UKEPR Issue 08

Transcription

1 Title: PCSR Sub-chapter 14.4 Analyses f the PCC-3 events Ttal number f pages: 180 Page N.: I / VII Chapter Pilt: F. CERRU Name/Initials Date Apprved fr EDF by: A. MARECHAL Apprved fr AREVA by: G. CRAIG Name/Initials Date Name/Initials Date REVISION HISTORY Issue Descriptin Date 00 First issue fr INSA review Secnd issue fr INSA review Integratin f c-applicant and INSA review cmments Additin f sectin relative t SGTR (1 tube) Remarking with RESTRICTED classificatin June 2009 update including: Text clarificatins Additin f references Technical update t accunt fr December 2008 Design Freeze ntably new permissive signal fr URBWZ (sectin 6), new PSRV design and pressuriser spray classificatin and partial cldwn rate (sectins 3, 5 and 7) and fuel pl and FPCS/FPPS characteristics including available vlumes and RRI parameters (sectins 14, 15 and 16) Remval f RESTRICTED classificatin Cnslidated Step 4 PCSR update: - Minr editrial changes - Update f references - Update f steam generatr tube rupture (1 tube) fault analysis ( 6), - Update f the spent fuel pl fault analyses ( 14, 15 and 16) Cntinued n next page

2 Title: PCSR Sub-chapter 14.4 Analyses f the PCC-3 events Page N.: II / VII REVISION HISTORY (Cnt d) Issue Descriptin Date 08 Cnslidated PCSR update: - References listed under each numbered sectin r sub-sectin heading numbered [Ref-1], [Ref-2], [Ref-3], etc - Minr editrial changes - Update f references (English translatins) - Additin f a remark abut inherent brn dilutin in case f small break LOCA and additin f an assciated reference ( 5) - Update f Steam Generatr Tube Rupture (1 Tube) ( 6) - Remval f text regarding breaks lcated upstream f the tw islatin valves nt being taken int accunt ( 16)

3 Title: PCSR Sub-chapter 14.4 Analyses f the PCC-3 events Page N.: III / VII Cpyright 2012 AREVA NP & EDF All Rights Reserved This dcument has been prepared by r n behalf f AREVA NP and EDF SA in cnnectin with their request fr generic design assessment f the EPR TM design by the UK nuclear regulatry authrities. This dcument is the prperty f AREVA NP and EDF SA. Althugh due care has been taken in cmpiling the cntent f this dcument, neither AREVA NP, EDF SA nr any f their respective affiliates accept any reliability in respect t any errrs, missins r inaccuracies cntained r referred t in it. All intellectual prperty rights in the cntent f this dcument are wned by AREVA NP, EDF SA, their respective affiliates and their respective licensrs. Yu are permitted t dwnlad and print cntent frm this dcument slely fr yur wn internal purpses and/r persnal use. The dcument cntent must nt be cpied r reprduced, used r therwise dealt with fr any ther reasn. Yu are nt entitled t mdify r redistribute the cntent f this dcument withut the express written permissin f AREVA NP and EDF SA. This dcument and any cpies that have been made f it must be returned t AREVA NP r EDF SA n their request. Trade marks, lgs and brand names used in this dcument are wned by AREVA NP, EDF SA, their respective affiliates r ther licensrs. N rights are granted t use any f them withut the prir written permissin f the wner. EPR TM is an AREVA Trade Mark. Trade Mark Fr infrmatin address: AREVA NP SAS Tur AREVA Paris La Défense Cedex France EDF Divisin Ingénierie Nucléaire Centre Natinal d'equipement Nucléaire , avenue Pierre Brsslette BP Mntruge France

4 Title: PCSR Sub-chapter 14.4 Analyses f the PCC-3 events Page N.: IV / VII TABLE OF CONTENTS 1. SMALL STEAM OR FEEDWATER SYSTEM PIPING FAILURE (DN<50), INCLUDING BREAK OF CONNECTING LINES TO STEAM GENERATOR (DN<50) [STATES A, B] 1.1 ACCIDENT DESCRIPTION 1.2 SYSTEM SIZING 2. LONG-TERM LOSS OF OFFSITE POWER (>2 HOURS) 2.1 INTRODUCTION 2.2 IDENTIFICATION OF CAUSES AND ACCIDENT DESCRIPTION 2.3 FURTHER EVENT SEQUENCE UP TO 24 HOURS 2.4 CONCLUSION 2.5 SYSTEM SIZING 3. INADVERTENT OPENING OF A PRESSURISER SAFETY VALVE (STATE A) 3.1 EVENT DESCRIPTION 3.2 INFLUENCE OF THE PRESSURISER SAFETY VALVES NEW DESIGN 3.3 SYSTEM SIZING 4. INADVERTENT OPENING OF AN SG RELIEF TRAIN OR A SAFETY VALVE (STATE A) 4.1 FAILURE OF ONE MAIN STEAM RELIEF CONTROL VALVE 4.2 SPURIOUS OPENING OF A MAIN STEAM RELIEF TRAIN 4.3 SPURIOUS OPENING OF ONE MAIN STEAM SAFETY VALVE (MSSV) 4.4 SYSTEM SIZING 5. SMALL BREAK LOCA (DN < 50) INCLUDING A BREAK IN THE RBS [EBS] INJECTION LINE (STATES A AND B) 5.1 SMALL BREAK LOCA IN STATE A 5.2 SMALL BREAK LOCA DN 50 IN STATE B 5.3 CONSEQUENCES OF THE MODIFICATION OF THE PARTIAL COOLDOWN RATE

5 Title: PCSR Sub-chapter 14.4 Analyses f the PCC-3 events Page N.: V / VII 5.4 SYSTEM SIZING 6. STEAM GENERATOR TUBE RUPTURE (1 TUBE) 6.1 IDENTIFICATION OF CAUSES AND ACCIDENT DESCRIPTION 6.2 SAFETY CRITERIA 6.3 METHODS AND ASSUMPTIONS 6.4 DEFINITION OF CASES STUDIED 6.5 SHORT TERM STUDY 6.6 LONG TERM STUDY 6.7 IMPACT OF THE MODIFICATION TO THE PARTIAL COOLDOWN RATE AND SAFETY CLASSIFICATION UPGRADE OF THE NORMAL SPRAY OPERATIONS 6.8 CONCLUSION 6.8 SYSTEM SIZING 7. INADVERTENT CLOSURE OF ONE OR ALL MAIN STEAM ISOLATION VALVES (PCC-3) 7.1 INTRODUCTION 7.2 INADVERTENT CLOSURE OF ALL VIV [MSIV] (STATE A, PCC-3) 7.3 INADVERTENT CLOSURE OF ONE VIV [MSIV] (IN STATE A) 7.4 SYSTEM SIZING 8. INADVERTENT LOADING OF A FUEL ASSEMBLY IN AN INCORRECT POSITION 8.1 DESCRIPTION 8.2 IDENTIFICATION OF CAUSES, PREVENTION METHODS 8.3 DETECTION METHODS 8.4 ANALYSIS OF THE CONSEQUENCES 8.5 SYSTEM SIZING 9. FORCED DECREASE OF REACTOR COOLANT FLOW (FOUR PUMPS) 9.1 IDENTIFICATION OF CAUSES AND ACCIDENT DESCRIPTION

6 Title: PCSR Sub-chapter 14.4 Analyses f the PCC-3 events Page N.: VI / VII 9.2 METHODS AND ASSUMPTIONS 9.3 RESULTS AND CONCLUSION 9.4. SYSTEM SIZING 10. LEAK IN THE GASEOUS WASTE PROCESSING SYSTEMS 11. LOSS OF PRIMARY COOLANT OUTSIDE THE CONTAINMENT 11.1 INTRODUCTION SYSTEM SIZING 12. UNCONTROLLED RCCA BANK WITHDRAWAL (STATES B, C, AND D) 13. UNCONTROLLED SINGLE CONTROL ROD WITHDRAWAL 13.1 IDENTIFICATION OF CAUSES AND ACCIDENT DESCRIPTION 13.2 METHODS AND ASSUMPTIONS 13.3 RESULTS AND CONCLUSIONS SYSTEM SIZING 14. LONG TERM LOSS OF OFFSITE POWER (LOOP): FUEL POOL COOLING ASPECTS (STATE A) 14.1 INTRODUCTION 14.2 PRE-ACCIDENT CONDITIONS (NORMAL OPERATION PCC-1) 14.3 GRACE PERIOD 14.4 BOUNDARY CONDITIONS 14.5 DECOUPLING CRITERIA 14.6 TRANSIENTS 14.7 CONCLUSION 14.8 EFFECT OF A REACTOR EVENT ON THE PTR [FPCS] 15. LOSS OF ONE TRAIN OF THE FUEL POOL COOLING SYSTEM (PTR) [FPCS] OR OF A SUPPORTING SYSTEM (STATE F) 15.1 INTRODUCTION 15.2 PRE-ACCIDENT CONDITIONS (NORMAL OPERATION PCC-1)

7 Title: PCSR Sub-chapter 14.4 Analyses f the PCC-3 events Page N.: VII / VII 15.3 GRACE PERIOD 15.4 BOUNDARY CONDITIONS 15.5 DECOUPLING CRITERIA 15.6 TRANSIENTS 15.7 CONCLUSION 16. ISOLATABLE PIPING FAILURE ON A SYSTEM CONNECTED TO THE SPENT FUEL POOL (STATE A TO F) 16.1 INTRODUCTION 16.2 PRE-ACCIDENT CONDITIONS (NORMAL OPERATION PCC-1) 16.3 GRACE PERIOD 16.4 BOUNDARY CONDITIONS 16.5 DECOUPLING CRITERIA 16.6 TRANSIENTS 16.7 CONCLUSION

8 PAGE : 1 / 173 SUB-CHAPTER ANALYSES OF THE PCC-3 EVENTS 1. SMALL STEAM OR FEEDWATER SYSTEM PIPING FAILURE (DN < 50), INCLUDING BREAK OF CONNECTING LINES TO STEAM GENERATOR (DN < 50) [STATES A, B] 1.1. ACCIDENT DESCRIPTION Minr piping failures (DN < 50mm) lcated in the steam r feedwater system, r in the Steam Generatrs (SGs) cnnecting lines are defined as PCC-3 events related t steam r feedwater breaks. The cnsequences f these PCC-3 events are bunded by the PCC-4 events Main steam line break r Main feedwater line break, which are analysed in sectins 2 and 3 f Sub-chapter Fr the smaller PCC-3 breaks, the steam r water break flw is much lwer than in the larger PCC-4 breaks. This results in a less severe uncntrlled RCP [RCS] vercling r verheating rate. Fr instance, at the ht shutdwn pressure f 90 bar the highest perating pressure: The energy remved thrugh a DN50 break (20 cm 2 ) with saturated steam flw cnditins is less than 2% NP (NP = nminal pwer f 4500 MWth) The feedwater flw lst thrugh a DN50 break (20 cm 2 ) with sub-cled liquid flw cnditins is in the range f 10% NF (NF= nminal flw f app kg/s in fur SGs) When cmpared t the PCC-4 transients, the resulting lw secndary side depressurisatin rate may nt be sufficient t activate the F1 signals dedicated t the fast PCC-4 transients. These are the RT and turbine trip and VIV [MSIV] clsing n "high steam pressure drp MAX1", and the cmplete feedwater islatin in the affected SG n "high steam pressure drp MAX2". Hwever, the lack f activatin f thse signals des nt invalidate the bunding aspect f the PCC-4 analyses, as: During pwer peratin, the cre is prtected by the dedicated prtectin signals "high cre pwer level" and "lw DNBR", independent f the steam pressure signals, After reactr shutdwn: Fr the steam release, if the "high steam pressure drp" F1 signal is nt activated, the VIV [MSIV] is clsed autmatically by the "lw steam pressure MIN" F1 signal at 50 bar. Cmplete feedwater islatin in the affected SG is initiated by the "secnd lw steam pressure MIN2" F1 signal at 40 bar. Abve 50 bar, n the secndary side, the cre remains subcritical, even withut bratin. The shutdwn margin frm the cntrl and shutdwn rds is sufficient t cmpensate fr the reactivity insertin dwn t a cre temperature f 260 C the saturatin temperature fr 47 bar. This assessment assumes the highest wrth rd stuck in its upper psitin. Belw 50 bar, in the affected SG, cre criticality may ccur, but the PCC-3 break cling capability fr DN < 50, i.e. < 20 cm 2 is much lwer than the PCC-4 case analysed in sectin 2 f Subchapter That case cnsiders a 2A steam line break f area 1300 cm 2 at

9 PAGE : 2 / 173 the SG utlet. The pwer excursin calculated in the PCC-4 analysis bunds the ne assciated with the smaller PCC-3 breaks by a significant margin. Fr the feed release, the Main feedwater line break analysis perfrmed in sectin 3 f Sub-chapter 14.5 des nt claim the "steam pressure" signals, "high steam pressure drp" r "lw steam pressure". The analysis nly relies n the "lw SG-level MIN" in the unaffected SG t initiate the F1 prtectin and mitigatin actins. This decupling assumptin ensures that the maximum lss f feedwater is used in the PCC-4 analysis. It therefre cvers any break size within the whle feedwater break size spectrum, including the smaller PCC-3 breaks SYSTEM SIZING This event is nt limiting fr the design f the claimed safety systems.

10 PAGE : 3 / LONG-TERM LOSS OF OFFSITE POWER (>2 HOURS) 2.1. INTRODUCTION The lss f ff-site pwer r lss f nn-emergency AC pwer t the statin auxiliaries is caused by either a cmplete lss f ff-site pwer cincident with a turbine trip, r a lss f nsite pwer. The lss f pwer results in an immediate reactr clant pump castdwn and lss f main feedwater flw. A reactr trip will ccur n lw pump speed as a result f the lss f pwer. Diesel generatrs are started and prvide electric pwer t essential lads. The sensible and decay heat lads are remved by the steam relief and ASG [EFWS]. Tw types f LOOP are identified, depending n their prbability f ccurrence: Shrt-term LOOP with an ff-site pwer recvery time f tw hurs. This is classified as a PCC-2 event. Lng-term LOOP with an ff-site pwer recvery time f 24 hurs. This is classified as a PCC-3 event. The shrt-term LOOP is analysed in sectin 6 f Sub-chapter 14.3; the lng-term LOOP is analysed belw IDENTIFICATION OF CAUSES AND ACCIDENT DESCRIPTION Infrmatin n the identificatin f the causes and the accident descriptin are prvided in sectin 6 f Sub-chapter The descriptin f the shrt-term LOOP als applies t the lngterm LOOP f mre than tw hurs. The steady-state plant cnditin that is reached a few minutes after the LOOP ccurs, using nly F1A functins, als applies t cases lasting up t 24 hurs. The main characteristics f the safe plant cnditins are: The emergency diesel generatrs (EDGs) are in peratin. These are started abut 10 secnds after the LOOP ccurs. These supply all essential systems needed in all circumstances fr bratin, heat remval and activity cntainment. The systems supprted by the diesel generatrs are the ASG [EFWS], RRI [CCWS] and SEC [ESWS], RBS [EBS], RCV [CVCS] and RIS/RRA [SIS/RHRS]. The reactr is tripped with the RCCAs inserted with sufficient shutdwn margin at the ht standby temperature. The reactr clant pumps are shutdwn and the heat remval frm the cre takes place thanks t natural circulatin in all lps. The secndary side SG pressure cntrl is perfrmed by the F1A classified VDA [MSRT] at a pressure f 95.5 bar. The main cndenser is unavailable fllwing LOOP.

11 PAGE : 4 / 173 The primary clant temperatures are cnsistent with the secndary pressure at abut 306 C in the cld leg. The ht leg temperature is a few degrees higher, depending n the decay heat level. The primary system pressure is in the nrmal perating range arund 155 bar and is cntrlled by the EDG pwered auxiliary spray and pressuriser heaters (576 kw). The pressuriser water inventry is between the HZP and HFP nminal level. The actual level depends n cntrl being perfrmed by the EDG-pwered RCV [CVCS] pumps and the letdwn cntrl. The SG water inventry is at its nminal level f 15.7 m and is cntrlled by the EDGpwered ASG [EFWS]. The ASG [EFWS] pumps are actuated autmatically by the signal SG level < MIN2 r earlier FURTHER EVENT SEQUENCE UP TO 24 HOURS There are tw main pssibilities fr lng-term LOOP: remaining in a cntrlled state at ht shutdwn, r cling the RCP [RCS] until RIS/RRA [SIS/RHRS] cnnecting cnditins are reached, the safe shutdwn state Staying at Ht Cnditins The ht shutdwn state crrespnding t a secndary side pressure at the VDA [MSRT] as described abve can be safely maintained fr 24 hurs. This is achieved using the fllwing functins and systems that are pwered by the EDG r by battery supplies: RCP [RCS] integrity, i.e., preventin f leaks such as leaks at RCP [RCS] pumps seals. This is prvided by the seal water injectin frm the RCV [CVCS] charging pumps r the thermal barrier cled by the cmpnent cling water system (RRI [CCWS]). RCP [RCS] inventry and pressuriser level is cntrlled by the RCV [CVCS] charging and letdwn. RCP [RCS] pressure cntrl is perfrmed by the pressuriser heaters (576 kw). The secndary side heat remval is prvided via the VDA [MSRT]. These are battery pwered using batteries that can be charged by the EDGs. The SG inventry is maintained by the ASG [EFWS]. The ttal water inventry in the tanks is sufficient fr heat remval ver the 24 hur perid. The tanks can be refilled frm ther surces fr use beynd 24 hurs. The functins mentined abve are F1A classified, with the exceptin f the RCV [CVCS] and the pressuriser heaters. If the RCV [CVCS] is assumed t be unavailable, the RBS [EBS] can be used fr bratin and inventry cntrl. Under extreme cnditins, the MHSI culd be used fr inventry cntrl after a partial cldwn has been cmpleted using the VDA [MSRT]. The surces t refill the ASG [EFWS] tanks are nn classified.

12 PAGE : 5 / 173 Single Failure (SF) and Preventive Maintenance (PM) Single failure and preventive maintenance assumptins d nt affect the ability t maintain the plant in ht shutdwn cnditin. All the abve-mentined safety and peratinal systems are designed t meet the single failure criterin, with the exceptin f the RCV [CVCS]. In additin, the lss f ne r tw safety system trains, such as the ASG [EFWS], can be cmpensated fr by pening the nrmally passive headers. This allws all fur lps t be used fr heat remval. The limiting event fr the heat remval capacity f the ASG [EFWS] is the feedwater line break described in sectin 3 f Sub-chapter Thus there is additinal margin in the system fr this event Cldwn f the Plant t RIS/RRA [SIS/RHRS] (Safe Shutdwn State) The plant can be cled t the RIS/RRA [SIS/RHRS] cnnecting cnditins by means f the EDG-pwered safety systems alne. The cnnectin cnditins are a RCP [RCS] pressure less than 30 bar and a ht leg temperature f 180 C. Fr plant cldwn, the RBS [EBS] is available fr bratin and t cmpensate fr the reductin in clant vlume during the cldwn. The VDA [MSRT] are available fr steam remval t the atmsphere, and the ASG [EFWS] fr water supply t the SGs. The justificatins fr the adequacy f the cling capacity and the functins required t reach the safe shutdwn state are prvided in ther sectins as identified in Sectin Table CONCLUSION The lng-term LOOP is safely mitigated by means f the functins and systems pwered by the EDGs. The RCP [RCS] and secndary side safely maintain their integrity and nly steam is released t the atmsphere. Therefre, all the acceptance and safety criteria fr a PCC-3 event are satisfied. Bth the cntrlled state and the safe shutdwn state are safely reached and maintained SYSTEM SIZING This event is nt limiting fr the design f the claimed safety systems.

13 PAGE : 6 / 173 SECTION TABLE 1 Cldwn f the Plant t RIS/RRA [SIS/RHRS] cnnecting cnditins (Safe Shutdwn) Criteria Reference Case Remark/Reasn Subcriticality Activity release Heat remval Sectin 13 f Sub-chapter 14.3 (Uncntrlled brn dilutin) Sectin 6 f this sub-chapter (SG tube rupture) Sectin 3 f Sub-chapter 14.5 (Feedwater line break) Achieved with ne stuck rd Tube rupture is the limiting PCC-3 event In the reference case nly ne train is available fr cldwn.

14 PAGE : 7 / INADVERTENT OPENING OF A PRESSURISER SAFETY VALVE (STATE A) 3.1. EVENT DESCRIPTION The inadvertent pening f a pressuriser safety valve event is defined as the spurius pening f a pressuriser safety valve (PSV) which is nrmally clsed during plant peratin. During nrmal pwer peratin, the pening r clsing demand fr a PSV is hydraulic and valve-specific. Thus, a single failure can impact nly ne PSV. An inadvertent pening f a pressuriser safety valve is similar t a small break lss f clant accident (SB-LOCA) n the ht side f the reactr clant system (RCP [RCS]). The inadvertent pening f a pressuriser safety valve is a PCC-3 event and is bunded by the analyses perfrmed fr anther PCC-3 event, SB LOCA DN < 50 in sectin 5 f this subchapter because: The steam relief capacity f a PSV f 300 te/h at 176 bar crrespnds t an equivalent leak area f abut 30 cm 2. The PCC-3 SB-LOCA break analysed in sectin 5 f this sub-chapter is the largest PCC-3 SB-LOCA event, with an equivalent break area f 20 cm 2, crrespnding t an equivalent diameter f 50 mm. The PSV leak f 30 cm 2 lcated in the RCP [RCS] ht side is bunded, fr the lss f RCP [RCS] clant, by the SB-LOCA cld leg break f 20 cm 2. This is because f a higher injectin/leak rati and a lwer leak flw rate: Fr ht leg breaks, the minimum effective injectin capacity is 100 % mre than fr cld leg breaks nce the effect f a single failure and preventive maintenance are cnsidered. Injectin int the brken lp f the RIS [SIS] can be claimed fr the PSV leak. Therefre, tw MHSI are available versus ne MHSI fr the SB-LOCA cld leg break. Leak size is 50% larger (PSV leak: 30 cm 2, SB-LOCA cld leg: 20 cm 2 ). Even with the same injectin/leak rati, breaks lcated in the ht side f the RCP [RCS] are less nerus than breaks in the cld side. This is because f the higher break flw quality. The presence f steam at the break reduces the leak mass flw rate and increases the RCP [RCS] depressurisatin. Based n these statements and the SB-LOCA results f sectin 5 f this sub-chapter, it can be cncluded withut additinal transient analysis, that cre uncvery des nt ccur during the PCC-3 event Inadvertent pening f a pressuriser safety valve.

15 PAGE : 8 / INFLUENCE OF THE PRESSURISER SAFETY VALVES NEW DESIGN The accident was analysed assuming the SEBIM mdel fr the Pressuriser Safety Valves (PSV) whilst the SEMPELL mdel valve will be implemented n the EPR pressuriser. As the steam relief capacity fr a SEMPELL pressuriser safety valve is the same as that fr a SEBIM pressuriser safety valve (300 te/h at 176 bar), the results and thus cnclusins resulting frm the analysis f the inadvertent pening f a SEBIM type pressuriser safety valve are the same with the PSV SEMPELL type valve SYSTEM SIZING This event is nt limiting fr the design f the claimed safety systems.

16 PAGE : 9 / INADVERTENT OPENING OF AN SG RELIEF TRAIN OR A SAFETY VALVE (STATE A) The mst severe cre cnditins fllwing an accidental depressurisatin f the main steam system due t a spurius r inadvertent pening f a main steam valve result frm: The spurius pening f a main steam relief train (VDA [MSRT]). The spurius pening f a main steam safety valve (MSSV) These are bth classified as PCC-3 events. During pwer peratin, cre prtectin is prvided by a reactr trip initiated by the Reactr Prtectin System (RPR [PS]), which includes the DNBR prtectin channel. The autmatic actuatin f the reactr trip prevents any cre damage prir t cmpletin f the plant shutdwn. After plant shutdwn, the cre vercling transient cntinues fr as lng as the main steam system depressurisatin cntinues. There is the ptential fr a return t cre criticality. The severity f the event depends n this ptential return t cre criticality after the reactr trip. The classificatin f each event and the crrespnding severity in terms f the uncntrlled RCP [RCS] cldwn is discussed belw FAILURE OF ONE MAIN STEAM RELIEF CONTROL VALVE The maximum discharge capacity f each VDA [MSRT] is 50% f the full lad steam generatin f the assciated SG [Ref-1]. This crrespnds t apprximately 14% f the plant full lad steam flw. Each VDA [MSRT] cnsists f an MSRIV, which is nrmally clsed and an MSRCV, which is nrmally pen, in series. The MSRCV is nrmally pen and the relief train is kept clsed by the nrmally clsed MSRIV. Therefre, the failure f the MSRCV will nt affect nrmal plant peratin SPURIOUS OPENING OF A MAIN STEAM RELIEF TRAIN The spurius pening f a VDA [MSRT] is caused by the spurius pening f the crrespnding main steam relief islatin valve (MSRIV). This ccurs via the spurius pening f the tw slenid-driven pilt valves in series. The spurius pening f a VDA [MSRT] is cnsequently classified as a PCC-3 event. On actuatin f the "SG Pressure Drp > MAX1" signal, all the VIV [MSIV] are autmatically clsed. Once the main steam lines islate, nly the affected steam generatr cntinues t depressurise. When main steam pressure reaches the MIN3 setpint, the VDA [MSRT] is autmatically islated by clsing bth the MSRCV and MSRIV. Therefre, the limiting single failure fr this scenari is a failure f the assciated MSRCV t clse. This will result in a cntinued un-islatable steam discharge frm the affected SG.

17 PAGE : 10 / 173 The ptential cldwn resulting frm the Inadvertent Opening f a MSRIV event is bunded by that resulting frm the Main Steam Line Break event. The Excessive Increase in Secndary Steam Flw event discussed in sectin 3 f Sub-chapter 14.3 and the Main Steam Line Break event discussed in sectin 2 f Sub-chapter 14.5 represent a far greater increase in steam lad. Cnsequently they result in a bunding rate f reactivity increase relative t this event. Therefre, the spurius pening f a VDA [MSRT] event is bunded by the cnsequences f ther increase in steam flw events SPURIOUS OPENING OF ONE MAIN STEAM SAFETY VALVE (MSSV) The main steam safety valve (MSSV) is a spring-laded valve. The spurius pening f a MSSV is therefre classified as a PCC-3 event. The capacity f each MSSV is 25% f the full lad steam generatin f the assigned SG [Ref-1]. This crrespnds t rughly 6% f the plant full lad steam flw. The increase in steam lad fllwing a single MSSV failing pen is small and is bunded by the cnsequences f the Main Steam Line Break (MSLB) in State A. This is classified as a PCC-4 event and is analysed in sectin 2 f Sub-chapter 14.5, Main Steam Line Break (States A, B). The MSLB analysis shws that fuel damage des nt ccur during the subsequent uncntrlled cre cling transient. It is cnfirmed that n cre DNB ccurs in this transient. Therefre, the Inadvertent Opening f a MSSV event is bunded by the cnsequences f ther increases in steam flw. NOTE: Failure t clse ne SG safety valve after a demand t pen In the PCC analyses, the SG safety valve is nly actuated after failure f the VDA [MSRT] t pen, in cases where the main steam header is islated. Cnsequently, a stuck-pen SG safety valve need nt t be included in the PCC analyses, since it wuld result frm a duble failure. This wuld be the failure f ne VDA [MSRT] islatin valve t pen, fllwed by the failure f ne SG safety valve t clse after us) SYSTEM SIZING This event is nt limiting fr the design f the claimed safety systems.

18 PAGE : 11 / SMALL BREAK LOCA (DN < 50) INCLUDING A BREAK IN THE RBS [EBS] INJECTION LINE (STATES A AND B) A small break is defined as a break f equivalent diameter smaller than r equal t 50 mm (~20 cm 2 ) SMALL BREAK LOCA IN STATE A Identificatin f Causes and Accident Descriptin General Cmments The fllwing small breaks are nt studied in this sub-chapter: Steam generatr tube ruptures fr which the physical phenmena are different. These transients are described in sectin 6 f this sub-chapter fr Steam Generatr Tube Rupture (ne tube) and sectin 10 f Sub-chapter 14.5 fr Steam Generatr Tube Rupture (tw tubes in 1 SG). Leaks in the RCP [RCS] that are cmpensated fr by the RCV [CVCS]. A lss f clant accident causes: Lss f reactr clant inventry and a pssible cre heat-up Cntainment lads due t verpressure frm a mass and energy release. This is discussed in sectin 1 f Sub-chapter 6.2 Mechanical lads n RCP [RCS] cmpnents and assciated supprts and structures as discussed in Sub-chapter 3.4 Mechanical lads n RPV internals as discussed in Sub-chapter 3.4. The radilgical cnsequences f a LOCA are analysed in the sectin related t Small Break LOCA in Sub-chapter The risk f inherent brn dilutin fllwing a LOCA may lead t the frmatin and accumulatin f a plug f clear water (lw brn cncentratin) in a Steam Generatr, after which this then starts t flw twards the reactr vessel. A cmplete descriptin f the calculatin prcedure used t assess the inherent brn dilutin fllwing LOCA is presented in [Ref-1]. A LOCA is classified as a PCC-3 r a PCC-4 event accrding t the break size and the plant initial state. This sectin nly deals with the small break LOCA in state A, classified as a PCC-3 event as discussed in Sub-chapter 14.0.

19 PAGE : 12 / Typical sequence f events Frm the initiating event t the cntrlled state The break results in a lss f reactr clant inventry that cannt be cmpensated fr by the RCV [CVCS]. The lss f primary clant causes a decrease in the primary system pressure and the pressuriser level. A reactr trip (RT) ccurs fllwing a lw pressuriser pressure < MIN2 signal. The RT signal autmatically trips the turbine and clses the ARE [MFWS] high-lad lines. As the secndary side pressure increases, the GCT [MSB] valves pen allwing steam t dump t the cndenser. If the cndenser is unavailable fr steam dump, fr example if Lss f Off-site Pwer (LOOP) ccurs cincident with the turbine trip, the VDA [MSRT] pen allwing the steam t be dumped t the atmsphere. The SGs are fed by the ARE [MFWS] thrugh the lw-lad lines. If the ARE [MFWS] is unavailable, the start-up and shutdwn pump AAD [SSS] starts and feeds the SG thrugh the lw-lad lines. If the AAD [SSS] is unavailable, fr example if LOOP ccurs cincident with the turbine trip, the ASG [EFWS] is actuated fllwing a lw SG level < MIN2 signal. A Safety Injectin (SI) signal is actuated fllwing a pressuriser pressure < MIN3 signal. The SI signal autmatically starts the MHSI and LHSI pumps and initiates a partial cldwn f the secndary system. The partial cldwn cls the primary system and reduces the RCP [RCS] pressure. During the partial cldwn, the RCP [RCS] pressure decreases sufficiently t allw MHSI injectin int the cld legs. The partial cldwn is perfrmed by all SGs using the steam dump t cndenser r t the atmsphere fr cases with LOOP. This is perfrmed by autmatically decreasing the respective relief valve setpints fr a cnstant cling rate f -100 C/h. This decrease cntinues t a fixed pressure value which is lw enugh t allw the necessary MHSI injectin but high enugh t prevent cre re-criticality. Fr these break sizes, the vlume f the flw thrugh the break is less than the vlume being added by the MHSI and steam prductin in the cre due t the decay heat. Depressurisatin f the RCP [RCS] therefre stps at the end f the partial cldwn. This cntinues until the energy remved at the break becmes sufficient t remve the decay heat. The RCP [RCS] inventry cntinues t decrease whilst MHSI injectin is insufficient t match the break flw. During this phase the break flw is sub-cled until it eventually reaches saturatin cnditins. The break flw decreases as the vid fractin in the cld legs increases. Eventually, the break flw changes t single phase steam. The RCP [RCS] inventry depletin stps nce sufficient MHSI flw is available t cmpensate fr the break flw. Prir t the time at which the MHSI flw matches the break flw, the cre may becme uncvered. In these circumstances, the fuel clad temperature increases abve the saturatin level in the uncvered part f the cre. The cladding temperature increase is directly prprtinal t the depth and duratin f the cre uncvery. Therefre, dedicated criteria discussed in Sub-chapter 14.1, must be met t prevent any unacceptable cre damage and t limit the radilgical cnsequences t the envirnment. The cntrlled state is reached when the fllwing cnditins are met: The cre is subcritical

20 PAGE : 13 / 173 The cre pwer is remved The reactr clant inventry is stable r increasing Frm Cntrlled State t Safe Shutdwn State During the cntrlled state, the cre cling is prvided by the RCP [RCS] water supply frm the RIS [SIS] and the RCP [RCS] heat remval via the break, and the SG if needed. This state can nt last fr a lng perid f time fr the fllwing reasns: The ASG [EFWS] tanks empty The cntainment pressure and temperature increase. Thus a transfer t the safe shutdwn state is necessary. Fllwing a SB-LOCA, the safe shutdwn state is reached when the fllwing cnditins are met: The cre is subcritical even after xenn depletin The break flw is matched by RIS [SIS] flw The decay heat is remved by the cling chain LHSI/RRI/SEC [LHSI/CCWS/ESWS] with the LHSI used in RHR mde and partially by the break flw The activity release is within the PCC-3 limits. A transfer t the RIS/RRA [SIS/RHRS] cnnectin cnditins is required t reach the safe shutdwn state. The sequence f actins t be perfrmed is as fllws: Bratin phase: The RCP [RCS] must be brated t keep the cre subcritical thrughut the transient during the transitin t the safe shutdwn state. Fr smaller break sizes 1 MHSI bratin is nt sufficient, due t a lw injectin flw rate. Fr these breaks the RCP [RCS] bratin is perfrmed during the RCP [RCS] cldwn by the RCV [CVCS], if available, via the charging line. If it is nt available it is perfrmed by the F1A classified Extra Bratin System (RBS [EBS]), with injectin f bric acid f 7000 ppm enriched brn. The RCP [RCS] cldwn rate is either 25 C/h if ne RBS [EBS] pump is in peratin, r 50 C/h if tw RBS [EBS] pumps are in peratin. The RBS [EBS] is designed such that the injectin f brn fully cmpensates fr the reactivity insertin resulting frm the RCP [RCS] cldwn rates. 2 Fr larger break sizes, MHSI bratin is sufficient. 1 2 Break sizes typically lwer than 1 cm 2 ( 10 mm), with RCP [RCS] highly sub-cled. Break sizes typically higher than 1 cm 2 ( 10 mm).

21 PAGE : 14 / 173 RCP [RCS] cldwn: The RCP [RCS] cldwn is manually initiated via the secndary side. It is perfrmed by decreasing the GCT [MSB] setpint, if available, r by decreasing the VDA [MSRT] setpints. This manual cldwn is F1B classified. The minimum cldwn rate claimed in the EPR design is 25 C/h, prvided it is nt limited by the VDA [MSRT] r GCT [MSB] capacity. As detailed previusly, the cldwn rate depends n the number f RBS [EBS] trains in peratin. RCP [RCS] depressurisatin: The depressurisatin is perfrmed by shutting dwn the MHSI pumps nce the RCP [RCS] ht leg temperature falls belw 200 C. This temperature is sufficiently lw fr LHSI injectin t prvide the required injectin. Hwever, this actin is nly undertaken if the LHSI pumps are already in peratin and the RCP [RCS] water inventry is sufficient. The Reactr Pressure Vessel Level 3 (RPVL) and T sat measurements, bth F1B classified, prvide the required infrmatin n RCP [RCS] water inventry, as required by the emergency perating prcedures. Cnnectin f the LHSI/RHR trains is pssible when the fllwing RCP [RCS] cnditins are met: RCP [RCS] ht leg pressure belw 30 bar RCP [RCS] ht leg temperature belw 180 C T sat and RPVL cnsistent with LHSI/RHR suctin frm the ht leg. The safe shutdwn state is then maintained by cntrlling the RCP [RCS] water inventry with ne LHSI perating in SI mde, and by cntrlling the RCP [RCS] temperature with the ther LHSI perating in RHR mde. The LHSI injectin can be cmplemented by the MHSI if required t maintain the RCP [RCS] water inventry. It perates in its apprpriate cnfiguratin with the large mini-flw line pen befre LHSI/RHR injects. This limits the MHSI delivery pressure t arund 40 bar. IRWST cling is perfrmed by the LHSI miniflw. Switch-ver f the LHSI injectin frm the cld legs t the ht legs is nt necessary Safety Criteria The safety criteria t be met are the dse equivalent limits fr PCC-3 events described in Subchapter Fr LOCA analysis, the fllwing criteria shall be met as defined in Sub-chapter 14.0: The peak cladding temperature shall remain belw 1200 C. The maximum cladding xidatin shall remain belw 17% f the ttal cladding thickness. The maximum hydrgen generatin shall remain belw 1% f the amunt that wuld be generated if all the active part f the cladding were t react. The cre gemetry shall remain clable. Calculated changes in cre gemetry shall be such that the cre remains capable f being cled. 3 T sat = T sat (Ht Leg pressure) - T c, with T c = cre utlet temperature.

22 PAGE : 15 / 173 Lng-term cling shall be maintained. The calculated cre temperature shall be maintained at an acceptably lw value and decay heat shall be remved. A demnstratin must shw that the fllwing tw safe states are reached with the applicatin f the safety analysis rules defined in PCC Accident Analysis Rules discussed in Sub-chapter 14.0: The cntrlled state, using nly F1A means. The safe shutdwn state, using nly F1A and F1B means Methds and Assumptins Methd The CATHARE cmputer cde described in Appendix 14A is used. The CATHARE thermal-hydraulic cde has been develped jintly by CEA, EDF, and AREVA NP. A rigrus assessment methdlgy has been implemented. The cde assessment matrix relies n numerus separate effect tests (SET) and integral effect tests (IET): The SET and cmpnent test matrix cntains abut 300 tests selected frm varius experiments. The IET matrix cntains a selectin f 27 tests perfrmed n the BETHSY, LOBI, LOFT, LSTF, PACTEL, PMK, and SPES facilities. This realistic deterministic methdlgy is characterised by tw main features: Key cde mdels fr SB- and IB-LOCAs: The dminant phenmena are realistic, thugh cnservatively riented, and bund the experimental results withut excessive cnservatism. Initial and bundary cnditins are cnservatively selected. The basic steps f the realistic deterministic methdlgy cnsist f: A phenmenlgical analysis f the LOCA scenari and the identificatin f key phenmena. A judgement n the adequacy f the cde t calculate the LOCA scenari, based n physical understanding, the experimental database, and cde assessment examinatin, supplemented where necessary by sensitivity studies. An evaluatin f calculatin uncertainty with emphasis n dminant parameters, thrugh sensitivity studies, r the use f the cde assessment matrix t demnstrate the cde cnservatism fr the key SB-LOCA phenmena. Intrductin, where necessary, f cnservative biases as clse as pssible t the uncertainty n the key phenmena. The biases are intrduced either in a cde mdel, in a ndalisatin scheme, r in a bundary cnditin. Use f cnservative assumptins fr initial and bundary cnditins.

23 PAGE : 16 / 173 The realistic, deterministic methdlgy prvides a cnservative result that can be directly cmpared t the acceptance criteria. The CATHARE cde prvides a detailed representatin f the primary and secndary systems. Fr the PCC LOCA analysis, the brken lp is explicitly mdelled; tw intact lps are either, lumped int a single lp, weighted accrdingly, r mdelled separately. The furth lp is mdelled with the pressuriser cnnected t the ht leg. The break is cnservatively lcated at the lwer part f the cld leg. The CATHARE pint kinetic mdel is nt utilised. The residual fissin pwer (term A) is prvided as an input t the CATHARE cde. The term A is calculated in a decupled cnservative RT simulatin described in Sectin Table 1. The transient analyses are perfrmed using the cnservative PCC analysis rules defined in PCC Accident Analysis Rules in Sub-chapter A first CATHARE calculatin is perfrmed which mdels the entire RCP [RCS] and the relevant bundary cnditins. In this calculatin, the system calculatin, nly the average cre assembly is mdelled. A secnd CATHARE calculatin is then perfrmed, the ht assembly calculatin. This nly mdels the ht assembly and the ht rd within that assembly. It utilises the cre bundary cnditins frm the system calculatin Main Assumptins Accident Definitin The break size analysed is 20 cm 2, an equivalent diameter f 50 mm. The analysis assesses the emergency cre cling capability. The purpse is t demnstrate that the relevant acceptance criteria are met Prtectin and mitigatin actins In a LOCA event, autmatic prtectin actins using F1A classified systems, trip the reactr, remve the residual heat, and match the inventry lss t allw the plant t reach the cntrlled state. The rules defined fr safety analyses in the sectin PCC Accident Analysis Rules f Subchapter 14.0 require the cntrlled state t be reached using nly F1A classified systems. The safe shutdwn state is reached using F1A and F1B classified systems nly. The F1A I&C signals cnsidered in this analysis are: Reactr Trip n pressuriser pressure < MIN2 Turbine Trip n RT signal Safety Injectin n pressuriser pressure < MIN3

24 PAGE : 17 / 173 Reactr clant pumps trip n Reactr clant pumps pressure drp < MIN1. This is nt mdelled in the calculatin because f the assumed LOOP VDA [MSRT] pening and pressure cntrl n SG pressure > MAX1 Partial cldwn n SI signal ASG [EFWS] injectin and APG [SGBS] islatin n SG level < MIN Operatr actins N peratr actin is claimed until 30 minutes after the reactr trip. After 30 minutes, peratr actins are required t reach the safe shutdwn state C. The peratr diagnses the RCP [RCS] state based n infrmatin prvided by tw measurements, Reactr Pressure Vessel Level (RPVL) and T sat. This prcess is cntrlled by the emergency perating prcedures discussed in sectin 2 f Sub-chapter The peratr then has t perfrm the fllwing actins: Criticality Cntrl The sequence f peratr actins t perfrm RCP [RCS] bratin depends n the RCP [RCS] state revealed by the RPVL and T sat measurements. In a standard LOCA transient, the RCP [RCS] bratin will be perfrmed in parallel with the RCP [RCS] cldwn. It will be perfrmed by the RCV [CVCS], which is nt F1 classified and/r the RBS [EBS] which is F1A classified. Bth systems are actuated by the peratr. If a high flux is detected by the intermediate range channels, F1B classified, r the MHSI pumps are unavailable, the peratr is instructed t immediately actuate the RBS [EBS], and the RCV [CVCS] if available. Water Inventry Cntrl The MHSI pump(s) can be stpped prvided that: The cre utlet temperature is belw 200 C The LHSI/RHR required number f pumps are available and in peratin The cre utlet is nt superheated The RPVL measurement indicates that the cre remains cvered. The accumulatrs are islated befre the MHSI cut-ff criterin is reached, at a time dependent n the RCP [RCS] sub-cling. If mre severe depletin f the RCP [RCS] clant inventry ccurs, further peratr actins are perfrmed. These actins are described in Intermediate and Large Break LOCA (up t the Surge Line Break in States A and B), sectin 6 f Sub-chapter RCP [RCS] temperature and pressure cntrl In the RCP [RCS] state described abve, the peratr initiates the RCP [RCS] cldwn either at -50 C/h r at -25 C/h.

25 PAGE : 18 / 173 The list f F1B peratr actins, with indicatin f the main F1B infrmatin required, are: Manual MHSI cut-ff T sat, cre utlet temperature (T c ), RPV level (RPVL) Manual accumulatr islatin T sat, cre utlet temperature (Tc), RPV level (RPVL) Manual RBS [EBS] actuatin High neutrn flux frm ex-cre detectrs, lw MHSI flw rate r indirect infrmatin as T sat, RCP [RCS] pressure Manual VDA [MSRT] pening/clsing SG pressure, RCP [RCS] temperature Manual ASG [EFWS] cntrl if n F1B autmatic cntrl f SG level SG level, ASG [EFWS] flw rate Manual pening f ASG [EFWS] headers at pump suctin/discharge ASG [EFWS] tank level, ASG [EFWS] flw rate Manual VIV [MSIV] by-pass pening SG pressure Manual cnnectin f LHSI/RHR trains RCP [RCS] ht leg pressure, RCP [RCS] ht leg temperature, T sat, RPVL Definitin f cases analysed. The cases studied in sub-sectin 5.1 f this sub-chapter crrespnd t a 20 cm 2 break equivalent diameter 50 mm, the largest SB-LOCA size. The break is assumed t be lcated in a cld leg pump discharge pipe. The cld leg lcatin prduces the wrst cnsequences fr the cre when cmpared t any ther lcatin in the RCP [RCS]. This includes breaks in the ht leg r in the pressuriser, and breaks in the pressuriser steam space. These cases must cnsider: The limiting single failure The mst nerus preventive maintenance activity A LOOP cincident with the event. Tw CATHARE calculatins are perfrmed:

26 PAGE : 19 / 173 The first CATHARE calculatin ends when the cntrlled state is reached. Its bjective is t demnstrate that the acceptance criteria related t the cntrlled state are met. Therefre, excessive fuel clad heat-up must be prevented, using nly f F1A systems as described in sub-sectin f this sub-chapter. The secnd CATHARE calculatin ends when the safe shutdwn state is reached. Its bjective is t demnstrate that the acceptance criteria fr the safe shutdwn state f lng-term cre cling are met. These must be met with the use f nly F1A and F1B systems. In additin it must be shwn that the transfer t the safe shutdwn state can be achieved. The CATHARE cde is cupled with the CONPATE cntainment cde fr this purpse. This methdlgy is described in sectin 1.6 f Sub-chapter Descriptin f Cases Analysed, frm Initiating Event t the Cntrlled State The safety analysis is perfrmed using cnservative assumptins Chice f Single Failure and Preventive Maintenance The wrst active single failure (SF) is the lss f ne Emergency Diesel Generatr (EDG) fllwing LOOP. As a cnsequence f the diesel lss, ne RIS [SIS] train f ne MHSI pump and ne LHSI/RHR pump and ne ASG [EFWS] pump are unavailable. The preventive maintenance (PM) f ne diesel is the wrst assumptin as ne RIS [SIS] train f ne MHSI pump and ne LHSI/RHR pump and ne ASG [EFWS] pump are cnsequently unavailable. The assumptin f LOOP is limiting fr the SB-LOCA analysis when the SF and PM assumptins are applied Initial State The initial state cnditins, given in Sectin Table 2 are chsen t maximise the time required t actuate the RT and SI signal. This is the mst cnservative assumptin fr SB-LOCA mitigatin. The initial water temperature within the RPV dme is maximised. It is assumed t perate at the ht leg temperature. This is the mst cnservative assumptin fr the SB-LOCA transient assessing cre cling. The axial pwer shape fr the average rd in the average assembly is identical t the ne used in the PCC-4 analyses and shwn in Sectin Figure 1. This pwer shape is a tp skewed pwer shape having the fllwing characteristics: An enthalpy rise factr f 1.00 A peaking factr f 1.57 An axial ffset f 18% (15% + 3% uncertainty) The axial pwer shape chsen fr the ht rd in the ht assembly has n effect n the cladding heat-up as the cre remains cvered thrughut the transient.

27 PAGE : 20 / 173 A tp-skewed axial pwer shape is used in the analysis because it represents a distributin with pwer cncentrated in the upper regin f the cre. This distributin is limiting fr the analysis f the SB-LOCA because it minimises clant level swell, while maximising vapur superheating and fuel rd heat generatin at the uncvered elevatin. Shuld the cre be uncvered, the cladding in the upper part f the cre wuld heat up. The higher the linear pwer, the higher the clad temperature excursin. The lwer part f the cre remains clse t the saturatin temperature as it remains cvered. The initial fuel temperature is t the same as the ne used in the PCC-4 analyses shwn in Sectin Figure 3. This temperature is averaged ver a sectin f fuel and is given as a bundary cnditin limit. This initial temperature has a negligible impact n the maximum clad temperature reached, because the cre heats up sme time after RT in a typical SB-LOCA sequence The initial stred energy is remved in the perid fllwing reactr trip and befre the heat-up ccurs Specific Assumptins Neutrnic data and decay heat The cre pwer is set at 102% f full pwer until reactr trip. After RT, the residual fissin pwer (term A) is defined by a cnservative decupling curve given in Sectin Table 1. The decay heat is the maximum curve described in the relevant sectin f Subchapter 14.1 and represents term B+C MAX 2σ. Assumptins related t nn-f1 systems The nn-safety-grade systems, cntrl systems, are nt claimed when they perfrm a mitigating functin. The pressuriser pressure cntrl system using the pressuriser heaters is mdelled as it delays the RT signal. A ttal heating pwer f 2592 kw is assumed until the pressuriser is ttally empty. The flw t the turbine is assumed t remain cnstant until the turbine trip. The ARE [MFW] flw is assumed t remain cnstant until reactr trip. The GCT [MSB] and AAD [SSS] are nt perating. The RCV [CVCS] is nt mdelled. The letdwn line is nrmally islated n lw pressuriser level, nt F1A, and n the SI signal, F1A, while the RCV [CVCS] charging line is nt islated n the SI signal. This mdelling is cnservative fr the RCP [RCS] water inventry balance. Assumptins related t F1 systems Reactr Trip (F1A): The RT signal is actuated fllwing a pressuriser pressure < MIN2 signal. At a setpint f 135 bar - 3 bar. The uncertainty n the setpint includes the effects f the degraded cntainment cnditins [Ref-1]. The specific cnservative delays that are assumed are listed belw: RT signal 0.9 secnds after "pressuriser pressure < MIN2" Beginning f rd insertin 0.3 secnds after RT signal

28 PAGE : 21 / secnds fr cmplete rd insertin assuming seismic cnditin) Ttal main feed water islatin 0.3 secnds after RT signal Turbine trip 0.3 secnds after RT signal. Safety Injectin (F1A): The SI signal is actuated fllwing a pressuriser pressure < MIN3 signal with a setpint f 115 bar 3 bar. The uncertainty n the setpint includes the effect f the degraded cntainment cnditins. This is included t delay the start f the RIS [SIS] pumps and the beginning f the partial cldwn [Ref-1]. The specific cnservative delays that are assumed are listed belw: SI signal 0.9 secnds after the "pressuriser pressure < MIN3" signal Partial cldwn signal simultaneus with SI signal. The VDA [MSRT] setpint is decreased at a rate equivalent t -100 C/h 2 secnds delay fr VDA [MSRT] pening 40 secnds delay fr RIS [SIS] pump start-up. This delay includes the diesel unlading and relading sequence and the RIS [SIS] pump start time Minimum characteristics fr RIS [SIS] pumps as defined in the relevant sectin f Sub-chapter C fr initial IRWST temperature and injectin flw temperature. This temperature is held cnstant fr the transient calculatin. This is justified by the shrt time duratin f the transient during which the temperature increase f the IRWST is lw. The fllwing assumptins relating t the accumulatrs are defined t minimise the accumulatr injectin: 47 m 3 ttal vlume 35 m 3 water vlume 45 bar initial pressure 2500 m -4 discharge line resistance. The water temperature in each accumulatr is assumed t be 50 C which crrespnds t the maximum temperature used in the analysis. The RIS [SIS] train injecting t the brken lp is assumed t spill directly t the cntainment. It is assumed t make n cntributin t the RCP [RCS] injectin 4. The RIS [SIS] cmpnents that are available t perfrm the cld leg injectin taking int accunt the assumed single failure and preventive maintenance are: One MHSI pump 4 As n cre heat-up is expected during the SB-LOCA transient, this assumptin has n majr impact n the acceptance criteria (see sectin f this sub-chapter).

29 PAGE : 22 / 173 Three accumulatrs One LHSI pump. Based n the reactr mdelling in sub-sectin f this sub-chapter, the fllwing RIS [SIS] mdelling is adpted: One RIS [SIS] train injects int a single intact lp Three accumulatrs inject int the 3 intact lps. VIV [MSIV] (F1A): There is n main steam line islatin. VDA [MSRT] (F1A): VDA [MSRT] setpints are the nminal values plus a 1.5 bar uncertainty. There is n impact frm degraded cntainment cnditins as the pressure sensrs are lcated utside f cntainment. This maximises the RCP [RCS] pressure. The setpints are as fllws: bar befre the start f the partial cldwn bar after the end f the partial cldwn. All VDA [MSRT] are available (ne per SG). ASG [EFWS] (F1A): ASG [EFWS] is actuated train-by-train fllwing a very lw SG level < MIN2 signal. The assciated setpint is: 40% - 5% uncertainty n the wide range channel. The uncertainty n the setpint includes the effect f the degraded cntainment cnditins. This delays the start-up f the ASG [EFWS] pumps. Tw ASG [EFWS] trains are available. They are mdelled injecting int the SG assciated with the lp with the pressuriser, lp 2 in CATHARE, and the brken lp, lp R in CATHARE. The specific cnservative delays that are assumed are as fllws: ASG [EFWS] actuatin signal 1.5 secnds after the "SG level < MIN2" signal 50 secnds delay fr the start-up f the ASG [EFWS] pump. This delay includes the diesel unlading and relading sequence and the ASG [EFWS] pump start time. Minimum characteristic fr the ASG [EFWS] pump. A cnstant injectin flw rate f 90 te/h is assumed 50 C fr the injectin flw temperature. Reactr clant pump trip (F1A). In the EPR design, an autmatic reactr clant pump trip is prvided fr the LOCA event. This is based n a " P ver reactr clant pump" measurement with a setpint f 80% ± 5% f nminal P as defined in Sub-chapter Table 9.

30 PAGE : 23 / 173 The analysis assumes the reactr clant pumps are tripped when the reactr is tripped. This is the mst cnservative reactr clant pumps trip time between the reactr trip and the reactr clant pumps trip signal time. Fr the smaller break areas belw 20 cm 2, the early reactr clant pump trip cntributes t an additinal lss f RCP [RCS] water inventry. It keeps the primary pressure high at the beginning f the transient while the RCP [RCS] is still in the liquid phase. In additin, a reactr clant pump cast dwn at RT/TT is cnsistent with the LOOP assumptin. Other assumptins The Lss Of Off-site Pwer is included in the sequence and ccurs at the same time as the turbine trip Results The sequence f events is given in Sectin Table 3 [Ref-1]. The mst representative parameters are presented in the fllwing figures: Sectin Figure 2: RCP [RCS] and secndary side water inventries RCP [RCS] and secndary side pressures Sectin Figure 3: Ttal and steam break flw rates Ttal break and RIS [SIS] flw rates Sectin Figure 4: Ht spt clad temperature Cre swelled level The SB-LOCA analysis t the cntrlled state has nt been perfrmed fr the PCSR. The capability t reach the cntrlled state is demnstrated fr the EPR 4500 by satisfying the acceptance criteria with a large margin fr the EPR 4250 and by cmparisn f pertinent features between the EPR 4500 and the EPR SB-LOCA Analysis fr EPR 4250 The RCP [RCS] water inventry stps decreasing, with a minimum water cntent f apprximately 83 te at arund 2375 secnds. The decay heat is fully remved, partly by the break, mstly by the SG via the ASG [EFWS] and the VDA [MSRT]. The cre is subcritical with n credit taken fr the RCP [RCS] bratin, see sub-sectin f this sub-chapter. The cntrlled state is reached. The fllwing cnclusins can be drawn fr the acceptance criteria: There is n cre uncvery and thus n cre heat-up; the peak clad temperature remains belw the acceptance criterin limit f 1200 C There is n clad xidatin There is n clad rupture

31 PAGE : 24 / 173 The integrity f the cre gemetry is maintained The lng-term cling is addressed in sub-sectin f this sub-chapter. In cnclusin, the F1A systems the RIS [SIS], in cnjunctin with VDA [MSRT] and ASG [EFWS], are sufficient t reach the cntrlled state. Extraplatin f the Results frm the EPR 4250 t the EPR 4500 The tw EPRs share the same systems fr RCP [RCS] injectin and cling: The flw capacity f the MHSI pumps is identical fr the tw pwer levels The capacity f the ASG [EFW] tank is unchanged fr the higher pwer The capability f ASG [EFW] and VDA [MSRT] is identical fr the tw pwer levels The capacity f the IRWST is identical fr the tw pwer levels The SG capability is the same fr the tw pwer levels with an identical partial cldwn. The flw via the break is determined by the primary pressure and the break quality. Fr a break f 20 cm 2, the SG are required t remve the decay heat and the stred heat. Because the initial RCP [RCS] pwer is slightly higher, abut 6%, the RCP [RCS] will depressurise mre slwly. Cmparing the EPR 4250 results and the BDR-99 results at 4900 MW in Appendix 14B, the pressuriser pressure f 112 bars is reached at 296 secnds fr the EPR 4250 versus 300 secnds fr the EPR This shws that the difference in pwer has a minimal impact n the initial depressurisatin. After this phase, the inventry at the tw pwer levels will change insignificantly. The primary pressure will remain slightly belw the secndary pressure during and after the partial cldwn. As the pressure fr the partial cldwn is identical fr bth cases, the break flw will als be similar. The break flw is mstly liquid until 2400 secnds, and the quality at the break depends mstly n the initial RCP [RCS] mass inventry. This phase f the transient is almst identical in the EPR 4250 and the EPR After 2400 secnds, the flw at the break is mstly vapur. The steam flw frm the cre is larger fr the EPR 4500 due t the higher pwer. The quantity f liquid reaching the break is als slightly higher. The primary pressure stays at 61.5 bar, the setpint fr the end f the partial cldwn. The SI flw at this pressure is identical fr the tw EPR. The SI flw des nt match the break flw fr the EPR 4250, and falls further behind fr the EPR 4500 at 2400 secnds. Hwever, the results fr the EPR 4900 shw that the primary pressure is subsequently decupled frm the SG pressure. Once this ccurs, the SI flw equals and exceeds the break flw, the RCP [RCS] starts t refill, and the risk f cre uncvery is eliminated. The SI will exceed the break flw earlier fr the EPR 4500 than fr the EPR Descriptin f cases studied frm the cntrlled state t the safe shutdwn state The safety analysis is perfrmed assuming the same level f cnservatism as used fr the transitin t the cntrlled state discussed in sub-sectin f this sub-chapter.

32 PAGE : 25 / 173 In particular, the maximum decay heat curve and the minimum capacity f F1 systems cnsidered in sub-sectin f this sub-chapter are als assumed in sub-sectin f this sub-chapter Chice f Single Failure and Preventive Maintenance The wrst single failure (SF) is the lss f ne EDG fllwing the LOOP assumed t ccur at the time f reactr trip: As a cnsequence, ne RIS [SIS] train, f ne MHSI pump and ne LHSI pump, and ne ASG [EFWS] pump are unavailable. The remte cntrl f the VDA [MSRT] assigned t this divisin fails tw hurs after the LOOP, because the battery is discharged. This assumes that the pwer supply frm the neighburing divisin via the dedicated DC crss-cnnectin is unavailable because f preventive maintenance n the assciated diesel. The battery discharge des nt affect the availability f the VDA [MSRT], as it can be cntrlled lcally. Thus the cnsequence f the single failure and preventive maintenance is limited t the lss f tw MHSI and LHSI and ASG [EFWS] pumps. The preventive maintenance (PM) n ne emergency diesel is the mst cnservative assumptin as: One RIS [SIS] train, f ne MHSI pump and ne LHSI pump, and ne ASG [EFWS] pump are unavailable. The VDA [MSRT] assigned t this divisin is lst tw hurs after the LOOP because f the battery discharge. This assumes the pwer supply frm the neighburing divisin via the dedicated DC crss-cnnectin is unavailable because f a single failure n the assciated diesel. The assumptin f LOOP is cnservative fr the SB-LOCA analysis when the SF and PM principles are applied Specific Assumptins RCP [RCS] cldwn phase The cntrlled state, crrespnding t the ht shutdwn state at the end f the partial cldwn, is maintained in the CATHARE calculatin until tw hurs after reactr trip. The RCP [RCS] and SG pressures are held in the range f 60 bar withut a requirement fr peratr actin. The fur reactr clant pumps were tripped at RT. At RT plus tw hurs, the RPVL is stabilised between the Tp f the Ht Leg and the Bttm f the Ht Leg. The T sat indicates saturated cnditins at the cre utlet. At that time in the CATHARE calculatin, the peratr starts the RCP [RCS] cldwn t the safe shutdwn state. This is undertaken using three ut f fur VDA [MSRT]. The unavailability f ne VDA [MSRT] is assumed t cver the single failure f a VDA [MSRT]. The failure f ne valve t pen is cmbined in the calculatin with the single failure f ne diesel. This cmbinatin f the SF f ne VDA [MSRT] with the SF f ne EDG is used nly t minimise the number f calculatins.

33 PAGE : 26 / 173 In the CATHARE accident analysis, the minimum RCP [RCS] cldwn rate f -25 C/h is assumed t maximise the cnsumptin f ASG [EFWS] water. Assumptins cncerning the secndary side The applicatin f the single failure criterin and preventive maintenance results in the availability f nly tw ASG [EFWS] delivering t tw SG. The flw rate per pump is that used in the analysis t the cntrlled state in sub-sectin f this sub-chapter. The SG level is cntrlled t prevent the SG frm verfilling. The set pint f the available VDA [MSRT] is decreased t 5 bar, the saturatin pressure fr 150 C at a rate cnsistent with the RCP [RCS] cldwn phase described abve. The MSH is cnservatively islated at the beginning f the RCP [RCS] cldwn. Assumptins cncerning the RIS [SIS] The MHSI and LHSI water injectin temperatures are maximised, including the IRWST temperature increase arising frm the degraded cntainment cnditins caused by the break mass and energy releases. This temperature is btained frm a calculatin with cupled CATHARE-CONPATE cdes as described in Appendix 14A. The IRWST temperature variatin is calculated cnservatively: The initial IRWST temperature is at its maximum value f 50 C The IRWST water vlume is at its minimum value f 1450 m 3 The minimum capacity f LHSI/RRI [LHSI/CCWS] heat exchanger is used, resulting in a minimum LHSI heat remval capability. The MHSI perating in the analysis is cnservatively assumed t be stpped as sn as the cre utlet temperature falls belw 200 C. The LHSI cntinues t deliver t the RCP [RCS] until the RIS/RRA [SIS/RHRS] cnnectin cnditins are reached. The accumulatrs are cnservatively assumed t be islated at the beginning f the RCP [RCS] cldwn phase. Assumptins abut the LHSI/RHR cnnectin cnditins The RIS/RRA [SIS/RHRS] cnnectin cnditins are reached when the fllwing cnditins are met: Ht leg temperature belw r equal t 180 C Ht leg pressure belw r equal t 30 bar T sat and RPVL cnsistent with LHSI/RHR suctin frm the ht leg. In the CATHARE calculatin, it is assumed that the RIS/RRA [SIS/RHRS] cnnectin cnditins are reached when the RPVL is abve the tp f ht leg and T sat is greater than 10 C.

34 PAGE : 27 / Results The SB-LOCA transient frm the cntrlled state t the safe shutdwn state has nt been recalculated in the PSCR. The capability t reach the safe shutdwn state while satisfying the acceptance criteria is derived frm the results f calculatins perfrmed in BDR-99 fr the EPR 4900 as discussed in Appendix 14B. These calculatins shw that the criteria are met with large margin. These calculatins are cmbined with a cmparisn f the relevant characteristics f the EPR 4500 and the EPR This cmparisn shws that the EPR 4500 is mre favurable than the EPR BDR-99 Status Results f the BDR-99 analysis are prvided in sectin f Appendix 14B. They are summarised belw. The cre remains cvered thrughut transient, with the RPV level abve the bttm f the cld/ht legs. The RIS/RRA [SIS/RHRS] cnnectin cnditins are reached seven hurs after the reactr trip. This includes a delay f tw hurs withut any manual actin, and five hurs f RCP [RCS] cldwn at -25 C/h. At the end f the cldwn the RCP [RCS] cnditins are as fllws: Ht leg temperature is abut 160 C Ht leg pressure is abut 10 bar The sub-cling margin T sat is psitive, higher than 10 C The RPVL is abve the tp f the ht leg. When the LHSI/RHR is t be cnnected, the MHSI pump is shut dwn, ne LHSI train perates in SI mde with injectin int ne cld leg, and the remaining LHSI train perates in RHR mde. The flw rate injected by the LHSI pump perating in SI mde is sufficient t maintain a RCP [RCS] lp level in the ht legs prviding suitable perating cnditins fr the LHSI pump in RHR mde. N further RCP [RCS] water inventry reductin ccurs after the transfer t the safe shutdwn state. The MHSI pump, which has previusly been shut dwn under the emergency perating guidelines, remains available fr injectin in additin t the LHSI pump in injectin mde. If it were started again, its delivery head wuld be limited t arund 40 bar, as described in subsectin f this sub-chapter. The transfer t the safe shutdwn state ccurs withut emptying the ASG [EFWS] tanks. Abut 600 te f ASG [EFWS] water is used ut f the initial ttal ASG [EFWS] tanks cntent f 1500 tns. Cre subcriticality is maintained thrughut the transient fr the 20 cm 2 break size analysed, by the brn injected by the MHSI pump, and after LHSI/RHR cnnectin by the LHSI pump perating in SI mde. N extra bratin is needed. Fr very small breaks, where SI injectin flw may nt be sufficient t achieve the required bratin, the required bratin wuld be prvided by the F1A classified RBS [EBS]. Sub-sectin belw, Reactivity cntrl in the event f a very small LOCA lcated in ne SI CL-injectin line, prvides mre infrmatin.

35 PAGE : 28 / Extraplatin f BDR-99 Results t the EPR 4500 The results f the BDR-99 calculatin fr EPR 4900 demnstrate that the F1-classified systems are sufficient t reach the safe shutdwn RCP [RCS] brn cncentratin and t cl and depressurise the RCP [RCS] dwn t RIS/RRA [SIS/RHRS] cnnectin cnditins. This can be perfrmed within a time perid cnsistent with the ASG [EFWS] tanks capacity, while keeping the cre cvered fr the entire transient. This is achieved despite the assumptin f the wrst single failure and the mst nerus preventive maintenance. The F1-classified systems used t achieve the safe shutdwn state are: MHSI and LHSI fr RCP [RCS] injectin MHSI, and RBS [EBS] if needed, fr RCP [RCS] bratin ASG [EFWS] and VDA [MSRT] fr RCP [RCS] cling LHSI/RHR fr lng term RCP [RCS] and IRWST heat remval. When cmpared t the EPR 4900 characteristics, the EPR 4500 is similar, r better, fr RCP [RCS] injectin, the RCP [RCS] cling, and the RCP [RCS] bratin capabilities: The EPR 4500 pwer level is 9% lwer when cmpared with the EPR 4900 MHSI injectin flw at high pressure (P > 50 bar) is increased in the EPR 4500 cmpared with the EPR MHSI injectin flw at lw pressure (P < 50 bar), and LHSI injectin flw, are unchanged in the EPR 4500 cmpared t the EPR 4900 The same RBS [EBS] bratin capacity fr the EPR 4500 and the EPR 4900 The ASG [EFWS] tanks water inventry unchanged in the EPR 4500 cmpared with the EPR 4900, prviding higher heat remval capacity relative t the pwer level Similar ASG [EFWS] and VDA [MSRT] flw capacities between the EPR 4500 and the EPR 4900, in terms f percent f nminal pwer Same IRWST water cntent between the EPR 4500 and the EPR 4900, prviding higher heat sink reserve relative t the pwer level. It can be cncluded withut need fr dedicated calculatins that achieving the Safe Shutdwn State is demnstrated fr the EPR This cnclusin is based n the results f the BDR-99 calculatins, and n the similar r beneficial aspects f the EPR 4500 cmpared with the EPR 4900 fr RCP [RCS] injectin, RCP [RCS] cling, and RCP [RCS] bratin, The fllwing sectin prvides additinal infrmatin abut the RCP [RCS] bratin in the event f a very small LOCA. In these circumstances MHSI bratin nly is nt sufficient and RBS [EBS] bratin is required t reach the safe shutdwn state. Data used are fr the EPR see Appendix 14B Tab.13/25 and Sub-chapter 14.1 Table 13

36 PAGE : 29 / Reactivity cntrl in the event f a very small LOCA lcated in ne SI CLinjectin line In a SB-LOCA, tw F1 bratin systems are available t prvide bratin fr cre subcriticality after RT, the MHSI and the RBS [EBS]. Fr a SB-LOCA f sufficient size, the MHSI is able t perfrm the required bratin alne, Fr very small LOCA, the MHSI flw injected int RCP [RCS] is t small t perfrm the required bratin alne. In this case RBS [EBS] bratin is required. If the very small LOCA is nt lcated in ne SI cld leg injectin line, at least ne RBS [EBS] train is fully available fr bratin, including PM and SF, as fr any nn- LOCA event. This RBS [EBS] train is able t inject mre brn than necessary, as the RBS [EBS] is designed t cpe with the mre limiting brn dilutin leading t cre criticality after RT. If the very small LOCA is lcated in ne SI cld leg injectin line, the crrespnding RBS [EBS] train is nt fully available fr bratin. A part f the RBS [EBS] flw is assumed t be directly lst t the break withut entering the RCP [RCS]. Each RBS [EBS] pump delivers int tw SI CL lines via an RBS [EBS] header. This paragraph cnsiders this last case, t shw that the RBS [EBS] flw injected int the RCP [RCS] in this case is sufficient t maintain cre subcriticality after RT. This is maintained up t and including reaching the RIS/RRA [SIS/RHRS] cnnectin cnditins f 30 bar and 180 C in the RCP [RCS] ht leg. The nn F1-classified RCV [CVCS] is nt cnsidered as a surce f bratin. Perid frm RT t the End f Partial Cldwn The reactr trip takes the cre subcritical. The negative reactivity wrth f the rds is designed t keep the cre subcritical t the end f Partial Cldwn (PC): Cre subcriticality is maintained by N-1 rds t: 260 C, using cnservative assumptins. This design cnditin bunds the end f PC cnditins f: 275 ± 1.5 C with PC perfrmed by VDA [MSRT] dwn t 60 ± 1.5 bar. 270 ± 1.5 C with PC perfrmed by GCT [MSB] dwn t 55 ± 1.5 bar. Cnsequently, RCP [RCS] bratin is nt required in SB-LOCA until after the end f PC. Perid frm End f PC t RIS/RRA [SIS/RHRS] Cnnectin Cnditins During the transfer frm the end f PC t the RIS/RRA [SIS/RHRS] cnnectin cnditins, RCP [RCS] bratin is required t maintain the cre subcritical. The negative reactivity intrduced by the cntrl rds is nt sufficient. The Emergency Operating Guidelines (EOG) will instruct the peratr t actuate the RBS [EBS] befre transferring the plant t cld shutdwn in any PCC except a large LOCA.

37 PAGE : 30 / 173 The wrst cnfiguratin fr RCP [RCS] bratin is shwn in the upper part f Sectin Figure 5: Single failure f ne EDG causes the unavailability f ne RIS [SIS] train and ne RBS [EBS] train. Preventive maintenance n anther EDG causes unavailability f ne RIS [SIS] train. SB-LOCA lcated in ne SI cld leg injectin line, between the RIS [SIS] nzzle and the first RCP [RCS] islatin check-valve. This is assumed t result in the cmplete lss f RIS [SIS] and RBS [EBS] flws delivered via this line. Only ne MHSI-flw plus half f the RBS [EBS] train flw is available fr brn injectin int the RCP [RCS]. The wrst case fr RCP [RCS] bratin is shwn in the bttm part f Sectin Figure 5: The SB-LOCA is assumed t be small enugh fr the pressure t remain abve the MHSI pump delivery pressure. Thus MHSI injectin will nt ccur via the intact SI line (RCP [RCS]). Only half the RBS [EBS] flw is available fr brn injectin int the RCP [RCS]. In these circumstances the intact SI line and the affected SI line have the same back pressure, equal t the RCP [RCS] cld leg back pressure. This is a cnsequence f the very large rati between the SB-LOCA size and the SI line sectin as shwn by the CATHARE results. The RCP [RCS] average brn cncentratin against time is given by the fllwing equatin: dc M RCS RCS dt dm = Cin Win CRCS Wut with RCS = Win Wut dt M RCS : C RCS : C in : W in : W ut : RCP [RCS] water mass RCP [RCS] average brn cncentratin Brn cncentratin f flw rate W in Flw rate entering the RCP [RCS], called injectin flw Flw rate leaving the RCP [RCS] via the SB-LOCA This equatin is used t calculate the fllwing parameters, using the cnservative assumptins detailed belw: Only the RBS [EBS] injectin flw is needed t reach the critical brn cncentratin fr RIS/RRA [SIS/RHRS] cnnectin cnditins. N MHSI injectin is assumed Only the MHSI injectin flw is needed t reach the critical brn cncentratin at RIS/RRA [SIS/RHRS] cnnectin cnditins. N RBS [EBS] injectin is assumed The minimum average RCP [RCS] brn cncentratin is reached at RIS/RRA [SIS/RHRS] cnnectin cnditins, in the wrst case, with nly half the RBS [EBS] flw entering the RCP [RCS].

38 PAGE : 31 / 173 The RCP [RCS] critical brn cncentratin is defined as the cncentratin limit which maintains cre subcriticality at RIS/RRA [SIS/RHRS] cnnectin cnditins. A lwer cncentratin wuld lead t cre criticality. T perfrm these calculatins, the fllwing set f cnservative assumptins are made as discussed in the bratin phase sectin f Sub-chapter 14.1 The RIS/RRA [SIS/RHRS] cnnectin cnditins are defined as 30 bar and 150 C. 150 C is the lwest temperature cnsistent with a HL temperature f 180 C if a Reactr Clant Pump is nt perating. There is assumed t be n bratin f the RCP [RCS] befre starting the transfer t cld shutdwn. N credit is taken fr MHSI r RBS [EBS] injectin during the PC prir t the peratr decisin t initiate the transfer t cld shutdwn. This is a very cnservative assumptin. The bratin f the RCP [RCS] is perfrmed during the transfer t cld shutdwn. This perid lasts five hurs, starting at the end f the PC with a temperature f 275 C, stpping at the RIS/RRA [SIS/RHRS] cnnectin cnditins with a temperature f 150 C. The transfer is perfrmed at a cling rate f -25 C/h cnsistent with the availability f ne ut f tw RBS [EBS] trains. Brn cncentratins (all brn cncentratins refer t natural brn): The mst nerus fuel cycle and pint within that cycle are chsen, fr UO 2 and MOX. This prvides the maximum difference in brn cncentratin between the initial RCP [RCS] brn cncentratin at 100% FP and the critical brn cncentratin at 150 C. EOL peratin at 100% FP is the limiting case. The fllwing values f initial and critical brn cncentratins refer t this limiting case. Minimum initial brn cncentratin in the RCP [RCS] f 10 ppm fr UO 2 and 10 ppm fr MOX. Maximum critical brn cncentratin at a temperature f 150 C f 480 ppm fr UO 2 and 530 ppm fr MOX,. These are calculated assuming all rds inserted. The SF is applied t ne EDG. The calculatin assumes an allwance f 200 ppm fr uncertainties the presence f a xenn-peak at the time f RT, and n-xenn at 150 C. The xenn apprach is ver cnservative, as the bratin lasts five hurs, cmpared t a perid f abut tw days between the xenn-peak and n-xenn. Minimum brn cncentratin f the RIS [SIS] flw f 2450 ppm fr UO 2 and 2700 ppm fr MOX. Minimum brn cncentratin f the RBS [EBS] flw f ppm fr UO 2 and ppm fr MOX. RCP [RCS] water inventry and in/ut flw rates:

39 PAGE : 32 / 173 A maximum RCP [RCS] water inventry at the beginning f bratin is cnservative. A value f 300 tns is assumed, being the RCP [RCS] initial inventry at 100% FP. This bunds the RCP [RCS] water inventry at the beginning f bratin with n credit taken fr RCP [RCS] water depletin between 100% FP and the beginning f the injectin int the RCP [RCS]). Minimum RBS [EBS] pump flw rate f 10 te/h r 2.8 kg/s. The flw ut f the RCP [RCS] thrugh the break is ignred. This is cnservative fr the calculatin f the RCP [RCS] bratin. Results The wrst initial perating cnditin is: 100% NP EOL with MOX Initial RCP [RCS] brn cncentratin at 100% FP, xenn-peak f 10 ppm, natural brn Critical brn cncentratin at 150 C, all rds in, n-xenn f 530 ppm, natural brn. Withut cnsidering RBS [EBS] injectin: the minimum MHSI injectin flw rate that just maintains cre subcriticality at the RIS/RRA [SIS/RHRS] cnnectin cnditins f 30 bar and 180 C at ht leg is apprximately 3.2 kg/s r 12 te/h. This assumed the MHSI alne, withut the RBS [EBS] prviding bratin. This MHSI injectin flw rate is achieved when the RCP [RCS] pressure drps 3 bar belw the MHSI shutff head: Relevant data: M RCS at beginning f bratin : 300 te C RCS at beginning f bratin : 10 ppm C in (MHSI alne) : 2700 ppm W in : calculated : 0 kg/s W ut This MHSI injectin flw rate, matches the break flw fr a SB-LOCA f 1 cm 2. This is very small when cmpared t the inner area f the SI CL line f 390 cm 2. Cnsequently, the break has n significant impact n the back pressure balance between the affected SI line and the intact SI lines with the pressure at break being the RCP [RCS] cld leg pressure: Break flw rate: Break size: 3.2 kg/s at 85 bar/275 C (RCP [RCS] side) break size apprximately 0.46 cm kg/s at 85 bar/10 C (IRWST side) break size apprximately 0.25 cm 2 Withut cnsidering MHSI injectin: the minimum RBS [EBS] injectin flw rate which just maintains cre subcriticality at the RIS/RRA [SIS/RHRS] cnnectin cnditins f 30 bar and 150 C is apprximately 0.7 kg/s r 2.6 te/h. This representing 26% f the minimum capacity f ne RBS [EBS] train: Relevant data: M RCS at beginning f bratin : 300 te C RCS at beginning f bratin : 10 ppm C in (RBS [EBS] alne) : ppm : calculated W in

40 PAGE : 33 / 173 W ut : 0 kg/s The minimum RCP [RCS] brn cncentratin when the LHSI/RHR is cnnected, using the set f cnservative assumptins defined abve has been calculated fr the limiting case. Fr this case, with the flw entering the RCP [RCS] with n MHSI, and nly half the RBS [EBS], the flw is sufficient t maintain a significant margin t the critical cncentratin: M RCS at beginning f bratin : 300 te C RCS at beginning f bratin : 10 ppm C in (RBS [EBS]) : ppm W in (½ RBS [EBS]) : 1.4 kg/s : 0 kg/s W ut Limiting Fuel Management Initial RCP [RCS] brn cncentratin, 100% FP, peratin at Xe peak Average RCP [RCS] brn cncentratin at 150 C, after 5 hurs bratin by half RBS [EBS] Critical brn cncentratin at 150 C, all rds in, xenn = 0 Cnclusin MOX at EOL 10 ppm (natural brn) 1000 ppm (natural brn) 530 ppm (natural brn) Cre subcriticality maintained by apprximately 470 ppm This evaluatin shws that whatever the SB-LOCA break size, the RBS [EBS] and MHSI injectin is sufficient t prvide the required RCP [RCS] bratin t maintain cre subcriticality frm RT, up t and including the Safe Shutdwn State. The safe shutdwn state is defined as the RIS/RRA [SIS/RHRS] cnnectin cnditins. Subcriticality can be maintained despite the wrst PM and SF, This is true fr the limiting case f a very SB-LOCA lcated in ne SI CL line, with a break size small enugh t avid MHSI injectin int RCP [RCS] Cnclusin The analysis f the SB-LOCA shws that despite the wrst single failure and the limiting preventive maintenance: The cntrlled state can be reached meeting all safety acceptance criteria as discussed in sub-sectin abve. The safe shutdwn state can be reached meeting all safety acceptance criteria, and cnsistent with the fllwing F1 capabilities: During the transfer frm the cntrlled state t the safe shutdwn state, The VDA [MSRT] and ASG [EFWS] pump and tank capacities fr cre heat remval. The LHSI/RHR heat exchange capacity fr IRWST heat remval. The MHSI injectin capacity frm the IRWST fr RCP [RCS] water inventry.

41 PAGE : 34 / 173 The MHSI, and RBS [EBS] fr smaller breaks nly, brn injectin capacities fr cre subcriticality. At the RIS/RRA [SIS/RHRS] cnnectin cnditins crrespnding t the safe shutdwn state, The LHSI/RHR heat exchange capacity fr cre heat remval. The LHSI/RHR heat exchange capacity fr IRWST heat remval. The LHSI/RHR injectin capacity fr RCP [RCS] water inventry. The LHSI/RHR brn injectin capacity fr cre sub-criticality SMALL BREAK LOCA DN 50 IN STATE B Accident Definitin The initiating event is a nn islable break r leak in the RCP [RCS]. It is defined as a break size f equivalent diameter belw 50 mm (~20 cm 2 ). This small break LOCA is classified as a PCC-3 event in state B, intermediate shutdwn state as discussed in sectin 0 f Sub-chapter State B cvers all shutdwn states during nrmal plant peratin, where primary heat is remved by the SG, and where sme F1A classified I&C signals have been changed cmpared t pwer peratin (state A). It extends frm 130 bar when the deactivatin f sme F1A signals ccurs t 30 bar and 120 C, the RCP [RCS] cnditins fr cnnectin f the RIS/RRA [SIS/RHRS]. The cnsequences f such an event are analysed with the same bjectives as thse fr reactr state A. The SB-LOCA analysis in state B addresses the cre cling capability. The bjective is t demnstrate that the relevant safety and acceptance criteria are met, including the capability f the F1 systems t maintain the safe shutdwn state. Cmpared t state A, state B intrduces the fllwing differences in terms f F1 mitigatin: The surce f the SI signal The accumulatrs are unavailable belw a RCP [RCS] pressure f 70 bar. As mentined in sectin , a cmplete descriptin f the calculatin prcedure used t assess the inherent brn dilutin fllwing LOCA is presented in [Ref-1].

42 PAGE : 35 / Typical sequence f events Frm the initiating event t the cntrlled state In reactr state B, the RCP [RCS] break causes a lss f RCP [RCS] water inventry. Three levels f mitigatin are prvided t cmpensate fr the lss f RCP [RCS] water inventry: The pressuriser level cntrl, which is nt F1 classified, will perate as the first level f mitigatin. This will use the allwable imbalance between the RCV [CVCS] charging flw and letdwn flw. Islatin f the RCV [CVCS] letdwn line fllwing a lw pressuriser level signal is the secnd level f mitigatin. This islatin, which is nt F1 classified limits the lss f clant. The third level f mitigatin is the SI signal, which is F1A classified. This signal actuates the MHSI and LHSI pumps with the LHSI perating n its mini-flw. It als initiates the RCP [RCS] / cntainment islatin including islatin f the RCV [CVCS] letdwn line. The SI signal n "lw pressuriser pressure" is inhibited in state B. This avids spurius actuatin in reduced RCP [RCS] pressure cnditins. 6 Therefre, anther SI signal is implemented. This SI signal uses the P sat measurement which is F1A classified. It is calculated frm the ht leg temperature measurement t define the crrespnding saturatin pressure and the ht leg pressure measurement. This signal actuates the LHSI/RHR trains while the RCP [RCS] ht legs are still under sub-cled cnditins. Break flw cmpensatin: Fllwing the autmatic RIS/RRA [SIS/RHRS] start-up, the RCP [RCS] water inventry lss is quickly matched by the injectin flw. Fr all SB-LOCAs up t the largest break size f 20 cm 2, the lss f RCP [RCS] inventry at the break lcatin is matched by the MHSI injectin, as described in sub-sectin f this sub-chapter. Cre heat remval: The break des nt remve all the decay heat. Therefre secndary side heat remval is required, using the ASG [EFWS] and VDA [MSRT], which is F1A classified. The ARE [MFWS], AAD [SSS], and GCT [MSB] are used if available, but are nt F1 classified. Cntainment heat remval: The break flw temperature is higher than 100 C Therefre sme flashing t steam ccurs at the break. This results in a steam release inside the cntainment which leads t an IRWST temperature increase. IRWST heat remval via the LHSI/RHR heat exchangers limits this IRWST temperature increase. The cntrlled state is defined as a state, where: The reactivity is under cntrl The cre pwer is remved via the SG, which were in standby prir t the accident The reactr clant inventry is stable r increases again, i.e., the safety injectin flw matches the break flw Frm the cntrlled state t the safe shutdwn state The safe shutdwn state is defined as in reactr state A. 6 P sat = P ht Leg - P sat ( T ht leg )

43 PAGE : 36 / 173 The transient t reach the safe shutdwn state frm the cntrlled state is similar t that in state A, and described in that sectin Safety Criteria The safety criteria and acceptance criteria t be met are the same as thse described fr the SB-LOCA in state A Definitin f Studied Cases As fr state A, the limiting break lcatin is the cld leg. The small break LOCA studied in this sectin crrespnds t the largest PCC-3 break size f equivalent diameter 50 mm, equivalent t a break area f 20 cm 2. This case is analysed assuming: The wrst single failure The limiting equipment unavailability due t preventive maintenance. In state B, LOOP des nt need t be cmbined with the event. There is n need fr a specific cde calculatin f SB-LOCA in state B cnditins where the accumulatrs are available, since this scenari is cvered by the mre limiting situatin in state A. A CATHARE (versin V1.3L) calculatin is perfrmed fr the range f state B cnditins where the accumulatrs are islated. It will be demnstrated that the acceptance criteria related t the cntrlled state are met using nly F1A functins. Reference can be made t the crrespnding demnstratin fr state A cnditins fr successfully achieving the safe shutdwn state, which clearly bund state B cnditins Descriptin f studied cases frm the initiating event t the cntrlled state The safety demnstratin is perfrmed cnsidering the same cnservative assumptins as in state A Chice f Single Failure and Preventive Maintenance The wrst single failure is the lss f ne MHSI pump when the RIS/RRA [SIS/RHRS] is actuated. Thus ne MHSI pump is unavailable. Preventive maintenance n ne divisin, affecting ne MHSI, ne LHSI, and ne ASG [EFWS] pump is the limiting cnfiguratin. Thus, ne MHSI pump, ne LHSI pump, and ne ASG [EFWS] pump are als assumed t be unavailable Initial State Reactr state B Intermediate shutdwn state is defined as fllws:

44 PAGE : 37 / 173 It extends belw the ht shutdwn state, where sme F1A I&C signals are deactivated cmpared with pwer peratin It crrespnds t a RCP [RCS] pressure belw 130 bar and a RCP [RCS] temperature belw 303 C. It extends, t the cld shutdwn state which is reached with the LHSI/RHR cnnected. This ccurs at a RCP [RCS] pressure belw 30 bar and a RCP [RCS] temperature belw 120 C. It is nted that state B is assumed t start five hurs after RT. Tw sub-states, B1 and B2, are cnsidered in the safety assessment f an SB-LOCA in state B, based n the availability f the accumulatrs: State B1: all accumulatrs are available (nt islated) RCP [RCS] pressure ranges between 70 bar 7 and 130 bar RCP [RCS] temperature ranges between 245 C and 303 C. State B2: all accumulatrs are islated RCP [RCS] pressure ranges between 30 bar and 70 bar. RCP [RCS] temperature ranges between 120 C and 245 C. When cnsidering the RCP [RCS] water inventry and cre cling aspects, the higher the RCP [RCS] pressure and the RCP [RCS] temperature when the break ccurs, the mre severe the cnsequences: A high RCP [RCS] pressure increases the initial break flw and minimises the immediate SI capacity. A high RCP [RCS] temperature increases the break flw rate nce RCP [RCS] saturatin is reached due t the higher RCP [RCS] saturatin pressure. Similarly, it minimises the available SI capacity due t a lwer SI flw rate at the higher RCP [RCS] pressure. Cnsequently, the tw fllwing cnservative initial states have t be cnsidered in the safety assessment: State B1: mst cnservative initial cnditin: RCP [RCS] pressure: bar, including 2.5 bar uncertainty RCP [RCS] temperature: 308 C, including 5 C fr uncertainty and dead band. State B2: mst cnservative initial cnditin: RCP [RCS] pressure: 72.5 bar, including 2.5 bar uncertainty RCP [RCS] temperature: 250 C, including 5 C fr uncertainty and dead band. 7 During the nrmal RCP [RCS] cldwn t cld shutdwn, the accumulatrs are islated at a RCP [RCS] pressure f 70 bar. This is abve their perating pressure range f 45 t 50 bar They are de-islated at 70 bar during the nrmal RCP [RCS] heat-up t ht shutdwn. At a RCP [RCS] pressure f 70 bar, the maximum RCP [RCS] temperature is 245 C.

45 PAGE : 38 / 173 Hwever, state B1 is clearly cvered by the analysis in state A. The same equipment and capacities are available as in state A, but the cre pwer is much lwer in state B. Therefre, a safety analysis is nly perfrmed fr state B Specific Assumptins a) Assumptins related t nn-f1 systems As in state A, the nn-classified systems are nt claimed when they perfrm a mitigating functin. b) Assumptins related t F1 systems Safety Injectin (F1A): SI signal is autmatically actuated n a lw RCP [RCS] subcling margin P sat signal with a setpint in the range f 10 t 5 bar. T cver the 8 uncertainty n the setpint and t take accunt f the degraded cntainment cnditins, the setpint is cnservatively assumed t be 0. This results in a maximum delay t start the LHSI/RHR pumps, and t the beginning f the partial cldwn. The cnservative assumptins fr the resulting actins are listed belw: 20 secnds maximum delay fr LHSI/RHR pumps start-up including signal delay Minimum characteristics fr LHSI/RHR pumps 50 C fr initial IRWST temperature and injectin flw temperature. The LHSI/RHR train injecting int the brken lp is assumed t spill directly int the cntainment with LHSI/RHR cmpnents available t perfrm the cld leg injectin are the fllwing, taking the single failure and preventive maintenance assumptins int accunt,: One MHSI pump. Three accumulatrs when available (state B1). Tw LHSI pumps. VDA [MSRT] (F1A): VDA [MSRT] setpints crrespnd t the saturated cnditins f the RCP [RCS], plus 1.5 bar uncertainty t mdel the pressure measurement uncertainty in a cnservative manner. All VDA [MSRT], ne per SG, are available. The SI signal initiates the Partial Cldwn as in state A. Hwever, the autmatic decrease f SG pressure at a rate f -100 C/h dwn t 60 bar (± 1.5 bar uncertainty) is nly effective in the high RCP [RCS] pressure range f state B1 where the initial SG pressure is higher than 60 bar. ASG [EFWS] (F1A): ASG [EFWS] is used t feed the SG. Three trains are available. 8 P sat = P ht Leg - P sat ( T ht Leg )

46 PAGE : 39 / 173 The cnservative assumptins fr the ASG [EFWS] pump characteristics and the ASG [EFWS] water temperature are similar t thse described in sub-sectin f Sub-chapter Reactr clant pumps trip (F1A): the reactr clant pumps trip is autmatically actuated n a reduced reactr clant pumps pressure drp signal, nrmally at 80% f the reactr clant pumps nminal pressure drp. Hwever, in the analysis a setpint f 50% is assumed t include sme margin. This results in a later reactr clant pumps trip and a cnsequent later SI signal Other Assumptins The pressuriser water level/vlume f 19.6 m 3 crrespnds t the minimum water level fr zer pwer, including cnservative uncertainties f 5% MR. The initial secndary pressure crrespnding t the primary temperature f 250 C is 40 bar. Fr the prgressin f the event it is assumed that the plant is in cldwn mde with a gradient f 50 C/h. The secndary and primary pressure decreases in line with this cldwn rate Results The safety assessment utilises a qualitative argument fr a SB-LOCA in state B1, but the SB- LOCA scenari fr state B2 is explicitly analysed State B1: Accumulatrs Available (Nt Islated) The effects f the 20 cm 2 SB-LOCA n the RCP [RCS] water inventry and cre cling in state B1 are less severe than thse calculated by the CATHARE cde fr the accident analysis in state A, since: All F1A mitigatin measures claimed in state A are available in state B1 MHSI, LHSI and accumulatrs fr SI injectin, VDA [MSRT], and ASG [EFWS] fr heat remval. There are further F1A systems available in state B1 Single failure applies t nly ne item f equipment instead f ne electrical divisin. This is a cnsequence f the cntinued availability f ff-site pwer in this case. There is, therefre, n lss f ne divisin pwer supply as a result f a failure f an emergency diesel generatr (EDG). The SI signal ccurs befre RCP [RCS] saturatin is reached. The RCP [RCS] is still full f sub-cled water, except fr the pressuriser. The MHSI pumps are perable earlier in state B1 as there is n requirement t include a delay frm a diesel relading sequence in the absence f a LOOP. Initial SG pressure 9 is lwer in state B1 than in state A, resulting in: Lwer break flw rate as a lwer RCP [RCS] pressure is reached when the RCP [RCS] saturates. 9 Maximum SG pressure bar in state B1, instead f bar in state A.

47 PAGE : 40 / 173 MHSI injectin ccurs earlier. The Partial Cldwn 10 is mre efficient. The initial SG pressure is lwer and leads t the MHSI delivery pressure f 85 bar/300 C being reached earlier. Similarly, the cmpletin f the Partial Cldwn at 60 bar/275 C als ccurs earlier. The SI injectin flw is higher due t the lwer RCP [RCS] pressure. Cre decay heat is lwer in state B1, allwing a faster RCP [RCS] depressurisatin. As a result, due t the lwer RCP [RCS] break flw and the earlier actuatin and greater effectiveness f the MHSI in state B1, the RCP [RCS] water inventry is higher cmpared with state A fr the same size break. Therefre, the CATHARE analysis results f the limiting PCC-3 SB-LOCA in state A fr a break f 50 mm crss sectin are cnservative fr a PCC-3 SB-LOCA in state B1: The cntrlled state is reached withut cre uncvery, and cnsequently withut cre heat-up, using nly F1A systems. The preventin f cre uncvery is achieved withut using the accumulatrs, and LHSI as ne MHSI is sufficient. The cnsequences f a small break LOCA transient in state B1 t the cntrlled state are bunded by the cnsequences btained in state A State B2: Accumulatrs Unavailable (Islated) The initial plant state cvered by this CATHARE calculatin is given in Sectin Table 4. Althugh state B2 is nly reached at mre than 5 hurs after RT, where the decay heat is 42.4 MW, a mre cnservative value f 50 MW is assumed in the calculatin. Thus, the analysis results include sme additinal margins. The sequence f events is given in Sectin Table 5 [Ref-1]. The mst imprtant parameters are presented in the fllwing figures: Sectin Figure 6: Reactr and SG pwer, RCP [RCS] and SG secndary side pressures. Sectin Figure 7: Break mass flw (steam, liquid and ttal), break flw steam and liquid. Sectin Figure 8: Swell levels in RPV, cre vid fractin. Sectin Figure 9: Clant liquid and vapur temperatures in RPV and cre, clad temperatures Sectin Figure 10: Integrated flw rates f RIS [SIS], clant inventry n primary and secndary side 10 With SG initial pressure f 90 bar in state B1 (saturatin 303 C), instead f 95.5 bar in state A (saturatin C), the MHSI injectin int RCS (RCS saturatin 85 bar/300 C) can start a few minutes earlier in state B1 cmpared with state A assuming the same partial cldwn rate f: -100 C/h).

48 PAGE : 41 / 173 Sectin Figure 11: Ttal RIS [SIS] and break flws, integrated RIS [SIS] and break flws A detailed explanatin f these parameters is prvided in Sectin Table 6. The main autmatic safety measure is starting the MHSI and LHSI pumps fllwing a SI signal, generated by the P sat lw setpint being reached. Hwever the LHSI pumps d nt deliver t the RCP [RCS]. The break flw is matched early in the transient. The lack f accumulatr injectin is nt significant t the mitigatin f the event. Abut 2500 secnds, r sme 40 minutes after the break ccurs, the RCP [RCS] inventry slwly starts increasing as a result f the peratin f nly ne MHSI pump. As the cre is cvered by at least a tw-phase mixture thrughut the transient, there is n cre heat-up and the acceptance criterin f 1200 C in the fuel rd is met. After abut 3000 secnds (50 minutes) the cntrlled state is reached Descriptin f Cases Studied frm the Cntrlled State t the Safe Shutdwn state The plant state at the cntrlled state is better in state B than in state A. All F1A and F1B mitigatin systems used in state A t transfer the plant frm the cntrlled state t the safe shutdwn state are als available in state B. Cnsequently, the safety assessment perfrmed fr the transfer t the safe shutdwn state in a PCC-3 SB-LOCA frm state A bunds the PCC-3 SB-LOCA frm state B. It can be cncluded that, despite f the wrst single failure and limiting preventive maintenance, the safe shutdwn state is reached with all safety and acceptance criteria fulfilled, using nly F1A and F1B systems Cnclusin A SB-LOCA in state B has the fllwing main differences when cmpared t a SB-LOCA in state A: Changes in F1A mitigatin means SI signal " P sat lw" in state B, instead f "pressuriser pressure lw" in state A Accumulatrs islated belw RCP [RCS] pressure f 70 bar in state B Mre favurable initial plant cnditins. The cnclusins reached fr the PCC-3 SB-LOCA in reactr state A fr a break smaller than 50 mm diameter, r area f 20 cm 2 ), als apply t the PCC-3 SB-LOCA in reactr state B in the same size range, as discussed belw. All the safety criteria are met despite the wrst single failure and preventive maintenance assumptins:

49 PAGE : 42 / 173 There is n cre uncvery and thus n cre heat-up. The peak clad temperature remains belw the acceptance criterin f 1200 C There is n clad xidatin There is n clad rupture Integrity f the cre gemetry is maintained The lng-term cre cling is maintained. The cntrlled state is reached, using F1A classified systems. The LHSI/RHR in cnjunctin with the VDA [MSRT] and the ASG [EFWS] nly are used. The safe shutdwn is reached, using nly F1A and F1B classified systems: During the transfer frm the cntrlled state t the safe shutdwn state: The VDA [MSRT] and ASG [EFWS] pump and tank capacities fr cre heat remval The LHSI/RHR heat exchange capacity fr IRWST heat remval The MHSI capacity fr RCP [RCS] water inventry The MHSI and RBS [EBS] brn injectin capacities fr cre subcriticality The RBS [EBS] is nly required fr smaller breaks, and if the RCP [RCS] brn cncentratin related t cld shutdwn was nt achieved at initial state B. At RIS/RRA [SIS/RHRS] cnnectin cnditins crrespnding t the safe shutdwn state: The LHSI/RHR heat exchange capacity fr RCP [RCS] heat remval The LHSI/RHR heat exchange capacity fr IRWST heat remval The LHSI capacity fr RCP [RCS] water inventry The LHSI brn injectin capacity fr cre subcriticality CONSEQUENCES OF THE MODIFICATION OF THE PARTIAL COOLDOWN RATE Fllwing the SI signal actuated either n a pressuriser pressure < MIN3 signal in state A r n a lw RCP [RCS] sub-cling margin P sat signal in state B, the partial cldwn is autmatically actuated in rder t remve the energy f the primary side via the secndary side. Cnsequently the primary pressure is reduced which allws the MHSI t inject brated water. The cldwn rate increase frm -100 C/h t -250 C/h will have a beneficial effect n the mitigatin f the small break LOCA accident. As a cnsequence f the change, the MHSI delivery pressure f 85 bar will be reached earlier as the primary pressure will decrease faster.

50 PAGE : 43 / 173 At the end f the partial cldwn, the final primary pressure will remain the same (61.5 bar) and the break flw will be similar. It can thus be cncluded that all the decupling criteria will be met SYSTEM SIZING Residual Heat Remval System (RIS [SIS]) This transient places requirements n the MHSI flw. The required MHSI flw rate is gverned by the fllwing requirements: Fr SB-LOCA f 5 cm 2, equivalent diameter f 25 mm, in state A limited RCP [RCS] draining. This transient places a requirement n the MHSI flw rate at apprximately 70 bar. Allwance fr reactr clant pumps running during the SB-LOCA f 5 cm 2 equivalent diameter f 25 mm. This transient places a requirement n the MHSI flw rate with the large mini-flw line pen at 25 bar N cre uncvery fr break size belw 20 cm 2, equivalent diameter f 50 mm, in pwer state A (PCC-3) impses a required MHSI flw rate

51 PAGE : 44 / 173 SECTION TABLE 1 Fissin Pwer (Term A) The residual fissin pwer (term A) results frm a MANTA decupled Reactr Trip (RT) simulatin. Pint-kinetic neutrnic mdel is used with a cnservative set f neutrnic data, bunding all UO 2 and MOX fuel managements: Maximum mderatr temperature cefficient K/K per g/cm 3 (cnstant value) Minimum Dppler temperature cefficient pcm/ C (cnstant value) Minimum Dppler pwer cefficient - accrding t 14.1 Table 4 Minimum rd wrth pcm (N-1 rds, UO 2 fuel) Minimum rd wrth insertin versus - accrding t 14.1 Table 8 Rd drp time Maximum rd drp time - 5 secnds (with earthquake) RCP [RCS] and SG thermal hydraulic calculatin is based n cnservative bundary cnditins: Minimum decrease f ARE [MFW] flw after RT: Frm RT t RT+15 s Frm RT+15 secnds t 0% SG-level setpint 100% t 30% (linear decrease) 30% (cnstant value), afterwards flw cntrlled t keep SG-level Maximum decrease f ARE [MFW] temperature after RT: At RT frm 230 C dwn t 190 C in ne step Minimum GCT [MSB] pening time after RT GCT [MSB] valves pening time GCT [MSB] I&C-prcessing delay 0 s 0 s TIME (s) frm beginning f rd drp FISSION POWER % f initial cre pwer

52 PAGE : 45 / 173 SECTION TABLE 2 Initial Cnditins 20 cm 2 ( 50 mm) Cld Leg Break (State A) Parameters Limiting Values Reactr Clant System Initial reactr pwer (% f nminal pwer) = 102. Initial average RCP [RCS] temperature ( C) = Initial pressuriser pressure (bar) = Reactr clant flw (kg/s) (T/H flw rate) Pressuriser water vlume / level (m 3 / m) 43.4 / 7.4 (nminal+ 5%MR) Dme liquid temperature ( C) 332 (ht leg temperature) Steam Generatrs Initial steam pressure (bar) 80.1(Cnsistent with RCP [RCS] T) Initial SG level (m) 15.7 (nminal) Tube plugging Level 10% Feedwater Main feedwater flw (% f nminal flw) = 102 Initial ARE [MFWS] temperature ( C) 232

53 PAGE : 46 / 173 SECTION TABLE 3 Sequence f Events Related t Cntrlled State Typical Results fr 20 cm 2 ( 50 mm) Cld Leg Break (State A) TIME (s) EVENT 0.0 Break pening 81.6 Pressuriser pressure < MIN2 (132 bar) 82.5 Reactr trip signal 82.8 RT (start f rd drp), TT, Reactr clant pumps trip, lss f ARE [MFW] flw 230 Pressuriser level = 0% MR 296 Pressuriser pressure < MIN3 (112 bar) 297 SI and PC signal 300 VDA [MSRT] pening 337 Starting MHSI, LHSI pumps 752 Start f MHSI injectin in lp 2 (RCP [RCS] pressure < 85 bar) 1380 ASG [EFWS] injectin in lps 2 and R 5000 End f calculatin SG1: related t the unaffected SG in lp1 SG2: related t the unaffected SG in lp2 SG3: related t the unaffected SG in lp3 SGR: related t the affected SG in lp R intact lp (with PM r SF) intact lp with pressuriser intact lp (with SF r PM) brken lp

54 PAGE : 47 / 173 SECTION TABLE 4 Initial Cnditins 20 cm 2 ( 50 mm) Cld Leg Break, State B2 Parameters Values Used Reactr Clant System Initial reactr pwer (% f nminal pwer) Initial average RCP [RCS] temperature ( C) Initial Pressuriser pressure (bar) RCP [RCS] lp flw rate (m 3 /hr) Pressuriser water vlume (m 3 ) 1.17% r 50 MW = = Steam Generatrs Initial steam pressure (bar) Initial water temperature ( C) Initial water level (m) 40 (fr RCP [RCS] at 250 C)

55 PAGE : 48 / 173 SECTION TABLE 5 Sequence f Events Related t Cntrlled State (Glbal Time Values) 20 cm 2 ( 50 mm) Cld Leg Break, State B2 TIME (s) EVENT 0 Break pening 200 Pressuriser empty RCP [RCS] pressure stabilises sme 5 bar abve secndary pressure (arund 45 bar) Setpint fr the RCP [RCS] trip criterin ( p acrss Reactr clant pumps < 50% f nminal) reached 1130 Setpint fr the SI signal n P sat = 0 reached 1150 Start f safety injectin by MHSI, RCP [RCS] pressure at abut 35 bar 2500 Minimum RCP [RCS] inventry, minimum level in RCP [RCS] well abve lp level MHSI flw is higher than break flw, cntinuus filling up f RCP [RCS] 3000 End f calculatin

56 PAGE : 49 / 173 SECTION TABLE 6 Explanatin f Parameters fr Figures 6 thrugh cm 2 (Ø 50 mm) Cld Leg Break State B Figure 6: Cre Pwer and Ttal Heat Exchange in Steam Generatr (CORE: cre pwer, SGPOWER: heat exchange in steam generatr) Primary and Secndary System Pressure (UPPL: upper plenum, COLDL1: cld leg lp 1, SECSG1 sec. pressure, PMIN1: reactr signal, PMIN2: safety injectin signal) Figure 7: Vapur and Liquid Mass Flw at the Leak (MVPLEAK: vapur flw, MLQLEAK: liquid flw, LEAKTOT: ttal flw) Vapur and Liquid Velcity at the Leak (VVPLEAK: vapur velcity, VLQLEAK: liquid velcity) Figure 8: Swell Level in Reactr Pressure Vessel (HDOME: vessel head, LEPLENSU: upper plenum, HLMID: ht leg middle) Vid fractin in the cre (VOIDCM1: 0.105m, VOIDCM2: 0.525m, VOIDCM8: 3.465m, VOIDCM9: 3.990m) Figure 9: Liquid and Vapur Temperature in Reactr Pressure Vessel (TEMLCM8: liquid at 3.465m, TEMLCM9: liquid at 3.990m, TEMGCM9: vapur at 3.990m, TGPLENSU: vapur in upper plenum) Cladding Temperature f the Average Rds (CLADTA1: 0.105m, CLADTA5: 1.995m, CLADTA8: 3.465m, CLADTA9: 3.990m) Figure 10: Integral Safety Injectin Rate (LHSIINT: lw head safety pump, MHSIINT medium head safety injectin, RIS [SIS] INT: ttal) Water Inventry in the Primary and Secndary System (PMASS: primary system, SMASS: secndary system) Figure 11: Safety Injectin and Leak Discharged Rate (RIS [SIS] TOT: ttal safety injectin rate, LEAKTOT: ttal leak discharge rate) Integral Safety Injectin and Leak Discharged Rate (RIS [SIS] INT: safety injectin, LEAKINT: leak discharged rate)

57 PAGE : 50 / 173 SECTION FIGURE 1 Typical (P,T) Reactr Operating Range Nte: This figure is prvided in Sectin 7 f Sub-chapter 14.5, SB-LOCA in Shutdwn State.

58 PAGE : 51 / 173 SECTION FIGURE 2 Secndary Side Water Inventries RCP [RCS] and Secndary Side Pressures Typical Results fr 20 cm 2 ( 50 mm) Cld Leg Break (State A, PCC-3)

59 PAGE : 52 / 173 SECTION FIGURE 3 Ttal Break and RIS [SIS] Flw Rates Ttal Break and Steam Flw Rates Typical Results fr 20 cm 2 ( 50 mm) Cld Leg Break (State A, PCC-3)

60 PAGE : 53 / 173 SECTION FIGURE 4 Maximum Clad Temperature Cre Tw-Phase Level Typical Results fr 20 cm2 ( 50 mm) Cld Leg Break (State A, PCC-3)

61 PAGE : 54 / 173 SECTION FIGURE 5 RCP [RCS] Bratin in SB-LOCA

62 PAGE : 55 / 173 SECTION FIGURE 6 20 cm 2 (Ø 50 mm) Cld Leg Break State B2 Cre Pwer and Ttal Heat Exchange in Steam Generatr Primary and Secndary System Pressure 120 REACTOR CORE AND SG POWER (MW) CORE SGPOWER PRIMARY AND SECONDARY PRESSURE (BAR) UPPL COLDL SECSG1 PMIN1 PMIN TIME (S)

63 PAGE : 56 / 173 SECTION FIGURE 7 20 cm 2 (Ø 50 mm) Cld Leg Break State B2 Vapur and Liquid Mass Flw at the Leak Vapur and Liquid Velcity at the Leak 300 LEAK DISCHARGED RATE (KG/S) MVPLEAK MLQLEAK LEAKTOT LEAK VELOCITY (M/S) VVPLEAK VLQLEAK TIME (S)

64 PAGE : 57 / 173 SECTION FIGURE 8 20 cm 2 (Ø 50 mm) Cld Leg Break State B2 Swell Level in Reactr Pressure Vessel Vid Fractin in the Cre 6 5 SWELL LEVEL IN REACTOR PRESSURE VESSEL (M) HDOME LEPLENSU HLMID CORE VOID FRACTION VOIDCM1 VOIDCM2 VOIDCM VOIDCM TIME (S)

65 PAGE : 58 / 173 SECTION FIGURE 9 20 cm 2 (Ø 50 mm) Cld Leg Break State B2 Liquid and Vapur Temperature in Reactr Pressure Vessel Cladding Temperature f the Average Rds 300 LIQUID AND VAPOR TEMPERATURE IN VESSEL (C) TEMLCM8 TEMLCM9 TEMGCM9 280 TGPLENSU CLADDING TEMPERATURE (C) CLADTA1 CLADTA5 CLADTA8 250 CLADTA TIME (S)

66 PAGE : 59 / 173 SECTION FIGURE cm 2 (Ø 50 mm) Cld Leg Break State B2 Integral Safety Injectin Rate Water Inventry in the Primary and Secndary System

67 PAGE : 60 / 173 SECTION FIGURE cm 2 (Ø 50 mm) Cld Leg Break State B2 Safety Injectin and Leak Discharged Rate Integral Safety Injectin and Leak Discharge 200 LEAK DISCHARGED AND INJECTION RATE (KG/S) TOT AKTOT INT. LEAK AND INJECTION RATE (TONS) SISINT LEAKINT TIME (S)

68 PAGE : 61 / STEAM GENERATOR TUBE RUPTURE (1 TUBE) The steam generatr tube rupture f ne tube (2A-SGTR) ccurring in state A is classified as a PCC-3 event IDENTIFICATION OF CAUSES AND ACCIDENT DESCRIPTION General Cncern The steam generatr tube rupture (SGTR) event is defined as the duble-ended rupture f a single steam generatr (SG) tube. The main cnsequences f this accident are assciated with the secndary side cntaminatin and pssible discharge f radiactive prducts t the atmsphere. The cntaminatin cmes frm the rupture which cnnects the reactr clant system (RCP [RCS]) t the secndary side. The primary side clant is assumed t be radiactive due t crrsin and fissin prducts assciated with cntinuus peratin with a limited amunt f defective fuel rds. This risk f cntaminatin is primarily in the affected SG (SGa). The pssible discharge f radiactive prducts t the atmsphere can ccur either in the steam r liquid phase via the main steam relief trains (VDA [MSRT]) r the main steam safety valves, if challenged. The descriptin f the transient is subdivided int shrt term and lng term t clearly separate the phases f radiactivity release t the atmsphere. The shrt term phase is defined as up t the pint f leak terminatin. This includes the cntrlled state in which the leak is matched by the RCP [RCS] injectin. In the lng term phase, the plant is transferred t the safe shutdwn state cnditins with a pssible additinal activity release if depressurisatin f the affected SG by the VDA [MSRT] is required Typical Sequence f Events The typical sequence f events in the case f a 2A-SGTR, apart frm additinal events that culd ccur because f the single failure assumptins is as fllws: Frm rupture initiatin t leak terminatin (shrt term) a) Frm rupture initiatin t the cntrlled state The cntrlled state is defined as a state where the RIS [SIS] flw and/r RCV [CVCS] flw if available, is able t cmpensate fr the flw thrugh the tube rupture, with decay heat remved frm the RCP [RCS] by the SG. The lss f primary clant causes a decrease in the primary pressure and cntaminatin f the secndary side. The reactr trip can ccur either fllwing a pressuriser pressure < MIN2 r a SG level > MAX1 signal generated in the affected SG, r via an peratr initiated shutdwn at 30 minutes after activity detectin via a safety class 1 system. The latter crrespnds t Design Optin 1 f the SGTR mitigatin strategy [Ref-1]. Which signal ccurs depends n the initial state and perating cnditins f the plant. The fllwing discussin f a typical sequence f events, within this sub-sectin, assumes the break is f sufficient magnitude t lead t an autmatic reactr trip prir t the peratr initiating a cntrlled shutdwn.

69 PAGE : 62 / 173 At Pwer Operatin At pwer peratin, the SGTR flw takes part in the prductin f steam. The SGa level is nt significantly increased. The RT n pressuriser pressure < MIN2 signal is therefre generated prir t the ne n SG level > MAX1 signal. Zer Pwer Operatin At ht shutdwn initial cnditins, the primary heat transferred t the secndary side is insufficient t bil all the SGTR flw. This causes the affected SG level t increase. A RT ccurs and the affected SG is islated n the feed side fllwing a SG level > MAX1 signal. The ARE [MFWS], r ASG [EFWS] if already actuated are islated. A reactr trip signal autmatically trips the turbine and the steam generatr pressure rapidly increases. The GCT [MSB] is assumed t be unavailable as it is nt F1-classified. It wuld als be unavailable fllwing a Lss f Offsite Pwer (LOOP) assumed at turbine trip. When the VDA [MSRT] pressure setpint is reached, the VDA [MSRT] islatin valve pens and cntaminated steam is discharged t the atmsphere frm the affected SG. The cntinuus lss f RCP [RCS] clant inventry causes the pressuriser t empty. This results in a depressurisatin f the primary side because the RCV [CVCS] is nt able t match the break flw. Partial cldwn is initiated either fllwing a Safety Injectin (SI) signal n pressuriser pressure < MIN3 r fllwing a SG level > MAX2 signal frm the affected SG. Partial cldwn lwers the pressure in all fur SG t nminally 60 bar by reducing each VDA [MSRT] pressure setpint at a rate crrespnding t a given RCP [RCS] cldwn. Fllwing the SI signal the MHSI pumps are actuated. Hwever they d nt inject as the RCP [RCS] pressure is abve their shutff head. The cntrlled state is reached when MHSI injectin and RCV [CVCS], if available, are able t match the SGTR flw rate. Hwever, since the leak has nt been halted at this pint, the affected SG cntinues t fill with cntaminated water and activity release t the atmsphere cntinues. b) Frm the cntrlled state t leak terminatin The affected SG is identified and islated fllwing the cmbinatin f SG level > MAX2 and end f partial cldwn signals r peratr actin. The RCV [CVCS] charging lines are islated autmatically. The islatin f the affected SG is perfrmed by raising the setpint f the VDA [MSRT] t abve the MHSI shutff head but belw the MSSV pressure setpint and clsing the VIV [MSIV] if this has nt already ccurred. This prevents any further release f radiactive prducts t the atmsphere. This setpint increase can be perfrmed autmatically r manually. The islatin f the affected SG, including the clsure f the affected SG VDA [MSRT] and VIV [MSIV] causes the flw via the break t increase the pressure in the affected SG. Once the primary side and secndary side f the affected SG pressures equalise, the flw via the break is finally terminated. This crrespnds t the end f the shrt term phase. Significant margin t verfilling f the affected SG is maintained. Cnsequently nly steam is discharged during this phase. The shrt term phase, until SGTR leak terminatin, uses nly autmatic F1 signals and systems.

70 PAGE : 63 / Frm leak terminatin t the safe shutdwn state (lng term phase) The safe shutdwn state is defined as a state where the affected SG is islated and at least ne RIS/RRA [SIS/RHRS] train is cnnected t the RCP [RCS]. One ut f fur LHSI in RHR mde trains is sufficient t prvide the required heat remval. The cnnectin cnditins are: RCP [RCS] ht leg pressure < 30 bar and, RCP [RCS] ht leg temperature < 180 C and, Tsat 1 and Reactr Pressure Vessel Level (RPVL) cnsistent with LHSI in RHR mde suctin cnditins frm the ht leg. The sequence f actins t be perfrmed by the peratr t reach the safe shutdwn can be divided int 2 successive phases: bratin and RCP [RCS] cldwn, and final depressurisatin. Bratin and RCP [RCS] Cldwn The bratin and RCP [RCS] cldwn actins are perfrmed by the peratr 30 minutes after reactr trip. The RBS [EBS] delivers a cnstant bratin flw rate t the RCP [RCS], prviding the negative reactivity required t reach the safe shutdwn state. The allwed cldwn rate depends n the number f available RBS [EBS] trains: 25 C/h with 1 RBS [EBS] train in peratin, 50 C/h with 2 RBS [EBS] trains in peratin. The RCP [RCS] cldwn is perfrmed using the unaffected steam generatrs. This cldwn ccurs with the MHSI perating t prevent perturbing the pressure balance between primary side and the affected SG. Final Depressurisatin At the end f the RCP [RCS] cldwn phase, the RCP [RCS] pressure is clse t the MHSI shutff head with the MHSI n. This pressure is higher than the LHSI in RHR mde maximum cnnecting pressure f 30 bar. If the affected SG level is t high, the peratr first pens the transfer line between SGa and its partner SG t limit risks f water hammer in the SGa steam line. This als prevents verfilling f the affected SG and large activity release t the atmsphere. Prir t this transfer, the partner SG is prepared t accept the additinal vlume frm the affected SG by: lwering the value fr level cntrl slightly abve the SG level MIN2 setpint, ASG [EFWS] is stpped, VIV [MSIV] is clsed, and the setpint f the VDA [MSRT] increased Once the level in the affected SG falls belw MAX2 (NR), the affected SG VDA [MSRT] is pened. This allws the depressurisatin t 30 bar. 1 Tsat = Tsat (ht leg pressure) - Tc, with Tc = cre utlet temperature

71 PAGE : 64 / Radilgical cnsequences Cntaminated steam flws thrugh the turbine befre reactr trip and is cndensed in the steam dump system. Gaseus and insluble radiactive prducts are evacuated t the atmsphere thrugh air ejectrs and are detected by cntinuus activity cntrl and peridic measurements. After turbine trip, if the cndenser is n lnger available, the pening f the VDA [MSRT] cannt be prevented. Steam is then released t the atmsphere. The radilgical cnsequences are assessed in Sub-chapter Precautins limiting the event ccurrence The prbability f SGTR event is reduced thrugh the fllwing precautins: the SG tube material is highly ductile, the blwdwn system is lcated at the bttm f the SG tube bundle and is designed t prevent slid depsits n the tube plate, the secndary water is cnditined chemically, thereby prtecting the SG tubes frm crrsin phenmena, the steam generatrs are designed t prevent any prjectile cming frm the main feedwater t directly strike ne r several tubes, SG supprt plates maintaining tube bundle are designed (type f material, gemetry f brings) t prevent denting in the tubes and, in the case f a duble-ended guilltine rupture, t prevent pipe whip which culd cause the rupture f neighburing tubes, activity cntrl f the secndary side SG water and SG steam assumes cntinuus mnitring f the cmpliance within defined limits SAFETY CRITERIA The safety criteria t be cmplied with are the radilgical limits fr PCC-3 events discussed in Sub-chapter The safety criteria t be met are the dse equivalent limits in the case f release t the atmsphere. T meet these criteria, the fllwing decupling criteria are t be met: n cre damage (fuel cladding integrity), n MSSV challenge t prevent any pssibility f MSSV failure in the pen psitin, pssible return t LHSI in RHR mde cnditins f bratin, depressurisatin and heat remval with achievement f safe shutdwn cnditins using nly F1 systems. The preventin f cre damage, t keep the cre clable and t prevent increased activity cncentratin n primary side, is demnstrated by the LOCA studies.

72 PAGE : 65 / 173 The SGTR mitigatin strategy, invlving autmatic and manual actins, has been prduced t meet the fllwing tw bjectives: preventin f SG verfilling, t avid increased activity release by liquid discharge t the atmsphere, minimisatin f the SGTR leak backflw, t avid prblems with lw brated water slugs in the primary circuit when the reactr clant pumps are ff (e.g. fllwing a lss f ffsite pwer) METHODS AND ASSUMPTIONS Methds f analysis Case 1 withut LOOP The Case 1 SGTR analysis, t assess the maximum steam release, is perfrmed with the CATHARE cde using a realistic deterministic methdlgy. The realistic deterministic methdlgy is characterised by tw main features: the key cde mdels are realistic thugh cnservatively riented, bunding the experimental results withut excessive cnservatism, and the initial and bundary cnditins are cnservatively selected. The basic steps f the realistic deterministic methdlgy cnsist f: the phenmenlgical analysis f the accident scenari, and the identificatin f the key phenmena, the judgement f adequacy f the cde t calculate the accident scenari, based n physical understanding, experimental data base, cde assessment examinatin, and supplemented when necessary by sensitivity studies, the evaluatin f calculatin uncertainty with emphasis n dminant parameters (thrugh sensitivity studies as necessary), r the check f a bunding cnservative apprach f key phenmena by the cde, relying n the assessment matrix f the cde, the intrductin, when necessary, f cnservative biases as clse as pssible t the uncertainty n the key phenmena. They are intrduced either in a cde mdel, in a ndalisatin scheme, r in a bundary cnditin, and the use f cnservative assumptins fr initial and bundary cnditins. The dminant phenmena f the SGTR transient are: the SGTR flw rate and the resultant SG level increase,

73 PAGE : 66 / 173 the mderate RCP [RCS] draining (pressuriser) and depressurisatin until the equilibrium with the affected SG pressure is reached, the asymmetric RCP [RCS] heat remval via the unaffected SG in subcled RCP [RCS] cnditins, All these phenmena are within the applicable range f the CATHARE cde, fr which validatin is based n [Ref-1]: the qualificatin f crrelatins and physical laws n separate effect tests (SET) r cmpnent tests, fr example: CATHARE SGTR peratr fr accurate SGTR break flw predictin, the validatin f the axial SG mdel, with an ecnmiser f the N4 SG-type frm MEGEVE small scale mdel tests, the verall verificatin f the cde by simulatin f integral effect tests (IET), cvering a wide range f representative PWR transients n small-scale facilities, fr example: BETHSY 4.3b 6 SGTR Test in which CATHARE accurately predicted the mass discharged at the faulted SG relief valve, the faulted SG mass inventry, the RCP [RCS] mass inventry and distributin. It accurately predicted the frmatin f the large steam space inside the faulted SG tubes, the slw RCP [RCS] depressurisatin during the draining f the faulted SG, the restart f the lp circulatin after the reactr clant pump start in the affected lp, and the cnsequent fast depressurisatin due t the cndensatin and cllapse f the faulted SG tubes steam space. Cases 2 and 3 with LOOP The S-RELAP5 cde cupled with the I&C rutines f the NLOOP cde is used fr Cases 2 and 3 [Ref-2], which assess the ptential fr verfilling f and water relief frm the SG and address the lng term cldwn capability fllwing LOOP. The family f transients in the S-RELAP5 mdel is SGTR. Primary side phenmena: Small break LOCA behaviur as primary pressure and pressuriser level decrease until the initiatin f the MHSI. Steam-side islatin f the affected SG and secndary side cldwn with the intact SGs can lead t a very lw circulatin rati within the affected SG. Secndary side phenmena: Main steam pressure increases fllwing clsing f the turbine / main steam bypass valves. Fast pening f the main steam relief train and reclsing t maintain a cnstant main steam pressure.

74 PAGE : 67 / 173 Filling f the affected SG abve the tp edge f the separatrs after reactr trip. Overfill f the affected SG may ccur. Generally, fr S-RELAP5, a wide range f validatin at different test facilities fr the apparent phenmena are perfrmed as integral r separate tests. These tests are applied fr verificatin f all primary side phenmena. Explicitly n the basis f tests at the PKL and THTF facilities, a wide range f validatin fr smaller leaks is perfrmed. This als cvers thermal-hydraulic phenmena in transients including the phenmena n the secndary side. Additinally, an SGTR incident ccurring at the Del2 PWR was recalculated successfully using S-RELAP5. [Ref-3] Bth the CATHARE and S-RELAP5 transient analyses rely n the applicatin f the cnservative PCC analysis rules defined in Sub-chapter The rules include the deterministic penalisatin f all relevant bundary cnditins relative t the decupling criteria under cnsideratin. This penalisatin addresses at least: the characterisatin f the initiating event, the plant initial cnditins (cntrl dead band limits, maximum measurement uncertainties) and, the efficiency f the prtectin and mitigatin actins with maximum uncertainty n each I&C measurement and signal delay, and n each system respnse time and capacity. This analysis methdlgy prvides cnservative results that can be used directly fr the assessment f the decupling criteria Main Assumptins Accident Definitin The cases studied in sectin 6 f this sub-chapter crrespnd t the duble-ended guilltine rupture f 1 tube in a steam generatr, which allws unimpeded blwdwn frm bth ends f the severed tube. The tube rupture is lcated at the bttm f SG-tubes bundle, n the cld side. This lcatin maximises the SGTR leak flw rate (higher fluid density). Fr accident analyses, a lss f ff-site pwer (LOOP) is cmbined with the accident, if this is mre cnservative Prtectin and Mitigatin Actins The autmatic prtectin systems and peratr actins (by means f F1-classified systems) fllwing a SGTR event, aim at tripping the reactr, remving the residual heat, terminating the primary t secndary leak flw, limiting cntaminated SG liquid mass release t the atmsphere, and, finally, taking the reactr t a safe shutdwn state. The different autmatic prtectins and alarms, which culd ccur during the recvery frm the SGTR event, are linked either t the reactr clant depressurisatin r t the level increase in the affected SG.

75 PAGE : 68 / 173 The reactr trip is initiated via ne f the fllwing F1A signals: pressuriser pressure < MIN2, SG level in affected SG > MAX1, If the leak rate is insufficient t reach either f the F1A actins listed abve, a manual reactr trip may be assumed after the first significant indicatin is received in the cntrl rm. The ther F1A autmatic prtectin includes the fllwing: Turbine trip: the turbine trip is actuated n RT check-back signal, Safety injectin signal and partial cldwn: the RIS [SIS] is actuated n the "pressuriser pressure < MIN3" signal. A partial cldwn using all SGs, including the affected ne (unless it has been islated by peratr actin), is initiated if it has nt already been actuated, Partial cldwn can als be actuated n the SG level > MAX2" signal 2 if partial cldwn has nt already been actuated. The partial cldwn is perfrmed by all SGs, including the affected ne (unless it has been islated by peratr actin), Affected SG islatin (feed side): The affected SG is islated n a SG level > MAX1" signal. This initiates islatin f full lad ARE [MFWS] (MAX1 narrw range) and ASG [EFWS] line if the ASG [EFWS] was previusly actuated (MAX1 wide range). This signal is SG related, Affected SG islatin (steam side): The affected SG is islated n the SG level > MAX2" and end f partial cldwn signals. This is perfrmed by clsure f the VIV [MSIV], increasing the VDA [MSRT] pressure setpint t abve the MHSI shutff head but belw the MSSV pressure setpint, ASG [EFWS] actuatin: The ASG [EFWS] train is actuated n SG level < MIN2" in the crrespnding SG. This signal is SG specific. In the event f a LOOP, the ASG [EFWS] is actuated n an RIS [SIS] signal. The time delay between the setpint being reached and the effective ASG [EFWS] flw delivery is defined in accrdance with the assumptin f LOOP r n LOOP, VDA [MSRT] actuatin: The VDA [MSRT] pens and perfrms the heat remval with pressure cntrl when the SG pressure reaches the VDA [MSRT] setpint, SG pressure > MAX1", VIV [MSIV] islatin: The VIV [MSIV] clsure is initiated n a SG pressure < MIN1" r SG pressure drp > MAX1" signal. In this case all the MS lines are islated as the signal is nt SG specific, VDA [MSRT] islatin: The VDA [MSRT] f the crrespnding SG is islated when the SG pressure reaches the VDA [MSRT] setpint, SG pressure < MIN3. This is perfrmed by clsure f the assciated MSRIV. This signal is SG specific. 2 The MAX2 level can nly be reached in the affected SG because all ther SG feedwater delivery is islated n SG level > MAX1.

76 PAGE : 69 / 173 Fr lng term mitigatin f the event, the peratr actins aim t transfer the plant t the safe shutdwn state. The peratr perfrms the bratin and cldwn using the unaffected SGs prir t the final depressurisatin f the RCP [RCS] and the affected SG t the LHSI in RHR mde cnnecting cnditins Operatr Actins N peratr actin is claimed until 50 minutes after the first significant indicatin (detectin f increased level f activity within the affected SG). The 50 minute delay takes int accunt an initial peratr actin at 30 minutes after the activity detectin and then a delay f 20 minutes fr a pwer decrease. When lcal peratr actin is needed, the delay is extended t 1 hur. The actins presented belw are extracted frm the Emergency Operating Prcedures (EOP) available at the time f the study. The F1B peratr actins related t the affected SG islatin are: manual ASG [EFWS] islatin, if nt dne (SG level, secndary side activity) 3 manual ARE [MFWS] islatin, if nt dne (SG level, secndary side activity) manual VIV [MSIV] islatin, if nt dne (SG pressure) manual VDA [MSRT] setpint increase, if nt dne (SG pressure) The F1B peratr actins related t the nn-affected SGs are: manual ASG [EFWS] actuatin manual ARE [MFWS] Lw Lad islatin The F1B peratr actins t cldwn the plant t RHR cnnectin cnditins are: manual actuatin f cldwn, if nt dne (SG level, secndary side activity) reactr clant bratin: The bratin is autmatically perfrmed by the Chemical and Vlume Cntrl System (RCV [CVCS]). In the event that this system is unavailable, the peratr actuates the Extra Bratin System (RBS [EBS]). If the reactr is tripped manually, all f the abve actins will be perfrmed by the peratr at the time f reactr trip, with the exceptin f initiating the manual cldwn. The RBS [EBS] will be started and manual cldwn initiated after the cmpletin f the autmatic partial cldwn. 3 The parenthesis indicates ptential parameters used t take actins.

77 PAGE : 70 / DEFINITION OF CASES STUDIED Shrt Term Cases The shrt term phase, as defined in the SGTR study, is the time perid between SGTR initiatin and leak terminatin. This phase includes reaching the cntrlled state, which crrespnds t the state where the cre is subcritical and the SI flw rate r, if wrking prperly, RCV [CVCS] flw rate cmpensates fr the SGTR leak rate. Fr the shrt term phase, the purpse f the study is t evaluate the maximum amunt f fluid released t the atmsphere frm the affected SG prir t terminatin f the leak. This is dne in tw separate steps: T evaluate the maximum amunt f activity release t the atmsphere, it is cnservative t assume maximum pwer t be remved as prir t the islatin f the affected SG there is nly steam release. Therefre, the event is initiated at 102% f full pwer. This results in the maximum decay heat. In additin, n LOOP is assumed, requiring the reactr clant pump pwer t be remved in additin t the decay heat. T verify that n SG verfilling ccurs, and thus n liquid is released t the atmsphere prir t leak terminatin, a minimum pwer is cnservative. This assumptin minimises the steam releases and hence maximises the liquid cntent f the SG. Therefre the event is initiated at 2% f full pwer and LOOP is assumed. Thus, tw cases with different assumptins are analysed t address each f these tw bjectives. Case 1: Withut LOOP T maximise the steam release frm the affected SG it is necessary t maximise the heat t be remved by the SGs. Therefre, the wrst case is: maximum initial pwer f 102% FP n LOOP It is assumed that the reactr clant pumps remain running thrughut the transient. The ther specific assumptins fr this case are described in sub-sectin f this subchapter. Case 2: With LOOP T maximise the liquid cntent in the affected SG the initial liquid inventry shuld be maximised. This ccurs at a lw pwer level. In additin, the heat t be remved by the SGs shuld be minimised t give the minimum steam release. Therefre, the wrst case is: lw initial pwer f 2% FP, LOOP cincident with a turbine trip signal.

78 PAGE : 71 / 173 The ther specific assumptins related t this case are described in sub-sectin f this sub-chapter Lng Term Case The lng term phase cvers the time perid between leak terminatin and the safe shutdwn state with LHSI in RHR mde cnnectin cnditins being reached. This phase includes the phases f bratin and simultaneus cldwn f the RCP [RCS] using the unaffected SGs and the final depressurisatin f the RCP [RCS] and the affected SG. Fr the lng term phase, the bjective f the study is: T cnfirm the ability t reach safe shutdwn cnditins, LHSI in RHR mde cnnectin cnditins using nly F1 systems. The adequacy f ASG [EFWS] tank capacity is demnstrated The adequacy f the RBS [EBS] is demnstrated T determine the ttal amunt f activity released t the atmsphere, mainly during the final depressurisatin phase fr the RCP [RCS] and the affected SG. Only ne case is studied fr this phase. Case 3: With LOOP This case, with the inclusin f LOOP n turbine trip, demnstrates the capacity f the F1 systems t sufficiently brate the affected lp and t depressurise the RCP [RCS] and the affected SG withut significant leak backflw, when the reactr clant pumps are tripped. The maximum radilgical releases t the atmsphere are calculated during this phase. Nte that a lng term case with a maximum initial pwer and withut LOOP wuld be relevant fr the demnstratin f the capacity f F1 systems, especially f the ASG [EFWS] tank, t cl dwn the plant t LHSI in RHR mde cnditins with a maximum pwer t remve. Hwever, this case is analysed in the 2-tube SGTR case f sectin 10 f Sub-chapter The amunt f cntaminated steam released by the SGa during the final depressurisatin with a single SGTR is bunded by the results f the analysis perfrmed fr the 2 SGTR case in sectin 10 f Subchapter The ther specific assumptins related t this case are described in sub-sectin f this sub-chapter.

79 PAGE : 72 / SHORT TERM STUDY Case 1: Withut LOOP Chice f Single Failure (SF) and Preventive Maintenance (PM) The single failure n the Main Steam Relief Cntrl Valve (MSRCV) f the affected SG is assumed. The valve is assumed t remain stuck in its initial, fully-pen psitin. Pst-trip, SG pressure increases in the steam generatr until the VDA [MSRT] islatin valve pens. When this ccurs, the affected SG will begin an uncntrlled blwdwn. The blwdwn will cntinue until the MSRIV is shut n lw SG pressure (< MIN3). This case is studied t cnfirm that the SG des nt verfill r dry ut, and that the steam releases remain belw an acceptable value. It is assumed that n preventive maintenance is limiting fr this case. Operatr actins will be further ptimised during the Nuclear Site Licensing phase, t ensure that affected SG dry ut is avided Initial State The initial state cnditins, given in Sectin Table 1, are chsen t maximise the heat t be remved and the pressure difference between the RCP [RCS] and affected SG. Nte that the impact f an increase f the initial pressuriser level is assessed in sub-sectin f this sub-chapter Specific Assumptins a) Neutrnic data The cre pwer is assumed cnstant at 102% (4590 MWth) f full pwer until reactr trip. Fllwing RT, the time-dependent A term with σ uncertainties n B+C term is used as described in Sub-chapter b) Assumptins related t cntrl systems Turbine: Turbine cntrl maintains the turbine flw rate at 102% until turbine trip n reactr trip. GCT [MSB]: Nt cnsidered ARE [MFWS]: SG level cntrl is in peratin when the accident ccurs and wrks prperly until feed islatin n reactr trip. This is cnsistent with the analysis rules presented in Sub-chapter This maximises the activity transferred t the affected SG. High lad main feedwater flw is islated n reactr trip with n delay. Lw lad main feedwater is manually islated by the peratr.

80 PAGE : 73 / 173 RCV [CVCS]: T maximise the pressure difference between the RCP [RCS] and the affected SG, the maximum charging flw rate with 2 charging pumps in peratin at the start f the transient is assumed. Letdwn is islated n pressuriser level < MIN3 (12%). RCV [CVCS] charging is islated autmatically fllwing the cmbinatin f "SG level > MAX2 and the end f partial cldwn signals. The injectin temperature is mdelled as 270 C with letdwn in peratin. The injectin temperature is reduced t 50 C when the letdwn is islated. Pressuriser heaters and pressuriser sprays: T maximise the pressure difference between the RCP [RCS] and the affected SG, all pressuriser heaters are initially actuated. This maximises the RCP [RCS] pressure, while the spray flw rate is nt cnsidered. The heaters are shut ff fllwing a pressuriser level < MIN3 signal. c) Assumptins related t F1 systems The relevant setpints are given in Sectin Table 3. Reactr Trip: With the RCV [CVCS] system in peratin, the makeup flw is sufficient t maintain the primary circuit pressure abve the reactr trip setpint n lw pressuriser pressure fr the first 3000 secnds f the transient. The high activity signal is detected immediately fllwing the initiating event; a time delay f 3000 secnds is taken fr the peratr actin. Therefre, a manual reactr trip is assumed 3000 secnds after the break is pened. VDA [MSRT]: A minimum setpint fr the VDA [MSRT] n the affected SG is assumed and a maximum setpint n the unaffected SGs. This maximises the steam release frm the affected SG. After the manual reactr trip, the pressure increases in the SG, until the VDA [MSRT] pens. It is assumed that the VDA [MSRT] in the affected SG pens first (at 94 bar abs). The assciated MSRCV is assumed t have failed in the fully pen psitin, which leads t an uncntrlled blwdwn. The blwdwn f the affected SG results in a lw-lw primary circuit pressure signal, which initiates a partial cldwn. The VDA [MSRT] setpints are then decreased frm 97.0 bar t 61.5 bar by the end f the partial cldwn, while in the affected SG, the VDA [MSRT] setpint is raised t 99 bar abs. VIV [MSIV]: The VIV [MSIV] f all the SGs are clsed n the lw SG pressure signal ( SG pressure < MIN1 ) due t the depressurisatin caused by blwdwn f the affected SG. In the event that this des nt ccur, the peratr will perfrm this manually after the partial cldwn is cmplete. MHSI: SI is actuated fllwing a "pressuriser pressure < MIN3" signal with a setpint f bar. This signal initiates a partial cl dwn. The MHSI injects with a maximum flw rate, which begins injectin at a pressuriser pressure belw 97 bar. This maximises the pressure difference between the RCP [RCS] and the affected SG at the end f partial cldwn. ASG [EFWS]: EFW flw is started t the intact SGs at the minimum flw rate and maximum temperature by the peratr fllwing the manual reactr trip. EFW t the affected SG is islated at this time.

81 PAGE : 74 / 173 MSSV: T cnfirm pening f the MSSV is nt demanded during the transient, the MSSV is assumed t have a minimum setpint f bar ( bar). RBS [EBS]: The RBS [EBS] pump(s) are started when the peratr initiates the manual cldwn (nt mdelled in the calculatin). The cldwn rate is determined by the number f RBS [EBS] trains available. If tw trains are available, the cldwn prceeds at -50 C/hr. If nly ne train is available, the cldwn is limited t -25 C/hr Case 2: With LOOP Chice f Single Failure and Preventive Maintenance This case is studied t cnfirm that n SG verfilling, and thus n liquid release, ccurs befre leak terminatin ccurs. The wrst case assumes neither a single failure nr a preventive maintenance. Each lss f a F1 system reduces the filling rate f the affected SG, which is the main cncern fr this case Initial State The initial state cnditins, given in Sectin Table 2, are chsen t maximise the initial liquid cntent f the affected SG, t maximise the pressure difference between the primary and secndary side, and t minimise the heat t be remved by the affected SG. Nte that the impact f an increase f the initial pressuriser level is assessed in sub-sectin f this sub-chapter Specific Assumptins a) Neutrnic data The cre pwer is assumed t start at 2% full pwer, decreasing fllwing the realistic decay heat curve is presented in Sub-chapter b) Assumptins related t cntrl systems Turbine: The turbine is islated at the beginning f the transient t simulate initial ht standby cnditins. GCT [MSB]: GCT [MSB] is assumed t be lst when the fault ccurs t reduce the steam release frm the affected SG. ARE [MFWS]: N main feedwater supply either by ARE [MFWS] r by AAD [SSS] is assumed when the fault ccurs. This increases the amunt f subcled ASG [EFWS] injectin and, thus, the liquid cntent f the SG. RCV [CVCS]: The charging flw rate is maximised with 2 charging pumps in peratin t maximise the pressure difference between the RCP [RCS] and the affected SG. Letdwn is islated fllwing a pressuriser level < MIN3 signal. The RCV [CVCS] is islated autmatically fllwing a "SG Level > MAX2 (NR) and end f partial cldwn signals.

82 PAGE : 75 / 173 Pressuriser heaters and sprays: Pressuriser pressure cntrl is in peratin. After the emergency pwer mde is reached, 576 kw f emergency pwer is assumed t be supplied t the pressuriser heaters. The pressuriser heaters are shut ff when the pressuriser empties. c) Assumptins related t F1 systems Reactr Trip: The RT ccurs fllwing a SG pressure > MAX1 signal, with a minimum delay t shrten the time t reach the emergency pwer mde, which is assumed t ccur cincident with the reactr trip/ turbine trip signal. VDA [MSRT]: A minimum VDA [MSRT] setpint n the affected SG is assumed at bar. This maximises the pressure difference between the RCP [RCS] and the affected SG. A calculatin with an increased actuatin pressure fr the affected lp and reduced actuatin pressure fr the ther lps, t reduce steam remval frm the affected SG shws an ppsite effect with a slightly reduced maximum liquid cntent in the SG. After reaching the MAX2 setpint in the affected SG, a partial cldwn at 100 C/h is perfrmed autmatically t 58.5 bar in the affected SG and 61.5 bar in the unaffected SGs. When the partial cldwn is finished, the set value fr the relief train f the affected lp is manually set t 100 bar. The VDA [MSRT] set pressure increase is autmatically actuated fllwing the cmbinatin f SG level > MAX2 (NR) and end f partial cldwn signals. VIV [MSIV]: The VIV [MSIV] f the affected SG is manually clsed by the peratr at the end f the PC. The VIV [MSIV] wuld autmatically clse fllwing a "SG Level MAX2 + PC finished" signal. MHSI: The safety injectin signal is actuated fllwing a "pressuriser pressure < MIN3" signal at a setpint f bar. When the RCP [RCS] pressure drps belw 97 bar, the MHSI injects with a maximum flw rate t maximise the pressure difference between the RCP [RCS] and the affected SG. ASG [EFWS]: ASG [EFWS] is manually actuated immediately an emergency pwer mde ccurs. The ASG [EFWS] cntrl is nt cnsidered, which leads t maximum emergency feedwater injectin and an autmatic islatin f the system fllwing a SG liquid level abve MAX1 signal. MSSV: T cnfirm the MSSV is nt demanded during the transient, the MSSV setpint is assumed at its minimum f bar Results Case Frm the initiating event t the cntrlled state The sequence f events fr Case 1 is given in Sectin Table 4 4. The transient prgress is shwn graphically in Sectin Figure 1 t Sectin Figure 11. The results are discussed belw. 4 Case 1 is a new calculatin perfrmed in the frame f the GDA. All related data given (sequence f events, figures, ) cme frm new analysis results.

83 PAGE : 76 / 173 The break is pened at the start f the transient with an initial flw f abut 28 kg/s. Pressuriser pressure decreases slwly and pressuriser level decreases steadily until the letdwn flw is islated n lw pressuriser level at 1095 secnds. After letdwn is islated, the pressuriser level decreases at a slwer rate. The primary circuit pressure cntinues t slwly decrease, which decreases the leakage flw rate and increases the RCV [CVCS] charging flw. This maintains the primary circuit pressure abve the reactr trip setpint and the system appraches a new steady state cnditin at a lwer pressure as the RCV [CVCS] charging flw increases t match the leakage flw. At 50 minutes after the break is pened, the reactr is tripped manually. In additin t the reactr trip, the peratr perfrms the fllwing actins: Stps MFW flw t all SGs Disables EFW flw t the affected SG Starts EFW flw t the intact SGs Rd insertin begins 0.4 secnds after RT and the turbine is islated 2.5 secnds after RT. Fllwing the turbine trip, the secndary pressure increases. It is assumed that the VDA [MSRT] pens in the affected SG (at 94 bar). The MSRCV and MSRIV pen. The MSRCV n the affected SG is assumed t have failed in the fully pen psitin. This results in a rapid depressurisatin f the affected SG. The depressurisatin f the SG results in a cldwn f the primary circuit and a drp in primary circuit pressure. The lw pressuriser pressure setpint is reached abut 50 secnds after the VDA [MSRT] in the affected SG pens and the lw-lw pressuriser pressure setpint is reached abut 45 secnds after that. The pressure in the intact SGs als decreases. The decrease in primary circuit pressure results in an increase in RCV [CVCS] charging flw and a decrease in break flw. After the reactr trip, the charging flw exceeds the break flw. The lw-lw pressuriser pressure signal activates the safety injectin system and initiates an autmatic partial cldwn at -250 C/hr. The partial cldwn signal is ineffective because the failed-pen MSRCV in the affected SG results in a cldwn slightly in excess f -250 C/hr. The depressurisatin cntinues until the pressure in the SGs reaches the MIN1 setpint at 3595 secnds. The end f partial cldwn is detected after the VIV [MSIV] islatin n SG pressure < MIN1, nce the partial cldwn setpint finally reaches 61.5 bar (at 3666 secnds). Pressure cntinues t decrease in the affected SG. Finally, the MSRIV n the affected SG is shut, islating the affected SG. Because f the RCV [CVCS] charging flw, the level as well as the pressure in the affected SG increases. The affected VDA [MSRT] pens again (at 8382 secnds), despite the setpint increase. The MSRCV being still stuck pen, the pressure decreases in the affected SGs. The MSRT is finally clsed n the MIN3 setpint (at 8818 secnds). At 8418 secnds, the level in the affected SG reaches the MAX2 setpint. An autmatic signal is generated t stp the RCV [CVCS] charging flw n Partial Cldwn Cmplete and SG Level > MAX2 and the RCV [CVCS] charging flw is islated after a 41.5 secnd delay. After the RCV [CVCS] charging is islated, the primary circuit pressure begins t decrease. At secnds, the differential pressure acrss the break is calculated t be less than ne bar and the leak is cnsidered t be halted. The transient is terminated 500 secnds later.

84 PAGE : 77 / 173 During this transient, where few peratr actins are mdelled, 218 tns f steam flws thrugh the VDA [MSRT] f the affected SG (steam cming frm the 4 SGs). Abut 450 kg f liquid is discharged frm the VDA [MSRT] f the affected SG in the frm f entrained misture. The minimum liquid mass cntained in the affected SG is 26 tns Frm the cntrlled state and safe shutdwn state The emergency perating prcedures will be fllwed by the peratr immediately fllwing the manual reactr trip s as t reach the safe shutdwn state. The safe shutdwn state is defined as a state where the affected SG is islated and at least ne RIS/RRA [SIS/RHRS] train is cnnected t the RCP [RCS]. One ut f fur LHSI trains in RHR mde is sufficient t prvide the required heat remval. The cnnectin cnditins are: RCP [RCS] ht leg pressure < 32 bar and, RCP [RCS] ht leg temperature < 180 C and, ΔTsat 5 and Reactr Pressure Vessel Level (RPVL) cnsistent with LHSI in RHR mde suctin cnditins frm the ht leg. The sequence f actins t be perfrmed by the peratr t reach the safe shutdwn can be divided int tw successive phases: bratin and RCP [RCS] cldwn, and final depressurisatin. While perfrming these peratins, the peratr is required t mnitr key safety functins (e.g. saturatin margin) and sme plant parameters, (e.g. pressuriser level). Bratin and RCP [RCS] Cldwn The bratin and RCP [RCS] cldwn actins are perfrmed by the peratr after reactr trip. The RBS [EBS] delivers a cnstant bratin flw rate t the RCP [RCS], prviding the negative reactivity required t reach the safe shutdwn state. The allwed cldwn rate depends n the number f available RBS [EBS] trains: 25 C/h with ne RBS [EBS] train in peratin, 50 C/h with tw RBS [EBS] trains in peratin. The RCP [RCS] cldwn is perfrmed using the unaffected steam generatrs. This cldwn ccurs with the MHSI perating t prevent perturbing the pressure balance between primary side and the affected SG. Final Depressurisatin At the end f the RCP [RCS] cldwn phase, the RCP [RCS] pressure is higher than the LHSI in RHR mde maximum cnnecting pressure f 32 bar. If the affected SG level is t high, the peratr first pens the transfer line between SGa and its partner SG t limit risks f water hammer in the SGa steam line. This als prevents verfilling f the affected SG and large activity release t the atmsphere. Once the level in the affected SG falls belw MAX2 (NR), the affected SG VDA [MSRT] is pened. This allws the depressurisatin t 32 bar. 5 Tsat = Tsat (ht leg pressure) - Tc, with Tc = cre utlet temperature

85 PAGE : 78 / 173 Safety Functin mnitring During the peratins perfrmed t reach the safe shutdwn, the peratr is still required t mnitr sme key plant parameter such as saturatin margin and pressuriser level. The peratr culd then be requested t perate the pressuriser nrmal spray, shut the MHSI neby-ne, etc. in rder t reach the RHR cnnectin cnditins These peratins are aimed at aviding pening f the secnd VDA [MSRT] Case 2 Case 2 is nt recalculated in the PCSR. The capacity t reach the cntrlled state and t terminate the SGTR leak while meeting the relevant criteria is derived frm the results f the Case 2 analysis perfrmed in BDR-99, discussed in Appendix 14B. The criteria cvered are steam relief t the atmsphere such that radiactive releases are significantly belw the regulatry limits, n MSSV demand, and n SG verfilling. This assessment relies n the fact that differences between the EPR 4500 characteristics fr the PCSR and EPR 4900 characteristics f BDR-99 are very similar when cnsidering SGTR mitigatin. There are n differences which culd significantly mdify the cnclusins f the BDR-99 analysis Case 2: EPR 4900 Accident Analysis f BDR-99 (1 SGTR, 2%FP, with LOOP, shrt term phase up t leak cancellatin) The results f the BDR-99 case 2 analysis, perfrmed with the S-RELAP5 cde, are prvided in sectin f Appendix 14B. They are summarised as fllws: The amunt f steam discharged frm the affected SG t the atmsphere is apprximately 35 te. Overfeeding f the affected SG is prevented with a significant margin, by autmatic F1A actins and systems. The RCV [CVCS] charging flw must be cut ff by the peratr after 30 minutes, t prevent SG verfilling. The sequence f events fr Case 2 is given in Sectin Table 5. The EPR 4500 is quite similar t the EPR 4900 regarding SGTR relevant parameters as shwn in Sectin Table 6. EPR 4500 prvides sme imprvement cmpared t EPR 4900 by having autmatic islatin f the RCV [CVCS] charging line fllwing a SG level > MAX2 signal. This is perfrmed manually fr EPR This allws islatin befre the peratr grace perid f 30 minutes has expired and increases the reliability f this cuntermeasure, which is needed in the relatively shrt term. The tw ntable differences between EPR 4500 and EPR 4900 are: the pwer level, 8% less n EPR 4500, reduces the steam release. The pwer level difference has n significant impact n the verfilling preventin as the majr mitigatin cuntermeasures are based n SG level setpints. This mainly results in different timings fr the prgressin f the transient.

86 PAGE : 79 / 173 The MHSI injectin has a delivery pressure 5 bar higher fr the EPR 4500 cmpared t 6 EPR As SG pressure at the end f partial cldwn is unchanged, the time delay t terminate the SGTR leak is slightly lnger in EPR 4500 when cmpared t EPR This slightly increases the SG level increase in the affected SG at the time the SGTR flw is terminated. It can be cncluded, withut the need fr a dedicated calculatin, that the cntrlled state and the decupling criteria assciated with the shrt term phase f the SGTR transient are achieved in EPR This is based upn the results f the Case 2 analysis in BDR-99 and n the similar characteristics f EPR 4500 and EPR 4900 fr SGTR-relevant parameters, A further increase f the initial pressuriser level wuld have n significant impact as far as the release t the atmsphere is cncerned. The partial cldwn starts very sn after the initiating event and the variatin f the initial pressuriser level has very little impact n the depressurisatin and cling phenmena LONG TERM STUDY Case 3 With LOOP Chice f Single Failure and Preventive Maintenance The single failure chsen reduces the capacity f the F1 systems t cl the RCP [RCS] and SG t the LHSI in RHR mde cnnectin cnditins. This failure can be either n: ne RBS [EBS] pump t slw the bratin, ne VDA [MSRT] t slw the cldwn and SG depressurisatin, ne ASG [EFWS] pump t slw the cldwn, There is n preventive maintenance case that wuld further reduce the cldwn, bratin, r increase the activity release fr the transient Cnditins at the beginning f the lng term phase The lng term phase starts at the end f the shrt term phase presented in Case 2. The cnditins at the beginning f lng term phase crrespnd t a maximum level in the affected SG and maximum activity transferred thrugh the leak Specific Assumptins The assumptins fr the systems described in Case 2 remain valid. The additinal assumptins and characteristics fr the lng term phase are the fllwing: MHSI: This is maintained until the end f RCP [RCS] cldwn phase, when RCP [RCS] temperatures in unaffected lps are less than 180 C. At this pint it is shut dwn by the peratr t allw the depressurisatin f the RCP [RCS] and the affected SG r inventry reductin f SGa via the blwdwn system. 6 Cmparisn perfrmed n the basis f the plant characteristics given in Appendix 14B.0.2 Table 13 EPR 4900MW and plant characteristics given in Sub chapter 14.1 Table 13.

87 PAGE : 80 / 173 Accumulatrs: These are manually islated when the MHSI is shut dwn. N accumulatr injectin ccurs during the transient. LHSI: Injects t the RCP [RCS] when the RCP [RCS] pressure reaches 20 bar. RBS [EBS]: At the start f the plant cldwn, at 2500 secnds, ne f tw extra bratin system pumps is started by the peratr t prvide bratin. The pump is stpped if the cldwn is finished r if a cnnectin frm the affected SG t the partner SG via the transfer line is pened t reduce the inventry in SGa. The minimum capacity f the RBS [EBS] tank is sufficient t brate the RCP [RCS] inventry frm a 10 ppm initial cncentratin t the 680 ppm required fr LHSI in RHR mde cnditins under EOC UO 2 assumptins. The cncentratins quted abve are fr natural brn. VDA [MSRT]: Fr the RCP [RCS] cldwn phase, the VDA [MSRT] setpint n the unaffected SGs is reduced t prvide a 25 C/hr cldwn gradient. This is required if nly ne RBS [EBS] pump is available. With the VDA [MSRT] capacity f 50% f nminal flw rate at 100 bar, this gradient can be maintained t a secndary pressure f abut 3.5 bar. Subsequently, the VDA [MSRT] are fully pen and the cldwn gradient decreases. The VDA [MSRT] n the affected SG is pened by 20% t depressurise the RCP [RCS] and the affected SG at the end f the cldwn phase. This is perfrmed nce the inventry f the affected SG has been reduced using the transfer line. ASG [EFWS]: In the lng term phase, the ASG [EFWS] n the unaffected SGs is assumed t be cntrlled t the nminal wide range level measurement. T prepare the affected SG level reductin, the liquid level f SG4 is lwered t abut 22% NR by the peratr. Transfer line: A transfer line cnnectin frm the affected SG t the partner SG is pened manually by the peratr t lwer the liquid level in the affected SG, befre the final depressurisatin is perfrmed. This transfer line is the F1 part f the SG blwdwn system Results The sequence f events fr Case 3 is given in Sectin Table 5. Case 3 is nt recalculated in the PCSR. The capability t reach the Safe Shutdwn State and t meet the relevant criteria is derived frm the results f the Case 3 analysis perfrmed in BDR-99 and presented in Appendix 14B. The criteria cnsidered are the steam relief t the atmsphere t keep radiactive releases significantly belw the regulatry limits, n MSSV demand, and n SG verfilling. This assessment relies n the similar characteristics f the EPR 4500 and EPR 4900 relevant t the SGTR mitigatin. There are n differences which culd significantly mdify the cnclusins f the BDR-99 analysis. The fllwing assessment refers t the lng term phase with the shrt term phase having been addressed in sub-sectin f this sub-chapter Case 3: EPR 4900 Accident Analysis f BDR-99 (1 SGTR, 2%FP, with LOOP, lng term phase up t LHSI in RHR mde cnnectin) The results f the Case 3 analysis fr BDR-99, perfrmed with the S-RELAP5 cde are presented in sectin f Appendix 14B. They are summarised belw:

88 PAGE : 81 / 173 RCS Bratin: The brn cncentratin in the primary clant required fr subcriticality at safe shutdwn state cnditins is reached at apprximately 80 minutes, abut 40 minutes after the start f RBS [EBS]. Radiactive Releases: Befre depressurisatin f the RCP [RCS] and the affected SG at the end f the plant cldwn and bratin phase, the liquid level in the affected SG is lwered by pening the transfer line t the partner SG. Thus n liquid is discharged t the atmsphere during the depressurisatin f the affected SG via the VDA [MSRT]. When the depressurisatin is stpped at an SG pressure f 20 bar, sufficient fr LHSI in RHR mde peratin, nly apprximately 42 te f cntaminated steam have been discharged during this phase thrugh the VDA [MSRT] f the affected SG. If the affected SG is depressurised t apprximately 6 bar, 57 te f cntaminated steam are discharged. Preventin f SG Overfilling: Abut 20 minutes after SGTR initiatin, the narrw range level measurement f the affected SG reaches the MAX2 limit and partial cldwn is actuated. During the partial cldwn, the liquid inventry f the SG decreases. Once the partial cldwn is cmpleted and the peratr initiates islatin f the affected SG after a 30 minute grace perid the level is 17.5 m. With steam-side islatin f the SG and VDA [MSRT] setpint increase t 98 bar, the SG pressure increases slwly until pressure equilibrium with the primary side is reached. This equalisatin is caused by the cntinued SGTR leakage. In this phase, the affected SG is filled t 20.8 m, with the tp f the SG at 21.2 m. Subsequently, small cndensatin effects in the SG lead t a further liquid level increase, reducing the steam vlume t 5 m 3 at 5.6 hurs when the cldwn and bratin phase is finished. Preventin f SGTR Backflw int RCP [RCS]: Prir t 5.6 hurs, the risk f backflw is prevented by MHSI peratin. At 5.6 hurs, the peratr pens a transfer line cnnectin t an unaffected SG t reduce the liquid cntent f the affected SG. Within 2.8 hurs, the liquid mass f the affected SG is lwered frm 180 t abut 140 te via the transfer line. This reduces the cllapsed liquid level t abut 17.5 m. At this pint, the final depressurisatin f the affected SG and the RCP [RCS] is perfrmed using the VDA [MSRT] f the affected lp, withut SG verfilling and withut SGTR backflw. MSSV Setpint: the MSSV are nt demanded during the transient Case 3: Extraplatin f BDR-99 Results t EPR 4500 The results f Case 3 in BDR-99 fr EPR 4900 demnstrate that the F1A systems and functins are sufficient t reach the Safe Shutdwn State withut SG verfilling, withut SGTR backflw and withut an MSSV demand. RBS [EBS] perfrms the required F1 bratin, ASG [EFWS] and VDA [MSRT] perfrm the required F1 heat remval and RCP [RCS] cldwn t LHSI in RHR mde cnnecting cnditins VDA [MSRT] and SG blwdwn perfrm the required F1 depressurisatin f the RCP [RCS] and the affected SG dwn t LHSI in RHR mde cnnecting cnditins. Sectin Table 6 shws that, cmpared t EPR 4900 characteristics, EPR 4500 characteristics are similar fr RCP [RCS] bratin, RCP [RCS] cldwn, RCP [RCS]/SG depressurisatin, and beneficial fr heat remval.

89 PAGE : 82 / 173 The nly ptentially detrimental effects in EPR 4500 cmpared t EPR 4900 fr the lng term phase f transfer t LHSI in RHR mde are: The slightly lnger duratin f the transfer phase, due t a higher SG pressure at the initial ht shutdwn cnditins IMPACT OF THE MODIFICATION TO THE PARTIAL COOLDOWN RATE AND SAFETY CLASSIFICATION UPGRADE OF THE NORMAL SPRAY OPERATIONS Cnsequences f the mdificatin f the partial cldwn rate (Case 2 and Case 3) In sme f the current PCSR studies (Case 2 and Case 3), the cldwn rate f the partial cldwn is 100 C/h. In rder t increase margins t safety criteria in LOCA studies, this rate is increased t 250 C/h while keeping the same ther characteristics. It is perfrmed using the fur SG, dwn t 60 bar n the secndary side. Due t this rate increase, the related SG pressure drp signal setpint is als increased frm 2 bar/min t 5 bar/min. In the frame f SGTR studies, the impact f the cldwn rate is nt significant. The amunt f energy remved frm the RCP [RCS] remains the same whatever the RCP [RCS] cldwn rate. The nly impact n the analysis is n the timescale fr specific events. The mdificatin f the SG pressure drp signal will impact nly the case with the single failure n the cntrl valve f the SGa VDA [MSRT]. This mdificatin will lead t a later islatin f SGa withut mdifying the amunt f radiactive prducts released t the atmsphere. Whatever the SG pressure drp signal, the islatin pressure f the VDA [MSRT] remains at 40 bar and SGa has t depressurise t this islatin pressure. Only the timescale will be significantly different. Impact f the safety classificatin change f the nrmal spray peratins In the current PCSR studies, the nrmal spray peratins are nt F1B classified. Cnsequently, it was nt cnsidered in the recvery rute t reach the safe shutdwn state. The classificatin f the nrmal spray peratins as F1B allws the peratr t use a classified means t depressurise the RCP [RCS] in parallel with SGa, independent f the PSV. In the frame f the SGTR studies, the depressurisatin f the RCP [RCS] relies n the cnnectin between the primary side and the SGa. Nne f the depressurisatin means f the pressuriser are cnsidered CONCLUSION The present analysis f the single tube 2A-SGTR accident shws that despite the wrst single failure and preventive maintenance: the cntrlled state can be reached using nly the fllwing systems: Manual RT 50 minutes after activity detectin, ASG [EFWS] and VDA [MSRT], including partial cldwn, fr RCP [RCS] heat remval,

90 PAGE : 83 / 173 RCV [CVCS] charging fr RCP [RCS] clant inventry cntrl. the safe shutdwn state is reached using nly F1A and F1B systems: VIV [MSIV] clsure, ARE/AAD/ASG [MFWS/SSS/EFWS] islatin, VDA [MSRT] setpint increase fr affected-sg islatin, MHSI and LHSI fr RCP [RCS] clant inventry cntrl, ASG [EFWS] and VDA [MSRT] fr RCP [RCS] cling, RBS [EBS] fr bratin, SG transfer line cnnectin fr RCP [RCS] and affected SG depressurisatin, LHSI in RHR mde fr lng term heat remval. The ttal amunt f cntaminated fluid released t the atmsphere frm the affected SG, assuming the wrst single failure and preventive maintenance, is: At full pwer, with reactr clant pumps n, and n LOOP: 218 tns f steam released directly t the atmsphere frm the affected VDA [MSRT], and n verfilling r dry ut takes place during the transient. N liquid is released t the atmsphere (except in the frm f entrained vapur misture). Thus, fr the mass releases, nly the entrained misture in the vapur need be taken int accunt. NB: The radiactive steam releases thrugh the affected VDA [MSRT] are limited especially as due t the VIV [MSIV] being clsed fllwing the partial cldwn, the steam released cmes frm all fur SGs. The affected SG pressure has been kept belw r equal t the RCP [RCS] pressure during the transient. Thus, any SGTR reverse flw is negligible and there is n criticality issue. The cre remains cvered thrughut the transient, s the cre cling is never impaired and n clad heat-up is experienced. Therefre, all the decupling criteria and targets are met SYSTEM SIZING The maximum MHSI pump delivery pressure is sized fr the SGTR transient t allw leak terminatin with n verfilling f the affected SG.

91 PAGE : 84 / 173 SECTION TABLE 1 Initial Cnditins fr SGTR Accident Case 1 Parameter Value Initial reactr pwer 4590 MW Initial average RCP [RCS] temperature = C Initial reactr clant pressure = bar Reactr clant flw rate m 3 /hr/lp Bypass flw rate Ttal Dme 5.53% 0.51% Guide Tubes 3.01% Reflectr 2.01% Pressuriser level 56% + 5% = 61% Initial unaffected SG level 49% % = 59.5% NR Main feedwater flw rate 649 Kg/s SG Pressure (Exit) 71.9 bar SG Saturatin Pressure 72.1 bar SG Pressure (MFW) 72.2 bar Initial ARE [MFW] Enthalpy KJ/kg Initial ARE [MFW] Temperature 230 C Steam line pressure (VDA [MSRT] cnnectin) 71.3 bar Steam header pressure 69.0 bar RCV [CVCS] Injectin temp. (letdwn n) 270 C RCV [CVCS] Injectin temp. (letdwn ff) 50 C

92 PAGE : 85 / 173 SECTION TABLE 2 Plant Initial Cnditins EPR 4900 Case 2 Parameters Limiting values used Reactr clant system Initial reactr pwer (% f nminal pwer) 2 Reactr thermal pwer (MW) 85 Reactr clant pump thermal pwer (MW) app. 30 Initial average RCP [RCS] temperature ( C) = Initial reactr clant pressure (bar) = Reactr clant flw (kg/s) app (thermal hydraulic) Pressuriser water vlume (m3/%mr) 24.9 / 34 (nminal + 5% MR) Steam generatrs Initial steam pressure (bar) Initial SG level (m) cde calculatin (nminal + 5% NR) Feedwater Main feedwater flw (% f nminal flw) 2 Initial ARE [MFWS] temperature ( C) 123

93 PAGE : 86 / 173 SECTION TABLE 3 Setpints fr Case 1 Included Setpint Functin bias Intact VDA [MSRT]s 97 bar +1.5 Affected VDA [MSRT] 94 bar -1.5 PSV bar PSV bar PSV 2, bar MSSVs bar -1.5 Lw pressuriser pressure (MIN2) bar -1.5 Lw-lw pressuriser pressure (MIN3) bar +1.5 Lw pressuriser level (MIN3) 12 % High SG level (MAX1) 71% NR +2 High SG level (MAX2) 87% NR +2 High SG level (MAX1) 91% WR +2 High SG pressure dp/dt -5 bar/min -7 bar Lw SG level (MIN2) 38% WR -2 Lw SG pressure (MIN1) 51.5 bar Lw SG pressure (MIN3) 38.5 bar Lw P SAT 10 bar

94 PAGE : 87 / 173 SECTION TABLE 4 Sequence f Events fr Case 1 Event Time (s) 2A SGTR ccurs at bttm f tube bundle cld side 0 Pressuriser level < MIN Pressuriser heaters ff 1055 Islate letdwn 1095 Reactr trip signal (manual) Turbine trip signal 3000 High lad ARE [MFWS] stpped t all SGs Operatr islates the affected SG 3000 Operatr actins: Lw lad ARE [MFWS] stpped t all SGs ASG [EFWS] 3 disabled in affected SG3 ASG [EFWS] 1, 2 & 4 flw starts 3000 Rd insertin begins Turbine islated EFW 1, 2 & 4 flw starts VDA [MSRT] pening n high SG pressure (in affected SG3) at 94 bar, MSRCV failed pen 3038 Lw pressuriser pressure (133.5 bar) 3091 Lw-lw pressuriser pressure (116.5 bar) SI Signal 3135 Start partial cldwn MHSI/LHSI pumps started 3151 SG3 pressure < MIN VIV [MSIV] 1, 2, 3 & 4 shut 3601 Partial cldwn cmplete in unaffected SG 3667 SG3 Pressure < MIN SG3 MSRIV shut 3838 MSRT pening n high SG pressure (in affected SG3) at 99 bar, 8384 MSRCV failed pen Partial cldwn cmplete and SG3 level > MAX Stp RCV [CVCS] charging flw 8460 SG3 pressure < MIN SG3 MSRIV shut 8824 Leak cancelled Transient terminated 14745

95 PAGE : 88 / 173 SECTION TABLE 5 Sequence f Events EPR 4900 Cases 2 and 3 - cntinued n next page -

96 PAGE : 89 / 173

97 PAGE : 90 / 173 SECTION TABLE 6 Cmparisn f EPR 4900 t EPR 4500 SGTR- Relevant Parameters Parameter EPR 4900 EPR 4500 Impact Assessment Main Gemetrical Data SG free vlume 247 m 3 3 Less than 5% 238 m difference heat transfer 8171 m 2 2 N significant impact 7960 m area n SG verfilling. ASG [EFWS] RBS [EBS] ttal effective liquid vlume ttal tank vlume, minimum Plant Initial Cnditins Cre Pwer Pressuriser level SG liquid mass Prtectin System SG level Pressuriser Pressure 1500 m 3 3 Higher heat remval 1680 m capacity. Increased capacity f brn injectin. In the 54 m 3 72 m 3 studies a value f 54 m 3 is credited cnservatively. 2% FP 98 MW 90 MW Abut 8% less pwer in EPR 4500 cmpared t EPR % FP 28%R, 21 m 3 3 N significant impact 31%R, 23 m n SG verfilling. Mre margin with 0% FP t 87.6 t respect t SG verfilling. MAX2 MAX1 NOM 18.1 m, 84%NR 17.2 m, 71%NR, 89%WR 16.2 m, 56%NR 18.0 m, 85%NR 17.0 m, 69%NR, 89%WR 15.7 m, 49%NR MSSV bar bar VDA [MSRT] 93.0 bar 95.5 bar nminal at 100% FP 74.6 bar 78.0 bar MIN2 135 bar 135 bar MIN3 115 bar 115 bar Prvides similar perfrmance f SGTR mitigatin with respect t cuntermeasures invlving SG level. Abslute values increased by abut 2.5 bar, which is beneficial fr limitatin f SG verfilling.

98 PAGE : 91 / 173 SECTION FIGURE 1 Case 1 - Primary and Secndary Pressures Upper Plenum Level

99 PAGE : 92 / 173 SECTION FIGURE 2 Case 1 - Steam Generatr Levels

100 PAGE : 93 / 173 SECTION FIGURE 3 Case 1 - Pressuriser Level

101 PAGE : 94 / 173 SECTION FIGURE 4 Case 1 - VDA [MSRT] Liquid and Steam Flw

102 PAGE : 95 / 173 SECTION FIGURE 5 Case 1 - Main and Emergency Feedwater Flws

103 PAGE : 96 / 173 SECTION FIGURE 6 Case 1 - RCV [CVCS] and MHSI Flws

104 PAGE : 97 / 173 SECTION FIGURE 7 Case 1 - Steam Flws RCV [CVCS] and Leakage Flws

105 PAGE : 98 / 173 SECTION FIGURE 8 Case 1 - Break Differential Pressure Lp Temperatures

106 PAGE : 99 / 173 SECTION FIGURE 9 Case 1 - Liquid Mass and Free Vlume in Affected SG

107 PAGE : 100 / 173 SECTION FIGURE 10 Case 1 - Cre and SG Riser Vid Fractin Pressuriser Heater Pwer

108 PAGE : 101 / 173 SECTION FIGURE 11 Case 1 - Ttal Injectin Flw and Leak Flw SG Heat Transfer

109 PAGE : 102 / 173 SECTION FIGURE 12 EPR 4900 Cases 2 and 3 RCP [RCS] Pressure/ Ht and Cld Leg Temperatures

110 PAGE : 103 / 173 SECTION FIGURE 13 EPR 4900 Cases 2 and 3 - Mass Flw

111 PAGE : 104 / 173 SECTION FIGURE 14 EPR 4900 Cases 2 and 3 SG Levels

112 PAGE : 105 / 173 SECTION FIGURE 15 EPR 4900 Cases 2 and 3 Brn Cncentratin

113 PAGE : 106 / INADVERTENT CLOSURE OF ONE OR ALL MAIN STEAM ISOLATION VALVES (PCC-3) 7.1. INTRODUCTION The inadvertent clsure f all VIV [MSIV] results in the islatin f all fur main steam lines. This event is evaluated fr verpressure, and is likely t be the limiting verpressure event. A reactr trip wuld ccur as a result f the high primary r secndary pressures, which are limited by the pressuriser and steam generatr relief systems respectively. The inadvertent clsure f all VIV [MSIV] is classified as a PCC-3 event INADVERTENT CLOSURE OF ALL VIV [MSIV] (STATE A, PCC-3) Identificatin f causes and accident descriptin General Cncern The inadvertent clsure f all f the VIV [MSIV] is an verheating event that leads t a risk f fuel failure due t a departure frm nucleate biling (DNB). Identificatin f causes The inadvertent clsure f all VIV [MSIV] event is typically caused by a spurius I&C cmmand t clse the fur VIV [MSIV]. Precautins limiting the likelihd f the accident The 4 steam pilts f each VIV [MSIV] are assigned t separate electrical divisins. Therefre the prbability f spurius clsure f the 4 VIV [MSIV] due t electrical supply faults causing the spurius pening f 2 steam pilts in series in each VIV [MSIV] is very lw Typical sequence f events Frm the initiating event t the cntrlled state The clsure f all VIV [MSIV] results in the terminatin f all main steam flws. The reduced heat remval results in a secndary pressure and temperature increase, causing the primary pressure and temperature t increase. Reactr Trip and Turbine Trip are autmatically initiated, and the primary and secndary pressures are autmatically limited by the pressuriser and SG relief devices. Subsequently, the cntrlled state is reached. In this case it is defined as a ht shutdwn state with residual heat being remved by the VDA [MSRT] and ASG [EFWS]. The ARE/AAD [MFWS/SSS] is nt claimed as it is nt a F1 classified system.

114 PAGE : 107 / 173 Frm the cntrlled state t the safe shutdwn state The safe shutdwn state is reached when the LHSI/RHR can be cnnected. The fllwing sequence f actins shuld be perfrmed by the peratr t take the plant t the LHSI/RHR perating cnditins: RCP [RCS] bratin During the RCP [RCS] cldwn, the RCP [RCS] bratin is perfrmed by the RBS [EBS]. The RCV [CVCS] is nt claimed as it is nt a F1 classified system. Fllwing cmpletin f the bratin, the peratr stps the RBS [EBS]. RCP [RCS] cldwn: The RCP [RCS] cldwn t LHSI/RHR cnnectin cnditins is carried ut using the secndary side. It is undertaken by reducing the VDA [MSRT] setpints at the required rate. The GCT [MSB] is unavailable as the VIV [MSIV] are clsed by the initiating event. The rate f RCP [RCS] cling is defined t be cnsistent with the capacity f the ASG [EFWS] tanks. Therefre, the LHSI/RHR perating cnditins are reached befre the ASG [EFWS] tanks empty. The EPR cling rate is 50 C/h if tw RBS [EBS] trains are available, r 25 C/h if nly ne RBS [EBS] train is available. The RBS [EBS] is designed s that the RBS [EBS] bratin cmpensates fr the reactivity insertin resulting frm the RCP [RCS] cling. The ASG [EFWS] tanks capacity is sufficient t keep the reactr clant pumps in peratin during the RCP [RCS] cling phase if the shutdwn f tw f the fur reactr clant pumps has t be perfrmed by the peratr. RCP [RCS] depressurisatin: After RCP [RCS] cldwn t 180 C in the ht legs, the peratr will briefly pen the PSV t depressurise the RCP [RCS] if the RCP [RCS] pressure is greater than the LHSI/RHR cnnectin pressure f 30 bar. Nrmal pressuriser spray, r auxiliary pressuriser spray frm the RCV [CVCS], are nt claimed as they are nt F1 classified systems. During the depressurisatin phase, the LHSI maintains a minimum RCP [RCS] pressure f abut 20 bar s that the RCP [RCS] keeps a certain sub-cling margin. The LHSI/RHR cnnectin cnditins are met. One LHSI/RHR train is sufficient t remve the decay heat Safety Criteria The safety criteria are the radilgical limits fr PCC-3/PCC-4 events. The cnsequences f the inadvertent clsure f all VIV [MSIV] are analysed t assess the fllwing acceptance criterin: The number f fuel rds experiencing DNB must remain belw 10%.

115 PAGE : 108 / Definitin f Studied Cases Fuel clad integrity The analysis is perfrmed t demnstrate that the fuel clad integrity is maintained. The analysis therefre shws that the minimum DNBR remains abve the DNBR criterin f 1.00 identified in Sub-chapter Radilgical cnsequences The safety criteria t be met are the dse equivalent limits in case f release t the atmsphere, as addressed in Sub-chapter 3.1: General safety design bases. The bunding transient fr radilgical releases is the PCC-2 lss f cndenser vacuum analysed in sectin 5 f Sub-chapter The quantity f steam release t the atmsphere is identical in bth cases Methds and Assumptins Methd f Analysis The analysis f this accident is perfrmed using the THEMIS cde described in Appendix 14A. The DNBR calculatin is perfrmed with the FLICA cde described in Appendix 14A. Fr the system transient analysed with the THEMIS cde, the methd f analysis is based n the fllwing apprach: Identificatin f the dminant phenmena Verificatin f the adequacy f the cde t simulate these phenmena Applicatin f cnservative PCC analysis rules. The dminant phenmena f this transient are: SG verpressure and heating, resulting frm the lss f steam flw RCP [RCS] verpressure and heating, resulting frm the SG heat remval changes Cre pwer changes, resulting frm neutrnic feedbacks fllwing changes in RCP [RCS] thermal-hydraulic cnditins. All these phenmena are within the capability f the THEMIS cde. The neutrnic calculatins in this cde rely n a pint-kinetics mdel which accunts fr all relevant aspects. The mdel includes feedbacks due t changes in mderatr density, nuclear pwer, brn cncentratin, and rds psitin. The thermal-hydraulic qualificatin f this cde is based n:

116 PAGE : 109 / 173 The use f recgnised and tested crrelatins, fr example: Fluid-t-wall heat-transfer crrelatins cvering nrmal and abnrmal perating cnditins. These include Dittus-Belter fr frced cnvectin at the primary side f the SG tubes, and Jens-Lttes fr nucleate biling at the secndary side f the SG tubes Drift flux crrelatins, Zuber-Wallis, EPRI, and Patricia GV2 in the axial SG mdel Tw-phase pressure drp crrelatin, Martinelli-Nelsn in the axial SG mdel. The validatin f specific mdels by test results frm small-scale simulatins, fr example: Axial SG mdel withut an ecnmiser frm the MB2 mck-up tests Axial SG mdel with an ecnmiser f the N4 SG-type frm the MEGEVE mck-up tests. The axial SG mdel refers t the mdelling f the SG secndary side. The axial SG mdel is particularly well adapted t the calculatin f plant transients experiencing secndary side verpressure resulting frm lss f steam flw such as VIV [MSIV] clsure. This is because the mdel has the capability t cmpute the internal recirculatin flw, and t mdel the different regins f the SG, sub-cled, tw-phase, saturated, and superheated cnditins, and their develpment during the transients. The verall verificatin f the cde by simulatin f PWR plants transients, fr example: The THEMIS pressuriser mdel was validated by cmparisn with RCP [RCS] verpressure transients perfrmed at the CRUAS 3-lps plant with heaters and start-up at varius pwer and pressuriser levels, The SG axial mdel was validated in stable perating cnditins by cmparisn with steady-state peratin tests at different pwer levels, carried ut at the BUGEY 3-lps and PALUEL 4-lps plants Lad rejectin and reactr trip at the PALUEL 4-lps plant were accurately simulated with THEMIS using the axial SG mdel. The calculated lp temperatures cmpared well with the measured values, thus validating the verall SG/RCP [RCS] heat transfer and the entire RCP [RCS] hydraulic calculatins. The SG secndary side verpressure transient calculated by THEMIS clsely agreed with the measured values. The results demnstrated the applicability f the SG axial mdel fr these transient perating cnditins. The transient analysis relies n the applicatin f the cnservative PCC analysis rules described in Sub-chapter Part f these rules is the deterministic applicatin f cnservatisms t all relevant bundary cnditins, fr the acceptance criteria being cnsidered. These cnservatisms address as a minimum: The characterisatin f the initiating event t maximise the resultant impact

117 PAGE : 110 / 173 Cntrl dead band limits and maximum measurement uncertainties at the initial plant cnditins Maximum uncertainty n each I&C measurement and signal delay, and n each system respnse time and capacity fr prtectin and mitigatin actins Cnservative mderatr and fuel Dppler cefficients fr neutrnic feedbacks This methdlgy prvides a cnservative result which can be directly used t assess the acceptance criteria Prtectin and Mitigatin Actins The fllwing F1A I&C functins prvide prtectin fllwing an inadvertent clsure f all VIV [MSIV], fr assessment against the DNBR criterin. The analyses fr the ther safety criteria, are discussed abve. Reactr trip and turbine trip fllwing a SG pressure > MAX1 signal Reactr trip and turbine trip fllwing a pressuriser pressure > MAX2 signal Reactr trip and turbine trip fllwing a lw DNBR signal. Hwever, this parameter is nt claimed in the accident analysis presented. The F1A I&C functins required t reach the cntrlled state are thse related t decay heat remval via the SG, the ASG [EFWS] and VDA [MSRT], as described in sectin 5 f Subchapter 14.3: Lss f Cndenser Vacuum. The F1B devices, required t transfer the plant frm the cntrlled state t the safe shutdwn state, are described in sectin 5 f Sub-chapter 14.3: Lss f Cndenser Vacuum Descriptin f Studied Cases (frm the Event Initiatin t the Cntrlled State) Chice f Single Failure and Preventive Maintenance The minimum DNBR is reached at the start f rd drp. Therefre: The single failure assumed is a stuck rd; There is n preventive maintenance cnsidered fr this event, due t the shrt duratin f the calculatin phase. The calculatin ends fllwing the successful RT, a few secnds after the initiating event Initial State The cnservative initial cnditins fr the assessment f the minimum DNBR are 100% full pwer with uncertainties included. The relevant parameters are presented in Sectin Table 1.

118 PAGE : 111 / Specific Assumptins Neutrnic data and decay heat The fissin pwer term A is calculated with a pint-kinetic mdel. A maximum mderatr cefficient in abslute value (EOC) is assumed, which results in a pwer increase at the beginning f the transient, due t a mderatr density increase. The minimum Dppler cefficient in abslute value is chsen t maximise this pwer increase. The maximum decay heat curve term B+C with 1.645σ is used, as described in Sub-chapter Assumptins related t nn F1 systems The cntrl I&C functins are nt mdelled, as they either have n impact r they have beneficial effects n the minimum DNBR value. In additin, the pressuriser spray is nt taken int accunt. Bth f these assumptins lead t a higher minimum DNBR value. Assumptins related t F1 systems The reactr trip is the nly F1 system, cnsidered during this phase f the accident, relevant t the minimum DNBR value. Other assumptins The initial DNBR is equal t the minimum value allwed by the lw DNBR LCO functin. A detailed discussin f the limiting value f DNBR is prvided in sectin 8 f Sub-chapter This minimum value results frm the analysis f the shrt-term LOOP event described in sectin 6 f Sub-chapter Results and Cnclusin Minimum DNBR criterin This PCC transient is nt calculated in the PCSR. The assessment f the DNBR criterin is derived frm the PCC transient analysis already perfrmed fr the EPR 4900 in the BDR-99 presented in Appendix 14B, frm the assessment is perfrmed by cmparing the relevant characteristics f the EPR 4500 cvered by the PSAR and the EPR 4900 cvered by the BDR-99 and their impact n the analysis results. The BDR-99 accident analysis presented in sectin 2.4 f Appendix 14B shws that: At the beginning f the transient, the first tw secnds, fllwing the all VIV [MSIV] clsure, the DNBR decreases. This is a cnsequence f the RCP [RCS] pressure increase which causes a mderatr density increase. During this perid the mderatr temperature remains essentially unchanged. This results in a pwer increase, which then causes a decrease in DNBR.

119 PAGE : 112 / 173 Subsequently, the DNBR then stabilises ver apprximately 1 secnd, then increases cntinuusly fr the remainder f the transient. This arises frm a cmbinatin f the sharp RCP [RCS] pressure increase and the cre temperature increase. The minimum DNBR is reached at abut 2 secnds, befre the RT signal "SG pressure > MAX1" which is generated at abut 4 secnds. The minimum DNBR value is 1.13, fr an initial DNBR value f This demnstrates a cmfrtable margin t the DNBR criterin f This result shws that the PCC event inadvertent clsure f fur VIV [MSIV] is less nerus than the limiting PCC-2 shrt term Lss Of Off-site Pwer (LOOP) event. The initial DNBR value f 1.26 is derived frm the LOOP transient. It is sufficient t maintain the DNBR abve 1.00 during the RCP [RCS] flw rate decrease fllwing the lss f the pwer t all reactr clant pumps. A cmparisn f the relevant parameters fr the EPR 4500 cvered by the PCSR and the EPR 4900 cvered by the BDR-99 analysis shws that: The EPR 4500 has an initial DNBR margin similar t that f the EPR 4900 which has an initial minimum DNBR value f The derivatin f this value is discussed in sectin 6 f Sub-chapter The EPR 4500 has similar primary and secndary thermal-hydraulic characteristics t the EPR Hwever, the EPR 4500 has the ptential fr lwer RCP [RCS] verpressure rates than the EPR 4900, due t a lwer pwer/pressuriser steam vlume rati. The pwer is decreased by 8% in the EPR 4500 but the pressuriser steam vlume is unchanged. This is a benefit fr the DNBR. At the start f the transient the DNBR decreases because f the RCP [RCS] pressure increase befre the mderatr temperature has increased. The lwer RCP [RCS] pressure increase causes a lwer DNBR decrease in the perid befre RT. Based n the abve cmparisn: The PCC-3 event inadvertent clsure f fur VIV [MSIV] is nt limiting fr the assessment f the minimum DNBR when cmpared t the PCC-2 LOOP event as the BDR-99 accident analysis prvides a large margin fr the DNBR criteria. The EPR 4500 fulfils the DNBR criterin, DNBR 1, in the event f inadvertent clsure f fur VIV [MSIV] as the results shw n adverse effect fr the EPR 4500 cmpared with the EPR Reaching the cntrlled state The means t reach the cntrlled state at ht shutdwn are the same as thse identified fr the PCC-2 event described and demnstrated in sectin 5 f Sub-chapter 14.3: Lss f Cndenser Vacuum. Reactivity cntrl: the initial pwer level and the shutdwn rds wrth are identical Residual heat remval: the same capabilities are available fr the SG (VDA [MSRT] and ASG [EFWS]) Clant inventry: bth events have n impact n the primary clant inventry.

120 PAGE : 113 / 173 Influence f the pressuriser safety valves new design The inadvertent clsure f ne r all main steam islatin valves has been perfrmed with the SEBIM-type pressuriser safety valves mdelled. The impact f the main PSV parameters change t SEMPELL-type pressuriser safety valves is as fllws: The BDR-99 accident analysis presented in Appendix 14B Table 2, shws that the minimum DNBR in the case f an inadvertent clsure f all VIV [MSIV] ccurs at 2.1 secnds. Appendix 14B Figure 1 shws that the first PSV pens later than the time f minimum DNBR, at 5.8 secnds. The SEMPELL valve pening pressure is higher than the SEBIM pening pressure. Therefre, there is n risk f an earlier pening f a PSV that culd have a detrimental impact n the DNBR. Cnsequently, the change frm SEBIM t SEMPELL pressuriser safety valves has n impact n the DNBR fllwing this fault. Thus, fr the case f an inadvertent clsure f all VIV [MSIV], the PSV are nt challenged Descriptin f Studied Cases (frm the Cntrlled State t the Safe Shutdwn State) The safe shutdwn state is reached nce the LHSI/RHR is peratinal. The transitin frm the cntrlled state t the safe shutdwn state is cvered by the PCC-2 turbine trip event discussed in sectin 5 f Sub-chapter 14.3 if reactr clant pumps remain in peratin. If all reactr clant pumps are unavailable after turbine trip due t a lss f grid, it is cvered by the PCC-3 lng term LOOP event discussed in sectin 2 f this sub-chapter. Impact f the safety classificatin f the nrmal spray peratins The F1B safety classificatin f the nrmal pressuriser spray allws credit t be claimed fr this system in the transfer t LHSI/RHR cnnecting cnditins. The analysis f this mdificatin is given fr the feedwater line break, sectin 3 f Sub-chapter 14.5 fr ASG [EFWS] tank sizing, and n the lss f cndenser vacuum, sectin 5 f Sub-chapter 14.3, cncerning steam mass discharged t the atmsphere INADVERTENT CLOSURE OF ONE VIV [MSIV] (IN STATE A) The inadvertent clsure f ne VIV [MSIV] culd be caused by a spurius clsure signal n ne VIV [MSIV]. The clsure f ne VIV [MSIV] islates the steam flw in ne steam line. The heat remval reductin in the affected steam generatr leads t a secndary pressure and temperature increase and cnsequently t a temperature increase in the crrespnding primary lp. Reactr trip wuld ccur fllwing a high steam generatr pressure r lw DNBR signal. The secndary side pressure wuld be limited by the peratin f the VDA [MSRT].

121 PAGE : 114 / Identificatin f Causes and Accident Descriptin General Cncern The inadvertent clsure f ne VIV [MSIV] is an verheating event leading t a risk f fuel failure due t DNB, and a risk f Reactr Clant Pressure Bundary (RCPB) and Secndary System Pressure Bundary (SSPB) failures due t primary and secndary system verpressure. This sectin deals with the risk f DNB. The risk f excessive verpressure is addressed in sectin 1 f Sub-chapter 3.4, Tpics specific t Mechanical Cmpnents. Identificatin f causes The inadvertent clsure f ne VIV [MSIV] event culd be initiated: By a spurius I&C cmmand t clse ne VIV [MSIV], r By the spurius pening f tw pilt valves in series n the VIV [MSIV]. Precautins limiting f the accident ccurrence The assignment t the 4 electrical divisins f the 4 steam pilts f ne VIV [MSIV] is such that the prbability f spurius clsure f 1 VIV [MSIV] due t the spurius pening f 2 steam pilts in series is lw. The inadvertent clsure f ne VIV [MSIV] is classified as a PCC-3 event Typical Sequence f Events Frm the initiating event t the cntrlled state The clsure f ne VIV [MSIV] results in the terminatin f ne main steam flw. The reduced heat remval leads t secndary pressure and temperature increases, causing the primary side pressure and temperature t increase. Reactr Trip and Turbine Trip are autmatically initiated, and the secndary side pressure is autmatically limited by the SG relief valves. Subsequently, the cntrlled state is reached, defined here as ht shutdwn cnditin, with residual heat being remved by the VDA [MSRT] and the ASG [EFWS]. The GCT [MSB] is nt claimed n the three unaffected SG as it is nt an F1 classified system. The ARE/AAD [MFWS/SSS] is nt claimed as they are nt F1 classified systems. Frm the cntrlled state t the safe shutdwn state The safe shutdwn state is reached when the LHSI/RHR can be cnnected. The sequence f actins t be perfrmed by the peratr t reach the LHSI/RHR perating cnditins is:

122 PAGE : 115 / 173 RCP [RCS] bratin During the RCP [RCS] cldwn, the RCP [RCS] bratin is perfrmed by the RBS [EBS]. The RCV [CVCS] is nt claimed as it is nt an F1 classified system. After cmpletin f the bratin, the peratr stps the RBS [EBS]. RCP [RCS] cldwn The RCP [RCS] cldwn t LHSI/RHR cnnectin cnditins is carried ut using the secndary side. It is perfrmed by reducing the VDA [MSRT] setpints. The GCT [MSB] is nt claimed as it is nt an F1 classified system. The rate f RCP [RCS] cling is defined t be cnsistent with the capacity f the ASG [EFWS] tanks. Therefre, the LHSI/RHR perating cnditins are reached befre the ASG [EFWS] tanks empty. The EPR cling rate is 50 C/h if tw RBS [EBS] trains are available, r 25 C/h if nly ne RBS [EBS] train is available. This cling rate may nt be achievable in the lng term due t the limited capacity f the VDA [MSRT] at lw pressure. The RBS [EBS] is designed s that the RBS [EBS] bratin cmpensates fr the reactivity insertin resulting frm the RCP [RCS] cling. The ASG [EFWS] tank capacity is sufficient t keep tw reactr clant pumps in peratin during the RCP [RCS] cling phase assuming the shutdwn f tw f the fur reactr clant pumps has t be perfrmed by the peratr. RCP [RCS] depressurisatin If the RCP [RCS] pressure is greater than the RIS/RRA [SIS/RHRS] cnnectin pressure f 30 bar when the RCP [RCS] cldwn t 180 C in ht leg is cmpleted, the peratr can briefly pen the PSV t depressurise the RCP [RCS]. The nrmal pressuriser spray 1, r auxiliary pressuriser spray frm the RCV [CVCS] are nt claimed as they are nt F1 classified systems. During the depressurisatin phase, the LHSI trains ensure a certain sub-cling margin and limit the RCP [RCS] depressurisatin at abut 20 bar Safety Criteria The safety criteria are the radilgical limits fr PCC-3/PCC-4 events. The cnsequences f the inadvertent clsure f ne VIV [MSIV] are analysed fr the fllwing acceptance criterin: The number f fuel rds experiencing DNB must remain belw 10% Definitin f Studied Cases Fuel cladding integrity The analysis is perfrmed t shw that the minimum DNBR remains abve 1.00, the decupling criterin described in Sub-chapter 14.1, thus demnstrating that fuel cladding integrity is maintained. 1 The nrmal spray is F1B classified in the current design reference but nt at the time f the study was perfrmed.

123 PAGE : 116 / 173 The phase frm the initiating event t the minimum DNBR is analysed in detail in the fllwing sectins. The transfer t the cntrlled state and the safe shutdwn state is assessed using a qualitative evaluatin, by reference t ther analyses in Chapter 14. Radilgical cnsequences The safety criteria t be met are the dse equivalent limits fllwing a release t the atmsphere, discussed in Sub-chapter 3.1. The bunding transient fr radilgical releases is the lss f cndenser vacuum analysed in sectin 5 f Sub-chapter 14.3, Lss f Cndenser Vacuum. The quantity f steam release t the atmsphere is identical in bth cases Methds and Assumptins Methd f Analysis The analysis f this accident is carried ut using the THEMIS cde described in Appendix 14A. The DNBR calculatin is perfrmed using the FLICA cde described in Appendix 14A. The methdlgy f analysis is the same as that used fr the inadvertent clsure f all VIVs [MSIVs] event, presented in sub-sectin f this sub-chapter. When cmpared t this accident, the inadvertent clsure f ne VIV [MSIV] intrduces an asymmetrical RCP [RCS] behaviur. The adequacy f the cde and the methdlgy f analysis are discussed in Main Steam Line Break Accident sectin 2 f Sub-chapter Prtectin and Mitigatin Actins F1A I&C prtectin fr the DNBR criterin after an inadvertent clsure f ne VIV [MSIV].is prvided by a reactr trip and turbine trip fllwing a SG pressure > MAX1 signal. The analyses fr the ther safety criteria are described in sub-sectin 7.2 f this sub-chapter. Nte: the reactr trip n the lw DNBR channel culd be qualified fr such an asymmetrical event. The reactr trip signal is nt taken int accunt in the present accident analysis. The F1A I&C functins required t reach the cntrlled state are thse related t decay heat remval via the SG, the ASG [EFWS] and the VDA [MSRT] as described fr the Lss f Cndenser Vacuum event in sectin 5 f Sub-chapter The F1B functins required t transfer the plant frm the cntrlled state t the safe shutdwn, are described in sectin 1 f the Lss f Cndenser Vacuum event described in sectin 5 f Sub-chapter 14.3.

124 PAGE : 117 / Descriptin f Studied Cases (frm the Initiating Event t the Cntrlled State) Chice f Single Failure and Preventive Maintenance The minimum DNBR is reached at the start f rds drp. Thus: The single failure assumed is a stuck rd; The preventive maintenance is nt cnsidered fr this event. Due t the shrt duratin f the calculatin phase an assumptin f preventive maintenance wuld nt impact the calculated results Initial State The cnservative initial cnditins fr the DNBR assessment are 100% full pwer, with uncertainties taken int accunt. The key parameters are presented in Sectin Table Specific Assumptins Neutrnic data and decay heat The fissin pwer term A is calculated with a pint-kinetic mdel. BOC neutrnic data are cnsidered, as they lead t the minimum decrease f pwer at the start f rds drp. In this case, EOC neutrnic data d nt lead t the limiting pwer increase, as they d fr the inadvertent clsure f all VIV [MSIV] discussed abve. The maximum decay heat curve term B+C with 1.645σ is used as described in Subchapter Assumptins related t nn F1 systems The cntrl I&C functins are nt taken int accunt, as they have either n impact r are beneficial t the minimum DNBR value. Assumptins related t F1 systems The nly F1 system demanded during this phase f the accident and relevant t the minimum DNBR value is the reactr trip. Other assumptins The initial DNBR is equal t the minimum value allwed by the lw DNBR LCO functin as discussed in sectin 8 f Sub-chapter 14.1.

125 PAGE : 118 / Results and Cnclusin Regarding DNBR criterin The PCC transient is nt calculated in the Pre Cnstructin Safety Reprt. The demnstratin that the DNBR criterin is met is based n the result f PCC transient analysis already perfrmed in the BDR-99 analysis fr EPR 4900 presented in Appendix 14B. The acceptability fr EPR 4500 can be judged frm the cmparisn f relevant parameters fr the EPR 4500 cvered by the PSAR and the EPR 4900 cvered by the BDR-99. The BDR-99 accident analysis described in sectin 2.4 f Appendix 14B shws that: At the beginning f the transient, typically the first 4 secnds after ne VIV [MSIV] clsure, RCP [RCS] pressure and temperature have small variatins which d nt lead t a significant change t the DNBR value. DNBR starts t decrease. This is due t the cre clant temperature increase, cmbined with a relatively small pressure increase. Finally, the DNBR decrease stps at the start f the rd drp fllwing a "SG pressure > MAX1" RT signal, which typically ccurs arund 5.5 secnds. Subsequently, the DNBR cntinues t increase. Assuming an initial DNBR value f 1.26, the minimum DNBR value is This maintains a cmfrtable margin t the DNBR criterin f This result shws that the PCC event inadvertent clsure f ne VIV [MSIV] is less nerus than the limiting PCC-2 LOOP event. The initial DNBR value f 1.26 was defined t keep the DNBR abve 1.00 during the RCP [RCS] flw rate decrease due t the lss f pwer t all fur f the reactr clant pumps. Cmparisn f the relevant characteristics between the EPR 4500 cvered by the PCSR and the EPR 4900 cvered by the BDR-99 discussed in Sub-chapter 14.1 shws that: The EPR 4500 has an initial DNBR margin similar t that f the EPR 4900 with a minimum initial DNBR value f 1.26, as discussed in sectin 6 f Sub-chapter The EPR 4500 has similar primary and secndary side thermal-hydraulic characteristics cmpared t the EPR Hwever, the EPR 4500 has the ptential fr a lwer RCP [RCS] heat-up rate than the EPR 4900, due t a lwer pwer/rcp [RCS] clant mass rati. In the EPR 4500 pwer is decreased by 8% and RCP [RCS] clant mass is unchanged frm that fr the EPR In additin the EPR 4500 has a lwer pwer/sg water cntent rati. The pwer is decreased by 15% and the SG water mass is decreased by 8% and the SG vlume decreased by 4% cmpared with the EPR This is beneficial fr the DNBR, as it reduces the rate f decrease. Based n the abve cmparisn: The results shw a large margin t the DNBR criterin. The PCC-3 event f inadvertent clsure f ne VIV [MSIV] is nt limiting fr DNB when cmpared t the PCC-2 LOOP event. This cnclusin can be drawn even when n claims are made n the specific DNBR prtectin prvided by the reactr trip n lw DNBR.

126 PAGE : 119 / 173 The cmparisn between the relevant characteristics fr the EPR 4500 and the EPR 4900, shws n significant detrimental effect fr the EPR 4500 cmpared with the EPR It can be cncluded that EPR 4500 meets the DNBR criterin f DNBR 1 fllwing an inadvertent clsure f ne VIV [MSIV]. The cntrlled state The means t reach the cntrlled state, ht shutdwn, are the same as fr the PCC-2 event described in the sectin Lss f Cndenser Vacuum, sectin 5 f Sub-chapter 14.3: Reactivity cntrl: the initial pwer level and the shutdwn rds wrth are identical Residual heat remval: the same capabilities are available fr the SG (VDA [MSRT] and ASG [EFWS]) Clant inventry: bth events have n impact n the primary clant inventry Descriptin f Studied Cases (frm the Cntrlled State t the Safe Shutdwn State) The safe shutdwn state is reached nce the LHSI/RHR is peratinal. The transitin frm the cntrlled state t the safe shutdwn state is cvered by the PCC-2 event Lss f Cndenser Vacuum, presented in sectin 5 f Sub-chapter 14.3, if reactr clant pumps remain in peratin. If the reactr clant pumps are unavailable after turbine trip due t the lss f grid the transfer t the safe shutdwn state is cvered by the PCC-3 lng term LOOP event described in sectin 2 f this sub-chapter. Bth the initial and final states are the same, and the capabilities f the F1B systems needed in bth cases, the VDA [MSRT], ASG [EFWS] and RBS [EBS] are identical SYSTEM SIZING This event is nt limiting fr the design f the claimed safety systems.

127 PAGE : 120 / 173 SECTION TABLE 1 Inadvertent Clsure f All VIVs [MSIVs] Main Assumptins (4500 MWth) Parameter Limiting Value Assumed Reactr Trip "SG pressure > MAX1" Setpint Delay = 97.0 bar 1.2 s Reactr Trip "pressuriser pressure > MAX2" Setpint Delay = bar 1.2 s Initial cnditins RCP [RCS] flw T/h design flw Cre pwer 100% + 2% = 102% FP Pressuriser pressure = bar RCP [RCS] average temperature = C Pressuriser level % = 61% f measuring range SG level 49% f narrw range SG heat transfer area Nminal 10%

128 PAGE : 121 / 173 SECTION TABLE 2 Inadvertent Clsure f One VIV [MSIV] Main Assumptins (4500 MWth) Parameter Limiting Value Assumed Reactr Trip "SG pressure > MAX1" Setpint Delay = 97.0 bar 1.2 s Initial cnditins RCP [RCS] flw T/h design flw Cre pwer 100% + 2% = 102% FP Pressuriser pressure = bar RCP [RCS] average temperature = C Pressuriser level 56-5% = 51% f measuring range SG level 49-5% = 44% f narrw range SG heat transfer area Nminal -10%

129 PAGE : 122 / INADVERTENT LOADING OF A FUEL ASSEMBLY IN AN INCORRECT POSITION 8.1. DESCRIPTION The reactr cre lading pattern reflects a fuel assembly arrangement that allws the safety limits t be met thrughut the fuel cycle. The inadvertent lading f a fuel assembly in an incrrect psitin refers t a cre cnfiguratin that des nt cmply with the intended lading pattern. The incrrect psitining f the assembly may ccur during reactr refuelling peratins (state E, see Sub-chapter 14.0). The cnsequences are: Direct cnsequence Nn-cmpliance with the lading pattern may result in an unexpected increase in the cre reactivity, namely a drp in the shutdwn margin needed fr refuelling peratins. Pssible cnsequence If the incrrect fuel lading pattern is nt detected prir t pwer peratins, it culd lead t a change in the pwer distributin predicted fr the cre design and thereby exceed the safety limits IDENTIFICATION OF CAUSES, PREVENTION METHODS Inadvertent lading f a fuel assembly in an incrrect psitin can be the result f: An errr when the lading pattern was develped, r An errr when the lading pattern was applied t the cre, r An errr during refuelling peratins. Varius measures are implemented t prevent these errrs Creatin f the Lading Pattern and Applicatin t the Cre The lading pattern develpment prcess where meeting the safety limits is justified is subject t tw independent checks, ne by the plant peratr and the ther by the fuel supplier. The lading pattern is sent t the plant electrnically. Using this infrmatin, the plant prduces the assembly lad sequence, a list f sequential assembly mvements, fr the mnitring statin f the fuel handling system. The mnitring statin carries ut an autmatic check f the pattern received via a checksum.

130 PAGE : 123 / Reactr Relading Operatins Measures are taken during the fuel handling system design stage, (mnitring functin), t prevent the incrrect psitining f an assembly during relading peratins: Each sequence is autmatically presented t the lading manager in the reactr building r t his assistant in the fuel building t cnfirm the acceptability f the fuel mvement. After validatin by the lading manager r his assistant, the assembly pick-up and put-dwn crdinates are sent t the equipment invlved, either the fuel manipulatr crane r the verhead crane. The fuel manipulatr and verhead crane peratrs execute, using jystick cntrl, the mvements indicated by these autmatic devices. The mvement is interrupted immediately if the peratrs release the jystick. A camera is placed at the utlet pint f the transfer device n the reactr building side t allw the peratr t read the identity f each assembly transferred. The mnitring system nly allws the peratin t cntinue via subsequent mvement t the defined sequence if the manually entered identity number read by the peratr crrespnds t the number expected in the sequencing plan DETECTION METHODS During Relading The fuel handling system mnitring statins allw the prgressin f the cre lading plan t be fllwed thrughut the relading peratins. A cre lading table can therefre be cnsulted in real time. At the end f lading, a cmplete cre map is prduced s that cmpliance with the required lading pattern can be cnfirmed. This map guarantees that after relading, the plant restarts with the assemblies in the crrect psitins in the cre Restart Physics Tests By cmparing design predictins with measurement results, the restart physics tests enable a glbal verificatin that the cre design meets the apprpriate limits. They are based n the fllwing measurements: Critical brn cncentratin levels Mderatr temperature cefficient Cntrl rd wrth Flux maps At lw pwer During pwer rise.

131 PAGE : 124 / ANALYSIS OF THE CONSEQUENCES Because f the detectin methds utlined abve, nly the immediate cnsequences f the inadvertent lading f an assembly are analysed. It is demnstrated that fr refuelling cnditins (state E), and fr all f pssible cases f replacement f an assembly with the fuel management s mst reactive assembly, the shutdwn margin remains abve 1000 pcm. Thus, it is shwn that the Inadvertent lading f a fuel assembly in an incrrect psitin des nt lead t a risk f cre criticality SYSTEM SIZING This event is nt limiting fr the design f the claimed safety systems.

132 PAGE : 125 / FORCED DECREASE OF REACTOR COOLANT FLOW (FOUR PUMPS) 9.1. IDENTIFICATION OF CAUSES AND ACCIDENT DESCRIPTION A cmplete lss f frced reactr clant flw can be caused by a simultaneus fault in the pwer supplies t all the RCP [RCS] pumps caused by a drp in frequency n the external grid. The bunding case studied crrespnds t a supply frequency drp at 4 Hz per secnd t 0 Hz where it remains fr an undetermined perid. The typical sequence f events during a frced decrease f reactr clant flw is as fllws. Frm the initiating event t the cntrlled state A fast supply frequency drp leads t a reversal f the mtr trque, which reduces the reactr clant pumps speed and clant flw mre rapidly than a vltage drp transients which is limited by the inertia f the flywheel. If the reactr is at pwer at the time f the incident, the cre pwer is essentially unchanged. As the primary clant flw is decreasing, the margin t nucleate biling is reduced. This culd result in DNB with subsequent fuel damage, if the reactr is nt tripped prmptly. The reactr trip is initiated by the lw RCP [RCS] pump speed prtectin functin, which is F1A classified. A frequency drp f 4Hz/s leads t a cmplete Lss Of Off-site Pwer (LOOP). The cntrlled state is defined belw. This state is similar t the LOOP cntrlled state described in detail in sectin 6 f Sub-chapter Nuclear pwer = 0% full pwer Inlet temperature = C Pressure = 155 bar Brn cncentratin f the initial pwer state Xenn level higher than r equal t the initial xenn level All RCCA fully inserted Natural circulatin. The shutdwn margin defined in sectin 1 f Sub-chapter 4.3 supprts the required cre subcriticality.

133 PAGE : 126 / 173 Frm the cntrlled state t the safe shutdwn state The safe shutdwn state crrespnds t the fllwing cnditins: Nuclear pwer = 0% full pwer Ht leg temperature = 180 C Pressure = 30 bar Decay heat remved by the steam generatrs r by LHSI/RHR mde. A brn cncentratin that ensures cre subcriticality, even fllwing the xenn depletin All RCCA fully inserted Natural circulatin. The fllwing actins must be perfrmed t reach the safe shutdwn state: RCP [RCS] cldwn and depressurisatin (F1 classified) Bratin via the RBS [EBS] (F1 classified). The frced decrease f the primary clant flw event is bunded by the fllwing events: Criterin Reactivity Release Subcriticality Heat Remval (DNB) Event Lss f Cndenser Vacuum described in sectin 5 f Sub-chapter 14.3 RCV [CVCS] Malfunctin described in sectin 13 f Sub-chapter 14.3 ASG [MFWS] System Pipe Break described in sectin 3 f Subchapter 14.5 The analysis cvering the transient frm the initiating event t the autmatic reactr trip is presented belw Safety and Decupling Criteria The cmplete lss f frced reactr clant flw is a PCC-3 event. The safety criteria are the dse equivalent limits fllwing a release t the atmsphere, as addressed in Sub-chapter The decupling criteria assessing the behaviur f the barriers are: The number f fuel rds entering DNB must nt exceed 10% f the ttal cre The average clad ht spt temperature must nt exceed 1482 C

134 PAGE : 127 / 173 The amunt f fuel melting at the ht spt must nt exceed 10% Reactr Prtectin System Actins Measures Enabling the Incident Prbability t be Limited These measures are linked t grid reliability and t the reliability f the prtectin channels Reactr Prtectin Actins A reactr trip t prtect against the frced decrease f reactr clant flw can be initiated by the fllwing signals: The lw RCP [RCS] pumps speed signal The RCP [RCS] pumps are fitted with speed measurements. These measurements are used t generate a reactr trip signal when the speed in 2 ut f 4 RCP [RCS] pumps falls belw the setpint. The lw-lw reactr clant flw rate (ne lp) signal The lss f ne RCP [RCS] pump is detected using lp flw measurements. These measurements are used t generate a reactr trip signal using 2 ut f 4 lgic when the lp flw rate falls belw the setpint. If the nuclear pwer level is belw a lw threshld, the lw-lw reactr clant flw rate channel is inhibited t allw the plant t be perated with ne f the 4 RCP [RCS] pumps stpped. When the lss f flw rate affects all fur RCP [RCS] pumps as a result f vltage r frequency disturbances, prtectin is prvided by the tw signals. The reactr trip is actuated by the lw RCP [RCS] pump speed signal with a higher setpint and shrter respnse time. When the lss f flw rate affects nly ne primary lp, prtectin is prvided by the lw-lw reactr clant flw rate (ne lp) signal METHODS AND ASSUMPTIONS Single Failure and Preventive Maintenance The single failure and preventive maintenance assumptins are applied t the F1 systems in the mst cnservative way fr the acceptance criterin being assessed as required by the general safety rules discussed in Sub-chapter The mst significant single failure is the assumptin that the RCCA with the highest absrptin wrth fails t enter the cre during a reactr trip. N preventive maintenance assumptin is made fr this transient.

135 PAGE : 128 / Methd f Analysis The 3D kinetic neutrnic cmputer cde SMART, is cupled with THEMIS, mdelling the thermal-hydraulic behaviur f the primary system as described in Appendix 14A, fr analysis f the EPR 4900 in BDR-99 discussed in Appendix 14B. The cde suite calculates the fllwing parameters during the transient: the cre flw rate the nuclear pwer the heat flux the reactr clant system pressure the reactr clant system temperature. The use f a 3D kinetic neutrnic mdel allws the wrst axial pwer shape t be mdelled and its impact n the DNBR and reactr trip effectiveness assessed. The parameters listed abve are used by the thermal-hydraulic cde FLICA, described in Appendix 14A, t evaluate the number f fuel rds that enter DNB Initial Cnditins The assumed initial perating cnditins are the mst cnservative fr DNBR. The nminal values are discussed in Sub-chapter 14.1: The maximum steady state pwer level is 102% f the nminal pwer level, including a 2% uncertainty n the thermal balance. The maximum steady-state average clant temperature, taking int accunt measurement uncertainties, the average clant temperature cntrl dead band, and the effectiveness f the cntrl system is the nminal temperature C. The minimum steady-state clant pressure, taking int accunt measurement uncertainty and the effectiveness f the cntrl system is the nminal pressure bar. The vessel flw is equal t 100% f the nminal thermal-hydraulic flw, Fr the 3D kinetic neutrnic simulatin, the axial pwer distributin and the nuclear F H value are such that the initial DNBR value is equal t the lw DNBR limiting cnditin f peratin (LCO) value. The initial cre Axial Offset (A0) value is 18%. Fr the DNBR calculatins t cnfirm the design DNBR criterin is met, the axial pwer distributin and the nuclear F H value are such that the initial DNBR value is equal t the DNBR limiting value. The initial cre A0 value is 18%.

136 PAGE : 129 / Cre Related Assumptins Mderatr temperature cefficient The lwest initial value f the mderatr density cefficient is assumed. This value results in the maximum ht-spt heat flux during the initial part f the transient when the minimum DNBR is reached. Dppler cefficient This cefficient is set at its maximum abslute value. This reduces the negative reactivity additin during the reactr trip, thus increasing the heat flux when the minimum DNBR is reached. Fuel-clant heat transfer cefficient This cefficient is minimised t maximise the thermal flux during the rd drp. Shutdwn margin The RCCA having the greatest wrth is assumed t be stuck abve the cre. The negative reactivity insertin fllwing trip is thus minimised, leading t a minimum final subcriticality. The RCCA rd wrth versus time is calculated using the cnservative tp peaked cre initial cnditin with 18% axial ffset Prtectin Actins The reactr trip is initiated fllwing a lw RCP [RCS] pump speed signal. The setpint is assumed t be 91% f the nminal speed. The ttal delay between the reactr trip setpint being reached and the beginning f the RCCA drp is cnservatively assumed t be 0.6 secnds Cntrl Actins The transient generates a heat-up within the reactr clant system whse cnsequences are mitigated by the average clant temperature and the pressure cntrls. As the effect f the average clant temperature cntrl is beneficial, it is nt mdelled in the analysis. The pressuriser spray flw rate is assumed t be its maximum value t limit the pressure increase RESULTS AND CONCLUSION The justificatin that the safety and decupling criteria are met fr this event is based n the results f the PCC transient analysis fr EPR 4900 presented in sectin 2.6 f Appendix 14B and frm the cmparisn f the relevant parameters fr the EPR 4500 cvered by the PSAR and the EPR 4900 cvered by the BDR-99. The PCC transient is nt recalculated in the PSAR.

137 PAGE : 130 / BDR-99 results All the decupling acceptance criteria are met. The number f fuel rds experiencing DNB is less than 1%, and therefre significantly belw the decupling criterin f 10% Relevant Differences between the EPR 4500 and the EPR 4900 A cmparisn f the EPR 4500 with the EPR 4900 is summarised belw: Lwer pwer level Same thermal-hydraulic cre clant flw cast-dwn as frced by the grid frequency decrease Higher RCP [RCS] average temperature (+1.5 C) Slightly lwer cre utlet temperature Same LCO fr axial pwer distributin with an axial ffset limit f 18% Same LCO fr initial DNBR as described in sectin 6 f Sub-chapter 14.3 Better RCCA effectiveness fr reactr trip Similar bunding reactivity feedbacks fr the mderatr and fuel in abslute value Cnclusins fr the EPR 4500 The main parameters affecting the minimum DNBR reached during the transient are the primary flw transient, the cre pwer distributin, limited by the LCO functin n axial ffset, the initial DNBR value, limited by its dedicated LCO functin, and the slight pwer decrease resulting frm reactivity feedback befre reactr trip. Since these parameters are nt significantly different fr the EPR 4500, nly slight changes in the DNBR margin are expected when cmpared with the EPR This wuld nly slightly change the number f rds which experience DNB and the number will remain belw the decupling criterin. It can be cncluded withut the need fr a dedicated calculatin that the decupling acceptance criteria are met fr the EPR SYSTEM SIZING This event is nt limiting fr the design f the claimed safety systems.

138 PAGE : 131 / LEAK IN THE GASEOUS WASTE PROCESSING SYSTEMS This transient is nly cnsidered fr the radilgical cnsequence-related aspects. The relevant calculatins are presented in the sub-chapter 'Radilgical Cnsequences f Design Basis Accidents' (see Sub-chapter 14.6).

139 PAGE : 132 / LOSS OF PRIMARY COOLANT OUTSIDE THE CONTAINMENT INTRODUCTION The scenari cnsidered is a lss f clant utside the cntainment. During nrmal plant peratin several events culd cause such a clant lss. The representative accident sequence is described belw. A lss f clant accident utside the cntainment during the peratin f the residual heat remval system is described in Sub-chapter This event is classified as a PCC-3 event. The lss f primary clant may result frm a failure f: The Chemical and Vlume Cntrl System RCV [CVCS], including the RCV [CVCS] cnnecting lines, r The Nuclear Sampling System REN [NSS]. The mst limiting pipe breaks fr the Chemical and Vlume Cntrl System are: A 2A rupture f the RCV [CVCS] line, lcated between the Vlume Cntrl Tank (VCT) and the VCT suctin valves A 2A rupture f a RCV [CVCS] cnnecting line, lcated in the Nuclear Auxiliary Building. The mst limiting pipe break fr the Nuclear Sampling System REN [NSS] is: A 2A rupture f the pressuriser liquid sampling line, lcated between the cntainment penetratin and the heat exchanger. The RCP [RCS] is nt significantly affected by such breaks as the break flw is matched by makeup r, in the event f a RCV [CVCS] pump trip, the cnnecting lines are islated. In each case the break islatin time is cnservatively assumed t be 60 minutes after the pipe break ccurs, based n the fllwing: 30 minutes t actuate the alarm frm either a Fuel Building sump level high r a Fuel Building activity high signal 30 minutes t perfrm the peratr actin f manual break islatin frm the Main Cntrl Rm Bth these accident cases are analysed and the results given in Sub-chapter SYSTEM SIZING This event sizes the clsure time f the islatin valve in the RCV [CVCS] line.

140 PAGE : 133 / UNCONTROLLED RCCA BANK WITHDRAWAL (STATES B, C, AND D) This transient is classified as a PCC-3 event if it ccurs in reactr states B, C, r D, but it is classified as a PCC-2 event if it ccurs in reactr state A. The PCC-2 event is assessed in sectins 9 and 10 f Sub-chapter A rd cluster cntrl assembly (RCCA) bank withdrawal accident is defined as an uncntrlled additin f reactivity t the reactr cre caused by withdrawal f RCCA banks that leads t a pwer excursin. Such a transient culd be caused by a malfunctin f the reactr cntrl system. It is assumed that such malfunctin culd nt result in a withdrawal f shutdwn RCCA (shutdwn RCCA, unlike cntrl RCCA, are nt cntrlled by an autmatic system). Therefre, the maximum reactivity insertin that can ccur is frm the simultaneus withdrawal f all (initially inserted) cntrl RCCA at the maximum withdrawal speed. The study f this transient relies n a dedicated prtectin functin that eliminates this accident. This dedicated prtectin functin autmatically cuts ff the RCCA pwer supply when the plant leaves plant state A. It is based n primary temperature and primary pressure measurements. The RCCA pwer supply is autmatically cut ff when the temperature is lwer than its setpint r when the pressure is lwer than its setpint. Cnversely, this permissive signal permits the manual cnnectin f the RCCA pwer supply by the peratr when the temperature is higher than the setpint and when the pressure is higher than the setpint. The primary temperature and primary pressure measurements used in the permissive derivatin are acquired frm the Prtectin System and are F1A classified. The F1 classificatin f this functin allws the uncntrlled RCCA bank withdrawal scenari in states B, C and D t be remved frm the Pre-Cnstructin Safety Reprt. In additin, there may be a requirement fr the mvement f the RCCA in shutdwn states. T d s withut challenging the deletin f the uncntrlled RCCA bank withdrawal scenari, the manual actuatin f the RCCA pwer supply in states B t D is nly pssible if the clant brn cncentratin is higher than the refuelling clant brn cncentratin. This is defined t be sufficient t maintain cre subcriticality with all RCCAs withdrawn.

141 PAGE : 134 / UNCONTROLLED SINGLE CONTROL ROD WITHDRAWAL IDENTIFICATION OF CAUSES AND ACCIDENT DESCRIPTION Definitin, Causes, and Descriptin f the Transient The accidental withdrawal f a single Rd Cluster Cntrl Assembly (RCCA) at pwer can nly ccur in the fllwing tw, very unlikely cases: Case 1: The peratr culd deliberately withdraw a single cntrl rd, the cluster cntrl being transferred t manual mde, thinking that the clusters are misaligned r that ne cluster has drpped. Case 2: If the reactr is perating in autmatic cntrl mde, several simultaneus electrical r mechanical failures can cause withdrawal f a single RCCA. Fr each case, the RCCA withdrawal speed is limited t 75 cm/min. In the assessment described belw the initial pwer level is 102% NP. The typical sequence f events is described in the fllwing sectins Frm the Initiating Event t the Cntrlled State The withdrawal f a single RCCA will result in an insertin f reactivity which leads t bth an increase in average cre pwer and temperature, and in the lcal pwer peak in the area f the cre frm which the RCCA has been withdrawn. The cmbinatin f cnservative thermalhydraulic cnditins and distrted pwer distributin may result in a Departure frm Nucleate Biling (DNB) if the cre is nt adequately prtected. The prtectin against DNB is prvided by the lw DNBR channel, which calculates the DNBR n-line. T carry ut its prtectin functin fr this fault, the calculated DNBR has t be representative f the real DNBR value during the single RCCA withdrawal transient. The calculated DNBR can fail t adequately represent the actual DNBR due t the distrted pwer distributin in the single RCCA withdrawal case, and taking accunt f the single failure criterin. This lss f accuracy has t be assessed and taken int accunt when basing prtectin claims n the lw DNBR channel. After the reactr trip initiated by the lw DNBR channel which is F1A classified, the cntrlled state is as fllws: Nuclear pwer = 0% full pwer Temperature = C Pressure = 155 bar Brn cncentratin as fr the initial pwer state Xenn level higher than r equal t the initial xenn level

142 PAGE : 135 / 173 All RCCA fully inserted. The shutdwn margin calculatin, discussed in sectin 5 f Sub-chapter 4.3, prvides the cre subcriticality in this state. This transient state is similar t that fllwing a lss f cndenser vacuum described in sectin 5 f Sub-chapter 14.3, where mre details are prvided Frm the Cntrlled State t the Safe Shutdwn State The safe shutdwn state crrespnds t a state with the fllwing cnditins: Nuclear pwer = 0% full pwer Ht leg temperature = 180 C Pressure = 30 bar Brn cncentratin sufficient fr cre subcriticality fllwing the xenn depletin Residual heat is remved by the steam generatrs r the RRA [RHRS] All RCCA fully inserted. The actins t be perfrmed t reach the safe shutdwn state are mainly: Cldwn via the VDA [MSRT] at a rate f 25 C/h if nly ne RBS [EBS] pump is available (r at 50 C/h if bth RBS [EBS] pumps are available) dwn t a ht leg temperature f less than 180 C and then a reductin f primary pressure t less than 30 bar (RIS/RRA [SIS/RHRS] perating cnditins) by means f the pressuriser safety valves. Bratin with ne r bth RBS [EBS] pumps during the cldwn The single RCCA withdrawal transient is bunded fr the activity release by the lss f cndenser vacuum discussed in sectin 5 f Sub-chapter This event is bunded fr the heat remval capability by the feedwater line break transient, described in sectin 3 f Sub-chapter 14.5, as the fur steam generatrs remain available. This event is bunded fr cre subcriticality by the RCV [CVCS] malfunctin which results in a decrease in brn cncentratin in the reactr clant as discussed in sectin 13 f Subchapter The sequence f actins t be perfrmed t reach the safe shutdwn state is detailed in sectin 3 f Sub-chapter The analysis belw addresses the transient frm the initiating event t the reactr trip Safety and Decupling Criteria The single RCCA withdrawal at pwer is classified as a PCC-3 event.

143 PAGE : 136 / 173 The safety criteria are the dse equivalent limits fllwing a release t the atmsphere discussed in Sub-chapter The decupling criterin is defined in terms f percentage f fuel rds that suffer a Departure frm Nucleate Biling (DNB). The criterin is that the percentage f fuel rds in DNB must be lwer than 10%. A mre limiting criterin is impsed by verifying that there is n DNB Reactr Prtectin System Actins The lw DNBR prtectin functin actuates a reactr trip, which prtects the fuel against DNB during single RCCA withdrawal at pwer transients. The lw DNBR channel uses a n-line calculatin f DNBR and Self Pwered Neutrn Detectr (SPND) imbalance. The DNBR calculatins are based n the fllwing: Pwer density distributin f the ht channel, which is directly derived frm the neutrnic in-cre instrumentatin (SPND). The signals frm the SPNDs prvide the integrated pwer alng the ht channel using a plynmial functin. Inlet temperature, derived frm the cld leg temperature sensrs Pressure, derived frm the primary pressure sensrs Relative cre flw, derived frm the reactr clant pump speed sensrs. Twelve fuel assemblies are instrumented. Therefre the cre is divided int 12 radial znes, each f which is surveyed by ne SPND finger as shwn in Sectin Figure 1. Thus, 12 n-line DNBR values are calculated. The axial lcatin f the six SPND in their guide tube is shwn in Sectin Figure 2. The lw DNBR prtectin channel fllws the glbal architecture f the prtectin system with fur divisins and a 2 ut f 4 dwnstream vte. Each divisin uses all 12 n-line DNBR values. In rder t avid spurius actuatin f the reactr trip in case f a single SPND failure during nrmal peratin, the basic reactr trip actuatin is based n the secnd lwest value f n-line DNBR. The SPND imbalance calculatin fllws the glbal architecture f the prtectin system with fur divisins and a 2 ut f 4 dwnstream vte. Each divisin is fed with all 72 SPND signals. The calculatin is based n the pwer density prvided by the SPNDs. The differences in pwer density between tw symmetrical SPND are calculated. These are SPNDs at the same axial level and symmetrical with respect t the centre f the cre. The sum f the abslute value f these differences crrespnds t the SPND imbalance. The lgic f the reactr trip actuatin is shwn in Sectin Figure 3 and described belw: In the event f high SPND imbalance, the reactr trip actuatin is based n the cmparisn f the lwest value f n-line DNBR with the setpint cvering imbalance and rd drp cnditins. The setpint cvering imbalance and rd drp cnditin is designed t cver the additinal lss f accuracy fr the n-line DNBR calculatin due t abnrmal situatins with high SPND imbalance. It is therefre higher and mre cnservative than the setpint defined fr nrmal peratin.

144 PAGE : 137 / 173 In all ther situatins, the reactr trip actuatin is based n the cmparisn f the secnd lwest n-line DNBR with the setpint. Since the prtectin against DNB is prvided thrugh the lw DNBR channel, the bjective is t demnstrate that the n-line calculated DNBR is nt higher than the actual value during a single RCCA withdrawal transient. The further bjective is t assess the lss f accuracy f the n-line DNBR calculatin due t the accuracy f the SPNDs in single RCCA withdrawal situatins. This lss f accuracy is cnsidered as an uncertainty t be included in the event f a high SPND imbalance fr determining the DNBR imbalance and rd drp setpint value. A reactr trip is actuated fr a calculated DNBR value belw the DNBR imbalance and rd drp setpint value nly in cases with high SPND imbalance METHODS AND ASSUMPTIONS Single Failure Selectin The single failure is applied t ne SPND. The high SPND imbalance setpint will be reached whichever SPND is assumed t have failed, as several symmetrical SPND pairs wuld have a high imbalance in the event f a cnservative single RCCA withdrawal case. The wrst case is t assume that the failed SPND belngs t the finger prviding the lwest nline calculated DNBR. Therefre, it is assumed that the n-line DNBR frm this finger is unavailable. Cnsequently, the safety analysis must assess the lss f accuracy f the secnd lwest value f n-line DNBR Methd f Analysis Calculatin f n-line DNBR in Single RCCA Withdrawal Situatins Static calculatins are perfrmed at nminal cnditins f nminal pwer, inlet temperature, pressure and cre flw. Fr each zne, the n-line DNBR is calculated by an algrithm using the pwer density distributin prvided by the SPND finger in the zne as an input. The pwer density distributin cnsists f a plynmial fit built frm the respnses f the six SPNDs f the finger surveying the zne. The respnse f a SPND is equal t the prduct: SPND calibratin cefficient x Absrptin rate density in the SPND The tw-energy-grup, three-dimensinal ndal diffusin cde SMART is used t determine the absrptin rate density in each f the 72 SPND. The calibratin cefficients are derived frm three-dimensinal SMART calculatins at nminal pwer with all rds ut. Each SPND is calibrated fr the fuel rd with the maximum nuclear enthalpy rise in the zne that it surveys as shwn in Sectin Figure 1:

145 PAGE : 138 / 173 Calibratin cefficient = integrated pwer t the SPND height in the fuel rd f the zne with maximum nuclear enthalpy rise absrptin rate density f the SPND Calculatin f the Design DNBR fr the Single RCCA Withdrawal Event The design DNBR value fr the single RCCA withdrawal event is determined by the FLICA cde. The three-dimensinal SMART cde is used t calculate the axial and radial pwer distributins needed as an input fr FLICA Lss f Accuracy One n-line DNBR value per zne, and therefre 12 n-line DNBR values fr the cre, are prvided fr the znes shwn in Sectin Figure 1. The lss f accuracy is btained by cmparing the secnd lwest value f n-line DNBR, 12 values fr the cre, t the actual DNBR. Lss f accuracy = 2 nd lwest n line DNBR - actual DNBR actual DNBR RESULTS AND CONCLUSIONS Results fr the EPR 4250 [Ref-1] The analysis fr the EPR 4250 is perfrmed at the Beginning f Cycle (BOC) and the End f Cycle (EOC) fr UO 2 and MOX fuel management schemes. The analysis has als been perfrmed at BOC and EOC fr the initial cre. Deep RCCA bank insertin is a cnservative assumptin fr a RCCA withdrawal event. The initial psitin f the cntrl banks is defined accrding t the rd insertin strategy and rd insertin limits defined in Sectin Table 1. The assignment f cntrl RCCA t cntrl banks may change during a cycle. Therefre, the analysis has been perfrmed using each f the fur sequences f rds psitins shwn in Sectin Figure 4. Each individual RCCA was withdrawn frm that set f initial cnditins. Cases leading t very high DNBR (>3) in these calculatin are neglected. They generally crrespnd t EOC situatins when the F H is lw at arund 1.3. The key results fr the EPR 4250 are presented belw in Sectin Table 2.

146 PAGE : 139 / 173 Fr all the cases studied fr RCCA withdrawal, the lss f accuracy is less than 9%. Cnsequently, t remain effective during RCCA withdrawal, the lw DNBR setpint value has t take accunt f this lss f accuracy. As an imbalance methd is als used fr a rd drp event, the setpint value will be assessed using the highest lss f accuracy determined fr thse accidents. The high setpint value fr SPND imbalance is assumed t be 300 W/cm with all relevant cases leading t a higher value Results fr the EPR 4500 Dedicated calculatins are nt perfrmed fr the EPR 4500 fr the fllwing reasns: The results shuld nly be slightly different because the analysis has cvered a large number f cases and the limits f RCCA insertin are unchanged fr the EPR The bjective f the analysis is the determinatin f the lss f accuracy assciated with the accident. If, hwever, these values were higher fr the EPR 4500, the lw DNBR setpint wuld be increased t cmpensate. Adequate cre prtectin during the uncntrlled withdrawal f single rd frm pwer is therefre prvided SYSTEM SIZING This event is nt limiting fr the design f the claimed safety systems.

147 PAGE : 140 / 173 SECTION TABLE 1 EPR Maximum Initial Insertin f the Cntrl RCCA at Nminal Pwer RCCA Insertin (cm) at BLX P1 P2 P3 P4 P5 set set set set set set set set set set RCCA Insertin (cm) at EOL P1 P2 P3 P4 P5 set set set set set set set set set set

148 PAGE : 141 / 173 SECTION TABLE 2 EPR 4250 MAXIMUM LOSS OF ACCURACY (LOA) FOR THE RCCA WITHDRAWAL EVENT Sequence f Rds Psitin Lcatin f Withdrawn Rd Insertin f the Cntrl RCCA Fuel Management Cycle LOA 1 st n-line DNBR (%) LOA 2 nd n-line DNBR (%) SPND Imbalance (w/cm) 1 N3 set 1 First cre 1, BLX R7 set 2 UO 2 INOUT-18 m equilibrium, BLX C9 set 1 First cre 1, BLX L3 set 1 First cre 1, BLX

149 PAGE : 142 / 173 SECTION FIGURE 1 Radial Lcatin f SPND Fingers and Radial Znes