ANP-10329, Revision 1, 'U.S. EPR Mitigation Strategies for … · 2014-11-28 · AREVA Inc....

ANP-10329 Revision 1 U.S. EPR Mitigation Strategies for

Extended Loss of AC Power Event

Technical Report

November 2014

AREVA Inc.

(c) November 2014 AREVA Inc.

Copyright © November 2014

AREVA Inc. All Rights Reserved

AREVA Inc. ANP-10329 Revision 1 U.S. EPR Mitigation Strategies for Extended Loss of AC Power Event Technical Report Page i

Nature of Changes

Rev Section(s) or Page(s) Description and Justification

000 All Initial Issue 001 All Miscellaneous editorial changes (e.g. Changed “secondary side

feed and bleed cooling” to “primary to secondary heat transfer” throughout).

001 2.1 In Item 1, established that containment pressure and temperature will remain below containment design basis limits. Clarified Item 2 (SG depressurization) and deleted Item 3.

001 3.7 – 3.9 Added statement that Recommendation 7.2 is satisfied through compliance with EA-12-049 in accordance with COMSECY-13-0002.

001 4.1.3 Analytical Bases revised to summarize core cooling in Modes 1 to 5 with steam generators (SGs) available and core cooling in Modes 5 and 6 with SGs unavailable. Cooldown is with four SGs for first six hours when SGs are available.

001 4.1.3 Added Table 4–2 which summarizes breakdown of operating modes, analyses performed, initial conditions, and operator actions. Lower mode initial conditions include low temperature overpressure protection (LTOP) enabled and no credit for accumulators.

001 4.1.3 Increased discharge head of Primary Coolant Injection Pump (PCIP).

001 4.1.3.4 Deleted containment venting strategy. Revised discussion on containment heat removal.

001 4.1.3.5 Updated Safeguard Buildings Heatup analyses. 001 4.1.3.8 Updated Spent Fuel Pool time to boil analysis. 001 4.1.4 Clarified and updated Reasonable Protection requirements. 001 4.1.5 Revised simplified diagrams and updated FLEX summary

tables. 001 4.1.5 Revised electrical distribution system from ELAP DG. 001 4.1.5 Added discussion of mitigation strategies in all plant modes. 001 4.1.5 Deleted mitigation strategy for containment venting. Revised

discussion on mitigation strategy for containment heat removal. 001 4.1.5.1 Added list of ELAP diesel generator loads. 001 4.1.5.6 Updated Instrumentation and Controls. 001 4.1.6 Updated Sequence of Event tables. 001 4.1.7 Updated portable equipment performance requirements and

added performance requirements for safety related and non-safety related components used in mitigation strategy.

AREVA Inc. ANP-10329 Revision 1 U.S. EPR Mitigation Strategies for Extended Loss of AC Power Event Technical Report Page ii

Rev Section(s) or Page(s) Description and Justification

001 4.2 Deleted Section 4.2.2, “NTTF 7.3, Plant Technical Specification,” and Section 4.2.3, “NTTF 7.4, Seismically Qualified Spent Fuel Pool Spray System.”

AREVA Inc. ANP-10329 Revision 1 U.S. EPR Mitigation Strategies for Extended Loss of AC Power Event Technical Report Page iii

Contents

Page

1.0 INTRODUCTION ............................................................................................... 1-1

1.1 Description of Fukushima Daiichi Accident ............................................. 1-2

1.2 Purpose .................................................................................................. 1-2

2.0 REGULATORY OVERVIEW.............................................................................. 2-1

2.1 NRC Order EA-12-049, Interim Staff Guidance JLD-ISG-2012-01, and NEI 12-06, Revision 0 ....................................................... 2-3

2.2 NRC Order EA-12-051, Interim Staff Guidance JLD-ISG-2012-03, and NEI 12-02, Revision 1 ....................................................... 2-5

3.0 APPLICABLE TIER 1 AND TIER 2 RECOMMENDATIONS .............................. 3-1

3.1 NTTF Recommendation 2.1, Tier 1 ........................................................ 3-1

3.2 SECY-12-0025, Enclosure 3 Recommendation, Tier 2 ........................... 3-2



3.5 SECY-12-0025, Enclosure 2 Recommendation, Tier 1 ........................... 3-3





3.10 NTTF Recommendation 8, Tier 1 ........................................................... 3-4

3.11 NTTF Recommendation 9.3 .................................................................... 3-5 3.11.1 Tier 1 Recommendations ............................................................. 3-5 3.11.2 Tier 2 Recommendations ............................................................. 3-5

4.0 MITIGATION ASSESSMENT ............................................................................ 4-1

4.1 NTTF 4.2, Mitigation of Beyond Design Basis External Events ..................................................................................................... 4-1 4.1.1 Overview ...................................................................................... 4-1 4.1.2 Acceptance Criteria ...................................................................... 4-2 4.1.3 Analytical Bases ........................................................................... 4-3 4.1.4 Reasonable Protection of Installed and Portable

Equipment .................................................................................. 4-65 4.1.5 Mitigation Strategies ................................................................... 4-70 4.1.6 Sequence of Events/Critical Operator Actions ......................... 4-121

AREVA Inc. ANP-10329 Revision 1 U.S. EPR Mitigation Strategies for Extended Loss of AC Power Event Technical Report Page iv

4.1.7 Functional Performance Requirements for Key Equipment ................................................................................ 4-147

4.2 NTTF 7.1, Safety-Related Spent Fuel Pool Level Instrumentation ................................................................................... 4-154 4.2.1 Overview .................................................................................. 4-154 4.2.2 Conformance............................................................................ 4-154 4.2.3 Arrangement ............................................................................ 4-155 4.2.4 Qualification ............................................................................. 4-155 4.2.5 Power Supplies ........................................................................ 4-156 4.2.6 Accuracy .................................................................................. 4-156 4.2.7 Display ..................................................................................... 4-156 4.2.8 Training .................................................................................... 4-157

4.3 NTTF 9.3, Enhanced Emergency Preparedness ................................ 4-157 4.3.1 Overview .................................................................................. 4-157 4.3.2 Conformance............................................................................ 4-157

5.0 REFERENCES .................................................................................................. 5-1

AREVA Inc. ANP-10329 Revision 1 U.S. EPR Mitigation Strategies for Extended Loss of AC Power Event Technical Report Page v

List of Tables

Table 4–1—Mitigation Strategy Acceptance Criteria .................................................... 4-2

Table 4–2—ELAP States ............................................................................................. 4-6

Table 4–3—Reasonable Protection of ELAP Event Mitigation Equipment ................. 4-69

Table 4–4—ELAP Loads ............................................................................................ 4-77

Table 4–5—ELAP Electrical Bus Alignments ............................................................. 4-78

Table 4–6—FLEX Capability – Core Cooling Summary – Modes 1 through 5 with SGs Available ....................................................................................... 4-82

Table 4–7—Primary Coolant Injection Valve Alignment ............................................. 4-84

Table 4–8—Fire Water to SGs Valve Alignment ........................................................ 4-89

Table 4–9—FLEX Capability – Primary Feed and Bleed Core Cooling Summary ..... 4-96

Table 4–10—Primary Feed and Bleed Cooling Valve Alignment ............................. 4-100

Table 4–11—FLEX Capability – Containment Summary .......................................... 4-103

Table 4–12—SAHRS Spray Valve Alignment .......................................................... 4-105

Table 4–13—SAHRS Portable Cooling Water Valve Alignment ............................... 4-106

Table 4–14—FLEX Capability – Spent Fuel Cooling Summary ............................... 4-109

Table 4–15—SICS Controls ..................................................................................... 4-113

Table 4–16—FLEX Capability – Support Functions Summary ................................. 4-115

Table 4–17—Sequence of Events – ELAP Initiated in Modes 1 through 5 with SGs Available for Primary to Secondary Heat Transfer (ELAP States A, B, and C) ............................................................................. 4-123

Table 4–18—Sequence of Events – ELAP Initiated in Mode 5 or Mode 6 with SGs Unavailable (ELAP States D, E, and F) ...................................... 4-138

Table 4–19—Performance Requirements for Key Portable Equipment ................... 4-148

Table 4–20—Performance Requirements for Key Safety Related Equipment ......... 4-150

Table 4–21—Performance Requirements for Key Non-Safety Related Equipment . 4-153

AREVA Inc. ANP-10329 Revision 1 U.S. EPR Mitigation Strategies for Extended Loss of AC Power Event Technical Report Page vi

List of Figures

Figure 4-1— ELAP State A Pressurizer Pressure ...................................................... 4-17

Figure 4-2— ELAP State A Cold Leg Temperatures .................................................. 4-17

Figure 4-3— ELAP State A Pressurizer Level ............................................................ 4-18

Figure 4-4— ELAP State A Steam Generator Pressure ............................................. 4-18

Figure 4-5— ELAP State A Steam Generator Levels ................................................. 4-19

Figure 4-6— ELAP State A Core Region Levels ........................................................ 4-19

Figure 4-7—ELAP State B Pressurizer Pressure ....................................................... 4-24

Figure 4-8—ELAP State B Cold Leg Temperatures ................................................... 4-25

Figure 4-9—ELAP State B Pressurizer Level ............................................................. 4-25

Figure 4-10—ELAP State B Steam Generator Pressure ............................................ 4-26

Figure 4-11—ELAP State B Steam Generator Level ................................................. 4-26

Figure 4-12—ELAP State B Core Region Levels ....................................................... 4-27

Figure 4-13—ELAP State C RCS Pressures .............................................................. 4-31

Figure 4-14—ELAP State C RCS Cold Leg Temperatures ........................................ 4-32

Figure 4-15—ELAP State C Steam Generator Levels................................................ 4-32

Figure 4-16—ELAP State C RCS Levels ................................................................... 4-33

Figure 4-17—ELAP State D RCS Pressures .............................................................. 4-37

Figure 4-18—ELAP State D Primary Temperatures ................................................... 4-38

Figure 4-19—ELAP State D RPV Volume Fractions .................................................. 4-38

Figure 4-20—ELAP State E RCS Pressures .............................................................. 4-42

Figure 4-21—ELAP State E Primary Temperatures ................................................... 4-42

Figure 4-22—ELAP State E RPV Volume Fractions .................................................. 4-43

Figure 4-23—ELAP State F Fuel Temperature for a 60 Minute Delay in the Start of Injection ............................................................................................ 4-46

Figure 4-24—Boron Precipitation Analysis Results .................................................... 4-50

Figure 4-25—Containment Pressure with Containment Spray ................................... 4-54

Figure 4-26—Containment Temperature with Containment Spray ............................. 4-55

Figure 4-27—ELAP Battery Discharge Duration ........................................................ 4-65

Figure 4-28—Electrical Distribution and Repowering EUPS ...................................... 4-80

Figure 4-29—RCP SSSS ........................................................................................... 4-86

AREVA Inc. ANP-10329 Revision 1 U.S. EPR Mitigation Strategies for Extended Loss of AC Power Event Technical Report Page vii

Figure 4-30—Primary to Secondary Heat Transfer Simplified Diagram ..................... 4-89

Figure 4-31—Core Cooling in Mode 5 with SGs Unavailable and Mode 6 (Head On) Simplified Diagram ......................................................................... 4-97

Figure 4-32—Core Cooling in Mode 6 (Head Off) Simplified Diagram ....................... 4-98

Figure 4-33—Containment Spray and Containment Heat Removal Simplified Diagram .............................................................................................. 4-105

Figure 4-34—Spent Fuel Spray System Simplified Diagram .................................... 4-108

AREVA Inc. ANP-10329 Revision 1 U.S. EPR Mitigation Strategies for Extended Loss of AC Power Event Technical Report Page viii

Nomenclature

Acronym Definition

AC Alternating Current

ANPR Advance Notice of Proposed Rulemaking

BDBEE Beyond Design Basis External Event

COMS Communication System

DC Direct Current

EDG Emergency Diesel Generator

EFW Emergency Feedwater

ELAP Extended Loss of AC Power

E-LGT Emergency Lighting

EP Emergency Preparedness

EPSS Emergency Power Supply System

EUPS Class 1E Uninterruptible Power Supply

FB Fuel Building

FLEX Diverse and Flexible Coping Strategies

FPS Fire Protection System

FSAR Final Safety Analysis Report

GOTHIC Generation of Thermal-Hydraulic Information for Containments

HVAC Heating, Ventilation, and Air Conditioning

I&C Instrumentation and Control

IRWST In-Containment Refueling Water Storage Tank

ISG Interim Staff Guidance

LOCA Loss of Coolant Accident

LOOP Loss of Offsite Power

LTOP Low Temperature Overpressure Protection

MCC Motor Control Center

MCR Main Control Room

MHSI Medium Head Safety Injection

MSRCV Main Steam Relief Control Valve

MSRIV Main Steam Relief Isolation Valve

MSRT Main Steam Relief Train

NEI Nuclear Energy Institute

NRC U.S. Nuclear Regulatory Commission

NTTF Near-Term Task Force

PA Public Address

PACS Priority and Actuator Control System

AREVA Inc. ANP-10329 Revision 1 U.S. EPR Mitigation Strategies for Extended Loss of AC Power Event Technical Report Page ix

Acronym Definition

PCIP Primary Coolant Injection Pump

PDS Primary Depressurization System

PRT Pressurizer Relief Tank

PS Protection System

PSRV Pressurizer Safety Relief Valve

PZR Pressurizer

RCP Reactor Coolant Pump

RCS Reactor Coolant System

RHR Residual Heat Removal

RSS Remote Shutdown Station

RV Reactor Vessel

SAHRS Severe Accident Heat Removal System

SAS Safety Automation System

SB Safeguard Building

SBO Station Blackout (event)

SBVSE Electrical Division of Safeguard Building Ventilation System

SCDS Signal Conditioning and Distribution System

SFP Spent Fuel Pool

SFPS Spent Fuel Pool Spray

SG Steam Generator

SICS Safety Information and Control System

SSC Structures, Systems, and Components

SSE Safe Shutdown Earthquake

SSSS Standstill Seal System

UHS Ultimate Heat Sink

AREVA Inc. ANP-10329 Revision 1 U.S. EPR Mitigation Strategies for Extended Loss of AC Power Event Technical Report Page x

ABSTRACT

After the March 2011 accident at the Fukushima Daiichi Nuclear Power Plant in Japan,

the U.S. Nuclear Regulatory Commission (NRC) commissioned a Near-Term Task

Force (NTTF) to evaluate the event. The NTTF recommended specific regulatory

actions in areas of nuclear power plant design and emergency planning to improve the

availability and reliability of plant safety systems to mitigate a beyond design basis

event from external hazards. This technical report addresses applicable Tier 1 and

Tier 2 NTTF recommendations.

The NRC issued Order EA-12-049, “Order Modifying Licenses with Regard to

Requirements for Mitigation Strategies for Beyond-Design-Basis External Events”

(Reference 1), on March 12, 2012, which requires reactor licensees to develop,

implement, and maintain guidance and strategies to maintain or restore core cooling,

containment integrity, and spent fuel pool cooling capabilities following a beyond design

basis external event (BDBEE). The BDBEE discussed in Order EA-12-049 is assumed

to cause a simultaneous loss of all alternating current (AC) power sources and loss of

normal access to the ultimate heat sink that can occur in any operating mode. The

NRC also issued Order EA-12-051, “Order Modifying Licenses with Regard to Reliable

Spent Fuel Pool Instrumentation” (Reference 2), on March 12, 2012, which requires

reactor licensees to provide sufficiently reliable instrumentation to monitor spent fuel

pool water level and be capable of withstanding design-basis natural phenomena.

This technical report addresses measures incorporated into the U.S. EPR design to

improve nuclear safety in response to the Fukushima Daiichi Nuclear Power Plant

accident. For the U.S. EPR design, the BDBEE evaluated is an extended loss of AC

power event, which assumes a simultaneous loss of all AC power sources (loss of

offsite power plus loss of emergency diesel generators plus loss of alternate AC

sources) plus loss of normal access to the ultimate heat sink. It also demonstrates how

the U.S. EPR design provides baseline coping capability with installed equipment,

describes permanent plant connections, and identifies performance and interface

AREVA Inc. ANP-10329 Revision 1 U.S. EPR Mitigation Strategies for Extended Loss of AC Power Event Technical Report Page xi

requirements for portable equipment to support long-term event mitigation. Critical

operator actions and their timing are also provided.

The U.S. EPR mitigation strategies are capable of mitigating BDBEEs initiated in all

plant operating modes. These strategies have been verified to be acceptable by

analytical methods and evaluations.

AREVA Inc. ANP-10329 Revision 1 U.S. EPR Mitigation Strategies for Extended Loss of AC Power Event Technical Report Page 1-1

1.0 INTRODUCTION

The purpose of this technical report is to describe the U.S. EPR mitigation strategies for

beyond design basis external events (BDBEEs). The BDBEE evaluated is an extended

loss of alternating current (AC) power (ELAP) event, which assumes a simultaneous

loss of all offsite AC power sources plus loss of onsite emergency diesel generators

(EDGs) plus loss of alternate AC sources plus loss of normal access to the ultimate

heat sink (UHS).

In response to the events at Fukushima, the U.S. Nuclear Regulatory Commission

(NRC) Near-Term Task Force (NTTF) recommended specific regulatory actions. The

regulatory actions were prioritized as Tier 1, Tier 2, and Tier 3 recommendations. This

technical report addresses applicable Tier 1 and Tier 2 recommendations. The

regulatory requirements for Tier 3 NTTF recommendations are not addressed in this

report.

NTTF Recommendation 4.2 resulted in NRC Order EA-12-049 (Reference 1), which

requires reactor licensees to develop, implement, and maintain guidance and strategies

to maintain or restore core cooling, containment integrity, and spent fuel pool (SFP)

cooling capabilities following a BDBEE. These strategies must be capable of mitigating

a simultaneous loss of all AC power and loss of normal access to the UHS and must be

applicable in all operating modes. Reasonable protection for mitigating equipment must

also be provided. This technical report addresses Nuclear Energy Institute (NEI) 12-06,

“Diverse and Flexible Coping Strategies (FLEX) Implementation Guide” (Reference 3),

which addresses FLEX Phase 1 event mitigation (installed equipment), describes

permanent plant connections as needed, and identifies performance requirements for

portable equipment to support long-term event mitigation (interface provisions for

Phase 2 and 3 actions). The term “portable equipment” as used in this report includes

pre-staged FLEX equipment.


1.1 Description of Fukushima Daiichi Accident

On March 11, 2011, the Fukushima Daiichi plant in northern Japan was subjected to

two BDBEEs:

1. A beyond design basis earthquake with peak ground accelerations at the site in the

0.5g-0.6g range.

2. A tsunami, triggered by the earthquake, that struck the plant about 40 minutes later

with an approximately 45-foot high wave, which was approximately 32 feet above

the intake building level, 26 feet above the top of the plant seawall, and 12 feet

above plant grade level.

Units 1, 2, and 3 were in power operation at the time of the earthquake, while Units 4, 5,

and 6 were shut down for routine refueling and maintenance activities. The beyond

design basis earthquake resulted in a loss of offsite power (LOOP), a reactor trip, and

an automatic startup of the EDGs. The beyond design basis tsunami resulted in a total

loss of heat sink due to debris on all units, a total loss of AC emergency power due to

flooding on most units, and a total loss of direct current (DC) emergency power due to

flooding on one unit. As a result of the loss of emergency power for an extended period

of time, Units 1, 2, and 3 experienced some core damage with radiological releases and

hydrogen gas explosions. Releases of combustible gases from adjacent units into Unit

4 resulted in an explosion in Unit 4 as well, however there was no significant fuel

damage. Units 5 and 6 remained shut down without any fuel damage.

1.2 Purpose

This technical report addresses the applicable Tier 1 and Tier 2 NTTF

recommendations.

Section 2.0 provides an overview of the applicable regulatory criteria and bases.

Section 3.0 provides a synopsis of the method that the U.S. EPR design uses to

address each of the applicable Tier 1 and Tier 2 NTTF Recommendations.


Section 4.1 summarizes the U.S. EPR mitigation strategy for NTTF Recommendation

4.2 (mitigation of beyond design basis external hazards).

Section 4.2 summarizes the U.S. EPR mitigation strategy for NTTF Recommendation 7

(enhancing SFP makeup and SFP instrumentation).

Section 4.3 summarizes the U.S. EPR mitigation strategy for NTTF Recommendation

9.3 (enhanced emergency preparedness (EP) staffing and communications).


2.0 REGULATORY OVERVIEW

This section describes the regulatory criteria and regulatory basis for the U.S. EPR

design certification post-Fukushima Daiichi mitigation strategy. The NRC orders

(Reference 1 and Reference 2) and NEI guidance documents (Reference 3) determined

the mitigation strategy.

Following the events at the Fukushima Daiichi Nuclear Power Plant on March 11, 2011,

the NRC established a senior-level agency task force known as the NTTF. The NTTF

was tasked with conducting a systematic and methodical review of the NRC regulations

and processes, and then determining whether the agency should make additional

improvements to these programs considering the events at Fukushima Daiichi. The

NTTF provided these recommendations in SECY-11-0093, “Recommendations for

Enhancing Reactor Safety in the 21st Century, the Near-Term Task Force Review of

Insights from the Fukushima Daiichi Accident” (Reference 4).

The NRC identified a subset of the NTTF recommendations that should be undertaken

without unnecessary delay in SECY-11-0124, “Recommended Actions to be Taken

without Delay from the Near-Term Task Force Report” (Reference 5).

Subsequently, the NRC issued SECY-11-0137, “Prioritization of Recommended Actions

to be taken in Response to Fukushima Lessons Learned” (Reference 6). As a result of

the prioritization and assessment process of the NRC staff, the NTTF recommendations

were prioritized into the following three tiers:

• Tier 1 consists of the NTTF recommendations that the NRC staff determined should

be started without unnecessary delay, and for which sufficient resource flexibility

exists, including availability of critical skill sets.

• Tier 2 consists of the NTTF recommendations that cannot be initiated in the near

term due to factors that include the need for further technical assessment and

alignment, dependence on Tier 1 issues, or availability of critical skill sets. These


actions do not require long-term study and can be initiated when sufficient technical

information and applicable resources become available.

• Tier 3 consists of the NTTF recommendations that require further NRC staff study to

support a regulatory action, have an associated shorter-term action that needs to be

completed to inform the longer-term action, are dependent on the availability of

critical skill sets, or are dependent on the resolution of NTTF Recommendation 1

(Reference 9). Given this, the NTTF Tier 3 recommendations are not addressed in

this report.

In SECY-12-0025, “Proposed Orders and Requests for Information in response to

Lessons Learned from Japan’s March 11, 2011, Great Tohoku Earthquake and

Tsunami” (Reference 7), the NRC described its process to disposition:

• Six additional NRC staff recommendations described in SECY-11-0137.

• Other issues that continue to arise as part of ongoing NRC staff deliberations,

stakeholder interactions, and interactions with the Advisory Committee on Reactor

Safeguards.

In SECY-12-0095, “Tier 3 Program Plans and 6-Month Status Update in Response to

Lessons Learned from Japan’s March 11, 2011, Great Tohoku Earthquake and

Subsequent Tsunami” (Reference 8), the NRC provided an updated list of

recommendations that are being addressed under the Japan lessons learned project.

In March of 2012, the NRC issued two orders and a 10 CFR 50.54(f) letter to

pressurized water reactor operating plant licensees and Combined License holders:

• NRC Order EA-12-049, “Mitigation Strategies for Beyond Design Basis External

Hazards” (Reference 1).

• NRC Order EA-12-051, “Reliable Spent Fuel Pool Instrumentation” (Reference 2).

• 10 CFR 50.54(f) letter requesting additional information, Recommendations 2.1, 2.3,

and 9.3.


2.1 NRC Order EA-12-049, Interim Staff Guidance JLD-ISG-2012-01, and NEI 12-06, Revision 0

In response to NTTF Recommendation 4.2, NRC Order EA-12-049, “Order Modifying

Licenses with Regard to Requirements for Mitigation Strategies for Beyond-Design-

Basis External Events” (Reference 1), was issued on March 12, 2012. The Order

requires guidance and strategies to be available to prevent fuel damage in the reactor

and SFP if all units at a site simultaneously experience a loss of power, motive force,

and normal access to the UHS.

NRC Order EA-12-049 requires a three-phase approach for mitigating BDBEEs. The

initial phase, referred to as Phase 1, requires the use of installed equipment and

resources to maintain or to restore core cooling, containment integrity, and SFP cooling

capabilities. The transition phase, referred to as Phase 2, requires that sufficient

portable onsite equipment and consumables be available to maintain or restore these

functions until they can be achieved with resources brought from offsite. The final

phase, referred to as Phase 3, requires that sufficient offsite resources sustain Phase 1

and Phase 2 functions indefinitely.

The NRC issued Interim Staff Guidance (ISG) JLD-ISG-2012-01, “Compliance with

Order EA-12-049, Order Modifying Licenses with Regard to Requirements for Mitigation

Strategies for Beyond-Design-Basis External Events” (Reference 11), on August 29,

2012. This ISG endorses, with clarifications, the methodologies described in the

industry guidance document, NEI 12-06 (Reference 3), as an acceptable means to

comply with NRC Order EA 12-049 (Reference 1).

NEI 12-06 provides FLEX to establish an indefinite coping capability to prevent damage

to the fuel in the reactor and SFPs, and to maintain the containment function by using

installed equipment, onsite portable equipment, and prestaged offsite resources. This

coping capability is based on strategies that focus on an assumed simultaneous

extended loss of all AC power sources (LOOP plus loss of EDGs plus loss of alternate

AC sources) plus loss of normal access to the UHS caused by unspecified events.

These mitigating strategies must be implementable for all modes.


NEI 12-06 states that permanent plant equipment contained in structures with designs

that are robust with respect to seismic events, floods, high winds and associated

missiles, and extreme temperatures are assumed to be available. Onsite portable or

prestaged mitigating equipment must also be reasonably protected from external

events.

The U.S. EPR design conforms to NRC Order EA-12-049 (Reference 1), NRC JLD-ISG-

2012-01 (Reference 11), and NEI 12-06, Revision 0 (Reference 3) with the following

clarifications:

1. JLD-ISG-2012-01 and NEI 12-06 do not specify an acceptance criterion for the

containment function. To fulfill the containment function, the U.S. EPR mitigation

strategy has conservatively established an acceptance criterion for these BDBEEs

that the containment be maintained below its design basis limits (i.e., pressure below

62.9 psig and temperature below 310°F).

2. Table D-1 of NEI 12-06 states that emergency feedwater (EFW)/auxiliary feedwater

should “provide SG makeup sufficient to maintain or restore SG level with installed

equipment and power supplies to the greatest extent possible to provide core

cooling.” For some operating modes, the U.S. EPR mitigation strategy requires dry

out of the steam generators (SGs) to enable feedwater delivery from a fire water

pump. Core heat removal is then accomplished using the main steam relief trains

(MSRTs) to maintain the SGs below the shutoff head of the diesel driven fire water

pumps. Dryout of the SGs causes a reduction in SG pressure sufficient to allow

feed flow. During this brief period when primary to secondary heat transfer is

interrupted, reactor coolant system (RCS) circulation continues due to momentum

which facilitates restoration of primary to secondary heat transfer once feedwater is

delivered to the SGs. Heat transfer is restored; however, SG levels will not recover

until approximately 1.2 hours after feedwater initiation in ELAP events initiated in

Mode 1.


2.2 NRC Order EA-12-051, Interim Staff Guidance JLD-ISG-2012-03, and NEI 12-02, Revision 1

In response to NTTF Recommendation 7.1, NRC Order EA-12-051, “Issuance of Order

to Modify Licenses with Regard to Reliable Spent Fuel Pool Instrumentation”

(Reference 2), was issued on March 12, 2012. This order states that reactor licensees

must provide sufficiently reliable instrumentation that is capable of withstanding design-

basis natural phenomena to monitor SFP water level.

Attachment 2 to NRC Order EA-12-051 (Reference 2) requires reliable water level

instrumentation in associated spent fuel storage pools that is capable of supporting

identification by trained personnel of the following pool water level conditions:

• A level that is adequate to support operation of the normal fuel pool cooling system.

• A level that is adequate to provide substantial radiation shielding for a person

standing on the SFP operating deck.

• A level at which fuel remains covered and actions to implement makeup water

addition should no longer be deferred.

The NRC issued ISG JLD-ISG-2012-03, “Compliance with Order EA-12-051, Reliable

Spent Fuel Pool Instrumentation” (Reference 12), on August 29, 2012. This ISG

endorses, with exceptions and clarifications, the methodologies described in the

industry guidance document NEI 12-02, “Industry Guidance for Compliance with NRC

Order EA-12-051, To Modify Licenses with Regard to Reliable Spent Fuel Pool

Instrumentation” (Reference 13).

The U.S. EPR design conforms to NRC Order EA-12-051 (Reference 2), NRC JLD-ISG-

2012-03 (Reference 12), and NEI 12-02, Revision 1 (Reference 13).


3.0 APPLICABLE TIER 1 AND TIER 2 RECOMMENDATIONS

The NRC issued a letter, “Implementation of Fukushima Near-Term Task Force

Recommendations,” to AREVA NP Inc. (AREVA) on April 25, 2012 (Reference 14),

which indicated that AREVA would be requested to provide information related to the

Fukushima Tier 1 Recommendations in SECY-12-0025 (Reference 7) and

SRM-12-0025, “Proposed Orders and Requests for Information in Response to Lessons

Learned from Japan’s March 11, 2011, Great Tohoku Earthquake and Tsunami”

(Reference 15), that are applicable to the U.S. EPR design. The four recommendations

identified in the letter were:

• Recommendation 2.1—Seismic Hazards Analysis.

• Recommendation 4.2—Protection of Equipment from External Hazards.

• Recommendation 7.1—Spent Fuel Pool Instrumentation.

• Recommendation 9.3—Enhanced Emergency Preparedness.

Because the NRC letter of April 25, 2012 only addressed Fukushima Tier 1

recommendations, AREVA proposed a plan to the NRC at a September 19, 2012 public

meeting to address all Tier 1 and Tier 2 Fukushima recommendations. This plan

concluded that only a subset of the Tier 1 and Tier 2 Fukushima recommendations are

applicable to the U.S. EPR design.

The following subsections summarize how the applicable Fukushima Tier 1 and Tier 2

recommendations are met for the U.S. EPR design.

3.1 NTTF Recommendation 2.1, Tier 1

NTTF Recommendation 2.1 is a Tier 1 recommendation that requests reactor licensees

reevaluate the seismic and flooding hazards at their sites against current NRC

requirements and guidance and, if necessary, that they update the design basis of


structures, systems, and components (SSC) important to safety to protect against the

updated hazards.

Subsequent to the April 25, 2012 letter (Reference 14), the NRC staff determined that

this recommendation would be addressed by reactor licensees. No further action on

this recommendation is required for the U.S. EPR design certification.

3.2 SECY-12-0025, Enclosure 3 Recommendation, Tier 2

Enclosure 3 of SECY‐12‐0025 (Reference 7) is a Tier 2 recommendation that requests

the reevaluation of other natural external hazards against current regulatory

requirements and guidance and that the design basis be updated accordingly.

The U.S. EPR design satisfies current regulatory requirements and guidance. U.S.

EPR FSAR Tier 2, Section 2.1 discusses the U.S. EPR site characteristics design

parameters. The U.S. EPR design satisfies this recommendation and no further action

on this recommendation is required for the U.S. EPR design certification.


NTTF Recommendation 4.1 is a Tier 1 recommendation that resulted in an Advance

Notice of Proposed Rulemaking (ANPR). The ANPR requests that icensees strengthen

their station blackout (SBO) mitigation capability (10 CFR 50.63) under conditions

involving significant natural disasters.

The scope and timing of rulemaking cannot be predicted at this time. The U.S. EPR

design features for SBO are addressed as part of the response to NTTF

Recommendation 4.2 in Section 4.1.


Recommendation 4.2 is a Tier 1 recommendation that resulted in the issuance of NRC

Order EA-12-049 (Reference 1), which requires reactor licensees to enhance SBO

mitigation capabilities for beyond design basis external hazards.


The U.S. EPR mitigation strategy for this recommendation is addressed in Section 4.1.

3.5 SECY-12-0025, Enclosure 2 Recommendation, Tier 1

Recommendation from SECY-12-0025 (Reference 7), Enclosure 2 is a Tier 1

recommendation that is related to NTTF 2.1, 2.3, 4.1, and 4.2. This recommendation

requests that the reactor licensee include the loss of normal access to the UHS as a

design assumption in conjunction with strategies for dealing with prolonged SBO, and

address loss of normal access to UHS in conjunction with measures taken to deal with

BDBEE.

The U.S. EPR mitigation strategy for this recommendation is addressed in Section 4.1

as part the of mitigation strategy for NTTF 4.2.



Order EA-12-051 (Reference 2). This Order stated that reactor licensees must provide

sufficiently reliable instrumentation to monitor SFP water level and be capable of

withstanding design basis natural phenomena.

The U.S. EPR mitigation strategy for this recommendation is discussed in Section 4.2.


Recommendation 7.2 is a Tier 2 recommendation that requests reactor licensees

provide safety-related AC electrical power for SFP makeup.

In accordance with COMSECY-13-0002 (Reference 28), the intent of this

recommendation is satisfied through the Order EA-12-049 SFP strategy that uses

AC-independent (self-powered), reliable, portable pumps. The U.S. EPR mitigation

strategy associated with EA-12-049 is addressed in Section 4.1.



Recommendation 7.3 is a Tier 2 recommendation that requests that plant Technical

Specifications require one train of emergency onsite electrical power to be operable for

SFP makeup/instrumentation when there is irradiated fuel in the SFP, regardless of

plant operating mode.


recommendation is satisfied through the EA-12-049 SFP strategy which must be

capable of being implemented in all modes and uses programmatic controls for

availability of strategies with specified out-of-service times. The U.S. EPR mitigation

strategy associated with EA-12-049 is addressed in Section 4.1.


Recommendation 7.4 is a Tier 2 recommendation that requests that reactor licensees

provide a seismically qualified means to spray water into SFPs, including an easily

accessible connection to supply water, such as using a portable pump or pumper truck,

at grade outside of the building.


recommendation is satisfied through the EA-12-049 SFP strategy which uses a spray

strategy and two access locations for providing makeup to the SFP. The U.S. EPR

mitigation strategy associated with EA-12-049 is addressed in Section 4.1.

3.10 NTTF Recommendation 8, Tier 1

Recommendation 8 is a Tier 1 recommendation that will result in an ANPR.

Recommendation 8 requests that reactor licensees strengthen and better integrate

Emergency Operating Procedures, Severe Accident Management Guidelines and

Extensive Damage Mitigation Guidelines. As stated in SECY-12-0025 (Reference 7),

the ANPR activities are in progress within the NRC, but the ANPR has not been issued.


The intent of this recommendation is fulfilled through U.S. EPR FSAR Tier 2, Sections

13.5 and 19.2.5 which include guidance for Emergency Operating Procedures, Severe

Accident Management Guidelines, and Extensive Damage Mitigation Guidelines. U.S.

EPR FSAR Tier 2, Section 13.5 provides the U.S. EPR design requirements for use of

site-specific information for administrative, operating, emergency, maintenance, and

other operating procedures. U.S. EPR FSAR Tier 2, Section 19.2.5 describes the

Operating Strategies for Severe Accidents methodology and requirements for

development and implementation of severe accident management guidelines prior to

fuel loading using this methodology for the U.S. EPR design.

3.11 NTTF Recommendation 9.3

3.11.1 Tier 1 Recommendations

A portion of Recommendation 9.3 is a Tier 1 recommendation that requires reactor

licensees to provide enhanced EP staffing and communications.

The U.S. EPR mitigation strategy for this recommendation is discussed in Section 4.3.

3.11.2 Tier 2 Recommendations

The remaining portion of Recommendation 9.3 is a Tier 2 recommendation that requires

reactor licensees to enhance their Emergency Plan (e.g., multiunit dose assessments,

periodic training).

U.S. EPR FSAR Tier 2, Section 13.3 discusses the U.S. EPR design requirements for

development of an Emergency Plan in accordance with 10 CFR 50.47 and 10 CFR

Part 50, Appendix E.


4.0 MITIGATION ASSESSMENT

4.1 NTTF 4.2, Mitigation of Beyond Design Basis External Events

4.1.1 Overview

In NTTF Recommendation 4.2 and NRC Order EA-12-049 (Reference 1), it is

postulated that a BDBEE can deterministically result in a simultaneous ELAP and loss

of normal access to the UHS. An ELAP event assumes a simultaneous loss of AC

power sources (LOOP plus loss of EDGs plus loss of alternate AC sources) for an

indefinite period. An evaluation of an ELAP event caused by a BDBEE was performed

for the U.S.EPR design. Mitigation strategies for the ELAP event have been developed

based on the guidance of NEI 12-06 (Reference 3). This FLEX guidance has been

endorsed by the NRC, with certain exceptions and clarifications provided in NRC

JLD-ISG-2012-01 (Reference 11). The U.S. EPR design conforms with

JLD-ISG-2012-01 (Reference 11) and NEI 12-06 (Reference 3), with certain

clarifications as discussed in Section 2.1 of this report.

For new plant designs, the scope of NRC Order EA-12-049 (Reference 1) spans both

the Design Certification and the Combined License. Accordingly, Section 4.1 focuses

on providing a baseline coping capability with installed equipment (Phase 1), providing

permanent plant connections, and identifying performance requirements for portable

equipment to support long-term event mitigation (interface provisions for Phase 2 and 3

actions).

Section 4.1 is divided into the following subsections:

• Section 4.1.2 summarizes the acceptance criteria for core cooling, containment

integrity, and spent fuel cooling.

• Section 4.1.3 describes the analytical codes and methods, key assumptions, and

results of the analyses performed.

• Section 4.1.4 summarizes the reasonable protection requirements of installed and

portable equipment.


• Section 4.1.5 provides the mitigation strategies for core cooling, containment

integrity, and SFP cooling capabilities following an ELAP event. These strategies

are based upon the analytical results provided in Section 4.1.3.

• Section 4.1.6 summarizes the sequence of events and critical operator actions.

• Section 4.1.7 summarizes the performance requirements for safety related,

non-safety related, and portable equipment used to implement the mitigation

strategies.

4.1.2 Acceptance Criteria

The acceptance criteria for the ELAP mitigation strategies are summarized in Table 4-1.

Table 4–1—Mitigation Strategy Acceptance Criteria

Function Acceptance Criteria

Core Cooling Fuel in core remains covered with liquid or two phase mixture – no fuel damage. Criticality – maintain core subcritical throughout the event.

Spent Fuel Cooling Fuel in SFP remains covered – no fuel damage.

Containment Integrity Containment pressure and temperature remain below design basis pressure and temperature limits.

These criteria are consistent with NEI 12-06 (Reference 3) which has been endorsed by

the NRC in JLD-ISG-2012-01 (Reference 11).

Adequate containment integrity is provided for these BDBEEs by conservatively

maintaining the containment pressure and temperature below the Reactor Containment

Building design basis limits. As described in U.S. EPR FSAR Tier 2, Section 3.8.1.1,

the containment design basis pressure limit is 62.9 psig (77.6 psia) and the containment

design basis temperature limit is 310°F. These criteria were chosen for the U.S. EPR

design since neither JLD-ISG-2012-01 (Reference 11) nor NEI 12-06 (Reference 3)

specify acceptance criteria for the containment function.


4.1.3 Analytical Bases

Order EA-12-049, “Order Modifying Licenses with regard to Requirements for Mitigating

Strategies for Beyond-Design-Basis External Events,” states that reactor licensees must

be capable of implementing the ELAP mitigation strategies in all modes.

This section provides information about the analyses performed that provide the basis

for the ELAP event mitigation strategies, including codes and methods used, key

assumptions, and the results of the analyses.

The scope of Section 4.1.3, Analytical Bases, is further divided into the following

subsections:

• Section 4.1.3.1 summarizes the transient core cooling analyses performed with

S-RELAP5.

• Section 4.1.3.2 summarizes the primary feed and bleed injection requirements.

• Section 4.1.3.3 summarizes the reactor coolant pump (RCP) seal leakage

evaluation.

• Section 4.1.3.4 summarizes the containment temperature and pressure analyses

performed with the GOTHIC (Generation of Thermal-Hydraulic Information for

Containments) computer code.

• Section 4.1.3.5 summarizes the Safeguard Buildings (SBs) heatup analysis.

• Section 4.1.3.6 summarizes the main control room (MCR) heatup analysis.

• Section 4.1.3.7 summarizes the main control room portable cooler sizing evaluation.

• Section 4.1.3.8 summarizes the SFP time to boil and makeup analysis.

• Section 4.1.3.9 summarizes the DC load shedding analysis.

Table 4-2 summarizes the key equipment status and operator actions for the various

operating Technical Specification modes and demonstrates how core cooling is

achieved in all modes. The operating Technical Specification modes are further broken


down for analytical purposes based on RCS initial conditions (e.g., RCS intact,

pressure, temperature, pressurizer (PZR) level), decay heat at time of ELAP event,

equipment availability changes within a mode (e.g., number of RCPs operating,

accumulators isolated, or low temperature overpressure protection (LTOP) enabled),

and potential differences between heatup and cooldown equipment operation. These

various modes were then grouped into “ELAP States” (i.e., ELAP State A, ELAP State

B, etc.). The ELAP States are further classified by their respective core cooling method:

• Steam Generators Available: Mitigation Strategy = Primary to Secondary Heat

Transfer (ELAP States A, B, and C).

• Steam Generators Not Available: Mitigation Strategy = Primary Feed and Bleed

(ELAP States D, E, and F).

Some of the key differences between the various ELAP States for the S-RELAP5

analyses are as follows:

ELAP State A: Trip from 100% power. All four RCPs were initially operating, RCS at

nominal PZR level, and all accumulators credited. This ELAP State

includes Modes 1 to 3.

ELAP State B: Decay heat at one hour after reactor shutdown. All four RCPs were

initially operating, RCS at nominal PZR level, and no accumulators

credited (although one is available). This ELAP State includes Modes

3 and 4.

ELAP State C: Mode 4 decay heat at seven hours after reactor shutdown, and Mode 5

decay heat at 15 hours after reactor trip. LTOP enabled. All four

RCPs were initially operating and one accumulator credited (at 320

psia). PZR level is at ~ 90%.

ELAP State D: Mode 5 decay heat at 16.67 hours after reactor shutdown. RCS intact

(pressurized). LTOP enabled. Four residual heat removal (RHR) trains

were initially in operation. No RCPs were initially operating and no


accumulators credited. PZR level is at ~ 100%. The SGs were

deterministically assumed to be unavailable due to outage conditions.

ELAP State E: Mode 5 decay heat at 16.67 hours after reactor shutdown. RV head

on and RCS vented (primary depressurization system (PDS) valves

open to pressurizer relief tank (PRT)). LTOP enabled, two RHR trains

were initially in operation. No RCPs were initially operating and no

accumulators credited.

ELAP State F: Mode 6 decay heat at 41.67 hours after reactor shutdown. RCS open

to containment (RV head removed). LTOP enabled. Two RHR trains

were initially in operation. No accumulators credited.


Table 4–2—ELAP States

Group Mode RCS Condition at time of ELAP

RCP Status

Accumulator Status

RCS Status

RCS Inventory

Key Operator Actions

STEAM GENERATORS AVAILABLE MITIGATION STRATEGY = PRIMARY TO SECONDARY HEAT TRANSFER

EL

AP

S

TA

TE

A

Mode 1 Power Operation 100% Power

Tavg = 594°F Pressure = 2250 psia

4 RCPs operating

4 accumulators active and available

Closed PZR nominal

level

• 4 SG cooldown at 90°F/hour to 100 psia secondary pressure

• Fire water to 4 SGs at 150 gpm for first 6 hours. Maintain SG level at 82.2% WR (+0%, -10%)

• After 6 hours, isolate fire water to SGs 3 and 4, bypass SGs 3 and 4 MSRIV solenoids to maintain valves open, and leave MSRCVs in current position. Feed SGs 1 and 2 to maintain level and control SG pressure at 100 psia with MSRCVs.

• Replenish Fire Water Storage Tank

Mode 1 Power Operation 5% - 100% Power

594°F ≥ Tavg ≥ 580°F Pressure = 2250 psia

Mode 2 Startup Power Decrease to 0%, Keff < 0.99

580°F ≥ Tavg ≥ 578°F Pressure = 2250 psia

Mode 3 Hot Standby Cooldown to 1015 psia

578°F ≥ Tavg > 350°F 2250 psia ≥ Pressure > 1015 psia Reactor is subcritical



RCP Status

Accumulator Status

RCS Status

RCS Inventory



EL

AP

S

TA

TE

B

Mode 3 Hot Standby Cooldown to 350°F

578°F ≥ Tavg > 350°F 1015 psia ≥ Press > 435 psia

4 RCPs operating

3 accumulators isolated, but

available; 1 active, but

depressurized to 320 psia.

No accumulators

credited

Closed PZR nominal

level

• 4 SG cooldown at 90°F/hour to 60 psia

• Fire water to 4 SGs at 150 gpm for first 6 hours. Maintain SG level at 82.2% WR (+0%, -10%)

• After 6 hours, isolate fire water to SGs 3 and 4, bypass SGs 3 and 4 MSRIV solenoids to maintain valves open, and leave SGs 3 and 4 MSRCVs in current position. Feed SGs 1 and 2 to maintain level and control SG pressure at 60 psia with MSRCVs.

• Start PCIP for RCS makeup at approximately 3 hours. Secure after regaining PZR level

Mode 4 Hot Shutdown Cooldown to 250°F

350°F > Tavg > 250°F 435 psia > Pressure > 370 psia



RCP Status

Accumulator Status

RCS Status

RCS Inventory



EL

AP

S

TA

TE

C

Mode 4 Hot Shutdown Cooldown to 200°F

250°F > Tavg > 200°F 435 psia > Pressure > 370 psia RHR connection point (~ 250°F and ~ 360 psia - Mode 4) LTOP overpressure protection by two PSRVs active at 248°F (P17) (525/541 psig)

RCPs 2 and 3

operating (RCPs 1

and 4 tripped at

250°F)




One accumulator

credited (320 psia)

Closed PZR level is raised to

~ 90%

• Steam through MSRTs once SG pressure reaches 40 psia. Position MSRCVs as necessary to maintain 40 psia.

• Fire water to 4 SGs for first 6 hours. Maintain SG level at 82.2% WR (+0%, -10%)




RCP Status

Accumulator Status

RCS Status

RCS Inventory



EL

AP

S

TA

TE

C

Mode 5 Cold Shutdown Cooldown to 130°F

200°F > Tavg > 130°F 370 psia > Pressure > 14.7 psia 4 RHR trains in operation LTOP overpressure protection by two PSRVs active at 248°F (P17) (525/541 psig)

Below 158°F,

only RCP 3 in

operation Below

131°F, no RCPs




One accumulator

credited (320 psia)

Closed PZR level is raised to

~ 90%

• Steam through MSRTs once SG pressure reaches 40 psia. Position MSRCVs as necessary to maintain 40 psia.

• Fire water to 4 SGs for first 6 hours. Maintain SG level at 82.2% WR (+0%, -10%)




RCP Status

Accumulator Status

RCS Status

RCS Inventory


STEAM GENERATORS NOT AVAILABLE MITIGATION STRATEGY = PRIMARY FEED AND BLEED

EL

AP

S

TA

TE

D

Mode 5 Cold Shutdown Cooldown to 130°F RCS pressure > 14.7 psia. SGs are unavailable

Tavg = 130°F 370 psia > Pressure > 14.7 psia 4 RHR trains in operation LTOP overpressure protection by two PSRVs active at 248°F (P17) (525/541 psig) SGs deterministically assumed to be unavailable due to outage conditions

No RCPs operating


available No

accumulators credited

Closed PZR at 100%

(PZR level is raised to 100% after last RCP is

tripped)

• Latch each PSRV open on its second lift

• PDS valve opened at 60 min

• PCIP activated at 60 min

EL

AP

S

TA

TE

E

Mode 5 and Mode 6 (RV head not removed, but detensioning started) Cold Shutdown Begin draindown and Midloop operation PDS Valves Opened RCS vented and SGs are unavailable

Tavg = 130°F Pressure = 14.7 psia LTOP overpressure protection by two PSRVs 2 RHR trains operating 1 set of PDS valves open

No RCPs operating


available No


Open to PRT

Drain to Midloop (Inlet to

PZR surge line

covered)


• Flow path is to PRT via 1 set of PDS valves

EL

AP

S

TA

TE

F

Mode 6 Refueling RV Head removed

Tavg < 130°F Pressure = 14.7 psia LTOP overpressure protection by two PSRVs 1 set of PDS valves open

No RCPs operating


available No


Open to PRT or open at

RV flange

Flange level or Canal

flooded


• Flow path is either out of RV flange or to PRT via 1 set of PDS valves


4.1.3.1 Core Cooling S-RELAP5 Analyses

The transient analyses of the core response for ELAP events initiated in Modes 1

through 6 were performed using S-RELAP5. ANP-10263(P)(A), “Codes and Methods

Applicability Report for the U.S. EPR” (Reference 16), justifies the use of S-RELAP5 on

the U.S. EPR design. S-RELAP5 is a thermal hydraulic simulation code that utilizes a

two-fluid (plus non-condensables) model with conservation equations for mass, energy,

and momentum transfer. For the ELAP State A analysis, the reactor core is modeled

with heat generation rates determined from reactor kinetics equations (point kinetics)

with reactivity feedback, and with actinide and decay heating. For the rest of the ELAP

States, the core power is modeled as a decay heat versus time including actinide

contributions.

The two-fluid formulation uses a separate set of conservation equations and constitutive

relations for each phase. The effects of one phase on another are accounted for by

interfacial friction and heat and mass transfer interaction terms in the conservation

equations. The conservation equations have the same form for each phase; only the

constitutive relations and physical properties differ.

The modeling of plant components is performed by following guidelines developed to

provide accurate accounting for physical dimensions and the dominant phenomena

expected during the transient. The basic building blocks for modeling are the hydraulic

volumes for fluid paths and the heat structures for heat transfer surfaces. In addition,

special purpose components exist to represent specific components such as the RCPs

and the SG moisture separators. Plant geometry is modeled at the resolution

necessary to resolve the flow field and the phenomena being modeled within practical

computational limitations.

S-RELAP5 models used in the performance of the ELAP analyses include heat

structures which represent the reactor and pressurizer vessels, RV internals, RCS loop

piping, fuel pellets and cladding, and the SG tubes, tubesheet, and wrapper. Model

enhancements, such as adding a PRT model, were included as necessary to ensure


that the problem solution included the pertinent plant equipment for each transient.

Simplifications to the models were also made as warranted, such as removing the

portion of the input that models the secondary side (during ELAP States D, E, and F), to

improve computational runtime performance. The topical reports that justify application

of the S-RELAP5 methodology and models to the U.S. EPR design are provided in

References 16, 17, and 19.

4.1.3.1.1 ELAP State A – Core Cooling for Events Initiated in Mode 1, Mode 2, and Mode 3 RCS >1000 psig

Analytical Methods

The analysis of the core response for ELAP events initiated in Modes 1 through 3

(ELAP event initiated at 100% power and SGs available) was performed using

S-RELAP5. The S-RELAP5 thermal hydraulic modeling code is described in

Section 4.1.3.1

Key Assumptions and Modeling Highlights

The analysis of core cooling for ELAP events initiated in ELAP State A that rely on the

SGs for heat removal was performed using the following key assumptions:

• The S-RELAP5 model was used with the following best estimate (or conservative)

assumptions and modeling highlights:

- Non-safety system capabilities (such as fire water system) are included in the

model, as appropriate (best estimate assumption).

- End of cycle core reactor kinetics (conservative assumption due to greater

positive reactivity insertion during cooldown).

- Best-estimate core decay heat (best estimate assumption).

- No stuck control rods (best estimate assumption).

- No single failures (best estimate assumption).

- No equipment out of service prior to event initiation (best estimate assumption).


These analysis assumptions are consistent with the requirements of Section 3.2.1,

“General Criteria and Baseline Assumptions,” of NEI 12-06 (Reference 3) as endorsed

by JLD-ISG-2012-01 (Reference 11) with the exception that the U.S. EPR design uses

end-of-cycle core reactor kinetics rather than an assumed 100 day power history (which

is less limiting).

• The ELAP event assumes a simultaneous loss of all AC power sources (LOOP, loss

of all EDGs, and loss of all alternate AC sources) in combination with a loss of

normal access to the UHS.

• The initiating ELAP event is assumed to occur when the plant is operating normally

at 100% full power.

• The ELAP event causes an immediate loss of power to the RCPs and main

feedwater pumps, followed by a reactor trip.

• The initial conditions of the RCS are as follows:

- PZR level is at nominal level (54.3%).

- RCS pressure is at 2250 psia.

- RCS average temperature is 594°F.

- All four accumulators are operable and pressurized to 681.7 psia.

• RCS leakage was assumed from the following two sources:

- Allowable RCS leakage per Plant Technical Specifications (11 gpm).

- RCP seal leakage. RCP seal leakage was modeled consistent with the SBO

analysis described in U.S. EPR FSAR Tier 2, Section 8.4. The RCP standstill

seal system (SSSS) is credited with limiting RCP seal leakage.

• The MSRTs are used to control pressure in the SGs so that the low head diesel-

driven fire water pump(s) can supply water to the SGs via the EFW header.

• Core decay heat is removed by means of primary to secondary heat transfer. Core

heat is transferred from the fuel to the reactor coolant, transported to the SGs by


natural circulation, transferred to the secondary side of the SGs, and transported to

the atmosphere by steaming the SGs through the MSRTs. The SGs will be fed from

the diesel-driven fire pump(s) when the SGs have been depressurized below the fire

pump discharge pressure.

• The following key operator actions are assumed in the analysis:

- The operator ensures that the automatic closure of all three seal leak-off isolation

valves for each RCP has occurred upon detection of simultaneous loss of seal

injection and thermal barrier cooling. At 15 minutes after the RCP trip occurs, the

operator ensures that the standstill seal has closed.

- RCS cooldown starts at 30 minutes after the initialization of ELAP. The pressure

in all four SGs is lowered at a rate that results in an RCS cooldown rate of

90°F/hour until SG pressure decreases to 100 psia. MSRTs are then throttled as

required to control SG pressures at 100 psia.

- Fire water is fed to four SGs at 150 gpm (each) when SG pressure is less than

fire pump discharge pressure. SG levels are controlled at 82.2% WR

(+0%, -10%) in each SG after level recovers.

- After six hours, fire water to SGs 3 and 4 is isolated, the SGs 3 and 4 MSRIV

solenoids are bypassed to maintain the valves open, and the associated main

steam relief control valves (MSRCVs) are left in their current position. Fire water

flow is continued to SGs 1 and 2 for the remainder of the analysis to maintain SG

levels, and the MSRCVs continue to be throttled to control SG 1 and 2 pressure

at 100 psia.

Results

S-RELAP5 cases were run to characterize the RCS response, timing of operator

actions, and latitude in potential FLEX mitigating strategies. With no mitigation actions,

core uncovering occurs in ELAP State A (Modes 1 through 3) at ~ 2.8 hours. Therefore,

operator actions are required to mitigate the consequences of an ELAP event in ELAP

State A. To mitigate these events, the operators are relied upon to control SG pressure


using the MSRTs and to control SG level with supply from the diesel driven fire water

pump. The acceptance criteria that the core remains covered and subcritical are met.

RCS makeup from the Primary Coolant Injection Pump (PCIP) is required after the first

24 hours to maintain PZR level and primary system subcooling.

The results of the Mode 1 through 3 (ELAP State A) case are depicted in Figure 4-1

through Figure 4-6. The key transient highlights for this case are as follows:

• At 30 minutes, an RCS cooldown of 90°F/hour is initiated with all four SGs. Once

SG pressure decreases to 100 psia, SG pressure will be controlled at 100 psia.

Cooldown with all four SGs provides a symmetric RCS response.

• During the initial cooldown, the RCS depressurizes due to RCS contraction.

• At ~ 1.2 hours, the PZR vessel empties due to RCS cooldown contraction and

assumed RCS leakage.

• At ~ 1.32 hours, the SGs are empty. SG3 empties slightly earlier than the other

three SGs due to the effects of the PZR and the slightly hotter fluid reaching the SG.

• Once the SGs are empty, the secondary pressure rapidly decreases as the MSRTs

try to maintain the cooldown rate. Approximately 10 seconds after SG dryout, SG

pressures reach 100 psia and fire water is delivered to all four SGs. SG level is not

recovered for another 1.2 hours.

• Accumulators begin to discharge at ~ 2.0 hours. The accumulators do not empty

during the analyzed duration of the transient.

• At ~ 2.53 hours, SG levels begin to recover. The levels are not on scale, but level is

beginning to increase. As decay heat decreases, the SG levels are increased to the

control point of 82.2% WR (+0%, -10%).

• At 3.75 hours, PZR level begins to recover. The pressurizer level initially recovers

due to accumulator injected fluid that expands. The expansion of the accumulator

fluid moves fluid into the pressurizer. As the cooler fluid reaches the RV upper

head, the upper head void partially collapses, once again leading to the loss of


pressurizer level. Eventually, the accumulator flow and its expansion lead to the

upper head void collapsing and the pressurizer level recovers again. However, this

does not occur for another six hours.

• Fire water flow to SGs 3 and 4 is terminated at 6 hours. The inventory in SGs 3

and 4 continue to boil off.

• SG 1 and 2 levels reach the control point of 82.2% WR (+0%, -10%) at ~ 7.4 hours

and then fire water flow is reduced to maintain SG levels.

• PZR level is regained at ~ 9.4 hours and remains above zero for the remainder of

the transient.

• SG 3 and SG 4 are empty at ~ 10.8 hours. The inventory has boiled off and has

once again led to a dryout condition.

• At ~16.8 hours, the fire water storage tank is replenished. Approximately 90% of the

300,000 gallons has been used.

The analysis was terminated at 24 hours since a viable mitigation strategy was

demonstrated. The Table 4-1 core cooling acceptance criteria that the core remains

covered and subcritical were met.


Figure 4-1— ELAP State A Pressurizer Pressure

Figure 4-2— ELAP State A Cold Leg Temperatures


Figure 4-3— ELAP State A Pressurizer Level

Figure 4-4— ELAP State A Steam Generator Pressure


Figure 4-5— ELAP State A Steam Generator Levels

Figure 4-6— ELAP State A Core Region Levels


4.1.3.1.2 ELAP State B – Core Cooling for Events Initiated in Modes 3 and 4 with RCS < 1000 psig and RCS > LTOP Enable Temperature

Analytical Methods

The analysis of the core response for ELAP events initiated in Modes 3 and 4

(accumulators isolated, LTOP not enabled, and SGs available) was performed using

S-RELAP5. The S-RELAP5 thermal hydraulic modeling code is described in

Section 4.1.3.1


The analysis of core cooling for ELAP events initiated in ELAP State B that rely on the

SGs for heat removal was performed using the following key assumptions and modeling

highlights:

• The S-RELAP5 model was used with the following best estimate assumptions:


model, as appropriate.

- Best-estimate core decay heat.

- No stuck control rods.

- No single failures.

- No equipment out of service prior to event initiation.



by JLD-ISG-2012-01 (Reference 11).




• The initiating ELAP event was assumed to occur when the reactor has been shut

down for one hour.


• The ELAP event causes an immediate loss of power to the RCPs and main

feedwater pumps.


- PZR level is at nominal level (34%).

- RCS pressure is at 1015 psia.

- RCS average temperature is 500°F.

- All four accumulators are isolated and are not credited in the analysis.




analysis described in U.S. EPR FSAR Tier 2, Section 8.4. The RCP SSSS is

credited with limiting RCP seal leakage.

• The MSRTs are used to control pressure in the SGs so that the low head, diesel-

driven fire water pump(s) can supply water to the SGs via the EFW header.




the atmosphere by steaming the SGs through the MSRTs. The SGs will be fed from

the diesel-driven fire pump(s) when the SGs have been depressurized below the fire

pump discharge pressure.







- RCS cooldown starts at 30 minutes after the initialization of ELAP. Steam

pressure in all four SGs is lowered at a rate that results in an RCS cooldown rate

of 90°F/hour until SG pressure decreases to 60 psia. MSRTs are then throttled

as required to control SG pressures at 60 psia.

- Fire water is fed to four SGs at 150 gpm (each) for the first six hours. SG level is

maintained at 82.2% WR (+0%, -10%) in each SG.

- After 6 hours, fire water to SGs 3 and 4 is isolated, the SG 3 and 4 MSRIV

solenoids are bypassed to maintain the valves open, and the associated

MSRCVs are left in their current position. Fire water flow is continued to SGs 1

and 2 for the remainder of the analysis to maintain SG levels, and the MSRCVs

continue to be throttled to control SG 1 and 2 pressure at 60 psia.

- The PCIP is started whenever pressurizer level is less than 60 inches (32 inches

indicated level) and RCS pressure is less than the PCIP shutoff head. The PCIP

will be stopped when RCS pressure approaches the PCIP shutoff head.

Results



core uncovering occurs in ELAP State B Modes 3 and 4 at ~ 6.6 hours. Therefore,

operator actions are required to mitigate the consequences of an ELAP event in ELAP

State B. To mitigate these events, the operators are relied upon to control SG pressure

using the MSRTs and to control SG level with supply from the diesel driven fire water

pump. The Table 4-1 core cooling acceptance criteria that the core remains covered

and subcritical are met. Primary system makeup from the PCIP is required three times

in the first 24 hours to maintain pressurizer level and primary system subcooling.

The results of the Mode 3 and 4 (ELAP State B) case are depicted in Figure 4-7 through

Figure 4-12. The key transient highlights for this case are as follows:


• At 30 minutes, an RCS cooldown of 90°F/hour is initiated with all four SGs. Once

SG pressure decreases to 60 psia, SG pressure will be controlled at 60 psia.

Cooldown with all four SGs provides a symmetric response.

• During this initial cooldown, the RCS depressurizes due to RCS contraction.

• At ~ 1.1 hours, the PZR empties due to RCS cooldown contraction and from

assumed RCS leakage.

• At 2.94 hours, the PCIP is started for the first time and is run for about one hour.

• At 3 hours, SG pressure reaches 60 psia and fire water is delivered to all four SGs.

• At 3.1 hours, the SGs are empty. SG3 empties slightly earlier than the other three

SGs due to the effects of the PZR and the slightly hotter fluid reaching the SG. SG

levels briefly go offscale but recover immediately (~ 5 minutes). As decay heat

decreases, the SG levels are increased to the control point of 82.2% WR (+0%, -

10%).


and 4 continues to boil off.

• At ~ 7.4 hours, the PCIP is started for the second time and is run for about

24 minutes.

• SGs 1 and 2 levels reach the control point of 82.2% WR (+0%, -10%) at ~ 8.1 hours

and then fire water flow is reduced to maintain SG levels.

• SG 3 and SG 4 are empty at ~ 10.1 hours. The SG inventory has continued to

slowly boil off and has once again led to a dryout condition.

• At ~ 19.7 hours, the PCIP is started for the third time and is run for about

42 minutes.

• At ~ 23.3 hours, the replenishment of the fire water storage tank is necessary.

Approximately 90% of the 300,000 gallons has been used.





Figure 4-7—ELAP State B Pressurizer Pressure


Figure 4-8—ELAP State B Cold Leg Temperatures

Figure 4-9—ELAP State B Pressurizer Level


Figure 4-10—ELAP State B Steam Generator Pressure

Figure 4-11—ELAP State B Steam Generator Level


Figure 4-12—ELAP State B Core Region Levels

4.1.3.1.3 ELAP State C – Core Cooling for Events Initiated in Modes 4 and 5 with RCS Pressurized and RCS < LTOP Enable Temperature

Analytical Methods

The analysis of the core response for an ELAP event initiated in Modes 4 and 5 (ELAP

State C – LTOP enabled and SGs available) was performed using S-RELAP5. The

S-RELAP5 thermal hydraulic modeling code is described in Section 4.1.3.1


The analysis of core cooling for ELAP events initiated in ELAP State C that rely on the

SGs for heat removal was performed using the following key assumptions and modeling

highlights:



model, as appropriate.













down for 7 hours for the Mode 4 case and 15 hours for the Mode 5 case. This is

conservative considering the amount of time necessary to reach these states from

the time of reactor shutdown.

• The ELAP event causes an immediate loss of power to the RCPs and all SG

feedwater pumps.


- PZR level is 90% full.

- For the Mode 4 case, RCS average temperature is 248°F. For the Mode 5 case,

RCS average temperature is 130°F.

- LTOP is enabled. The first pressurizer safety relief valve (PSRV) opens at

525 psig and the second PSRV opens at 541 psig.

- Three accumulators are isolated, but available; the fourth accumulator is active,

but depressurized to 320 psia.

- In Mode 4, two RCPs are operating and only one in Mode 5.










the atmosphere by steaming the SGs through the MSRTs. For these ELAP State C

cases, the RCS must heat up first in order to generate steam. The MSRTs are then

used to control the SGs at 40 psia. No secondary depressurization is required for

these ELAP State C cases because the fire pump discharge pressure exceeds the

SG control pressure.






- MSRTs are opened and used to control SG pressure once the SG pressure

increases to 40 psia.

- Simultaneous with opening the MSRTs, fire water is initiated to the four SGs as

required to maintain SG levels at 82.2% WR (+0%, -10%) in each SG.

- After six hours, fire water to SGs 3 and 4 is isolated and the SG 3 and 4 MSRIV

solenoids are bypassed to maintain the valves open. The SG 3 and 4 MSRCVs

are left in the position they were in at the time of fire water isolation. Fire water

flow is continued to SGs 1 and 2 for the remainder of the analysis to maintain SG

levels. The SG 1 and 2 MSRCVs continue to be throttled as required to maintain

SG 1 and SG 2 pressures at 40 psia.


Results



core uncovering occurs in both ELAP State C Modes 4 (~ 6.1 hours) and 5 (~ 10.1

hours) respectively. Therefore, operator actions are required to mitigate the

consequences of an ELAP event in ELAP State C. To mitigate these events, the

operators are relied upon to control SG pressure using the MSRTs and to control SG

level with supply from the diesel driven fire water pump. The Table 4-1 core cooling

acceptance criteria that the core remains covered and subcritical were met. Primary

system makeup from the PCIP is not required for at least 24 hours to maintain

pressurizer level and primary system subcooling.

Analyses were performed for ELAP events initiated in both Mode 4 and Mode 5 with the

steam generators available. The results for Mode 4 are more limiting than for Mode 5

because they consider a higher initial decay heat level and a higher initial RCS

temperature. Given this, the results of the limiting Mode 4 (ELAP State C) case are

depicted in Figure 4-13 through Figure 4-16. The key transient highlights for this case

are as follows:

• SG pressure initially increases and is then controlled at 40 psia for the remainder of

the transient. Steaming to the atmosphere is initiated at 0.6 hours.

• At 0.6, hours fire water flow is delivered to all four steam generators. SG levels are

then maintained at the control point of 82.2% WR (+0%, -10%).


and 4 continues to boil off.

• SG 3 and SG 4 are empty at 15.7 hours and 16.4 hours, respectively. The SG

inventory has continued to slowly boil off and led to a dryout condition.

• At 21 hours, flow from the one active accumulator begins to inject into the RCS. The

primary system pressure is then controlled by the accumulator. The accumulator

does not empty during the transient.


• Sometime after 24 hours, the fire water storage tank must be replenished.

• Throughout this transient, LTOP is not actuated. Therefore, the PSRVs do not lift.




Figure 4-13—ELAP State C RCS Pressures


Figure 4-14—ELAP State C RCS Cold Leg Temperatures

Figure 4-15—ELAP State C Steam Generator Levels


Figure 4-16—ELAP State C RCS Levels

4.1.3.1.4 ELAP State D – Core Cooling for Events Initiated in Mode 5 with RCS Filled and Pressurized (Steam Generators Unavailable)

Analytical Methods

The analysis of the core response for ELAP events initiated in Mode 5 (LTOP enabled

and SGs unavailable) was performed using S-RELAP5. The S-RELAP5 thermal

hydraulic modeling code is described in Section 4.1.3.1.

This S-RELAP5 model was used to calculate the time-to-boil and time-to-uncover the

core with the PZR level water solid. Cases were run to confirm successful primary feed

and bleed core cooling when injection of 300 gpm of water to the core was initiated at

60 minutes after event initiation.



The analysis of core cooling for ELAP events initiated in ELAP State D that rely on

primary side feed and bleed for heat removal was performed using the following key


• S-RELAP5 was used with the following best estimate assumptions:











• The initiating ELAP event was conservatively assumed to occur when the reactor

has been shut down for 16.67 hours. This is a conservative value of decay heat

assumed for this analysis; however, the overall timing constraint for entry into ELAP

State D is set by the containment GOTHIC analysis discussed in Section 4.1.3.4,

which assumed decay heat at 40 hours after shutdown.

• For the purposes of this analysis, the SGs were deterministically assumed to be

unavailable due to outage conditions.

• The ELAP event causes an immediate loss of power to the operating RHR system

pumps.


- PZR level is 100% full.


- RCS average temperature is 130°F and RCS pressure is 370 psia.

- LTOP is enabled. The first PSRV opens at 525 psig and the second PSRV

opens at 541 psig.

- Four accumulators isolated, but available; (no accumulators are credited).

- The RCS is intact and not vented.






• Since the SGs are assumed to be unavailable, core decay heat is removed by

primary feed and bleed cooling. Water from the in-containment refueling water

storage tank (IRWST) is injected into an RCS cold leg from the PCIP and then flows

through the core removing heat. The PCIP delivers at least 300 gpm at an RCS

pressure of 350 psia. Heated water, and eventually steam, from the core then flows

out the PZR PDS valves to the PRT. The PRT fills and pressurizes until one of the

PRT rupture discs bursts, which opens the RCS bleed flow path to the containment

atmosphere.






- As needed, the operator latches the PSRV open after the second lift to minimize

repeated open/reseat cycles.

- At 60 minutes, the PDS valves are opened and the PCIP is started.


Results



the time-to-boil was calculated as ~ 68.1 minutes and the time to uncover was

calculated at ~ 3.7 hours. Therefore, operator actions are required to mitigate the

consequences of an ELAP event in ELAP State D. To mitigate these events, the

operators are relied upon to open one set of PDS valves to provide a vent path and to

start the PCIP to establish primary side feed and bleed cooling. The Table 4-1 core

cooling acceptance criterion that the core remains covered was met as indicated by the

upper node in the core remaining below a 95% void fraction (5% liquid). The upper core

remained cooled by a two-phase mixture. The RCS was refilled from the IRWST, which

resulted in a high boron concentration in the reactor pressure vessel. As a result, the

Table 4-1 core cooling acceptance criterion for criticality was also met.

The results of the Mode 5 (ELAP State D) case are depicted in Figure 4-17 through

Figure 4-19. The key transient highlights are as follows:

• At ~ 1.2 minutes, the PSRV lifts for the first time due to LTOP actuation.

• At ~ 2.9 minutes, the PSRV lifts for the second time due to LTOP actuation. The

operator latches the PSRV open after the second lift to minimize repeated

open/reseat cycles.

• At ~ 30.5 minutes, one of the PRT rupture discs fails. The peak RCS pressure after

PRT rupture disc failure occurs at ~ 3.37 hours.

• At 60 minutes, the operators open the PDS valves and start the PCIP.

• At ~ 63.9 minutes the RCS begins to boil. Note that this time to boil is slightly

shorter than with no mitigating actions since the PCIP flow reduces the RCS

pressure, which in turn reduces the RCS saturation temperature.


The analysis was terminated at ~ 5.6 hours since a viable mitigation strategy was



Figure 4-17—ELAP State D RCS Pressures


Figure 4-18—ELAP State D Primary Temperatures

Figure 4-19—ELAP State D RPV Volume Fractions


4.1.3.1.5 ELAP State E – Core Cooling for Events Initiated in Mode 5 with RCS Drained and Mode 6 with the RV Head Not Removed

Analytical Methods

The analysis of the core response for an ELAP event initiated in Mode 5 (RCS drained)

and Mode 6 (RV head not removed, LTOP enabled, and SGs unavailable), was

performed using S-RELAP5. The S-RELAP5 thermal hydraulic modeling code is

described in Section 4.1.3.1.


The analysis of core cooling for ELAP events initiated in ELAP State E that rely on



• S-RELAP5 was used with the following best estimate assumptions:











• The initiating ELAP event was conservatively assumed to occur when the reactor

has been shut down for 16.67 hours.


pumps.



- Prior to draining the RCS, the PDS valves are opened to vent the RCS to the

PRT.

- The RCS is intact with the exception of the open PDS flowpath. The pressurizer

manway will not be used as a vent during the draindown or assumed open in the

analysis.

- RCS water level at 1 foot below RV flange.

- RCS average temperature is 140°F and RCS pressure is 14.7 psia. The RCS is

vented to the PRT via the PDS valves.

- LTOP is enabled. However, the PSRVs are not actuated because the PDS flow

path provides sufficient venting.


• Since the steam generators are unavailable, core decay heat is removed by primary

feed and bleed cooling. Water from the IRWST is injected into RCS loop 1 cold leg

from the PCIP and then flows through the core removing decay heat. The PCIP

delivers at least 300 gpm at an RCS pressure of 350 psia. Heated water, and

eventually steam, from the core then flows out of the RCS through the PZR PDS

valves to the PRT. The PRT fills and pressurizes until one of the PRT rupture discs

bursts, and then the RCS bleed flow path is directed to the containment atmosphere.






- At 60 minutes, the PCIP is started.


Results


actions, and latitude in potential FLEX mitigating strategies. With no mitigation actions

and the RCS at an initial water level of 1 foot below the RV flange, the time-to-boil was

calculated as ~ 2.9 minutes and the time to uncover was calculated at ~ 2 hours.

Therefore, operator actions are required to mitigate the consequences of an ELAP

event in ELAP State E. To mitigate these events, the operators are relied upon to start

the PCIP to establish primary side feed and bleed cooling. The RCS vent path is

established prior to entering ELAP State E by opening one set of PDS valves. The

Table 4-1 core cooling acceptance criterion that the core remains covered was met as

indicated by the upper node in the core remaining below a 95% void fraction (5% liquid).

The upper core remained cooled by a two-phase mixture. The RCS was refilled from

the IRWST, which resulted in a high boron concentration in the RV. As a result, the


The results of the Mode 5 and 6 (ELAP State E) cases are depicted in Figure 4-20

through Figure 4-22. The key transient highlights are as follows:

• At ~ 2.9 minutes, the RCS begins to boil.

• At 60 minutes, the operators start the PCIP.

• At ~75.4 minutes, the RCS pressure peaks at 336 psia and one of the PRT rupture

discs bursts.

• Throughout this transient, LTOP is not actuated. Therefore, the PSRVs do not lift.





Figure 4-20—ELAP State E RCS Pressures

Figure 4-21—ELAP State E Primary Temperatures


Figure 4-22—ELAP State E RPV Volume Fractions

4.1.3.1.6 ELAP State F – Core Cooling for Events Initiated in Mode 6 with the RV Head Removed

Analytical Methods

The analysis of the core response for ELAP events initiated in Mode 6 with the RCS

drained and RV head removed was performed using S-RELAP5. The S-RELAP5

thermal hydraulic modeling code is described in Section 4.1.3.1.


The analysis of core cooling for ELAP events initiated in ELAP State F that rely on















down for 41.67 hours.


pumps.


- RV head is off.

- RCS water level is at 1 foot below the RV flange.

- RCS average temperature is 140°F and RCS pressure is 14.7 psia.


• Since the steam generators are unavailable, core decay heat is removed by primary

feed and bleed cooling. Water from the IRWST is injected into an RCS cold leg from

the PCIP and then flows through the core removing decay heat. The PCIP delivers

at least 300 gpm at an RCS pressure of 350 psia. Heated water and steam from the

core then flows out of the top of the RV flange to the containment atmosphere.


- At 60 minutes, the PCIP is started.


Results

With no mitigation actions and the RCS at an initial water level of 1 foot below the RV

flange, the time-to-boil was calculated as ~ 3.3 minutes and the time to uncover was

calculated at ~ 73 minutes. Therefore, operator actions are required to mitigate the

consequences of an ELAP event in ELAP State F. To mitigate these events, the

operators are relied upon to start the PCIP to establish primary side feed and bleed

cooling. The RCS vent path is provided by the open RPV head. The Table 4-1 core

cooling acceptance criterion that the core remains covered was met. The core remains

subcritical as a result of injection of IRWST water with the PCIP. As a result, the


The results of the Mode 6 (ELAP State F) case are depicted in Figure 4-23. The key

transient highlights are as follows:

• At ~ 3.3 minutes, the RCS begins to boil. Note that due to the low RCS inventory

and rapid boiling, there is a large liquid water swell from the RV into the containment

(approximately half of the RCS initial liquid inventory).

• At 60 minutes, the operators start the PCIP.

• Because the RV head is removed, LTOP is not actuated and the PSRVs do not lift.


demonstrated. The Table 4–1 core cooling acceptance criteria that the core remains



Figure 4-23—ELAP State F Fuel Temperature for a 60 Minute Delay in the Start of Injection

4.1.3.2 Primary Feed and Bleed Injection Requirements

For an ELAP event initiated in ELAP State D, E, or F, primary side feed and bleed

cooling is used as the method to remove core decay heat. With this core cooling

method, two types of analyses were performed:

• Core cooling analyses to determine heat removal requirements.

• Boron precipitation analyses to determine long-term core cooling requirements to

prevent boron precipitation.

4.1.3.2.1 Heat Removal Requirements

Key Assumptions

The analysis of core cooling for an ELAP event initiated in ELAP State D, E, or F was

performed using the following key assumptions:


• The RCS is adequately vented to remove core decay heat in the primary feed and

bleed mode. Methods to vent the RCS in ELAP States D, E, and F are summarized

in Table 4-2.

• Boiling in the core is acceptable for core cooling, provided the core remains covered

with liquid or two phase mixture (refer to Section 4.1.2).

• Best estimate decay heat.

• The earliest time to enter Mode 5 or Mode 6 following a normal plant shutdown is

16.67 hours. This conservative time establishes the maximum amount of core

decay heat that must be removed in ELAP State D, E, or F.

Methodology

For short-term core cooling in ELAP State D, E, or F, analysis was performed to

determine injection flow requirements.

The injection flow requirements to replace boil off was determined using:

Q = W (ho – hi)

where,

Q (BTU/hour) = Decay heat.

W (lbm/hour) = Injection flow rate.

ho (BTU/lbm) = Core exit enthalpy (this corresponds to the enthalpy of saturated

steam at 212°F).

hi (BTU/lbm) = Injection flow enthalpy corresponding to the injection flow

temperature.

Results

The calculated injection flow required to replace boil off at 16.67 hours after shutdown

was approximately 230 gpm assuming an injection flow temperature of 212°F.


Based on these results, the following insights can be drawn:

• RCS makeup should be restored as quickly as practicable. At a minimum, a

continuous RCS injection rate of 230 gpm is needed to maintain adequate

inventory above the top of the fuel and remove core decay heat.

• Borated makeup water should be used as the injection source. The boron

concentration should be equivalent to the concentration of the IRWST to ensure

long-term subcriticality.

4.1.3.2.2 Boron Precipitation

Key Assumptions

The analysis of boron precipitation for an ELAP event initiated in ELAP State D, E, or F

was performed using the following key assumptions:

• The earliest time to enter ELAP State D or E following a normal plant shutdown is

approximately 16.67 hours. The earliest time to enter ELAP State F is

approximately 41.67 hours. Utilizing the decay heat at 16.67 hours after shutdown

conservatively establishes the maximum amount of core decay heat that must be

removed.

• RCS makeup flow in excess of boil off refills the RCS, and conservatively, only once

the cold-side is refilled, increases the mixing volume.

• The following additional assumptions were made consistent with U.S. EPR FSAR

Tier 2, Chapter 15, loss of coolant accident (LOCA) boron precipitation analysis:

- The boron solubility limit is 38,500 ppm based on mixing with cold IRWST water

and saturated core water at 14.7 psia.

- The boil-off rate is based on the ANS 1973 decay heat standard with 20%

uncertainty.

- There is no credit for inlet subcooling.


Methodology

In ELAP State D, E, or F, core cooling is maintained in the long term by pumped flow

from the IRWST. The borated water from the IRWST provides a means for the core to

remain subcritical, but causes a boron precipitation concern because of an increase in

concentration from the decay heat boil off. An analysis was performed based on the

U.S. EPR FSAR Tier 2, Chapter 15, LOCA boron precipitation methodology to

determine the minimum injection flow rate needed to preclude boron precipitation.

The minimum flow rate to reach the solubility limit was determined. Sensitivity studies

were also performed with different flow rates and a best estimate decay heat model.

Results

Summary results of these analyses are presented in Figure 4-24. Based on these

results and the analyses performed, the following insights can be drawn:

• Even with conservative decay heat assumptions, boron solubility limits are not

approached for at least eight hours from the start of the ELAP event.

• A minimum RCS makeup flow rate of 300 gpm is sufficient to remove core decay

heat and preclude boron precipitation using the conservative assumptions of this

analysis. This result is reflected in the S-RELAP5 transient analyses for ELAP

States D, E, and F described in Section 4.1.3.1.

• An RCS makeup flow rate of 330 gpm provides margin to remove core decay heat

and preclude boron precipitation, and is recommended for long-term event

mitigation. This result is reflected in the sizing of the PCIP as shown in Table 4–21.


Figure 4-24—Boron Precipitation Analysis Results

4.1.3.3 RCP Seal Leakage

Following a BDBEE that results in an ELAP event, the normal methods of cooling the

RCP seals with the RCP thermal barrier coolers and RCP seal injection are lost. The

ELAP transient is similar to the SBO event that has been evaluated in U.S. EPR FSAR

Tier 2, Section 8.4. In the U.S. EPR SBO mitigation strategy, the RCP SSSS is relied

upon to close to limit RCP seal leakage. A similar strategy can be applied to the ELAP

transient provided the plant parameters are maintained within the RCP SSSS

qualification envelope.

For SBO mitigation, qualification testing was performed to demonstrate that the RCP

SSSS would limit seal leakage to less than 0.5 gpm per pump for 24 hours. During the

qualification tests, the RCP SSSS was subjected to the temperature and pressure

profile which would bound an SBO event.


Based on the qualification test results, an evaluation was performed to confirm that the

SBO qualification testing envelope bounded the ELAP primary to secondary heat

transfer cooling transient for events initiated in Modes 1 through 5 during the initial

24-hour time period. For long-term ELAP event mitigation (i.e., beyond 24 hours),

additional loss of RCP seal cooling tests are required for the standstill seal. Test

conditions will bound the full range of RCS conditions (temperature and pressure) that

are expected for long-term mitigation of an ELAP event initiated in ELAP States A, B,

and C (with SGs available for cooling).

The purpose of this qualification testing is to validate the RCP SSSS leak rate and

integrity of the SSSS when exposed to ELAP conditions on a long term basis.

ITAAC 7.9 in Table 2.2.1-5 of U.S. EPR FSAR Tier 1, Section 2.2.1 has been

established to validate the results of this testing prior to fuel load.

4.1.3.4 Containment Temperature and Pressure Control (Integrity)

Analytical Methods

Containment temperature and pressure control were evaluated using the GOTHIC

computer code. GOTHIC is a general purpose thermal-hydraulics software package for

design, licensing, safety, and operating analysis of nuclear power plant containments

and other confinement buildings. Appropriate heat transfer and fluid flow correlations

are used depending on fluid state. Special process models are used for components

such as doors, valves, heat structures, and break junctions. GOTHIC solves the

conservation equations for mass, momentum, and energy for multi-component, multi-

phase flow. The phase balance equations are coupled by mechanistic models for

interface mass, energy, and momentum transfer that cover the entire flow regime from

bubbly flow to film/drop flow, as well as single phase flows. The interface models allow

for the possibility of thermal non-equilibrium between phases and unequal phase

velocities.

GOTHIC has previously been used to analyze the containment response as discussed

in U.S. EPR FSAR Tier 2, Section 6.2. BAW-10252PA-00, “Analysis of Containment


Response to Pipe Ruptures using GOTHIC” (Reference 19), and ANP-10299P,

Revision 2, “Applicability of AREVA NP Containment Response Evaluation Methodology

to the U.S. EPR™ for Large Break LOCA Analysis Technical Report” (Reference 20),

are topical reports that justify application of the GOTHIC methodology to the U.S. EPR

design. Because the ELAP scenario is characterized by a slow, but continuous

containment pressurization and heatup, the GOTHIC containment response

methodology is an appropriate choice for this ELAP analysis.


The GOTHIC analysis of containment response was performed using the following key

assumptions and inputs:

• The GOTHIC subdivided multi-node containment model was used as the base

model.

• As discussed in Section 4.1.2, containment integrity is conservatively ensured by

maintaining the containment pressure and temperature below the Reactor

Containment Building design basis limits (62.9 psig (77.6 psia) and 310°F).

• ELAP events were assumed to occur in states where the steam generators are

relied upon for core decay heat removal (ELAP States A, B, and C), as well as in

states where primary feed and bleed cooling is relied upon for core decay heat

removal (ELAP States D, E, and F). Plant conditions in these various ELAP States

are summarized in Table 4-2. Mass and energy releases from RCS leakage were

modeled, along with sensible energy from the primary side and secondary side.

Mass and energy releases from RCS leakage were based on the pertinent core

cooling analysis for events initiated in modes with SGs available (refer to ELAP

States A, B, and C in Section 4.1.3.1), as well as in modes with SGs unavailable

(refer to ELAP States D, E, and F in Section 4.1.3.1).

• For ELAP State D with steam generators unavailable, containment analyses

assumed a best estimate value of decay heat at 40 hours after shutdown for these

conditions.


• Peak containment temperature and pressure will be limited using containment spray.

The containment spray will transport heat from the containment atmosphere into the

IRWST, which increases the IRWST temperature. Heat from the IRWST will then be

rejected to the environment through the severe accident heat removal system

(SAHRS) heat exchanger which will be cooled using a portable component cooling

water source. Using this mitigation strategy, the GOTHIC analyses were performed

subject to the following assumptions:

- The SAHRS pump is re-powered and has a nominal flow rate of 232 lb/s.

- The portable cooling water source has the same flow rate as the dedicated

component cooling water system, which is nominally 307 lb/s (~ 2218 gpm). The

temperature of the portable cooling water source is assumed to be a constant

90°F.

- The SAHRS pump is not started until 16.67 hours after the ELAP event occurs.

- For the ELAP State D case (which is the enveloping case), the ELAP event is

assumed to occur 40 hours after shutdown.

Results

GOTHIC analyses were performed to determine the general timing of containment

heatup and pressurization, to determine the limiting mode for the ELAP event accident

initiation relative to containment response, and to assess the overall feasibility of using

the containment spray to manage the containment temperature and pressure response.

Based on these analyses, the following insights can be drawn:

• For an event initiated in ELAP States A, B, and C with SGs available for core decay

heat removal, the GOTHIC analysis was run to 24 hours with no operator action.

The maximum containment pressure at 24 hours was 20.1 psia. The projected time

to reach the containment design basis pressure and temperature was greater than

48 hours.

• For an event initiated in ELAP States D, E, and F, the SAHRS pump, heat

exchangers, and portable cooling water are placed in service at 16.7 hours after the


ELAP event. The GOTHIC analyses demonstrate that the containment pressure

and temperature can be maintained within design basis limits indefinitely. Therefore,

this mitigation strategy fulfills the Table 4-1 containment acceptance criterion.

• The limiting case from a containment heat removal perspective is for ELAP events

initiated in ELAP State D. The results of the GOTHIC analysis for this limiting case

are depicted in Figure 4-25 and Figure 4-26.

• The GOTHIC containment analyses demonstrated that containment heatup and

pressurization following an ELAP event is a slow transient that provides ample time

for operator action. Containment spray represents a viable mitigation strategy to

maintain containment integrity.

Figure 4-25—Containment Pressure with Containment Spray


Figure 4-26—Containment Temperature with Containment Spray

4.1.3.5 Safeguard Buildings Heatup Analysis

Analytical Methods

The GOTHIC computer code was used to evaluate heatup of the SBs. Refer to

Section 4.1.3.4 for a description of the GOTHIC code.

• SB 1 and SB 2 were evaluated for a loss of all forced ventilation resulting from an

ELAP event. The ELAP event mitigation strategies described in Section 4.1.5

generally rely on equipment located in SB 1 and SB 2 in the long-term.

• The initial heatup of SB 3 and SB 4 was also evaluated as it relates to short-term

ELAP event mitigation. For long-term ELAP event mitigation, the only equipment

relied upon in these buildings are the SAHRS pump and associated equipment (e.g.,

switchgear). For long-term ELAP event mitigation using equipment in SB 3 and

SB 4, note that cooling of the SB 4 switchgear room that houses the switchgear that


powers the SAHRS pump is required if the portable 480V generator is used to

repower the SAHRS pump instead of the ELAP diesel generator.

SB 1 was modeled by dividing the building into homogeneous temperature regions

(control volumes) corresponding to rooms, which were evaluated individually with heat

transfer to adjoining regions being considered. These control volumes included all

rooms on the +26ʹ-7ʺ elevation and the battery room on the +15ʹ elevation. Heat loads

were modeled as heaters within each control volume. Further, note that SB 1 is

physically symmetric to SB 4.

SB 2 was modeled by dividing the building into homogeneous temperature regions

(control volumes), which were evaluated individually with heat transfer to adjoining

regions being considered. In areas with insignificant heat loads that were not expected

to challenge equipment operability limits, these areas were grouped together into a

single control volume for model simplification. Heat loads were modeled as heaters

within each control volume. Further, note that SB 2 is physically symmetric to SB 3.

Key Assumptions

The GOTHIC analyses of the SBs response were performed using the following key


• Since SB 1 is physically symmetric to SB 4 and SB 2 is physically symmetric to

SB 3, it was only necessary to analyze the symmetric pair with the higher heat loads

(i.e., either SB 1 and SB 2 or SB 3 and SB 4). Since the heat loads in SB 1 and

SB 2 were higher than the heat loads in SB 3 and SB 4, the GOTHIC analysis was

limited to heatup of SB 1 and SB 2. This modeling assumption ensures that the

analyzed temperatures for SB 3 and SB 4 initially (before 7 hours) remain below

acceptable limits if SB 1 and SB 2 temperatures remain below acceptable limits.

• Initially, air flow between rooms is not modeled for conservatism. The warmer

rooms will pressurize slightly resulting in a small amount of air flow through

doorways to cooler rooms. One exception to this is flow between a switchgear room

and another control volume consisting of the other switchgear room and the hall in


SB 2. The door to the switchgear room contains a two-foot by four-foot grating in it

to allow airflow. A similar door grating is also provided on the corresponding door to

the SB 3 switchgear room.

• Room temperatures begin at the maximum normal temperature and 60% humidity.

Additionally, the ambient temperature is 100°F, consistent with Section 4.1.4.1.5.

• Radiation heat transfer is neglected.

• The maximum heat input of 8.3 kW for the SB 4 switchgear room occurs when the

portable 480V generator, instead of the ELAP diesel generator, is used to power the

SAHRS pump. If the portable 480V generator is used to power the SAHRS pump, a

portable cooler with at least 8.3 kW heat removal capacity must be placed in service

to ensure that the temperature in the switchgear room remains below the

acceptance criteria. The portable cooler must be placed in service at the same time

as the Division 4 portable 480V generator.

• Since the ELAP transient is similar to the SBO event that has been evaluated in U.S.

EPR FSAR Tier 2, Section 8.4, the SBO equipment temperature acceptance criteria

were used for this evaluation. This approach is consistent with Section 3.2.1.8 of

NEI 12-06 (Reference 3).


- At 30 minutes, three specified doors on the +26ʹ-7ʺ elevation of SB 1 and SB 4,

and five specified doors on the +26ʹ-7ʺ elevation of SB 2 and SB 3 are opened.

- At 7 hours, forced ventilation to SB 1 and SB 2 is restored. SB supply and

exhaust fans are not re-started for SB 3 and SB 4.

- At 25 hours, seven specified doors on the +39ʹ elevation of SB 2 are opened to

ensure that the temperature in these rooms remain below the acceptance

criteria.


Results

The results of the analyses indicated that all areas of SB 1 and SB 2 were maintained

less than the acceptance criterion of 131°F. The acceptance criterion of 131°F is based

upon the temperature limit for indefinite operation of battery chargers and inverters.

The most limiting room in SB 1 was the switchgear room, which reached a temperature

of 129.1°F. The most limiting room in SB 2 was the switchgear room, which reached a

temperature of 127.2°F. After initiation of forced flow at seven hours, the temperature

trends in all areas of SB 1 and SB 2 indicated that temperatures would be maintained

less than 131°F indefinitely.

4.1.3.6 Main Control Room Heatup Analysis

Analytical Methods

The GOTHIC computer code was used to conduct a parametric study of heatup of the

MCR following a loss of forced ventilation. Refer to Section 4.1.3.4 for a description of

the GOTHIC code. The MCR was modeled as a single node with a single heat

structure comprised of concrete with a painted surface. The concrete surfaces of the

room, as well as the free volume of air, served as heat sinks. The heat load was

modeled as a heater. The parametric study examined changes in free volume, heat

source, and concrete surface area.


The GOTHIC analysis of MCR response was performed using the following key


• The MCR and the shift office were assumed to constitute a single, homogeneous,

free volume with concrete walls, ceiling, and floor.

• The MCR was assumed to have a drop ceiling that reduced the available free

volume and concrete surface area. Additionally, the free volume of the MCR was

further reduced for conservatism.


• The thickness of the concrete walls, floor, and ceiling was conservatively assumed

to be half the thickness. The wall was conservatively treated as an insulated

boundary, which thermally isolated the MCR from the surrounding rooms.

• The surface area of the walls, floor, and ceiling was reduced for conservatism.

• The concrete surface was assumed to be painted, with the thickness and properties

of the coating typical for painted surfaces.

• The initial room temperature was conservatively assumed to be 80°F.

Results

The parametric study demonstrated that if ventilation or cooling is not restored to the

MCR for at least seven hours following an ELAP event, then:

• The MCR temperature would not exceed 110°F for at least seven hours during an

ELAP event with a heat load less than 10 BTU/sec and an initial temperature less

than 80°F.

• The MCR temperature would not exceed 95.1°F if the heat load is not more than

5 BTU/sec.

4.1.3.7 Main Control Room Portable Cooler Sizing Evaluation

Analytical Methods

An evaluation was performed to determine the total heat input to the U.S. EPR MCR

following an ELAP event to determine the minimum performance requirements for a

portable cooler (air conditioner) for the MCR. The evaluation considered the heat loads

from personnel and MCR equipment energized during an ELAP event to determine the

total MCR heat load. This total MCR heat load was then compared against the

GOTHIC parametric study results described in Section 4.1.3.6 to confirm that heatup of

the MCR was acceptable. Additionally, this total MCR heat load was used to size a

portable cooler for the MCR.


Key Assumptions

• The total heat load for the MCR is estimated at 4.36 BTU/sec. This reflects the

following assumptions:

- Five operators were assumed in the MCR with heat input from each operator

assumed to be 475 BTU/hr.

- Heat input to the MCR from emergency lighting (E-LGT) is 1.5 kW.

- Heat input from the safety information and control system (SICS) cabinets in the

MCR is assumed to be 2.4 kW.

Results

The evaluation determined that the MCR heat input rate was 4.36 BTU/sec, or about

16,000 BTU/hour. Examination of the results of the MCR heatup parametric study

described in Section 4.1.3.6 indicated that with a heat load of 5.0 BTU/sec, the MCR

temperature will rise at most to 95.1°F within seven hours. Based on these results, the

minimum portable cooler size was conservatively set at 32,000 BTU/hr (i.e., twice the

expected heat load) to provide the capability to cool down the MCR. The portable MCR

cooler would need to be placed in service within seven hours of the ELAP initiating

event to maintain acceptable temperatures in the MCR.

4.1.3.8 Spent Fuel Pool Time to Boil and Makeup Analysis


The SFP time to boil and makeup analysis was performed using the following key


• During an ELAP event, spent fuel cooling by the SFP cooling system heat

exchangers is lost. Heatup of the SFP and boiling can be credited to cool the spent

fuel, provided the water level is maintained above the top of the spent fuel (refer to

Section 4.1.2). This spent fuel cooling strategy is consistent with the NRC staff

guidance given in Question 5.8.4 in NUREG-1628, “Staff Responses to Frequently


Asked Questions Concerning Decommissioning of Nuclear Power Reactors”

(Reference 25).

• SFP initial temperature is 120°F.

• The maximum SFP heat load was assumed at 130 hours after reactor shutdown

based on a full core off-load. This SFP heat load conservatively assumes at least

15% excess margin.

• Heat losses from the SFP are conservatively neglected.

• Initial SFP water level is conservatively assumed to be 55ʹ 6". This value is

conservative because it is below the elevation of the lowest non-seismic Category 1

piping penetration.

• It is assumed that the total volume of water in the SFP remains constant during

heatup. Water level increase due to density decrease is neglected.

• Ten feet of water above the top of the fuel is considered the minimum level for

adequate radiation shielding. Radiation levels in the SFP area will begin to increase

dramatically when level decreases below this point.

Analytical Methods

The SFP time to boil and makeup analysis was performed to determine the bulk SFP

heatup time and boil-off rate.

The SFP bulk heat-up time is conservatively calculated using:

Δt = MCpΔT/Q

where,

Δt (hours) is the time to complete the temperature rise.

M (lbm) is the mass of water in the SFP.

Cp (BTU/lbm°F) is the specific heat of water.

ΔT (°F) is the temperature rise.


Q (BTU/hr) is the heat added to the SFP from the spent fuel stored in the pool.

The boil-off rate is calculated using:

Boil off Rate = Q / hfg

where,

Boil off Rate (lbm/hr) is the rate that mass is lost from the SFP due to boiling.

Q (BTU/hr) is the heat added to the SFP from the spent fuel stored in the pool.

hfg (BTU/lbm) is the latent heat of evaporation of water.

The evaporation time is calculated using:

Tevap = M / Boil off Rate

where,

Tevap (hours) is the time to boil down to the specified level.

M (lbm) is the mass of water above the specified level.

Boil off Rate (lbm/hr) is the rate that mass is lost from the SFP due to boiling.

Results

Based on these analyses, the following insights can be drawn:

• During a full core offload refueling condition, the time to reach SFP bulk boiling

following the loss of all SFP cooling is approximately 3.5 hours. The initial boil-off

rate is 140 gpm. The boil-off rate decreases over time as the spent fuel decay heat

decreases.

• If spent fuel cooling is not restored, then an additional 22.6 hours is available to boil

off the pool inventory while maintaining the level above the top of the spent fuel

racks (refer to Section 4.1.2). Therefore, the total time to uncover the spent fuel

(from a temperature of 120°F) is approximately 3.5 + 22.6 hours = 26.1 hours.


• SFP level will boil down to 10 feet above the top of the fuel in the fuel racks 12 hours

after boiling begins (15.5 hours after initiation of the event).

• Since the operators have approximately 26.1 hours to restore cooling and/or

makeup to the SFP, boiling of the SFP can be credited as the Phase 1 event

mitigation method, and cooling and/or makeup to the SFP can be credited for

Phases 2 and 3 event mitigation.

• For conservatism, operator action at 15.5 hours after ELAP event initiation will

ensure that the SFP level remains at least 10 feet above the top of the fuel in the

fuel racks. This conservatively meets the Table 4-1 spent fuel cooling acceptance

criterion and protects the operators for local actions in proximity to the SFP.

4.1.3.9 DC Load Shedding

Analytical Methods

To determine how long the Class 1E uninterruptible power supply (EUPS) system

battery capacity can be extended during an ELAP event, the following process was

used:

• The loads on the EUPS battery were identified based on the design basis accident

EUPS battery sizing calculation and the Electrical Load List.

• Loads required for ELAP Phase 1 scenario mitigation were identified and their

operation defined.

• Loads to be shed from the EUPS battery for an ELAP event were identified.

• The time elapsed before ELAP load shedding takes place was identified.

• The ELAP EUPS duty cycle was defined by applying the ELAP Phase 1 equipment

operation and load shedding sequence to the loads supplied by the EUPS battery.

• The margins to apply for the EUPS batteries during an ELAP event were

determined.


• The duration of battery discharge availability until the minimum acceptable cell

voltage is reached was determined using the EUPS battery cell type, the ELAP

EUPS duty cycle, and the ELAP margins.


The DC load shedding analysis was performed using the following key assumptions and

inputs:

• No additional accidents or failures are assumed to occur immediately prior to or

during the event, other than those causing the ELAP event.

• Electrical equipment installed within the SBs is reasonably protected and is assumed

to remain available for the ELAP event. This equipment includes, but is not limited

to, the EUPS inverters (31/32/33/34BRU01), EUPS battery chargers

(31/32/33/34BTP02), 480V buses (31/32/33/34BRA), 250V DC switchboards

(31/32/33/34BUC), and associated cabling.

• ELAP event is identified at 10 minutes after initiation of the event after offsite power

is lost, all EDGs fail to start or load, and all SBO diesel generators fail to start or

load.

• DC load shedding is assumed to take 60 minutes to complete and is completed by

70 minutes after ELAP event initiation.

• Only those containment isolation valves identified in the U.S. EPR SBO coping

strategy (refer to U.S. EPR FSAR Tier 2, Section 8.4) and the PCIP containment

isolation valve (30JND11 AA012) are assumed to be operated for the ELAP event,

consistent with Section 3.2.1.11 of NEI 12-06.

Results

Based on this analysis, it was determined that the EUPS battery discharge duration can

be extended from two hours to eight hours and 30 minutes. The overall timeline for DC

load shedding is provided in Figure 4-27. To extend the EUPS battery capacity to this

duration, the following operator actions are required:


• Identify the ELAP event and begin DC load shedding in all four divisions of the

EUPS within 10 minutes after initiation of the ELAP event.

• Complete shedding of non-ELAP loads in all four divisions of the EUPS within 70

minutes after initiation of the ELAP event.

• Before the EUPS divisions are depleted at eight hours and 30 minutes, re-energize

credited EUPS Divisions 1 and 2 for long-term event mitigation in Phases 2 and 3

(see Section 4.1.5.1).

Figure 4-27—ELAP Battery Discharge Duration

4.1.4 Reasonable Protection of Installed and Portable Equipment

The term “reasonable protection,” within the context of this technical report, means that

the design of the SSC it is describing either meets the U.S. EPR design basis for the

applicable external hazards, or has been shown by analysis or test to meet or exceed

the U.S. EPR design basis. This definition is consistent with the definition of “robust” in

NEI 12-06 (Reference 3).

Additionally, NEI 12-06 (Reference 3) provides the following guidance:

Section 3.2, Performance Attributes, states:


“…installed equipment that is designed to be robust with respect to DBEE

is assumed to be fully available”.

Section 3.2.1.3, Initial Conditions, (6) states:

“Permanent plant equipment that is contained in structures with designs

that are robust with respect to seismic events, floods and high winds and

associated missiles are available.”

Section 3.2.1.3 (8) states:

“Installed electrical distribution systems…remain available provided they

are protected…”

Non-safety-related SSC (for example, diesel-driven fire water pump, discharge piping,

portable equipment, Fire Protection Building, and the fire water storage tanks) that are

relied upon to mitigate an ELAP event are designed to meet the FLEX reasonable

protection standards.

NEI 12-06 (Reference 3) provides the following guidance:

Section 2.3 states:

“Considering the external hazards applicable to the site, the FLEX

mitigation equipment should be stored in a location or locations such that

it is reasonably protected such that no one external event can reasonably

fail the site FLEX capability. Reasonable protection can be provided for

example, through provision of multiple sets of portable on-site equipment

stored in diverse locations or through storage in structures designed to

reasonably protect from applicable external events.”

The following subsections comprise a list of external hazards defined in Section 2 of

NEI 12-06 (Reference 3) and a description of the way in which the installed plant


equipment, both safety-related and non-safety-related, and portable equipment meet

the FLEX reasonable protection requirements.

4.1.4.1 External Hazards

4.1.4.1.1 Seismic

The Fire Protection Building and the fire water storage tanks are the only non-safety-

related structures that are credited for mitigation of an ELAP event. The Fire Protection

Building is designed for the safe shutdown earthquake (SSE) as required by Regulatory

Guide 1.189 (Reference 26) using a limiting acceptance condition characterized as

essentially elastic behavior with no damage (i.e., Limit State D per ASCE 43-05)

(Reference 23). The fire water storage tanks are designed for the SSE using

ANSI/AWWA D100-2005 (Reference 29). Design for the SSE is consistent with the

FLEX guidance.

Equipment that is credited for ELAP event mitigation is either safety-related Seismic

Category I equipment, or is non-safety-related equipment that is installed in a Seismic

Category I structure or a conventional seismic structure that is designed for the SSE

with the following clarification:

To provide adequate functionality following an SSE, the following supplemental

seismic requirements are imposed:

- For valves and piping – ANSI/ASME B31.1-2004 (Reference 24). For example,

this includes the non-safety-related piping and valves from the diesel-driven fire

water pumps to the EFW system.

- For other SSC – ASCE 43-05, “Seismic Design Criteria for Structures, Systems,

and Components in Nuclear Facilities” (Reference 23). For example, this

includes the ELAP diesel generator.

This seismic qualification strategy for non-safety-related equipment is consistent with

the seismic qualification strategy used for the non-safety-related fire protection system

(FPS) as described in U.S. EPR FSAR Tier 2, Section 9.5.1.


4.1.4.1.2 Flooding

The U.S. EPR design uses a “dry site concept,” which means that the plant grade level

is located one foot above the flood elevation. This definition refers to the Seismic

Category I safety-related structures. The Fire Protection Building and the fire water

storage tanks are the only non-safety-related structures that are credited for Phase 1

event mitigation of an ELAP event. Taking this into account, the Fire Protection Building

and the fire water storage tanks will be similarly designed and constructed at least one

foot above the flood elevation.

4.1.4.1.3 Severe Storms with High Winds / Missile Protection

The Fire Protection Building and fire water storage tanks are designed for high wind

loads per ASCE 7-10 (Reference 22). In accordance with NEI 12-06 FLEX

requirements, the Fire Protection Building and the fire water storage tanks are missile

protected. The hurricane wind speed and missile spectra are defined in Regulatory

Guide 1.221 (Reference 21). The tornado wind speed and missile spectra are defined

in Regulatory Guide 1.76 (Reference 30). Selection of the high wind hazard is

consistent with U.S. EPR FSAR Tier 2, Sections 3.3 and 3.5.

4.1.4.1.4 Snow, Ice, and Extreme Cold

The Fire Protection Building and fire water storage tanks are designed for snow and ice

loading per ASCE 7-10 (Reference 22), consistent with the FLEX guidance. Minimum

temperatures for design of non-safety systems in the U.S. EPR design are based on a

best estimate, 1% exceedance value of -10°F. Because of the beyond design basis

nature of the ELAP event, design evaluations of equipment performance (safety-related

or non-safety-related) are similarly based on a best estimate, 1% exceedance value

of -10°F.

4.1.4.1.5 High Temperatures

In accordance with NEI 12-06 (Reference 3), equipment should be maintained at a

temperature within a range to support its likely function when called upon. Maximum


temperatures for design of non-safety systems are based on a best estimate, 1%

exceedance value of 100°F dry bulb / 77°F wet bulb coincident. Because of the beyond

design basis nature of the ELAP event, design evaluations of equipment performance

(safety-related or non-safety-related) are similarly based on a best estimate, 1%

exceedance value of 100°F dry bulb / 77°F wet bulb coincident.

4.1.4.2 Summary of Reasonable Protection of Installed Equipment

Table 4-3 provides a summary of the reasonable protection requirements for installed

plant equipment:

Table 4–3—Reasonable Protection of ELAP Event Mitigation Equipment

Hazard Applicability General Approach

Seismic Structure Seismic Category I or conventional seismic structures designed for the site specific SSE with limiting acceptance condition as specified in ASCE 43-05 or AWWA D100-2005 for Fire Protection Storage Tanks.

Systems and Components

Seismic Category I or reasonable protection of non-safety-related installed equipment in Seismic Category I and Conventional Seismic structures. Reasonable protection of non-safety-related equipment installed in Seismic Category I, or Conventional Seismic structures designed for the hazards in this table. The system and component design includes use of:

• ASME B31.1 – piping, valves, and supports.

• ASCE 43-05 – other equipment (e.g., pumps, diesels, electrical).

Flooding Structure Seismic Category I or Conventional Seismic structures located 1 foot above the maximum flood elevation. Note: U.S. EPR design uses a “dry site” concept for Seismic Category I structures.

High Wind Structure Seismic Category I or ASCE 7-10 for Conventional Seismic structures with wind speeds and missiles based on Regulatory Guide 1.76 and Regulatory Guide 1.221.

Snow, Ice, and Cold

Structure Seismic Category I or ASCE 7-10 for Conventional Seismic structures.


Hazard Applicability General Approach Temperatures Systems and

Components Equipment (safety-related or non-safety-related) evaluated for best estimate 1% exceedance temperatures (-10°F) or reasonable protection of non-safety related equipment by storing in a Seismic Category I structure or Conventional Seismic structure designed for the hazards of this table.

High Temperatures

Structure Seismic Category I or ASCE 7-10 for Conventional Seismic structures.

Systems and Components

Equipment (safety-related or non-safety-related) evaluated for best estimate 1% exceedance temperatures (100°F dry bulb/77°F wet bulb coincident) or reasonable protection of non-safety related equipment by storing in a Seismic Category I structure or Conventional Seismic structure designed for the hazards of this table.

4.1.4.3 Reasonable Protection of Portable Equipment

The COL applicant shall provide reasonable protection for portable equipment utilized in

ELAP event mitigation. NEI 12-06, Section 2.3 provides the following guidance:

“Considering the external hazards applicable to the site, the FLEX

mitigation equipment should be stored in a location or locations such that

it is reasonably protected such that no one external event can reasonably

fail the site FLEX capability. Reasonable protection can be provided for

example, through provision of multiple sets of portable on-site equipment

stored in diverse locations or through storage in structures designed to

reasonably protect from applicable external events.”

4.1.5 Mitigation Strategies

Based on the analytical bases provided in Section 4.1.3 and the reasonable protection

requirements provided in Section 4.1.4, mitigation strategies were developed to satisfy

the overall acceptance criteria given in Section 4.1.2.

The mitigation strategies were grouped as follows:

• AC and DC Power (Section 4.1.5.1).

• Core Cooling with Primary to Secondary Heat Transfer (Section 4.1.5.2).


• Core Cooling with Primary Feed and Bleed (Section 4.1.5.3).

• Containment Integrity and Heat Removal (Section 4.1.5.4).

• Spent Fuel Cooling (Section 4.1.5.5).

• Instrumentation and Controls (Section 4.1.5.6).

• Support Functions (Section 4.1.5.7).

Details of the mitigation strategy for each of these groupings are provided in the

following subsections.

4.1.5.1 AC and DC Power

During an ELAP event, DC power is required for remote operation of electrical

switchgear, for instrumentation and control (I&C) systems, and for operation of essential

AC motor-operated valves that are battery backed. The only power sources available

during Phase 1 event mitigation are the two-hour batteries and their associated EUPS

buses. Actions are required to extend the period of time that this DC power is available.

In the U.S. EPR EUPS design, each of the 250V DC two-hour batteries

(31/32/33/34BTD01) (this form of abbreviation indicates one per division, four total

throughout the discussion) is connected to a 250V DC switchboard (31/32/33/34BUC).

One of two redundant battery chargers (31/32/33/34BTP01 or 31/32/33/34BTP02) is

connected to each 250V DC switchboard. The EUPS battery chargers BTP01 and

BTP02 are normally supplied 480V AC input power by the emergency power supply

system (EPSS). Battery charger BTP01 is supplied by EPSS load center BMC in

Divisions 1 and 4 and by EPSS motor control center (MCC) BNA02 in Divisions 2 and 3.

Battery charger BTP02 is supplied by EPSS load center BMB in all four divisions. The

battery chargers rectify the 480V AC power to 250V DC power and furnish electrical

energy for the steady-state operation of loads connected to 250V DC switchboards,

while returning its battery to a full state of charge or maintaining its battery in a fully

charged state.


Each 250V DC switchboard provides input power to an inverter (31/32/33/34BRU01).

The inverter is used to transform the DC power to three phase AC power to the EUPS

buses.

For the mitigation of an ELAP event, all non-essential loads with the exception of the

I&C cabinets are segregated from essential loads on separate AC and DC buses,

referred to as “load shed buses.” Refer to U.S. EPR FSAR Tier 2, Figure 8.3-5. Each

load shed bus is connected to the associated EUPS bus or 250V DC switchboard by an

isolation device that can be remotely operated from the MCR. An ELAP condition is

identified shortly after it has been determined that the EPSS buses cannot be energized

from the EDGs or the SBO diesel generators. All load shed bus infeed isolation devices

are opened from the MCR within 60 minutes after determination that an ELAP event is

in progress to conserve the stored energy in the batteries. Nine safety automation

system (SAS) cabinets in Divisions 1 and 4, six SAS cabinets in Divisions 2 and 3, and

one SICS remote shutdown station (RSS) workstation cabinet in Divisions 1 and 4 are

de-energized locally by opening isolation devices at the cabinets. These actions extend

battery availability to eight hours and 30 minutes as discussed in Section 4.1.3.9.

Prior to depletion of the batteries, the batteries in Divisions 1 and 2 are recharged from

either a prestaged, permanently installed dedicated diesel generator or by portable

480V generators using the Divisions 1 and 2 battery chargers. Refer to Figure 4-28.

The dedicated diesel generator is located in the Fire Protection Building and is referred

to as the ELAP diesel generator. The ELAP diesel generator is also used to power

plant equipment that is credited for Phase 2 and 3 event mitigation (for example, the

PCIP). This ELAP diesel generator is provided with a diesel fuel storage tank with a

minimum capacity corresponding to eight hours of fully loaded operation. The ELAP

diesel fuel storage tank is provided with external fill connections to allow replenishment

in Phases 2 and 3.

The ELAP diesel generator has a minimum load capability of 1.2 MW. The ELAP diesel

generator minimum load capability was determined by summing all of the individual

loads to be powered from this source and adding approximately 15% margin. The loads


considered when sizing the ELAP diesel generator are listed in Table 4–4. The ELAP

diesel generator connects to 6.9kV bus 30BBH, located in the Fire Protection Building.

Bus 30BBH can provide power to Class 1E 6.9kV switchgear buses 31BDB and 34BDB.

If the ELAP diesel generator is not available, portable 480V generators will be used to

power the loads listed in Table 4–4. Three 480V portable generators are required.

Each portable generator’s minimum load capability was determined by summing all of

the individual loads in the division to be powered from the generator and adding

approximately 15% margin. The Division 1 portable generator has a minimum load

capability of 550 kW and connects to 1E 480V load center 31BMB. The Division 2

portable generator has a minimum load capability of 350 kW and connects to 1E 480V

load center 32BMB. The Division 4 portable generator has a minimum load capability of

350 kW and connects to 1E 480V load center 34BMB. Refer to Figure 4-28.

The timing of energizing the buses is dictated by when the equipment powered from the

bus is required to operate to support the ELAP mitigation strategy. This can vary

depending on plant conditions at the initiation of the ELAP event. The overall sequence

of events for equipment operation timing requirements is provided in Table 4–17 and

Table 4–18. When operation of equipment not powered from the EUPS buses or the

250V DC system is required, refer to Table 4–4 to determine the power supply for that

equipment and then refer to Table 4–5 to determine the electrical alignment necessary

to energize the required equipment power supply. Refer to U.S. EPR FSAR Tier 2,

Figures 8.3-2 and 8.3-6 for electrical single line drawings. The buses must be

energized in the order given in the applicable Table 4–5 sequence. It is possible that

some of the buses in the sequence may have already been energized when aligning

power to other equipment earlier. If that is the case, then the buses must be energized

in the required sequence, starting with the first deenergized bus in the sequence. Prior

to energizing each bus, all loads on the bus except those listed in Table 4–4 must be

stripped from the bus. These operator actions will ensure that required loads are

powered, unnecessary loads are stripped, and EUPS battery capacity is extended in a

manner consistent with the analysis.


This AC and DC repowering mitigation strategy for ELAP event mitigation reflects the

following considerations:

• At least two 250V DC switchboards (Divisions 1 and 2) and their associated EUPS

buses must be powered from the ELAP diesel generator because all systems are

not four-division or four-train redundant, and certain equipment requires power from

a minimum of two EUPS divisions to be operable. The main steam relief isolation

valves (MSRIVs), for example, each require two EUPS divisions to be operable.

Other required ELAP event mitigation equipment, like the communications

equipment and special E-LGT, is not four-division or four-train redundant.

• Events utilizing primary to secondary heat transfer require all four divisions of EUPS

buses to be operable for the first six hours to allow the use of four SGs during

symmetric cooldown of the primary system.

• The Division 3 and Division 4 250V DC switchboards and their associated EUPS

buses are de-energized by eight hours and 30 minutes after initiation of the event

prior to depletion of their associated batteries. All loads are stripped from the

Division 3 and Division 4 250V DC switchboards and EUPS buses, and then the

associated battery isolation device is opened. These actions are performed for

equipment protection of the batteries and are not required for event mitigation.

• The plant operators have ample time (eight hours and 30 minutes after initiation of

the event) to repower EUPS Divisions 1 and 2.

• During ELAP event mitigation, an exception exists to the use of the ELAP DG or the

portable generators to repower electrical buses for equipment operation. When

primary feed and bleed cooling is relied upon to mitigate events initiated in ELAP

State D (refer to Table 4-2), operator action is required to open one set of PDS

valves. To accomplish this action, the Division 4 EUPS bus 34BRA is used to

backfeed power to 34BRB via 34BNB02 and 34BNB03 to energize the Division 4

powered valves. In this event, the PDS valves must be opened within one hour, and

the backfeed alignment requires fewer operator actions than using the ELAP diesel

generator or a portable generator.


• The voltage regulating transformers feeding 31BNB02 and 32BNB02 and the

downstream buses (31/32BNB03, 31/32BRB) will only be energized long enough to

align the required loads and will then be de-energized. As a result, the long term

heat load from the voltage regulating transformers feeding 31BNB02 and 32BNB02

was not included in the SB heatup analyses described in Section 4.1.3.5.

• Various AC powered valves are used for ELAP event mitigation that are powered

from their respective EUPS “valve” buses (31/32/33/34 BRA). In Divisions 1 and 2,

the 31BRA and 32BRA “valve” buses will be repowered from the Division 1 and 2

battery chargers (31BTP02 and 32BTP02). These battery chargers are included on

the Table 4–4 ELAP load list. In Divisions 3 and 4, the valves will be placed in their

required position prior to depletion of the Division 3 and 4 batteries. Given this, the

following valves were also credited for ELAP event mitigation, but are not included in

Table 4–4 since they are powered from their respective EUPS “valve” buses

(31/32/33/34 BRA).

- EFW discharge header cross-connect valves.

- Fire water to EFW discharge header isolation valves.

- PCIP motor operated discharge throttle valve (30JND11 AA012).

- RCP seal No. 1, No. 2, and No. 3 seal leak-off isolation valves.

- RCP SSSS nitrogen injection isolation valves.

- Accumulator injection isolation valves.

- Accumulator vent control valves.

- Accumulator vent line isolation valves.

- Pressurizer continuous degasification isolation valves.

- Pressurizer safety relief valves.

- Main steam isolation valves.

- Main steam relief isolation valves.


- Main steam relief control valves.

- Letdown line isolation valve.


Table 4–4—ELAP Loads

ELAP Loads Description ELAP Loads ID Power Supply

Battery Charger 2 Div 1 31BTP02 31BMB Div 1 Class 1E 480V Load Center

Battery Charger 2 Div 2 32BTP02 32BMB Div 2 Class 1E 480V Load Center

IRWST 3-Way Valve 30JNG10 AA001 31BNB02 Div 1 1E 480V MCC

MHSI Control Valve Train 1 30JND10 AA103 31BNB02 Div 1 1E 480V MCC

MHSI Large Minimum Flow Isolation Valve Train 1 30JND10 AA005 31BNB02 Div 1 1E 480V MCC

MHSI Outside Containment Isolation Valve Train 1 30JND10 AA002 31BNB03 Div 1 1E 480V MCC

MHSI Small Minimum Flow Isolation Valve Train 1 30JND10 AA004 31BNB02 Div 1 1E 480V MCC

PDS Line 1 First Isolation Valve 30JEF10 AA004 31BRB Div 1 Non-1E 480V MCC

PDS Line 1 Second Isolation Valve 30JEF10 AA005 34BRB Non-1E 480V MCC

PDS Line 2 First Isolation Valve 30JEF10 AA006 31BRB Div 1 Non-1E 480V MCC

PDS Line 2 Second Isolation Valve 30JEF10 AA007 34BRB Non-1E 480V MCC

Portable Cooler for Control Room N/A 32BNB01 Div 2 1E 480V MCC

Portable Cooler for Switchgear Room Div 4 N/A 34BNB01 Div 4 1E 480V MCC

PCIP 30JND11 AP002 31BMB Div 1 Class 1E 480V Load Center

SAHRS Pump 30JMQ40 AP001 34BDC Div 4 Class 1E 6.9 KV Switchgear

SBVSE (Electrical Division of SB Ventilation System) Train 1 Battery Room Fan

30SAC51 AN001 31BNB01 Div 1 1E 480V MCC

SBVSE Train 1 Exhaust Fan 30SAC31 AN001 31BNB01 Div 1 1E 480V MCC

SBVSE Train 1 Supply Fan 30SAC01 AN001 31BNB01 Div 1 1E 480V MCC

SBVSE Train 2 Battery Room Fan 30SAC52 AN001 32BNB01 Div 2 1E 480V MCC

SBVSE Train 2 Exhaust Fan 30SAC32 AN001 32BNB01 Div 2 1E 480V MCC

SBVSE Train 2 Supply Fan 30SAC02 AN001 32BNB01 Div 2 1E 480V MCC


Table 4–5—ELAP Electrical Bus Alignments

To Energize Bus From ELAP DG From Portable 480V

Generator (PG) From Division 4

EUPS Bus 34BRA

34BDC Div 4 Class 1E 6.9 KV Switchgear

ELAP DG 30BBH 34BDB 34BDCPG4 34BMB 34BDB 1 34BDC

N/A

31BMB Div 1 Class 1E 480V Load Center

ELAP DG 30BBH 31BDB 31BMB PG1 31BMB N/A

32BMB Div 2 Class 1E 480V Load Center

ELAP DG 30BBH 31BDB 32 BDA 32BDB 32BMB

PG2 32BMB N/A

31BNB01 Div 1 1E 480V MCC ELAP DG 30BBH 31BDB 31BMB 31BNB01

PG1 31BMB 31BNB01 N/A

31BNB02 Div 1 1E 480V MCC ELAP DG 30BBH 31BDB 31BMB 31BNB02 3

PG1 31BMB 31BNB02 3N/A

31BNB03 Div 1 1E 480V MCC ELAP DG 30BBH 31BDB 31BMB 31BNB02 3 31BNB03 3

PG1 31BMB 31BNB02 3 31BNB03 3

N/A

32BNB01 Div 2 1E 480V MCC ELAP DG 30BBH 31BDB 32 BDA 32BDB 32BMB 32BNB01

PG2 32BMB 32BNB01 N/A

34BNB01 Div 4 1E 480V MCC N/A PG4 34BMB 34BNB01 N/A

31BRB Div 1 Non-1E 480V MCC 4 ELAP DG 30BBH 31BDB 31BMB 31BNB02 3 31BNB03 3 31BRB 3

PG1 31BMB 31BNB02 3 31BNB03 3 31BRB 3

N/A

34BRB Non-1E 480V MCC 4 N/A N/A 34BRA 34BNB02 1, 3 34BNB03 3 34BRB 1, 2, 3

Table Notes:

1. Backfeed to bus.

2. Mechanical interlock must be defeated to close both feeder breakers on 34BNB03.


3. Deenergize after using.

4. Alignment is only required if power from the 12 hour battery is not available. This alignment allows the PDS valves to

be repowered.


Figure 4-28—Electrical Distribution and Repowering EUPS

4.1.5.2 Core Cooling with Primary to Secondary Heat Transfer

Primary to secondary heat transfer is utilized for core cooling whenever the SGs are

available. This corresponds to plant ELAP States A, B, and C (refer to Table 4-2). The

timing of transient events and required action times may vary depending on the ELAP

state at the time of ELAP event initiation. For ELAP events that rely on primary to

secondary heat transfer for core cooling, refer to the sequence of events in Table 4–17

for required action times.

During primary to secondary heat transfer, heat is transferred from the fuel to the

reactor coolant, transported to the SGs by natural circulation, transferred to the

secondary side of the SGs, and then transported to the atmosphere by steaming the

SGs through the MSRTs.


Three main functional objectives must be satisfied to effectively provide core cooling for

events initiated in Modes 1 through 5 with SGs available (i.e., ELAP States A, B, and C)

using primary to secondary heat transfer:

• RCS inventory control.

• Primary heat removal.

• Reactivity control.

An overview of the mitigation strategies for these functional objectives is provided in

Table 4–6. Details of the mitigation strategies for each of these functional objectives

are provided in the following subsections.


Table 4–6—FLEX Capability – Core Cooling Summary – Modes 1 through 5 with SGs Available

ELAP Function Method Phase 1 Phase 2 and 3

Co

re C

oo

ling

Reactor Core Cooling and Heat Removal (Events initiated in Modes 1 through 5 with SGs available)

• Use primary to secondary heat transfer for decay heat removal with diesel-driven fire pump to feed SGs via EFW header.

• Depressurize SGs with MSRTs to facilitate feedwater delivery (if required).

• Throttle MSRCVs to control SG pressure.

• Provide sustained source of feedwater.

• Seismically qualified diesel-driven fire pump to EFW header.

• Steam lines are isolated by closing MSIVs.

• SGs are depressurized symmetrically using MSRTs if required.

• After secondary feed established, MSRCVs throttled to control SG pressure.

• SG feed is sufficient to restore SG level with installed equipment following SG dryout (ELAP States A and B).

• SG feed is sufficient to maintain SG level with installed equipment (ELAP State C).

• Fire water storage tanks and building designed for FLEX reasonable protection requirements.

• Permanent connections (primary and alternate) for portable, self-powered, SG feed pump.

• Portable means to refill fire water storage tank to extend baseline coping.

• Portable means to refill fire pump diesel tanks and lube oil to extend baseline coping.

RCS Inventory Control/Long-Term Subcriticality

• Low leakage RCP seals.

• Borated RCS makeup.

• RCS inventory loss pathways (e.g., letdown) isolated during initial event mitigation.

• RCP SSSS actuated to limit RCP seal leakage during initial event mitigation.

• In initial plant ELAP States A and C, borated RCS makeup provided by the accumulators.

• Seismically qualified RCP SSSS equipment.

• PCIP is used for makeup when RCS pressure is < 350 psi. PCIP is powered from either ELAP diesel generator in the Fire Protection Building or from a portable generator.

• Borated water source is provided from IRWST.

• Seismically qualified PCIP.

Key Reactor Parameters

• SG level.

• SG pressure.

• RCS pressure.

• RCS temperature.

• Instruments powered by Class 1E DC bus.

• DC load shedding used to extend baseline coping.

• Power Divisions 1 and 2 Class 1E batteries using either the ELAP diesel generator in the Fire Protection Building or by portable generators.


4.1.5.2.1 RCS Inventory Control

Adequate core cooling is provided by maintaining the liquid or two-phase mixture level

in the RV above the top of the fuel in the core (refer to Section 4.1.2). RCS inventory

control is challenged during an ELAP event by the loss of all AC powered RCS injection

sources and by the potential for increased RCP seal leakage resulting from overheating

of the RCP seals. Mitigation of the challenge to core cooling requires a source of

makeup to the RCS, as well as minimization of RCS inventory losses.

Accumulators are not available in all ELAP States as shown in Table 4-2. Specifically,

note the following:

• Four accumulators are available and are credited during events initiated in ELAP

State A.

• One accumulator may be available and depressurized to 320 psia, but is not

credited during events initiated in ELAP State B.

• One accumulator is available and depressurized to 320 psia, and is credited during

events initiated in ELAP State C.

The reduction in RCS pressure resulting from primary to secondary heat transfer during

SG depressurization enables the accumulators to inject borated water for RCS

inventory makeup and reactivity control. In ELAP State A, approximately 37,000 gallons

of accumulator inventory is available to make up for RCS contraction and leakage until

pumped injection can be placed into service. In ELAP State C, approximately 9,250

gallons of accumulator inventory is similarly available.

Section 4.1.3.1 describes analyses that were performed to characterize the RCS

response to an ELAP event initiated in Modes 1 through 5 with SGs available (i.e.,

ELAP States A, B, and C). These results indicated that some accumulator injection did

occur in ELAP States A and C, but the accumulators did not empty. The injection of

accumulator inventory allows later start of the PCIP for RCS makeup for these ELAP

states. This combination of accumulators and PCIP for borated makeup allows the


accumulators to be isolated or vented to prevent nitrogen injection into the RCS when

the PCIP is placed in service.

The PCIP will be operated as required to maintain adequate RCS inventory in Phase 2

and Phase 3 of the event. To implement primary makeup using the PCIP, the following

valve lineup in Table 4–7 will be performed. The power supplies and their alignment to

the PCIP and the respective motor operated valves during the ELAP event are

described in Section 4.1.5.1.

Table 4–7—Primary Coolant Injection Valve Alignment

Valve ID Description Position

30JNK10 AA001 IRWST Three-way Isolation Open to PCIP

suction 2

30JND11 AA008 Manual PCIP Suction Isolation Open

30JND11 AA009 Manual PCIP Suction Isolation Open

30JND11 AA012 PCIP Motor Operated Discharge Throttle Valve Open 1

30JND10 AA002 MHSI Outside Containment Isolation Valve Train 1 Closed

30JND10 AA004 MHSI Small Minimum Flow Isolation Valve Train 1 Closed

30JND10 AA005 MHSI Large Minimum Flow Isolation Valve Train 1 Closed

30JND10 AA103 MHSI Control Valve Train 1 Open

Table Notes:

1. Motor-operated discharge throttle valve (30JND11 AA012) is administratively closed

and de-energized in Modes 1 to 4.

2. Valve is normally open to PCIP suction and fails as is.

Once the valve alignment is complete, the PCIP will be operated as required to maintain

adequate RCS inventory when RCS pressure is less than 350 psia. The analyses for

these ELAP States indicated that RCS pressure will be below 350 psia by the time

pumped primary injection is required to maintain RCS inventory.


Control of RCS leakage is required for adequate RCS inventory control. RCS inventory

loss can occur through three pathways:

• RCS letdown.

• PZR continuous degasification line.

• RCP seals.

The letdown line isolation valve (30KBA10 AA001) is automatically closed upon

detection of low EDG bus voltage in all four electrical divisions for greater than

30 seconds (refer to U.S. EPR FSAR Tier 2, Figure 9.3.4-1, Sheet 1 of 9). The letdown

line isolation valve is powered from the Division 1 EUPS (31BRA) and fails as-is upon a

loss of power after isolation.

The flow through the PZR continuous degasification line is limited to a small value by a

flow restriction. The PZR continuous degasification isolation valves (30JEF10 AA503

and 30JEF10AA504) are closed by the operator when time is available (refer to U.S.

EPR FSAR Tier 2, Figure 5.1-4, Sheet 3 of 7). The PZR continuous degasification

isolation valves are powered from the Division 1 and Division 4 EUPS buses (31BRA

and 34BRA) and fail as-is upon a loss of power after isolation.

The RCPs are provided with an SSSS to limit RCP seal leakage during loss of seal

cooling events (refer to Figure 4-29). The SSSS is a static seal located above the

Number 3 seal, between the Number 3 seal housing and the pump coupling sleeve. It

consists of a ring piston surrounding the pump shaft, which moves up under nitrogen

pressure to land on the counter-ring of the shaft (closing annular space “E” in

Figure 4-29). When the static seal is open, the piston is located on the bottom side of

the Number 3 seal housing. To engage the SSSS, the piston is raised by injecting

nitrogen under the piston until it comes into contact with the counter-ring. The leak

tightness is created by metal to metal contact. The standstill seal is kept closed by both

gas pressure and RCS pressure. If the gas pressure is lost, the RCS pressure can

maintain the standstill seal in a closed position provided the RCS pressure is greater

than or equal to 218 psig. The static seal is equipped with springs between the top of


the piston and the end of the static seal housing. These springs are designed to return

the piston to the down position when there is no actuation pressure and no pressure

downstream of the Number 3 seal. Static sealing between the components (for

example, piston and housing) is provided by O-rings designed for high temperatures.

Consistent with the strategy used for SBO mitigation (see U.S. EPR FSAR Tier 2,

Section 8.4), the seal leak-off isolation valves are automatically closed upon detection of

simultaneous loss of seal injection and thermal barrier cooling. The standstill seal will

automatically close 15 minutes later, after the RCP shaft has stopped rotating. The

operators will ensure that all three seal leak-off isolation valves on each RCP have

closed. At 15 minutes after the RCP trip occurs, the operators will verify that the

standstill seal has closed. All of the valves required to change position for SSSS

closure and seal return isolation are powered from the EUPS two-hour batteries and fail

as-is upon a loss of power after actuation. Closure of the SSSS and seal return

isolation valves on all four RCPs limits total RCP seal leakage to less than or equal

to 2 gpm.

Figure 4-29—RCP SSSS

4.1.5.2.2 Primary Heat Removal

Primary heat removal is required to remove the decay heat transferred from the core to

the RCS. Additional primary heat removal, in excess of core decay heat, is required in


ELAP States A and B to depressurize the RCS to allow low pressure makeup sources

(accumulators, PCIP) to be used for RCS inventory control during an ELAP event. The

mitigation strategy for an ELAP event initiated when SGs are available in Modes 1

through 5 (i.e., ELAP States A, B, and C) utilizes primary to secondary heat transfer for

primary heat removal. Primary to secondary heat transfer requires a source of

feedwater to the SGs and a path to relieve steam from the SGs. Refer to simplified

Figure 4-30.

The fire water storage tanks are used as a source of feedwater to the SGs during

Phase 1 of the event. Two 300,000 gallon steel lined concrete storage tanks are

provided (Tank 1 is assumed to be available for supplying a feedwater source, while

Tank 2 is assumed to be available for firefighting). These tanks meet the NEI FLEX

standards for reasonable protection. Each tank is provided with a six-inch seismically

qualified connection to allow the tanks to be refilled using a portable self-powered pump

during Phase 2 and Phase 3 event mitigation.

The diesel-driven fire pumps are used to pump fire water to the EFW discharge

cross-connect header to supply feed to the SGs during event mitigation. Refer to U.S.

EPR FSAR Tier 2, Figure 9.5.1-1 and Figure 10.4.9-1. The diesel-driven fire pumps

take suction on the fire water storage tanks. These diesel-driven fire pumps and their

associated diesel fuel storage tanks are located in the Fire Protection Building. The Fire

Protection Building meets the FLEX standards for reasonable protection. The diesel

fuel storage tanks for the fire pumps are provided with external fill connections to allow

fuel replenishment during Phases 2 and 3 of event mitigation.

A permanently installed, seismically qualified six-inch pipe is provided between the fire

pump discharge header and the EFW discharge cross-connect header. This piping

includes a manual isolation valve (30SGA01 AA091) inside the Fire Protection Building.

The line is routed underground into SB 1. Routing the line underground provides

reasonable protection of the line. Two motor-operated isolation valves

(30LAR55 AA005 and 30LAR55 AA002) are provided on this line inside SB 1. Both

motor-operated isolation valves are powered from EUPS Train 1 bus 31BRA. A check


valve (30LAR55 AA001) is also provided between the downstream motor-operated

valve and the EFW discharge cross-connect header to prevent reverse flow from the

EFW system. Motor operated isolation valve 30LAR55 AA002 and check valve

30LAR55 AA001 are safety related and provide redundant isolation between the safety

related EFW system and the non-safety related fire water system.

A hose connection is provided on a four-inch vent valve (30LAR54 AA501) on the EFW

discharge cross-connect header in SB 4. This connection provides additional defense-

in-depth by allowing the FPS in SB 4 to supply feed to the SGs by manually connecting

a hose between the fire system and the EFW discharge header vent.

Provisions are included for installation of a portable self-powered pump to supply SG

feedwater during Phases 2 and 3. Two connections (N+1) are provided for the portable

pump discharge on the line connecting the fire pump discharge header to the EFW

discharge cross-connect header. One of these connections is located at the Fire

Protection Building and the other is located at the exterior of SB 1. A connection is also

provided on the fire water storage tanks outlet cross-connect line to provide suction to

the portable pump from the fire water storage tanks.


Figure 4-30—Primary to Secondary Heat Transfer Simplified Diagram

The valve alignment listed in Table 4–8 is performed to align fire water to the SGs. The

power supplies and alignment to the respective motor operated valve during the ELAP

event for loads not powered from EUPS buses or the 250V DC system are described in

Section 4.1.5.1.

Table 4–8—Fire Water to SGs Valve Alignment


30SGA01 AA091 Fire Water to EFW Manual Isolation Valve Open

30LAR55 AA005 Fire Water to EFW Motor Operated Isolation Valve Open

30LAR55 AA002 Fire Water to EFW Motor Operated Isolation Valve Open

30LAR14 AA001 EFW Discharge Cross-Connect Valve to Train 1 Open




30LAR11 AA105 EFW SG Level Control Valve Train 1 Open 1






30LAR11 AA006 SG Isolation Valve Train 1 Open 1




Table Notes:

1. Valve is normally open and fails in position.

Manual isolation valve (30SGA01 AA091) inside the Fire Protection Building is normally

maintained open.

The EFW discharge cross-connect valves are closed during normal operation. These

valves are also used to throttle flow to the SGs when required. The valves are powered

from their respective divisional EUPS buses. The valves can be manually positioned

locally if power is not available.

The EFW SG level control valves and the SG isolation valves are open during normal

operation and fail as-is when power is lost to the valves as a result of DC load shedding.

The SG steaming paths are provided by the MSRTs. Each SG is provided with an

MSRT that consists of an MSRIV in series with an MSRCV. Steaming one of the SGs

requires opening the MSRIV and throttling the MSRCV to achieve the desired steam

flow.

The MSRIVs (30LBA13/23/33/43 AA001) are pilot-operated valves and are opened by

venting pressure from the area above the main operating piston. Since the MSRIVs are

pilot operated valves, SG pressure must be maintained above a minimum of

approximately 40 psia to provide the motive force to open the MSRIVs. Each MSRIV

has four solenoid-operated pilot valves that are arranged as two pilot valves in series on

each of the two redundant control lines. Two pilot valves in series must be energized to


vent the steam pressure and maintain the MSRIV open. If the pilot valves are de-

energized, they close and, if at least one pilot valve in each control line is closed, the

MSRIV closes. Each of the four solenoid-operated pilot valves is powered from a

different EUPS division. The solenoid power supplies are assigned in such a way that

Divisions 1 and 2 powered solenoids are in series on one control line, and Divisions 3

and 4 powered solenoids are in series on the other control line. Therefore, the MSRIVs

can be remotely opened from the MCR whenever SG pressure is greater than 34.7 psia

using control power from Divisions 1 and 2. Additionally, note that none of the

automatic functions of the MSRIVs are available due to DC load shedding of the SAS

cabinets.

Additional defense-in-depth is provided by a third control line that is arranged in parallel

with the other two control lines. The third control line has two manual valves in series to

provide a power independent means to open the MSRIV locally. The MSRIV opens

when both of the manual valves in the third control line are opened.

The MSRCVs are powered from their respective divisional EUPS buses. Power from all

four EUPS buses is available during the period of SG depressurization. The MSRCVs

can be remotely controlled from the MCR as long as their associated EUPS bus is

energized, but no automatic functions of the valve are operable due to DC load

shedding of the SAS cabinets. The valves fail as-is if power is lost, and are provided

with the capability for local manual control.

To mitigate ELAP events initiated in ELAP States A and B, the results of analyses

described in Sections 4.1.3.1.1 and 4.1.3.1.2 demonstrate that the core can be

adequately cooled if all four SGs and MSRTs are used for controlled depressurization.

All four MSIVs are closed to isolate downstream non-safety related piping. A controlled

depressurization of all SGs is initiated at 30 minutes by opening all four MSRIVs

(30LBA13 AA001, 30LBA23 AA001, 30LBA33 AA001, and 30LBA43 AA001) and by

remotely controlling all four MSRCVs (30LBA13 AA101, 30LBA23 AA101,

30LBA33 AA101, and 30LBA43 AA101) from the MCR to achieve an RCS cooldown

rate of 90°F/hr.


The analysis of an ELAP event initiated in ELAP States A and B indicated that dryout of

the SGs occurs because SG pressures cannot be reduced fast enough to allow feed

from fire water prior to depleting the SG secondary inventory. SG dryout would be

detected by rapidly decreasing SG pressures and SG levels near zero. When SG

dryout is detected, the operators will remotely adjust all four MSRCVs from the MCR to

control SG pressures at the required pressure. Additionally, note that one diesel-driven

fire pump will be started and aligned to the SGs prior to dryout.

When dryout occurs, SG pressures rapidly decrease. As SG pressures drop below the

shutoff head of the diesel-driven fire pumps, flow begins to the SGs. The diesel-driven

fire pumps were conservatively assumed to have a capacity of greater than 2500 gpm

at 185 psi (capacity of the pumps is 2500 gpm at 213 psi). A minimum of 600 gpm

(150 gpm to each of the four SGs) is delivered to the SGs when SG pressures are

100 psia.

Feed flow to the SGs is reestablished and the RCS starts cooling again. SG levels

begin to recover at some later time (refer to Table 4–16 for transient event timing).

When SG levels have reached normal level (82.2% wide range), the EFW discharge

cross-connect valves (30LAR14 AA001, 30LAR24 AA001, 30LAR34 AA001, and

30LAR44 AA001) are throttled from the MCR to control level between 72.2% and 82.2%

wide range to prevent overfill.

ELAP events initiated in ELAP State C require a somewhat different sequence of

actions because the RCS must heat up first before primary to secondary heat transfer

can be established. The results of analyses described in Section 4.1.3.1.3 for ELAP

events initiated in ELAP State C demonstrate that the core can be adequately cooled.

For ELAP State C, MSRTs are used to control all four SG pressures at 40 psia and

adequate feedwater is provided from fire water to maintain SG levels.

In ELAP State C, the SGs are low enough in pressure to allow immediate fire water feed

to the SGs at the start of the event. SGs are initially at the required level and are

maintained using the feedwater from fire water.


All four MSIVs are closed to isolate downstream non-safety related piping. The RCS

will begin to heat up due to loss of heat removal by RHR. Once RCS Thot exceeds

212°F, SG pressures will begin to increase. When SG pressures increase to 40 psia, all

four MSRIVs are opened and all four MSRCVs are throttled as necessary to control SG

pressures at 40 psia. A fire water pump is started and aligned to feed all four SGs. As

SG levels begin to decrease due to steaming through the MSRTs, the EFW discharge

cross-connect valves are throttled as required to maintain SG levels between 72.2%

and 82.2% wide range level.

For all ELAP States (A, B, C) in which primary to secondary heat transfer is used for

core cooling, certain long term actions are required to maintain core cooling. Battery

chargers are not reenergized on Divisions 3 and 4, so the Division 3 and 4 EUPS buses

and 250V switchgear will be depleted at approximately 8.5 hours. This results in loss of

power to the Division 3 and 4 EFW cross-connect valves and MSRCVs. The MSRIVs

will remain open as long as SG pressure is greater than approximately 40 psia because

all four MSRIVs have the pilot valves in one of their pilot flow paths powered from

Divisions 1 and 2. At six hours, the EFW cross-connect valves to SG 3 and SG 4 will be

closed. The MSRCVs will be left in their throttled position. This alignment will allow the

existing SG 3 and SG 4 inventory to be boiled off until the MSRIVs on those SGs close

due to low steam pressure.

The fire water storage tank will eventually approach depletion. The fire water storage

tank must be replenished from other sources using the fill connections provided, or a

portable pump and water supply must be placed in service prior to tank depletion.

The diesel-driven fire pump fuel oil storage tanks require replenishment prior to

depletion utilizing the provided external fill connections. The fuel oil storage tank sizing

and diesel fuel usage at the required fire water flow rates provide reasonable assurance

that replenishment is not required until three and a half days after the event.


4.1.5.2.3 Reactivity Control

Reactivity control is required to provide reasonable assurance that criticality does not

occur due to the positive reactivity addition caused by RCS cooling. During events

initiated in ELAP State A, the reduction in RCS pressure resulting from primary to

secondary heat transfer enables the accumulators to inject borated water for RCS

inventory makeup and reactivity control. During events initiated in ELAP State B,

operator actions to start the PCIP with suction from the IRWST are relied upon for

inventory control as described in Section 4.1.5.2.1. These actions also provide

reactivity control in ELAP State B. ELAP State C is a heatup event. The analysis

described in Section 4.1.3.1.3 verified that adequate shutdown margin was available to

maintain the reactor subcritical, even considering the most positive moderator

temperature coefficient value at beginning of life. Reactivity control in Phase 2 of event

mitigation in ELAP States A, B, and C is accomplished by operation of the PCIP for

RCS inventory control, which will inject borated water into the RCS.

Section 4.1.3.1 describes the analyses that were performed to characterize the core

response to an ELAP event initiated in all ELAP States. These results indicated that the

reactor is maintained subcritical throughout the event.

4.1.5.3 Core Cooling with Primary Feed and Bleed

Primary feed and bleed cooling is utilized for core cooling whenever the SGs are not

available. This corresponds to ELAP States D, E, and F (refer to Table 4-2). The timing

of transient events and required action times may vary depending on the plant state at

the time of event initiation. Refer to Table 4–18 to determine required action times.

During primary feed and bleed cooling, heat is transferred from the fuel to the reactor

coolant in the RV. The reactor coolant in the vessel will heat up to saturation

temperature and then begin to boil. The high enthalpy steam leaving the RV via the

PDS valve vent path or open RV head will transport the heat to the containment

atmosphere. The heat will be removed from the containment atmosphere by

containment spray and spray cooling. Low enthalpy water is injected into the RCS from


the IRWST using the PCIP to replace the coolant boiled off in the RV and maintain the

core covered with water or two phase mixture.

Primary feed and bleed cooling requires a source of makeup to the RCS and an

adequate RCS vent path. A pre-staged PCIP (30JND11 AP002) installed in parallel

with the Train 1 medium head safety injection (MHSI) pump (30JND10 AP001) is used

to pump borated water from the IRWST into RCS cold leg 1. Refer to U.S. EPR FSAR

Tier 2, Figure 6.3-2. The injected water flows down the RV downcomer and up through

the reactor core, removing heat from the fuel. The steam that is generated is released

through a vent path to provide heat removal from the RCS. In ELAP State D, both PDS

valves are opened in one of the PDS flowpaths to provide a vent path when the PCIP is

started. Prior to draining the RCS in Mode 5 (ELAP State E), a flowpath from the PZR

to the PRT is aligned by opening both valves in one PDS flowpath. Utilization of this

flowpath requires the RCS to repressurize until the PRT rupture disc fails, which then

provides a flowpath to containment atmosphere. Events initiated when the RV head is

removed (ELAP State F) utilize the open top of the RV as the vent path to containment

atmosphere.

An overview of the primary feed and bleed mitigation strategy is provided in Table 4–9.

Simplified diagrams of the core cooling paths are provided in Figure 4-31 and

Figure 4-32. Details of the mitigation strategies are provided below.


Table 4–9—FLEX Capability – Primary Feed and Bleed Core Cooling Summary


Co

re C

oo

ling

Core Cooling and Heat Removal

• Boil-off of excess RCS inventory.

• Primary side feed and bleed cooling with RCS vented to containment.

• Boil-off of RCS inventory above the top of the fuel provides core cooling in Phase 1.

• RCS is vented with one open seismically qualified PDS flowpath from the PZR to the containment atmosphere via the PRT rupture disc (ELAP State E) or from the open vessel when the RV head is removed (ELAP State F).

• PSRVs are latched open on the second lift (ELAP State D).

• Pre-staged seismically qualified PCIP installed in parallel with Train 1 MHSI pump with suction from the IRWST and discharge through the Train 1 MHSI discharge line.

• PCIP is powered from either the ELAP diesel generator in the Fire Protection Building or by portable generator.

• RCS is vented with one open seismically qualified PDS flow path from the PZR to the containment atmosphere via the PRT rupture disc (ELAP States D, E, and F) or from the open vessel when the RV head is removed (ELAP State F).

Key Reactor Parameters

• RCS pressure.

• RCS temperature.





Figure 4-31—Core Cooling in Mode 5 with SGs Unavailable and Mode 6 (Head On) Simplified Diagram


Figure 4-32—Core Cooling in Mode 6 (Head Off) Simplified Diagram

Core cooling in Phase 1 event mitigation is provided by boil off of the liquid in the RV

above the top of the core and the liquid in the hot and cold legs that drains into the RV

(refer to Section 4.1.2). For Phase 2 event mitigation, actions to place a source of

pumped injection into service are required prior to uncovering the core. Additional

inventory must be added to the RCS at a rate greater than or equal to the rate of boil off

to prevent uncovering the core. A calculation was performed to determine makeup flow

requirements to maintain core cooling in ELAP States D, E, and F. As discussed in

Section 4.1.3.2.1, this calculation determined that a minimum makeup flow rate of 230

gpm is required for core cooling. As discussed in Section 4.1.3.2.2, an injection flow of

300 gpm provides margin to the minimum flow required for core cooling (230 gpm) and

represents the minimum flow required to prevent boron precipitation. A 10% margin

was added to this value, resulting in the PCIP sized for a flow of 330 gpm. The required

discharge head of the PCIP (857 feet) was then calculated based on the peak RCS

pressure in the analyzed shutdown states, static head, and line losses. Analyses


described in Sections 4.1.3.1.4 (ELAP State D), 4.1.3.1.5 (ELAP State E), and 4.1.3.1.6

(ELAP State F) indicate that initiation of RCS injection at a minimum of 300 gpm within

one hour will prevent uncovering the core. The required injection initiation time of one

hour provides margin to actually uncovering the core. Finally, note that only one PCIP

is necessary to meet the FLEX N +1 requirement because the installed pump is

reasonably protected in SB 1 and it has two independent power sources (i.e., ELAP

diesel generator and portable diesel generator).

During Phase 1 of ELAP event mitigation in ELAP States D, E, and F, reactivity control

is accomplished by control rod insertion and required RCS boron concentration.

Additional margin to criticality is provided over time by the concentration of boron in the

core due to water boil off with no RCS injection flow. During Phases 2 and 3 of event

mitigation, reactivity control is accomplished by injection of borated water from the

IRWST using the PCIP.

In ELAP States D and E when the RCS is intact and the SGs are unavailable, primary

heat removal is accomplished by releasing high enthalpy steam from the RCS to the

containment atmosphere and by replacing the released inventory with low enthalpy

RCS makeup from the IRWST using the PCIP. The RCS will initially begin to heat up

and repressurize during this evolution. Steam from the PZR will flow through the open

PDS flowpath (or the PSRVs if the PDS valves are not yet open) to the PRT. (Refer to

U.S. EPR FSAR Tier 2, Section 5.4.11.2 for a description of the PRT and U.S. EPR

FSAR Tier 2, Figure 5.4-7 for a diagram of the PRT.) The PRT is equipped with two

redundant rupture discs with a rupture pressure setpoint of 300 psid. The RCS will heat

up and pressurize until at least one of the rupture discs fails, providing a flowpath for the

steam to the containment atmosphere.

In ELAP State F when the RV head is removed from the RV, the RCS vent path will be

through the open RV to containment. When the RV head has not yet been removed

from the RV, the RCS vent path will be either the open PDS pathway established in

ELAP State E or through the de-tensioned RV head flange to RV interface. The high


enthalpy steam released through either of the RCS vent paths is replaced with cold

water pumped from the IRWST by the PCIP.

To implement primary feed and bleed cooling in ELAP States D, E, or F with SGs

unavailable, the following valve lineup in Table 4–10 will be performed. The power

supplies and alignment to the respective motor operated valve during the ELAP event

for loads not powered from EUPS buses or the 250V DC system are described in

Section 4.1.5.1.

Table 4–10—Primary Feed and Bleed Cooling Valve Alignment


30JNK10 AA001 IRWST Three-way Isolation Open to PCIP

suction 1

30JND11 AA008 Manual PCIP Suction Isolation Open 1

30JND11 AA009 Manual PCIP Suction Isolation Open 1

30JND11 AA012 PCIP Motor Operated Discharge Throttle Valve Open 3, 4

30JND10 AA002 MHSI Outside Containment Isolation Valve Train 1 Closed 3

30JND10 AA004 MHSI Small Minimum Flow Isolation Valve Train 1 Closed 3

30JND10 AA005 MHSI Large Minimum Flow Isolation Valve Train 1 Closed 3

30JND10 AA103 MHSI Control Valve Train 1 Open 3

30JEF10 AA004 (30JEF10 AA006)

PDS Valve Open 2, 3

30JEF10 AA05 (30JEF10 AA007)

PDS Valve Open 2, 3

Table Notes:

1. Pre-position equipment upon entry into Mode 5.

2. Pre-position equipment prior to lowering RCS level in Mode 5. These valves will be

administratively maintained open throughout the period that the RCS is drained

down to ensure an adequate vent path for primary feed and bleed cooling exists.

3. Action to implement primary feed and bleed cooling following an ELAP event.

4. Motor-operated discharge throttle valve (30JND11 AA012) is administratively closed

and de-energized in Modes 1 to 4.


4.1.5.4 Containment Integrity and Heat Removal

Containment parameters must be managed during an ELAP event to ensure integrity of

the containment, prevent damage to equipment located inside containment, and

maintain sufficient inventory for core cooling. Containment pressure and temperature

must be maintained less than the design basis limits provided in Section 4.1.2.

Following an ELAP event, normal methods of active containment heat removal and

pressure control are lost when AC power sources are lost. To assess the effects of

losing containment heat removal during an ELAP event, analyses described in

Section 4.1.3.4 were performed to determine the rate of containment heatup and

pressurization as well as required compensatory actions. The timing associated with

these analyses is dependent upon the plant state at the onset of the ELAP event.

Further, note that if the containment equipment hatch is open when an ELAP event

occurs, it must be closed to maintain containment integrity.

• For ELAP events initiated with SGs available for decay heat removal (i.e., ELAP

States A, B, and C), the containment pressurizes very slowly due to ambient heat

losses and RCS leakage.

• For ELAP events initiated with SGs unavailable for decay heat removal (i.e., ELAP

States D, E, and F), the containment heats up and pressurizes more rapidly due to

ambient heat losses and primary feed and bleed cooling, which transports all of the

core decay heat to the containment.

Heat from the containment atmosphere and IRWST will be removed using the SAHRS.

The SAHRS is conceptually similar to the containment spray system used on most

pressurized water reactors. From a timing perspective, these cases that rely on primary

feed and bleed cooling (i.e., ELAP States D, E, and F) are more limiting for containment

heat removal than for cases with SGs available (i.e., ELAP States A, B, and C) as

discussed in Section 4.1.3.4.

An overview of the containment heat removal mitigation strategy is provided in

Table 4-11. A simplified diagram of the containment heat removal strategy is provided


in Figure 4-33. Details of the containment heat removal mitigation strategy are provided

in the following sections.


Table 4–11—FLEX Capability – Containment Summary

ELAP Function Method Phase 1 Phases 2 and 3

Co

nta

inm

ent

Containment Function, Containment Heat Removal

• Containment spray

• IRWST cooling

• Analysis

• Analysis demonstrates that containment pressure and temperature increases at slow rate.

• As needed, close the containment equipment hatch.

• Re-power seismically qualified SAHRS pump and provide flow to seismically qualified containment spray header. SAHRS pump takes suction from IRWST. SAHRS pump will be re-powered using either the ELAP diesel generator in the Fire Protection Building or by a portable generator.

• Provide portable cooling water to the seismically qualified SAHRS heat exchangers to cool the SAHRS pump discharge (IRWST fluid).

Key Containment Parameters

• Containment pressure





4.1.5.4.1 Containment Spray and Heat Removal

NRC Order EA-12-049 requires a three-phase approach for mitigating BDBEEs. During

the initial phase, referred to as Phase 1, the containment will be allowed to heat up and

pressurize at a slow rate. Later, in Phase 2 and Phase 3, containment heat will be

removed by the SAHRS. To avoid exceeding the containment design basis peak

temperature and pressure limits (see Section 4.1.2), the required timing for placing the

SAHRS into service is dependent upon the plant conditions at the onset of the ELAP

event:

• For ELAP events initiated with SGs available for decay heat removal (i.e., ELAP

States A, B, and C), the SAHRS must be placed in service within 36 hours.

• For ELAP events initiated with SGs unavailable for decay heat removal (i.e., ELAP

States D, E, and F), the SAHRS must be placed in service within approximately

16.7 hours.

The SAHRS pump (30JMQ40 AP001) will be re-powered and portable cooling water will

be provided to the SAHRS heat exchangers (30JMQ40 AC001 and 30JMQ40 AC004)

via flanged connections on the supply and return lines of the dedicated component

cooling water system. Actions required to re-power the SAHRS pump from either the

ELAP diesel generator or from a portable generator are provided in Table 4–4 and

Table 4–5. Only one SAHRS pump and heat exchanger set are necessary to meet the

FLEX N +1 requirement because the installed pump and heat exchanger are reasonably

protected in SB 4 and the pump has two independent power sources (i.e., ELAP diesel

generator and portable diesel generator).

With this containment heat removal strategy, containment inventory is not challenged

since the IRWST fluid is recirculated through the SAHRS heat exchangers and there is

no external source of water added to the RCS or containment.


Figure 4-33—Containment Spray and Containment Heat Removal Simplified Diagram

To place the SAHRS in service during an ELAP event, the motor operated valves listed

in Table 4–12 must be opened to align the SAHRS pump to the IRWST and

containment spray header (refer to U.S. EPR FSAR Tier 2, Figure 19.2-22).

Table 4–12—SAHRS Spray Valve Alignment


30JNK11 AA009 IRWST Isolation to SAHRS Open

30JMQ40 AA001 SAHRS Containment Isolation for IRWST Suction Line Open

30JMQ41 AA001 SAHRS Containment Isolation for Spray Line Open

As needed, these valves may be locally opened manually since they are located outside

containment and the power source may not be energized at the time SAHRS spray is

initiated.


The flanged connection points (with manual isolation valves 30KAA80 AA091 and

30KAA80 AA092) to the supply and return lines of the dedicated component cooling

water system are shown in U.S. EPR FSAR Tier 2, Figure 9.2.2-4. The portable cooling

water supply also provides cooling water for the SAHRS pump seal cooler, bearing

cooler, and motor cooler. The nominal portable cooling water flow rate is 307 lbm/s

(~ 2218 gpm).

To provide portable cooling water to the SAHRS heat exchangers, SAHRS pump seal

cooler, SAHRS bearing cooler, and SAHRS motor cooler, the manual or motor operated

valves listed in Table 4–13 must be aligned. All valves are manual valves with the

exception of 30KAA80 AA020, which is a motor operated valve. This valve may be

locally opened manually since it is located outside containment and the power source

may not be energized at the time SAHRS cooling is initiated. Further, note that the

pre-throttled valves to the SAHRS Pump seal cooler, SAHRS bearing cooler, and

SAHRS motor cooler do not need to be adjusted for ELAP event mitigation since the

cooling water flow is equivalent to the nominal dedicated component cooling water flow

under normal conditions.

Table 4–13—SAHRS Portable Cooling Water Valve Alignment


30KAA80 AA091 Portable CCW Supply Open

30KAA80 AA092 Portable CCW Supply Open

30KAA80 AA004 Dedicated CCW Pump Discharge Isolation Closed

30KAA80 AA020 Dedicated CCW Surge Tank Isolation Closed

30KAA80 AA002 Dedicated CCW Pump Motor Cooler Isolation Closed

After the cooling water flow path has been aligned, the portable cooling water pump is

started. After cooling water flow has been established, the SAHRS pump is started to

initiate containment spray. Additionally, note that the SAHRS pump will have to be

started by manually closing the pump motor breaker locally since control power will not

be available from Division 4 at the time the SAHRS pump is started.


To ensure proper operation of the SAHRS pump for an extended period of time, a

pressurized demineralized water source must be provided to the seal water supply

system buffer tank (30GHW44 BB001) for makeup to the SAHRS pump mechanical

seals (refer to U.S. EPR FSAR Tier 2, Figure 9.2.7-1). The seal water buffer tank

GHW44 BB001 has a 40 gallon capacity, which is adequate to accommodate expected

seal leakage for 7,000 hours (291 days). The buffer tank pressure is required to be a

minimum of 102 psig. For long term event mitigation, the COL applicant will provide a

portable pressurized demineralized water source that will be connected to 1 inch valve

30GHW44 AA010.

Portable cooling water hoses to the SAHRS heat exchangers are routed through the

Nuclear Auxiliary Building at grade level to the supply and return lines of the dedicated

component cooling water system. The portable cooling water pump, hoses, suction

source, and discharge sink will be provided by COL applicant. The portable cooling

water suction source must be maintained at less than 90°F for the duration of ELAP

event mitigation, consistent with the analysis described in Section 4.1.3.4.

4.1.5.4.2 Containment Closure

The equipment hatch is provided with manual closure capability to allow closure during

a loss of electrical power, using permanently installed manual hydraulic pumps, portable

battery powered screwdrivers, and manual hand wheels. The equipment hatch can be

closed in 91 minutes using six workers. Four of the workers are required for the full

91 minutes, and the two additional workers are only required during the last 15 minutes.

This manpower requirement is acceptable because the action is only required during

selected outage modes when additional staffing is available.

4.1.5.5 Spent Fuel Cooling

In Section 4.1.3.8, analyses are described that determined the bulk SFP heatup time

and boil-off rate. For a worst-case full core off-load, these analyses concluded the

following:


• To maintain the fuel assemblies covered with water (refer to Section 4.1.2), makeup

to the SFP must be provided within 26.1 hours. Boiling of the SFP can be credited

as the Phase 1 event mitigation method because ample time is available to take

compensatory action.

• The operators have approximately 15.5 hours to restore cooling and/or makeup to

the SFP in order to maintain at least 10 feet of water inventory over the fuel

assemblies.

• For Phase 2 and 3 event mitigation, an SFP makeup rate of 140 gpm is needed to

match the initial boil-off rate. The boil-off rate decreases over time as the spent fuel

decay heat decreases.

Based on this information, an overview of the spent fuel cooling mitigation strategy is

provided in Table 4–14. A simplified diagram of the spent fuel cooling strategy is

provided in Figure 4-34. Details of the spent fuel cooling mitigation strategies are

provided in the following sections.

Figure 4-34—Spent Fuel Spray System Simplified Diagram


Table 4–14—FLEX Capability – Spent Fuel Cooling Summary


Sp

ent

Fu

el C

oo

ling

Spent Fuel Cooling

• Makeup through connection to SFP makeup piping or other suitable means (e.g., sprays).

• Makeup with portable injection source.

• Vent pathway for steam.

• Analysis demonstrates that spent fuel heats up slowly and remains cooled by water inventory above the top of the spent fuel.

• Vent path from SFP area to environment established for removal of steam.

• Seismically qualified permanent connections (primary and alternate) provided for portable, self-powered, SFP makeup pump.

• Two seismically qualified permanent connections provided for makeup from FPS.

• Vent path established in Phase 1 is maintained open to provide a vent path for steam.

SFP Parameters

• SFP Level. • Instruments powered by Class 1E DC bus.

• U.S. EPR design includes redundant, safety-related wide range level sensors in SFP that fulfill Order EA-12-051 order.

• Power Divisions 1 and 2 Class 1E batteries using either a pre-staged ELAP diesel generator in the Fire Protection Building or by portable generators.

• Power SFP level instruments using portable battery powered indication device in accordance with Order EA 12-051.


For Phase 1 event mitigation, a vent path from the SFP area must be established prior

to the onset of SFP boiling to allow release of steam from this area to the environment.

Based on the analyses in Section 4.1.3.8, SFP boiling is calculated to occur no sooner

than 3.5 hours after the ELAP event occurs. Alignment of the vent path within three

hours provides margin to the analytical limit to ensure the action is completed while the

area is habitable. The vent path to the environment is provided by opening selected

doors from the SFP area to the material lock area (refer to U.S. EPR FSAR Tier 2,

Figures 3.8-41 and 3.8-46). The following actions, none of which require an external

source of electrical power, are performed to provide the required vent path:

• On the +64ʹ elevation, open the double doors and the single door between the fuel

pool operating floor and the laydown area.

• On the +64ʹ elevation, open the rollup door between the laydown area and the

material lock area.

• On the +64ʹ elevation, unlatch the material lock (labeled “Removable Floor” on U.S.

EPR FSAR Tier 2, Figure 3.8-41) and the lock doors will fall open.

• On the 0ʹ elevation, open the rollup door at grade level in the material lock room to

provide a vent path to the environment.

The vent path for the spent fuel area that is established in Phase 1 is maintained open

in Phases 2 and 3.

For Phase 2 and 3 event mitigation, makeup is required to the SFP. Based on the

Section 4.1.3.8 analyses, a minimum flow rate of 140 gpm is required to match the SFP

boil-off rate.

Flow from the self-powered, portable SFP makeup pump is provided to the SFP as

shown in simplified Figure 4-34 and U.S. EPR FSAR Tier 2, Section 9.3.3.2.1 and

Figure 9.3.3-1. The spent fuel pool spray (SFPS) system provides both a spray cooling

function and an alternate fill pipe for makeup to the SFP. Flow paths in the SFPS


system are aligned using manual valves. The SFPS system is a dry system consisting

of two separate but redundant trains that are physically located on opposite sides of the

SFP. Two separate and independent hose connections, located at grade elevation level

on the exterior of the Fuel Building (FB), are provided on opposite sides of the building

to attach a pumper truck or portable pump. The two external connections satisfy the

FLEX N+1 criterion because the FB is adequately protected and the two connections

are located on opposite sides of the FB.

Alternatively, flow to the SFP can be provided by the FPS as shown in simplified

Figure 4-34 and U.S. EPR FSAR Tier 2, Figure 9.5.1-1. This portion of the FPS

consists of two separate but redundant trains that are physically located on opposite

sides of the SFP. Each of these redundant trains contains connections from the FPS

within the FB, SB 1, and SB 4. Flow paths to the SFP for this portion of the FPS are

aligned using manual valves.

When an ELAP event is identified, the following actions are taken to ensure spent fuel

cooling:

• During Phase 1 event mitigation, align the vent path from the SFP area to the

material lock area.

• During Phase 2 and 3 event mitigation, align manual valves (as appropriate) to

provide flow from either a portable pump or the FPS to the SFP.

• Monitor level in the SFP using the SFP level instrumentation described in

Section 4.2.1.

4.1.5.6 Instrumentation and Controls

Mitigation of the ELAP event is accomplished using safety-related I&C systems (i.e.,

SICS, priority and actuator control system (PACS), signal conditioning and distribution

system (SCDS), and protection system (PS)). Operator actions are performed using

SICS. SICS provides the human-system interface that is used to perform control and


indication functions that are needed to monitor the safety status of the plant, and bring

the unit to and maintain it in a safe shutdown state.

The SICS provides conventional I&C controls and indications needed to mitigate the

consequences of accidents. The SICS human-system interface is located in the MCR.

4.1.5.6.1 Instrumentation

The following minimum set of instruments required to support ELAP event mitigation are

provided on SICS:

• Containment pressure.

• Containment temperature.

• Core exit thermocouple temperatures.

• EFW flow (downstream of discharge cross-ties).

• Fire water storage tank levels.

• IRWST level.

• MHSI Train 1 flow.

• PZR level.

• RCS cold leg temperature.

• RCS hot leg pressure.

• RCS hot leg temperature.

• SG pressures.

• SG wide range levels.

• SFP level.

• Source range neutron flux.

• Subcooling margin monitors.


4.1.5.6.2 Controls

Components utilized for ELAP mitigation that are provided with controls and status

indication on SICS are listed in Table 4–15:

Table 4–15—SICS Controls

Component Description Component ID Control Positions

250V DC Switchboard Load Shed Breakers Divisions 1, 2, 3, 4

(Not Assigned) Open / Close

Accumulator Isolation Valves 30JNG13/23/33/43 AA008 Open / Close / Throttle

Accumulator Vent Control Valves 30JNG13/23/33/43 AA101 Open / Close / Throttle

Accumulator Vent Isolation Valves 30JNG13/23/33/43 AA502 Open / Close

CVCS Letdown Isolation Valve 30KBA10 AA001 Open / Close

Diesel-driven Fire Water Pumps (Not Assigned) Start / Stop

EFW Discharge Cross-Connect Valves 30LAR14/24/34/44 AA001 Open / Close / Throttle

ELAP Diesel Generator 30XKA60 AG100 Start / Stop

EUPS Bus Load Shed Breakers Divisions 1, 2, 3, 4

(Not Assigned) Open / Close

FPS to EFW Isolation Valves 30LAR55 AA002/005 Open / Close

IRWST 3-Way Isolation Valve Train 1 30JNK10 AA001 Open / Close

Main Steam Isolation Valves 30LBA10/20/30/40 AA002 Open / Close

MSRCVs 30LBA13/23/33/43 AA101 Open / Close / Throttle

MSRIVs 30LBA13/23/33/43 AA001 Open / Close

MHSI Large Miniflow Valve Train 1 30JND10 AA005 Open / Close

MHSI Outside Containment Isolation Valve Train 1

30JND10 AA002 Open / Close

MHSI Small Miniflow Valve Train 1 30JND10 AA004 Open / Close

MHSI Throttle Valve Train 1 30JND10 AA103 Open / Close / Throttle

PCIP Discharge Throttle Valve 30JND11 AA012 Open / Close / Throttle

PZR Continuous Degasification Isolation Valves

30JEF10 AA503/504 Open / Close

PZR Safety Relief Valves 30JEF10 AA191/192/193 Open / Close

PCIP 30JND11 AP002 Start / Stop

PDS Valves 30JEF10 AA004/5/6/7 Open / Close

RCP No. 1 Seal Leak Off Isolation Valves

30JEB10/20/30/40 AA009 Open / Close


Component Description Component ID Control Positions





RCP SSSS Nitrogen Injection Isolation Valves


RCP SSSS Nitrogen Vent Isolation Valves


SBVSE Battery Room Exhaust Fans (Div. 1 and 2)

30SAC51/52 AN001 Start / Stop

SBVSE Exhaust Fans (Div. 1 and 2) 30SAC31/32 AN001 Start / Stop

SBVSE Supply Fans (Div. 1 and 2) 30SAC01/02 AN001 Start / Stop

4.1.5.7 Support Functions

To support the overall functional requirements of NRC Order EA-12-49 (Reference 1)

(i.e., core cooling, containment, and spent fuel cooling), five main support functions

must be provided:

• AC Power –refer to Section 4.1.5.1.

• DC Power –refer to Section 4.1.5.1.

• Lighting.

• Communications.

• Heating, Ventilation, and Air Conditioning (HVAC).

An overview of the mitigation strategies for each of these support functions is provided

in Table 4–16. Details of the mitigation strategies for each of these support functions

are provided in the following subsections.


Table 4–16—FLEX Capability – Support Functions Summary

Safety Function Method Phase 1 Phase 2 and 3

Su

pp

ort

Fu

nct

ion

s

AC power • AC distribution system

• AC distribution system housed in reasonably protected structures.

• Power Division 1, 2, and 4 ELAP mitigation equipment using either a pre-staged ELAP diesel generator in the Fire Protection Building or by portable generators.

DC power • Batteries

• DC distribution system

• Batteries and DC distribution system housed in reasonably protected structures.


Lighting • Emergency lighting

• Applicable E-LGT powered by DC power system.

• Applicable E-LGT systems housed in reasonably protected structures.


• Utilize portable lighting equipment.

Communications • Plant communication systems

• Applicable communication systems powered by DC power system.

• Applicable plant communication systems housed in reasonably protected structures.


• Utilize portable communication equipment.

HVAC • Re-power SBVSE fans

• Portable Cooler for MCR

• Portable cooler for SB 4switchgear room

• Analysis demonstrates that areas housing ELAP event mitigation equipment heats up slowly without active ventilation (e.g., open doors in electrical division rooms in SB 1 and SB 2).

• Power ventilation equipment for Divisions 1 and 2 Class 1E batteries and EPSS 480V MCC 31/32BNB01 using either a prestaged ELAP diesel generator in the Fire Protection Building or by portable generators.

• Start SBVSE Trains 1 and 2 supply, exhaust, and battery room fans.

• Provide portable cooler in MCR with heat exhaust to staircase in SB 3.

• Provide portable cooler for switchgear room with heat exhaust to staircase in SB 4 if the SAHRS pump is powered by the portable 480V generator.


4.1.5.7.1 Lighting

The plant lighting systems are divided into two main categories:

• Lighting for the MCR and RSS.

• Lighting outside of the MCR and RSS.

The impact on lighting in each of these areas following an ELAP event is as follows:

• The special E-LGT provides approximately 33% of the MCR and RSS lighting.

Special E-LGT loads (32UJK22GP401 and 33UJK22GP402) are located on

Divisions 2 and 3 of the EUPS. As discussed in Section 4.1.5.1, Division 2 of the

EUPS will remain energized throughout the duration of an ELAP event. The other

67 percent of the MCR and RSS lighting is provided by the E-LGT system and is

powered from the EPSS. The E-LGT would be lost following an ELAP event.

• Escape route-egress battery pack lighting will provide a minimum of 90 minutes of

illumination in areas such as stairwells, corridors, rooms, building exit ways, and/or

doors. Battery pack E-LGT will provide a minimum of eight hours of illumination and

the battery pack units are located in the access route from the MCR to the RSS.

• Portable lighting is provided to support implementation of ELAP event mitigation

strategies.

4.1.5.7.2 Communications

The plant communication system (COMS) consists of the following subsystems:

• Portable wireless communication system.

• Digital telephone system.

• Public address (PA) and alarm system.

• Sound-powered system.


• Emergency offsite communication system.

• Security communication system.

Each communication subsystem provides an independent mode of communications. A

failure of one subsystem does not affect the capability to communicate using the other

subsystem. These diverse COMS are independent of each other to provide effective

communications, including usage in areas exposed to high ambient noise in the plant.

Electrical power from a Class 1E standby power source is provided for the portable

wireless COMS base station, emergency offsite communication capability, and plant

security communications. Portable wireless communication subsystem base stations

(30CYV10GW001 and 30CYV10GW002) are powered from Division 2 of the EUPS.

Portable wireless communication subsystem base stations (30CYV10GW003 and

30CYV10GW004) are powered from Division 3 of the EUPS. As a result of this

divisional arrangement of power supplies, at least two of the portable wireless

communication subsystem base stations have power available throughout the ELAP

event. The portable wireless communication subsystem base stations are located in

Seismic Category I structures in separate rooms. The location of the base station

equipment cabinets are physically separated from the other subsystem equipment (i.e.,

PABX/VoIP, PA, and alarm system) to provide for added protection against a single

accident or fire disabling multiple modes of communication throughout the plant.

4.1.5.7.3 HVAC

Following an ELAP event, all plant AC-powered forced ventilation is lost. The loss of

ventilation affects mitigation of an ELAP event in three plant areas:

• SBs (refer to Section 4.1.3.5 for SB heatup analysis).

• MCR (refer to Sections 4.1.3.6 and 4.1.3.7 for MCR heatup analysis).

• Fire Protection Building.


4.1.5.7.3.1 Safeguard Buildings

Action is required to open three doors in SB 1 and SB 4 within 30 minutes; to open five

doors in SB 2 and SB 3 within 30 minutes; to restore forced ventilation flow to the

Division 1 and Division 2 SB electrical areas within seven hours; to provide portable

cooling to the SB 4 switchgear room within 16 hours 40 minutes (ELAP States D, E,

and F) or 36 hours (ELAP States A, B, and C) if the portable 480V generator is used to

repower the SAHRS pump; and to open seven doors in SB 2 within 25 hours after

initiation of the event. These actions will maintain temperatures in the SBs within

equipment operability limits.

The following doors are opened within 30 minutes of event initiation (refer to U.S. EPR

FSAR Tier 2, Figures 3.8-57, 3.8-68, and 3.8-79):

Safeguard Building 1 +27ʹ elevation:

• West switchgear room door to north staircase and elevator access.

• North staircase and elevator access door to east switchgear room.

• East switchgear room door to east I&C cabinet room.


• East switchgear room door to north staircase and elevator access.

• North staircase and elevator access door to west switchgear room.

• West switchgear room door to west I&C cabinet room.


• East switchgear room door to west switchgear room.

• East switchgear room door to staircase and elevator access area.

• West switchgear room door to staircase and elevator access area.


• West switchgear room door to escape staircase.

• Staircase and elevator access area door to north staircase.


• West switchgear room door to east switchgear room.

• West switchgear room door to staircase and elevator access area.

• East switchgear room door to staircase and elevator access area.

• East switchgear room door to escape staircase.

• Staircase and elevator access area door to north staircase.

Within seven hours after event initiation, EPSS 480V MCC 31BNB01 and 480V MCC

32BNB01 are energized from the ELAP diesel generator as described in

Section 4.1.5.1. Recirculation dampers (30SAC01 AA004 and 30SAC02 AA004) are

manually positioned full closed, and exhaust dampers (30SAC31 AA002 and

30SAC32 AA002) are manually positioned full open. Supply fans (30SAC01 AN001

and 30SAC02 AN001), exhaust fans (30SAC31 AN001 and 30SAC32 AN001), and

battery room fans (30SAC51 AN001 and 30SAC52 AN001) are then started to initiate

ventilation flow. SB supply and exhaust fans are not re-started for SB 3 and SB 4.


For SB 4, action is also required to place a portable cooler in service in the switchgear

room if the 480V portable generator is used to repower the SAHRS pump. This action

is required due to the heat load of transformer 34BMT02, which is energized by the

portable generator when feeding from 34BMB to 34BDB. The portable cooler is not

required when energizing 34BDB from the ELAP diesel generator because transformer

34BMT02 is not energized in that electrical lineup. Exhaust air from the portable cooler

condenser is conveyed by portable ductwork to the north stairwell in SB 4 (refer to U.S.

EPR FSAR Tier 2, Figure 3.8-79). The following doors are opened to allow heat from

the stairwell to vent to SB 4 +81ʹ elevation (refer to U.S. EPR FSAR Tier 2,

Figure 3.8-83):

• North staircase door to the staircase service corridor.

• Staircase service corridor door to service corridor and staircase access area.

The SAHRS pump is the only equipment in SB 4 that is repowered during Phase 2

and 3 ELAP event mitigation. The cooler is required to be placed in service when the

480V portable generator is started to repower the SAHRS pump. This timing varies by

the plant conditions at ELAP event initiation. Portable cooling to the SB 4 switchgear

room must be provided within 16 hours 40 minutes for events initiated in ELAP

States D, E, or F or within 36 hours for events initiated in ELAP States A, B, or C if the

480V portable generator is used to repower the SAHRS pump.

Within 25 hours of event initiation, the following SB 2 doors on +39ʹ elevation are

opened (refer to U.S. EPR FSAR Tier 2, Figure 3.8-69):

• Switchgear room door to north interconnecting passageway.

• North interconnecting passageway door to access north staircase and elevator.

• Access to north staircase and elevator door to north staircase.

• Access to north staircase and elevator door to west interconnecting passageway.

• Access to north staircase and elevator door to cable duct.


• West interconnecting passageway door to escape staircase.

• West cable duct door to cable floor.

4.1.5.7.3.2 Main Control Room

For the MCR, action is required to place a portable cooler in service within seven hours

to maintain habitability (refer to U.S. EPR FSAR Tier 2, Figure 3.8-70. Exhaust air from

the portable cooler condenser is conveyed by portable ductwork to the SB 3 escape

staircase.

4.1.5.7.3.3 Fire Protection Building

The Fire Protection Building is equipped with an HVAC system to ventilate the Fire

Protection Building during Phase 1, 2, and 3 event mitigation.

4.1.6 Sequence of Events/Critical Operator Actions

The overall sequence of events and critical operator actions to mitigate postulated

ELAP events can be divided into two basic sets of actions depending upon the method

used to remove core decay heat. Within each basic set of actions, the timing of

selected actions and events may be dependent upon the plant conditions at the time of

ELAP event initiation. Given this, the possible sets of plant initial conditions have been

grouped together, organized by similarity in required actions and event response, and

categorized into distinct plant states. Table 4-2 provides a listing of these six distinct

ELAP states.

• In modes relying on the steam generators for core cooling (i.e., ELAP States A, B,

and C), the overall sequence of events and critical operator actions is provided in

Table 4–17

• In modes relying on primary feed and bleed for core cooling (i.e., ELAP States D, E,

and F), the overall sequence of events and critical operator actions is provided in

Table 4–18.


Actions or event timing that are applicable to only one or two of the ELAP States

included in the table is designated by a bold “ELAP State” label designating the

applicable state in the “Event” column of the table. If the action or event timing is

applicable to all three of the pertinent ELAP States included in the table, then no “ELAP

State” label will be present in the “Event” column.

The ELAP State is determined by plant conditions at the time of ELAP initiation. The

mitigation strategy described for that ELAP State is followed throughout the event. As

plant conditions change during mitigation, the ELAP State is not changed.

Phase 2 of event mitigation begins at the time the ELAP diesel generator or 480V

portable generators are started to power FLEX equipment. The time of ELAP diesel

generator or portable generator start is listed in Table 4–17 for ELAP States A, B,

and C; and in Table 4–18 for ELAP States D, E, and F.

In Reference 31 the NRC endorsed an NEI position paper (Reference 32) on an

acceptable approach to demonstrating that the reactor licensees are capable of

implementing mitigating strategies in all modes of operation including shutdown and

refueling modes. For example, personnel and equipment may be pre-staged in

shutdown and refueling modes. These factors were credited when evaluating the

feasibility of some actions required to mitigate ELAP events initiated in shutdown or

refueling modes.


Table 4–17—Sequence of Events – ELAP Initiated in Modes 1 through 5 with SGs Available for Primary to Secondary Heat Transfer (ELAP States A, B, and C)

Modes 1 through 5 with SGs Available for Primary to Secondary Heat Transfer

Event Time Limit

Time Constraint?

Technical Basis for Time Requirement

Description of Why Time is Reasonably Achievable

LOOP with loss of all AC power except from battery backed inverters.

0 1 N N/A N/A

ELAP State A – Reactor trip procedure entered. Operators perform immediate actions for reactor trip before mitigating loss of power.

~ 1 min 2 N N/A N/A

RCP seal leakage is assumed to increase to 25 gpm per RCP.

2 min 1 N N/A N/A

Operators attempt to start EDGs.

~ 2 min 2 N N/A N/A

Four additional EDG start attempts fail.

~ 9 min 2 N N/A Note: 125 seconds between each start attempt, 15 seconds crank time.

SBO diagnosed – operators enter SBO procedure.

~ 9 min 2 N N/A N/A

Operators attempt to start SBO diesel generators.

~ 9 min 2 N N/A N/A

SBO diesel generators fail to start or connect to EPSS buses.

~ 10 min 2 N N/A N/A



Event Time Limit

Time Constraint?



ELAP event is diagnosed. 10 min 1 Y The SBO diesel generator is required to be capable of powering loads within 10 minutes of loss of all AC power. The ELAP event is diagnosed upon failure of the SBO diesel generator to start or load.

Operators are trained to place the SBO diesel generator in service within 10 minutes. Procedural guidance will direct initiation of ELAP mitigation upon failure of the SBO diesel generator to start or load.

Operators ensure RCP SSSS actuates and all RCP seal return valves close from MCR.

15 min 3 Y Analysis assumed reduction of leakage to 13 gpm (11 gpm RCS leakage plus 2 gpm total SSSS leakage) at 15 minutes as a result of this action.

The seal leak-off isolation valves are automatically closed upon detection of simultaneous loss of seal injection and thermal barrier cooling. The SSSS is automatically actuated 15 minutes after loss of seal cooling.

Plant personnel open three doors in SB 1, five doors in SB 2, five doors in SB 3, and three doors in SB 4 to limit temperature rise in switchgear room.

30 min 3 Y Analysis indicated that SB temperatures would remain below equipment operability limits if specified doors were opened 30 minutes after event initiation, and forced ventilation was initiated by seven hours after event initiation.

Personnel will be trained to open these doors within the required time.

Operators perform SBO containment isolation actions.

30 min 2 N N/A N/A

Operators manually close all four MSIVs from the control room.

30 min 1 Y Analysis assumed that MSIVs would be closed by 30 minutes after initiation of the event.

MSIVs can be closed from the control room.



Event Time Limit

Time Constraint?



ELAP State A, ELAP State B – Operators manually control all four SG MSRTs from the MCR to control RCS cooldown at 90°F/hr, and initiate controlled depressurization of all four SGs.

30 min 3 Y Analysis assumed initiation of 90°F/hr cooldown at 30 minutes. Delay in initiating cooldown results in lower inventory in the SGs at start of cooldown.

MSRTs are powered from EUPS buses, and can be operated from the MCR.

ELAP State C – Operators manually control all four SG MSRTs to control SG pressures at 40 psia.

35 min 5 Y Once the RCS has heated up enough to raise SG pressures to 40 psia (which is above the minimum required pressure to open MSRIVs), the MSRCVs are controlled to maintain SG pressures at 40 psia to initiate primary to secondary heat transfer and terminate the RCS heatup. This prevents loss of RCS inventory due to PSRV opening, which would begin at approximately 1 hour 6 minutes with no actions.

MSRTs are controlled from the control room.

ELAP State C – Operators position EFW valves from the MCR to align the diesel-driven fire pump discharge to all SGs. Operators start diesel-driven fire pump and manually control all four SG wide range levels between 72.2% and 82.2% from the control room.

35 min 1 Y Fire water addition to the SGs to make up for inventory lost through the MSRTs when steaming begins is an analysis assumption.

All required components are operated from the control room.



Event Time Limit

Time Constraint?



ELAP State A – Operators position EFW valves from the MCR to align the diesel-driven fire pump discharge to all SGs. Operators start diesel-driven fire pump.

1 hr 4 Y Analysis assumes feed supply is available when SGs dry out at approximately 4750 seconds. Feed supply to SGs required for primary to secondary heat transfer.

All valves required to align the flow path are motor operated from the MCR. The diesel-driven fire pump is started from the MCR.

ELAP State B – PZR empties. 1 hr 7 min 5

N N/A N/A

Action completed to shed non-essential loads from all four divisions of 250V DC switchboards and EUPS buses.

1 hr 10 min 3

Y Analysis of battery coping time assumed all non-essential loads were disconnected by 70 minutes after initiation of the event.

All non-essential loads, with the exception of the I&C cabinets, are segregated from essential loads on a separate load shed bus. Non-essential loads are shed by opening four breakers from the MCR. It is reasonable to assume that four breakers can be operated from the MCR within 60 minutes of recognition that an ELAP event has occurred. The I&C cabinets in each division are located in the same room. It is reasonable to assume that an operator can reach each room and de-energize the cabinets within 60 minutes of recognition that an ELAP event has occurred.

ELAP State A – PZR empties. 1 hr 11 min 5

N N/A N/A



Event Time Limit

Time Constraint?



ELAP State A – All SGs are dry.

1 hr 19 min 5

N N/A N/A

ELAP State A – Operators detect SG dryout by observing rapidly decreasing SG pressures and SG levels near zero and throttle all four SG MSRCVs from the MCR as required to control pressure at 100 psia. Fire water flow of ~ 150 gpm per SG begins, restoring primary to secondary heat transfer.

1 hr 20 min 5

Y SG pressures must be reduced below diesel-driven fire pump discharge pressure before feed flow begins. Analysis assumed depressurization to 100 psia to ensure ~ 150 gpm per SG.

MCR operators monitor progression of cooldown and are trained to detect SG dryout. SG pressures rapidly decreasing and SG levels decreasing to zero provide an indicator of impending dryout.

ELAP State A – Accumulators begin to inject into the RCS.

1 hr 59 min 5

N N/A N/A

ELAP State B – Operators position EFW valves from the MCR to align the diesel-driven fire pump discharge to all SGs. Operators start diesel-driven fire pump.

2 hr 4 Y Analysis assumes feed supply is available when SGs dry out at approximately 9800 seconds. Feed supply to SGs required for primary to secondary heat transfer.

All valves required to align the flow path are motor operated from the MCR. The diesel-driven fire pump is started from the MCR.

ELAP State A – SG levels begin to recover.

2 hr 32 min 5

N N/A N/A

ELAP State B – PZR level is regained.

2 hr 55 min 3

N N/A N/A



Event Time Limit

Time Constraint?



ELAP State B – Operators start the ELAP diesel generator.

2 hr 57 min 3

Y The ELAP diesel generator must be started by 2 hours 57 minutes to support operation of the PCIP at that time.

The ELAP diesel generator can be started from the MCR.

ELAP State B – Operators perform electrical and flow path alignments required to prepare PCIP for operation and block open the door to the PCIP room. Operators then start the PCIP when RCS pressure decreases to less than 350 psia.

2 hr 57 min 3

Y The PCIP must be started when RCS pressure decreases to less than 350 psia to prevent hot leg and steam generator tube boiling that could interrupt natural circulation. The analysis described in Section 4.1.3.1.2 showed that RCS pressure decreased below 350 psia at 2 hours and 57 minutes.

The PCIP and most valves, including valves in the containment, are operated from the MCR. Only two manual valves and one door in SB 1 are required to be aligned in the field. The electrical buses are located in the same building and can be aligned relatively quickly. Additional outage staffing will be available to ensure these actions can be completed within the required time for events initiated in this ELAP State.

FB doors are opened to provide vent path from SFP area to exterior.

3 hr 4 Y Vent path is required to prevent pressurization of FB.

Aligning vent path requires opening four doors, three of which are on the same elevation. Three hours is adequate time to accomplish this task.



Event Time Limit

Time Constraint?



ELAP State B – Operators observe rapidly decreasing SG pressures and SG levels near zero and throttle all four SG MSRCVs from the MCR as required to control pressure at 60 psia. Fire water flow of ~ 150 gpm per SG begins, restoring primary to secondary heat transfer.

3 hr 5 Y SG pressures must be reduced below diesel-driven fire pump discharge pressure before feed flow begins. Analysis assumed depressurization to 60 psia to ensure ~ 150 gpm per SG.

MCR operators monitor progression of cooldown and are trained to detect SG dryout. SG pressures rapidly decreasing and SG levels decreasing to zero provide an indicator of impending dryout.

ELAP State B – All SGs are dry.

3 hr 3 min 5

N N/A N/A

ELAP State B – SG levels begin to recover.

~ 3 hr 12 min 5

N N/A N/A

SFP boiling begins. 3 hr 30 min 5

N N/A Limiting time for heatup of SFP.

ELAP State B – Operators stop the PCIP when RCS pressure approaches PCIP shutoff head.

4 hr 5 N N/A Note: Operator guidance will be to stop the pump when PZR at desired level or RCS pressure approaches PCIP shutoff head.

Operators terminate fire water flow to SG-3 and SG-4 by closing the associated EFW cross-connect valves. SG-3 and SG-4 MSRCVs are left in their existing position.

6 hr 4 Y Fire water flow to SG-3 and SG-4 are terminated at this time to ensure that the EFW cross-connect valves are closed before power is lost to the valves at 8 hours 30 minutes.

Action only requires closing two valves from the control room.



Event Time Limit

Time Constraint?



ELAP State A, ELAP State C – Operators start the ELAP diesel generator.

7 hr 3 Y Power source is required to support operation of SB ventilation at 7 hours.

The ELAP diesel generator can be started from the MCR.

Electrical power and manual damper alignments are performed to support operation of SB ventilation. The SBVSE Divisions 1 and 2 supply and exhaust fans are started.

7 hr 3 Y Analysis indicated that SB temperatures would remain below equipment operability limits if specified doors were opened 30 minutes after event initiation and forced ventilation was initiated by seven hours after event initiation.

Action requires operators to access and position two dampers in the field. Since the installed fans are being repowered, only electrical alignment is required to place the fans in service once the dampers have been positioned. Seven hours is adequate time to position two dampers, and perform the required electrical alignment. The required SB ventilation fans can be started from the MCR.

Plant personnel route MCR portable cooler exhaust ductwork to SB 3 and place MCR portable cooler in service.

7 hr 3 Y Analysis assumed cooler placed in service to limit MCR temperature.

Doors are located in the vicinity of the MCR.

ELAP State A – Fire water flow throttled to control SG levels.

7 hr 23 min 5

N N/A N/A

ELAP State B – Operators start the PCIP when RCS pressure is less than 350 psia and indicated PZR level is less than 30 inches.

7 hr 24 min 5

N N/A PCIP is controlled remotely from the MCR.



Event Time Limit

Time Constraint?




7 hr 48 min 5


ELAP State B – Fire water flow throttled to control SG levels.

8 hr 7 min 5

N N/A N/A

Operators energize Division 1 and 2 250V DC switchboards and EUPS buses from ELAP diesel generator and battery room fans are started.

8 hr 30 min 3

Y Mitigation strategy assumes availability of Divisions 1 and 2 powered equipment. Divisions 1 and 2 must be powered from the ELAP diesel generator or portable generators prior to battery depletion.

Action requires placing two battery chargers in service. Eight hours and 30 minutes is sufficient time to allow performance of these actions.

Operators de-energize Division 3 and 4 250V DC switchboards and EUPS buses.

8 hr 30 min 5

N N/A Note: Action is performed for equipment protection and is not required for event mitigation. Action can be delayed if required to allow performance of actions that are required for event mitigation.

ELAP State A – PZR level is recovered.

9 hr 22 min 5

N N/A N/A

ELAP State B – SG-3 and SG-4 dry out.

10 hr 7 min 5

N N/A N/A



Event Time Limit

Time Constraint?



ELAP State B – Replenish ELAP diesel generator fuel oil storage tank.

10 hr 57 min 4

Y ELAP diesel generator is required to power essential mitigation equipment. The ELAP diesel generator is provided with a minimum eight-hour fuel oil supply. The ELAP diesel generator is placed in service by two hours and 57 minutes. Requiring replenishment at 10 hours 57 minutes is conservative since the ELAP diesel generator will not be at full load until Division 1 and 2 250V DC switchboards and EUPS buses are connected.

A means of tank replenishment exists that is capable of filling the fuel oil storage tank within 10 hours 57 minutes. Note: If the ELAP diesel generator is started earlier than 2 hours 57 minutes, the required time of fuel replenishment is earlier by an equal amount.

ELAP State A – SG-3 dries out.

10 hr 47 min 5

N N/A N/A

ELAP State A – SG-4 dries out.

10 hr 53 min 5

N N/A N/A



Event Time Limit

Time Constraint?



ELAP State A, ELAP State C – Replenish ELAP diesel generator fuel oil storage tank.

15 hr 4 Y ELAP diesel generator is required to power essential mitigation equipment. The ELAP diesel generator is provided with a minimum eight-hour fuel oil supply. The ELAP diesel generator is placed in service by seven hours. Requiring replenishment at 15 hours is conservative since the ELAP diesel generator will not be at full load until Division 1 and 2 250V DC switchboards and EUPS buses are connected.

A means of tank replenishment exists that is capable of filling the fuel oil storage tank within 15 hours. Note: If the ELAP diesel generator is started earlier than seven hours, the required time of fuel replenishment is earlier by an equal amount.

Makeup to the SFP is provided to maintain at least ten feet of water inventory above the fuel assemblies.

15 hr 30 min 3

Y Maintain adequate radiological shielding for access. If no makeup was provided, fuel would uncover at 26 hours 6 minutes.

Pre-installed engineered features are provided to facilitate pool replenishment.

ELAP State C – SG-3 dries out.

15 hr 41 min 5

N N/A N/A

ELAP State C – SG-4 dries out.

16 hr 25 min 5

N N/A N/A

ELAP State A – Fire water storage tank is replenished from other sources using the provided fill connections or a portable pump and water supply is placed in service.

16 hr 53 min 4

Y Analysis indicated that requiring replenishment or alternate source of feed at 19 hours 13 minutes provides a 10% volume margin to loss of suction.

A means of tank replenishment or alternate feed supply exists that is capable of being placed in service within 16 hours 53 minutes.



Event Time Limit

Time Constraint?



ELAP State B – Operators start the PCIP when RCS pressure is less than 350 psia and indicated PZR level is less than 30 inches.

19 hr 42 min 5



20 hr 24 min 5


ELAP State C – Accumulator injection begins.

21 hr 2 min 5

N N/A N/A

ELAP State B – Fire water storage tank is replenished from other sources using the provided fill connections or a portable pump and water supply is placed in service.

23 hr 20 min 4

Y Analysis indicated that requiring replenishment or alternate source of feed at 23 hours 20 minutes provides a 10% volume margin to loss of suction.

A means of tank replenishment or alternate feed supply exists that is capable of being placed in service within 23 hours 20 minutes.

ELAP State A, ELAP State C – Operators perform electrical and flowpath alignments required to prepare PCIP for operation and block open the door to the PCIP room. The PCIP begins to be cycled as required to maintain PZR level on scale.

24 hr 3 Y Analysis verified that accumulators will provide required RCS makeup for 24 hours. A source of RCS makeup is required after 24 hours.

The PCIP, and most valves, including valves in the containment, are operated from the MCR. Only two manual valves and one door in SB 1 are required to be aligned in the field. The electrical buses are located in the same building and can be aligned relatively quickly. The PCIP and the associated PCIP discharge valve can be operated from the control room.



Event Time Limit

Time Constraint?



After the PCIP is available for RCS makeup, Division 1 and 2 accumulator outlet isolation valves are closed to prevent nitrogen injection into the RCS.

24 hr 4 Y Analysis verified that accumulators will provide required RCS makeup for 24 hours without emptying and injecting nitrogen into the RCS.

Division 1 and 2 accumulator outlet valves are powered from Division 1 and Division 2 EUPS buses and can be closed from the control room.

After the PCIP is available for RCS makeup, Division 3 and 4 accumulators are vented to prevent nitrogen injection into the RCS.

24 hr 4 Y Analysis verified that accumulators will provide required RCS makeup for 24 hours without emptying and injecting nitrogen into the RCS.

Division 3 and 4 accumulator vent valves are powered from Division 1 and Division 2 EUPS buses and can be opened from the control room.

Plant personnel open seven doors on the +39ʹ elevation of SB 2 to limit temperature rise in associated switchgear room.

25 hr 3 Y Analysis indicated that SB 2 temperatures would remain below equipment operability limits if specified doors were opened 25 hours after initiation of the event.

Action requires opening seven doors in the same area of SB 2.

ELAP State C – Fire water storage tank is replenished from other sources using the provided fill connections or a portable pump and water supply is placed in service.

31 hr 4 Y Conservative extrapolation of analysis indicated that requiring replenishment or alternate source of feed at 31 hours provides a 10% volume margin to loss of suction.

A means of tank replenishment or alternate feed supply exists that is capable of being placed in service within 31 hours.



Event Time Limit

Time Constraint?



The SAHRS pump is powered from the ELAP DG or a 480V portable generator and cooling water is supplied to the SAHRS cooler from a portable cooling water pump. The SAHRS pump and the portable cooling water pump are started to provide containment spray and heat removal.

36 hr 4 Y Analysis indicated that the containment design basis peak temperature and pressure will not be challenged for several days. Initiating containment spray flow and cooling water prior to that time prevents exceeding the containment design basis peak temperature and pressure limits.

The SAHRS pump and heat exchanger are installed equipment. A portable cooling water pump that is capable of being placed in service within 36 hours will be provided.

If portable 480V generator is used to repower the SAHRS pump, plant personnel route SB 4 switchgear room portable cooler exhaust ductwork to SB 4 north staircase, open two doors on the +81ʹ elevation of SB4, and place SB 4 switchgear room portable cooler in service.

36 hr 4 Y Cooler must be placed in service to remove heat from the switchgear room to support long term operation of the SAHRS pump.

Action requires routing approximately 50 feet of portable ductwork, opening two doors, connecting the portable cooler to an installed power connection, and starting the cooler. These actions can be performed within 36 hours.

If diesel-driven fire pump is still being used as feed source, replenish fuel oil storage tank.

3.5 days 6 Y Fuel oil storage tank has a minimum capacity sufficient to fuel the pump for 84.4 hours at a pump flow of 660 gpm. Diesel-driven fire pump is placed in service within one hour after event initiation.

A means of tank replenishment exists that is capable of filling the fuel oil storage tank within 3.5 days. Note: If the diesel-driven fire pump is started earlier than 1 hour, the required time of fuel replenishment is earlier by an equal amount.



Event Time Limit

Time Constraint?



A pressurized demineralized water source is provided for makeup to the SAHRS pump mechanical seal.

250 days 4 Y Seal Water Buffer Tank GHW44 BB001 has a 40 gallon capacity, which can accommodate seal leakage for 7,000 hours (291 days).

A period of 250 days is considered adequate time to stage and install a pressurized demineralized water source.

Table Notes:

1. Event timing is an analysis assumption.

2. Event timing estimated based on engineering judgment.

3. Operator action time is the analytical limit (i.e., the time assumed for completion of the action in the relevant analysis).

Action must be completed by this time, but may be performed earlier to provide margin.

4. Operator action time includes margin to the analytical limit.

5. Event timing based on analysis results.

6. Operator action time based on expected fuel consumption at minimum required pump flow rate and minimum required

fuel storage capacity.


Table 4–18—Sequence of Events – ELAP Initiated in Mode 5 or Mode 6 with SGs Unavailable (ELAP States D, E, and F)

Mode 5 or Mode 6 with SGs Unavailable – Primary Feed and Bleed Cooling

Event Time Limit

Time Constraint?



LOOP with loss of all AC power except from battery backed inverters.

0 1 N N/A N/A

ELAP State D – First PSRV cycle occurs.

~1 min 5 N N/A N/A

Operators attempt to start EDGs.

~ 2 min 2 N N/A N/A

ELAP State D – Second PSRV cycle occurs. Operators latch the PSRV open when the second cycle is observed.

~ 3 min 5 N N/A N/A

ELAP State E, ELAP State F – Core boiling begins

~ 3 min N N/A N/A

Four additional EDG start attempts fail.

~ 9 min 2 N N/A (125 seconds between each start attempt, 15 seconds crank time)

SBO diagnosed – operators enter SBO procedure.

~ 9 min 2 N N/A N/A

Operators attempt to start SBO diesel generators.

~ 9 min 2 N N/A N/A

SBO diesel generators fail to start or connect to EPSS buses.

~ 10 min 2 N N/A N/A



Event Time Limit

Time Constraint?



ELAP event is diagnosed. 10 min 1 Y The SBO diesel generator is required to be capable of powering loads within 10 minutes of loss of all AC power. The ELAP event is diagnosed upon failure of the SBO diesel generator to start or load.

Operators are trained to place the SBO diesel generator in service within 10 minutes. Procedural guidance directs initiation of ELAP mitigation upon failure of the SBO diesel generator to start or load.

ELAP State D, ELAP State E – Operators ensure RCP SSSS actuates and all RCP seal return valves close from MCR.

15 min 3 Y Analysis assumed reduction of leakage to 13 gpm (11 gpm RCS leakage plus 2 gpm total SSSS leakage) at 15 minutes as a result of this action.

The seal leak-off isolation valves are automatically closed upon detection of simultaneous loss of seal injection and thermal barrier cooling. The SSSS is automatically actuated 15 minutes after loss of seal cooling.

Plant personnel open three doors in SB 1, five doors in SB 2, five doors in SB 3, and three doors in SB 4 to limit temperature rise in associated switchgear room.

30 min 3 Y Analysis indicated that SB temperatures would remain below equipment operability limits if specified doors were opened 30 minutes after event initiation and forced ventilation was initiated by seven hours after event initiation.

Personnel will be trained to open these doors within the required time.

ELAP State D – PRT rupture disc fails.

32 min 5 N N/A N/A



Event Time Limit

Time Constraint?



ELAP State D – Operators start the ELAP DG and perform electrical and flow path alignments required to prepare PCIP and PDS valves for operation. Operators then start the PCIP, open two PDS valves in one of the PDS flowpaths, and block open the PCIP room door.

1 hr 1, 4 Y The analysis assumed that the PCIP was started at one hour. The analysis estimated that PCIP injection must be started by approximately 3.5 hours to prevent uncovering the core.

The ELAP diesel generator, the PCIP, and most valves, including valves in the containment, are operated from the MCR. Only two manual valves in SB 1 are required to be operated in the field. The electrical buses are located in the same building and can be aligned relatively quickly. Additional outage staffing will be available to ensure these actions can be completed within the required time for events initiated in this plant state.

ELAP State E, ELAP State F – ELAP diesel generator started, power is aligned to the PCIP and associated flowpath valves, the PCIP flow path is aligned, the PCIP is started, and the door to the PCIP room is blocked opened.

1 hr 4 Y Without a source of pumped RCS injection, the core would become uncovered at ~2 hours 2 minutes in ELAP State E and ~ 1 hour 13 min in ELAP State F.

The ELAP diesel generator and the PCIP are started from the MCR. All manual valves in the PCIP flow path and the PDS valves are aligned prior to beginning draindown in Mode 5. Motor operated valves required to align the PCIP flowpath are operated from the MCR. These actions can be completed within one hour of event initiation. Additional staffing will be available for performance of these actions during outage conditions.



Event Time Limit

Time Constraint?



ELAP State D – Core boiling begins.

1 hr 4 min 5

N N/A N/A

Action completed to shed non-essential loads from all 250V DC switchboards and EUPS buses.

1 hr 10 min 3

Y Analysis of battery coping time assumed all non-essential loads were disconnected by 70 minutes after initiation of the event.

All non-essential loads, with the exception of the I&C cabinets, are segregated from essential loads on a separate load shed bus. Non-essential loads are shed by opening four breakers from the MCR. It is reasonable to assume that four breakers can be operated from the MCR within 60 minutes of recognition that an ELAP event has occurred. The I&C cabinets in each division are located in the same room. It is reasonable to assume that an operator can reach each room and de-energize the cabinets within 60 minutes of recognition that an ELAP event has occurred.

ELAP State E – Maximum RCS pressure of ~ 334 psia is reached and PRT rupture disc fails.

1 hr 15 min 5

N N/A N/A



Event Time Limit

Time Constraint?



Equipment hatch is reinstalled if required.

1 hr 31 min 4

Y The equipment hatch can be reinstalled in one hour and 31 minutes.

Personnel will be trained and procedures will be provided to support installation of the equipment hatch in one hour 31 minutes. Additional staffing will be available for the performance of this task during outage conditions.

ELAP State D – Maximum RCS pressure (after PRT rupture disc failure) of ~ 191 psia is reached and RCS pressure begins to decrease.

2 hr 29 min 5

N N/A N/A

FB doors are opened to provide vent path from SFP area to exterior.

3 hr 4 Y Vent path is required to ensure that pressurization of FB does not occur.

Aligning vent path requires propping four doors open, three of which are on the same elevation. Three hours is adequate time to accomplish this task.

SFP boiling begins. 3 hr 30 min 5

N N/A Limiting time for heatup of SFP.



Event Time Limit

Time Constraint?



Electrical power and manual damper alignments are performed to support operation of Safeguards ventilation. The SBVSE Division 1 and 2 supply, exhaust, and battery room fans are started.

7 hr 3 Y Analysis indicated that SB temperatures would remain below equipment operability limits if specified doors were opened 30 minutes after event initiation, and forced ventilation was initiated by seven hours after event initiation.

Action requires operators to access and position two dampers in the field. Since the installed fans are being repowered, only electrical alignment is required to place the fans in service once the dampers have been positioned. Seven hours is adequate time to position two dampers and perform the required electrical alignment.

Plant personnel route MCR portable cooler exhaust ductwork to SB 3 and place MCR portable cooler in service.

7 hr 3 Y Analysis assumed cooler placed in service to limit MCR temperature.

Doors are located in the vicinity of the MCR.

Operators energize Division 1 and 2 250V DC switchboards and EUPS buses from ELAP diesel generator.

8 hr 30 min 3

Y Mitigation strategy assumes availability of Divisions 1 and 2 powered equipment. Divisions 1 and 2 must be powered from the ELAP diesel generator or portable generators prior to battery depletion.

Action requires placing two battery chargers in service. Eight hours 30 minutes is sufficient time to allow performance of these actions.

Operators de-energize Division 3 and 4 250V DC switchboards and EUPS buses.

8 hr 30 min 5

N N/A Action is performed for equipment protection and is not required for event mitigation. Action can be delayed if required to allow performance of actions that are required for event mitigation.



Event Time Limit

Time Constraint?



Replenish ELAP diesel generator fuel oil storage tank.

9 hr 4 Y ELAP diesel generator is required to power essential mitigation equipment. The ELAP diesel generator is provided with a minimum 8 hour fuel oil supply. The ELAP diesel generator is placed in service by one hour after event initiation to power the PCIP. Requiring replenishment at 9 hours is conservative since the ELAP diesel generator will not be at full load until Divisions 1 and 2 250V DC switchboards and EUPS buses are connected.

A means of tank replenishment exists that is capable of filling the fuel oil storage tank within 9 hours. Note: If the ELAP diesel generator is started earlier than 1 hour, the required time of fuel replenishment is earlier by an equal amount.

Makeup to the SFP is provided to maintain at least ten feet of water inventory above the fuel assemblies.

15 hr 30 min 3

Y Maintain adequate radiological shielding for access. If no makeup was provided, fuel would uncover at 26 hours 6 minutes.

Pre-installed engineered features are provided to facilitate pool replenishment.

The SAHRS pump is powered from the ELAP DG or the 480V portable generator and cooling water is supplied to the SAHRS cooler from a portable cooling water pump. The SAHRS pump and the portable cooling water pump are started to provide containment spray and heat removal.

16 hr 40 min 3

Y Analysis indicated that the containment design basis peak temperature and pressure will not be exceeded if containment spray flow and cooling water are initiated by 16 hours 40 minutes.

The SAHRS pump and heat exchanger are installed equipment. A portable cooling water pump that is capable of being placed in service within 16 hours and 40 minutes will be provided.



Event Time Limit

Time Constraint?



If the 480V portable generator is used to repower the SAHRS pump, plant personnel route SB 4 switchgear room portable cooler exhaust ductwork to SB 4 north staircase, open two doors on +81ʹ elevation of SB 4, and place SB 4 switchgear room portable cooler in service.

16 hr 40 min 3

Y Cooler must be placed in service to remove heat from the switchgear room to support long term operation of the SAHRS pump.

Action requires routing approximately 50 feet of portable ductwork, opening two doors, connecting the portable cooler to an installed power connection, and starting the cooler. These actions can be performed within 16 hours and 40 minutes.

Plant personnel open seven doors on the +39ʹ elevation of SB 2 to limit temperature rise in associated switchgear room.

25 hr 3 Y Analysis indicated that SB 2 temperatures would remain below equipment operability limits if specified doors were opened 25 hours after initiation of the event.

Action requires opening seven doors in the same area of SB 2.

A pressurized demineralized water source is provided for makeup to the SAHRS pump mechanical seal.

250 days 4 Y Seal Water Buffer Tank GHW44 BB001 has a 40 gallon capacity, adequate to accommodate seal leakage for 7,000 hours (291 days).

A period of 250 days is considered adequate time to stage and install a pressurized demineralized water source.

Table Notes:

1. Event timing is an analysis assumption.

2. Event timing estimated based on engineering judgment.

3. Operator action time is the analytical limit (i.e. the time assumed for completion of the action in the relevant analysis).

Action must be completed by this time, but may be performed earlier to provide margin.


4. Operator action time includes margin to the analytical limit.

5. Event timing based on analysis results.


4.1.7 Functional Performance Requirements for Key Equipment

Functional performance requirements for key equipment can be divided into three

categories: (1) portable equipment, (2) safety related equipment, and (3) non-safety

related equipment. Functional performance requirements for key equipment in each

category are addressed as follows:

Functional performance requirements for key portable equipment required for long-term

ELAP event mitigation (i.e., Phases 2 and 3) are summarized in Table 4–19.

Functional performance requirements for key safety related equipment required for

short and/or long-term ELAP event mitigation are summarized in Table 4–20.

Functional performance requirements for key non-safety related equipment required for

short and/or long-term ELAP event mitigation are summarized in Table 4–21.

Further, note that reasonable protection requirements for this ELAP event mitigation

equipment is discussed in Section 4.1.4.


Table 4–19—Performance Requirements for Key Portable Equipment

Equipment Performance Requirements Interface Requirements

Core Cooling

Portable SG Feed Pump

• Portable SG feed pump is capable of providing a minimum of 150 gpm to each of the four SGs with a maximum SG pressure of 100 psia.

• Connections are sized for a flow rate of 660 gpm (150 gpm to each of four SGs with 10% flow margin).

• Connection points are outside the Fire Protection Building (30SGA01 AA092), outside SB 1 (30LAR55 AA004), inside SB 1 (30LAR55 AA003), or inside SB 4 (30LAR54 AA501).

Containment Integrity

Portable Cooling Water

• A nominal flow rate of 2218 gpm of portable cooling water shall be provided to the dedicated component cooling water piping to provide cooling to the SAHRS heat exchangers 30JMQ40 AC001 and 30JMQ40 AC004, and to the SAHRS pump bearing, seal water, and motor coolers.

• Connection points are flanged connections inside SB 4 at 30KAA80 AA091 and 30KAA80 AA092.

SFP Cooling

Portable SFP Makeup Pump and Water Source

• The pump shall be sized for a minimum flow rate of 140 gpm with a minimum discharge head of 130 feet.

• Connection points are outside FB (30KTC30 AA074 or 30KTC30 AA084).

Electrical and DC Load Shedding

Portable ELAP Generators

• The portable generator connected to Division 1 shall be 550 kW and the portable generators connected to Divisions 2 and 4 shall each be 350 kW.

• Output voltage shall be 480V AC.

• Connection points are in SB (breakers on 31BMB, 32BMB, and 34BMB buses).


Equipment Performance Requirements Interface Requirements

HVAC

Portable Cooler • The cooler (air conditioner) shall be sized to provide a minimum of 32,000 BTUs/hr of cooling to MCR while exhausting heat through approximately 140 feet of portable ductwork.

• Hot exhaust from cooler condensing unit is directed to SB 3.

Portable Cooler • A cooler (air conditioner) shall be sized to provide a minimum of 31,000 BTUs/hr of cooling to SB 4 switchgear room while exhausting heat through approximately 50 feet of portable ductwork.

• Hot exhaust from cooler condensing unit is directed to SB 4 north stairwell +27ʹ elevation and two doors are opened on the +81ʹ elevation of SB 4 to release the heat from the stairwell.


Table 4–20—Performance Requirements for Key Safety Related Equipment

Equipment Performance Requirements Requirements Comparison

Core Cooling

Accumulators • Accumulator water volume, pressure, and boration requirements conform to U.S. EPR FSAR Tier 2, Technical Specification 3.5.1.

• Requirements for ELAP event mitigation are comparable to safety related design basis of equipment.

IRWST • IRWST water volume, temperature, and boration requirements conform to U.S. EPR FSAR Tier 2, Technical Specifications 3.5.4, 3.5.6, and 3.5.7.

• Requirements for ELAP event mitigation are comparable to safety related design basis of equipment.

MSRT • MSRTs are capable of (a) sufficiently depressurizing steam generators to allow RCS to be cooled down at 90°F/hour, and (b) controlling steam generator pressure.

• Requirements for ELAP event mitigation are bounded by safety-related design basis of equipment described in U.S. EPR FSAR Tier 2, Section 10.3.


IRWST • IRWST water volume, temperature, and boration requirements conform to U.S. EPR FSAR Tier 2, Technical Specifications 3.5.4, 3.5.6, and 3.5.7.

• Requirements for ELAP event mitigation are comparable to safety-related design basis of equipment.

SFP Cooling

SFP • SFP level, boration, enrichment, and burnup requirements conform to U.S. EPR FSAR Tier 2, Technical Specifications 3.7.14, 3.7.15, and 3.7.16.

• Requirements for ELAP event mitigation are comparable to safety-related design basis of equipment.

Instrumentation and Controls

Safety related I&C, including PS, SICS, PACS, and SCDS

• Safety related I&C including PS, SICS, PACS, and SCDS functions as described in U.S. EPR FSAR Tier 2, Sections 7.2, 7.3, and 7.5.

• Requirements for ELAP event mitigation are bounded by design basis for safety related I&C equipment.



SFP level • Safety related SFP level instrumentation provided that fulfills NRC Order EA-12-051.

• Requirements for ELAP event mitigation using SFP level instrumentation are described in Section 4.2.

AC and DC Power

DC power distribution system, including EUPS buses, EUPS battery chargers (Divisions 1 and 2), and 2 hour batteries (Divisions 1 to 4)

• DC power distribution functions as described in U.S. EPR FSAR Tier 2, Section 8.3 with one exception. To mitigate events initiated in ELAP State D, operator action is required to open one set of PDS valves. This requires the Division 1 MCC 31BNB03 to be used to backfeed power to 31BRB to re-power the Division 1 PDS valves, and requires the Division 4 EUPS bus 34BRA to be used to backfeed power to 34BRB to re-power the Division 4 PDS valves.

• Requirements for ELAP event mitigation are generally comparable to the safety related design basis of the equipment. Backfeeding of the PDS valves is acceptable for this BDBEE because the electrical equipment can support backfeeding.

AC power distribution system, including transformers, breakers, and alternate feeds

• AC power distribution system functions as described in U.S. EPR FSAR Tier 2, Section 8.3 with one exception. If a portable AC source is used in Division 4 to repower the SAHRS pump, then this will require the load to be backfed through transformer 34BMT02.

• Requirements for ELAP event mitigation are generally comparable to the safety related design basis of the equipment. Backfeeding of the SAHRS pump through transformer 34BMT02 is acceptable for this BDBEE because the electrical equipment can support backfeeding.

HVAC

Division 1 and 2 battery room exhaust fans

• Battery room exhaust fans function as described in U.S. EPR FSAR Tier 2, Section 9.4.6.

• Requirements for ELAP event mitigation are bounded by safety-related design basis of equipment.



Division 1 and 2 SB supply and exhaust fans

• SB supply and exhaust fans function as described in U.S. EPR FSAR Tier 2, Section 9.4.6 with one exception. For ELAP event mitigation, SB 1 and SB 2 will only be ventilated; chilled water will not be provided.

• Requirements for ELAP event mitigation are generally bounded by the safety-related design basis of the equipment. Ventilation only of the Safeguards Buildings is acceptable because equipment in these buildings will be maintained at acceptable temperatures for this BDBEE without chilled water.


Table 4–21—Performance Requirements for Key Non-Safety Related Equipment


Core Cooling

Diesel Driven Fire Water Pump

• Diesel driven fire pumps are capable of providing a minimum of 150 gpm to each of the four SGs with a maximum SG pressure of 100 psia.

• Requirements for ELAP event mitigation are bounded by the design basis for the equipment described in U.S. EPR FSAR Tier 2, Section 9.5.1.

Fire Water Storage Tank

• The capacity of each of the two fire water storage tanks is a minimum of 300,000 gallons.

• Requirements for ELAP event mitigation are comparable to the design basis for the equipment described in U.S. EPR FSAR Tier 2, Section 9.5.1.

SSSS • RCP SSSS limits the RCP seal leakage of each of the four RCP seals to a maximum of 0.5 gpm.

• Requirements for ELAP event mitigation are comparable to the design basis for the equipment described in U.S. EPR FSAR Tier 2, Section 5.4.1.2.1.

PCIP • The PCIP is capable of providing a minimum 330 gpm injection flow to the RCS at a discharge head of 857 feet.

• The PCIP is a dedicated pump used only during an ELAP event.


SAHRS Pump and ancillary equipment

• The SAHRS pump is capable of providing a minimum flow of 232 lbm/sec to the containment spray nozzles.


SAHRS Heat Exchangers

• The SAHRS Heat Exchanger is capable of maintaining containment pressure less than 62 psig and containment temperature less than 310°F with a tube side flow rate of 232 lbm/sec and a shell side flow rate of 2218 gpm at a temperature of 90°F.




Electrical and DC Load Shedding

ELAP Diesel Generator (DG)

• The ELAP DG is capable of generating 1.2 MW at an output voltage of 6.9kV.

• The ELAP DG is a dedicated diesel generator used only during an ELAP event.

4.2 NTTF 7.1, Safety-Related Spent Fuel Pool Level Instrumentation

4.2.1 Overview


Order EA-12-051 (Reference 2). This order stated that reactor licensees must provide

sufficiently reliable instrumentation to monitor SFP water level and be capable of

withstanding design basis natural phenomena.

4.2.2 Conformance

Consistent with the information in Attachment 3 to NRC Order EA-12-051

(Reference 2), the U.S. EPR design addresses the requirements in Attachment 2 to

Order EA-12-051 by providing two physically separate and independent divisions of

safety-related SFP level sensing with two redundant wide range level sensor channels

in each division. The instruments measure the level from the top of the SFP normal

operating range to below the top of the fuel racks. This span provides indication of:

• A level that is adequate to support operation of the normal SFP cooling system.

• A level that is adequate to provide substantial radiation shielding for a person

standing on the SFP operating deck.

• A level where fuel remains covered and actions to implement makeup water addition

should no longer be deferred.

The SFP level instrumentation is safety-related and has the following design features:

• Seismic and environmental qualification of the instruments.

• Independent power supplies.

• Electrical isolation and physical separation between instrument divisions.


• Continuous display in the MCR.

• Routine calibration and testing.

In addition, the following requirements that are specified in Attachment 3 to NRC Order

EA-12-051 (Reference 2) are addressed in a manner consistent with JLD-ISG-2012-03

(Reference 12), NRC Order EA-12-051 (Reference 2), and NEI 12-02, Revision 1

(Reference 13) as endorsed by JLD-ISG-2012-03 (Reference 12).

4.2.3 Arrangement

The SFP includes four SFP wide range level sensors. The safety-related wide range

level sensors are Seismic Category I components. The sensors are located in separate

corners, or recesses, of the SFP to provide reasonable protection against missiles and

debris.

Refer to U.S. EPR FSAR Tier 2, Table 3.2.2-1 and Section 9.1.3.6.

4.2.4 Qualification

The wide range level sensors and cabling for the wide range level instrument channels

are qualified to operate for a minimum period of seven days under the following

conditions:

• Radiological conditions for a normal refueling quantity of freshly discharged

(100 hours) fuel with the SFP water level where fuel remains covered.

• Temperature of 212°F and 100% relative humidity.

• Boiling water and/or steam environment.

• Concentrated borated water environment.

Refer to U.S. EPR FSAR Tier 2, Table 3.11-1.


4.2.5 Power Supplies

The primary instrument channels normally receive power from plant vital AC power.

Each of the two divisions of wide range level sensors includes the capability to connect

a sensor directly to a battery-operated portable indication device. The two portable

indication devices provide on demand push-button-activated indication of SFP level with

no dependence on other station power sources. Each portable indication device is

located in the associated division I&C room, which is protected and accessible during

normal operation, event, and post-event conditions. The portable indication device

batteries are maintained in a charged state during normal operation with a minimum

battery capacity of seven days of on-demand operation.

Refer to U.S. EPR FSAR Tier 2, Sections 9.1.3.1 and 9.1.3.3.2.

4.2.6 Accuracy

The accuracy of the wide range level instrument channels is less than ±1 foot over their

total instrument range of 33 feet (from +30ʹ 0" to +63ʹ 0" elevation). This configuration

provides reasonable assurance that the instrument channel indication demonstrates

that the stored fuel is covered with water. Accuracy is maintained without recalibration

following a power interruption, change in power source, or connection of a battery-

powered indication device.

Refer to U.S. EPR FSAR Tier 2, Section 9.1.3.6.

4.2.7 Display

Continuous display of the SFP level is available in the MCR.

On-demand indication of the SFP level is available in the I&C rooms in Divisions 1

and 4. On-demand display is provided by portable battery-powered indication devices

that can be operated independently of normal and emergency station power sources.


4.2.8 Training

U.S. EPR FSAR Tier 2, Section 13.2 discusses the U.S. EPR design requirements for

development of a training program for plant personnel. The training program will

demonstrate that the SFP instrumentation is maintained available and reliable in an

ELAP event. Personnel will be trained in the use and the provision of alternate power to

the safety-related level instrument channels.

4.3 NTTF 9.3, Enhanced Emergency Preparedness

A portion of Recommendation 9.3 is Tier 1, and requires that enhanced EP staffing and

communications be addressed.

4.3.1 Overview

This section describes provisions for enhancing EP as it relates to staffing and

communications associated with Recommendation 9.3, outlined in Enclosure 5 of the

March 12, 2012 letter, “Request for information pursuant to Title 10 of the Code of

Federal Regulations 50.54(f) regarding Recommendations 2.1, 2.3, and 9.3, of the near-

term task force review of insights from the Fukushima Daiichi accident,” (Reference 9).

The letter requested that an assessment of the COMS and equipment used during an

emergency event be provided to identify any enhancements that may be needed to

ensure communications are maintained during a large scale natural event.

4.3.2 Conformance

4.3.2.1 Enhanced Emergency Plan Communications

The U.S. EPR design includes onsite COMS that are independent and diverse. The

COMS for the U.S. EPR design is described in U.S. EPR FSAR Tier 2, Section 9.5.2.

As noted in U.S. EPR FSAR Tier 2, Section 9.5.2, the COMS consists of the following

subsystems:

• Portable wireless COMS.

• Digital telephone system.


• PA and alarm system.

• Sound-powered system.

• Emergency offsite communication.

• Security communication.

Each communication subsystem provides an independent mode of communications. A

failure of one subsystem does not affect the capability to communicate using the other

subsystem. These diverse COMS are independent of each other to provide effective

communications, including usage in areas exposed to high ambient noise in the plant.

As noted in U.S. EPR FSAR Tier 2, Section 9.5.2, electrical power from a Class 1E

standby power source is provided for the portable wireless COMS base station,

emergency offsite communication capability, and plant security communications. An

isolation device is placed between non-Class 1E COMS components and the Class 1E

power supply to provide the required independence per IEEE Std 384-1992. The

backup power supplies for other communication subsystems (with the exception of the

sound powered phone system) and components are either from integral DC power units

or other plant backup power supplies based on their operational significance and

location. Isolation of the non-safety-related AC sources to the EUPS is also provided as

described in U.S. EPR FSAR Tier 2, Section 8.3.1.1.9.

U.S. EPR FSAR Tier 2, Section 9.5.2.1.3 discusses the requirements for emergency

response facilities and associated communication capabilities.

U.S. EPR FSAR Tier 2, Section 9.5.2.1.3 describes the offsite COMS that interface with

the onsite COMS, including type of connectivity, radio frequency, normal and backup

power supplies, and plant security system interface.

U.S. EPR FSAR Tier 2, Section 9.5.2.1.3 discusses the requirements for emergency

response facilities and associated communication capabilities.


4.3.2.2 Enhanced Emergency Plan Staffing

U.S. EPR FSAR Tier 2, Section 13.0 discusses requirements for adequate plant staff

size and technical competence.


5.0 REFERENCES

NRC Order EA-12-049, “Order Modifying Licenses with Regard to 1.

Requirements for Mitigation Strategies for Beyond-Design-Basis

External Events,” March 12, 2012.

NRC Order EA-12-051, “Order Modifying Licenses with Regard to 2.

Reliable Spent Fuel Pool Instrumentation,” March 12, 2012.

NEI 12-06, Revision 0, “Diverse and Flexible Coping Strategies (FLEX) 3.

Implementation Guide,” Nuclear Energy Institute, August 2012.

SECY-11-0093, “Recommendations for Enhancing Reactor Safety in the 4.

21st Century, the Near-Term Task Force Review of Insights from the

Fukushima Daiichi Accident,” July 12, 2011.

SECY-11-0124, “Recommended Actions to be Taken without Delay from 5.

the Near-Term Task Force Report,” September 9, 2011.

SECY-11-0137, “Prioritization of Recommended Actions to be Taken in 6.

Response to Fukushima Lessons Learned,” October 3, 2011.

SECY-12-0025, “Proposed Orders and Requests for Information in 7.

Response to Lessons Learned from Japan’s March 11, 2011, Great

Tohoku Earthquake and Tsunami,” February 17, 2012.

SECY-12-0095, “Tier 3 Program Plans and 6-Month Status Update in 8.


Tohoku Earthquake and Subsequent Tsunami,” July 13, 2012.

NRC Letter, “Request for Information Pursuant to Title 10 of the Code of 9.

Federal Regulations 50.54(f) Regarding Recommendations 2.1, 2.3, and

9.3, of the Near-Term Task Force Review of Insights from the

Fukushima Dai-Ichi Accident,” March 12, 2012.

Deleted. 10.


JLD-ISG-2012-01, “Compliance with Order EA-12-049, Order Modifying 11.

Licenses with Regard to Requirements for Mitigation Strategies for

Beyond-Design-Basis External Events,” August 29, 2012.

JLD-ISG-2012-03, Revision 0, “Compliance with Order EA-12-051, 12.

Reliable Spent Fuel Pool Instrumentation,” August 2012.

NEI 12-02, Revision 1, “Industry Guidance for Compliance with NRC 13.

Order EA-12-051, To Modify Licenses with Regard to Reliable Spent

Fuel Pool Instrumentation,” Nuclear Energy Institute, August 2012.

NRC Letter to AREVA NP Inc., “Implementation of Fukushima Near-14.

Term Task Force Recommendations,” ADAMS Accession Number -

ML121040163, April 25, 2012.

SRM-12-0025, “Proposed Orders and Requests for Information in 15.


Tohoku Earthquake and Tsunami,” February 17, 2012.

ANP-10263(P)(A), “Codes and Methods Applicability Report for the 16.

U.S. EPR,” AREVA NP Inc., November 2007.

EMF-2328(P)(A), “PWR Small Break LOCA Evaluation Model, S-17.

RELAP5 Based.”

Deleted. 18.

BAW-10252PA-00, “Analysis of Containment Response to Pipe 19.

Ruptures using GOTHIC,” Framatome ANP, Inc., December 2005.

ANP-10299P, Revision 2, “Applicability of AREVA NP Containment 20.

Response Evaluation Methodology to the U.S. EPR™ for Large Break

LOCA Analysis Technical Report,” AREVA NP Inc., December 2009.

Regulatory Guide 1.221, Revision 0, “Design-Basis Hurricane and 21.

Hurricane Missiles for Nuclear Power Plants,” October 2011.


ASCE 7-10, “Minimum Design Loads for Buildings and Other 22.

Structures,” American Society of Civil Engineers, 2010.

ASCE 43-05, “Seismic Design Criteria for Structures, Systems and 23.

Components in Nuclear Facilities,” American Society of Civil Engineers,

2005.

ANSI/ASME B31.1-2004, “Power Piping,” American National Standards 24.

Institute/The American Society of Mechanical Engineers, 2004.

NUREG-1628, “Staff Responses to Frequently Asked Questions 25.

Concerning Decommissioning of Nuclear Power Reactors”, Final Report,

June 2000.

Regulatory Guide 1.189, Revision 1, “Fire Protection for Nuclear Power 26.

Plants,” March 2007.

Deleted. 27.

COMSECY-13-0002, “Consolidation of Japan Lessons Learned Near-28.

Term Task Force Recommendations 4 and 7 Regulatory Activities,”

January 25, 2013.

ANSI/AWWA D100-2005, “Welded Steel Tanks for Water Storage.” 29.

Regulatory Guide 1.76, “Design Basis Tornado for Nuclear Power 30.

Plants”, March 2007.

Nuclear Energy Institute (NEI) position paper, “Position Paper: 31.

Shutdown/Refueling Modes” (Agencywide Documents Access and

Management Systems (ADAMS) Accession No. ML13273A514),

September 18, 2013.

NRC letter to Mr. Joseph E. Pollock, Vice President, Nuclear Energy 32.

Institute (NEI), dated September 30, 2013, Accession No.

ML13267A382.

Date post:	14-Aug-2020
Category:	Documents
Upload:	others
View:	0 times
Download:	0 times