime during the t ransient. Thus, no fuel or clad damage is predicted, and all applicable acceptance criteria are met. The radiological consequences of thi s event would be less than the steamline break event anal yzed in Subsection 15.1.5.3.

15.3.2 Complete Loss of For ced Reactor Coolant Flow 15.3.2.1 Identification of Caus es and Accident Description A complete loss of forced reactor coolant flow may result from a simultaneous loss of electrical supplies to all reactor coolant pumps. If the reactor is at power at the time of the accident, the immediate effect of loss of coolant flow is a rapid increase in the coolant t emperature. This increa se could result in DNB with subsequent fuel damage if the react or were not tripped promptly.

Normal power for two of the reactor coolant pumps is supplied through buses from a t ransformer connected to the generator, whereas the other tw o reactor coolant pu mps are supplied from offsite power. When a generator trip occurs, the buses which are normally fed from the generator are automatically transferred to an offsite power supply. The pumps will continue to supply coolant flow to the core.

Following any tur bine trip where there are no electrical faults or thrust bearing f ailure which require tripping the generator from the network, the generator remains connected to the network for a pproximately 30 seconds. The two reactor coolant pumps normally fed from the generator remain connected to the generator thus ensuring full flow for 30 seconds after the reactor trip befor e any transfer is made.

This event is classified as an A NS Condition III incident (an infrequent incident) as defined in S ubsection 15.0.1.

The following signals pr ovide the necessary protection against a complete loss of flow accident:

a. Reactor coolant pump power supply undervoltage or underfrequency.

b. Low reactor coolant loop flow.

B/B-UFSAR 15.3-5 REVISION 7 - DECEMBER 1998 The reactor trip on reactor coolant pump bus undervoltage is provided to protect against conditio ns which can cause a loss of voltage to all r eactor coolant p umps, i.e., loss of nonemergency a-c power. This function is b locked below approximately 10%

power (Permissive 7).

The reactor trip on reactor co olant pump underfrequency is provided to trip the reactor f or an underfrequen cy condition, resulting from frequency disturb ances on the power grid.

Reference 4 provides analyses of grid frequency dist urbances and the resulting nuclear steam supply system (NSSS) protection requirements which a re generally applicable.

The reactor trip on low primary coolant loop flow is provided to protect against loss of flow conditions which affect only one reactor coolant loop. T his function is generated by two out of three low flow signals per reactor coola nt loop. Above Permissive 8, low flow in any loop will actuate a reac tor trip.

Between approximately 10%

power (Permissive

7) and the power level corresponding to P ermissive 8, low flow in any two loops will actuate a reactor trip.

15.3.2.2 Analysis of Ef fects and Consequences The following cases for complete loss of for ced reactor coolant flow are analyzed:

1. Complete loss of all four reactor coolant pumps (RCPs) with four loops in operation; and

2. Frequency decay event resulting in a complete loss of forced reactor coolant flow.

Case 1 of the complete loss of flow event assu mes that the RCPs begin to coastdown upon reaching a undervolt age trip setpoint (modeled to occur at t=0 seconds in this analysis). Rod motion following the undervol tage trip is model ed to occur at t=1.5 seconds, reflecting an undervoltage trip time delay of 1.5 seconds. For the underfrequency complete loss of flow event (Case 2), a frequency decay of 5 Hz/sec is a ssumed to occur at t=0 seconds, decreasing RCS flow to all loops.

At t=1.2 seconds, the underfrequency trip setpoint of 54.0 Hz is reached. Rod motion occurs at t=1

.8 seconds, follow ing a 0.6 second underfrequency t rip time delay.

These transients are analyzed by three digital c omputer codes.

First, the LOFTRAN c ode (Reference 1) is used to calculate the loop and core flow tra nsients, the nuclear power transient, and the primary system press ure and temperature tran sients. The flow coastdown analysis p erformed by LOFTRAN is based on a momentum balance around each reac tor coolant loop and across the reactor core.

B/B-UFSAR 15.3-5a REVISION 9 - DECEMBER 2002 This momentum balance is combined with the conti nuity equation, a pump momentum balance, a nd the as-built pump characteristics and is based on conservative sys tem pressure loss estimates.

The FACTRAN code (Reference 2) is th en used to calculate the heat flux transient based on the nuclear power an d flow from LOFTRAN.

Finally, the THINC code (see Section 4.4) is used to calculate the DNBR during the transien t based on the heat flux from FACTRAN and the flow from LOFT RAN. The DNBR results are based on the minimum of the t ypical and thi mble cells.

Results Figures 15.3-3 and 15.3-4 show the transient response for the limiting case; the fre quency decay compl ete loss of flow event (Case 2). The react or is assumed to be tripped on an underfrequency signal.

Figure 15.3-4 shows the DNBR to be greater than t he limit value.

Since DNB does not occur for the cases analyzed, the ability of the primary coolant to remove he at from the fu el rod is not greatly reduced. Thus, the average fuel and c lad temperatures do not increase significant ly above their respective initial values.

B/B-UFSAR 15.3-6 REVISION 9 - DECEMBER 2002 The calculated sequence of events for the ca se analyzed is shown on Table 15.3-1. The speed of t he reactor coolant pumps will continue to decrease from the 5 hz/sec frequency decay until a pump trip occurs on an underfreq uency condition. Following pump trip, the reactor coolant pumps will continue to coast down, and natural circulation flow will eventually be established, as demonstrated in Subsecti on 15.2.6. With the reactor tripped, a stable plant conditi on would be attained.

Normal plant shutdown may then proceed.

15.3.2.3 Radiological Consequences A complete loss of reactor coolant flow from full load results in a reactor and turbin e trip. Assuming, in addition, that the condenser is not available, at mospheric steam dump would be required. The quantity of steam released would be the same as for a loss of offsite power.

There are only minimal radiological conseque nces associated with this event. The refore, this event is not limiting.

The radiological consequences re sulting from a tmospheric steam dump would be less severe than the steamline b reak analyzed in Subsection 15.1.5.

15.3.2.4 Conclusions The analysis performed has demonstrated that for the complete loss of forced r eactor coolant flow, the DNBR does not decrease below the limit value at any time during the transie nt. Thus, no fuel or clad damage is predicted, and all ap plicable acceptance criteria are met.

15.3.3 Reactor Coolant Pump Shaft Seizu re (Locked Rotor)

B/B-UFSAR 15.3-7 REVISION 7 - DECEMBER 1998 15.3.3.1 Identification of Caus es and Accident Description A transient analysis is performed for the instantaneous seizure of an RCP rotor (loc ked rotor). Flow th rough the affected reactor coolant loop is rapidly reduced, leading to a reactor trip on a low flow s ignal. Following the trip, heat stored in the fuel rods continues to pass into the core coolan t, causing the coolant to expand. At the s ame time, heat t ransfer to the shell side of the steam generator is reduced, first because the reduced flow res ults in a decreased tube side film coefficient, and then because the reactor coo lant in the tubes cools down while the shell side t emperature increases (tu rbine steam flow is reduced to zero upon plant trip). The rapid expansi on of the coolant in the r eactor core, c ombined with t he reduced heat transfer in the steam generator causes an insurge into the pressurizer and a pres sure increase througho ut the RCS. The insurge into the press urizer causes a pressu re increase which in turn actuates the au tomatic spray system, opens the power-operated relief valves (PORVs), and opens the pressurizer safety valves. The s equence of events initiated by the insurge depends on the rate of insurge and pressure increase. The PORVs are designed for reliable op eration and would be expected to function properly during the acci dent. However, for co nservatism, their pressure-reducing effect as well as the pressure-reducing effect of the spray is not incl uded in this analysis.

This event is classified as an ANS Condition IV incident (a limiting fault) as defin ed in Subsection 15.0.1.

The consequences of a locked rot or (i.e., an instantaneous seizure of a pump shaft) are very similar to those of a pump shaft break. The init ial rate of the reduct ion in coolant flow is slightly greater for the locked rotor event.

However, with a broken shaft, the impell er could conceivably be free to spin in the reverse direction. The effect of reverse spinning is to decrease the steady-state core f low when compared to the locked rotor scenario.

Only one analysis, which permits reverse spinning but no forward flow, has been perfo rmed and represents the most limiting condition for the locked rotor and pump shaft break accidents.

15.3.3.2 Analysis of Ef fects and Consequences

Method of Analysis Two digital computer c odes are used to analy ze this transient.

The LOFTRAN Code (Reference 1) is us ed to calculate the resulting loop and core flow transients following the pump seizure, the time of reactor trip based on the loop flow transients, the nuclear power follow ing reactor trip, and th e peak RCS pressure.

The thermal behavior of the fuel located at the core hot spot is investigated using the FACTRAN Code (Reference 2), which uses the core flow and the nuclear power values calculated by LOFTRAN.

The FACTRAN Code includes a film boiling heat transfer coefficient.

B/B-UFSAR 15.3-8 REVISION 9 - DECEMBER 2002 One case is analyzed: one locked rotor/shaft bre ak with four loops in operation, co ncurrent with a loss of offsite power at the time of trip.

Initial Operating Conditions At the beginning of the postulated locked rotor accident, the plant is assumed to be operati ng at nominal reactor power consistent with uprated power conditions and pressure. Initial temperature is assumed to be nominal plus a 1.5 o F bias. The revised thermal design procedure as describe d in WCAP-11397-P-A (Reference 3) is used. Plant characteristics and initial conditions are discussed in Su bsection 15.0.3.

For the peak pressure and peak clad temperat ure evaluations, one analysis is performed and the in itial pressure is conservatively estimated as 43 psi above the nominal pressure of 2250 psia to allow for errors in the pressuri zer pressure measurement and control channels. This is done to obtain the highest possible rise in the coolant pres sure during the transi ent. To obtain the maximum pressure in the primary side, conserva tively high loop pressure drops are add ed to the calculated p ressurizer pressure.

The pressure response sh own in Figure 15

.3-6 is at t he point in the RCS having the max imum pressure (i.e., the outlet of the faulted loop's RCP).

The remainder of the plant is assumed to be operating under the most adv erse steady-state operating condition, e.g., 102% of the NSSS uprated thermal power and the maximum steady-state c oolant average tem perature, including uncertainties and a 1.5 o F bias. For a conservative ana lysis of fuel rod behavi or, the hot spot evaluation assumes t hat DNB occurs at the initiation of the transient and continues throughout the event. This assumption reduces heat transfer to the coolant and results in conservatively high hot spot temperatures.

The reactor coolant flow coastdo wn analysis is based on a momentum balance around each reactor coolant l oop and across the reactor core. This mo mentum balance is combined with continuity equation, a pump momentum bala nce, and the as-built pump characteristics and is based on high estimates of system pressure losses. No single act ive failure in any of these systems or equipment will adverse ly affect the consequenc es of the accident.

A conservatively large absolute value of the Doppler-only power coefficient is used (s ee Figure 15.0-3).

The total integrated Doppler reactivity f rom 0 to 100% power is assumed to be 0.016 K. A moderator temperat ure coefficient (M TC) of 0 pcm/

o F is assumed in the analysis. The use of this MTC is consistent with the analysis initial conditions assu mptions and corr esponds to the applicable MTC limit at hot full power (HFP) initial conditions.

The HFP analysis resul ts using a 0 pcm/

o F MTC bound those for part-power initial con ditions with a positive MTC at the licensed allowable MTC limit. For this analysis, the curve of trip reactivity versus ti me (Figure 15.0-6) was used with a 4% K trip reactivity, which incl udes the most reactive rod cluster control assembly (RCCA) stuck out of the core.

B/B-UFSAR 15.3-9 REVISION 11 - DECEMBER 2006 Evaluation of the Pressure Transient A detailed model was used to determine the peak pressure in the RCS under postulated accident conditions and to obtain the neutron flux response as a function of t ime, which is used later in the analysis.

After pump seizure, neutron flux is rapidly reduced because of the control rod insertion upon plant trip.

In this analysis, rod motion is assumed to begin o ne second after the flow in the affected loop reached 85.1% of nominal flow.

No credit was taken for the pressure-red ucing effect of the pressurizer relief v alves, pressurizer spray, steam dump or controlled feedwater flow af ter plant trip.

Although these operations are expec ted to occur and would r esult in a lower peak pressure, an additional degree of conservati sm is provided by ignoring their effect.

Upon actuation of th e pressurizer safety valves at an opening pressure of 2549.9 psia (including 2% allowa nce for drift and 1%

for pressure shift), purge of the water in the safety valve loop seal occurs and full v alve relief capacity is achieved within 1 second. The pressur izer safety valves capac ity for steam relief is described in Chapter 5.

Evaluation of DNB in t he Core During the Accident For this accident, DNB is assumed to occur in the core.

Therefore, an evaluation of the consequences with respect to fuel rod thermal transients is perf ormed. Result s obtained from analysis of this hot spot cond ition represent the upper limit with respect to clad temperature and zirconi um water reaction.

In the evaluatio n, the rod power at the hot spot is assumed to be 2.6 times the average rod power (i.e., F Q=2.6) at the initial core power level.

Calculation of the ext ent of DNB in the core during the locked rotor event is perform ed with the THINC computer code (See Section 4.4). The T HINC code uses the c ore heat flux calculated from FACTRAN and the core flow transie nt from LOFTRAN.

Film Boiling Coefficient The film boiling coeffic ient is calculated in the FACTRAN Code using the Bishop-Sandberg-To ng film boiling correlation (Reference 5). The fl uid properties are evaluated at film temperature (average bet ween wall and bulk t emperatures). The program calculates the film coefficient at e very time step based upon the actual heat transfer conditions at the time. The neutron flux, system pressure, bulk density, and mass flow rate as a function of time are used as program input.

B/B-UFSAR 15.3-9a REVISION 9 - DECEMBER 2002 For this analysis, the initial values of the pressure and bulk density are used throughout the transient since they are the most conservative with respect to t he clad temperature response. As indicated earlier, DNB was assumed to start at the beg inning of the accident.

Fuel-Clad Gap Coefficient The magnitude and ti me dependence of the heat transfer coefficient between fuel and cla dding (gap coeff icient) have a pronounced influence on the thermal results.

The larger the value of the gap coefficient, the more heat is transferred between pellet and clad.

For the first part of the transient, a high gap coefficient p roduces higher clad te mperatures since the heat stored and genera ted in the fuel pellet tries to redistribute itself in t he cooler clad. Thi s effect of the gap coefficient is reversed when the clad temperature exceeds the pellet temperature in cases where a zirconiu m-steam reaction is present. The gap coefficient was taken to be the conservatively large value of 1 0,000 Btu/hr-ft 2-°F which is greater than the highest value calculated during core life.

Zirconium-Steam Reaction The zirconium-steam reaction can become signific ant above 1800

°F (clad temperature).

In order to take th is phenomenon into account, the following c orrelation, which defines the rate of the zirconium-steam reaction, was introduced int o the model (see Reference 4):

86T)(45500/1.9

-6 2)e 10 x (33.3 dt)w (d= where w = amount reacted, mg/cm 2 t = time, seconds T = temperature, K Results The transient results wi thout offsite power av ailable are shown in Figures 15.3-5 through 15.3

-6. The peak RCS pressure reached during the transient is less than that which would cause stresses to exceed the faulte d condition stre ss limits. Also , the peak clad surface tempera ture is considerably less than the 2700

°F transient limit for the locked rotor acciden

t. It should be noted that the c lad temperature was cons ervatively calculated assuming the DNB occurs at the initiation of the transient. The results of these cal culations (peak pres sure, peak clad temperature, and zirconium-steam rea ction) are also summarized in Table 15.3-2.

The calculated sequence of events is sho wn in Table 15.3-1.

Figure 15.3-6 shows that the core flow rapid ly coasts down to a new equilibrium value.

With the reactor tripped, a stable plant condition will eventually be attained. Normal plant shutdown may then proceed.

B/B-UFSAR 15.3-9b REVISION 7 - DECEMBER 1998 15.3.3.3 Conclusion The results of the trans ient analysis show t hat none of the fuel rods will experience DNBR values below the safety analysis limit value.

Since the peak RCS p ressure reached during the transient is less than that which woul d cause stresses to exceed the faulted condition stress limits, the i ntegrity of the primary coolant system is not endangered.

Also, since the peak clad average temperature calculated for the hot spot during the worst transient remains consid erably less than the 2700

°F transient limit, the core will remain in place and int act with no loss of core cooling capability.

B/B-UFSAR 15.3-10 REVISION 12 - DECEMBER 2008 15.3.3.4 Radiological Consequences The evaluation of the radiological consequen ces of a postulated seizure of a reactor coolant pump rotor (Locked Rotor Accident-LRA) assumes that the reactor has been operati ng with a small percent of defective fuel and leaking st eam generator tubes for sufficient time to e stablish equilibri um concentrations of radionuclides in the reactor c oolant and in the secondary coolant. A concurrent P ORV failure is also assumed.

It is assumed conservatively tha t, as a result of the locked rotor accident, 2% of the fu el rods in the core undergo sufficient clad damage to result in the rele ase of their gap activity.

As a result of the accid ent, radionuclides car ried by the primary coolant to the s team generators, via the leaking tubes, are released to the enviro nment via the steam line safety or power operated relief valves.

The key inputs and a ssumptions used in t he AST Locked Rotor Accident (LRA) radiolo gical consequence analysis using AST methodology are summariz ed below and pro vided in Table 15.3-4.

This LRA analysis postulates the instantaneous seizure of a Reactor Coolant Pump (RC P) rotor, where the reactor is tripped on the subsequent low f low signal. Fol lowing the trip, heat stored in fuel rods continu es to pass into the reactor coolant, causing the coolant to expand. At the s ame time, heat t ransfer to the shell side of the Steam Generator (SG) is reduced, first because the reduced flow results in a decreased tube side film coefficient, and then because the pr imary reactor coolant in the tubes cools down while the shell side te mperature increases (turbine steam flow is r educed to zero upon pl ant trip). The rapid expansion of the coolant in the reactor core, combined with the reduced heat transfer in the SG, causes an insur ge of coolant into the pressurizer and a p ressure increase throughout the Reactor Coolant System (RCS). This insurge in to the pressurizer causes a pressure increase, which in turn actuates the automatic spray system, opens the power-operated relief va lves (PORVs), and also opens the pressuriz er safety valves.

The SG PORVs are designed for re liable operation and would be expected to function pro perly during the accid ent. However, for conservatism, their pres sure reducing effect is ignored, and an SG PORV failure, in the open position at the onset of accident releases, is assumed.

In addition, the pres sure reducing effect of the spray is also ignored for this analysis.

This evaluation of the radiological co nsequences of an LRA assumes that the reactor has been operating with a small percent of defective fuel and leaking SG tubes. The rea ctor is assumed to have been ope rating in this condition for sufficient time to establish equilibrium concentrat ions of radion uclides in the reactor coolant and seco ndary coolant. A dditionally, prior to B/B-UFSAR 15.3-10a REVISION 12 - DECEMBER 2008 accident initiation, the reactor is postulated to ex perience an Iodine spike, th ereby increasing the R CS iodine activity above that of equili brium levels.

As a result of this accident, radionucli des carried by the primary coolant to the Steam Generators, via the leaking tubes, are released to the en vironment via the steam line safety valves or PORVs.

This LRA dose assessment is an alyzed using two modeled simulations. The first simulation, Ca se 1, is modeled to calculate the doses due to the activity that was instantaneously released into the primary RCS fr om the postulated damaged fuel fraction, and the activity res ulting from a pre-accident 60

µCi/gm Dose Equivalent (DE)

I-131 spike. Leak and steaming rates are used to model the transport of activity from the RCS to the environment, through t he PORVs of intact SGs, and through the failed PORV of the fau lted SG, which is the postulated single-failure for this analysis.

The second simulation, C ase 2, is modeled to calculate the doses due to 0.1

µCi/gm DE I-131 equilibri um activity exis ting in the secondary coolant pr ior to accident init iation. This iodine activity is released u sing the same part itioned steaming rates that are associated with Case 1 SG PORV rele ase to the environment. For the intact SGs this iodine activity is released the same partitioned ste aming rates that are a ssociated with Case

1. However, for the SG with the failed PORV , referred to as the faulted SG, it is po stulated that th e activity initially contained in the faulted SG is relea sed to the envir onment for 20 minutes. The failed SG PORV is isolated by locally closing the associated isolation v alve. The operator ca n identify the failed SG PORV when the faulted SG pres sure drops below SG PORV reset value. There is also a positive valve position indication of the open SG PORV on the control board. As a result of t he failed SG PORV, the operator would enter the emergency procedure for "Faulted Steam Generator Isolation". The dispa tch, travel time, and local isolation of this va lve by an operator was conservatively assumed to require 20 minutes , from the time the SG PORV fail s open.

Fuel Damage and Core Source Term For conservatism, the LRA core source terms are those associated with a DBA power lev el of 3658.3 MWth, which includes an additional 2% power over that of the full licensed power to account for uncertainty.

The instantaneous seizure of the RCP rotor ass ociated with the LRA results in the damage of 2% of the core. The design basis of this accident assumes th at no fuel melt is p ostulated to occur.

Therefore for Case 1, the so urce term available for release is associated with this fraction of damaged fue l and the fraction of core activity existing in the gap, plus the iodine in the RCS due to a design basis pre-accident 60

µCi /gm DE I-131 spike, and the noble gas activity associated with 1% fuel defects.

B/B-UFSAR 15.3-10b REVISION 12 - DECEMBER 2008 The additional source activity modeled in the second case consists simply of the 0.1

µCi/gm DE I-131 e quilibrium secondary coolant activity conce ntration limit from the Technical Specifications.

The total activity avai lable for release from both the intact SGs and the SG with a failed SG PORV are input to the RADTRAD NIF for Case 2.

Activity Release Fractions Release fractions and transport fractions ar e per Regulatory Guide 1.183, Appendix G and Table 3. To comply with this regulatory guidance, 5%

of the core inventor y of iodine and noble gas is assumed to be in the fuel-clad gap, e xcluding I-131 and Kr-85, where 8%

and 10% are assumed, respect ively. Additionally, Table 3 of RG 1.183 shows that 12% of the core cesium and rubidium should be assumed to be in the fuel-clad gap. However, to accommodate t he consideration of extended fuel burnup, in excess of the RG 1.183 assumptions, all RG 1

.183 Table 3 "Other Noble Gases", "Other Halogens", and "Alk ali Metals" isotopic release fractions are do ubled. Although analyses have shown that isotopic activity frac tions in the fuel-clad gap may in fact decrease when "burning" the fuel longer than the 62 GWd/MTU specified in RG 1.183, this 100% increase in the gap fractions is used as an accepted and conservative mea ns of bounding all extended burnup phenomen

a. All of the g ap activity in the damaged fuel is released in its entirety, instantaneously into the RCS and mixed ho mogeneously therein.

These activity relea se fractions are input to the RADTRAD code through the use of the Release Fractions and Timing (RFT) file.

Airborne Activity Removal Mechanisms in Containment As discussed below only decay and le akage are credited.

Decay Credited:

Decay of radioactivity is credited in all compartments, prior to release. This is implemented in RADTRAD using the half-lives in the Nuclide Inventory Fi le (NIF). The R ADTRAD decay plus daughter option is used. In r eality, daughter p roducts such as xenon from iodines or iodines fr om tellurium are unlikely to readily escape from the matrix in which the pa rent iodine or tellurium is contained.

Nevertheless, the R ADTRAD feature to include daughter effects is se lected for conservatism.

Depletion due to Leakage Credited:

For analyses of doses due to release from the RCS volume, the dose results from leak age, and it is rea sonable to credit the small amount of depletion from the ava ilable RCS activity inventory associated with th is leakage. Thi s is calculated inherently by the RADTRAD code.

B/B-UFSAR 15.3-10c REVISION 12 - DECEMBER 2008 Release Rates, Steaming Rates, and Parti tioning Factors:

Activity that originates in the primary RCS is r eleased to the secondary coolant by means of the primary-to-secondary coolant leak rate. This design basis leak rate v alue is 0.21 8 gpm, per intact SG, totaling 0.654 gpm, and 0.5 gpm for the SG with the failed SG PORV. For input into RADTRA D, these rates were converted from gallons per minute to c ubic feet per minute, making them 0.02914 cfm, per int act SG, totaling 0.08743 cfm, and 0.06684 cfm for the SG with the failed SG PORV.

Releases to the enviro nment are associated with the secondary coolant steaming from the Steam Generators w ith intact SG PORVs and releases directly out of an SG with a failed SG PORV.

Because of the r elease dynamic of the ac tivity from the intact SG PORVs, RG 1.183 allows f or a reduction in th e amount of activity released to the environment based on partitioning of nuclides between the liquid a nd gas states of water for this release path.

For Iodine, the partit ioning factor of 0

.01 was taken directly from the suggested guidance.

However, there is no explicit guidance with regard to other particulate nu clides. Reviewing the specified AST release fractions, it is c oncluded that the only nuclides other than iodines to be released from the core source term are cesiums, rubidium, and noble gases. For cesiums and rubidium, a bounding partitioning factor of 0.0055 is used, as shown in the applic able ANSI Standard, ANS/ANSI-18.1-1999.

This value bounds the actual 0

.00529 factor that is shown for Cs-134 in the ANSI Standa rd, which shows the largest partitioning factor of these such isotopes. Because of the volatility of noble gases, no partitioning is assumed for any such isotopes.

The methodology used to model steaming of activi ty through intact SG PORVs following the postulated LRA event is applicable to both the Case 1 and Case 2 si mulations. This metho dology assumes an average cumulative rel ease rate through the SG valves that is reduced in steps. The partitioning factors a re applied to these release rates, which were derived from the total time increment mass releases. Increm ental steam mass relea ses are in pounds.

Release rates were deriv ed by dividing these totals by the time increment. Then, this data was converted us ing the assumption of cooled liquid conditions (i.e., 62.4 lbm/ft 3), as specified by the guidance of RG 1.183.

The steaming re lease and primary-to-secondary coolant leakage is pos tulated to end at 40 hours4.62963e-4 days 0.0111 hours 6.613757e-5 weeks 1.522e-5 months , when the RCS and secondary lo op have equilibrated.

The table below shows the time steps , isotopic partition ing factors, and associated release rates:

B/B-UFSAR 15.3-10d REVISION 12 - DECEMBER 2008 LRA Partitioning Factors And Associated Release Rates Time Interval (hrs) Total Steam Mass Release (lbm) Iodine Partitioning Factor Cesium Partitioning Factor Noble Gas Partitioning Factor Steam Release Rate for Iodines (cfm) Steam Release Rate for Cesiums (cfm) Steam Release Rate for Noble Gases (cfm) 0 - 2.0 719,000 0.01 0.0055 1.0 9.5977E-01 5.2788E-01 9.5977E+01 2.0 - 8.0 1,109,000 0.01 0.0055 1.0 4.9346E-01 2.7140E-01 4.9346E+01 8.0 - 40 2,664,000 0.01 0.0055 1.0 2.2226E-01 1.2224E-01 2.2226E+01 40 - 64 0 0.01 0.0055 1.0 0 0 0 The release rate through the failed SG PORV is conserv atively assumed to be un-partitioned, and therefore no isotopic partit ioning factors are applied. The rate at which activity is rele ased from this pathway is therefore equal to the pr imary-to-secondary coolant leak rate discussed above.

In Case 2, for the intact SGs, the iodine activity is released using the same partitioned ste aming rates that are ass ociated with Case 1 SG PORV release to the envi ronment. For the faulted SG the release rate is based on a 20-minute failed SG PORV r elease. The total mass released is 167,000 lbm.

Converted to a volume, and divided by the 20-minute release time, this becomes the 133.75 cfm volumetric flow rate.

/Q Calculations (Meteorology)

Releases from the SG POR Vs are considered elevat ed releases due to the high steaming rates, and the associated /Q's have been reduced by a factor of 5 per guidance in RG 1.194. The a tmospheric dispersion factors are given in Table 15.0-17.

Assumptions and Inputs The following inputs and assumptions were used in the LRA analysis.

a. Core inventory is based on a DBA power level of 3658.3 MWth, which is 102% of the Rated Ther mal Power Level of 3586.6 MWth, to account for measurement uncertainty.

b. Two percent (2%) of the fuel is damaged during t he initiation of this accident, and is assumed to have failed.

c. No fuel melts following the po stulated LRA.

d. Five percent (5%) of the core in ventory of noble gas es and iodines are released from the fuel gap, excluding I-131 and Kr-85, where 8%

and 10% are respectively release

d. Release fractions of other nuclide groups contained in the fuel gap are detailed in Table 3 of Regulatory Guide 1.183, and to account for g ap fraction uncertainty due to expected extend ed fuel burnup, these fractions from the referenced table are doubled.

B/B-UFSAR 15.3-10e REVISION 12 - DECEMBER 2008

e. All iodine released from the SGs is assumed to be of the elemental species. This is done for RADTRAD si mulation considerations, and is consistent with the RG 1

.183 specification of 97% elemental and 3%

organic, because elemental and organic iodin e are treated identically by the compu ter model.

f. The Control Room HVAC system is realigned to t he emergency mode of operation 30 minutes after the initiation of this design basis accident.

g. The activity released fr om the fuel from either the gap or from fuel pellets is assumed to be insta ntaneously mixed w ith the reactor coolant within the pressure vessel per RG 1.183.

h. SG PORV releases end at 40 hours4.62963e-4 days 0.0111 hours 6.613757e-5 weeks 1.522e-5 months , when the R CS has seen a large enough reduction in residual heat to no long er require steaming via the PORVs for temper ature reduction.

i. A failure of one SG PORV, in the open position, that takes 20 minutes to isolate, is assumed to conservatively maximize activity release.

Dose Results Radiological doses r esulting from a design bas is LRA for a control room operator and a person lo cated at EAB or LPZ are to be less than the regulatory dose limi ts as given below:

Regulatory Dose Limits - LRA Dose Type Control Room (rem)

EAB and LPZ (rem)

TEDE Dose 5 a 2.5 b Notes: a 10 CFR 50.67 b 10 CFR 50.67 as modified by Regulato ry Guide 1.183 (Table 6, Page 1.183-20)

B/B-UFSAR 15.3-10f REVISION 13 - DECEMBER 2010 The table below provides the results from the si mulations modeled using the RADTRAD 3.03 code, as we ll as the summed result:

Locked Rotor Accident Radiological A nalysis Results (Maximum for Both By ron or Braidwood)

Case 1: Doses from Iod ine Spike and Fuel Damage RCS Activity RADTRAD Dose Ass essment Results Control Room (rem TEDE)

EAB (rem TEDE)

LPZ (rem TEDE) 2.729 1.421 0.518 Case 2: Doses from Equilibrium Secondary Coolant Activity RADTRAD Dose Ass essment Results Control Room (rem TEDE)

EAB (rem TEDE)

LPZ (rem TEDE) 0.061 0.035 0.006 Total Dose from Design Basis Locked Rotor A ccident (LRA)

Control Room (rem TEDE)

EAB (rem TEDE)

LPZ (rem TEDE) 2.790 1.456 0.525 These doses are below the Regulatory Dose Limi ts, so it is verified that the LRA is suffic iently mitigated at bo th Byron and Braidwood Stations.

B/B-UFSAR 15.3-11 REVISION 12 - DECEMBER 2008 15.3.3.4.1 Source Term The concentration of n uclides in the primary and secondary system prior to and following the accident are dete rmined as follows:

a. The iodine concentrations in the reactor coolant will be based upon a preaccident io dine spike and 2% failed fuel. 1. Preaccident Spike -

A reactor transient has occurred prior to the LRA and has raised the primary coolant iodine c oncentration to 60

µCi/gm of Dose Equivale nt (DE) I-131 (T able 15.0-10).

2. Failed Fuel - 2% of the fuel rods in the core suffer clad damage due to the LRA and release all their iodine gap activity to the primary coolant.

b. The noble gas concentrat ions in the primary coolant are based on 1 percent d efective fuel ex isting prior to the LRA, plus 5% of the inventory of noble gases and iodines released from th e fuel gap of the damaged fuel, excluding I-131 and Kr-85, where 8% and 10% are respectively release

d. Release fracti ons of other nuclide groups contain ed in the fuel g ap are detailed in Regulatory Guide 1.183 Ta ble 3. To a ccount for gap fraction uncertainty due to expected extended fuel burnup, fractions from T able 3 are doubled.

c. The secondary coolan t activity is based on the DE of 0.1 µCi/gm of I-131 (Table 15.0-10).

15.3.3.5 Radiological Conclusions The resulting radiation doses in the control room, at the exclusion area boundar y, and at the low-popu lation zone outer boundary are presented in Tables 15.

0-11 and 15.0-12. The doses from this accident a re within the NRC's dose acceptance criterion of 10 CFR Part 50.67 guidelines.

B/B-UFSAR 15.3-12 REVISION 12 - DECEMBER 2008

THIS PAGE WAS IN TENTIONALLY DELETED

B/B-UFSAR 15.3-13 REVISION 9 - DECEMBER 2002 15.3.4 Reactor Coolant Pump Shaft Break Refer to Section 15.3.3

B/B-UFSAR 15.3-18 REVISION 9 - DECEMBER 2002 TABLE 15.3-1

TIME SEQUENCE OF EVE NTS FOR INCIDENTS WHICH RESULT IN A DECREASE IN REACTOR COOLANT SYSTEM FLOW

ACCIDENT EVENT TIME (sec.) Partial Loss of Forced Reactor Coolant Flow Four loops operating two pumps coasting down Coastdown begins 0.0 Low flow reactor trip 1.7 Rods begin to drop 2.7 Minimum DNBR occurs 3.9

Complete Loss of Forced Reactor Coolant Flow (Underfrequency)

Frequency decay to all four RCPs begins 0.0

Underfrequency trip setpoint is reached 1.2 Rods begin to drop 1.8

Minimum DNBR occurs 3.9

B/B-UFSAR 15.3-19 REVISION 9 - DECEMBER 2002 TABLE 15.3-1 (Cont'd)

ACCIDENT EVENT TIME (sec.) Four Loop Operation Reactor Coolant Pump

Locked Rotor/Shaft Break Rotor on one pump locks 0.0

Low flow trip point reached 0.04 Rods begin to drop 1.04

Maximum RCS pressure occurs 3.60

Maximum clad temperature occurs 3.7

B/B-UFSAR 15.3-20 REVISION 9 - DECEMBER 2002 TABLE 15.3-2

SUMMARY

OF RESULTS FOR LOCKED ROTOR/SH AFT BREAK TRANSIENT FOUR LOOPS OPERATING INITIALLY Maximum Reactor Coolant System Pressure (psia) 2736 Maximum Cladding Temperature (°F) Core Hot Spot 1954 Zr-H 2O reaction at core hot spot (% by weight) 0.54%

B/B-UFSAR 15.3-21 REVISION 12 - DECEMBER 2008 TABLE 15.3-3

THIS TABLE HAS BEEN INTENTIONALLY DELETED.

B/B-UFSAR 15.3-22 REVISION 9 - DECEMBER 2002 TABLE 15.3-3a

This page has been i ntentionally deleted.

B/B-UFSAR 15.3-23 REVI SION 12 - DECEMBER 2008 TABLE 15.3-4 INPUT PARAMETERS FOR THE LOCKED ROTOR ACCIDENT RADIOLOGICAL CONSEQUENCE ANALYSIS USING AST Parameter Unit Value Notes Fraction of Core Experiencing Cladding Damage with Failed-Open PORV

% 2.0 The value of 2% is used, the reload limit for safety analysis, boun ding the 0.1%

value in the previous design basis calculation.

Gap Fractions:

I-131 Kr-85 Other Noble Gases Other Halogens Alkali Metals

- - - - - (2 times the following):

0.08 0.10 0.05 0.05 0.12 As a significant number of fuel assemblies not qualifying for AST due to their containing fuel rods with maximum linear heat generation rates exceeding 6.3 kilowatts per foot peak rod average power for burnups exceeding 54 GWD/MTU, the fuel will be treated as having gap fractions a factor of 2 greater than the Regulatory Guide 1.183 values.

SG Iodine Partition Factor SG Aerosol Carryover

-_ -_ 0.01 0.001 Credited only for non-faulted SG, with PORV failure assumed in faulted SG Steam Released to Environment: 0 - 2 hrs 2 - 8 hrs 8 - 40 hrs 40 - 64 hrs lbm lbm lbm lbm 719,000 1,109,000 2,664,000 0 Per RG 1.183, release duration is until cold shutdown is established and releases from the steam generators have been terminated.

RHR Cut-in Time hours 40 Time for termination of release due to PORV steaming.

Chemical form of radioiodine released from the fuel:

Cesium iodide Elemental iodide Organic iodide

% % % 95 4.85 0.15 Iodine Releases from steam generator to environment:

Elemental Organic % %

97 3 B/B-UFSAR 15.4-1 REVISION 5 - DECEMBER 1994 15.4 REACTIVITY AND POWER DISTRIBUTION ANOMALIES A number of faults have been postulated which could result in reactivity and power distribution anomalies. Reactivity changes could be caused by control rod motion or ejection, boron concentration changes, or addition of cold water to the reactor coolant system (RCS). Power distribution changes could be caused by control rod motion, misalignment, or ejection, or by static means such as fuel assembly mislocation. These events are discussed in this section. Detailed analyses are presented for the most limiting of these events. Discussion of the following incidents is presented in Section 15.4: a. Uncontrolled rod cluster control assembly bank withdrawal from a subcritical or low power startup condition, b. Uncontrolled rod cluster control assembly bank withdrawal at power, c. Rod cluster control assembly misalignment, d. Startup of an inactive reactor coolant pump at an incorrect temperature (detailed analysis is deleted), e. Chemical and volume control system malfunction that results in a decrease in boron concentration in the reactor coolant, f. Inadvertent loading and operation of a fuel assembly in an improper position, and g. Spectrum of rod cluster control assembly ejection accidents. Items a, b, c, d and e are considered to be ANS Condition II events, Item f and ANS Condition III event, and Item g of ANS Condition IV event. Item c entails both Condition II and III events. Subsection 15.0.1 contains a discussion of ANS classifications. 15.4.1 Uncontrolled Rod Cluster Control Assembly Bank Withdrawal From a Subcritical or Low Power Startup Condition 15.4.1.1 Identification of Causes and Accident Description A rod cluster control assembly (RCCA) withdrawal accident is defined as an uncontrolled addition of reactivity to the reactor core caused by withdrawal of RCCAs resulting in a power excursion. Such a transient could be caused by operator action or by a malfunction of the reactor control or rod control systems.

B/B-UFSAR 15.4-2 This could occur with the reactor either subcritical, hot zero power or at power. The "at power" case is discussed in Subsection 15.4.2. Although the reactor is normally brought to power from a subcritical condition by means of RCCA withdrawal, initial startup procedures with a clean core call for boron dilution. The maximum rate of reactivity increase in the case of boron dilution is less than that assumed in this analysis (see Subsection 15.4.6). The RCCA drive mechanisms are wired into preselected bank configurations which are not altered during reactor life. These circuits prevent the RCCAs from being automatically withdrawn in other than their respective banks. Power supplied to the banks is controlled such that no more than two banks can be withdrawn at the same time and in their proper withdrawal sequence. The RCCA drive mechanisms are of the magnetic latch type and coil actuation is sequenced to provide variable speed travel. The maximum reactivity insertion rate analyzed in the detailed plant analysis is that occurring with the simultaneous withdrawal of the combination of two sequential control banks having the maximum combined worth at maximum speed. This event is classified as an ANS Condition II incident (an incident of moderate frequency) as defined in Subsection 15.0.1. The neutron flux response to a continuous reactivity insertion is characterized by a very fast rise terminated by the reactivity feedback effect of the negative Doppler coefficient. This self limitation of the power excursion is of primary importance since it limits the power to a tolerable level during the delay time for protective action. Should a continuous RCCA withdrawal accident occur, the transient will be terminated by the following automatic features of the reactor protection system: a. Source Range High Neutron Flux Reactor Trip - actuated when either of two independent source range channels indicates a neutron flux level above a preselected manually adjustable setpoint. This trip function may be manually bypassed only after an intermediate range flux channel indicates a flux level above a specified level. It is automatically reinstated when both intermediate range channels indicate a flux level below a specified level. b. Intermediate Range High Neutron Flux Reactor Trip - actuated when either of two independent intermediate range channels indicates a flux level above a preselected manually adjustable setpoint. This trip function may be manually bypassed only after two of the four power range channels are reading above approximately 10% of full power and is automatically B/B-UFSAR 15.4-3 REVISION 9 - DECEMBER 2002 reinstated when three of the four channels indicate a power level below this value. c. Power Range High Neutron Flux Reactor Trip (Low Setting) - actuated when two out of the four power range channels indicate a power level above approximately 25% of full power. This trip function may be manually bypassed when two of the four power range channels indicate a power level above approximately 10% of full power and is automatically reinstated only after three of the four channels indicate a power level below this value. d. Power Range High-Neutron Flux Reactor Trip (High Setting) - actuates when two out of the four power range channels indicate a power level above a preset setpoint. This trip function is always active. e. High Nuclear Flux Rate Reactor Trip - actuated when the positive rate of change of neutron flux on two out of four nuclear power range channels indicate a rate above the preset setpoint. This trip function is always active. In addition, control rod stops on high intermediate range flux level (one of two) and high power range flux level (one out of four) serve to discontinue rod withdrawal and prevent the need to actuate the intermediate range flux level trip and the power range flux level trip, respectively. 15.4.1.2 Analysis of Effects and Consequences Method of Analysis The analysis of the uncontrolled RCCA bank withdrawal from subcritical accident is performed in three stages: first, an average core nuclear power transient calculation, then an average core heat transfer calculation, and finally the DNBR calculation. The average core nuclear calculation is performed using spatial neutron kinetics methods TWINKLE (Reference 1) to determine the average power generation with time including the various total core feedback effects, i.e., Doppler reactivity and moderator reactivity. The average heat flux and temperature transients are determined by performing a fuel rod transient heat transfer calculation in FACTRAN (Reference 2). The average heat flux is next used in THINC (described in Section 4.4) for transient DNBR calculation. Plant characteristics and initial conditions are discussed in Subsection 15.0.3. In order to give conservative results for a startup accident, the following assumptions are made: a. Since the magnitude of the power peak reached during the initial part of the transient for any given rate B/B-UFSAR 15.4-4 REVISION 9 - DECEMBER 2002 of reactivity insertion is strongly dependent on the Doppler coefficient, conservatively low values as a function of power are used. The Doppler reactivity defect is determined as a function of power level using a one-dimensional steady-state computer code with a Doppler weighting factor of 1.0. The Doppler coefficient used does not directly correlate with Figure 15.0-3 because the TWINKLE code, on which the neutronic analysis is based, is a diffusion-theory code, rather than a point-kinetics approximation. The Doppler defect used as an initial condition is 965 pcm. b. Contribution of the moderator reactivity coefficient is negligible during the initial part of the transient because the heat transfer time between the fuel and the moderator is much longer than the neutron flux response time. However, after the initial neutron flux peak, the succeeding rate of power increase is affected by the moderator reactivity coefficient. A highly conservative value is used in the analysis to yield the maximum peak heat flux. c. The reactor is assumed to be just critical at hot zero power (no load) Tavg. This assumption is more conservative than that of a lower initial system temperature. The higher initial system temperature yields a large fuel-water heat transfer coefficient, larger specific heats, and a less negative (smaller absolute magnitude) Doppler coefficient, all of which tend to reduce the Doppler feedback effect thereby increasing the neutron flux peak. The initial effective multiplication factor is assumed to be 1.0 since this results in the worst nuclear power transient. d. Reactor trip is assumed to be initiated by power range high neutron flux (low setting). The most adverse combination of instrument and setpoint errors, as well as delays for trip signal actuation and rod cluster control assembly release, is taken into account. A 10% increase is assumed for the power range flux trip setpoint raising it from the nominal value of 25% to 35%. Since the rise in the neutron flux is so rapid, the effect of errors in the trip setpoint on the actual time at which the rods are released is negligible. In addition, the reactor trip insertion characteristic is based on the assumption that the highest worth rod cluster control assembly is stuck in its fully withdrawn position. See Subsection 15.0.5 for rod cluster control assembly insertion characteristics.

B/B-UFSAR 15.4-4a REVISION 6 - DECEMBER 1996 e. The maximum positive reactivity insertion rate assumed is greater than that for the simultaneous withdrawal of the combination of the two sequential control banks having the greatest combined worth at maximum speed (45 inches/minute). Control rod drive mechanism design is discussed in Section 4.6.

B/B-UFSAR 15.4-5 REVISION 11 - DECEMBER 2006 f. The most limiting axial and radial power shapes associated with having the two highest combined worth banks in their high worth position are assumed in the DNB analysis. g. The initial power level was assumed to be below the power level expected for any shutdown condition (10-9 of nominal power). This combination of highest reactivity insertion rate and lowest initial power produces the highest peak heat flux. h. Two reactor coolant pumps are assumed to be in operation. This is conservative with respect to DNB. Plant systems and equipment credited for mitigating the effects of the accident are discussed in Subsection 15.0.8 and listed in Table 15.0-7. No single active failure in any of these systems or equipment will adversely affect the consequences of the accident. Results Figures 15.4-1 through 15.4-3 show the transient behavior for the uncontrolled RCCA bank withdrawal incident, with the accident terminated by reactor trip at 35% of nominal power. The reactivity insertion rate used is greater than that calculated for the two highest worth sequential control banks, both assumed to be in their highest incremental worth region. Figure 15.4-1 shows the neutron flux transient. The energy release and the fuel temperature increases are relatively small. The thermal flux response, of interest for DNB considerations, is shown on Figure 15.4-2. The beneficial effect of the inherent thermal lag in the fuel is evidenced by a peak heat flux much less than the full power nominal value. There is a large margin to DNB during the transient since the rod surface heat flux remains below the design value, and there is a high degree of subcooling at all times in the core. Figure 15.4-3 shows the response of the hot spot fuel average temperature and the hot spot clad temperature. The average fuel temperature increases to a value lower than the nominal full power value. The minimum DNBR at all times remains above the limit value. The calculated sequence of events for this accident is shown on Table 15.4-1. With the reactor tripped, the plant returns to a stable condition. The plant may subsequently be cooled down further by following normal plant shutdown procedures. The operating procedures would call for operator action to control RCS boron concentration and pressurizer level using the CVCS, and to maintain steam generator level through control of the main or auxiliary feedwater system. Any action required of the operator to maintain the plant in a stabilized condition will be in a time frame in excess of 10 minutes following reactor trip.

B/B-UFSAR 15.4-6 REVISION 9 - DECEMBER 2002 15.4.1.3 Radiological Consequences There are no radiological consequences associated with an uncontrolled rod cluster control assembly bank withdrawal from a subcritical or low power start-up condition event since radioactivity is contained within the fuel rods and reactor coolant system within design limits. 15.4.1.4 Conclusions In the event of a RCCA withdrawal accident from the subcritical condition, the core and the reactor coolant system are not adversely affected, since the combination of thermal power and the coolant temperature result in a DNBR greater than the limit value. Thus, no fuel or clad damage is predicted as a result of DNB. 15.4.2 Uncontrolled Rod Cluster Control Assembly Bank Withdrawal at Power 15.4.2.1 Identification of Causes and Accident Description Uncontrolled rod cluster control assembly (RCCA) bank withdrawal at power results in an increase in the core heat flux. Since the heat extraction from the steam generator lags behind the core power generation until the steam generator pressure reaches the relief or safety valve setpoint, there is a net increase in the reactor coolant temperature. Unless terminated by manual or automatic action, the power mismatch and resultant coolant temperature rise could eventually result in DNB. Therefore, in order to avert damage to the fuel clad, the reactor protection system is designed to terminate any such transient before the DNBR falls below the limit value. This event is classified as an ANS Condition II incident (an incident of moderate frequency) as defined in Subsection 15.0.1. The automatic features of the reactor protection system which prevent core damage following the postulated accident include the following: a. Power range neutron flux instrumentation actuates a reactor trip if two-of-four channels exceed an overpower setpoint. b. Reactor trip is actuated if any two-out-of-four channels exceed a positive neutron flux rate setpoint. c. Reactor trip is actuated if any two-out-of-four T channels exceed an overtemperature T setpoint. This setpoint is automatically varied with axial power imbalance, coolant temperature and pressure to protect against DNB.

B/B-UFSAR 15.4-6a REVISION 9 - DECEMBER 2002 d. Reactor trip is actuated if any two-out-of-four T channels exceed an overpower T setpoint. This setpont is automatically varied with coolant average temperature so that the allowable heat generation rate (kw/ft) is not exceeded.

B/B-UFSAR 15.4-7 REVISION 11 - DECEMBER 2006 e. A high pressurizer pressure reactor trip actuated from any two-out-of four pressure channels which is set at a fixed point. f. A high pressurizer water level reactor trip actuated from any two-out-of-three level channels when the reactor power is above approximately 10% (Permissive-7). In addition to the above listed reactor trips, there are the following RCCA withdrawal blocks: a. high neutron flux (one-out-of-four power range), b. Overpower T (two-out-of-four), and c. Overtemperature T (two-out-of-four). The manner in which the combination of overpower and overtemperature T trips provide protection over the full range of reactor coolant system conditions is described in Chapter 7.0. Figure 15.0-1 presents allowable reactor coolant loop average temperature and T for the design power distribution and flow as a function of primary coolant pressure. The boundaries of operation defined by the overpower T trip and the over temperature T trip are represented as "protection lines" on this diagram. The protection lines are drawn to include all adverse instrumentation and setpoint errors so that under nominal conditions trip would occur well within the area bounded by these lines. The utility of this diagram is in the fact that the limit imposed by a given DNBR can be represented as a line. The DNB lines represent the locus of conditions for which the DNBR equals the limit value. All points below and to the left of a DNB line for a given pressure have a DNBR greater than the limit value. The diagram shows that DNB is prevented for all cases if the area enclosed with the maximum protection lines is not traversed by the applicable DNBR line at any point. The area of permissible operation (power, pressure and temperature) is bounded by the combination of reactor trips: high neutron flux (fixed setpoint); high pressure (fixed setpoint); low pressure (fixed setpoint); overpower and overtemperature T (variable setpoints).

B/B-UFSAR 15.4-8 REVISION 11 - DECEMBER 2006 15.4.2.2 Analysis of Effects and Consequences Method of Analysis The transient is analyzed by the LOFTRAN Code (Reference 3). This code simulates the neutron kinetics, reactor coolant system, pressurizer, pressurizer relief and safety valves, pressurizer spray, steam generator, and steam generator safety valves. The code computes pertinent plant variables including temperature, pressures, and power level. The core limits as illustrated in Figure 15.0-1 are used as input to LOFTRAN to determine the minimum DNBR during the transient. Bryon/Braidwood Unit 1 have the BWI steam generators while Byron/Braidwood Unit 2 have Westinghouse D5 steam generators. For this reason, the limiting cases are analyzed separately using input for each steam generator design to insure limiting results are calculated. This accident is analyzed with the Revised Thermal Design Procedure as described in WCAP-11397-P-A for minimum DNBR. Plant characteristics and initial conditions are discussed in Subsection 15.0.3. a. Initial reactor power, pressure, and RCS temperatures are assumed to be at their nominal values. Uncertainties in initial conditions are included in the limit DNBR as described in WCAP-11397-P-A. b. Reactivity Coefficients - Two cases are analyzed: 1. Minimum Reactivity Feedback. The most positive moderator coefficient of reactivity allowed by the Technical Specifications is assumed corresponding to the beginning of core life. A variable Doppler power coefficient with core power is used in the analysis. A conservatively small (in absolute magnitude) value is assumed. 2. Maximum Reactivity Feedback. A conservatively large positive moderator density coefficient and a large (in absolute magnitude) negative Doppler power coefficient are assumed. c. The reactor trip on high neutron flux is assumed to be actuated at a conservative value of 118% of nominal full power. The T trips include all adverse instrumentation and setpoint errors; the delays for trip actuation are assumed to be the maximum values. d. The RCCA trip insertion characteristic is based on the assumption that the highest worth assembly is stuck in its fully withdrawn position.

B/B-UFSAR 15.4-8a REVISION 11 - DECEMBER 2006 e. The maximum positive reactivity insertion rate is greater than that for the simultaneous withdrawal of the combinations of the two control banks have the maximum combined worth at maximum speed. f. The analysis assumes all main steam safety valves are operable. If one or more main steam safety valves become inoperable, Technical Specification 3.7.1 requires a reduction in power as well as a reduction in the power range neutron flux - high reactor trip setpoint. The required reductions are based on a heat balance equation as described in Reference 12. A sensitivity study was performed to demonstrate that the reductions are adequate. The effect of RCCA movement on the axial core power distribution is accounted for by causing a decrease in overtemperature T trip setpoint proportional to a decrease in margin to DNB. The peak RCS pressure case for this event is analyzed using the standard thermal design procedure. Initial reactor power, pressure, and RCS temperatures are assumed to be at their nominal values with uncertainties applied in the conservative direction. No credit is taken for the effect of pressurizer spray and power operated relief valves in reducing or limiting the coolant pressure. Pressurizer safety valves are operable. The Technical Specifications allow a 2% tolerance around the nominal setting of 2460 psig for the pressurizer safety valves, with the lowest allowed lifting pressure being 2411 psig. The assumed high pressurizer pressure reactor trip setpoint in the peak pressure cases, including instrument uncertainty, is higher than the lowest setting for the pressurizer safety valves. As a result, the pressurizer safety valves could lift prior to reaching the high pressurizer pressure reactor trip setpoint and the reactor trip might be delayed. The pressurizer safety valves are assumed to lift at the highest setpoint in the peak pressure cases to maximize RCS and secondary side pressure. A sensitivity study is performed assuming the lowest pressurizer safety valve lift setpoint to demonstrate that, with a delayed reactor trip, all applicable acceptance criteria are met.

B/B-UFSAR 15.4-9 REVISION 11 - DECEMBER 2006 Plant systems and equipment credited for mitigating the effects of the accident are discussed in Subsection 15.0.8 and listed in Table 15.0-7. No single active failure in any of these systems or equipment will adversely offset the consequences of the accident. Results Figures 15.4-4 and 15.4-5 show the transient response for a rapid RCCA withdrawal incident starting from full power. Reactor trip on high neutron flux occurs shortly after the start of the accident. Since this is rapid with respect to the thermal time constants of the plant, small changes in Tavg and pressure result and margin to DNB is maintained. The transient response for a slow RCCA withdrawal from full power is shown in Figures 15.4-6 and 15.4-7. Reactor trip on overtemperature T occurs after a longer period and the rise in temperature and pressure is consequently larger than for rapid RCCA withdrawal. Again, the minimum DNBR is greater than the limit value. Figure 15.4-8 shows the minimum DNBR as a function of reactivity insertion rate from initial full power operation for minimum and maximum reactivity feedback. It can be seen that two reactor trip channels provide protection over the whole range of reactivity insertion rates. These are the high neutron flux and overtemperature T channels. The minimum DNBR is never less than the limit value. Figures 15.4-9 and 15.4-10 show the minimum DNBR as a function of reactivity insertion rate for RCCA withdrawal incidents starting at 60% and 10% power, respectively. In neither case does the DNBR fall below the limit value. The shape of the curves of minimum DNB ratio versus reactivity insertion rate in the reference figures is due both to reactor core and coolant system transient response and to protection system action in initiating a reactor trip. Referring to Figure 15.4-10, for example, it is noted that: a. For high reactivity insertion rates (i.e., between ~ 2.0 x 10-4 K/sec and 11.0 x 10-4 K/sec) reactor trip is initiated by the high neutron flux trip for the minimum reactivity feedback cases. For the higher insertion rates in this range, the neutron flux level in the core rises rapidly while core heat flux and coolant system fluid lag behind due to the thermal capacity of the fuel and coolant system fluid. Thus, the reactor is tripped prior to any significant increase in heat flux or coolant temperature resulting in higher minimum DNBRs for these reactivity insertion rates and more margin to the applicable safety analysis limit.

B/B-UFSAR 15.4-10 REVISION 9 - DECEMBER 2002 As reactivity insertion rate decreases, core heat flux and coolant temperatures can remain more nearly in equilibrium with the neutron flux; minimum DNB ratio during the transient thus decreases with decreasing insertion rate. b. The overtemperature T reactor trip circuit initiates a reactor trip when measured coolant loop T exceeds a setpoint based on measured reactor coolant system average temperature and pressure. This trip circuit is described in detail in Chapter 7.0; however, it is important in this context to note that the average temperature contribution to the circuit is lead-lag compensated in order to account for the effect of the thermal capacity of the reactor coolant system in response to power increases. c. With further decrease in reactivity insertion rate, the overtemperature T and high neutron flux trips become equally effective in terminating the transient (e.g., at ~ 2.0 x 10-4 K/sec reactivity insertion rate). For reactivity insertion rates between ~ 2.0 x 10-4 K/sec and ~ 1.0 x 10-4 K/sec the effectiveness of the overtemperature T trip increases (in terms of increased minimum DNB ratio) due to the fact that with lower insertion rates the power increase rate is slower, the rate of rise of average coolant temperature is slower and the system lags and delays become less significant. For reactivity insertion rates less than ~ 1.0 x 10-4 K/sec, the rise in the reactor coolant temperature is sufficiently high so that the setpoint for the first bank of steam generator safety valves is reached prior to trip. This accounts for the slight decrease (shift in the slope) in the rate of increasing minimum DNBR shown between ~ 2.0 x 10-4 K/sec and ~ 1.0 x 10-4 K/sec. At insertion rates of ~ 2.0 x 10-5 K/sec and lower the setpoint for the third bank of steam generator safety valves is reached. Opening of these valves, acts to decrease the rate of the reactor coolant system, average temperature increase. This decrease in the rate of the reactor coolant system, average temperature increase during the transient is accentuated by the lead-lag compensation causing the overtemperature T trip setpoint to be reached later resulting in a lower minimum DNB ratios.

B/B-UFSAR 15.4-10a REVISION 12 - DECEMBER 2008 Figures 15.4-8, 15.4-9 and 15.4-10 illustrate minimum DNBR calculated for minimum and maximum reactivity feedback for the D5 steam generators which bound the BWI steam generators. Since the RCCA withdrawal at power incident is an overpower transient, the fuel temperatures rise during the transient until after reactor trip occurs. For high reactivity insertion rates, the overpower transient is fast with respect to the fuel rod B/B-UFSAR 15.4-11 REVISION 13 - DECEMBER 2010 thermal time constant, and the core heat flux lags behind the neutron flux response. Due to this lag, the peak core heat flux does not exceed 118% of its nominal value (i.e., the high neutron flux trip setpoint assumed in the analysis). Taking into account the effect of the RCCA withdrawal on the axial core power distribution, the peak fuel temperature will still remain below the fuel melting temperature. For slow reactivity insertion rates, the core heat flux remains more nearly in equilibrium with the neutron flux. The overpower transient is terminated by the overtemperature T reactor trip before a DNB condition is reached. The peak heat flux again is maintained below 118% of its nominal value. Taking into account the effect of the RCCA withdrawal on the axial core power distribution, the peak clad centerline temperature will remain below the fuel melting temperature. Since DNB does not occur at any time during the RCCA withdrawal at power transient, the ability of the primary coolant to remove heat from the fuel rod is not reduced. Thus, the fuel cladding temperature does not rise significantly above its initial value during the transient. The calculated sequence of events for this accident is shown on Table 15.4-1. With the reactor tripped, the plant eventually returns to a stable condition. The plant may subsequently be cooled down further by following normal plant shutdown procedures. The peak RCS pressure for this event is analyzed using the same range of reactivity insertion rates as the DNB cases discussed above. A limit is placed on the maximum reactivity insertion rate during an RWAP event to demonstrate compliance with the TS RCS pressure SL. Subsequently, the plant-specific core design must ensure this maximum reactivity insertion rate will not be exceeded as part of the reload evaluation process. This ensures the RWAP RCS overpressure analysis remains valid on a cycle specific basis. 15.4.2.3 Radiological Consequences There are only minimal radiological consequences associated with an uncontrolled rod cluster control assembly bank withdrawal at power event. The reactor trip causes a turbine trip, and heat is removed from the secondary system through the steam generator power relief valves or safety valves. The radiological consequences associated with atmospheric steam release from this event are less severe than the steamline break accident analyzed in Subsection 15.1.5. 15.4.2.4 Conclusions The high neutron flux and overtemperature T trip channels provide adequate protection over the entire range of possible reactivity insertion rates, i.e., the minimum value of DNBR is always larger than the limit value. The radiological consequences would be less severe than the steamline break accident analyzed in Subsection 15.1.5.

B/B-UFSAR 15.4-12 REVISION 9 - DECEMBER 2002 15.4.3 Rod Cluster Control Assembly Misoperation (System Malfunction or Operator Error) 15.4.3.1 Identification of Causes and Accident Description Rod cluster control assembly (RCCA) misoperation accidents include: a. One or more dropped RCCAs within the same group, b. A dropped RCCA bank, c. Statically misaligned RCCA, d. Withdrawal of a single RCCA. Each RCCA has a position indicator channel which displays position of the assembly. The displays of assembly positions are grouped for the operator's convenience. Fully inserted assemblies are further indicated by a rod at bottom signal, which actuates a local alarm and a control room annunciator. Group demand position is also indicated. Full length RCCAs are always moved in preselected banks, and the banks are always moved in the same preselected sequence. Each bank of RCCAs is divided into two groups. The rods comprising a group operate in parallel through multiplexing thyristors. The two groups in a bank move sequentially such that the first group is always within one step of the second group in the bank. A definite schedule of actuation (or deactuation of the stationary gripper, movable gripper, and lift coils of a mechanism) is required to withdraw the RCCA that is attached to the mechanism. Since the stationary gripper, movable gripper, and lift coils associated with the four RCCAs of a rod group are driven in parallel, any single failure which would cause rod withdrawal would affect a minimum of one group. Mechanical failures are in the direction of insertion, or immobility. The dropped RCCAs, dropped RCCA bank, and statically misaligned RCCA events are classified as ANS Condition II incidents (incidents of moderate frequency) as defined in Subsection 15.0.1. The single RCCA withdrawal incident is classified as an ANS Condition III event, as discussed below. No single electrical or mechanical failure in the rod control system could cause the accidental withdrawal of a single rod cluster control assembly (RCCA) from the inserted bank at full power operation. The operator could deliberately withdraw a single RCCA in a control bank since this feature is necessary in order to retrieve an assembly should one be accidentally dropped. The event analyzed must result from multiple wiring failures (probability for single random failure is on the order of 10-4/year refer to Subsection 7.7.2.2) or multiple deliberate operator actions and subsequent and repeated operator disregard B/B-UFSAR 15.4-13 REVISION 9 - DECEMBER 2002 of event indication. The probability of such a combination of conditions is considered so low that the limiting consequences may include slight fuel damage. Thus, consistent with the philosophy and format of ANSI N18.2, the event is classified as a Condition III event. By definition "Condition III occurrences include incidents, any one of which may occur during the lifetime of a particular plant," and "shall not cause more than a small fraction of fuel elements in the reactor to be damaged..." This selection of criterion is not in violation of GDC 25 which states, "The protection system shall be designed to assure that specified acceptable fuel design limits are not exceeded for any single malfunction of the reactivity control systems, such as accidental withdrawal (not ejection or dropout) of control rods." (Emphases have been added.) It has been shown that single failures resulting in RCCA bank withdrawals do not violate specified fuel design limits. Moreover, no single malfunction can result in the withdrawal of a single RCCA. Thus, it is concluded that the criterion established for the single rod withdrawal at power is appropriate and in accordance with GDC 25. A dropped RCCA or RCCA bank is detected by: a. Sudden drop in the core power level as seen by the nuclear instrumentation system; b. Asymmetric power distribution as seen on out-of-core neutron detectors or core exit thermocouples; c. Rod at bottom signal; d. Rod deviation alarm; and e. Rod position indication. Misaligned assemblies are detected by: a. Asymmetric power distribution as seen on out-of-core neutron detectors or core exit thermocouples; b. Rod deviation alarm; and c. Rod position indicators. The resolution of the rod position indicator channel is 6 steps at full accuracy and 12 steps at half accuracy. Deviation of any assembly from its group by twice this distance (24 steps) will not cause power distributions worse than the design limits. The deviation alarm alerts the operator to rod deviation with respect to the group position in excess of 12 steps. If the rod deviation alarm is not operable, procedures require the operator to take appropriate actions.

B/B-UFSAR 15.4-14 REVISION 11 - DECEMBER 2006 If one or more rod position indicator channels should be out of service, detailed operating instructions shall be followed to assure the alignment of the non-indicated RCCAs. The operator is also required to take action as required by the Technical Specifications. In the extremely unlikely event of simultaneous electrical failures which could result in single RCCA withdrawal, rod deviation and rod control urgent failure would both be displayed on the plant annunciator, and the rod position indicators would indicate the relative positions of the RCCAs in the bank. The urgent failure alarm also inhibits automatic rod motion in the group in which it occurs. Withdrawal of a single RCCA by operator action, whether deliberate or by a combination of errors, would result in activation of the same alarm and the same visual indications. Withdrawal of a single RCCA results in both positive reactivity insertion tending to increase core power, and an increase in local power density in the core area associated with the RCCA. Automatic protection for this event is provided by the overtemperature T reactor trip, although due to the increase in local power density it is not possible in all cases to provide assurance that the core safety limits will not be violated. Plant systems and equipment credited for mitigating the effects of the various control rod misoperations are discussed in Subsection 15.0.8 and listed in Table 15.0-7. No single active failure in any of these systems or equipment will adversely affect the consequences of the accident. 15.4.3.2 Analysis of Effects and Consequences a. Dropped RCCAs, dropped RCCA bank, and statically misaligned RCCA. Method of Analysis 1. One or more dropped RCCAs from the same group. For evaluation of the dropped RCCA event, the transient system response is calculated using the LOFTRAN code. The code simulates the neutron kinetics, reactor coolant system, pressurizer, pressurizer relief and safety valves, pressurizer spray, steam generator, and steam generator safety valves. The code computes pertinent plant variables including temperatures, pressures, and power level. Statepoints are calculated and nuclear models are used to obtain a hot channel factor consistent with the primary system conditions and reactor power. By incorporating the primary conditions from the transient and the hot channel factor from the nuclear analysis, the B/B-UFSAR 15.4-15 REVISION 9 - DECEMBER 2002 DNB design basis is shown to be met using the THINC code. The transient response, nuclear peaking factor analysis, and DNB design basis confirmation are performed in accordance with the methodology described in Reference 9. 2. Dropped RCCA Bank A LOFTRAN calculation is not necessary for the dropped RCCA event. Westinghouse WCAP 11394-P-A concludes that sufficient DNB margin exists, subject to plant/cycle specific analysis. 3. Statically Misaligned RCCA. Steady state power distributions are analyzed using the computer codes as described in Table 4.1-2. The peaking factors are then compared to the peaking factor limit determined by the THINC code at the safety analysis DNBR limit. Results 1. One or more dropped RCCAs. Single or multiple dropped RCCAs within the same group result in a negative reactivity insertion. When detected, the reactor is manually tripped following the drop of the RCCAs. The core is not adversely affected during this period, since power is decreasing rapidly. Following manual reactor trip, normal shutdown procedures are followed. RCCA may be manually retrieved by following approved operating procedures. For those dropped RCCAs which do not result in a manual reactor trip, power may be reestablished either by reactivity feedback or control bank withdrawal. Following a dropped rod event in manual rod control, the plant will establish a new equilibrium condition. The equilibrium process without control system interaction is monotonic, thus removing power overshoot as a concern and establishing the automatic rod control mode of operation as the limiting case. For a dropped RCCA event in the automatic rod control mode, the rod control system detects the drop in power and initiates control bank withdrawal. Power overshoot may occur due to this action by the automatic rod controller after which the control system will insert the control bank to restore nominal power. Figure 15.4-12a B/B-UFSAR 15.4-16 REVISION 9 - DECEMBER 2002 shows a typical transient response to a dropped RCCA (or RCCAs) in automatic control. Uncertainties in the initial condition are included in the DNB evaluation as described in Reference 11. In all cases, the minimum DNBR remains above the limit value. 2. Dropped RCCA Bank. A dropped RCCA bank typically results in a reactivity insertion greater than 500 pcm. The reactor is manually tripped following the drop of a RCCA bank. The core is not adversely affected during this period, since power is decreasing rapidly. Following reactor trip, normal shutdown procedures are followed to further cool down the plant. Any action required of the operator to maintain the plant in a stabilized condition will be in a time frame in excess of ten minutes following the incident. 3. Statically Misaligned RCCA The most severe misalignment situations with respect to DNBR at significant power levels arise from cases in which one RCAA is fully inserted, or where bank D is fully inserted with one RCCA fully withdrawn. Multiple independent alarms, including a bank insertion limit alarm, alert the operator well before the postulated conditions are approached. The bank can be inserted to its insertion limit with any one assembly fully withdrawn without the DNBR falling below the limit value. The insertion limits in the Technical Specifications may vary from time to time depending on a number of limiting criteria. It is preferable, therefore, to analyze the misaligned RCCA case at full power for a position of the control bank as deeply inserted as the criteria on minimum DNBR and power peaking factor will allow. The full power insertion limits on control bank D must then be chosen to be above that position and will usually be dictated by other criteria. Detailed results will vary from cycle to cycle depending on fuel arrangements. For the RCCA misalignment in which control bank D is inserted to its full power insertion limit and one RCCA is fully withdrawn, the DNBR does not fall below the limit value. This case was analyzed B/B-UFSAR 15.4-17 REVISION 9 - DECEMBER 2002 assuming the initial reactor power, pressure, and RCS temperatures were at their nominal values, but with the increased radial peaking factor associated with the misaligned RCCA. Uncertainties in initial conditions were included as described in WCAP-11397-P-A (Reference 11). DNB calculations have not been performed specifically for assemblies missing from other banks; however, power shape calculations have been done as required for the RCCA ejection analysis. Inspection of the power shapes shows that the DNB and peak kW/ft situation is less severe than the bank D case discussed above assuming insertion limits on the other banks equivalent to a bank D full-in insertion limit. For the RCCA misalignments with one RCCA fully inserted, the DNBR does not fall below the limit value. This case was analyzed assuming the initial reactor power, pressure, and RCS temperatures are at their nominal values, but with the increased radial peaking factor associated with the misaligned RCCA. Uncertainties in the initial conditions are included as described in WCAP-11397-P-A. DNB does not occur for the RCCA misalignment incident and thus the ability of the primary coolant to remove heat from the fuel rod is not reduced. The peak fuel temperature corresponds to a linear heat generation rate based on the radial peaking factor penalty associated with the misaligned RCCA and the design axial power distribution. The resulting linear heat generation is well below that which would cause fuel melting. Following the identification of a RCCA group misalignment condition by the operator, the operator is required to take action as required by the plant Technical Specifications and operating instructions. b. Single RCCA Withdrawal Method of Analysis Power distributions within the core are calculated using the computer codes as described in Table 4.1-2. The peaking factors are then used by THINC to calculate the minimum DNBR for the event. The case of the worst rod withdrawn from control bank D inserted at the insertion limit, with the reactor B/B-UFSAR 15.4-18 REVISION 9 - DECEMBER 2002 initially at full power, was analyzed. This incident is assumed to occur at beginning-of-life since this results in the minimum value of moderator temperature coefficient. This assumption maximizes the power rise and minimizes the tendency of increased moderator temperature to flatten the power distribution. Results For the single rod withdrawal event, two cases have been considered as follows: 1. If the reactor is in the manual control mode, continuous withdrawal of a single RCCA results in both an increase in core power and coolant temperature, and an increase in the local hot channel factor in the area of the withdrawing RCCA. In terms of the overall system response, this case is similar to those presented in Subsection 15.4.2; however, the increased local power peaking in the area of the withdrawn RCCA results in lower minimum DNBRs than for the withdrawn bank cases. Depending on initial bank insertion and location of the withdrawn RCCA, automatic reactor trip may not occur sufficiently fast to prevent the minimum core DNBR from falling below the limit value. Evaluation of this case at the power and coolant conditions at which the overtemperature T trip would be expected to trip the plant shows that an upper limit for the number of rods with a DNBR less than the limit value is 5%. 2. If the reactor is in the automatic control mode, the multiple failures that result in the withdrawal of a single RCCA will result in the immobility of the other RCCAs in the controlling bank. The transient will then proceed in the same manner as Case 1 described above. For such cases as above, a reactor trip will ultimately ensue, although not sufficiently fast in all cases to prevent a minimum DNBR in the core of less than the limit value. Following reactor trip, normal shutdown procedures are followed. 15.4.3.3 Radiological Consequences The most limiting rod cluster control assembly misoperation, accidental withdrawal of a single RCCA, is predicted to result in limited fuel damage (< 5% of the total). The subsequent reactor and turbine trip would result in atmospheric steam release, assuming the condenser was not available for use. The radiological consequences from B/B-UFSAR 15.4-19 REVISION 9 - DECEMBER 2002 this event would be no greater than the locked rotor event, analyzed in Subsection 15.3.3. 15.4.3.4 Conclusions For cases of dropped RCCAs or dropped banks, for which the reactor is manually tripped, there is no reduction in the margin to core thermal limits, and consequently the DNB design basis is met. It is shown for all cases which do not result in reactor trip that the DNBR remains greater than the limit value and, therefore, the DNB design is met. For all cases of any RCCA fully inserted, or control bank D inserted to its rod insertion limits with any single RCCA in that bank fully withdrawn (static misalignment), the DNBR remains greater than the limit value. For the case of the accidental withdrawal of a single RCCA, with the reactor in the automatic or manual control mode and initially operating at full power with control bank D at the insertion limit, an upper bound of the number of fuel rods experiencing DNB is 5 percent of the total fuel rods in the core. 15.4.4 Startup of an Inactive Reactor Coolant Pump at an Incorrect Temperature The Technical Specifications require that all four reactor coolant pumps be operating for reactor power operation; therefore, operation with an inactive loop is precluded. This event was originally included in the FSAR licensing basis when operation with a loop out of service was considered. Based on the Technical Specifications, which prohibit at-power operation with an inactive loop, and changes to the Technical Specifications that deleted all references to three-loop operation, this event has been deleted from the UFSAR.

B/B-UFSAR 15.4-20 and 15.4-21 REVISION 5 - DECEMBER 1994 Pages 15.4-20 and 15.4-21 have been deleted intentionally.

B/B-UFSAR 15.4-22 REVISION 9 - DECEMBER 2002 15.4.5 A Malfunction or Failure of the Flow Controller in a BWR Loop That Results in an Increased Reactor Coolant Flow Rate (Not applicable in PWRs) 15.4.6 Chemical and Volume Control System Malfunction That Results in a Decrease in Boron Concentration in the Reactor Coolant 15.4.6.1 Identification of Causes and Accident Description The principal means of causing an inadvertent boron dilution are the opening of the primary water makeup control valve and failure of the blend system, either by controller or mechanical failure. The CVCS and RMCS are designed to limit, even under various postulated failure modes, the potential rate of dilution to values which, with indication by alarms and instrumentation, will allow sufficient time for operator response, depending on the mode of operation, to terminate the dilution. An inadvertent dilution from the RMCS may be terminated by closing the primary water makeup control valve, CV-111A. All expected sources of dilution may be terminated by closing isolation valves in the CVCS, LCV-112B and C. The lost shutdown margin (SDM) may be regained by the opening of isolation valves to the RWST, LCV-112D and E, thus allowing the addition of 2300 ppm borated water to the RCS.

B/B-UFSAR 15.4-23 REVISION 9 - DECEMBER 2002 It is assumed that the addition rate of unborated water to the RCS is limited to 205 gpm by the capacity of the primary water makeup pumps and two charging pumps for Modes 1 and 2. The addition rate of unborated water to the RCS is assumed to be limited to 168 gpm by the high charging flow alarm in Modes 3, 4, and 5. Flows higher than 168 gpm are not considered in these modes of operation since the VCT will be filled faster and the "boron dilution alert" alarms will be initiated earlier. Unborated water sources are isolated from the RCS if conditions prescribed by Technical Specifications 3.3.9 cannot be met. Generally, to dilute, the operator must perform two distinct actions: a. Switch control of the RMCS from the automatic makeup mode to the dilute mode and b. Take RMCS control switch to start. Failure to carry out either of the above actions prevents initiation of dilution. Also during normal operation the operator may add borated water to the RCS by blending boric acid from the boric acid storage tanks with primary grade water. This requires the operator to determine the concentration of the addition and setting the blended flow rate and the boric acid flow rate. The makeup controller will then limit the sum of the boric acid flow rate and primary grade water flow rate to the blended flow rate, i.e., the controller determines the primary grade water flow rate, after the RMCS control switch is taken to start. The status of the RCS makeup is continuously available to the operator by: a. Indication of the boric acid and blended flow rates, b. CVCS, AB, and PW pump status lights, c. Deviation alarms if the boric acid or blended flow rates deviate by more than 10 percent from the preset values, d. Source range neutron flux - when reactor is subcritical; 1. high flux at shutdown alarm, 2. indicated source range neutron flux count rates, 3. audible source range neutron flux count rate, and 4. source range neutron flux - doubling alarm.

B/B-UFSAR 15.4-24 REVISION 9 - DECEMBER 2002 e. With the reactor critical 1. Axial flux difference alarm (reactor power 50 percent RTP), 2. Control rod insertion limit low and low-low alarms, 3. Overtemperature T alarm (at power), 4. Overtemperature T turbine runback (at power), and 5. Overtemperature T reactor trip. f. Power Range Neutron Flux - High, both high and low setpoint reactor trips. g. "Boron Dilution Alert" alarm(s) when reactor is subcritcal 1. VCT high level, 2. Divert valve CV112A is not in VCT position, and 3. Source Range neutron flux-doubling. This event is classified as an ANS Condition II incident (a fault of moderate frequency) as defined in Subsection 15.0.1. 15.4.6.2 Analysis of Effects and Consequences To cover all phases of plant operation, boron dilution during refueling, cold shutdown, hot shutdown, hot standby, startup, and power modes of operation are considered in this analysis. Conservative values for necessary parameters were used, i.e., high RCS critical boron concentrations, high boron worths, minimum shutdown margins, and lower than actual RCS volumes. These assumptions result in conservative determinations of the time available for operator or system response after detection of a dilution transient in progress. Conservative analysis methods are used to analyze a CVCS malfunction that results in a decrease in boron concentration in the reactor coolant. Minimum reactor coolant volumes and maximum dilution flow rates are conservatively assumed for each case analyzed. The result is a logarithmic decrease in coolant boron concentration according to the equation: C VQ- = dtC dBinB where CB = Boron concentration in the RCS B/B-UFSAR 15.4-25 REVISION 13 - DECEMBER 2010 Qin = Maximum dilution flow rate V = Active volume in RCS. This equation can be solved for the time at which the core would become critical or all shutdown margin would be lost. The rate of reactivity insertion due to the dilution can be calculated from the dilution rate and the differential boron worth. The results of this analysis are conservative for all cases analyzed. A comprehensive review of the primary system has been completed. This review showed that a single failure in the CVCS system in the cold shutdown condition would not result in a boron dilution of the reactor coolant system and that the CVCS malfunction represents the most limiting potential source of dilution. Based on this review, it is clear that the analysis results presented in the UFSAR bound all potential sources of inadvertent dilution under all modes of operation. Dilution During Refueling An uncontrolled boron dilution transient cannot occur during this mode of operation. Inadvertent dilution is prevented by administrative controls which isolate the RCS from the potential source of unborated water. CVCS valves, specified in Technical Specification 3.9.2 Bases will be verified closed and secured in position by mechanical stops or by removal of air or electrical power. These valves block all flow paths that could allow unborated makeup water to reach the RCS. Any makeup which is required during refueling will be borated water supplied from the RWST. Dilution During Cold Shutdown During this mode, the reactor is shutdown and meets the minimum shutdown margin described by the Core Operating Limits Report (COLR) per Technical Specification 3.1.1. The following conditions are assumed for inadvertent boron dilution while in this operating mode: a) The minimum ratio of initial to critical boron concentration required to ensure the core does not reach criticality in this mode is 1.065 for Byron Unit 1 and Braidwood Unit 1 and 1.075 for Byron Unit 2 and Braidwood Unit 2. The initial boron concentrations used for these ratios must meet the shutdown margin requirements as specified in the COLR. b) Dilution flow is limited to a maximum dilution rate of 168 gpm, which is equivalent to the high charging flow alarm plus uncertainties. Any additional dilution flow would increase the VCT level, without an immediate decrease in RCS boron concentration.

B/B-UFSAR 15.4-26 REVISION 13 - DECEMBER 2010 c) The minimum RCS water volume of 10583 ft3 for Byron Unit 1 and Braidwood Unit 1 and 9260 ft3 for Byron Unit 2 and Braidwood Unit 2 is used. This is a conservative estimate of the active volume of the RCS with one RCP running and all four loop stop valves open. Dilution During Hot Shutdown During this mode, the reactor is shutdown and meets the minimum shutdown margin described by the Core Operating Limits Report (COLR) per Technical Specification 3.1.1. The following conditions are assumed for inadvertent boron dilution while in this operating mode: a) The minimum ratio of initial to critical boron concentration required to ensure the core does not reach criticality in this mode is 1.071 for Byron Unit 1 and Braidwood Unit 1 and 1.082 for Byron Unit 2 and Braidwood Unit 2. The initial boron concentrations used for these ratios must meet the shutdown margin requirements as specified in the COLR. b) Dilution flow is limited to a maximum dilution rate of 168 gpm, which is equivalent to the high charging flow alarm plus uncertainties. Any additional dilution flow would increase the VCT level, without an immediate decrease in RCS boron concentration. c) The minimum RCS water volume of 10583 ft3 for Byron Unit 1 and Braidwood Unit 1 and 9260 ft3 for Byron Unit 2 and Braidwood Unit 2 is used. This is a conservative estimate of the active volume of the RCS with one RCP running and all four-loop stop valves open. Dilution During Hot Standby During the mode, the reactor is shutdown and meets the minimum shutdown margin described by the Core Operating Limits Report (COLR) per Technical Specification 3.1.1. The following conditions are assumed for inadvertent boron dilution while in this operating mode: a) The minimum ratio of initial to critical boron concentration required to ensure the core does not reach criticality in this mode is 1.088 for Byron Unit 1 and Braidwood Unit 1 and 1.101 for Byron Unit 2 and Braidwood Unit 2. The initial boron concentrations used for these ratios must meet the shutdown margin requirements as specified in the COLR.

B/B-UFSAR 15.4-26a REVISION 13 - DECEMBER 2010 b) Dilution flow is limited to a maximum dilution rate of 168 gpm, which is equivalent to the high charging flow alarm plus uncertainties. Any additional dilution flow would increase the VCT level, without an immediate decrease in RCS boron concentration. c) The minimum RCS water volume of 10583 ft3 for Byron Unit 1 and Braidwood Unit 1 and 9260 ft3 for Byron Unit 2 and Braidwood Unit 2 is used. This is a conservative estimate of the active volume of the RCS with one RCP running and all four-loop stop valves open. Dilution During Startup Startup is a transitory mode of operation. In this mode the plant is being taken from one long-term mode of operation, hot standby, to another, power operation. The plant is maintained in the startup mode only for the purpose of startup testing at the beginning of each cycle. During this mode of operation the plant is in manual control, i.e., Tavg/rod control is in manual. All normal actions required to change power level, either up or down, require operator initiation. The Technical Specifications and TRM require a SDM as specified in the Core Operating Limits Report and four reactor coolant pumps operating. Other conditions assumed are: a. Dilution flow is limited by the reactor makeup water system. The maximum anticipated flow rate of unborated primary water to the RCS is 205 gpm. b. A minimum RCS water volume of 9941.9 ft3 for Byron Units 1 and 2 and Braidwood Units 1 and 2. This is a conservative estimate of the active RCS volume, minus the pressurizer volume. c. The CB for criticality (ARI-1) is very conservatively assumed with a very conservative, constant boron worth.

B/B-UFSAR 15.4-27 REVISION 13 - DECEMBER 2010 Dilution During Full Power Operation The plant may be operated at power two ways, automatic Tavg/rod control and under operator control. The TRM requires an available trip reactivity as specified in the Core Operating Limiting Report. Technical Specifications require operation with four reactor coolant pumps. With the plant at power and the RCS at pressure, the dilution rate is limited by the capacity of the reactor makeup water system with two centrifugal charging pumps in operation (analysis is performed assuming two charging pumps are in operation even though normal operation is with one pump). Conditions assumed for this mode are: a. For manual and automatic reactor control at full power conditions, the dilution flow is limited by the reactor makeup water system (205 gpm). b. A minimum RCS water volume of 9941.9 ft3 for Byron Units 1 and 2 and Braidwood Units 1 and 2. This is a conservative estimate of the active RCS volume, minus the pressurizer volume. c. The CB for criticality (ARI-1) is very conservatively assumed with a very conservative, constant boron worth. 15.4.6.3 Results and Conclusions Dilution During Refueling Dilution during this mode has been precluded through administrative control of valves in the possible dilution flow paths, see Subsection 15.4.6.2. Dilution During Cold Shutdown In this mode of operation, unborated water sources will be isolated from the RCS if the conditions prescribed by Technical Specifications 3.3.9 cannot be met. In the event of an inadvertent boron dilution transient while in this mode of operation, the "boron dilution alert" alarms will sound upon detection of VCT high level, and the operator will administratively align CVCS valves to terminate dilution and start boration (note that this alarm could also be initiated by the flux doubling signal or CV112A valve not in VCT position, but these signals are not credited in the analysis). Valves LCV-112D and E (isolation valves to the RWST) are opened to supply 2300 ppm borated water to the suction of the charging pumps and valves LCV-112B and C (isolation valves in the CVCS) are closed to terminate the dilution. These actions are carried out to minimize the approach to criticality and regain lost shutdown margin. The operator has at least 15 minutes to complete these actions from the time of the alarms until shutdown margin is lost.

B/B-UFSAR 15.4-28 REVISION 12 - DECEMBER 2008 Dilution During Hot Shutdown and Hot Standby In this mode of operation, unborated water sources will be isolated from the RCS if the conditions prescribed by Technical Specifications 3.3.9 cannot be met. In the event of an inadvertent boron dilution transient while in this mode of operation, the "boron dilution alert" alarms will sound upon detection of VCT high level, and the operator will administratively align CVCS valves to terminate dilution and start boration (note that this alarm could also be initiated by the flux doubling signal or CV112A valve not in VCT position, but these signals are not credited in the analysis). Valves LCV-112D and E (isolation valves to the RWST) are opened to supply 2300 ppm borated water to the suction of the charging pumps and valves LCV-112B and C (isolation valves in the CVCS) are closed to terminate the dilution. These actions are carried out to minimize the approach to criticality and regain lost shutdown margin. The operator has at least 15 minutes to complete these actions from the time of the alarm(s) until shutdown margin is lost. Dilution During Startup This mode of operation is a transitory mode to go to power and is the operational mode in which the operator intentionally dilutes and withdraws control rods to take the plant critical. During this mode the plant is in manual control with the operator required to maintain a very high awareness of the plant status. For a normal approach to criticality the operator must manually initiate a limited dilution and subsequently manually withdraw the control rods, a process that takes several hours. The plant Technical Specifications require that the operator determine the estimated critical position of the control rods prior to approaching criticality thus assuring that the reactor does not go critical with the control rods below the insertion limits. Once critical, the power escalation must be sufficiently slow to allow the operator to manually block the source range reactor trip (nominally at 105 cps) after receiving P-6 from the intermediate range. Too fast a power escalation (due to an unknown dilution) would result in reaching P-6 unexpectedly leaving insufficient time to manually block the source range reactor trip. Failure to perform this manual action results in a reactor trip and immediate shutdown of the reactor. However, in the event of an unplanned approach to criticality or dilution during power escalation while in the startup mode, the plant status is such that minimal impact will result. The plant will slowly escalate in power to a reactor trip on the power range neutron flux - high, low setpoint (nominally 25 percent RTP). After reactor trip, there are more than 15 minutes for operator action prior to return to criticality. The required operator action is to initiate and continue boration until adequate shutdown margin is restored and to terminate the dilution.

B/B-UFSAR 15.4-28a REVISION 9 - DECEMBER 2002 Dilution During Full Power Operation With the reactor in manual control and no operator action taken to terminate the transient, the power and temperature rise will cause the reactor to reach the overtemperature T or Power Range High Neutron Flux trip setpoint resulting in a reactor trip. After reactor trip, there are more than 15 minutes for operator action prior to return to criticality. The required operator action is to initiate and continue boration until adequate shutdown margin is restored and to terminate the dilution. The boron dilution transient in this case is essentially the B/B-UFSAR 15.4-29 REVISION 9 - DECEMBER 2002 equivalent to an uncontrolled rod withdrawal at power. The maximum reactivity insertion rate for a boron dilution transient is conservatively estimated to be 2.0 pcm/sec and is within the range of insertion rates analyzed for uncontrolled rod withdrawal at power. It should be noted that prior to reaching the overtemperature T reactor trip, the operator will have received an alarm on overtemperature T turbine runback. Thus with the reactor in automatic rod control, a boron dilution will result in a power and temperature increase such that the rod controller will attempt to compensate by slow insertion of the control rods. This action by the controller will result in at least one of three alarms to the operator: a. rod insertion limit - low level alarm, b. rod insertion limit - low-low level alarm if insertion continued after (1), and c. axial flux difference alarm (I outside of the target band). Given the many alarms, indications, and the inherent slow process of dilution at power, the operator has sufficient time for action. For example, the operator has more than 15 minutes from the rod insertion limit low-low alarm until l.3 percent K/K is inserted at beginning-of-life. The time would be significantly longer at end-of-life, due to the low initial boron concentration, when shutdown margin is a concern. The above results demonstrate that in all modes of operation an inadvertent boron dilution is precluded, or sufficient time is available for operator action to terminate the transient. Following termination of the dilution flow and initiation of boration the reactor is in a stable condition with the operator regaining the required shutdown margin. 15.4.7 Inadvertent Loading and Operation of a Fuel Assembly in an Improper Position 15.4.7.1 Identification of Causes and Accident Description Fuel and core loading errors such as can arise from the inadvertent loading of one or more fuel assemblies into improper positions, loading a fuel rod during manufacture with one or more pellets of the wrong enrichment or the loading of a full fuel B/B-UFSAR 15.4-30 assembly during manufacture with pellets of the wrong enrichment will lead to increased heat fluxes if the error results in placing fuel in core positions calling for fuel of lesser enrichment. Also included among possible core loading errors is the inadvertent loading of one or more fuel assemblies requiring burnable poison rods into a new core without burnable poison rods. Any error in enrichment, beyond the normal manufacturing tolerances, can cause power shapes which are more peaked than those calculated with the correct enrichments. There is a 5% uncertainty margin included in the design value of power peaking factor assumed in the analysis of Condition I Condition II transients. The incore system of movable flux detectors which is used to verify power shapes at the start of life is capable of revealing any assembly enrichment error or loading error which causes power shapes to be peaked in excess of the design value. To reduce the probability of core loading errors, each fuel assembly is marked with an identification number and loaded in accordance with a core loading diagram. During core loading, the identification number will be checked before each assembly is moved into the core. Serial numbers read during fuel movement are subsequently recorded on the loading diagram as a further check on proper placing after the loading is completed. The power distortion due to any combination of misplaced fuel assemblies would significantly raise peaking factors and would be readily observable with incore flux monitors. In addition to the flux monitors, thermocouples are located at the outlet of about one third of the fuel assemblies in the core. There is a high probability that these thermocouples would also indicate any abnormally high coolant enthalpy rise. Incore flux measurements are taken during the startup subsequent to every refueling operation. This event is classified as an ANS Condition III incident (an infrequent incident) as defined in Subsection 15.0.1. 15.4.7.2 Analysis of Effects and Consequences Method of Analysis Steady state power distributions in the x-y plane of the core are calculated using the computer codes as described in Table 4.1-2. A discrete representation is used wherein each individual fuel rod is described by a mesh interval. The power distributions in the x-y plane for a correctly loaded core assembly are also given in Chapter 4.0 based on enrichments given in that section. For each core loading error case analyzed, the percent deviations from detector readings for a normally loaded core are shown at all incore detector locations (see Figures 15.4-13 through 15.4-17, inclusive).

B/B-UFSAR 15.4-31 Results The following core loading error cases have been analyzed: Case A: Case in which a Region 1 assembly is interchanged with a Region 3 assembly. The particular case considered was the interchange to two adjacent assemblies near the periphery of the core (see Figure 15.4-13). Case B: Case in which a Region 1 assembly is interchanged with a neighboring Region 2 fuel assembly. Two analyses have been performed for this case (see Figures 15.4-14 and 15.4-15). In Case B-1, the interchange is assumed to take place with the burnable poison rods transferred with the Region 2 assembly mistakenly loaded into Region 1. In Case B-2, the interchange is assumed to take place closer to core center and with burnable poison rods located in the correct Region 2 position but in a Region 1 assembly mistakenly loaded in the Region 2 position. Case C: Enrichment error: Case in which a Region 2 fuel assembly is loaded in the core central position (see Figure 15.4-16). Case D: Case in which a Region 2 fuel assembly instead of a Region 1 assembly is loaded near the core periphery (see Figure 15.4-17). 15.4.7.3 Radiological Consequences There are no radiological consequences associated with inadvertent loading and operation of a fuel assembly in an improper position since activity is contained with the fuel rods and reactor coolant system within design limits. 15.4.7.4 Conclusions Fuel assembly enrichment errors would be prevented by administrative procedures implemented in fabrication. In the event that a single pin or pellet has a higher enrichment than the nominal value, the consequences in terms of reduced DNBR and increased fuel and clad temperatures will be limited to the incorrectly loaded pin or pins.

B/B-UFSAR 15.4-32 Fuel assembly loading errors are prevented by administrative procedures implemented during core loading. In the unlikely event that a loading error occurs, analyses in this section confirm that resulting power distribution effects will either be readily detected by the incore moveable detector system or will cause a sufficiently small perturbation to be acceptable within the uncertainties allowed between nominal and design power shapes. 15.4.8 Spectrum of Rod Cluster Control Assembly Ejection Accidents 15.4.8.1 Identification of Causes and Accident Description This accident is defined as the mechanical failure of a control rod mechanism pressure housing resulting in the ejection of a rod cluster control assembly (RCCA) and drive shaft. The consequence of this mechanical failure is a rapid positive reactivity insertion together with an adverse core power distribution, possibly leading to localized fuel rod damage. 15.4.8.1.1 Design Precautions and Protection Certain features are intended to preclude the possibility of rod ejection accident, or to limit the consequences if the accident were to occur. These include a sound, conservative mechanical design of the rod housings, together with a thorough quality control (testing) program during assembly, and a nuclear design which lessens the potential ejection worth of RCCAs, and minimizes the number of assemblies inserted at high power levels. Mechanical Design The mechanical design is discussed in Section 4.6. Mechanical design and quality control procedures intended to preclude the possibility of a RCCA drive mechanism housing failure are listed below: a. Each full length control rod drive mechanism housing is completely assembled and shop tested at 4100 psi. b. The mechanism housings are individually hydrotested after they are attached to the head adapters in the reactor vessel head, and checked during the hydrostatic test of the completed reactor coolant system. c. Stress levels in the mechanism are not affected by anticipated system transients at power, or by the thermal movement of the coolant loops. Moments induced by the design-basis earthquake can be accepted within the allowable primary working stress range specified by the ASME Code, Section III, for Class 1 components.

B/B-UFSAR 15.4-33 REVISION 8 - DECEMBER 2000 d. The latch mechanism housing and rod travel housing are each a single length of forged Type 304 stainless steel. This material exhibits excellent notch toughness at all temperatures which will be encountered. A significant margin of strength in the elastic range together with the large energy absorption capability in the plastic range gives additional assurance that gross failure of the housing will not occur. The joints between the latch mechanism housing and head adapter, and between the latch mechanism housing and rod travel housing, are threaded joints reinforced by canopy type welds. Administrative regulations require periodic inspections of these (and other) welds. Nuclear Design Even if a rupture of a RCCA drive mechanism housing is postulated, the operation of a plant utilizing chemical shim is such that the severity of an ejected RCCA is inherently limited. In general, the reactor is operated with the RCCAs inserted only far enough to permit load follow. Reactivity changes caused by core depletion and xenon transients are compensated by boron changes. Further, the location and grouping of control RCCA banks are selected during the nuclear design to lessen the severity of a RCCA ejection accident. Therefore, should a RCCA be ejected from its normal position during full power operation, only a minor reactivity excursion, at worst, could be expected to occur. However, it may be occasionally desirable to operate with larger than normal insertions. For this reason, a rod insertion limit is defined as a function of power level. Operation with the RCCAs above this limit guarantees adequate shutdown capability and acceptable power distribution. The position of all RCCAs is continuously indicated in the control room. An alarm will occur if a bank of RCCAs approaches its insertion limit or if one RCCA deviates from its bank. Operating instructions may require boration, as necessary, at the low level alarm. The low-low alarm alerts the operator to stop diluting if in progress, and verify Shutdown Margin is within the limits specified in the COLR or initiate boration to restore Shutdown Margin to within limit. Reactor Protection The reactor protection in the event of a rod ejection accident has been described in Reference 5. The protection for this accident is provided by high neutron flux trip (high and low setting) and high positive rate neutron flux trip. These protection functions are described in detail in Section 7.2.

B/B-UFSAR 15.4-33a REVISION 8 - DECEMBER 2000 Effects on Adjacent Housings Disregarding the remote possibility of the occurrence of a RCCA mechanism housing failure, investigations have shown that failure of a housing due to either longitudinal or circumferential cracking would not cause damage to adjacent housings. However, even if damage is postulated, it would not be expected to lead to B/B-UFSAR 15.4-34 REVISION 6 - DECEMBER 1996 a more severe transient since RCCAs are inserted in the core in symmetric patterns, and control rods immediately adjacent to worst ejected rods are not in the core when the reactor is critical. Damage to an adjacent housing could, at worst, cause that RCCA not to fall on receiving a trip signal; however, this is already taken into account in the analysis by assuming a stuck rod adjacent to the ejected rod. 15.4.8.1.2 Limiting Criteria This event is classified as an ANS Condition IV incident. See Subsection 15.0.1 for a discussion of ANS classifications. Due to the extremely low probability of a RCCA ejection accident, some fuel damage could be considered an acceptable consequence. Comprehensive studies of the threshold of fuel failure and of the threshold or significant conversion of the fuel thermal energy to mechanical energy, have been carried out as part of the SPERT project by the Idaho Nuclear Corporation (Reference 6). Extensive tests of UO2 zirconium clad fuel rods representative of those in pressurized water reactor type cores have demonstrated failure thresholds in the range of 240 to 257 cal/gm. However, other rods of a slightly different design have exhibited failures as low as 225 cal/gm. These results differ significantly from the TREAT (Reference 7) results, which indicated a failure threshold of 280 cal/gm. Limited results have indicated that this threshold decreases by about 10% with fuel burnup. The clad failure mechanism appears to be melting for zero burnup rods and brittle fracture for irradiated rods. Also important is the conversion ratio of thermal to mechanical energy. This ratio becomes marginally detectable above 300 cal/gm for unirradiated rods and 200 cal/gm for irradiated rods; catastrophic failure, (large fuel dispersal, large pressure rise) event for irradiated rods, did not occur below 300 cal/gm. In view of the above experimental results, criteria are applied to ensure that there is little or no possibility of fuel dispersal in the coolant, gross lattice distortion, or severe shock waves. These criteria are: a. Average fuel pellet enthalpy at the hot spot below 225 cal/gm for unirradiated fuel and 200 cal/gm for irradiated fuel. b. Peak reactor coolant pressure less than that which could cause stresses to exceed the faulted condition stress limits. c. Fuel melting will be limited to less than ten percent of the fuel volume at the hot spot even if the B/B-UFSAR 15.4-35 REVISION 6 - DECEMBER 1996 average fuel pellet enthalpy is below the limits of criterion 1 above. It should be noted that the FSAR included an additional criterion that the average clad temperature at the hot spot must remain below 2,700F. The elimination of this criterion as a basis for evaluating the RCCA ejection accident results is consistent with the revised Westinghouse acceptance criteria for this event (Reference 10). 15.4.8.2 Analysis of Effects and Consequences Method of Analysis The calculation of the RCCA ejection transient is performed in two stages, first an average core channel calculation and then a hot region calculation. The average core calculation is performed using spatial neutron kinetics methods to determine the average power generation with time including the various total core feedback effects, i.e., Doppler reactivity and moderator reactivity. Enthalpy and temperature transients in the hot spot are then determined by multiplying the average core energy generation by the hot channel factor and performing a fuel rod transient heat transfer calculation. The power distribution calculated without feedback is pessimistically assumed to persist throughout the transient. A detailed discussion of the method of analysis can be found in Reference 5. Average Core Analysis The spatial kinetics computer code, TWINKLE (Reference 1), is used for the average core transient analysis. This code solves the two group neutron diffusion theory kinetic equation in one, two or three spatial dimensions (rectangular coordinates) for six delayed neutron groups and, up to 2000 spatial points. The computer code includes a detailed multiregion, transient fuel-clad-coolant heat transfer model for calculation of pointwise Doppler and moderator feedback effects. In this analysis, the code is used as a one dimensional axial kinetics code since it allows a more realistic representation of the spatial effects of axial moderator feedback and RCCA movement. However, since the radial dimension is missing, it is still necessary to employ very conservative methods (described in the following) of calculating the ejected rod worth and hot channel factor. Further description of TWINKLE appears in Subsection 15.0.11. Hot Spot Analysis In the hot spot analysis, the initial heat flux is equal to the nominal times the design hot channel factor. During the transient, the heat flux hot channel factor is linearly increased B/B-UFSAR 15.4-35a REVISION 6 - DECEMBER 1996 to the transient value in 0.1 second, the time for full ejection of the rod. Therefore, the assumption is made that the hot spots before and after ejection are coincident. This is very conservative since the peak after ejection will occur in or adjacent to the assembly with the ejected rod, and prior to ejection the power in this region will necessarily be depressed.

B/B-UFSAR 15.4-36 The hot spot analysis is performed using the detailed fuel-and cladding transient heat transfer computer code, FACTRAN (Reference 2). This computer code calculates the transient temperature distribution in a cross section of a metal clad UO2 fuel rod, and the heat flux at the surface of the rod, using as input the nuclear power versus time and the local coolant conditions. The zirconium-water reaction is explicitly represented, and all material properties are represented as functions of temperature. A conservative pellet radial power distribution is used within the fuel rod. FACTRAN uses the Dittus-Boelter or Jens-Lottes correlation to determine the film heat transfer before DNB, and the Bishop-Sandburg-Tong correlation (Reference 8) to determine the film boiling coefficient after DNB. The BST correlation is conservatively used assuming zero bulk fluid quality. The DNB ratio is not calculated, instead the code is forced into DNB by specifying a conservative DNB heat flux. The gap heat transfer coefficient can be calculated by the code; however, it is adjusted in order to force the full power steady-state temperature distribution to agree with the fuel heat transfer design codes. Further description of FACTRAN appears in Subsection 15.0.11. System Overpressure Analysis Because safety limits for fuel damage specified earlier are not exceeded, there is little likelihood of fuel dispersal into the coolant. The pressure surge may therefore be calculated on the basis of conventional heat transfer from the fuel and prompt heat generation in the coolant. The pressure surge is calculated by first performing the fuel heat transfer calculation to determine the average and hot spot heat flux versus time. Using this heat flux data, a THINC (Section 4.4) calculation is conducted to determine the volume surge. Finally, the volume surge is simulated in a plant transient computer code. This code calculates the pressure transient taking into account fluid transport in the reactor coolant system and heat transfer to the steam generators. No credit is taken for the possible pressure reduction caused by the assumed failure of the control rod pressure housing. 15.4.8.2.1 Calculation of Basic Parameters Input parameters for the analysis are conservatively selected on the basis of values calculated for this type of core. The more important parameters are discussed below. Table 15.4-3 presents the parameters used in this analysis. Ejected Rod Worths and Hot Channel Factors The values for ejected rod worths and hot channel factors are calculated using either three dimensional static methods or by a B/B-UFSAR 15.4-37 REVISION 1 - DECEMBER 1989 synthesis method employing one dimensional and two dimensional calculations. Standard nuclear design codes are used in the analysis. No credit is taken for the flux flattening effects of reactivity feedback. The calculation is performed for the maximum allowed bank insertion at a given power level, as determined by the rod insertion limits. Adverse xenon distributions are considered in the calculation. Appropriate margins are added to the ejected rod worth and hot channel factors to account for any calculational uncertainties, including an allowance for nuclear power peaking due to densification. Power distributions before and after ejection for a "worst case" can be found in Reference 5. During plant startup physics testing, ejected rod worths and power distributions are measured in the zero and full power rodded configurations and compared to values used in the analysis. It has been found that the ejected rod worth and power peaking factors are consistently overpredicted in the analysis. Reactivity Feedback Weighting Factors The largest temperature rises, and hence the largest reactivity feedbacks occur in channels where the power is higher than average. Since the weight of a region is dependent on flux, these regions have high weights. This means that the reactivity feedback is larger than that indicated by a simple channel analysis. Physics calculations have been carried out for temperature changes with a flat temperature distribution, and with a large number of axial and radial temperature distributions. Reactivity changes were compared and effective weighting factors determined. These weighting factors take the form of multipliers which when applied to single channel feedbacks correct them to effective whole core feedbacks for the appropriate flux shape. In this analysis, since a one dimensional (axial) spatial kinetics method is employed, axial weighting is not necessary if the initial condition is made to match the ejected rod configuration. In addition, no weighting is applied to the moderator feedback. A conservative radial weighting factor is applied to the transient fuel temperature to obtain an effective fuel temperature as a function of time accounting for the missing spatial dimension. These weighting factors have also been shown to be conservative compared to three dimensional analysis (Reference 5). Moderator and Doppler Coefficient The critical boron concentrations at the beginning of life and end of life are adjusted in the nuclear code in order to obtain moderator density coefficient curves which are conservative compared to actual design conditions for the plant. As discussed above, no weighting factor is applied to these results.

B/B-UFSAR 15.4-38 REVISION 6 - DECEMBER 1996 The Doppler reactivity defect is determined as function of power level using a one dimensional steady-state computer code with a Doppler weighting factor of 1.0. The Doppler defect used is 0.965% for the BOL cases and 0.893% for the EOL cases. The Doppler weighting factor will increase under accident conditions, as discussed above. Delayed Neutron Fraction, Calculations of the effective delayed neutron fraction (eff) typically yield values no less than 0.70% at beginning of life and 0.50% at end of life for the first cycle. The accident is sensitive to if the ejected rod worth is equal to or greater than as in zero power transients. In order to allow for future cycles, pessimistic estimates of of 0.55% at beginning of cycle and 0.44% at end of cycle were used in the analysis. Trip Reactivity Insertion The trip reactivity insertion assumed is given in Table 15.4-3 and includes the effect of one stuck RCCA. These values are reduced by the ejected rod reactivity. The shutdown reactivity was simulated by dropping a rod of the required worth into the core. The start of rod motion occurred 0.5 seconds after the high neutron flux trip point was reached. This delay is assumed to consist of 0.2 seconds for the instrument channel to produce a signal, 0.15 seconds for the trip breaker to open and 0.15 seconds for the coil to release the rods. A curve of trip rod insertion versus time was used which assumed that insertion to the dashpot does not occur until 2.7 seconds after the start of fall. The choice of such a conservative insertion rate means that there is over one second after the trip point is reached before significant shutdown reactivity is inserted into the core. This is a particularly important conservatism for hot full power accidents. The minimum design shutdown available for this plant at HZP may be reached only at end of life in the equilibrium cycle. This value includes an allowance for the worst stuck rod, adverse xenon distribution conservative Doppler and moderator defects, and an allowance for calculational uncertainties. Physics calculations for this plant have shown that the effect of two stuck RCCAs (one of which is the worst ejected rod) is to reduce the shutdown by about an additional one percent k. Therefore, following a reactor trip resulting from an RCCA ejection accident, the reactor will be subcritical when the core returns to HZP. Depressurization calculations have been performed for a typical four-loop plant assuming the maximum possible size break (2.75 inch diameter) located in the reactor pressure vessel head. The results show a rapid pressure drop and a decrease in system water mass due to the break. The safety injection system is actuated by the low pressurizer pressure trip within one minute after the break. The reactor coolant pressure continues to drop and B/B-UFSAR 15.4-39 REVISION 9 - DECEMBER 2002 reaches saturation (1100 to 1300 psi depending on the system temperature) in about two to three minutes. Due to the large thermal inertia of primary and secondary system, there has been no significant decrease in the reactor coolant system temperature below no-load by this time, and the depressurization itself has caused an increase in shutdown margin by about 0.2% k due to the pressure coefficient. The cooldown transient could not absorb the available shutdown margin until more than ten minutes after the break. The addition of high borated (2300 ppm) safety injection flow starting one minute after the break is much more than sufficient to ensure that the core remains subcritical during the cooldown. Reactor Protection As discussed in Subsection 15.4.8.1.1, reactor protection for a rod ejection is provided by high neutron flux trip (high and low setting) and high positive rate neutron flux trip. These protection functions are part of the reactor trip system. No single failure of the reactor trip system will negate the protection functions required for the rod ejection accident, or adversely affect the consequences of the accident. 15.4.8.2.2 Results Cases are presented for both beginning and end of life at zero and full power. 1. Beginning of Cycle, Full Power Control bank D was assumed to be inserted to its insertion limit. The worst ejected rod worth and hot channel factor were conservatively calculated to be 0.2% k and 6.10, respectively. The peak hot spot clad average temperature was 2434F. The peak hot spot fuel center temperature reached melting, conservatively assumed at 4900F. However, melting was restricted to less than 10% of the pellet. 2. Beginning-of-Cycle, Zero Power For this condition, control bank D was assumed to be fully inserted and banks B and C were at their insertion limits. The worst ejected rod is located in control bank D and has a worth of 0.765% k and a hot channel factor of 11.5. The peak hot spot clad average temperature reached 2348F, the fuel center temperature was 3616F. 3. End of Cycle, Full Power Control bank D was assumed to be inserted to its insertion limit. The ejected rod worth and hot B/B-UFSAR 15.4-40 REVISION 9 - DECEMBER 2002 channel factors were conservatively calculated to be 0.25% k and 6.40, respectively. This resulted in a peak clad average temperature of 2235F. The peak hot spot fuel temperature reached melting conservatively assumed at 4800F. However, melting was restricted to less than 10% of the pellet. 4. End of Cycle, Zero Power The ejected rod worth and hot channel factor for this case were obtained assuming control bank D to be fully inserted and banks C and B at its insertion limit. The results were 0.8% k and 23.0, respectively. The peak clad average and fuel center temperatures were 2337 and 3479F. The Doppler weighting factor for this case is significantly higher than for the other cases due to the very large transient hot channel factor. A summary of the cases presented above is given in Table 15.4-3. The nuclear power and hot spot fuel and clad temperature transients for the worst cases are presented in Figures 15.4-18 through 15.4-21. (Beginning of life full power and end of life full power.) The calculated sequence of events for the worst case rod ejection accidents, as shown in Figures 15.4-18 through 15.4-21, is presented in Table 15.4-1. For all cases, reactor trip occurs very early in the transient, after which the nuclear power excursion is terminated. As discussed previously in Subsection 15.4.8.2.2, the reactor will remain subcritical following reactor trip. The ejection of an RCCA constitutes a break in the reactor coolant system, located in the reactor pressure vessel head. The effects and consequences of loss of coolant accidents are discussed in Subsection 15.6.5. Following the RCCA ejection, the operator would follow the same emergency instructions as for any other loss of coolant accident to recover from the event. Fission Product Release It is assumed that fission products are released from the gaps of all rods entering DNB. In all cases considered, less than 10% of the rods entered DNB based on a detailed three dimensional THINC analysis (Reference 5). Pressure Surge A detailed calculation of the pressure surge for an ejection worth of one dollar at beginning of life, hot full power, indicates that the peak pressure does not exceed that which would cause stress to exceed the faulted condition stress limits (Reference 5). Since the severity of the present analysis does B/B-UFSAR 15.4-41 REVISION 12 - DECEMBER 2008 not exceed the "worst case" analysis, the accident for this plant will not result in an excessive pressure rise or further damage to the reactor coolant system. Lattice Deformations A large temperature gradient will exist in the region of the hot spot. Since the fuel rods are free to move in the vertical direction, differential expansion between separate rods cannot produce distortion. However, the temperature gradients across individual rods may produce a differential expansion tending to bow the midpoint of the rods toward the hotter side of the rod. Calculations have indicated that this bowing would result in a negative reactivity effect at the hot spot since Westinghouse cores are under-moderated, and bowing will tend to increase the under-moderation at the hot spot. Since the 17 x 17 fuel design is also under-moderated, the same effect would be observed. In practice, no significant bowing is anticipated, since the structural rigidity of the core is more than sufficient to withstand the forces produced. Boiling in the hot spot region would produce a net flow away from that region. However, the heat from the fuel is released to the water relatively slowly, and it is considered inconceivable that cross flow will be sufficient to produce significant lattice forces. Even if massive and rapid boiling, sufficient to distort the lattice, is hypothetically postulated, the large void fraction in the hot spot region would produce a reduction in the total core moderator to fuel ratio, and a large reduction in this ratio at the hot spot. The net effect would therefore be a negative feedback. It can be concluded that no conceivable mechanism exists for a net positive feedback resulting from lattice deformation. In fact, a small negative feedback may result. The effect is conservatively ignored in the analysis. 15.4.8.3 Radiological Consequences of a Postulated Rod Ejection Accident (AST) The key inputs and assumptions used in the AST Control Rod Ejection Accident (CREA) radiological consequence analysis are summarized below and provided in Table 15.4-4. Two cases are considered when analyzing the radioactive release due to a CREA. Case 1: Containment Leakage For Case 1, the ejected control rod is assumed to breach the reactor pressure vessel (RPV), effectively causing the equivalent of a small break loss of coolant accident. In this case, all activity from damaged fuel that has been mixed with the primary coolant of the reactor coolant system (RCS) leaks directly to the containment volume. This flashed release is assumed to instantaneously and homogeneously mix with the containment atmosphere and subsequently be available for release to the environment via a containment leak rate limit, or La, conservatively assumed to be 0.2% per day for this accident analysis. In accordance with RG 1.183 guidance, the leak rate B/B-UFSAR 15.4-41a REVISION 12 - DECEMBER 2008 is reduced by 50% after 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months , based on the containment pressure decreasing over time. Case 2: Steam Generator PORV Release For Case 2, no breach of the RPV is assumed following the rod ejection. In this case, reactor coolant system (RCS) integrity is maintained and all activity from damaged fuel that has been mixed with the RCS leaks to the secondary side through the steam generator (SG) tubes at a conservative rate of 1.0 gpm total leakage. From here, activity is available for release to the environment by steaming of the SG power operated relief valves (PORVs). An average rate of release is assumed. In addition to the activity released from the primary to secondary coolant, iodine activity in the secondary coolant at the TS limit (i.e., 0.1 Ci/gm Dose Equivalent (DE) I-131) is also assumed to be released. Fuel Damage and Core Source Term For conservatism, the CREA core source terms are those associated with a DBA power level of 3658.3 MWth, which includes an additional 2% power over that of the full licensed power to account for uncertainty. For the radiological dose analysis, the sudden rod ejection and localized temperature spike associated with the CREA is assumed to damage of 10% of the core fuel rods. Only 2.5 % of the damaged core fuel rods release melted fuel activity (i.e., 0.25% of the total core melts). Therefore for both cases, the source term available for release is associated with this fraction of melted fuel and the fraction of core activity existing in the gap. The damaged fuel is assumed to have operated at a radial peaking factor of 1.7. Activity Release Fractions Release fractions and transport fractions conform to RG 1.183, Appendix H and Table 3. To conform with this regulatory guidance, 10% of the core inventory of iodine and noble gas is assumed to be in the fuel-clad gap. Additionally, Table 3 of Regulatory Guide 1.183 shows that 12% of the core cesium and rubidium should be assumed to be in the fuel-clad gap and should be released in its entirety from the damaged 10% of the total core. However, to account for fuel burnup in excess of the referenced assumptions, the cesium and rubidium release fraction is doubled. Although analyses have shown that isotopic activity fractions in the fuel-clad gap may in fact decrease when "burning" the fuel longer than the 54 GWd/MTU specified in Regulatory Guide 1.183, this 100% increase in the gap fractions is used as an accepted and conservative means of bounding all extended burnup phenomena. With regard to the fraction released from melted fuel, it is assumed that 90% of the core inventory of iodine and noble gas, and 76% of the core cesium and rubidium B/B-UFSAR 15.4-41b REVISION 12 - DECEMBER 2008 remain available for release due to melting (i.e., these are the remaining fractions of activity that are not in the fuel-clad gap). Again, in conformance with RG 1.183, it would be assumed that 100% of the noble gases, 25% of the iodines, and 50% of the cesium and rubidium (i.e., considered particulate/aerosol nuclides) released from the melted fuel would be available for release from containment. However, for this analysis the assumption of 25% of the iodines being available for release was increased to 50%. This was done to prevent a "double counting" of the iodine removal due to plate-out in containment, because this analysis credits Powers' Natural Deposition model for plateout, as opposed to the historically assumed 50% plateout. These activity release fractions are input to the RADTRAD code through the use of the Release Fractions and Timing (RFT) file. Airborne Activity Removal Mechanisms in Containment As discussed below only natural deposition, decay, and leakage are credited. Natural Deposition: The RADTRAD computer program, including the Powers' Natural Deposition algorithm based on NUREG/CR-6189, is used for modeling aerosol deposition in containment. No natural deposition is assumed for elemental or organic iodine. The RADTRAD lower bound level (i.e., 10 percent) of deposition credit is used. Decay Credited: Decay of radioactivity is credited in all compartments, prior to release. This is implemented in RADTRAD using the half-lives in the Nuclide Inventory File (NIF). The RADTRAD decay plus daughter option is used. In reality, daughter products such as xenon from iodines or iodines from tellurium are unlikely to readily escape from the matrix in which the parent iodine or tellurium is contained. Nevertheless, the RADTRAD feature to include daughter effects is selected for conservatism. Steaming Release Rates and Partition Factors: Activity that originates in the RCS is released to the secondary coolant by means of the primary-to-secondary coolant leak rate. This assumed leak rate value is a total of 1.0 gpm. For input into RADTRAD, this rate is converted from gallons per minute to cubic feet per minute, making it equal to 0.1337 cfm. For Case 2, the release to the environment is associated with the secondary coolant steaming from the SGs. Because of this release dynamic, RG 1.183 allows for a reduction in the amount of activity released to the environment based on partitioning of nuclides between the liquid and gas states of water. For iodine, the partition factor of 0.01 was taken directly from the suggested guidance. However, there is no explicit guidance with B/B-UFSAR 15.4-41c REVISION 12 - DECEMBER 2008 regard to other particulate nuclides. Reviewing the specified AST release fractions, it is concluded that the only nuclides other than iodines to be released from the core source term are cesiums, rubidium, and noble gases. For cesiums and rubidium, a partition factor of 0.0055 is used which bounds the value of 0.00529 shown in ANSI Standard, ANS/ANSI 18.1 - 1999, for Cs-134 which has the largest partition factor of these isotopes. Because of their volatility, 100% of the noble gases are assumed to be released. The methodology used to model steaming of activity through PORVs following the postulated CREA event of Case 2 assumes an average cumulative release rate through the SG PORVs that, for simplicity and conservatism, is reduced in steps. The partition factors discussed above are applied to these release rates, which were derived from the total time increment mass releases. The following table shows the time steps, isotopic partition factors, and associated release rates; conversion of this data from mass to volumetric flow rates was performed based on cooled liquid conditions (i.e., 62.4 lbm/ft3), as specified by RG 1.183. CREA Partition Factors and Release Rates Time Interval (hrs) Total Steam Mass Release (lbm) Iodine Partition Factor Cesium Partition Factor Noble Gas Partition Factor Steam Release Rate for Iodines (cfm) Steam Release Rate for Cesiums (cfm) Steam Release Rate for Noble Gases (cfm) 0 - 0.0556 600,000 0.01 0.0055 1 2.8833E+01 1.5858E+01 2.8833E+03 0.0556 - 1.1111 1,900,000 0.01 0.0055 1 4.8055E+00 2.6430E+00 4.8055E+02 1.1111 - 720 0 0.01 0.0055 1 0 0 0 /Q Calculations (Meteorology) Releases from the SG PORVs are considered elevated releases due to the high steaming rates, and the associated /Qs have been reduced by a factor of five per guidance in RG 1.194 for energetic releases from steam relief valves, if (1) the release point is uncapped and vertically oriented, and (2) the time-dependent vertical velocity exceeds the 95th-percentile wind speed, at the release point height. Byron Station and Braidwood Station meet these criteria.

B/B-UFSAR 15.4-41d REVISION 12 - DECEMBER 2008 Assumptions and Inputs The following inputs and assumptions were used in the CREA analysis. a. Core inventory was based on a DBA power level of 3658.3 MWth, which is 102% of the RTP level of 3586.6 MWth, to account for measurement uncertainty. b. 10% of the fuel is damaged during the initiation of this accident, and is assumed to have failed. c. The damaged fuel is assumed to have operated at a radial peaking factor of 1.7. d. 10% of the core inventory of noble gases and iodines are released from the fuel gap (RG 1.183, Appendix H). Release fractions of other nuclide groups contained in the fuel gap are detailed in Table 3 of RG 1.183, and to account for gap fraction uncertainty. Due to fuel burnup, fractions from the referenced table are doubled. e. 2.5% of the damaged fuel rods will experience melting during the CREA. f. 100% of noble gases and 50% of the iodines contained in the melted fuel fraction are assumed to be released to the reactor coolant in accordance with Appendix H of RG 1.183. Fractions of other nuclides released from the melted fuel are used from Table 2 of RG 1.183. Though these are described as LOCA values for fuel melt release, they are conservatively used for the other nuclide groups. g. The activity released from the fuel from either the gap or from fuel pellets is assumed to be instantaneously mixed with the reactor coolant within the pressure vessel. h. All iodine released from the SGs is assumed to be of the elemental species. This is done for RADTRAD simulation considerations, and is consistent with the RG 1.183 specification of 97% elemental and 3% organic, because elemental and organic iodine are identically treated by the computer model. i. The CR ventilation system is assumed to realign to the emergency mode of operation 30 minutes after the initiation of this design basis accident. j. For the containment leakage case, all leakage is assumed to be at an La of 0.2% per day for the first 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months and 0.1% per day thereafter.

B/B-UFSAR 15.4-41e REVISION 13 - DECEMBER 2010 Dose Results Radiological doses resulting from a design basis CREA for a CR operator and a person located at the EAB or LPZ are to be less than the regulatory dose limits as given in the Table below. Regulatory Dose Limits - CREA Dose Type Control Room (rem) EAB and LPZ (rem)TEDE Dose 5a 6.3b Notes: a 10 CFR 50.67 b 10 CFR 50.67 as modified by Regulatory Guide 1.183 (Table 6, Page 1.183-20) The table below provides the results from the simulations modeled using the RADTRAD code. Control Rod Ejection Accident Radiological Analysis Results (Maximum of Either Byron or Braidwood) Case 1: Containment Leakage CREA RADTRAD Dose Assessment Results Control Room (rem TEDE) EAB (rem TEDE) LPZ (rem TEDE) 4.538 4.647 1.983 Case 2: Steam Generator PORV Release CREA RADTRAD Dose Assessment Results Control Room (rem TEDE) EAB (rem TEDE) LPZ (rem TEDE) 0.424 1.480 0.257 For the cases analyzed in this calculation, it is shown that a Case 1 CREA that breaches the RPV, and causes a containment release, would be the bounding CREA scenario. All doses are below the Regulatory Dose Limits, so it is verified that this design basis Control Rod Ejection Accident is sufficiently mitigated at both Byron and Braidwood Stations.

B/B-UFSAR 15.4-42 REVISION 12 - DECEMBER 2008 THIS PAGE WAS INTENTIONALLY DELETED B/B-UFSAR 15.4-43 REVISION 12 - DECEMBER 2008 THIS PAGE WAS INTENTIONALLY DELETED B/B-UFSAR 15.4-44 REVISION 12 - DECEMBER 2008 15.4.8.4 Conclusions Conservative analyses indicate that the described fuel and cladding limits are not exceeded. It is concluded that there is no danger of sudden fuel dispersal into the coolant. Since the peak pressure does not exceed that which would cause stresses to exceed the faulted condition stress limits, it is concluded that there is no danger of further consequential damage to the reactor coolant system. The analyses have demonstrated that the number of fuel rods entering DNB is limited to less than 10% of the fuel rods in the core. The radiological consequences of this event, based on 10% of the fuel rods being damaged, are well within the dose limits of 10 CFR Part 50.67. 15.4.9 References 1. Risher, D. H., Jr. and Barry, R. F., "TWINKLE - A Multi-Dimensional Neutron Kinetics Computer Code," WCAP-7979-A (Proprietary) and WCAP-8028-A (Non-Proprietary), January 1975. 2. Hargrove, H. G., "FACTRAN - A Fortran-IV Code for Thermal Transients in a UO2 Fuel Rod," WCAP-7908-A, December 1989. 3. Burnett, T. W. T., et al., "LOFTRAN Code Description," WCAP-7907-P-A (Proprietary), WCAP-7907-A (Non-Proprietary), April 1984. 4. NUREG-0800, Standard Review Plan Section 15.4.8, Appendix A, "Radiological Consequences of a Control Rod Ejection Accident (PWR)," Revision 1, July 1981.

B/B-UFSAR 15.4-45 REVISION 10 - DECEMBER 2004 5. Risher, D. H., Jr., "An Evaluation of the Rod Ejection Accident in Westinghouse Pressurized Water Reactors Using Spatial Kinetics Methods," WCAP-7588, Revision 1-A, January 1975. 6. Taxelius, T. G. (Ed), "Annual Report - SPERT Project, October 1968, September 1969," Idaho Nuclear Corporation IN-1370, June 1970. 7. Liimataninen, R. C. and Testa, F. J., "Studies in TREAT of Zircaloy-2-Clad, UO2-Core Simulated Fuel Elements" ANL-7225, January - June 1966, p. 177, November 1966. 8. Bishop, A. A., Sandberg, R. O., and Tong, L. S., "Forced Convection Heat Transfer at High Pressure After the Critical Heat Flux," ASME 65-HT-31, August 1965. 9. Hassler, R. L., et al, "Methodology for the Analysis of the Dropped Rod Event," WCAP-11394 (Proprietary) and WCAP-11395 (Non-Proprietary), April 1987. 10. Letter from W. J. Johnson of Westinghouse to R. C. Jones of the NRC, "Use of 2700F PCT Acceptance Limit in Non-LOCA Accidents," NS-NRC-89-3466, October 1989. 11. Friedland, A.J., and Ray, S., "Revised Thermal Design Procedure," WCAP-11397-P-A (Proprietary), WCAP-11397-A (Non-Proprietary), April 1989. 12. NRC Information Notice 94-60, "Potential Overpressurization of the Main Steam System," August 22, 1994.

B/B-UFSAR 15.4-46 REVISION 9 - DECEMBER 2002 TABLE 15.4-1 TIME SEQUENCE OF EVENTS FOR INCIDENT WHICH CAUSE REACTIVITY AND P OWER DISTRIBUTION ANOMALIES

TIME ACCIDENT EVENT (sec.) Uncontrolled Rod Initiation of uncontrolled 0.0 Cluster Control rod wi thdrawal from 10

-9 of Assembly Bank nominal power Withdrawal from a Subcritical or Low Power Startup Condition

1 Power range high neutron flux low setpoint reached 11.1 2 Peak nuclear power occurs 11.3 3 Rod begin to fall into core 11.6

4 Peak heat flux occurs 13.6

5 Minimum DNBR occurs 13.6

6 Peak average clad temperature occurs 13.9 7 Peak average fuel temperature occurs 14.0

Uncontrolled RCCA bank withdrawal at power

1. Case A Initiation of uncontrolled RCCA 0 withdrawal at a high reactivity insertion rate (50 pcm/sec)

Power range high neutron flux 2.3 high trip point reached

Rods begin to fall into core 2.8 Minimum DNBR occurs 3.8 B/B-UFSAR 15.4-47 REVISION 9 - DECEMBER 2002 TABLE 15.4-1 (Cont'd)

2. Case B Initiation of uncontrolled RCCA 0 withdrawal at a small reactivity insertion rate (0.3 pcm/sec)

Overtemperature T trip signal 81.7 initiated

Rods begin to fall into core 89.7 Minimum DNBR occurs 90.1 Rod Cluster Control Assembly Ejection

1. Beginning-of- Initiation of rod ejection 0.0 Life, Full Power Power range high neutron flux 0.05 setpoint reached Peak nuclear power occurs 0.13 Rods begin to fall into core 0.55 Peak fuel average temperature 2.28 occurs

Peak clad temperature occurs 2.38 Peak heat flux occurs 2.39

B/B-UFSAR 15.4-48 REVISION 9 - DECEMBER 2002 TABLE 15.4-1 (Cont'd)

2. End-of-Life, Initiation of rod ejection 0.0 Full Power Power range high neutron flux 0.04 setpoint reached

Peak nuclear power occurs 0.13

Rods begin to fall into core 0.54 Peak fuel average temperature 2.31 occurs Peak clad temperature occurs 2.40

Peak heat flux occurs 2.41

B/B-UFSAR 15.4-49

Table 15.4-2 has been deleted.

B/B-UFSAR

15.4-50

REVISION 9 - DECEMBER 2002 TABLE 15.4-3 PARAMETERS USED IN T HE ANALYSIS OF THE R OD CLUSTER CONTROL ASSEMBLY EJECTION ACCIDENT

BOL-HFP BOL-HZP EOL-HFP EOL-HZP TIME IN LIFE BEGINNING BEGINNING END END Power Level, % 102 0 102 0

Ejected rod worth,%WK 0.2 0.765 0.25 0.8 Delayed neutron fraction, % 0.55 0.55 0.44 0.44

Feedback reactivity weighting 1.30 2.07 1.30 3.55 Trip reactivity,%WK 4.0 2.0 4.0 2.0 F q before rod ejection 2.60 2.60

F q after rod ejection 6.10 11.5 6.40 23.0

Number of operational pumps 4 2 4 2

B/B-UFSAR

15.4-51

REVISION 9

- DECEMBER 2002 TABLE 15.4-3 (Cont'd)

BOL-HFP BOL-HZP EOL-HFP EOL-HZP TIME IN LIFE BEGINNING BEGINNING END END Max. fuel pellet average 4128 3123 4044 3056 temperature, °F Max. fuel center temperature, °F >4900 3616

>4800 3479 Max. clad average temperature, °F 2434 2348 2369 2337 Max. fuel store energy, cal/gm 181 130 177 127 % Fuel Melt <10% 0 <10% 0

B/B-UFSAR 15.4-52 REVISION 12

- DECEMBER 2008 TABLE 15.4-4 INPUT PARAMETERS FOR THE CREA RADIOLOGICAL CONSEQUENCES ANALYSIS USING AST Parameter Unit Value Notes Portion of Core Fuel Rods Experiencing Cladding Damage

% 10 Bounds value pre dicted by safety analysis. The acceptance criteria for fuel melting is a maximum of 10%.

Melted fuel

% of core 0.25 Based on 50% of the rods that violate the DNB limit having melting in the inner 10% over 50%

of the axial length. Gap Activity Alkali Metals

% 0.24 As a significant number of fuel assemblies not qualifying for AST due to their containing fuel rods with maximum linear heat generation rates exceeding 6.3 kilowa tts per foot peak rod average power for burnups exceeding 54 GWD/MTU , the fuel will be treated as having gap fractions a factor of 2 greater than the RG 1.183 values. Fraction of activity released to containment: From gap inventory Iodine Noble Gases From melted fuel Iodine Noble gas Iodine plateout onto containment surfaces

- - - - - 1.0 1.0 0.5 1.0 0.5 Iodine Chemical Species in Containment: Aerosol Elemental Organic Iodine Chemical Species in Release from SG to Environment: Elemental Organic % % % % % 95 4.85 0.15 97 3 .

B/B-UFSAR 15.4-53 REVISION 12 - DECEMBER 2008 TABLE 15.4-4 (Cont'd)

INPUT PARAMETERS FOR THE CREA RADIOLOGICAL CONSEQUENCES ANALYSIS USING AST Parameter Unit Value Notes Iodine Removal Coefficients in Containment N/A See Notes Typically, no credit is taken for continuing iodine removal in the containment for the rod ejection accident, however under provisions allowed by the AST g overning RG 1.183, Power's model for particulate deposition removal m ay be credited, if 50% plateout is not credited.

Containment Leak Rate:

0-24 Hours

> 24 Hours weight %/day 0.20 0.10 The design basis containment leak rate at 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months is consistent with guidance of RG 1.183.

Fraction of activity released to primary coolant (for primary to secondary leakage pathway): From gap inventory Iodine Noble Gases From melted fuel Iodine Noble gas

- - - - 1.0 1.0 0.5 1.0 Iodine Chemical Species in Primary Coolant: Elemental Organic Particulate

% % %

100 0 0 Steam Released to Environment: 0 - 200 sec 200 - 4000 sec lb/sec lb/sec 3000 500 Bounds release predi cted by small break LOCA analysis.

Chemical form of radioiodine released to the containment atmosphere:

Cesium iodine Elemental iodine Organic iodide

% % % 95 4.85 0.15 B/B-UFSAR 15.4-54 REVISION 9 - DECEMBER 2002 TABLE 15.4-4 (Cont'd)

ASSUMPTIONS USED FOR THE ROD CLUSTER CONTROL ASSEMBL Y EJECTION ACCIDENT

THIS PAGE HAS BEEN INTENTIALLY DELETED

B/B-UFSAR

15.

4-55 REVISION 9 -

DECEMBER 2002 TABLE 15.4-5

This table has been intentionally deleted.

B/B-UFSAR 15.5-1 REVISION 7 - DECEMBER 1998 15.5 INCREASE IN REAC TOR COOLANT INVENTORY Discussion and a nalysis of the f ollowing events is presented in this section:

a. inadvertent operation of emergency c ore cooling system during po wer operation, b. chemical and volume cont rol system mal function that increases reactor coolant inventory, and

c. a number of BWR transien ts (not applicable to the Byron/Braidwood Stations).

These events, consider ed to be ANS Condi tion II, cause an increase in reactor coolant inve ntory. Subsection 15.0.1 contains a discussion of ANS classifications.

15.5.1 Inadvertent Operation of Emergency Core Cooling System During Power Operation 15.5.1.1 Identification of Caus es and Accident Description Inadvertent operation of the emergency core co oling system (ECCS) at power could be caused by oper ator error, test sequence error, or a false electrical actuation signal. A s purious signal initiated after the logic circui try in one solid-state protection system train for any of the following engine ered safety feature (ESF) functions could ca use this incident by actuating the ESF equipment associated w ith the affected train.

a. High containment pressure, b. Low pressurizer pressure, or

c. Low steamline pressure.

Following the actuat ion signal, the suct ion of the coolant charging pumps diverts from the volume c ontrol tank to the refueling water storage tank. Simultane ously, the valves isolating the chargi ng pumps from th e injection header automatically open and t he normal charging l ine isolation valves close. The charging p umps force the bor ated water from the refueling water storage tank (RWST) through the pump discharge header, the injection line, and into the cold leg of each loop.

The passive accumulator tank safety injection and low head system are available. However, they do not provide flow when the reactor coolant system (RCS) is at n ormal pressure.

A safety injection (SI) signal normally results in a direct reactor trip and a tur bine trip. However, any single fault that actuates the ECCS wi ll not necessarily p roduce a reactor trip.

B/B-UFSAR 15.5-2 REVISION 9 - DECEMBER 2002 If an SI signal generates a re actor trip, the operator should determine if the signal is spu rious. If the SI signal is determined to be spurious, the operator should t erminate SI and maintain the plant in the hot-standby condition as determined by appropriate recovery pro cedures. If repair of the ESF actuation system instrumentation is necessary, future plant operation will be in accordance with the Tech nical Specificatio ns. If the SI results in discharge of coolant through the pressurizer safety relief valves, the operators will bring the plant to cold shutdown in order to inspect the valves.

If the reactor p rotection system does not produce an immediate trip as a result of the spurious SI si gnal, the reactor experiences a negative r eactivity excursion due to the injected boron, which causes a decrease in reactor power. The power mismatch causes a drop in Tavg and consequent c oolant shrinkage.

The pressurizer pressu re and water level decrease. Load decreases due to the effect of reduced steam p ressure on load after the turbine throttle valve is fully open.

If automatic rod control is used, these effects will lessen u ntil the rods have moved out of the core. The tran sient is eventually terminated by the reactor protection s ystem low pressurizer pressure trip or by manual trip.

The time to trip is affected by initial operating conditions.

These initial conditions include the core burnup history which affects initial boron co ncentration, rate of change of boron concentration, and D oppler and moder ator coefficients.

15.5.1.2 Analysis of Ef fects and Consequences Method of Analysis Inadvertent operation of the ECCS is analyzed us ing the LOFTRAN computer code (Reference 1). The code simulates the neutron kinetics, RCS, pressuriz er, pressurizer relief a nd safety valves, pressurizer spray, the f eedwater system, the s team generator, and steam generator safety v alves. The code computes pertinent plant variables including temperatures, pressures, a nd power level.

Inadvertent operation of the ECCS at power is classified as a Condition II event, a fault of moderate freq uency. The criteria established for Condit ion II events in clude the following.

a. Pressure in the reactor coolant and main steam systems should be maintained below 110% of the design values, b. Fuel cladding integr ity shall be maintained by ensuring that the minimum departure from nucleate boiling ratio (DNBR) remains above the DNBR limit, derived at a 95% confidence le vel and 95% probability, and c. An incident of m oderate frequency sh ould not generate a more serious plant condition witho ut other faults occurring independently.

B/B-UFSAR 15.5-3 REVISION 9 - DECEMBER 2002 The inadvertent ECCs a ctuation at power even t is analyzed to determine the maximum RCS pressu re encountered t hroughout the accident. The most li miting case with respe ct to RCS pressure is an SI at Hot Full Power coincident with a reactor trip. Because of the pressure reduction from the reactor t rip, the SI flow is maximized. The SI flow refills the pr essurizer until the pressurizer is water solid, and the SI f low results in liquid discharge through the pressu rizer safety relief valves.

The performance of the p ressurizer safety re lief valve system and the loads on pressurizer safety relief valves, assoc iated piping, and supports as a re sult of liquid disch arge through the pressurizer safety relief valves, was determined to be acceptable (Reference 4 and 5).

If the pressuriz er safety relief valves do not resea t, then the transient will proceed a nd terminate as desc ribed in Section 15.6.1, "Inadvertent opening of Pressurizer Safety or Relief Valve." This event is also classified as an event of moderate frequency.

American Nuclear Society standard 51

.1/N18.2-1973 (Reference 2) describes example 15 of a condition II event as a "minor reactor coolant system leak wh ich would not prev ent orderly reactor shutdown and cooldown assuming makeup is pro vided by normal makeup systems only." In Reference 2, norma l makeup systems are defined as those systems normally used to main tain reactor coolant inventory under respective condition s of startup, hot standby, power operation, or cooldown, u sing onsite power. Since the cause of the water relief is the ECCS flow, the magnitude of the leak will be less than or equivalent to that of the ECCS (i.e., operation of the ECCS maintains RCS i nventory during the postulated event and establishes the magnitude of the subject leak). Therefore, the a bove example of a Co ndition II event is met. The inadvertent ECCS a ctuation at power even t is also analyzed to determine the minimum DNBR value.

B/B-UFSAR 15.5-4 REVISION 9 - DECEMBER 2002 The most limiting case is a mini mum reactivity feedb ack condition with the plant assumed to be in manual rod c ontrol. Because of the power and temperature redu ction during the transient, operating conditions do not approach the core limits.

The minimum DNBR was obtained at tim e zero for both units. The Unit 1 specific results are presente d here. How ever, they are representative of the results for both U nit 1 and Unit 2.

The analysis assumptions for the DNBR evaluation are as follows:

a. Initial Operating Conditions The event is analyzed with the revised t hermal design procedure as described in WCAP-11397-P-A (Reference 3). Initial reactor power, RCS pressure and temperature are assumed to be at the nominal full power values. Uncer tainties in initial conditions are included in the limit DNBR as described in Reference

3. b. Moderator and Doppler Coefficients of Reactivity The analysis assumes a z ero moderator temperature coefficient and a lo w absolute value Doppler power coefficient at beginni ng of life.

c. Reactor Control The reactor is assumed to be in manual rod control.

B/B-UFSAR 15.5-5 REVISION 10 - DECEMBER 2004

d. Pressurizer Pr essure Control Pressurizer heaters are assumed to be inoperable.

This assumption yields a higher rate of pressure decrease which is co nservative. Press urizer spray and PORVs are assumed available in order to minimize RCS pressure.

e. Boron Injection At the initiation of the event, two char ging pumps inject borated water into the cold l eg of each loop.

The analysis assumes zero injection line purge volume for calculational simpli city; thus, the boration transient begins immediately in the analysis. The positive displacement charging pump is assumed to be inoperable at event initiation.

f. Turbine Load The turbine load remains const ant until the governor drives the throttle valve wide open.

After the throttle valve is fu ll open, turbine load decreases as steam pressure drops. g. Reactor Trip Reactor trip is initiated by a low pressurizer pressure signal at 1860 psia.

h. Decay Heat The decay heat has no impact on the DNB case (i.e., minimum DNBR occurs prior to reactor trip). A conservative core residual heat generati on based upon long-term operation at the initial power level is assumed.

B/B-UFSAR 15.5-6 REVISION 11 - DECEMBER 2006

i. Operator Action Time Operator action is not r equired to m itigate the consequences of this eve nt. Operator action is assumed to occur after the event to stabilize the plant in accordance with appro ved procedures to bring the plant to the applicable condition.

j. Pressurizer Safety Valves

The safety valves setpoints do not impact the minimum DNBR since the PORVs are assumed available to maintain low RCS pressure; th is assumption is conservative with respect to DNBR.

k. Auxiliary Feedwater

Auxiliary feedwater was not credited.

l. Main Steam Safety Valves The main steam safety valves are assumed conservatively to op en at +5% above th eir nominal set pressure for the DNB case.

No credit for steam dump is assumed in this analysis.

Plant systems and equi pment credited for mit igating the effects of the accident are di scussed in Subsection 15

.0.8 and listed in Table 15.0-7. No sing le active failure in a ny of these systems or equipment will adversely affect the conse quences of the accident.

Results The transient response is shown in Fig ures 15.5-1 through 15.5-3.

Table 15.5-1 shows the calculated se quence of events.

Nuclear power starts decreasing immediat ely due to boron injection, but steam flow does not decre ase until later in the transient when the tur bine throttle valve is wide open. The mismatch between load and nuclear power causes T avg , pressurizer

B/B-UFSAR 15.5-7 REVISION 9 - DECEMBER 2002 water level, and pressurizer pre ssure to drop. The reactor trips and control rods start m oving into the core when the pressurizer pressure reaches the pressurizer low pressure trip setpoint. The DNBR increases throughout the transient.

15.5.1.3 Radiological Consequences There are only minimal radiological conseque nces associated with inadvertent ECCS operation. The reactor trip ca uses a turbine trip and heat is removed from the secondary system through the steam generator power re lief valves or safety valves. Since no fuel damage is postula ted to occur for this transient, the radiological consequences associ ated with an atmospheric steam release from this event would be less severe than the steamline break event analyzed in Subsection 15.1.5.3.

Water relief from the pressurizer PORVs and safe ties may result in overpressurization of the p ressurizer relief tank (PRT), breaching the rupture di sk and spilling contaminated fluid into containment. The ra diological releases (off site doses) resulting from breaking the PRT rupture di sk are limited by isolation of the containment.

15.5.1.4 Conclusions Results of the a nalysis show that spurio us ECCS operation at uprated power conditions without immediate rea ctor trip does not present any hazard to the integrity of t he core or t he RCS with respect to DNBR. The minimum DNBR is never le ss than the initial value. If the reactor does not trip imm ediately, the low pressurizer pressure rea ctor trip will provi de protection. This trips the turbine and prevents excess cooldown, which expedites recovery from the incident.

With respect to pres surizer filling, B/B-UFSAR 15.5-8 REVISION 9 - DECEMBER 2002 RCS pressure will stabilize we ll below the RCS pressure safety limit of 2735 psig. The perform ance of the pr essurizer safety relief valve system and the loads on pre ssurizer safety relief valves, associated pipin g, and supports will be with in acceptable limits. 15.5.2 Chemical and Volume Control Syst em Malfunction That Increases Reactor Coolant Inventory An increase in reactor coolant inventory whi ch results from the addition of cold, unborated water to the reactor coolant system is analyzed in Subsect ion 15.4.6, chemic al and volum e control system malfunction t hat results in a decrease in boron concentration in the reactor coo lant. An incr ease in reactor coolant inventory which results from the inj ection of highly borated water into the reactor coolant s ystem is analyzed in Subsection 15.5.1, i nadvertent operation eme rgency core cooling system during po wer operation.

15.5.3 A Number of BWR Transients (Not applicable to the Byron/Bra idwood Stations.)

15.5.4 References

1. Burnett, T. W. T., et al

., "LOFTRAN Co de Description," WCAP-7907-P-A (Proprie tary), WCAP-7907-A (Non-Proprietary), April, 1984.

2. ANS-51.1/Nl8.2-1973, "Nuclear Safety Cri teria for the Design of Stationary Pressurized Water Reactor Plants." 3. Freidland, A. J. and Ray, S., "Revised Thermal Design Procedure," WCAP-11397-P-A (Proprietary), WCAP-11397-A (Non-Proprietary) April 1989.

4. "Technical Evalu ation Report, TMI Acti on Plan - NUREG-0737 (II.D.1) Braidwood Unit 1 &

2. Docket No.

50-456, 50-457," G. K. Miller et.

al, Idaho N ational Engineering Laboratory, January 1988.

5. NRC Letter from Mr. Leonard N. Olshan to ComEd Henry E.

Bliss, dated August 18, 1988,

Subject:

N UREG-0737, Item II.D.1, Performance Testing on R elief and Safety Valves for Byron Station, Units 1 and 2 (TAC No

s. 56200 and 63240) transmitting Technical Evaluation Report (TER) providing the results of the N RC's review on B yron Units 1 and 2 response to NUREG-0737, Item II.D.1.

B/B-UFSAR 15.5-9 REVISION 9 - DECEMBER 2002 TABLE 15.5-1

TIME SEQUENCE OF EVENTS FOR INCREASE IN REACTOR COOLANT INVENTORY EVENTS

ACCIDENT EVENT TIME (sec.) Inadvertent Actuation of ECCS During Power Operation

Spurious SI signal generated; two charging pumps begin injecting borated water 0

Turbine throttle valve wide open, load begins to drop with steam pressure 49.5 Low pressurizer pressure reactor trip setpoint reached 76.1 Control Rod Motion Begins 78.1 Minimum DNBR occurs (*)

(*) - DNBR does not decrease below its initial value

B/B-UFSAR 15.7-16 REVISION 12 - DECEMBER 2008 TABLE 15.7-1

PARAMETERS USED IN W ASTE GAS DECAY T ANK RUPTURE ANALYSES

(using TID 14844)

REGULATORY GUIDE 1.24 ANALYSIS Fuel defects 1%

Primary Coolant

Activity Table 15.0-9 Time of accident Immediately after shutdown at end of equilibrium core cycle Meteorology See Tables 15.0-13 and 15.0-14

Nuclide data Table 15A-1

B/B-UFSAR 15.7-17 REVISION 12 - DECEMBER 2008 TABLE 15.7-2

WASTE GAS DECAY TANK INVENTORY (ONE UNIT)

(u sing TID 14844)

ISOTOPE (Ci)

Xe-131m 1.07 (+3) Xe-133 7.51 (+4)

Xe-133m 9.24 (+2)

Xe-135 1.06 (+3)

Xe-135m 7.71 (+1)

Xe-138 5.98 (+0)

Kr-85 5.24 (+3)

Kr-85m 1.75 (+2)

Kr-87 4.41 (+1)

Kr-88 2.22 (+2)

Note: 5.77(+3) = 5.77 x 10 3

B/B-UFSAR 15.7-18 REVISION 12 - DECEMBER 2008 TABLE 15.7-3 SPENT RESIN STORAGE TANK IVENTORY

(using TID 14844)

LIQUID TANK PHASE RADIO- INVENTORY INVENTORY NUCLIDE (curies) (curies) I-131 1.9 x 10 4 196 I-132 2.26 x10 2 2.26 I-133 2.47 x 10 3 24.7 I-134 2.66 x 10 1 0.27 I-135 5.06 x 10 2 5.06

B/B-UFSAR 15.7-19 REVISION 12 - DECEMBER 2008 TABLE 15.7-4

RECYCLE HOLDUP T ANK INVENTORY

(using TID 14844)

LIQUID VAPOR PHASE PHASE RADIO- INVENTORY INVENTORY NUCLIDE (Curies) (Curies) I-131 28.08 Neg.

I-132 37.05 Neg.

I-133 51.08 Neg.

I-134 9.2 Neg.

I-135 31.86 Neg.

Kr 1467

Kr-85m - 371

Kr 237

Kr 691 Xe-131m - 683

Xe-133 - 51780

Xe-133m - 753.0

Xe-135 - 1593

Xe-135m - 101 Xe-138 - 137

B/B-UFSAR 15.7-20 REVISION 9 - DECEMBER 2002 TABLE 15.7-5

This page has been i ntentionally deleted.

B/B-UFSAR 15.7-21 REVISION 12 - DECEMBER 2008 TABLE 15.7-6

BOUNDING ISOTOPIC CORE INVENTORY Isotope Activity (Ci) Isotope Activity (Ci) KR 83M 1.381E+07 XE131M 1.075E+06 BR 84 2.494E+07 TE132 1.365E+08 BR 85 3.047E+07 I132 1.386E+08 KR 85 1.023E+06 I133 1.984E+08 KR 85M 3.083E+07 XE133 1.936E+08 RB 86 2.325E+05 XE133M 6.103E+06 KR 87 6.085E+07 I134 2.204E+08 KR 88 8.583E+07 CS134 1.904E+07 RB 88 8.685E+07 I135 1.851E+08 SR 89 1.043E+08 XE135 5.497E+07 SR 90 8.044E+06 XE135M 3.821E+07 Y 90 8.423E+06 CS136 5.393E+06 SR 91 1.410E+08 CS137 1.104E+07 Y 91 1.275E+08 BA137M 1.047E+07 SR 92 1.484E+08 XE138 1.723E+08 Y 92 1.489E+08 CS138 1.885E+08 Y 93 1.659E+08 BA139 1.826E+08 ZR 95 1.636E+08 BA140 1.766E+08 NB 95 1.648E+08 LA140 1.807E+08 ZR 97 1.673E+08 LA141 1.667E+08 MO 99 1.815E+08 CE141 1.614E+08 TC 99M 1.589E+08 LA142 1.635E+08 RU103 1.469E+08 CE143 1.603E+08 RU105 1.004E+08 PR143 1.561E+08 RH105 9.156E+07 CE144 1.225E+08 RU106 4.978E+07 ND147 6.587E+07 SB127 1.022E+07 NP239 1.858E+09 TE127 1.009E+07 PU238 3.686E+05 TE127M 1.316E+06 PU239 2.762E+04 SB129 3.058E+07 PU240 3.219E+04 TE129 3.010E+07 PU241 1.273E+07 TE129M 4.482E+06 AM241 1.407E+04 I129 3.187E+00 CM242 3.984E+06 TE131M 1.377E+07 CM244 4.339E+05 I131 9.583E+07

B/B-UFSAR 15.7-22 REVISION 12 - DECEMBER 2008 TABLE 15.7-7

INPUT PARAMETERS FOR THE FHA R ADIOLOGICAL CONS EQUENCE ANALYSIS USING AST Parameter Unit Value Notes Gap Activity:

I-131 Kr-85 Other Noble Gases Other Halogens Alkali Metals

% % % % % 2 times the following:

0.08 0.10 0.05 0.05 0.12 As a significant number of fuel assemblies not qualifying f or AST due to their containing fuel rods with maximum linear heat generation rates exceeding 6.3 kilowatts per foot peak rod average power for burnups exceeding 54 GWD/MTU, the fuel will be treated as having gap f ractions a factor of 2 greater than the RG 1.183 values. Number of Asse mblies Damaged

1 264 rods are assumed to be damaged. This is one full assembly.

Pool Scrubbi ng Factor: Overall Elemental Organic (and Noble Gases)

- - - 200 500 1 Per RG 1.183, based on 23 feet of water coverage.

Release Path Fil ter Efficiency % 0 Filtration is not credited for AST analysis.

Duration of release hr 2 Chemical form of radioiodine released from the fuel to the spent fuel pool:

Cesium iodide Elemental iodine Organic iodine

% % % 95 4.85 0.15 Chemical form of radioiodine released from the pool to the building:

Elemental iodine Organic iodine

% % 57 43 Depth of Water above the Top of Reactor Vessel F lange and Fuel Assemblies in Spent Fuel Pool ft 23 B/B-UFSAR

15.7-23 REVISION 9 - DECEMBER 2002 TABLE 15.7-7 (Cont'd)

This page has been i ntentionally deleted.

B/B-UFSAR 15.7-24 REVISION 9 - DECEMBER 2002 TABLE 15.7-8

This page has been i ntentionally deleted.

B/B-UFSAR 15.8-1 REVISION 7 - DECEMBER 1998 15.8 ANTICIPATED TRANSIENTS WITHOUT SCRAM (ATWS)

An anticipated t ransient without scram (ATWS) is an anticipated operational occurrence (such as a loss of fe edwater, loss of condenser vacuum, or loss of offsite power) th at is accompanied by a failure of the re actor trip system to shut down the reactor.

A series of generic studies (Ref erences 1 and 2) on ATWS showed that acceptable conseq uences would resul t, provided that the turbine trips and that a uxiliary feedwater flow is initiated in a timely manner.

The effects of an ATWS a re not considered as part of the design basis for transients analyzed in Chapter 15. Ho wever, 10 CFR 50.62, "Requirements for Reduction of Risk from Anticipated Transients Without Scram (ATWS)

Events for Lig ht-Water-Cooled Nuclear Power Plants," the ATWS Rule, requires that each pressurized water reactor have e quipment that is diverse from the reactor trip system to automatically ini tiate the auxiliary feedwater system and initiate a turb ine trip under the conditions indicative of an ATWS.

In addition, compliance with the ATWS rule is demonstrated on a cycle-by-cycle basis by focusing on two aspects of WCAP-11992, "ATWS Rule Administrat ion," December 1988 methodology. These aspects are the unfavora ble exposure time (UET) and critical trajectory methodologies. T he critical traj ectories are calculated loci of p lant conditions (e.g., power vs. inlet temperature) that provide a pe ak pressure in the transient analysis of the limiting ATWS event, which is then compared to the specified limit (3200 psig). The UET is the time during the cycle when reactivity feedback is insuff icient to maintain pressure under 3200 psig for a given reactor state. Information for the trajectory and U ET calculations was de rived from the ATWS submittal and WCAP-11992.

In the application of the UET methodolog y, the ATWS transient point kinetics i nformation is transfer red into steady-state conditions for c omparison with cycle-spe cific core condition evaluation calculations, and t he critical trajectories are determined. During peak ATWS pr essure conditions, heatup is relatively slow so that steady-state analysis is acceptable. The methodology uses the " base case" conditions from the ATWS submittal, with 100-perc ent power-operated rel ief valve capacity, 100-percent auxiliary fe edwater, and no cont rol rod insertion.

The cycle-specific cal culations are done wit h appropriate ATWS initial conditions of full power, rods o ut, equilibrium xenon, and 3200 psig pressure.

These calculations are compared to the critical trajectory from the transie nt analysis. Th is comparison provides cycle-specific design conditions th at would result in transient conditions e xceeding 3200 psig.

These calculations

B/B-UFSAR 15.8-2 REVISION 7 - DECEMBER 1998 show any core design c onditions that would r esult in exceeding the 3200 psig pressure l imit. Calculations as a function of the time in cycle and, t hus, as a function of moderator temperature coefficient (MTC) show the time duri ng the cycle that the core design critical trajec tory is greater th an the transient trajectory. From this, the UET is determined.

The analysis must show that the UET, given the cycle design, will be less than five percent, or equivalently, that ATWS pressure limit will be met for at least 95 perc ent of the cycle. If the limit is not met, the core design would be changed until the 95-percent level is achieved.

This 95-percent probab ility level for the UET is equivalent to the probability level in the reference analyses for the ATWS rule basis. All parameters should be best estima te values with the exception of the MTC initial c ondition. That was to be at a level not to be exceed ed (i.e., not less negat ive) at full power conditions for at least 95 percent of the cycle.

15.

8.1 REFERENCES

1. Burnett, T. W. T., et al

., "Westinghouse Anticipated Transients Without T rip Analysis," WCAP-8330, August 1974.

2. Anderson, T. M., (Westinghou se) letter to S.

H. Hanauer (USNRC), "ATWS Submittal," N S-TMA-2182, December 1979.

ATTACHMENT 15A DOSE MODELS USED TO EVALUATE THE ENVIRONMENTAL CONSEQUENCES OF ACCIDENTS

B/B-UFSAR 15A-i REVISION 12 - DECEMBER 2008 TABLE OF CONTENTS PAGE 15A DOSE MODELS US ED TO EVALUATE THE ENVIRONMENTAL CONSEQUENCES OF ACCIDENTS 15A-1 15A.l INTRODUCTION 15A-1 15A.2 ASSUMPTIONS (TID-14844) 15A-1 15A.3 OFFSITE DOSE MODELS (TID-14844) 15A-1a 15A.4 CONTROL ROOM DOSE MODELS (TID-14844) 15A-1c 15A.5 REFERENCES 15A-2

B/B-UFSAR 15A-ii LIST OF TABLES NUMBER TITLE PAGE 15A-1 Physical Data for Isotopes 15A-4

B/B-UFSAR 15A-1 REVISION 12 - DECEMBER 2008 ATTACHMENT 15A DOSE MODELS USED TO EVAL UATE THE RADIOLOGICAL CONSEQUENCES OF ACCIDENTS

15A.1 INTRODUCTION This Attachment identi fies the models us ed to calculate the radiological doses t hat would result f rom releases of radioactivity due to var ious postulated accidents.

The major design basis accidents were analyzed using Alternative Source Term methodology using Regulatory Guide 1.183 with dose acceptance criteria per 10 CFR 50.67. T hese acciden ts include:

Loss of Coolant Accident (LOCA)

Main Steam L ine Break (MSLB)

Control Rod Ejection Accident (CREA)

Locked Rotor A ccident (LRA)

Steam Generator Tube Rupture (SGTR)

Fuel Handling Accident (FHA)

Conformance with Regulatory Guides 1.183 and 1

.194 are documented in Appendix A.

Other accidents and ev ents not listed ab ove (including doses related to equipment qualification) were ana lyzed using the TID-14844 methodology per Regulatory Gui de 1.4 with 10 CFR 100 dose acceptance criteria.

15A.2 ASSUMPTIONS (TID-14844)

The following assumptions ar e basic to all dose models:

a. Direct radiation from the source point is negligible compared to gamma radiation due to immer sion in the semi-infinite radioactive cloud.

b. All radioactivity releases are treated as ground level releases regardless of t he point of discharge.

c. The dose receptor is a s tandard man as d efined by the International Commission on Radiological Protection (ICRP) (Reference 1).

d. Radioactive decay from t he point of release to the dose receptor is neglected.

e. The offsite atmospheric disp ersion factors used are the 5 th percentile values fro m Table 15.0-3 and 15.0-4.

B/B-UFSAR 15A-1a REVISION 12 - DECEMBER 2008 15A.3 OFFSITE DOSE MODELS (TID-14844)

Whole body (acute) doses and thyroid doses from inhaled radioactive iodine are c alculated for the 0

- 2 hour2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months interval at the exclusion area bou ndary and for the dura tion of the accident at the low pop ulation zone (LP Z) outer boundary.

15A.3.1 WHOLE BODY DOSE (TID-14844)

The whole body dose de livered to a dose rece ptor is obtained by considering the dose r eceptor to be immersed in a radioactive cloud which is infin ite in all directions ab ove the ground plane, i.e., an "infinite semispherical cloud." The concentration of radioactive material wit hin this cloud is taken to be uniform and equal to the maximum c enterline ground level concentration that would exist in the cloud at the appropriate distance from the point of release.

The whole body dose is a result of external ga mma radiation.

B/B-UFSAR 15A-1b REVISION 12 - DECEMBER 2008 Two different models are used for calculating the whole body dose. For the noble gases, the model taken from Regulatory Guide 1.109 (Reference 2) is used.

The equation is:

Where: D = Whole body dose, rem X/Q = the 5 th percentile atmo spheric dispersion factor for a given time period and distance (see Tables 15.0-13 and 15.0-14), sec / m 3

A i = the activity of nuclide i released during a given time period, Ci DCFy-i = gamma dose conversio n factor for nuclide i (see Table 1 3

Regulatory Guide 1.109 does not include dose conversion factors submersion in a cloud of radioactive iodine.

The whole body dose contribution from the iodine in the cloud of activity is calculated using the following equation from Reference 3.

Where: E-i = average gamma disint egration energy for nuclide i (see Table 15A-1), MeV per disintegration 15A.3.2 THYROID INHALATION DOSE (TID-14844)

The thyroid dose for a g iven time period is obtained from the following expression:

Where: D thy = thyroid dose, rem B = breathing rate, m 3/sec (from Reference 3), the breathing ra te offsite varies with time as follows:

0 - 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months 3.47E-4 m 3/sec 8 - 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months 1.75E-4 m 3/sec >24 hours 2.32E-4 m 3/sec ))(()/(i y i i DCF A Q X D=))(()/)(25.0 (i i i E A Q X D=))(()/(i thy i i thy DCF A Q X B D=

B/B-UFSAR 15A-1c REVISION 12 - DECEMBER 2008 X/Q = the 5 th percentile atmo spheric dispersion factor for a given time period and distance (see Tables 15.0-13 and 15.0-14), sec / m 3 A i = the activity of iodine isotope i released during a given time period, Ci DCFthy-i = thyroid dose c onversion factor for iodine isotope i (see Table 15A-1), rem

/ Ci inhaled 15A.4 CONTROL ROOM DOSE MODELS (TID-14844)

The operators in the control room will accumulate doses due to the activity entering the control room as the result of an accident. The integra ted activity in the control room during a given time interval is found by multiplying the release by the appropriate X/Q (see Tab le 6.4-1a) to give t he concentration at the control room intake. This a ctivity is bro ught into the control room through the filtered intake pathway and by unfiltered inleakage.

The activity in t he control room atmosphere is reduced by recir culation through filters, by exhausting a portion of the air to the environ ment (balancing the air inflow and inleakage

), and by radioactive decay. The flows and filter efficienc ies are provided in Table 6.4-1a.

Using the integrated act ivity in the control r oom, the whole body (acute) doses, beta-skin doses, and thyroid do ses are calculated for the operators in the control room from the m odels described in the followi ng subsections.

15A.4.1 WHOLE BODY DOSE (TID-14844)

As with the determinat ion of offsite doses, there are two different models used for calculatin g the whole body dose. For the noble gases, the model is based on Regulatory Guide 1.109 (Reference 2).

The equation is:

Where: D = whole body dose, rem GF = geometry corre ction factor used to convert the semi-infin ite cloud to a finite cloud (from R eference 4, GF =

1173 / V0.338 where "V" is the control room volume in cubic feet)

))(())((i i i DCF A OF GF D=

B/B-UFSAR 15A-1d REVISION 12 - DECEMBER 2008 OF = the occupancy fa ctor (i.e., the fraction of the time period t hat the operator is assumed to be presen t in the control room), from Reference 4, the values are:

0 - 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months OF = 1.0 24 - 96 hours0.00111 days 0.0267 hours 1.587302e-4 weeks 3.6528e-5 months OF = 0.6 96 - 720 hours0.00833 days 0.2 hours 0.00119 weeks 2.7396e-4 months OF = 0.4 A i = the average concentrat ion of nuclide i in the control room atmosphere during a given time period, Ci/m 3 DCF-i = whole body dose conv ersion factor for nuclide i (see Table 15A-1), rem

m 3 / Regulatory Guide 1.109 does not include dose conversion factors for sumbersion in a cloud of r adioactive iodine. The whole body dose contribution from the iodine in the cloud of activity is calculated using the following equation:

Where: E-i = average gamma disint egration energy for nuclide i (Table 15A-1), MeV per disintegration 15A.4.2 BETA-SKIN DOSE (TID-14844)

As with the whole body dose, two different m odels are used for calculating the beta-skin dose. For the nob le gases, the model is based on Regulatory G uide 1.109 (Reference 2). The equation is: Where: D = Beta-skin dose, rem DCF-i = Beta-skin dose c onversion factor for nuclide i (see Table 15A-1), rem

m 3 /

Regulatory Guide 1.109 does not include dose conversion factors for submersion in a cloud of r adioactive iodine. The beta-skin dose contribution form the iodine in the cloud of activity is calculated using the following equation:

))(())(25.0)((i i i E A OF GF D=))((i i i DCF C OF D=

B/B-UFSAR 15A-1e REVISION 12 - DECEMBER 2008 Where: E-i = average beta dis integration energy for nuclide i (Table 15A-1), MeV per disintegration

15A.4.3 THYROID DOSE (TID-14844)

The equation for the thyroid dose is:

Where: D thy = thyroid dose, rem B = breathing rate, m 3/sec (from Reference 4, the breathing rat e in the control room is 3.47E-4 m 3/sec and does not vary with time)

DCFthy-i = thyroid dose c onversion factor for nuclide i (see Table 15A-1), rem / Ci inhaled

))(())(23.0 (1=E A OF D i i))(())((i hy t i i thy DCF A B OF D=

B/B-UFSAR 15A-2 REVISION 9 - DECEMBER 2002 15A.5 REFERENCES

1. "Report of ICRP Committee II on Permis sive Dose for Internal Radiation (1959)," Health Physics Vol. 3 , pp. 30, 146-153, 1970. 2. Regulatory Guide 1.109, "Calculation of Annual Doses to Man from Routine Releases of React or Effluents for the purpose of Evaluating Compliance with 10 CFR Part 50 , Appendix I,"

Revision 1, October 1977.

B/B-UFSAR 15A-3 REVISION 12 - DECEMBER 2008 3. Regulatory Guide 1.4, Revisi on 2, "Assum ptions Used for Evaluating the P otential Radiological Co nsequences of a Loss of Coolant Accident for Pressurized Water Reactor," USAEC, June 1974.

4. Murphy, K. G. and K. M.

Campe, "Nuclear Powe r Plant Control Room Ventilation System Design for Meeting General Criterion 19," presented at the 13 th AEC Air Clea ning Conference, November 1974.

5. ICRP Publication 38, "Radion uclide Transformations - Energy and Intensity of Emi ssions," 1983.

6. ICRP Publication 30, "Limits for Intakes of Radionuclides by Workers," 1979.

7. Regulatory Guide 1.183, "Alternative R adiological Source Terms for Evaluating Design Basis Accide nts at Nuclear Power Reactors," July 2000.

8. NUREG/CR-6604, "RADT RAD: A Simplified Mo del for RADionuclide Transport and Removal And Do se Estimation,"

April 1998; Supplement 1, June 1999; and S upplement 2, Oct ober 2002.

9. U.S. Federal G uidance Report No.11, "Limiting Values of Radionuclide Int ake and Air Concentr ation and Dose Conversion Factors for I nhalation, Sub mersion, and Ingestion," 1988.

10. U.S. Federal G uidance Report No.12, "External Exposure to Radionuclides in Air, Wa ter, and Soil," 1993.

11. Regulatory Guide 1.194, "Atmospheric R elative Concentrations for Control Room Radiological Ha bitability Assessments at Nuclear Power Plants

," June 2003.

12. Regulatory Guide 1.145, "Atmospheric D ispersion Models for Potential Accident C onsequence Assessmen ts at Nuclear Power Plants," Revision 1, November 1982.

B/B-UFSAR 15A-4 REVISION 9 - DECEMBER 2002 TABLE 15A-1 PHYSICAL DATA FOR ISOTOPES Isotope Decay Constant*, hr-1 Thyroid Dose Conversion Factors**, rem/Ci Average Gamma Disintegration Energy*, Mev/Disintegration Average Beta Disintegration Energy*, Mev/Disintegration I-131 3.59E-3 1.07E6 3.81E-1 3.81E-1 I-132 3.01E-1 6.29E3 2.28E0 2.28E0 I-133 3.33E-2 1.81E5 6.07E-1 6.07E-1 I-134 7.91E-1 1.07E3 2.62E0 2.62E0 I-135 1.05E-1 3.14E4 1.58E0 1.58E0 Isotope Decay Constant*, hr-1 Whole-Body Dose Conversion Factor ***, rem-m 3/Ci-sec Beta-Skin Dose Conversion Factor***, rem-m 3/Ci-sec Kr-85m 1.55E-1 3.71E-2 4.63E-2 Kr-85 7.38E-6 5.10E-4 4.25E-2 Kr-87 5.45E-1 1.88E-1 3.085E-1 Kr-88 2.44E-1 4.66E-1 7.51E-2 Xe-131m 2.43E-3 2.90E-3 1.50E-2 Xe-133m 1.32E-2 7.96E-3 3.15E-2 Xe-133 5.51E-3 9.32E-3 9.70E-3 Xe-135m 2.72E0 9.89E-2 2.25E-2 Xe-135 7.63E-2 5.74E-2 5.90E-2 Xe-138 2.93E0 2.80E-1 1.31E-1

Reference 5

- Reference 6

- - Reference 2

B/B-UFSAR REVISION 1 - DECEMBER 1989

Attachment 15B h as been deleted intentionally.

B/B-UFSAR REVISION 14 - DECEMBER 2012 Figure 15.6-4 has been deleted intentionally.

REVISION 14DECEMBER 20120.10.20.250.30.35PMID0.40.450.60.50.40.30.20.5PBOT :integrated power fraction In the bottomthird of the corePMID s integratedpower fractionIn the middle third of the coreBYRON/BRAIDWOODSTATIONSUPDATED FINAL SAFETY ANALYSIS REPORTFIGURE 15.6-7Pbot/Pmid OPERATING LIMITS REVISION 14DECEMBER 2012?0...AXCLACO:N°i..A?:ffa.t1411001i0000300400e After Break (s)4u5547171BYRON/BRAIDWOODSTATIONSUPDATED FINAL SAFETY ANALYSIS REPORTFIGURE 15.6-8aHOT ROD PEAK CLADDING TEMPERATUREFOR ECCS LB LOCA PCT LIMITING CASE-UNIT 1 REVISION 14DECEMBER 2012VESSEL St5F EREUK100200300400500Time After Break (s)4O 547171BYRON/BRAIDWOODSTATIONSUPDATED FINAL SAFETY ANALYSIS REPORTFIGURE 15.6-6bBREAK FLOW ON VESSEL SIDE OFBROKEN COLD LEGFOR ECCS LB LOCA PCT LIMITING CASE-UNIT 1 REVISION 14DECEMBER 2012FF25000^2Mioo1502,30250TimeAfter Break(s)40554717,BYRON/BRAIDWOODSTATIONSUPDATED FINAL SAFETY ANALYSIS REPORTFIGURE15.6-8cBREAK FLOW ON LOOP SIDE OFBROKEN COLD LEGFOR ECCS LB LOCA PCT LIMITING CASE-UNIT 1 REVISION 14DECEMBER 2012TAC" L'22P 2 PUMP bO:D FRACTION2Ea]pPF J IP VO D TRACT I ON1d4060Time After Break (s)`547 IBYRON/BRAIDWOODSTATIONSUPDATED FINAL SAFETY ANALYSIS REPORTFIGURE 15.6-8dVOID FRACTION AT THE INTACT AND BROKENLOOP PUMP INLETFOR ECCS LB LOCA PCT LIMITING CASE-UNIT 1 REVISION 14DECEMBER 2012IvA"UP ri, vw RA!EA$$YC'Pi= AVEkAltr2025Erne After Breok445447171BYRON/BRAIDWOODSTATIONSUPDATED FINAL SAFETY ANALYSIS REPORTFIGURE 15.6-8eVAPOR FLOW RATE AT TOP OF CORE AVERAGECHANNEL DURING SLOWDOWNFOR ECCS LB LOCA PCT LIMITING CASE-UNIT 1 REVISION 14DECEMBER 2012uRdT t `I APGR F, :]'W RArE iv CORE 1G't A S S Y C ^ A NNE.15`10c3M0-i0to15202530Time After Break (s)BYRON/BRAIDWOODSTATIONSUPDATED FINAL SAFETY ANALYSIS REPORTFIGURE 15.6-8fVAPOR FLOW RATE AT TOP OF HOTASSEMBLY CHANNEL DURING BLOWDOWNFOR ECCS LB LOCA PCT LIMITING CASE-UNIT 1 REVISION 14DECEMBER 201210121too200^ffl400Time After Break (s)465547171BYRON/BRAIDWOODSTATIONSUPDATED FINAL SAFETY ANALYSIS REPORTFIGURE 15.6-8gCOLLAPSED LIQUIDLEVELIN LOWER PLENUMFOR ECCS LB LOCA PCT LIMITING CASE-UNIT 1 REVISION 14DECEMBER 20122Acc;JM(P A7OR UASS FLOW PATE2500201500-1-500'i'0200300Time After Break (s)465547171BYRON/BRAIDWOODSTATIONSUPDATED FINAL SAFETY ANALYSIS REPORTFIGURE 15.6-8hACCUMULATOR MASS FLOW RATEVAPOR FLOW RATEFOR ECCS LB LOCA PCT LIMITING CASE-UNIT 1 REVISION 14DECEMBER 2012120LCJCSiMASS100200300Time Alter Break405547!76BYRON/BRAIDWOODSTATIONSUPDATED FINAL SAFETY ANALYSIS REPORTFIGURE15.6-8iTOTAL SI MASS FLOW RATE FOR ONEINTACT LOOPFOR ECCS LB LOCA PCT LIMITING CASE-UNIT 1 REVISION 14DECEMBER 2012UNIT I COLLAPSEO LtOUtG ^EVEL tN CORE AVERAGE CHANNEL 1BYRON/BRAIDWOODSTATIONSUPDATED FINAL SAFETY ANALYSIS REPORTFIGURE 15.6-8jCOLLAPSED LIQUID LEVEL IN COREAVERAGE CHANNELFOR ECCS LB LOCA PCT LIMITING CASE-UNIT 1 REVISION 14DECEMBER 2012UNT1Lt)UfD LEVELIN INTACT LOOP 2 OO*NCOMER25120100200300400500Time After Break (s)405547171BYRON/BRAIDWOODSTATIONSUPDATED FINAL SAFETY ANALYSIS REPORTFIGURE 15.6-8kCOLLAPSED LIQUID LEVEL INDOWNCOMERCHANNELFOR ECCS LB LOCA PCT LIMITING CASE-UNIT 1 REVISION 14DECEMBER 2012SE" ! 11U1 v' WAS"250003Time After Break (s)4G554i iBYRON/BRAIDWOODSTATIONSUPDATED FINAL SAFETY ANALYSIS REPORTFIGURE 15.6.8IVESSEL FLUID MASSFOR ECCS LB LOCA PCT LIMITING CASE-UNIT 1 REVISION 14DECEMBER 20121CLACCiNG '=EVPERA'UREfit500300ne After Break (s)4;15517BYRON/BRAIDWOODSTATIONSUPDATED FINAL SAFETY ANALYSIS REPORTFIGURE 15.6-8mHOT ROD PEAK CLADDING TEMPERATURELOCATIONFOR ECCS LB LOCA PCT LIMITING CASE-UNIT 1 BIB-UFSARFigures 15.6-8n through 15.6-8p have been deleted intentionally.REVISION 6 - DECEMBER 1996 REVISION 14DECEMBER 2012A,EAtU"E200Time After Break (s)1 9136 5 1 65 1 1BYRON/BRAIDWOODSTATIONSUPDATED FINAL SAFETY ANALYSIS REPORTFIGURE 15.6-9aHOT ROD PEAK CLADDING TEMPERATUREFOR ECCS LBLOCA PCTLIMITING CASE-UNIT REVISION 14DECEMBER 2012skSzCfBREAK300Time After Break (s)I4C45;651 7BYRON/BRAIDWOODSTATIONSUPDATED FINAL SAFETY ANALYSIS REPORTFIGURE15.6-9bBREAK FLOWON VESSELSIDE OF BROKENCOLD LEGOR ECCS LB LOCA PCT LIMITING CASE--UNIT REVISION 14DECEMBER 20122LOP SIDE DRE100150200250Time Ater Break (s)146516511BYRON/BRAIDWOODSTATIONSUPDATED FINAL SAFETY ANALYSIS REPORTFIGURE 15.6-9cBREAK FLOW ON LOOP SIDE OFBROKEN COLD LEG^OR ECCS LB LOCA PCT LIMITING CASE-UNIT REVISION 14DECEMBER 2012VT d;' t OOP 2 PUMP VO9 "4A10%?ROK` N., `.;gS"kJMP vC=PLC142084220406080100f irne After Break (s)`4^fig?657BYRON/BRAIDWOOD STATIONSUPDATED FINAL SAFETY ANALYSIS REPORTFIGURE15.6-9dVOID FRACTION AT THE INTACT AND BROKENLOOP PUMP INLETDR ECCS LB LOCA PCT LIMITING CASE-UNIT REVISION 14DECEMBER 20122VAPnP.t: ion.A Ye.=E P. ASSI-V'3051152025irneAfterBreak (s)-10BYRON/BRAIDWOODSTATIONSUPDATED FINAL SAFETY ANALYSIS REPORTFIGURE 15.6-9eVAPOR FLOW RATE AT TOP OF COREAVERAGE CHANNEL DURING BLOWDOWNOR ECCS LB LOCA PCT LIMITING CASE-UNIT REVISION 14DECEMBER 2012i0-toRA': ':^: CORE HOT A35" CHANNELto1525Time After BreakBYRON/BRAIDWOODSTATIONSUPDATED FINAL SAFETY ANALYSIS REPORTFIGURE 15.6-9fVAPOR FLOW RATE AT TOP OF HOT ASSEMBLYCHANNEL DURINGBLOWDOWNOR ECCS LB LOCA PCT LIMITING CASE-UNIT REVISION 14DECEMBER 2012I0UN T 2 ;10WEN PLENUM C0 '_S?SED L 0U 0E'1C200300400me After Break(s)^65kfi5?BYRON/BRAIDWOODSTATIONSUPDATED FINAL SAFETY ANALYSIS REPORTFIGURE15.6-9gCOLLAPSED LIQUID LEVEL IN LOWER PLENUMFOR ECCS LB LOCA PCT LIMITING CASE-UNIT REVISION 14DECEMBER 2012T2i%, T A C Tu:'P2A CCJkf J'_ A T,,eMASSC2'50500aiT me After Break (s)BYRON/BRAIDWOOD STATIONSUPDATED FINAL SAFETY ANALYSIS REPORTFIGURE 15.6-9hACCUMULATOR MASS FLOW RATEIVAPOR FLOW RATEFOR ECCS LB LOCA PCT LIMITING CASE-UNIT REVISION 14DECEMBER 201212FACT LOOP2SiMASS FLGW RAf2003CTime After Break1906n16511BYRON/BRAIDWOODSTATIONSUPDATED FINAL SAFETY ANALYSIS REPORTFIGURE15.6-9iTOTALSI MASS FLOW RATE FOR ONEINTACT LOOPFOR ECCS LB LOCA PCT LIMITING CASE-UNIT REVISION 14DECEMBER 2012UNIT 2 _OLLAPSEO LIOUI6LEVELIN CORE AVERAGE CHANNEL 1IBYRON/BRAIDWOODSTATIONSUPDATED FINAL SAFETY ANALYSIS REPORTFIGURE 15.6-9jCOLLAPSED LIQUID LEVEL INCORE AVERAGE CHANNELOR ECCS LB LOCA PCT LIMITING CASE-UNIT REVISION 14DECEMBER 2012UHI' 2 LiOUIO LEVELtN INTACTLOOP 2 OO'WNCOMER200Time After Break (s)1005001906516511BYRON/BRAIDWOODSTATIONSUPDATED FINAL SAFETY ANALYSIS REPORTFIGURE 15.6-9kCOLLAPSED LIQUID LEVEL INDOWNCOMERCHANNELOR ECCS LB LOCA PCT LIMITING CASE-UNIT REVISION 14DECEMBER 20122VES5E__iOU 052003CTime After Breaklri8.5i6511BYRON/BRAIDWOOD STATIONSUPDATED FINAL SAFETY ANALYSIS REPORTFIGURE15.6-91VESSEL FLUID MASSFOR ECCS LB LOCA PCT LIMITING CASE-UNIT REVISION 14DECEMBER 201212wUNIr 2 POD I PEAK CLADDING TEMPERATURE LOCATIONIn2003004004%62576BYRON/BRAIDWOODSTATIONSUPDATED FINAL SAFETY ANALYSIS REPORTFIGURE15.6-9mHOT ROD PEAK CLADDINGTEMPERATURE LOCATIONOR ECCS LB LOCA PCT LIMITING CASE-UNIT

aJ aJ N >-x iD .' N -4',t ----f-'"'t il l I [ .I lJ:.d ", '---'.':-.-=-----"' * . , I I I z o DECEMBER 2010 --+l---I-J i " r i"::: Lh-' --r-----;-.-<---------

6 ... p , )lSV:) [ 1 3nJ IN3dS ----tr---->-0 Zo :t"-'" 1.< '0 I II . I _.

- -:-*. ---_-___ -_-_-_-_-_-_-'_

-... :-;---------: :-.. --_-=--=-:-,,.--.-,, -1: ..J i.o w "' .. ..., ..., BYRON/BRAIDWOOD STATIONS UPDATED FINAL SAFETY ANALYSIS REPORT FIGURE 15.7-2 SPEN T FUE L STORAGE POO L SECT I ON

RS-12-221, Braidwood, Units 1 and 2 and Byron, Units 1 and 2, Updated Final Safety Analysis Report, Revision 14, Chapter 15.0 - Accident Analyses

Contents

Text

SUMMARY

Subject:

8.1 REFERENCES

Navigation menu

RS-12-221, Braidwood, Units 1 and 2 and Byron, Units 1 and 2, Updated Final Safety Analysis Report, Revision 14, Chapter 15.0 - Accident Analyses

Text

SUMMARY

Subject:

8.1 REFERENCES

Navigation menu

Search