LD-91-062, Forwards Response to NRC 910513 & 0821 Requests for Addl Info to Enable NRC to Continue Review of C-E Ssar for Design Certification.Topics Discussed Include Definition of Single Failure & Sequence of Events

Forwards Response to NRC 910513 & 0821 Requests for Addl Info to Enable NRC to Continue Review of C-E Ssar for Design Certification.Topics Discussed Include Definition of Single Failure & Sequence of Events

ML20086J214
Person / Time
Site:	05200002
Issue date:	11/27/1991
From:	Erin Kennedy ASEA BROWN BOVERI, INC.
To:	NRC OFFICE OF INFORMATION RESOURCES MANAGEMENT (IRM)
References
LD-91-062, LD-91-62, NUDOCS 9112110118
Download: ML20086J214 (38)

Text

A - ,-

A RR RB P%ERBR AM A IPOW N FiOu N 1

November 27,1991  !

LD-91-062 l Docket No.52-002 U. S. Nuclear Regulatory Commission Attn: Document Control Desk Washington, DC 20555

Subject:

Response to NRC Requests for Additional Information

Reference:

A) Letter, Reactor Systems Branch RAls, T. V. Wambach (NRC) to E.11. Kennedy (C E), dated May 13,1991 B) letter, Reactor Systems Branch RAls, T. V. Wambach (NRC) to E. I'. Kennedy (C-E), dated August 21 1991

Dear Sirs:

Reference A requested ndditionalinformation for the NRC staff review of the Combustion Engineering Standard Safety Analysis Report - Design Certification (CESSAR-DC).

Enclosure I to this letter provides our responses to a number of these questions, and Enclosure Il provides a list of Reference A questions to which responses will be provided separately.

Enclosure 111 provides a response to RAI 440.139 of Reference B. Responses to the remaining questions of Reference B will be provided by separate correspondence.

Should you have any questions on the enclosed material, please contact me or Mr. Stan Ritterbusch of my staff at (203) 285-5206.

Very truly yours, COMBUSTION, ENGINEERING, INC.

- T E. H. Kennedy g,

/?l&f '

Manager Nuclear Systems Licensing EHK:lw 1

Enclosures:

As Stated 2 _ 'u_ ^88

• b"?ti n Engineering Nuclear Power v.

[}h 8 l

(QPbgg); f f tQN G*LDQ sfiC f @.3) Ib 'jh4WM 8 h N b'f .ttl [f 4 g "W 9- ([I'II) Id3M;

• b I I 9112110118 911127 N C'w um m fu an 2" E'2

PDR ADOCK 05200002 *

• D"*" "N0 " ' W' ud* CR A PDR

• cc: P. Lang (DOE - Germantown)

J. Trotter (EPRI)

T Wambach (NRC) 5

- - - - - _ - - - - _ - _ - _ - _ _ _ . _ - - - - - . _ _ _ _ - _ _ _ _ _ _ _ _ _ . _ _ _ _ _ - - _ _ _ _ _ _ _ _ _ - _ _ _ _ . . . _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ ___3

Enclosure I to

, LD-91062 RESPONSE TO NRC REQUESTS FOR ADDITIONAL INFORMATION REACTOR SYSTEMS BRANCH (REFERENCE A) 1

W, Question _440 t04 10 CFR PART S0, Appendix A states that a single failure means an occurrence which results in the loss of capacity of a component to perform its intended safety functions. In other words, a single active failure means a failure of a safety grade active i component. In CESSAR-DC, Table 15,0-4, you have provided a list l of single failures considered in your safety analyses. Confirm ,

that the components and systems listed in this table are designed to safety grade standards, Identify the items in this list that are non-safety grade and justify why a failure of these components would result in the most conservative analysis.

Response to 440,84 As has been the accepted practice of the past with respect to single failures, ABB-CE considers not only failures of the safety systems whose operation may be required, but also failures of non-safety grade systems whose failure could produce results more severe than failure of a safety system. If a non-safety grade system would help to mitigate a transient, then the analysis of that transient assumes the system is in the manual mode of operation. Non-safety grade systems are assumed to be in the automatic mode of operation if the system makes the consequences of a transient more adverse.

Therefore, the purpose of the single failure list is to identify the single failures which could create the most adverse conditions during a given transient, regardless of the safety grade status of that component or system. In most cases, the automatic action of safety grade systems overrides the operation of non-safety systems. The justification for choosing the most limiting single failure is explained in the individual analyses of Chapter 15.

Addressing the question as to which systema and components in Table 15.0-4 that are safety grade, the following list in provided:

Main Feedwater System Main Feedwater Isolation Valve, Back-Flow Check Valve l Main Steam System l Main Steam Isolation Valve, Atmempheric Dump Valve, l Main Steam Safety Valve Emergency Feedwater System l

Emergency Feed Pump (Motor and Steam Driven) t Safety Injection System SI Pump Electrical Power Sources Emergency Diesel Generator l

9ma* ,

Questien 440.85 CESSAR-DC, Table 15.0-4 states that a loss of offsite power greater than 3 seconds after turbine trip caused by reactor trip is considered as a single failure in your accident analyses. It is the staff position that a loss of offsite power ( Loop) should be assumed coincident with a reactor trip / turbine trip following an accident and a single failure of a safety grade active component is assumed to obtain the most limiting consequences of the event. The purpose of these licensing analyses is to document the bounding cases of design basis accidents that the System 80+ design could encounter with sufficient safety margin.

It is noted that in the design of operating reactors, there may be a few cases that a mechanistic approach of LOOP following a turbine trip with time delay is assumed in their safety analyses.

The staff considers that it is not prudent to use this compromised assumption in the design of advanced reactors which are expected to offer further defense in depth for public health and safety.

Response 440.85 We agree with the need for increased safety in future plants and for conservative, bounding analyses in Chapter 15. For this reason, the System 80+ design includes several enhancements to plant safety. A few of.the major improvements are: 1) increased thermal margin during normal operation, 2) addition of a safety-grade Safety Depressurization System, 3) placement of the refueling water storage tank inside containment to minimize switch-over valving and to provide decontamination of releases from the pressurizer, 4) lower operating temperatures and increased corrosion-resistant S/G tube material, 5) a redesigned electrical power distribution system, including two separate sources of offsite power and an onsite alternate AC source (gas turbine) and 6) increased redundancy in the components of the emergency safeguards systems, of special importance in the redesign of the electrical distribution system is the addition of a turbine generator breaker between the generator and the main transformer. This breaker opens upon turbine trip and, thus, avoids the need to l " fast transfer" the source of power to the reactor coolant pump buses from the main transformer to an alternate transformer.

i Because the system 80+ clectrical system design does not include

" fast transfer" of the reactor coolant pump buses after a turbine trip, there is no failure to fast transfer and, hence, there is no interruption of power to the pumps. The time delay indicated l in this RAI, therefore, is considered to be infinitely long and the assumed 3-second delay is extremely conservative.

The use of a 3 second time delay between turbine trip caused by reactor trip and loss of offsite power is based on technical data

W, that was derived from a report on actual grid response times.

The ceport LD-82-040, dated March 31, 1982 submitted to the NRC on Docket No.: STN-50-470 demonotrated that, due to the physical characteristics of U.S. electrical power grids that the time to i loss of offsite power following a turbine trip exceeds 3 seconds even for the worst case grid within the U.S. In light of this report, the conservatisms assumed in deriving the 3.0 second time delay, the addition of a turbine generator breaker to the electrical system design, and the order-of-magnitude improvement in System 80+ core damage frequency, the use of this time delay in our analyses is conservative and justified.

l

a.~sseP.

Ouestion 440.86(dl In CESSAR-DC, Chapter 15, expand the sequence of event descriptions of the limiting transients and accidents in each event category, include the following:

d) For condition II events (Moderate Frequency Events), provide transient DNB curves to demonstrate that the acceptance critoria for this class of event are met with sufficient margin and the final etabilized condition has been reached within the analyzed time period.

E_e_DP_ oils e 4 4 0. 8 6 (d1 Per the requirements of Reference 1, all moderate frequency events are considered in Chapter 15 of CESSAR-DC. The justification for choosing the most limiting event to be analyzed is presented in the " Analysis of Effects and Consequences" section of each Chapter 15 ovent. The following table lists the most limiting event for each Chapter 15 category, along with the associated figure number of the DNBR curve. The DNBR plot for Loss of Condenser Vacuum without LOC' is provid(d in Figure 1 of this response. For the PLCS malfunct I without LOOP, the DNBR plot for PLCS with LOOP is provided in Figure 2, as this condition is bounding. These curves demonstrate that the acceptance criteria for these events are act with sufficient margin and the final stabilized condition has been reached within the analyzed time period.

Reference:

1) NUREG-0800, " Standard Review Plan for the Review of Safety "

Analysis Reports for Nuclear Power Plants," as revised through 6/87.

RESPONSE 440.86(d) (Continued)

DNBk CURVE CATEGORY LIMITING MODERATE FRE_QUENCY EVENT (FIGUEE)

Increase in Heat Removal by Inadvertent Opening of an Atmosphere if 4 - 1.15 Secondary System (Section 15.1) Dump Valve Decrease Heat Renoval by Loss of Condenser Vacuum without LOOP Figure 1 Secondary system (Section 15.2)

Decrease in Reactor Coolant Total Loss of Reactor Coolant Flow 15.3.1 - 8 Flow Rate (Section 15.3)

Reactivity and Power Single CEA Drop 15.4.3 - 5 Distribution Anomalies (Section 15.4)

Increase in RCS Inventory PLCS Malfunction without LOOP Figure 2 (Section 15.5)

Decrease in RCS Inventory None Applicable None (Section 15.6)

Radioactive Material Release None Applicable None from a Subsystem or Component (Section 15.7)

0 2

i i 8 1

i i

6 1

i i 4 1

i 2

i 1 P i 1 O S O

L D 0 N ET U i 1 O C

R0 E UTaW l

i S

E.

G V I

i8 MI FOCL i T

i6 i

i4 i

i2 i

,O 8 7 6 5 4 3 2 1 0 232z2 ieZQ t

O e

hQ l

\';

O

~O LD 4

9 ,

O., -

n.

O '

o b

(N Nw m o

LU 5 5

[5 8 m

3z ~

O W

i=

1 '

8 a

G.

O

-o N ~

t I I I I I

-O to o + n N g- o W n W int W ' H 8 N Cl

,We Q1Lo#1.i._9n 4 4 0,0 6 (ol Identify tho most limiting eingle failure used for the analysis cf each event with respect to the acceptanco criteria of the event (o g., peak pressure, DHD, radiological consequences).

RosDongg 4 40 281.(o1 The following table lista the single failure assumptiens made with respect to each acceptanco critorion for each initiating event. In addition to the single failure listed, the most reactive CF.A is stuckout as required by the SRP. The eventa listed are the most limiting accident ano the most limiting anticipatcd operational occurrence in each of the novon initiating event categories given in Section 15.0.1.2.

"Nono" indicated in the table under the "Accumed Singlo Failuro" means that none of the postulated single failures woro found to adversely affect the recults rolovant to the listed "Accaptanco Critoria."

4

s:

TABLE 440.86((t)

CESSAR-DC ACCEPTAIICE ASSUMED SINGLE SECTION NO EVENT !!AME _ChiTFRIA FAILURE Increase in Heat Renoval By the Secondary Systen 15.1.4 Inadvertent Opening of a DNBR Loss of CEDMC Reactor Steam Generator Relief or Tripped Signal which Safety Valve Results in Loss of Turbine Trip and Failure to Cutback Feedwater Flow.

15.1.5 Stean Systen Piping DN3R None Failures Inside and Outside Dose None Containment Decrease in Heat Renoval by the Secondary Systen 15.2.3 Loss of Condenser Vacuun Peak Pressure Loss of Offsite Power DNBR Loss of Offsite Power Dose Loss of Offsite Power 15.2.8 Ft. e ' water Systen Pipe DNBR Loss of Offsite Power Br aks Peak Pressure Loss of Offsite Power Long Tern Decay Failure of One Hear Renoval Energency Feedwatcr Punp to Start Decrease in Reactor Coolant Flo-15.3.1 Total Loss of Reactor DNBR None Coolant Flow Peak Pressure None 15.3.3 Reactor Coolant Purp Locked DNBR None Rotor with Loss of Offsite Peak Pressure None Power Dose Stuck Open Atnospheric Derp Valve

TABLE 440.86fe) (cont.)

CESSAR-DC -

ACCEPTANCE ASSLMED SINGLE

_SJCTION NO EVENT NAME CRITERIA FAILL72 Reactivity and Power Distribution Anomalies 15.4.3 Single CEA Drcp DNBR None Kw/ft None 15,6.4 Startup of an Inactive Pump Peak Pressure None 15.4.6 . ' advertent Deboration Shutdown Margin None 15.4.8 CEA Ejection Fuel Enthalpy None DNBR None Dose Lo<ts of Offsite Power Peak Pressure Loss of Offsite Power Increase in RCS Inventory 15.5.1 Inadvertent Operation of Reactor Coolant Fone Lne ECCS Syste= Temperature Pressure Limits 15.5.2 CVCS Malfunction- Peak Pressure Loss of Offsite Power Pressurizer Level and DNER Loss of Offsite Power Jontrol Systen Malfunction Decrease in RCS Inventory 15.6.5 Loss of Coolant Accident Dose Failure of One Energency Generator to Start Radioactive Material Release from a Subsysten or Component 15.7.3 Postulated Radioactive Dose No-Releases Due to Liquid Containing Tank Failures 15.7.4 Fuel Handling Accident Dose Nane

Q11 cat 191L 33Lf'_O.L.91 Provido the basis for tho annumption of the tino delay (0.8 acconda) betwoon the trip breaker opening a: d the starting of Cim l

Motion. Are thoro any testing data to validate this accumption?

Rtenoant i h el Tho annumption of a ma:cimum timo dolay of 0.8 socc,. do betwoon the trip bruaker opening and the initiation of CEA motion was derived from rod drop tests performed during startup testing at the Allo-2 (Cycle 7), pV14GS-1 and SO!1GS-3 (Cycle 4) plants. The maximum delay timon woro obnorved to bo longer when tooting was done with the almultaneous tripping of all C1mo compared to individual CEAs. The tout resulto showed delay timos from 0.49 to 0.80 occondo. The variation la caused by differencon in the cloctrical circuit design which producen difforont CEDM coil voltaga docay timos. The circuit design for System 804 in expected to yield a 0.49 occond delay. Thorofore, the Syt, o 20+

safety analynis coi) decay timo delay of 0.8 coconds la conservativo.

I i

Qvent ion 440EL_{1LS1 Provido the basis for the nouumption of t.ho timo period requf: cod (3.66 coconds) for 90 percent CEA insortion in the roactor cc.,;co.

Discuss the adequacy of 90 porcent CEA in30rtlon for a reactor trip relativo to the required shutdown margin.

Ibisp_ongo 4 4 0. 8 0 Under worst caso conditions, the required scram time for an individual CEA from olectrical power interruption to 901 insertion in 4.0 noconda. This in reprononted by the acceptanco curvo in rigure 4D-4 of Appendix 4B. Also, thin figure illustraton that the timo period betwoon the athrting of CEA motion and 90 porcent insertion in the reactor core in 3.66 nocondo.

90% CEA incertion in unod for octablinhing requiromonto for rato of insortion (sco Section 4.2 and Appendix 4B). Ilowever, 100%

required shutdown margin corresponds to 100% CEA incertion. Note that the required chutdown margin for the caroty analycon conservntively assumen that the highant worth CCA does not insort.

I

QR0ilt3.9n_idL M Discuan the NRC review status of all the cornputer codos used in the transient and accident analynou docutuonted in CESSAll-DC.

EMDR9DUoJ.L% M All of the codos used to perforan tho safety analynon in CESSAR-DC are approved by the NRC.

The following table, 440.09-1 lista the codea, their purposo, documentation and NRC review status of the computer codoo unod in the transient and accident analyseo documented in CESSAR-DC.

l 1

TAllLE 440.89-1 C.9MEUTI:1LHOD1;LD NQ11-L997LANALYpj:0.

.CODlin PERE 001: DOC 11NURTAT10N HRC E EEQYAL CESEC III Dotormino HSSS LD-82-001 YES Thermal-llydraulic (Ref. 1) (Ref. 2)

Behavior CETOP-D Datormino DN11R CENPD-162-P; YES Transient CEN-160-S-P (Ref. 3)

(Rev. 1) ;

TORC Dotormino DNBR CENPD-161-P; YES Transient CEllPD-2 06 P (Ref. 4)

IIERMITE Dotormino lloactor CE!1PD-188 YES Coro Responno (Ref. 5)

COAST Datormino Reactor CENPD-98 YES Coolant Flo** (Ref. 6)

Coactdown Raton STRIKIH II Dotormino l'uol CEllPD-13 5 ; (YES Thermal Behavior CENPD-135, (Ref. 7)

Including DN11R and SUPPL.-2,4 Potential for l'uol Failure 4

gs%

l TAllLE 440.09-1 (Continued)

ROMPUTJ;R.JiODim0 RONTMNMl;NT_ANALYUJ 4 RQDES FUREODJi D0QVMUNTATION NRCJ PPRQYAL CEFLEsti-4A Dotormino liSSS CI:llPD-13 3 P; YES Thermal-llydraulio CEl1PD-13 3 P , (Ito f . 8, 9)

I3chavior During SUPPL.-2,3-P, Illowdown Phano 5-P FLOOD-MOD 2 Dotorminen lloflood Itopor t , Acrojet YI:S Mann & Encrgy liuoloar Company (Ito f . 10)

Itolonno llaten (lto f . 10)

SG!lII I Dotormino Hann & CESSAlt - PSAR YES Energy Rolcanon to December 1975 (Ref. II)

Containment Via SLila COMPERC-11 Determino Mann & CEllPD-13 4 ; Yl:S Energy itelonnon to C EtiPD-13 4 , (not. 8, 9)

Containment During SUPPL.-1,2 Rafill/Reflood Phano ColiTRAllS Determinen CI:11PD-14 0A YES Containment (Ito f . 12)

Pronnura and Temperaturo Tranniento

4 4 o TA13bE 440.89-1 (Continued)

COMITTEILMotllma AAB93_EBlihlLLQCh_hMALYDID.

CODEG EMBEQEH DQQFRENTATION NEQ_AEPR91AL CEFLESil-4A Dotormino HSSS CENPD-133P; YES Thermal-flydraulic CENPD-133P, (Ref. 8, 9) 13chavior During SUPPL.-2,4-P, Blowdown Phaco 5-P COMPERC-II Dotornin.a NSSS CI:NPD-13 4 ; YES Thermal-llydraulic CENPD-134, (Ref. 8, 9) 13chavior and SUPPL.-1,2 Containment.

Pressuro During Itofill/Reflood Phano STRIKIN-II Dotorminos Puol Rod CEllPD-13 5 ; YES licatup and C EllPD- 13 5, (Ref. 8, 13, Roaulting Fuel and SUPPL.-2,4,5-P 14)

Clad Temperaturen FATES 3 Determinco Fuol' CENPD-139; YES Performanco CEN-161 (11) -P (Ref. 15, 16)

Parametern (e.g.,

Gap Conductivity)

PARCil Dotorminos Steam CENPD-138; YES Cooling Ileat CEllPD- 13 8 , (Ref. 8, 9, Transfer SUPPL.-1; 17)

Coefficiento During LD-81-095 Reflood Phase llCRO'SS Determinou Steam LD-81-095 YES Flow Raton During (Ref. 9)

Reflood Phano COMZIRC Dotorminos Cladding CENPD-134; YES Oxidation CENPD-134, (Ref. 8)

SUPPL.-1,2 l

l l

l

~ . _ __ - . - , _ -

1. % t TAllLE 440.89-1 (Continued)

COMINTEILMQnHI41 f1MAM(_11RRAILJeSh_ANALJEIR E0 DER ITRPOE DROM ENIAT19H HRO._AITRQYAL CEPLESil- Datormirio NSSS CENPD-133, YE!!

4AS Thermal-llydraulic SUPPL.-1,4 (Itof. 8, 18) 5)ohavior During 1110wdown Phase COMPERC-Il Dotorminos NSSS CENPD-134; YES Thermal-llydraulic CENPD-l'J 4 , (Ref. 8, 9)

Behavior During SU PPL. -1, 2 Reflood Phase STRIKIN-II Determinco Fuel Rod CENPD-135; YES '

lleatup and CEMPD-135, (Ref. 8, 13, Roculting Fuel and n')PPL. -2 , 4 , 5-P 14)

Clad Temperaturca FATES 3 Dotorminoo Puol CENPD-139; YES Performance CEN- 161 ( 11) -P (ller. IS, 16)

Paramotorn (o.g.,

Gap Conductivity)

PARCil Dotorminos Puol Rod CENPD-138; YES Ilontup During Pool CENPD-138, (Ref. 8, 17)

Dolling Conditionn SUPPL.-1,2 (Af ter RCP Trip) m----. _____. , .,. ,

t A d.

Rej!pgr1Do_ALO_t.01 REFERENCESt

1. LD-82-001, "CESEC Digital Simulation of a Combustion Engineering Huclear Steam Supply System", Enclosuro 1-P to Lotter from A.E. Schoror (C-E) to D.G. Eisenhut (USNRC),

January 1, 1982.

2. TAC No. 01142, Safety Evaluation Report, "CESEC Dig 4tal Simulation of a Combustion Engineering Nuclear Steam Supply System", Enclosure to Lottor from C. O. Thomas (USNRC) to A. E. Schoror (C-E) , April 3, 1984.

3. " Operation of ANO-2 During Cycle 2", Lotter from R. A. Clark (USNRC) to W. Cavanaugh III (AP&L) , July 21, 1981 (Safety Evaluation and Amendment No. 26 to Facility Operating Liconue No. NPF-6 for ANO-2).

4. "Tolv .'odo--Vorification and Simplified Modeling Methods",

CENPD-206-P-A, June 1981. (NRC Approval Lottor dated December 11,-1980).

5. CENPD-188-A, "HERMITE A Multi-Dir.ensional Spaco-Timo Kinetics Code for PWR Transients", March 1976, Repr3nted July, 1976. (NRC Approval Intter dated June 10, 1976).

6. CENPD-98-A, " COAST Codo Description", April, 1973, (NRC Approval Lotter dated December 4, 1974).

7. CENPD-190-A "C-E Method for Control Element Assembly Ejection Analysis", January,1976. (NRC Approval Lotter dated June 10, 1976).

8. Lotter, O. D. Parr (NRC) to F. M. Storr. (C-E) , June 13, 1975.

9. Lotter, D. M. Crutchfield (NRC) to A. E. Schoror (C-E) , July 31, 1986.

10. UFLOOD/ MOD 2-A Code to Dotormine the Coro Reflood Rato for a PWR Plant with Two Coro Vescol Outlet Logo and Four Coro Vousel Inlet Logs", Interim Report, Aerojet Nuclear Company, November 2, 19'72.

11. "Doncription of the SGNIII Digital Computer Codo Used in Developing Main Steam Line Eroak Mass / Energy Holeano Data for Containment Analysis", CESSAR-PSAR Appendix 6B, SER Docket No. STN50-470, December, 1975.

12. CENPD-140-A, "Doscription of the CONTRANa Nigital Computer Code for Containment Prosauro and Tempora dro Transient Analysis", April, 1976. (HRC Approval Letter dated April 6, 1976).

. - - - - .~ --- . . - - _ - -

9 s

• RonnonsJL11P_d2

13. Lottor, K. Kniel (NRC) to A. E. Schorurr (C-E), November 12, 1976.

14. Lotter, R.L. Baer (NRC) to A.E. Schoror (C-E) , September 6, 1978.

15. Lotter, O.D. Parr (NRC) to F.M. Stern (C-E), December 4, 1974.

16. Lotter, R.A. C1 ( (NRC) to A.E. Lundvall, Jr. (DG&E), March 31, 1983.

17. Lotter, K. Knlol (NRC) to A.E. Scherer (C-E) , April 10, 1978.

18. Letter, K. Enlol (NRC) to A.E. Schoror (C-E) , September 27, 1977.

I e

s s '.

Question 440.90. 450.Q1 (15.0)

A moderato frequency event in combination with any single active component failure, or single operator error, shall be considered as an infrequent event for which an estimate of the number of potential fuel failures shall be provided and the radiological consequences should be calculated. For such events, fuel failure must be assumed for all rods for which the DNBR falla below 1.24.

The radiological consequences of the infrequent event should not exceed a small fraction of 10 CFR 100 limits. Confirm that the above acceptance critoria are used in assessment of the infrequent events for the System 80+ design.

Response 440.90. 450,01 Improved safety of the System 80+ design is summarized in the response to RAI 440.85. In the design-basis safety analysis of i System 80+, one of the primary ground rules was the use of previously used and approved analysis methodology. Combustion Engineering is aware of the Standard Review Plan's guidance on the DNBR criterion for assumed fuel failures and,also, the need to justify deviations. The justification which shows the conservatism of the DNB convolution technique was provided during the previous review of the System 80 design (docket No. 50-470).

NRC's review was summarized in the Safety Evaluation Report (NUREG-0852 and Supplement 1). The description and justification of the C-E method was provided in response to RAI 440.35 (Ref. 1) for CESSAR System 80 and approved for PVNGS-3 Cycle 3 (Ref. 2).

. Per the Standard Review Plan, radiological consequences were calculated for infrequent events which resulted in. fuel damage.

The only infrequent event resulting.in fuel damage was a loss of condenser vtcuum with a subsequent loss of offsito power. In section 15.2.3 of CESSAR-DC, this event was shown to meet the criterion of a small fraction of 10 CFR 100 limits.

References

1. C-E Letter LD-81-047, dated August 20, 1981.

2. Amendment 26 to Palo Verde Unit 3 Operating License.

y,y..-p-r-e,,g- W.,y-y,,,,,---,.,,--,,s_,.,,.m,,,c,-,,,-w,,_,,,..y,,,,9.-we-,yy,w-,,,,,_,,yy,,.w-r,_-#.,,,~-c.m,-.,.,y.y.-_,m~,,p.- .py,__,,m.,y,_,c-,.p.,-,__y.,c,,9..,. , , . -

t s i  !

l l

Quentina 440.92 The scheme of food only good steam generator (l'oGS) han boon i eliminated in the Syntom 80+ design. So upon a nocondary break,  ;

steam or foodwater line break, you are going to continue to dump l emergency foodwater into the broken steam generator in the Syntom 80+ donign. Discuan the merits of thin donign change from the '

previoun CE donign in light of accident recovery and mitigation.

Eenponno 440.92 A manually actuated emergency feedwater (EEN) isolation system- l Was selected for System 80+ after a donign roannonoment prompted i by Generic Safety Innuo (GSI) 125.11.07 in NUREG-0933 was conducted.

A manual isolation oystem significantly simplifies the EFH actuation logic and was found to have an acceptable offect on the safety analyson.

A discunnion of the of facts of thin denign chango 1.n provided in Appendix A of CESSAR-DC.

I e

a I

l 1

i

1 s Quention_dALSJ_(1LLJ1 Provida the results of an analyain of a pontulated fail open event of all turbine bypana valvoa duo to a ningle malfunction in the cloctrical system. This event should be treated an an avont with moderato frequency of occurrenco. The nood of this analyula in due to plant operating exporloncos from the Palo Verdo plant whero a control syntom failuro caunod all.nteam dump valvon to open.

Responno 440.91 The two incidents at the Palo Vordo plant in which multiple in-norvice turbino bypana valvoo opened due to a ningle failure resulted from the olcatrical crono-connection of multiplo instrument signal loopa in the Balance of Plant (BOP) portion of tho instrumentation system. NSSS intorraco requiremonta documents required that indopondent signals be input to the SDCS.

In both cason, a common connection betwoon input signaln existed, which was not conalatont with the NSSS interfaco requiremonto.

The System 80+ doolgn neopo includon the portions of instrument signal loop interfaces which woro formerly BOP scopo. Common connections do not exist in-the Syntom 80+ dealgn. The func~

tional design of the SBCS f or NUPLEX 804 10 equivalent to that of Palo Verdo. This ovent can thuu be-considered to be non-credible as caused by a ningle failure, llanco, thoro in no nood for its analysis.

l l

l t s ? I l

l Quqution 440.94  !

I CES SAll-DC, Section 15.1.4 indicaton that in the infrequent event j of inadvertent opening of a steam gonorator_ atmospheric dump valve with single failure, the loan of control olomont drivo mechanism control (CEDMC) is annumed an the limiting ninglo I failure. Ilowever, the CEDMC an doucribed in CESSMt-DC, Chaptor 7 l in not a safoty related nyatom. Thun, a failure of a cafety ,

grado activo componoht should be annumed on top of the failure of i (or r.on-credit for) non-nafoty grado ayatoma in the analynin of l thin ovent.

Responso 440.94 As was stated in responao to HitC quantion 440.84, tha v 1 dotormination of a single failure was based upon that failure which created the most limiting aconario for the given trannient,  ;

regardlons of whether the ayatom 10 caroty related or not. Thus, in consideration of the inadvortent opening of a otoam generator i ADV with a single failure event, the most limiting ningle failuro na described in section 15.1.4.1 of CESSAlt-DC in the loan of the CEDMC trip signal. L e

e h

E a

b i

1

---++.-vw, -

w-,e-,-..w ,m e.-r -w -, ,,+<wc--* pre.., ,,---.-.ar.r--.-.ie~~w%,- =me.-em,-y,.s-w., y y%-e_te--+,---,.y y.r--,.s+--, .c--e--e--<

$ 6 i Question 440.95. 4 5 0._Q2 Provido a diacussion of why the following cason are not analyzed in CESSAR-DC, Section 15.1.5 relativo to radiological consequences:

a) A steam line break outside of ccatainment upstream of the main steam isolation valvo (MSIV) during full power operation with concurrent less of offnito power in combination with a single failure, steam generator tubo leakage at the allowable limit of the technical specifications, and a stuck CEA.

b) A steam line break outsido of containment upstream of the MSIV during zero power operation with offsito power available in combination with a single failure, steam generator tubo leakago at tno allowablo limit of the technical specifications and a stuck CEA.

ResILQ.line 44Od L 450.OR a) This full power steam line break caso is not presented in CESSAR-DC because the event consequences are bounded by the event with A-C power available. The case with A-C available bounds the loss of offsito power case because reactor trip is delayed, which causes greater degradation of DNDR and, hence, larger radiological dosos, b) This zero power steam l'ao break caso, with offsito power availabic produced the same radiological dono results as the corresponding case without offsito power. Both casos resulted in donos which are a small fraction of 10CFR100 guidelines. In addition, the zero power casos are bounded by the full power SLB outside of containment case.

4 e *.

Qtton.tlpn_41QJLfu 450.01 CESSAlt-DC Section 15.1.5 states that the ovaluation shown that for the full and zero power steam line break (SLil) without loss of offsito power (Canos 2 and 4), the most advorno offect in caunod by failuro of a MSIV to close on one of the otoam linea on the intact steam generator following a main steam loolation uignal (MSIS). Consequently, thono casco asuumo stoaa continuon to be rolcaned from the intact atoam generator after MSIS at a rate of a maximum of Il percent of plant doolgn utonm flow rato.

Asnuming failure of non-safoty grado luolation valven (including the turbine stop valvou) downstream of the safety grado MSIV, what la the rato of steam relcano from the intact steam generator after a M91S? Ansona the radiological consequences of the uvent scenario.

&c.DDDRER 4AL% MD.&1 fho responao to ItAI 449.04 discusson the approach tahon to colect single failures. Multiple failures are not conaldered in Chapter 15.

Steam Line Dreaks accompanied by multiplo failures aro included an part of the Probabilistic Fisk Aspecsment summarized in Appendix 13 of CESSAIt-DC. -

t o *.

QRREt1RIl 119 dQ CESSAR-DC Section 15.1.5 states that for a SLB outside the containment apatream of the MSIV, a failure of the MSIV in the steam 1ino connecting the intact steam generator will not affeet the radiological consequences of the event. Provido the results of a reanalynia of theso events assuscing failure of ono MSIV in the stonm lino connecting the intact steam generator and failure of all the non-cafety grado isolation valves (including turbine stop valvo) downstream of the MSIva, a

REllRRI1Eo 41E dB The radiological consequences of the SLD outsido containment upstream of the MSIV would not be affected by the failure of a main steam isolation valvo in the intact steam generator. The radiological consequences for this event conservatively assumo that after the ruptured steam generator _ blowdown endn, the plant honto up to hot standby conditions (565 F) after which the operator initiates an orderly cooldown to shutdown cooling entry conditions by rolensing steam to the environment through the ADVs. If an MSIV in the intact S/G were to fail, then the steam releasca to the environment would be less than those calculated without the fniluro since the plant would not heat back up to hot standby conditions. Therefore, tho sensiblo heat to be removed from the RCS to achievo shutdown cooling conditions would be lower. Hence, the radiological consequences would be reduced.

See also the response to RAI 440.96.

. . = _

- -. = -. --- . - - - - . - - - . .---_-. . - - . -_ - _ - _ _ _ - - - .- - -- ..-._ .

i o ;

Q91R.kl_9A_.$.19.d.1

~

CESSAR-DC Tables 15.1.5-7 and 15.1.5-10 indicate that the assumed initial steam generator liquid inventory for a SLB outside the containment is less than one half of the steam generator liquid inventory assumed for a SLB inside the containment with essentially similar event scenario. Discuss why these assumptions are conservative for those analyzed cases considering an assumed high steam generator liquid inventory may result in high doses to the environment following a SLB outside the containment.

Rmangase 44o.91 The reason for different steam generator (SG) liquid inventories between steam line break (SLB) inside and outside containment analyses is due to the objective of those analyses.- For a SLB inside containment, the objective is to maximize the possibility of poat-trip return to power. For a SLB outsido containment, the objective is to maximize pre-trip degradation in DNBR. For the latter case, this is achieved through minimizing SG liquid inventory. The impact of reduced SG inventory during a SLB maximizes the initial rate of SG depressurization and temperature reduction, which in turn maximizns RCS cooldown rate. The maximum cooldown rate of the Rf;$ creates the most rapid power increase due to reactivity feedback. This results in a more rapid decrease in DNBR and, her.ce, a larger amount of assumed fuel damage. Since the dose is driven by the radicactivity -

associated with the Tech Spec tube leak, this scenario proved to be the most limiting for doses to the environment following a SLB outside the containment.

l I

sgym* rw-------.ew--y - -

p--

t

• 1 Quqitjon 440 Iql (15.2J1 '

CESSAR DC Section 15.2.3 indicates that in an event of loss of condenser vacuum with a single failure, the maximum number of fuel pins calculated to experience DNB is no greater than 1.8 percent.

Confirm for the above assessment that all fuel pins with a transient '

DNBR below 1.24 are assumed to experience DNB and fuel failure for the purpose of calculating radiological consequences, flesponse 440.101 fl5.2.31 ..

See the response to RAI 450.01, 440.90 for a discussion on determining '

the number of fuel pins which experience DNB and fuel failure.

t 4

h I  !

~ , - , . -. -. . - - ,. . - . - . _.. - -- - .- - -

- - - - - _ - . . - . - . _ - . - - -. ~ . . - = . . . .

l 1

• 1 1

P'tq1}1[gp 440.102 ( 15. 2 . (1 },

l The analysis of a postulated main foodwater lino break accident I prosented in CESSAR-DC Section 15.2.0 in not sufficiently conservative with respect to the tino annumed for a loan of of f aite power (LOOP), alngle f ailuro, etc. Provido the ronultu of a roanalysis of this event considering a LOOP coincident with ,

i reactor trip /turhino trip. A moot limiting failuro auch an a  !

failure of-a diocol, one train of tho auxiliary foottwatnr nyatom, l otc. , should be conoidorod in thin analynia. ,

Eennonno 440.102 (15.2.8)

For information on the timing of loon of offalto power, 000 the rouponno to RAI 440.05.- With roopoet to the limiting ninglo failuro, Section 15.2.8.3 D of CESSAR-DC discunnon the limiting single failuro assumed for the foodwater lino break analynin.

This failure was the failure of ono Emergency Foodwater Pump to t start.

t h

i e

k h

j.

l l

l

--e--- , w ore----,&Wyr-em,,,,.,.-,-m-,c--,.m.,,.,,,.--.w.nv..w.--c---,=.,s.y,w.,- .-,-......,,r-~.mn. wee-..-ev4._,m.--w..er---w-.-ewww.*T-e<**---5--**.e--<-~-+c+w-eowgaw -==v-

l

. e ;

1 QticD110tLiiOx102 ""  !

The analysis of a postulated single reactor coolant pump (RCP) rotor ,

seizuro ovent prosented in CESSAR-DC Section 15.3.3 is not suffi-  !

ciently conservativo with respect to the timo assumod for a loss of offsito power (boop), the timo porlod for a stuck open ADV, etc.  !

Provido the results of a reanalysis of this event considering a loss '

of offsito 'aower (bOOp) coincident with a reactor trip /turbino trip following tio event in!tiation. In calculating the total ADV opening timo for the failed ADV, tho 30 minuto operator action to close the block valvo upstream of the failed ADV should begin from the time of flipInyfring t1e failuro status when the subject ADV is required to closo. This oart of the scenario is described proporly in the t analvsis of the SGTR ovent prosonted in CESSAR-DC Section 15.6.3. i Hennenno 440.102 In the analysis of a postulated singlo reactor coolant pump (RCP) seizuro event, the timo delay betwoon turbino trip and loss of offsito power was assumed to be 3.0 seconds. This delay timo is conservativo and a further discussion of this value is presented in the response to RAI 440.85.

Tho- second part of this question concerns the olapaud time the ADV is assumed to ao eponed and "when" the ADV was discovorod to be stuck in the opon position; honco, alerting the oporator to close the ADV block valvo. In the SGTR ovent prosented in CESSAR-DC Section 15.6.3, the incentivo for glosing the ADV was that the RCS temperature had boon reduced to 550 F, thus proventing any further cycling of the MSSV's.

Using a like argument for the Locked Rotor evogt, the elapsod timo betwoon_ADV opening and the RCS cooling to 550 F is about 1455 seconds. At this point the operator would attempt to isolate the ADV and in doing so would becomo awaro that the ADV is stuck becauso a valvo positioning indicator would alert him to this fact. Tho next stop would be to close the block valvo upstream of the stuck ADV. Tho timo nocessary to complete-one discreto manipulation (i.e., close block valvo) during a Plant Condition 2 ovent (por Hoforonco 1) is one minuto.- Thorofore, the total clapsed time would realistically be about 1515 seconds. As can bo soon by the Locked Rotor analysis presented in CESSAR-DC Section 15.3.3, the analysis conservatively assumos the total elapsed tino to be 30 minutos. However, if it was assumod that the ADV was permitted to roloaso stoam for an additional 30 minutos over and above the already conservativo-timo period assumed in tho analysis, it is estimated that the corresponding donos will be much loss than 10CFR100 guidelinos.

Hoforenco:

i 1. American National Standard Timo Responso Design Critoria for Nuclear Safety Related operator-Actions,- ANSI /ANS-58.0 - 1984.

i

• i Qu eAtisn._4&lE__410ALIEL.11.

CE has indicated in March 6, 1991 ACRS meeting on System 804 design that the radiological consequences of a utcam generator tube rupture for the System 80 design is much higher than that for System 80+ design. This is because the Chi over Q value used for System 80 dose calculation is about five times higher than tnat used for System 80+ design. Discuss the discrepancy of these assumptions considering the System 80+ design could be built in the areas with the highest Chi over Q value. Provide appropriate interface criteria to ensure that site parameters do not exceed System 80+ analysis assumptions in this area.

Ee>P931 sal 4 LIE _i50 06 ih6M).

The value of the 2-hour atmospheric dispersion factor at the exclusion area boundary (EAB), Chi over Q, was calculated for System 30 assuming the atmospheric diffusion model recommended in Section C.2.g. of Regulatory Guide 1.4, Revision 2.

Acceptable tssumptions, in Section C.2.a. of the Regulatory Guide, for Odditional dispersion produced by the turbulent wake of the reactor building were consarvatively omitted in the System 80 calculation. Had they been included, the 2-hour dose at the Exclusion Area Boundary (EAB) could have been lower by a factor of three, assuming a System 80+ size reactor building.

The value of 2 hour2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> Chi over Q at the EAB for System 80+ was calculated assuming the same generic atmospheric conditions recommended in Regulatory Guide 1.4, but employing the methodology specifically recommended in Section C.1.3.1 of the later Regulatory Guide 1.145, Revision 1. This later methodology additional plume spread with meander justified in accounts for,fy puido and also includes building wake effects.

the Regulatt The combinedychfect is expressed as " Correction Factor M" of Figure 3 of h For the Pasquill Type F atmospheric s(e,h:ulatory bility conditions Guide 1.145.

at a wind speed of 1 meter /sec assumed in evdluating the 2-hour EAB dose, this correction factor reduces Chi over Q by a factor of about 4. It is the cause of 4 on System 80 to 4.97x10 4 the decrease in Chi over Q from 2x10 on System 80+, as presented at the March 6, 1991 ACRS meeting.

In conclusion, the deviation between the System 80 and System 80+

Chi over Q at the EAD is due to methodology and not a difference in assumed site meterology or EAD size. The linitations on site location (i.e., interface requirements) are addressed in Sections 15.0.4, 2.3.4 and 2.3.5 of CESSAR DC.

)

Please note that Combustion Engineering is evaluating the desirability of increasing Chi over Q to 9.0x10 in response to industry studies on the value needed to encompass most of the plant sites in the U.S. It is expected that corresponding revisions to Chapter 15 will be provided in early 1992.

t

• i Q3gstion 440.109 ( 15. 6. 3),  !

Provide the results of an analysis for the potential boron ,

dilution ovent during the recovering phano following a SGTR when backfill from the accondary ayntom through the ruptured steam generator occurred.

llesponne 440.1Q2 ,

The System 80+ Emergency Proceduro Guidelines Will includo stops '

- to provent backfill from the accondary ayatom through the ruptured steam gonorator by maintaining a positivo pronouro  ;

difference betwoon the primary and accondary systema. Thoroforo, boron dilution should not occur and has not boon analyzed. A further noto in undo that backfill la not noconsary to provent overfilling of the larger Syntom 80+ atoam generator au the t result of a SGTR ovent. Analysin of such beyond-doulgn-banio events is included in the.probabilistic risk annonoment summarized in Appendix B of CESSAR-DC.

1 4

9 a

,~ w -,,,..,,,--,.,.g._,.. , ..gn ,r m amm ,, ,..y.__--.,_e \g., ,

s . 3 Enclosuro II to LD .

QUESTIOliS FOR WilICl! RESPO!1SES WILL BC PROVIDED SEPARATELY 440.83 440.86 a, b, c, f 440.91 440.97 440.100 440.104 440.105 (450.04) 440.106 (450.05) 440.108 (450.07) 440.110 (1), (2), (3), (4), (5), (6) 440.111 i

l 1

Enclosure 11 to

, d 5 LD 91 %2 QUESTIONS FOR WillCll RESPONSES WILL DE PROVIDED SEPARATELY 440.83 440.86 a, b, c, f 440.91 440.97 440.100 440.1M 440.105 (450.N) 440,106 (450.05) 440,108 (450.07) 440.110 (1), (2), (3), (4), (5), (6) 440.111 4 l

1 l

I 1

L

Enclosure til to

• • • 5 ,

LD 91-062 RESPONSE TO NRC REQUESTS FOR ADDITIONAL INFORMATION REAC1'OR SYSTEMS 11RANCil (REFERENCE II) l i

e .. n Cuestion 440xL12 As mentioned in RAI 440.109,-discuss the potential for boron dilution during the recovering phase following a SGTH when backfill from the secondary system through the ruptured S/G occurs. This analysis should also be provided in support of GSI-22, CESSAR-DC Section 15.4.6, etc. ...

Rosnonso 440.139 l

Tho losuo of a " potential" boron dilution resulting from a SGTR l accident was addressed in the response to RAI 440.109, i

I

[

P I

P i

)

i e

f n

5 l

l ,

e ve =- +- ,.--w,-v.vv- -.-,n -m,v---,-n- -,ewy-.--v%-ww-=m,=%-- - . - , . - , , , w-- ..~i-. w- - u-%-,.,--c.. yv.,-e.,,,w.,w-,,y,wg-.-,*e,w,--