Text

Responds to Request for Addl Info Re C-E Std SAR-Design Certification
	ML20092K964
Person / Time
Site:	05200002
Issue date:	02/14/1992
From:	Brinkman C; ABB COMBUSTION ENGINEERING NUCLEAR FUEL (FORMERLY, ASEA BROWN BOVERI, INC.
To:	; NRC OFFICE OF INFORMATION RESOURCES MANAGEMENT (IRM)
References
	LD-92-020, LD-92-20, NUDOCS 9202260092
	Download: ML20092K964 (88)
	v • d • e

_.

(

y R EDID E

PUBRD A' ( A DIMMf 4 DOVf Fil February 14, 1992 1.D 92-020 Docket No. 52 002 U. S. Nuclear llegulatmy Commission

\\ttn: Document Contral Desk Washington, DC 205f 5

Subject:

1(esponse to NI(C 1(equests for Additional Information 1(eferences:

A) lxtter, lleactor Systems liranch IIAls, T. V. Wambach (N1(C) to li. I1.

Kennedy (C E), dated February 15,1991

11) letter, lleactor Systems llranch " Als, T.V. Wambach (NitC) to li. I1.

Kennedy (C E), dated May 13,1991 C) Letter, lleactor Systems llranch IRAls, T. V. Wambach (N1(C) to E. I1.

Kennedy (C li), dated August 21,1991

Dear Sirs:

The above 1(eferences requested additional information for the NitC staff review of the Combustion lingineering Standard Safety Analysis lleport Design Certification (CESSAll-DC). linclosure I to this letter provides our responses to a number of these questions inchiding corresponding revisions to CESSAR DC. Ilesponses to the remaining questions of 1(eferences will be provided by separate correspondence.

Should you have any questions on the enclosed material, please contact me or Mr. Stan 1(itterbusch of my staff at (203) 2SS-5206.

Very truly yours, COMilUSTION ENGINElil(ING, INC.

h' t.-a -c d j C.11. Ilrinkman Acting Director Nuclear Systems Licensing vs/hv linclosures: As Stated ec: J. Trotter (EPRI) p T. Wambach (NitC) 0g

'{\\

ABB Combustion Engineering Nuclear Power on n wom,.,

n. n n-u. n un w,

02 A

PDR

_ - _ m. -. - - _

Enclosure I to LD 92 020 ItESI'ONSli TO NRC llEOUliSTS FOlt ADDITIONAL INFORMATION REACTOR SYSTEMS BRANCil L

DVLSIl01{440.41 CESSAR DC Section 5.2.2.4.3.3 states that the main steam safety valves (MSSVs)aredesignedtooperatgintheenvironmentalconditionswith the maximum temperature of 330 f for 3 minutes following a main steam line break accident.

Provide a temperature profile for the compart-ment housing the MSSVs during a design basis main steam line break accident to support the assumptions made in the 2nvironmental conditions.

R[1PONSE 440.41 Each steam generator has its own main steam valve compartment housing.

If a main steam line breaks inside one of the main steam valve compart-ments, the pressure of the associated steam generator would drop.

Consecuently, the MSSVs on the affected steam generator would not be callec upon to open. After the affected steam generator blows down, decay heat would be removed via HSSVs and safety related ADVs on the unaffected steam generator. Since the affected main steam valve compartment does not interact with the intact main steam valve compartment, the temperature in the intact compartment 'will Always a

remain below 330 f.

.Y N

g

~

a e

t t

t a

i l

Question 440_.42 The statement made in CESSAR DC section $.2.2.10.1.1 regarding operator action for low temperature overpressure protection (LTLP) is not clear.

Discuss operator actions necessary during transients involving LTOP, including instrumentation and operating procedures available that ensure proper operator actions for mitigation of the translents.

i i

Btustonse The operator action referred to in CESSAR DC section 5.2.2.10.1.1 concerns an assumption that is made in the mass and energy addit. ion transient analysis discussed in section 5.2.2.10.2.1.

The assumption is strictly made for analysis and does not suggest any requirements by the operator or limitations on equipment.

Since the results of these transient analyses show that the system pressure reaches an equilibrium within several minutes, the I

assumption of no operator action for 10 minutes in tbe analysis is reasonable, k

l 1

t i

.g

. ~ ~ -.....

,--..-.e,---,.,.

..,._-,,._,.m,,_,,.,-,,.._,.-

.,--,--_,...___,a__.,.-._-,

Question 440.44:

Provide the results of the analyses for the design basis mass addition and energy addition transients including transient curves that demonstrate the peak RCS pressures are within pressure temperature limits determined for the System 80+ design.

Instrumentatica uncertainties should be factored into your evaluation.

Response 440.44:

The results of the design basis mass addition and energy addition transients are attached and will be included in CESSAR DC Chapter 5 section 5.2.2.10.

These figures will appear in a future amendment to CESSAR DC.

t e

4 t

m

.mm-,

.,m

,.m,- -...

- _ r y

k &T, WP. W 700 i

i i

i

-r i

i i

m a.

.w o' 600 -

o m

m w

m o.

o 3

d500 w

Z w

m

'a 400 4

9 r

o 3000 2

4 6

8 10 T ME, SECONDS Figure 5.2-1 SYSTEM 80+ MASS ADDITION TRANSIENT (INADVERTENT SAFETY INJECTION ACTUATION) l

(

kb$ 940.44 700 iiiiii i

i i

i d,

U a.

W c' 600 7 D

Vi U)w O'

a.

o 5

g500 :

w z

3

~

a w

m

400 2

~

4 3

i_

O

~C

~

l 300O 2

4 6

8 10 12 14 16 18 20 TIME, SECONDS 4

Figure 5.2-2 SYSTEM 80+ ENERGY ADDITION TRANSIENT (RCP START WITH RCS AT)

CESSARnahieu g g,g J

S.2.2.10.2.1 Limiting Trannients Trannients during the low temperature operating rnode are more covere when the RCS in operated in the water-solid condition.

Addition of maan or energy to an isolated water-colid nyotem producca incroaced system pressure.

The neverity of the proccure transients depends upon the rate and total quantity of naso or energy addition.

The choice of the limiting LTop transients in based on evaluations of potential transients for System 80 planto and their applicability to the System C0+ plant. lg The mont limiting transients initiated by a cingle operator error or equipment failure are:

A.

An inadvertent safety injection actuation (naus addition)*

E

, _np start when a positive stcan generator lE D.

A reactor coolant' (energy additiop).

to reactor vousel AT cxicta w

The most limiting transients are determined by conservative analysca which maximizo mano and energy additions to the RCS.

In addition, the RCS in accumed to be in a water-solid condition at the timo of the transient; such a condition han boon noticed to exist infrequently during plant operation nince the operator is instructed to avoid water-nolid conditions whenever possibic.

(g oxsA-t s

a shows the resultc of the inadvertent narcty injection actuation transient analysin for a water-solid RCS, when the RCS in the LTOP mode.

The mann addition due to the simultaneouc E

operation of four safety injection pumpa and one charging pump I

was considered, along with the simultaneous addition of energy Firgwfrom decay heat and the preocuritar heaters.

l c,. e 1 l

Ma shown the result of the transient analysis oflE

~

reactor coo ant pump start when a steam generator t;o reactor vessel AT of 100*F cxists.

This AT is the maximum allowed by technical specification during the LTOP mode.

In addition to considering the energy addition to the RCS from the steam generator cocondary sido, energy addition from decay heat, the reactor coolant pump and all precuurizer heaters were also included.

In this analysis the steam generators were assumed to be filled to the zero

power, normal water level.

For conservatism, the secondary water, both around and above the U-tubco, was assumed to be thermally mixed in order to maximize the energy input to the primary side.

This assumption is conservative since an a result of the temperature distribution within the steam generator during the transient, the water inventory above the tubes is practically isolated thermally from the heat transfer region.

Therefore the heat transfer rate, and thus the primary sido pressure, is not sensitive ~to the secondary

[

oide water level as long an the tubes are covered.

.. e Amendment E

CESSARnMLms y,,p on the basis of experienco, the AT value of 100*F used in the analysis is much larger than any AT that might be expected during plant operation.

This maximum allowablo AT of 100*F will provent pressurizer pressure from exceeding.the minimum P-T limit allowed for the lowest system temperature during the LTOP modo of coolant circulating with the l g During RCS cooldown operation.

(See Figures 5.3-Sa and 5.3-Sb).

using the Shutdown Cooling System, reactor coolant pumps operating serves to -cool the steam generator to keep the temperature difference between the reactor vessel and the steam generator minimal.

Procedures for System 80+

have directed tho. operator to maintain-the AT below approximately 20'F.

LTOP transients have not boon analyzed for the simultaneous startup - of more than one reactor coolant pump (RCP).

Such operation is procedurally precluded since the operator - starts only one RCP at a tino and a second RCP-is not started until system pressure is stabilized.

Additionally, 4hore is an LTOP transient alata that should indicate that a pressure transient is occurring.

Accordingly, the second RCP would not be started.

The operator cannot start an RCP if the AT exceeds 100*F.

However,.as montioned above, administrative procedures for System E

80 have ensured that the AT is maintained below approximately 20*F.

With similar administrative controls on System 80+,

AT margins will be even greater that for System 80.

p,.,

results of the analyses provided in Figure 5.2-1 and Talyl 61*1 show that~ the use of either SCS relief' valve will prov e _

nu cient pressure relief capacity to mitigate the most limiting

.iTOP events identified above.

5.2.2.10.2.2 Provision for Overpressure Protection-During heatup, the RCS pressure _is maintained.' below the LTOP-pressure until the RCS cold-leg temperature exceeds the LTOP disable temperature.

During

cooldown, the RCS pressure is

. maintained below the LTOP pressure once.the RCS-cold-leg temperature reaches the LTOP enable temperature.

An-LTOP enable temperature is defined in Dranch Technical Position RSD 5-2, "Overpressurization Protection _of Pressurized -

g.

Water Reactors While operating at Low Temperatures," to Standard Review Plan Section

'5.2.2,

" Overpressure Protection," -issued November 1988 as Revision 2..

-The definition is based on measuring - the degree of protection provided by the low temperature overpressure protection system (LTOP System) against of the reactor violations of the P-T Limits in terms of the RT %t location,.

vessel boltline material at either the 1/4t or $

m

)

v

. Amendment E

CESSAR naincmon gggg During cooldown, whenever the RCS cold log temperature is below the LTOP enabic temperature, that corresponding to the intersection of the design P-T Limit curve for cooldown with E

pressurizer safety valve setpoint, the SCS relief valves provide the necessary overpressure protection.

If the SCS is not aligned to the HCS before the cold-leg temperature is decreased below the LTOP, enable temperature,.an alarm will notify the operator to open the SCS suction isolation valves.

However, the SCS cannot I

be aligned to the RCS until the RCS pressure is below the LTOP enable pressure.

The LTOP conditions described above are within the SCS operating range.

Technical Specification Section 16.3/4.4.8.3 requires the SCS suction line isolation' valves to be open shen operating in the LTOP mode.

Also, this Technical Specification ensures that appropriate action is taken if one or more Sr.s relier valves are out of service during the LTOP mode of operat. ion'.

Either SCS relief valve will provide sufficient relief capacity to prevent any pressure ' transient from excoedi the isolation interlock setpoint (sco Figure 5.2-1 and @ CC

)\\

c n y m. s. a.1 5.2.2.10.2.3 Equipment Parameters s

ihd The SCS relief valves are spring-loaded liquid relief valves with sufficient capacity to mitigate the riost limiting over-pressurization event.

Pertinent valvo parameters are as follows:

Parameter Nominal Setpoint h ps1M Accumulatioy__s %

10 Capacity g* day (010% acc) gpm E

l s e.co l

i Since each SCS relief valve is a self actuating spring-loaded liquid relief valve, control circuitry is not required.

The valve will open when RCS pressure exceeds its setpoint.

The SCS relief valves are sized, based on an inadvertent safety injection actuation signal (SIAS) with full pressurizer heaters operating from a water-colid condition.

The analysis assumes l7 simultancoas operation of four SIS pumps and one charging pump

. y

_vith letdown _

olated.

The resulting flow capacity requirement Seco for water is 3 gpm.

The analysis in Section 5.2.2.10.2.1 E

assumed that either SCS relief valve relieved water at this rate.

i

Pressure measured at the valve inlet.

lg Amondm 2 n t-T

C ESS AR !Ta%mos g,A1tro,yy O

The design roliof capacity of each of two SCS relief valves (shown in Pt.ID Figure 6.3.2-lD) as supplied by the valve meets the minimum required relict capacity of kganufacturerfjj) gpm which contains uuf ficier t margin in relieving capacity i,;mo g

for even the worst transient.

The SCS rnlief valves are Safety Class 2, designed to Section III of the ASME Code.

S.2;2.10.2.4 Adminintrativo controls Administrative controls necessary to implement the LTOP provisions are limited to those controls necessary to open the SCS isolation valves.

During cooldown, when the temperature of the RCS is above that corresponding to the intersection of the controlling p-T Limit and the pressurizer safety valve setpoint',

overpressure protection is provided by the pressurizer safety' valves, and no g

administrativo procedural controls are neVeccary.

Deforo entering the low temperature region for which LTOP is necessary, RCS precouro is decreased to below the maximum pressure required for LTOP.

The LTOP pressure is less than the maximum pressuro

' allowable for SCS operation.

Once the SCS is aligned, no further specific administrative procedural controls are needed to encuro proper overpressure protection.

The SCS will remain aligned rh whencver the RCS is tit low temperatures and the reactor vcosol head is secured or until an adequate vent has been catablished. ly As designated in Tabic 7.5-2, indication of SCS isolation valvo position is provided.

During heatup, the SCS isolation valves remain open at least until the LToP enabic temperature.

Once the RCS temperatura has reached that temperature corresponding to the intorocction of the controlling p-T Limit and the pressurizer safety valve cetpoint, overpressure protection ir provided by the pressurizer safety valves.

The SCS can be isolated and no further administrativ procedural controls are necessary.

l E

S.2.2.11 Pronsurized Thermal Shock The System 80+ reactor vessel meets the requirements of 10 CFR S0.61,

" Fracture Toughness Requirements For Protection Against whichnatisfiesthescreeningcriteriain10CFR50.6hb)is109'F Pressurized Thermal Shock Events."

The calculaced RT (2).

S.2.3 REACTOR COOLANT PRESSURE DOUNDARY MATIGLIALS 5.2.3.1 Material Specification A list of specifications for the principal ferritic materials,

.i austenitic stainless steels, bolting and weld materials, which are part of the reactor coolant pressure boundary is given in Table 5.2-2.

l C ESS AR t'ini,"icaiion rg pg,g C K,- m \\ f w 7--'

TAM,0 __5. 7 - ('

/

EUfdULTRE_T1!D_IllhDXERTJRiblt 'I'TY IgtrigilolLACTUATim!

i IlBilfd14!T_hl!12hYGLE_

.iTMC1t_EST1;II-80!>IILILC01,/

/

Ilumber,of flaximum SCD itclief Haxinum Itglicf s

flumber of'/

Humber of

,,valyco RCD Pronsure,-rlhwrat,o y

cha r.ging.P'urnon DTD Ptunp_s E gational (nnlaj e (opm)

/

1 1

1 f567 1260 1

2 1

580 2162

/

1 3

1 59 3055 1

4 1

608 3934

/

C

,/

l N

/

\\

/

l I

/,

/

en[rgy

~

Including 'th > considerations of addition NOTE: /

a.

from decay heat and all pressur Mer heaters.

l

\\

/

' mfwa 9AJL O, %

AG '@

7 rP-,

yy_ s 2 s v

/

Amendment E

-. ~. -

- - - _. _.. _... - -. _. - - ~. _. -

,.~.

/

Qga liJL DG 5 i

ge s a-L p

7 _ __.

Y p

T h T H w'.. M 4

(,_.

t 600 i y 'i l.. s -

l s

j s

il y i l

i g

=

f I

690

, -,c 0

,/

~

$70

/-

560 kM 550 h

640 g

530 d

/

.I W

520

.k hW

/

cJ 10 J<

500 f

490 j

/

480 470 I

[

400 a

a i

i e

I e

I l#

450 i' l I-I l

i1 e

0 2

4 6

8 10 12 14 16

'18 20 I

TIME, SECONDS

/

1 Amendment E /

l 5)

December 30,Y9BBN v f..

nw. -

SYSTEM-8k4 RCP START TRANklENT

.$ M

- Y.

/

./

ed<

-.i -, -..- - -...- -.

'?

0 b 140 44 700 i

r-i i

i Ul o-td a: 600 3

~

y) y)

ta cr Q

a 3

Ed 500 w

z

--]

'.i w

ca

'a 400 4

~

S o

<x 300

--4 6

8 10 O

2 TIME, SECONDS Figure 5.2-1 SYSTEM 80+ MASS ADDITION TRANSIENT (INADVERTENT SAFET( INJECTION ACTUATION)

,.,,--n

.w..

-n,.

700 i

i i

i i,

cf

?

(n Q.

w Q' 600 7 D(n (n

w a'.

Q a

=5 y500 w

z 9

(-.

g m

a 400 4,

i o

l J

300 0

2 4

6 8

10 12 14 16 18 20 TIME, SECONDS l-Figure 5.2-2 SYSTEM 80+ ENERGY ADDITION TRANSIENT (RCP START WITH RCS AT) e

Attachment (1) to pfS-92-035 page 1 of 9 Ouestion 440.45 The following RAI clarifies the staff's position regarding intersystem LOCA protection and supersedes RAI 440.17 which should be deleted, future evolutionary ALWR designs should reduce the possibility of a loss-of-coolant accident (LOCA) outside containment by designing to the extent practicable all systems and subsystems connected to the reactor coolant system (RCS) to an ultimate rupture strength at least equal to full RCS pressure.

The " extent practicable" phrase is a realization that all systems must eventually interface with atmosphere pressure and that for certain large tanks and heat exchangers it would be difficult or prohibitively expensive to design such systems to an ultimate rupture strength equal to full reactor system pressure, it should be noted that the degree of isolation or number of barriors (for example three isolation valves) is not sufficient justification for using low pressure components that can be practically designed to the ultimate rupture strength criteria, for example, piping runs should always be designed to meet the ultimate rupture strength criteria, as should all associated flanges, connectors, packings including valve stem seals, pump seals, heat exchanger tubes, valve bonnets and RCS drain and vent lines.

The designer should make every effort to reduce the level of pressure challenge to all systems and subsystems connected to the RCS.

Our initial review of System 80+ design features, including proposed resolution of generic safety issue GI 105, does not provide adequate information on how those systems will satisfy the above staff position for evolutionary ALWRs.

Please provide detailed discussion of how the System 80+ design meets the above criteria. As part of the response include:

(1) an identification of all interfaces to the RCS indicating design and ultimate pressure capabilities for these systems, (2) a color coded simplified P&l0 showing piping and component ultimate pressure capabilities, clearly identifying the in%rface junctions, for all interfacing systems and components which do not meet the full RCS ultimate rupture strength criteria, justify, for each case, why it is not practicabic to reduce the pressure challenge any further.

This justification must be based upon engineering feasibility analysis and not solely risk benefit trade-offs.

For those interfaces where acceptable justification on the impracticability of full RCS pressure capability has been provided, there must be a demonstration of compensating isolation capability. For example, it should be demonstrated for each interface that the degree and quality of isolation t

I i

Attachment (1) to i

PfS-92-035 Page 2 of 9 Queltion 440.45 (coJdjaufdl or reduced severity of the potential pressure challenges compensate for and justify the safety of the low pressure interfacing system or component.

Adequacy of pressure relief and piping of relief back to primary containment are possible considerations. As identified in SECY 90-016 each of these high to low pressure interfaces must also include the following protection measures:

(1) the capability for leak testing of the pressure isolation valves (PlVs).

(2) valve position indication that is available in the control room when isolation valve operators are deenergized, and (3) high-pressure alarms to warn control room operators when rising RCS pressure approaches the design pressure of the attached low-pressure systems and both isolation valves are closed.

Response 440.45 Combustion Engineering has reviewed the Intersystem LOCA (ISL) issue as defined by Generic Safety Issue 105 in NUREG-0933 and NUREG/CR-5102.

Design changes based on PRA evaluations of ISL and engineering judgment have reduced the contribution of ISL to the core damage event frequency for the System 80+ design to approximately 1.0E-9 compared to the EPRI overall core damage frequency goal of 1.0E-5 as demonstrated in the System 80+ PRA.

Analyses of previous plants have identified the most significant potential ISL paths to be the Shutdown Cooling System (SCS) suction lines and the Low l

Pressure Safety injection System injection lines. The design pressure of l

the SCS has been increased from 650 psig to 900 psig in the System 80+

l design. The ultimate strength of the piping material will not, therefore be exceeded even if the SCS is subjected to normal RCS operating pressure.

The design pressure of the SCS piping conforms to the EPRI requirements in -

Volume 11, Section 5.2.3.2 of the ALWR Utility Requirements Document.

Isolation provisions for the SCS which further reduce the possibility of ISL are discussed below.

The System 80+ Safety injection System (SIS) design does not include a low pressure injection subsystem, thereby eliminating the other potential ISL path shown to be significant by evaluations of earlier designs. The design pressure of the SIS pumps and the injection piping from the discharge of the pumps to the outside containment isolation valvo in each train is 2050 psig.

The piping in these portions of the SIS can withstand normal RCS l

operating pressure. The destgn pressure of the injection piping from (and

Attochment (1) to PIS92-035 Page 3 of 9 Res onse 440.45 frantinuedi including) the outside containment isolation valve to the RCS is equal to RCS design pressure.

The SIS suction piping from the In containment Refueling Water Storage lank (IRWST) is designed to lower pressure in accordance with EPRI criteria in the ALWR Utility Requirements Document, Volume II, Section S.4.3.2.

Numerous valves isolate the SIS from the RCS as described below.

In addition to the SCS and SIS design changes, the Chemical and Volume Control System (CVCS) design has been revised to reduce the possibility of ISL. The letdown Heat Exchanger is now located inside containment and its tube-side design pressure has been increased from 650 psig to 2485 psig.

CVCS isohtion and overpressure protection are discussed further below.

The Process Sampling System (PSS) also interfaces with the RCS.

A-discussion of the isolation provisions and other features that address ISL for the PSS is also provided below.

Leak testing of pressure isolation valves is described in the response to NRC Question 210.88.

PSS The design pressure of PSS piping that interfaces with the RCS is 2485

19 In addition, flow restricting devices are provided in the RCS nozzle for each line to limit flow from a postulated downstream break to a value that can be accommodated by a charging pump.

Two containment isolation valves are provided in each sam;Ae line that interfaces with tl.e RCS. The normal position for these valves is closed. These valves are operable from the control room and have position indication in the control room.

There is no leak detection instrumentation in these lines.

CVCS This discussion refers to _ CESSAR-DC Figure. 9.3.4-1, Sheets 1 and 2.

Sheet I has been marked up to reflect revisions which will be incorporated-into the next Amendment to CESSAR-DC.

This sheet is attached for information. Sheet 2 can be found in CESSAR-DC. The P&ID coordinates for the valves listed below are provided in Table 440.45-1 of this response.

Letdown Line -- The letdown line is designed to RCS design pressure up to and including the letdown-control valve isolation valves (CH 349 and CH-350).

There are four valves in series upstream of each letdown control-valve isolation valve. Two are inside containment (CH-515 and CH-516) and two are outside containment (CH-523 and CH-110P or CH-110Q).

All valves upstream of the letdown control valve isolation valves can be operated from the control room, and control room position indication is provided for each.

- = _ _ -.

Attachment (1) to pfS-92-035 Page 4 of 9 Response 440.45 (continued)

These valves are normally open when the CVCS is operational (in Modes 1, 2, 3, 4, and intermittently, 5). Intermittently during Mode 5, and throughout Mode 6, letdown is isolated by closing valves CH-515 and CH-516. Since RCS pressure is reduced, any leakage past these valves, and a subsequent downstream pressurization, is negligible.

For any abnormal operational occurrence necessitating letdown isolation while the RCS is at full pressure (such as a CIAS, an SIAS, or a letdown line component malfunction), an RCS pressure challenge to lower pressure piping beyond CH-349 or CH-350 is obviated due to the extent of instrumentation, controls, and valves which ensure isolation well upstream of the lower pressure piping.

The letdown orifices (Sheet 1 of Figuro 9.3.4-1, coordinates F-7) limit letdown flow to its maximum allowable value if the letdown control valves are fully o)en.

The orifices are located in containment, upstream of the outer contaunment isolation valve (CH-523) in piping designed to RCS design pressure. The letdown line relief valve (Cil-354) is located downstream of the letdown control valve isolation valves. Cil-354 has a capacity equal to the capacity of the letdown orifices with the letdown control valve fully open. Overpressurization protection is thus provided for portions of the letdown flowpath designed to a pressure less than design pressure.

Charoina line -- The charging line design pressure equals or exceeds the design pressure of the RCS from (and including) the charging pumps, to the RCS. The line contains two check valves in series outside containment-(CH-719 for pump 1, CH-705 for pump 2, and CH-639).

The line also contains three check valves in series inside containment (CH-747, CH-433, and C11-448), along with two valves operable from the control room - one inside and one outside containment (CH-524 and CH-208).

Position indication is provided in the control room for these two valves.

Five check valves in series make it implausible that the charging pump suction piping could be overpressurized by the RCS.

hxiliary Spray line -- The auxiliary spray line (at coordinates H-7 and H-6 on Sheet 1 of figure 9.3.4-1) is a path parallel to the charging line.

It has the same piping design pressure rating and the same design configuration as the charging line.

Five check valves in series separate the charging pump suction piping from RCS pressure. As stated above, it is implausible that the charging pump suction piping could be overpressurized by the RCS, Seal In.iectiQn -- The design pressure of the reactor coolant pump (RCP) seal injection line is equal to or greater than the design pressure of the RCS from (and including) the charging pump to each RCP.

There are four check valves in the line going to each RCP. Three are inside containment

Attachment (1)to PfS 92 035 Page 5 of 9 Bf 20 Ale 440.45 (continue.Q and one is outside containment, for charging pump I to RCP 1A, for example, these valves are Cil 719, Cll 835, Cit-787, and C11866.

The seal injection line upstream of the RCP header also contains a valve operable from the control room located outside containment (CH 255) and a valve operable from the control room inside containment for each RCP (Cil 241, 242, 243, 244).

Position indication is provided in the control room for these valves. The four check valves in series provido adequate protection against RCS overpressurization back to the charging pump suction piping.

Seal Bleedoff -- RCP seal bicedoff (seal injection return flow) is routed to the volume control tank. The design pressure of the bleedoff piping is equal to RCS design pressure from each RCP out to the first manual valve outside containment (CH-198).

Each of the four bleedoff lines (one from each RCP) contains an orifice and a valve (RC-430, 431, 432, 433; see CESSAR DC Figure 5.1.2-2) operable from the control room.

The orifice and valve are in piping with a design

)ressure equal to RCS design pressure.

The orifice limits the controlled 31eedoff flowrate from a postulated downstream pipe rupture to a value within the makeup capacity of a charging pump.

In addition, the action of the RCP seals themselves restricts flow through a postulated break.

The valve in each bicedoff line has position indication in the control room, flow instrumentation in each line activates a high flow alarm in the control room once reaching the high setpoint.

Two valves operable from the control room are provided in the bicedoff line at the containment penetration (CH-506 is inside containment and CH 505 is outsidecontainment). As noted above, the design pressure of this line is equal to RCS design pressure beyond C11-506.

Position indication is provided for these valves in the control room.

ELS The RCS/ SIS and RCS/SCS interfaces referred to below are shown in CESSAR-DC figures 6.3.2-1A through 6.3.210.

The P&l0 coordinates for the valves listed below are provided la Table 440.45-1 of this-response.

The design pressure of each RCS direct vessel injection line from the reactor vessel up to and including a motor operated isolation valve (SI 616 series, SI-602, 603) outside containment is equal to RCS design pressure.

Each vessel injection line contains three check valves (SI-ll3 series, SI 217 series, S1-540 series)-in series inside the containment in addition to the remotely actuated motor operated valve outside. The motor operated valve is operable from the control room and has pcsition indication in the control room.

Leakage past the check valve nearest the reactor vessel injection nozzle would actuate a high pressure alarm in the control room when pressure reaches the setpoint.

Attachment (1) to pfS-92-035 page 6 of 9 i

Reipsnse 440.4LRontinued)

The design pressui e of each hot leg injection line from the RCS up to and j

including a motor operated valve (SI-321, 331) outside containment is equal to RCS design pressure.

Lach hot leg injection line containt twn chsek valves (SI-522,523,532,533) in series inside the containment to tddition to the motor operated valve outside.

The motor operated valve can be operated from t1e control room and has position indication in the control room.

Leakage past the check valve nearest the RCS would actuate a high pressure alarm in the control room when pressure reaches the setpoint.

The design pressure of the SIS from the SIS pump discharge to the motor operated valves outsido containment in the vessel injection and hot leg injection lines is 2050 psig. The ultimate rupture strength of the piping in these lines can withstand normal RCS operating pressure.

A check valve (S1-434, 446) is located between each SIS pump and the point at which the direct vessel injection and hot leg injection piping branch.

This valve provides additional isolation of the SIS pump suction piping from postulated application of high pressure via either the vessel injection or hot leg injection lines.

The direct vessel injection and hot leg injection piping interfaces with the Safety injection Tank (SIT) fill and drain header in several locations.

At each junction, the fill and drain piping is isolated from the RCS by two valves, i.e., a check valve (SI-217 series, SI-522, 532) inboard (closer to the RCS) of a normally closed, manually operated valve (SI-618 series.

S1-322, 332) that can be operated from the control room.

The manually operated valve is provided with position indication in the control room.

Leakage past the check valve would actuate a high pressure alarm in the control room when pressure reaches the setpoint.

The design pressure of the piping from the RCS up to and including the manually operated valve at each junction is equal to RCS design pressure.

Fill and drain piping outboard of the manually operated valves (S1-661, 670, 682) has a design l

pressure of 2050 psig which would withstand full RCS pressure.

The 2050 psig piping ultimately transitions to piping of low design pressure.

A normally closed, manually operated valve is provided at each point of transition.

The design pressure of these valves is 2050 psig; they are operable from the control room and they have position indication in the control room. The 2050 psig piping and the transition points to piping of low design pressure are inside containment.

A postulated ISL in the low pressure piping would not, therefore, exit the containment.

The SIT's are isolated from the RCS by two check valves (SI-215 series, SI-217 series) in series during normal operation. The design pressure of the piping is equal to RCS design pressure from the RCS up to and including the I

second check valve. Leakage past the first check valve from the RCS would be indicated by a high pressure alarm in the control room when pressure reaches the setpoint.

SIT high level and pressure alarms room would be

i Attachment (1) to PfS-92-035 4

page 7 of 9 l

i Response 440.45 (continued) i actuated if leakage into the SIT's caused their setpoints to be reached.

The design pressure of the piping outboard of the second check valve from 1

the RCS <s 700 psig. The same design pressure is also employed for the Sli itself and for connected plaing.

Any postulated ISL at the SIT-or connected piping would occur 'nside the containment.

Eli The SCS suction piping is designed to RCS design pressure from the RCS up_

to and including the second of two motor operated isolation valves-(SI-651, 652,653,654) in series inside the containment. These_ valves are closed during Modes 1, 2 and 3. -In addition, there is also a motor operated valve 5

(SI-655, 656) outside the containment.

All three valves car, be operated from the control room and have position indication in the control room. An alarm exists to notify the operator. if thc two motor operated valves insido containment are not fully closed coincident with the high RCS pressure.

A high capacity relief valve (SI-179,_189) provided for LTOP purposes is located downstream of the two motor operated valves inside containment in -

each SCS suction line.

These relief valves would limit the effects of postulated leakage past the two upstream motor operated. valves. The relief valves discharge to the in-containment holdup volume.

The design pressure of the SCS discharge piping is equal to RCS design-pressure from the RCS up to and including a motor operated _ valve (SI-600, 601)outsidecontainment.

The notor operated valve is closed in Modes 1, 2 and 3.

It can-be operated from the control room and has position t

indication provided in the control room. In addition, there are four check valves (one outside containment, SI-168, 178 and three inside, S1-113 series,51-217 series, and SI-540 series in series with the motor operated valve.- Leakage past the check valve nea) rest the RCS would actuate a high-l pressure alarm in the control room when pressure reaches the setpoint.- The capability also exists-to check for leakage across all five valves.

The design pressure of the remainder of the SCS is 900 psig. The ultimate-rupture strength of the piping is sufficient _to withstand - normal RCS operating pressure.

I l

4

.a.

m m.

.m

I

~

l Attechment (1) to PfS-92-035 Page 8 of 9 TABLE 440.45-1 (SilEET 1)

INTERSYSTEM LOCA ISOLATION VALVE COORDINATE LOCATION

[yCS VALV[1 flGURC 9.3.4-1 SilEET 1 flGURE 9.3.4-1 SilEET 2 Valve Tag coordinato Valve Tag Coordinate Humber Location Humhgr Location Cll-110P,1100 E-6, E-6 C11-198 F-7 CH-208 G-7 Cil-505 T-7 C11-241, 242, ll-2, G-2 Cil-506 T-7 243, 244 f-2, E-2 C11-255 G-3 C11-705 E-2 C11-349, 350 E-6, E-6 C11-719 C-2 C11-354 0-6 C11-433 11 - 6 Cll-448 11 - 6 C11-515, 516 11-8, 11 - 8 C11-523 E-7 C11-524 8-8 Cll-639 B-7 Cll-747 f-8 C11-787 11 - 1 C11-835 G-2 Cit-866 11 - 1

Att*chment (1) to PfS-92-035 Page 9 of 9 i

TABLE 440.45-1 (SHEET 2)

INTERSYSTEM LOCA ISOLATION VALVE COORDINATE LOCATION slS-SCS VALVES J1GURE 6.3.2-1A flGURE 6.3.2-1B Valve Tag Coordinate Valve Tag Coordinate thimber Location Number Location S1-434 B-4 SI-446 8-4 flGURE 6.3.2-10 Valve Taa Coordinate Numb 6r Location SI-;13, 123, 133, 143 F-7, F-6, F-3, F-1 SI-168, 178 F-7, G-3 S!-179, 189 f-2, f-5 51-215, 225, 235, 245 B-8, B-6, B-4, B-3 51-217, 227, 237, 247 A-7, A-6, A-3, A-2 SI-321, 331 G-1, G-5 S1-322, 332 E-1, E-:

SI-522, 523, 532, 533 C-1, F-1, C-5, F-5 SI-540, 541, 542, 543 C-7, C-6, C-3, C-2 SI-600, 601 G-7, G-3 SI-602, 603 G-6, G-2 51-616, 626, 636, 646 G-7, G-6, G-3, G-2 SI-618, 628, 638, 648 B-8, B-7, B-4, B-3 S1-651, 652, 653, 654 D-2, 0-6, E-2, E-6 SI-655, 656-f-2, F-6 SI-661

- C SI-670 B-1 SI-682 C-1 i

yy__,.,

~

.._,y.

_,._,.....m.

,,,,.wy..y

,.,.%,.,,y

__.,_,.,p,.,.

,,,,m.,.-_.,,,..w,.

.p, e

e.

s

__3 I

a I

i. -

+

[' __ _ __,

DC e '-

. l

~

ODev.oo i

i 6-m g

H C CF At NT $ ([F Ihl NI

&G 2

3@b+e r-m

.m.,

.e1

^N JN

h-M. sR-3 to-4 H l

P WO8 fo l

e, - A@t FtCS (C-3 e

t--F- + i gn y

<a 1

L F-?Q t

Nl T

T F IC L.

4 yll p

i

,.o g

Ci.a.icre m j

@' r'-

34. +,

.i 1 a

g g

gc q.n-3j..y tn u2 \\,

hi ACTOR CDOLMT Ct+ th.7

" I" g,,

g,.g.a. 6 2 l

t

. a '.

N

^N ^

E -M 99 3tO-ili }

x, Cn a+iez i

4 g,

;

o,.zw 7g g _.A. :7,

,c,

,co, w.

L

, \\&ut-A- t-l/4* 2 g g e; M

j @\\,

p y-------.g F A!

pgyS t

p.pg3 g

..,. g,y y f*

6-CD A scGL-A C.>,. nwoo.

b

. m.x...,

g 4.g.a.3,..y

'b Rtactah CoruwY D

7 m-q.n-i.y gl Jv

@'W l

D'- M I"

f g i s.ao in 1

, E-= =n-3m-ni l c_g e :

1 t

h C,C WC5 s

l eM-31 FO cs A-t-l NC%

(C-3#

..3.,

,y Q

-;-------g h

L F -2==

t F IC t-MS Cwete 6j CWDis.]

-a a-yg m t + a >>o-in I.

.... 3,..,a i

GD 3 \\ C,+ee

.tocron Cau.o c vC5 5- )i s

7i

-:e.

N N

i C* e wm o -u....,

+4 E - A te-3iO*{

h I

" Fd l

M A - A-[1 RC S (C

3)

E ify,y 2 +-+--* 4 ee se s.

me e.-

= = = = = = = = =

==

e se

+2 y

y d

CB 4R-A-3-?

I l Ca h l

I m -C.-a o,4 g,. j C",,,,y i e4 at-CD A e i AL-CS m CwCS (E

68 g

CH-3%

0+ =Oq

)

CH 30 W I A

Cwe04 I

f Tg l

.x p}F 2

CD CB M g

g 2

CD-CB-A d'

RE$iu RE $tN m.-C o -a-3/ * - 9 Gew5 i

1. ron 5vuBOL$ AeO.fehACVlAil0N$

?

e Fly. ac-Co a $

a Fig

.,aC-Cs n ut sitriatuct C s t-alen-sto-ioo

?

4 A

gJi; ow C-4. i 4 i

u 2[b e'.

v s~ino.~ Coamo 0

. Co-Ce +

E A-E D-A+ 2 Srbitu m

'e Co Ca-*

f j.

i Zy u

]c e-C a-a+

i f 5

- E-mea-aio-oi I Ce-Co-a+ 2 i

AAA

'T 7-h

- u 1;

E j 1 Co Cn-a-3-2 3' f T T X~

j Cn-b

~

o 4

3 g (S < o,-a A;ta-a o,,,,.

y M,ge-a+

f(f S * * *y"* " M 8

}y

.g l f 5

{ y 9

svsit u Fud-a at-Cn-a-3-.

(y=

(

yle # g~ * 'e a 5 *'a-'*-"

l C+

s

[

(C (m a C m~ In ' o-aw-Co a 3

m _.

.m

(

CT a aL C C'* '",,g e.. 3.,

,C s-Ce f + 2 3

,Co -C s:.m+ 2

' T g

q C

C 3

[ [

!i:

[

h Y: CB-CB'**3-*

Zg

,gg-te-a

CJ h C* '0 l -

i

)

C* **l 4[.k 2-Y 2-Jo+.co IF-} "CH-.M d

t y, CH-7U t

u

' CS TD-n 4

l 51 RHi*E R g

EN L C fDDm ca.CB-e-3-*'

I

,C,

u 4

T' 1

E aLwA 3tO-121 l c*-

..?

C+3C 404t3*'C6 Cw M CA

C A 'CD *- '8 2 O*-* lt!

C vC S IM-51

,{C+6

(

C B-C D-a-ii2 2 l

f@

CB-C\\- i/2-2 l l

%. -C u - a 3 -

DL-CB-A-3/4 I

~3'"

i 5*6

{

}4 g ::y U CB CB e-2-*

Cw q G -Cab +. 2

/

v s.%

2 A1 E * *4 GIO i?? l DL-CB-n ' CD+CB a ts_3F-k cygg g -g, I E* *A* 3 m-W A -c6 A-2-4 gg.La.a 3 4 g

CD CD-a % CS-A i

~ @"

Amendment i 9

0- @ #

December 21,1990 A f

Figure CHEMICAL & VOLUME CONTROL SYSTEM h/

PIPING Al!D INSTRUMENTATION DIAGRAM 9.3.4-1 9

9 e

4, _.

-e-.

e r-,

a w

..,,i 4.

OVESTION 440.52 Per the staff position of BTP RSB 5-1, confirm that a boron mixing and natural circulation cooldown test will be performed in the first plant with a System 80+ design.

RESPONSE 440.52 Testing to verify adequate natural circulation and boron mixing was successfully conducted for.the System 80 design at Palo Verde.

The natural circulation cooldown capacity of the System 80+ design was evaluated in developing a response to RAI 440.51.

The response to 440.51 indicates that the results of the System 80 natural circulation cooldown analysis apply to the System 80+

design in a conservative manner; that is, the results of the cooldown simulation for System 80 bound the System 80+

design.

Based on the results of the Palo Verde testing and the evaluation of natural circulation cooldown capabilities that was performed for the System 80+ design, natural circulation cooldown testing of the System 80+ design is not considered necessary.

Since system 80+ differs from System 80 because of the direct vessel injection feature, a boron mixing test under natural circulation will be performed in the first plant with a System 80+ design. However, a cooldown-is not considered necessary to confirm boron mixing requirements.

l

1 RAI No. 440.72 Page 1 of 2 Question 440.72 Discuss the design criteria for the safety injection pumps, containment spray pumps, and the shutdown cooling pumps, and discuss whether the pump design criteria includes pump operations at or near shutoff head conditions?

k Response 440.72 The functions and overall design criteria for the safety injection pumps are discussed in sections 6.3.1.1, 6.3.1.2.1 and 6.3.2.2.3.

In addition, the design criteria for the safety injection pumps are that they must...

(a) provide sufficient flow to the RCS, following depletion of the Safety Injection Tanks (SIT), to keip the core adequately cooled following all loss of coolant accidents (LOCA),

(b) match the loss in RCS inventory from boiling due to decay heat beginning at about 20 minutes following a large break LOCA (LBLOCA),

and (c) inject w-ter into the RCS during the feed portion of the

, feed-and-bleed operation of the Safety Depressurization System (SDS) for the purposes of removing decay heat from the core.

The pump head characteristics, in particular the shutoff and runout points, are selected to satisfy criteria (a) through (c) above, and tb;se discussed in sections 6.3.1.1, 6.3.1.2.1 and 6.3.2.2.3.

The safety 11jection pumps will operate at or-near their shutoff points during certain main steam line breaks (MSL6) when the RCS pressure is at or near a value corresponding to the shutoff head of the pumps. The minimum flow recirculation (mini-flow) lines are designed to allow sufficient recirculation flow through the pumps so that they can operate at these conditions without damage. Mini-flow is directed to the IRWST and is available during all operating modes of the pumps.

____,_a_ _ _ _. _ _ _ _. -- - - - - _ - - -

RAI No. 440.72 Page 2 of 2 l'

The functions and overall design criteria for the containment spray pumps are l

discussed in sections 6.5.1.1, 6.5.1.2, and 6.5.2.2.1.

In general, these design criteria were selected to be consistent with equipment-previously licensed in System 80 designs.

The containment spray pumps are not expected to normally operate near their shutoff conditions. Nevertheless, mini-flow lines are provided for each pump, i

with heat exchangers, to prevent pump deadhead operation. The mini-flow lines are designed to allow sufficient flow to be produced by the pumps so that they can operate at these conditions without damage.

The functions and overall design criteria for the shutdown cooling pumps are discussed in sections 5.4.7.1.1, 5.4.7.1.2, and 5.4.7.2.2(E).

In general, these design criteria were selected to be consistent with equipment previously licensed in System 80 designs.

In addition, the shutdown cooling pumps are designed to produce flow to sufficiently remove decay heat using the shutdown cooling heat exchangers to limit the temperature rise across the core. This

~

ensures that the RCS pressure does not rise above the maximum operating pressure for the SCS.

The shutdown cooling pumps are not expected to normally operate near their shutoff conditions. Nevertheless, mini-flow lines are provided for each pump, with heat exchangers, to prevent pump deadhead operation. The mini-flow lines are designed to allow sufficient flow to be produced by the pumps so that they can operate at these conditions without damage.

r r

we..

RAI No. 440 073 Page 1 of 2 NRC Ouestion 440.73 Provide an analysis for the potential for pump to pump interaction resulting in a pump dead heading scenario for the safety injection system, the containment spray and the shutdown cooling system. This analysis should identify all pumps and piping configurations that are pathways for pump-to-pump interactions including all shared common minimum ilry recirculation lines and test lines (Reference NRC Information Notice 90-61, September 20, 1990).

Fesconse The design of the Safety Injection System (SIS), Containment Spray System (CSS) and Shutdown Cooling System (SCS) provides protection against pump

" dead-head" operation resulting from pump to pump interaction. This has been accomplished by eliminating the need for low pressure safety injection pumps and by insta11r tion of an individual minimum recircu,lation flow (mini-flow) line for each pump.

In the System 80+ SIS, the flow rate required to be delivered to the RCS following large break loss of coolant accidents (LBLOCA) is provided by SIS pumps with suitable head curve characteristics. The low pressure SIS pumps of previous designs that had to produce both LDCA delivery and shutdown cooling flow rates have been eliminated in favor of dedicated pumps for safety injection and shutdown cooling functions. The result is the elimination of' low pressure pumps (i.e., the System 80 low pressure safety injection pumps) connected (Jn their discharge) to higher pressure pumps that were required to operate near dead-head conditions during certain modes of operation.

In System 80+, therefore, the source of pump-to pump interaction that could cause pumps to, perate at dead head conditions has been eliminated.

The SIS, SCS and CSS designs also have individual mini-flow lines for each pump. The mini flow connection is located immediately downstream of the pump discharge just upstream of the pump's discharge check and isolation valves.

This eliminates the possibility of isolating the flow path to the mini-flow 1

RAI No. 440-073 Page_2 of 2 i

lines which would allow dead heading of the pump if the main discharge flow path is closed.

Furthermore, for the SCS and CSS, a dedicated loop around eoch pump is provided with a heat exchanger to remove pump heat in the event of a closed pump discharge path. These mini-flow lines do not have any.

remotely actuated valves. A locally operated manual valve that is provided to allow pump maintenance is locked open during all plant operating modes.

Finally, to further eliminate any pump to pump interaction, the general plant arrangement separates redundant trains of the SIS, SCS and CSS. The divisional boundary provides complete separation between divisi'ons and effectively creates two identical support buildings. The result is a plant arrangement with two SI pumps, one SCS and one CSS pump located in each division. Within each division, the two trains are seperated by a quadrant wall and these trains are isolated from each other to the maximum extent practical. This precludes any cross connection to the remainder of these systems except through either the RCS or IRWST.

i e

O s

9 Question 440.82 Current editions of CESSAR-DC include Table 6.3.2-4a " Sis Flow Point

- Data-Injection Mode". This is the same table for the System 80 and the corresponding flow diagram does not have flow data points.

labeled for the location of the data readings. Does this table reflect flow point data for the System 80+ SI system?

Response

CESSAR-DC, Amendment 1, does not include Table 6.3.2-4a, " SIS Flow Point Data-Injection Mode". This table, along with tables 6.3.2-4b,

-4c, -4d and -4e were removed from CESSAR-DC in Amendment C.

The tables were removed because System 80+ has a more simplified system operation in that the SISs performance is defined by one set of system operating characteristics. The System 80+ SIS provides for direct vessel injection where the discharge from each SI pump is piped directly to the reactor vessel. The splitting of ficw1from each (high pressure safety injection) pump and diverting it to all four injection nozzles on the cold legs as was done in System 80 has been eliminated. Furthermore, for long term cooling in System 80+,

full flow from two of the four SI pumps is diverted to the hot leg.

The requirement to obtain a 50%/50% hot leg / cold leg balance of flow from-both HPSIP's has been eliminated.

Consequently, the SIS flow, whether for short term or long term cooling, will be identical as defined by the delivery curve. This is provided in table 6.3.3.3-1 of CESSAR-DC

-Therefore, table 6.3.2-4a is not necessary for the System 80+ SIS design.

p 4

Ouestion 440.110 Requirements for and analysis of safety injection systems (SIS) generally assune.relatively short periods for operation of the SIS, on the order of several hours, up to perhaps one day.

It must be recognized, however,..

.i that decay heat removal must continue to be provided after this-initial period has passed, possibly for days, weeks, or even months. Under such circumstances, questions of reliability and maintainability become important. The staff is concerned that very-long term post-IDCA cooling is not being adequately considered in the design of SIS's, and is evaluating how such cooling might be incorporated into advanced reactor designs. The discussion in Sections 6.3 and 15.6 should be expanded and clarified to address the tollowing items.

(1) Identify how the decay heat is transported to the ultimate heat sink.

Inc'.ude in this discussion the potential for cross connects between heat removal components that may improve overall system reliability.

(2) Identify what equipment is necessary for long term post-LOCA cooling, and what the projected mission times are for the required equipment over the spectrum of accidents analyzed. Justify the mission times assumed.

(3) Where non-safety related equipment is identified for use in long term cooling, what reliability criteria should be assumed in determining the availability of this equipment?

(4) In the event of severe fuel damage to part of'the-core, considerabic activity, and possibly fuel debris, may be transported into the SIS, with deleterious effects on system components. Ilow will maintenance or repair be performed in a potentially high-radiation environment?

(5) Even without fuel damage, for long mission times, there is-the possibility that key components, e.g., pumps and heat exchangers, will require maintenance and/or repair, flow is this accommodated in the SIS requirements and in the long-term cooling plan?

(6) lias the necessity for very-long term Post-LOCA decay heat removal been considered in your PRA? If not, why is this omission appropriate?

RAI No. 440-110 Page 2 of 6 4

Response 440.110 (1) Long term decay heat removal is performed in one of two ways, depending on the size of the break.

For a small break IDCA (SBLOCA), RCS pressure and inventory control can be recovered within several hours to allow entry into shutdown cooling. Cooldown and depressurization of the RCS to shutdown cooling entry conditions is accomplished.by using the steam generators and auxiliary pressurizer spray or the Reactor Coolant Cas Nent System (RCGVS), respectively. Once in shutdown cooling, decay heat is transferred to the Component Cooling Water System (CCWS) via the SCS heat exchangers, Heat exchangers in the CCWS then provide for the transfer of decay heat to the Station Service Jater System (SSWS). Decay heat contained in the SSWS water is removed by the ultimate heat sink (pond, river, ocean, etc.).

For a lar6e-break LOCA (LBLOCA), the RCS pressure may not be controllable and RCS inventory may he insufficient to allow entry into shutdown cooling. Under these conditions, simultaneous hot leg and direct vessel injection (DVI) will be initiated to maintain core inventory and flush the core to prevent boron precipitation. The safety injection pumps will take suction f rom the IRWST and will inject water into the hot legs and DVI nozzles. Water spilling out the break is directed to the Holdup Volume Tank (HVT), which replenishes the IRWST inventory once the HVT water level reaches the IRUST spillway elevation. Decay heat is removed from the core by either water boiling in the reactor vessel or watse spilling out the break. Decay heat accumulated in the containment atmosphere due to boiling will be removed by the CSS and transferred to' the IRWST.

Water spilling out the break will eventually arrive in the IRWST through the the IRWST spillway from th,e HVT.

Decay heat accumulated in the IRWST will be removed by the CSS or SCS since IRWST water is pumped -through the containment spray or the shutdown cooling heat exchanger before being returned to the IRWST.

Decay heat removed by the CCWS in these heat exchangers is transferred to the ultimate l

RAI No. 440 110 Page 3 of 6 heat sink through the SSUS as described above in the SBLOCA discussion.

The reliability of long term coolin5 is increased by providing cross connects which allow the interchangeable use of the shutdown cooling pumps and heat exchangers and the containment spray pumps and heat exchangers. The SCS and CSS pumps are identical which facilitates the use of these pumps for the interchangaable service.

t (2) The following SIS equipment, and support systems equipment, is used in long term post-LDCA cooling.

Safety injection System The IRWST, ilVT, S1 pumps, Safety injection Tanks (SIT'a), and associated valves and piping.

Shutdown Cooling System SCS heat exchangers, pumps, control valves, relief valves, and associated piping.

Component Cooling Water System CCWS pumps, heat exchangers, surge tanks, chemical addition tanks, radiation monitors, valves, and associated piping.

Station Service Water System SSWS pumps and pump structures, pump structure screens, strainers, radiation monitors, valves, and associated piping.

Containment Spray System CSS pumps, heat exchangers, and associated valves and piping.

The mission time requirements for equipment to remain in service following a LOCA will meet or exceed the mission time requi ements for previously licensed equipment in System 80 designs.

More

_--.-_----J

s' RAI No, 440 110 Page 4 of 6 information regarding mission times is discussed in the response to RAI No. 270.2.

System 80+ incorporates a number of changes from the System 80 design that greatly improves the reliability for operation during accident recovery periods.

The SIS consists of four redundant mechanical trains, each with its own suction line from the IRWST, its own. pump, and its evn discharge line to the RCS.

For breaks larger than the size of an injection line, each train, in conjunction with the SIT's, provides 50 percent of the minimum injection flow rate required to satisfy all IDCA performance requirements. For breaks equal to or smaller than the size of an injection line, each train provices 100 percent of the flow required to satisfy the LOCA performance requirements.

Direct vessel injection is used rather than cold leg injection to permit each of the SIS pumps to be sized for one half of the capacity required for a cold leg break. Direct vessel injection (DVI) in :onjunction with the use of four SI pump's increases the reliability of the SIS during LOCA events by maintaining the clear separation of the four SI loops and minimizing the number of valves within the system.

The System 80+ SIS pumps take their suction from the IRWST.

The IRUST is connected directly to the lloldup Volume Tank, which serves as the " containment sump", via passive spillways. Therefore, there is no distinction between the injection and reciroglation phases of SIS operation. By eliminating the need to realign the SI pumps-from 4

an outside Refueling Vater Storage Tank to the containment sump, the reliability of the system is improved.

Two redundant SCS trains are available for, small break, post-IDCA cooling.

Each train has 100 percent capacity to ensure that one train will meet all SCS performance requirements.

If both SCS trains become unavailable, the system design permits the CSS pumps j

I l

._A

RAI No. 440 110 Page 5 of 6 to be aligned for long-tera decay heat removal.

Separation of the two SCS trains is readily maintained in the design.

In addition, the bleed function of the Safety Depressurization System has been incorporated into the System 80+ design to permit emergency decay heat removal.

(3) Satisfactory long-term post LOCA cooling r,esults can be demonstrated using only safety related equipment. Control-grade equipment may be used according to plant procedures, but use of such equipment is not required or credited. Therefore, reliabilitycritetyaarenot specified for design basis events. Control-grade equipment reliability is addressed for beyond design basis events as part of the PRA and Reliability Assurance Program.

(4)

In the unlikely event of severe fuel damage to part of the core following a IDCA, fuel debris will not be transported to the SIS.

The SIS circulates water from the IRWST to the re' actor coolant loop, t

Provisions have been included in the IRWST to prevent transport of fuel debris or foreign matter into the system. All fluid directed to the IRWST passes through the HVT before entering the IRWST.

Large debris carried by water flowing to the ifVT will settle in that tank. Screens in the IRWST spillway inlets will prevent smaller debris from carrying over into the IRWST. Screens in the SIS suction inlets will prevent small debris (greater than 0.09 in.

diameter) from entering the SIS.

In addition, th@jSIS suction inlets are located above the bottom of the IRWST to prevent debris l

which has settled in the tank from being swept into the SIS suction lines.

The high radiation levels caused by the increased activity in the coolant will require special shielding to be installed should maintenance or. repair of components be required under severe-accident conditions.

RAI No 440 110 Page 6 of 6 (5) The need for maintenance and repair to SIS components during periods following a LOCA is minimized since (a) active components (such as-pumps and valves), electric cabling, instrumentation and controls in the SIS are qualified to operate in a post-LOCA environment, and (b) redundant equipment is provided, If it is determined that equipment repair is needed on a very long-term bases, extraordinary measures would be developed at the time of the event, considerihg event specifia onditions based on the best industry experience and knowledge available at that time.

(6) The PRA has considered the necessity of long-term p st-LOCA decay heat removal consistent with the EPRI PRA Key Assumptions and Groundrules (EPRI ALVR Utility Requir_ments Document, Vol. II, Chapter 1, Appendix A),

e

OVESTION 440.111 (15.81 Please provide a schedule for providing an ATWS analysis to demonstrate that the System 80+ ATWS response is within the bound considered by the staff during the deliberations leading to the ATWS Rule (10 CFR 50.62). This should include the analyses referenced on page B-92 which demonstrates that loss of feedwater with failure of turbine trip is the limiting peak pressure event.

RESPONSE 440.111 The "C-E NSSS Owner's Response to NUREG-0460, Volume 4 (CEN-134-NP) addressed the issue of the most limiting anticipated transient without scram (ATWS) event.

The report concluded (see Section 2.2) that the total loss of main feedwater without turbine trip produces the highest primary pressures.

Appendix B of Section 3.1.12 of CESSAR-DC " Anticipated Transients Without Scram" will be revised as reflected in the attached markup to reflect the most recent ATWS analyses for System 80+.

These analyses were performed on a best-estimate basis and demonstrated that the peak RCS pressures (i.e., cold leg) would not exceed 3140 gsia for a moderator temperature coefficient of

-0.3 x 10'4 li?/ F representing the most adverse expected MTC value for 99% of the fuel cycle.

(

CESSAR an!inc-tpg y gg O

3.1.12 ANTICIPATED TRANSIENTS WITHOUT SCRAM 3.1.12.1 MYS Description Anticipated Transient Without Scram (ATWS) is not an ' initiating -

t event, but rather is-ss faulted response to an event requiring control element assemblien (CEAs) insertion for reactivity control.

However, because of the dgnificant impact that an ATWS has' on plant responses, ;it is included as a separate initiating event class.

The initiating event is defined to be the occurrence of a transient requiring reactor trip for reactivity control coupled with failure of a trip to occur due to either mechanical failure of the CEAs to insert or the failure of both the Reactor Protection System (RPS) and the Alternate Protection -

System (APS)-to generate a trip signal.

Because ATWS is included as a separate event, failure to trip was not addressed in the event tree for the other transient initiating event classes.

's potentially a severe event in wlich the Reactor-i The ATWS Coolant System goes through a pressure excursion due to a

mismatch - between the core heat generation rate and the Reactor-Sy energy removal capability.

Although Coolant 50.62 g -defines a prescriptive solution : for the ATWS l

A 10 CFR Ty?

scenario in terms of prevention and mitigation, the b gcess ei criteria for the event is given in NUREG-0460, Volume 3 and can be summarized as follows:

l For the Reactor Coolant System (RCS) pressures calculated, the integrity of the reactor coolant pressure boundary-and the functionability of valves needed for long term cooling -

shall be demonstrated.

Thecalculatedradiologicalconseg0gesshall-bewithinthe guidelines set fcrth'in 10 CFR 10 The reactor fuel rods shall be-shown to withstand the internal and external transient pressure so as to maintain;a-long term coolabic geometry.

The peak fuel enthalpy--of the hottest fuel perllet shall not result in significant fuel melting.

The probability of departure from nucleate boiling for the hot rod shall be shown to be low.

The maximum - cladding-temperature and the extent of the-Zr-H 0 reaction'shall be determined and shown not to result 7

in sIgnificant cladding degradation.

O, Amendment F B-91 December 15, 1989

CESSAR nU%mou

%A[

Pio,ilt O

t For the limiting ATWS scenario, the criteria relating to the pressure boundary integrity and functionability of the valves required for long term cooling are of primary interest.

The concern is that if the peak pressure in g RCS exceeds Level C stress limits (approximately 3200 psia) a breach of the primary coolant pressure boundary will occur and that the Safety Injection System check valves will be jammed closed.

This would result in a LOCA with no RCS makeup available.

The course of an ATWS event is primarily dictated by a

macroscopic energy balance on the Reactor Coolant System.

Energy generated in the core and deposited in the coolant can be removed by varicus meanst they are: the steam generators, the primary safety relief valves, and RCS leakage.

Changes in the RCS pressure and teuperature are produced as a result of an imbalance between the rates of energy deposition into and removal from the reactor coolant.

All ATWS consequences are determined directly by the core power transient and the power -imbalance transient.

The relative consequences of ATWS events are thus determined by the relative magnitude of those plant parameters which govern these transients.

l The energy generation within the core during the period of peak RCS pressure and maximum potential for clad damage is determined h-.

i by the relative magnitude of Doppler and moderator temperature l

reactivity feedback.

A power imbalance which produces an increase in moderator temperature and pressure coupled - with a l

negative moderator temperature coefficient also produces a

negative reactivity feedback which tends to reduce the_ core power and hence reduces the core - power imbalance.

During an ATWS event, primary coolant temperature increases..

Since the assumed moderator temperature coefficient in the core is negative, the temperature increase-results in an insertion of negative reactivity which reduces the core power.

The moderator temperature coefficient will become more negative over the core cycle.

Therefore, as the cycle progresses, the consequences of an ATWS event would become less severe, in that the core power reduction via moderator feedback will be greater, thus reducing T _the imbalance between the core heat generation rate and the RCS heat removal capability.

Since ressure - and-associated s stem.

he c

primary concerns u

as been determined by analysis tha e e loss o ter _e, vent with failure of ine trip is the limiting at-ower peak pr h at The loss of normal feedwater flow could result from a malfunction in the feedwater/ condensate. system or its control system.

This

')

Amendment F

-B-92 December 15,-1989

CESSAR an!%mou QJ 90,lll C

malfunction can be caused by a closure of all feedwater control

valves, trip of all condensate pumps, or trip of all main feedwater pumps.

The loss of normal feodwater causes a reduction in foodwater flow to the steam generators when operating at power.

This produces a reduction in the water inventory in the steam generators.

Consequently, the secondary system can no longer remove the ' heat that is generated in the reactor core.

Due-to the-assumed failure of the CEAs to insert on reactor trip, the core power (h

remsins at or near 100% of the initial' level during the early part of the transient.

The heat buildup in the primary system is f\\

indicated by rising RCS temperature and

pressure, and by

( increasing pressurizer-water level due to the insurge of expanding reactor coolant.1 The initiation of the ATWS ovent may

,J be identified by Ir ans of the failure of CEA insertion en the

+

reactor trip sig al, sharp increases in-RCS pressure and and a rise i The heat temperature, the primary an steam generator pressure. inventories, the capacity of nd secondary coolant discharge capability of the RCS and. steam generator. Safety and Atmospheric Dump

Valves, and the action of the Emergency Feodwater System,' Steam Bypass. Control System, and the Chemical e

and Volume control System all combine to provide the-heat removal

%y capability to limit the consequences of-the reactor power generated during this incide t.

Realistic best estimate thermohydraulic-analyses of a tota M of Feed Q h out Turbine _{Ap/*F.

rip or Scram were rund MTCs of

-0.50x10 Ap/*F an

-th-3 0

T elk vessel pressures y

f generated in these analyses Arq9 psia. for - an ~pC of 4

k

-0.30x10 Ap/

F, - and 28 sfa for an MTC -of -0.50x10 Ap/*F.

Therefore, sin pc:ot s of ' Main Feed-wah.o without F

Turbin pds the limiting-ATWS, an ATWS_4 event will not ex Ievel", stress limits for MTCs of -0.30x10 Ap/*F or-less.

Figure B3.

-1 presents the core damage event tree for ATWS.

The following subsections describe the individual elements 'on this event tree.

i 3.1.12.2 ATWS Event Tree Elements-i 3.1.12.2.1 ATWB Initiators ATWS is defined to be an anticipated operational occurrence coupled with failure to insert negative reactivity via the CEAs.

ATWS initiators, for this study, are defined to be all transients which tend to pro 6uce RCS pressure transients. These include Loss t

...j Amendment F B-93 December 15, 1989

s[j-[ 44 0. lt l INSERT A :

Since RCS peak pressure and associated system stresses are the primary concerns during an ATWS, it has been determined by ar.alysis that the complete loss of feedwater event with f ailure of turbine trip is the limiting at-power event as documented in the "C-E NSSS Owner's Response to NUREG-0460, Volume 4 (CEN-134-Np)."

INSERT B :

The pressure continues to increase until the rate of RCS coolant expansion decreases due to the reduction in power caused by the core negative MTC.

At this point, the pSV outflow matches, and then exceeds the surge line inflow to the pressurizer initiating a pressure decrease.

INSERT C :

Best estimate, thermal-hydraulic analyses of a total loss of feedwater without turbine trip or reactor scram were performed assuming the most adverse expected MTC value during 99% of the fuel cycle (-0.30E-4Af / F).

The peak RCS pressure generated in this analysis was 3140 psia, which is below the level C stress limit of 3200 psia.

l

Ouestion 440.115 Technical Specification 3.4.9 of CESSAR-DC Chapter 16 does not include the surveillance requirements for the demonstration of the emergency power supplies-for the pressurizer heaters as proposed in the C-E Owners Group Standard Technical Specifications.

Explain why.

Bosponse 440.115 This surveillance requirement was inadvertently omitted from the System 80+ technical specifications.

The response to RAI 430.23 defines pressurizer heater power availability as listed in Tablo 8.3.1-4.

The pressurizer heater power is supplied from a 4.16KV non-safety bus which may receive emergency power from the non-safety gas turbine or, if necessary, the diesel generator via a manual bus tie.

A surveillance requirement will be added-to the System 80+ Technical Specifications to demonstrate operability of an emergency power source for pressurizer heaters.

This surveillance requirement will be included in a future amendment to Chapter 16.

l l

l

-3 QUESTION 440.116 Review of CESSAR-DC Section 6.8 on the In-containment Refueling Water Stcrage tank (IRWST) indicates that the Cavity Fluding System (CFS) is designed to

"... flood the Reactor Cavity (RC) in the event of a severe accident for the purpose of covering core debris in the reactor cavity with water." Operation of the CFS during severe accident conditions requires manual actuation of several sets of motor operated valves (MOVs) in order to flood the RC.

These manual MOVs (valve Nos.51-390 to SI 395) provide spillway links for water to flow from the IRWST to the Holdup Volume Tank (HVT) and then from the HVT to the reactor cavity.

In light of the severe accident conditions in which these spillways would be used to fill the reactor cavity to ameliorate a corium-concrete reaction, explairi why CE proposed to use an electrically dependent system requiring prompt operator action under stressfull conditions versus a passive system (such as one that employs a fusible metal plug for each HVT/RC spillway penetration) that will automatically open the spillways upon an elevated temperature produced by the corium. How will the timing of.

CFS operation be determined? What instrumentation will be relied upon? What

,:riteria and timing will be employed to reduce the potential for a steam explosion due to dropping debris into a flooded cavity?

RESPONSE 440.116 4

For the System 80+ design the Reactor Cavity flooding is initiated using manual operator actions. These actions include manual actuation of motor-operated valves (MOVs) in order to provide spillway links for water to flow from the In-containment Refueling Water Storage tank (IRWST) to the Holdup Volume Tank (HVT) and then to the Reactor Cavity (RC).

Manual = actions to flood the RC with IRWST fluid are predicated on indcations of accident sequences potentially leading to the severe accident scenario, such as radiation alarms /indicatior.s in the containment, RCS and containment pressure and temperature indications / recordings, and reactor vessel level indication. Adequate power sources, such as batteries, would be available to provide power to facilitate the operation of the minimum set of instrumentation required even during a Station Blackout scenario.

In addition, sufficient time for appropriate operator actions is available during the' severe accident scenario.

Predictions by the MAAP code, which is employed to simulate the severe accident sequences, have indicated that reactor vessel failure occurs no sooner than 2 to 3 hours3.472222e-5 days 8.333333e-4 hours 4.960317e-6 weeks 1.1415e-6 months from the initiation 1

of the accident. This suggests that adequate time is available for-the operators to assimilate plant status information, properly diagnose the accident scenario, and take specific manual actions, sucn as opening of the MOVs for. initiating reactor cavity flooding.

Manual actions also provide the flexibility to terminate cavity flooding should it be recognized later on that the transient would not lead to a severe accident scenario and that the plant can be stabilized using " conventional"

= Emergency _ Operating Procedures (EOPs),

1

l A passive fusible plug for each spillway' penetration could potentially delay timely cavity flooding till after vessel failure (since the temperature felt l

at the penetration may not be high enough-to melt the plug).

In addition, a i

fusible plug design would preclude testing of the cavity flooding system.

Analytical studies have indicated significant quenching of_the corium, adequate retention of core debris within the cavity, and scrubbing of the fission products, if the cavity is flooded prior to vessel failure. Cavity flooding prior to vessel faliure would also minmize the potential for any i

significant basemat melt-through.

For these reasons, the System 80+ design uses an "on-demand" manual cavity flooding system for mitigating the i

consequences of a severe accident scenario.

The potential for a steam explosion causing damage to the reactor cavity i

and containment is considered to be very small. Following the reactor vessel failure during a severe accident, molten core debris would be released from the vessel into the reactor cavity.

If water were accumulated in the cavity region prior to the vessel failure, molten debris-water interaction could be anticipated within the cavity. These were analyzed in references (1) and (2).

As discussed in these references, the major influence of a potential steam explosion would be to disperse some of the water accumulated within the reactor cavity as well as further fragment and disperse molten debris that had been expelled from the reactor vessel at the time of the interaction. The evaluation of such events indicate that the energy yields would not be l

sufficient to threaten the integrity of either the raactor cavity or the l

containment boundary. Additional evaluations documented in Referencc3 (3),

(4), and (5) have confirmed this basic conclusion.

l The evaluations and conclusions contained in the above references with regard to the potential for steam explosion are generally applicable to the System 80+ design because of the lower head mounted ICI design. This design would introduce corium into the cavity in a manner similar to that for the plants analyzed in the cited references.

Although the potential for steam explosion is minimal for the System 80+

design, the criteria and timing-for operator actions for cavity flooding would account for this phenomenon. The specific operator guidance and instrumentation to be relied upon for manual cavity flooding would be-developed as part of the overall accident management strategies for the System 80+ design. These strategies would be based on the NUMARC and NRC guidelines currently being developed.

References:

1.

-Zion Probabilistic Safety Study, Commonwealth Edison Company, September 1981, 2.

Indian Point Probabilistic Safety Study,' Consol_idated Edison l

Company of New York and the Power Authority of the State of--

1 New York,' April 1982.

3.

" Steam Explosions in Light Water Reactors," Report of the Swedish Government Committee on Steam Explosions, Ds I 1981.

4-g 1

~[

4.

Probabilistic Risk Assessment, Limerick Generating Station, Philadelphia-Electric Company, April 1982.

5.

NUREG/CR-5567, BNL-NUREG-52234, "PWR Ory Containment Issue Characterization," Brookhaven National Laboratory, Prepared-for the U.S. Nuclear Regulatory Commission, August-1990.

1 p

' N

i QUESTION 440.117 What severe accident analyses have been performed for establishing bases for the System 80+ CFS (IRWST/HVT/RC nerangement) that justify having only two HVT/RC spillways? What injection rates were assumed and is there enough total HVT/RC spillway discharge head to overcome pressures generated within the RC via the corium/ concrete reaction (and steaming from initial water injection) based on a minimum IRWST water level under Technical Specification 3.5.47 Could corium/ water interactions be violent enough to disperse core material and potentially block HVT/RC spillways?

RESPONSE 440.117 Severe accident analyses using the MAAP code were performed in support of the cavi_ty flooding system (CFS) design for System 80+.

These analyses helped in the overall design of the IRWST/HVT/RC arrangement. However, the choice of the number of spillways was based on sound engineering judgement in part to make it single failure-proof and to simplify the design.

The pressures generated within the Reactor Cavity due to steam produced by cooling of the molten corium are expected to be small.

This is due to the fact that a relatively large opening between the Reactor cavity and the lower and upper compartments is present for relieving the steam produced by the cooling of the molten debris. Assuming about a 1 percent decay heat _anii a conservatively -large steam production corresponding to twice the amount of the decay heat (to account for the cooling of the debris), the pressure drop between the Reactor Cavity and the opening is determined to be less than 0.04 psi.

In comparison the hydrostatic head between the HVT water level and the location of the Reactor Co ity spillway entrance:into the cavity _is-significantly higher ( > 4 psi). This means that even with the conservatively large steam production from decay heat removal and debris cooling, the backpressure in the Reactvc Cavity will not buildup significantly since all of the steam generated would be expelled-into the containment with the buildup of a very.small pressure difference.

This allows for adequate delivery of IRWST fluid into the cavity.

A discussion of corium/ water interactions leading to steam explosions is provided as part of the response to Q.440.116, This discussion indicates that the steam explosions would not yield sufficient energy to threaten the integrity of_the cavity walls or the containment boundary.

Based on the same discussion it can bc con,.luded that the probability of blockage of both HVT/RC spillways due to the-interaction of core debris with water would not be violent enough N potentia 11.s block both HVT/RC spillways with the debris.

=

Question 440.118:

(GSI-23:

Reactor Coolant Pump Seal failures)

The staff's draft safety evaluation report (DSER) for the EPRI Evolutionary Utility Requirements Document (URD) indicated that all new plant designs should provide independent RCP seal cooling for coping with station blackout (SB0) conditions. This measure was adopted, in part, since the EPRI URD specifies that the Chemical Volume and Control System (CVCS) is not required to perform safety functions and therefore maintains seal integrity with a non-safety grade seal injection (SI) system.

The URD specifies that the CVCS design, reliability, and availability should be enhanced through design improvements, judicious location of components, and selected application of redundancy and diversity requirements.

Initial review of CESSAR-DC Section 9.3.4 on the CVCS design indicates that the CVCS is "... designed as a non-safety related system.., In particular, the CVCS is not required to ensure the capability to prevent or mitigate the consequences of plant. accidents." This statement is inconsistent with the ABB-CE proposed resolution on Generic Safety Issue (GSI) 23 " Reactor Coolant Pump (RCP) Seal failures" (pages A-14 to A-16). The ABB-CE proposed technical resolution of GSI-23 relies solely upon the non-safety related CVCS seal injection to maintain RCP seal integrity and subsequently prevent a potentially core damaging seal LOCA.

With respect to the RCP seals, the CVCS clearly functions to support reactor l

coolant pressure boundary (RCPB) integrity.

In addition, the System 80+

design has reduced the nurrber of charging pumps from the three positive displacement pumps (PDPs) (two parallel trains and one common shared PDP) for t

the System 80 design to two (parallel trains) centrifugal charging pumps (CCPs).

Even though CCPs tend to exhibit enhanced reliability characteristics compared to PDPs, the reduction in the number of charging pumps would super-ficially imply a reduction in the reliability of the system unless other engineering factors (as shown in a failure mode and effects analysis (FMEA) l and fault tree analysis) are documented to support analysis for improved System 50+ CVCS reliability, especially in the context of GSI-23.

ABB-CE should provide a comparative CVCS reliability analysis of the System 80+ versus the System 80 to determine if the System 80+ CVCS design is consistent with the EPRI guidelines and that seal integrity, and-consequently the reactor pressure boundary, is not compromised during normal plant operations.

This analysis should be appropriately addressed in the relevant sections of CESSAR-DC.

Response 440.118:

In paragrapn 1, the NRC reviewer states:

... the EPRI URD specifies that the Chemical and Volume Control System (CVCS) is not required to perform safety related functions..." To implement this position, the EPRI URD states that the entire CVCS can be designed as non-safety grade (i.e.,

non-nuclear safety (NNS) ), and all safety grade functions performed by

Response 440.118 (Cont'd):

current generation systems can be transferred to other dedicated safety systems.

We arree with, and have implemented the EPRI requirement relative to not crediting the CVCS with safety-related functions. We have however elected to take a different approach regarding the safety classification of piping and components, in the System 80+ design, all CVCS safety functions have been transferred to other dedicated safety systems. This transfer involves safety functions which were previously credited to the CVCS, such as depressurization, and boron addition for reactivity control. However, the transfer of safety related functions to other dedicated systems has not resulted in a relaxation of CVCS design standards for reliability, redundancy, and availability (i.e., the System 80+ CVCS has Bol been designed as non-nuclear safety (NNS) ).

In accordance with current NRC regulatory criteria (Regulatory Guide 1.26), the System 80+ charging and letdown portions, including seal injection and reactor coolant pump bleedoff, are designed as Safety Class 3.

Onsite alternative AC (AAC) power is provided to the charging pumas for their continued operation during a Station Blackout in accordance wit 1 draft Regulatory Guide 1008, which specifies design requirements for alternate RCP Seal Cooling systems.

As described in CESSAR-DC Section 8.1.4.2, the installation and design of the alternate AC power source is in compliance with NRC Regulatory Guide 1.155,

" Station Blackout". Consequently, the System 80+ CVCS provides two diverse electrical power sources for RCP seal cooling for ensured seal integrity, l

In paragraph 2 of the RAI it is pointed out that there is an " inconsistency" between:

a) the CVCS design, since it is non-safety _related, and b) the C-E proposed resolution to Generic Safety Issue (GSI) 23, which relies on seal injection to maintain seal cooling.

Designating the CVCS as non-safety related has not diminished the quality of the design. As discussed in the paragraphs above, the system (in particular, the charging portion, including seal injection) is designed to ASME Section III, Safety Class 3 standards. The. system receives normal power from redundant, non-safety related buses. For events where normal station power is available, the CVCS is operated to provide seal injection for seal cooling.

For a Station Blackout event, the system receives power from the AAC bus,-and seal injection flow is continued. Continued ual injection during this event provides the alternative to component cooling water for seal cooling flow,-

assuring seal integrity, and subsequently precluding a "potentially core damaging seal LOCA". The reactor coolant pressure boundary remains intact with continued seal cooling provided by the CVCS.

In paragraph 3 of the RAI,~it is stated that the use of 2 centrifugal charging pumps is less reliable than 3 positive displacement pumps.

On the surface, 2 pumps could suggest less redundancy than 3 pumps. However, understanding how 2 centrifugal pumps function in the System 80+ CVCS design provides assurance that there has been no compromise in reliability.

=-

O Response 440.118 (Cont'dh tiechanical Desian In the previous System 80 design, each of three pumps. delivered 44 gpm.

Therefore, 132 gpm (maximum) of charging was possible.

Fcr the System 80+ design, however, one centrifugal pump can provide flow over the entire range of required CVCS flowrates (i.e., from 44 to 132 gpm).

Consequently, the complete flowrange of all three positive displacement pumps is achieved with one centrifugal pump.

The other centrifugal charging pump is a completely redundant, installed spare.

With a single mechanical failure of one centrifugal charging pump, therefore, the other is available to provide the complete charging flowrange.

For System 80, with the same failure, only 88 gpm maximurr, would be achievable.

The design with centrifugal charging pumps, therefore, exhibits enhanced reliability over the positive displacement pump design.

Electrical Desian In the positive displacement pump CVCS design, purrp 1 is powered from bus A, pump 2 is powered from bus B, and pump 3 has the capability of being powered from either bus A or B.

Upon a loss of one electrical bus, therefore, only two pumps can be operated, with a total flowrate of 88 gpm.

In the centrifugal pump CVCS design, pump 1 is powered from bus A and pumps 2 is powered from bus B.

Loss of an electrical bus would result in the ability to provide the cnmplete charging flowrange (44 to 132 gpm), a design enhancement over the positive displacement based CVCS design.

Consequently, the failure of a centrifugal-charging pump due to either a mechanical or electrical failure would have no adverse system impact.

Continued charging flow, over the entire flowrate range, is available from the installed spare (in the case of a-mechanical pump failure) or from the pump on the bus which continues to receive electrical power.

The RAI has suggested that a Failure Modes and Effects Analysis'and Fault-Tree Analyses be submitted for the CVCS. C-E believes that Failure Modes and Effects Analyses and Fault-Tree Analyses for non-safety related systems need-not be reported in CESSAR-DC, although they have been performed during the System 80+ CVCS design process with acceptable results.

Summarizing, seal injection furnished by the CVCS is the best design and operational approach to protecting the seals during a station blackout and serves as a redundant, diverse system for seal cooling.

l l

1 Question 440.119:

In addition to the discussion in the previous RAI (440.118) on GSI-23, the foilowing information provides additional clarification on the staff's position concerning GS-23 relative to advanced reactor designs.

Probabilistic risk assessment (PRA) analyses have indicated that the overall probability of core damage due to a small break LOCA could be dominated by RCP seal failures.

RCP seal failures have been classified as LOCAs with RCS leakage up to 500 gpm per RCP. The primary objective for the resolution of GSI-23 includes improving the reliability of RCP seals by reducing the probability of seal failure during normal operations and off-normal conditions.

RCP seal failure scenarios are separated into two categories:

(1) those resulting from mechanical-induced or maintenance-induced failures, and (2) those resulting from a loss of seal cooling such as 500.

The first aspect of GSI-23 deals with seal failures during normal operation and have been demonstrated through numerous in-plant occurrences.

Failures have occurred from maintenance errors, vibration, corrosion, plant transients, contamination, abnormal pressure staging, operator errors, improper venting, improper instrumentation, defective parts, and other causes. Normal condition seal LOCAs have resulted in unisolable RCS leakage at rates up to 500 gpm per RCP.

The second ispect of GSI-23 deals with a loss-of-seal cooling during off-normal L.onditions.

Loss of seal cooling may occur under the following conditions:

(1)

Loss of all AC power (i.e., SB0 as defined by 10 CFf 50.2).

(2)

Loss of component cooling waten (CCW) function independent of SB0.

(3)

Loss of service water (SW) function independent of SBO.

(4)

Inadvertent termination of RCP seal cooling due to a safety-injection /

containment-isolation signal ce loss of a pneumatic system.

Seal injection availability during off-normal conditions is of particular concern for advanced reactor designs.

Isolation of seal injection to RCPs has.

been identified as a significant. contributor leading to high leakage (Ref.

NUREG/CR-4948) for operating reactors. The probability for loss of seal injection may be exacerbated by a non-safety related CVCS for neudesigns.

This is due to the fact that the non-safety CVCS would not be required to meet the single failure criteria (redundancy, diversity, electrical independence, etc...) or withstand a design basis accident (DBA), even though the CVCS is apparently composed of safety and seismically classified components. CVCS unavailability leaves no method of alternate seal injection and introduces the possibility of additional uncertainty in the capability to maintain seal integrity, and subsequently the RCPB. Also of concern to the staff, is the -

fact that seal injection following LOOP, is normally supported by the-alternate AC (AAC) power system, rather than the emergency DGs.

Question 440.119 (Cont'd):

i in the event that 580 conditions exist and AAC is not available as stated in CESSSR-DC GSI resolution, the staff questions your assumption that the t. haft sea's are capable of limiting leakage to a maximum of 8 gpm per pump without cooling.

This is based on research findings for GSI-23, seal hydraulic-instability leading to seal faces " popping open," given a sufficient loss of inlet subcooling or seal back pressure.

Due to the above concerns, it does not appear that the CESSAR-DC resolution of GSI-23 adequately addresses the issues. Based upon recent GSI-23 research results, it appears that the following approach would provide more effective resolution of GSI-23 vulnerabilities.

Please address the applicability and feasibility of implementing these criteria for CESSAR-DC.

(1) Treat the RCP seal assembly as an item performing a safety related function similar to other components of the reactor coolant pressure boundary, applying quality assurance requirements consistent with Appendix B of 10 CFR Part 50 and applicable General Design Criteria (GDC) of 10 CFR Part S0, Appendix A.

This measure would bring the System 80+

RCS design closer to the intent of GDCs 14 and 30.

(2) RCP manufacturer recommended instrumentation and Estructions for monitoring RCP seal performance should be provided on the use of monitored parameters for early degradation detection in order to prevent or mitigate a cascade failure of multi-stage seal assemblies. As a minimum, RCP seal procedures should be provided for normal plant operation conditions, including pump startup, pump shutdown, and off-normal conditions. Procedures for off-normal conditions should include loss of seal injection flow, loss of cooling to seal coolers (e.g., seal coolers, thermal barrier heat exchangers, etc...), loss of -

all seal cooling (consistent with Requirement N,0. 3 stated below), and pump restart after loss of all seal cooling events.

(3)

Provide an independent seal cooling system which will be operable during off-normal plant conditions involving loss of all seal cooling events.

This system should be seismically qualified and independent of the CVCS and associated support systems to the extent practicable.

Some existing piping run may be shared, if the probability of failure is demonstrated to be-acceptably low, or in the event of pipe failure the leak can-be easily identified, isolated, and seal cooling maintained.

The system should have appropriate Technical Specifications for Surveillance Requirements and Limiting Conditions for Operation.

RESPONSE 440.119:

In addition to the concerns stated in question 440.118, the NRC states that CESSAR-DC resolution of GSI-23 does not adequately address the issues.

The issues are identified as RCP seal failure scenarios separated into two-categories:

e ReJponse 440JMont'd):

(1) Those resulting from mechanical-induced or maintenance induced failures during normal operation.

(2) Those resulting from a loss of seal cooling such as station blackout (580).

Addressing the first category of seal failures, it is stated that numerous seal failures have occurred during normal operation.

It is further stated that RCP seal failures have been classified as LOCA's with RCS leakage up to 500 gpm per RCP.

The 500 gpm seal failure occurred in the 1970's and resulted from continued operation of the RCP with damaged seals. This one worst case seal failure is not representative of the seal failure leakage rates which have occurred.

In fact seal leakage rates due to seal malfunction have been considerably below the 25 gpm per pump criteria established in Regulatory Guide 1.155.

Seal performance during normal operation has impreved significantly since 1983 as stated in the NUMARC response, dated September 30, 1991 to Draft Regulatory Guide 00-1008 and as supplemented in the CEOG response, CEN-408, to DG-1008.

In the CEOG report (CEN-408) 10 utilities with 15 operating C-C designed plants were surveyed to determine their RCP seal operating experience since 1983. A seal assembly failure is defined as an occurrence when two or more seal stages are not functioning as designed. A failure may result in external leakage from the seals or excessive controlled bleed off flow which is contained and piped off to the volume control tank.

A total of 23 failures were reported which required seal assembly replacement and met the above defined seal failure criteria. Of this amount, only three failures resulted in external leakage from the seals into the containment.

The maximum external seal leakage was 3.0 gpm which is well below the 25 gpm criteria.

The other 20 failures involved higher than allowed controlled bleed off flow which does not constitute external leakage from the RCP. The 23 failures span a 8 year time frame for 59 RCP's and are considered a reliability concern and not a safety concern by the industry.

It should be noted that NUREG-1401, Regulatory Analysis for Generic issue E3, does not differentiate between those seal failurcs which resulted in external seal 1 akage from the RCP and those seal failures which caused a higher than acceptabic controlled bleed off flow to the volume control tank oc similar collection tank, Lumping these two different types of seal malfunctions together results in higher than actual external leakage seal failure rates and tends to present an inaccurate picture of actual industry wide seal performance.

The RCP seals to be used in the System 80+ plant are the same as those used in the Palo Verde plant. The performance of these multiple stage seals has been excellent at Palo Verde and no unalanned shutdowns from normal operation can be attributed to performance of tie seals alone.

There have been'several incidences of seal malfunction durirg loss of seal cooling events, but the l

external seal leakage was well below the 25 gpm criteria.

These incidences are included in the CE0G report, CEN 408, and additional information on these i

events is provided in C-E response to question 440.120.

f fleippn_se 440.119_LCottt'd :

o Addressing the second GSI-23 seal failure category which deals with seal performance during loss of seal cooling, the NRC lists the following conditions:

(1)

Loss r.f all AC (i.e. 500 as defined by 10CfR50.2).

(2) toss of Component Cooling Water (CCW) function independent of SBO.

(3)

Loss of Service Water (SW) function independent oi

,c0.

1 (4)

Inadvertent termination of RCp seal cooling due to a safety injection / containment-isolation signal or loss of a pneumatic system.

System 80+ RCP seal cooling is accomplished by two independent and redundant seal cooling systems:

seal injection and component cooling water.

Before addressing the above NRC defined conditions, a desc~iption of the System 80+

component cooling water system and service water system is_provided in the following two paragraphs.

The component cooling water system (CCWS) consists of two separate, independent, redundant, closed loop, safety related divisions.

Either division of the CCWS is capable of supporting 100% of the cooling functions required for a safe reactor shutdown. A single failure of any component in the CCW system will not impair the ability of the CCW system to meet its functional requirements.

Each divi,sion consists of an esstntial and non essential cooling loop. The essential loops are composed of Safety Class 3 piping and components and cool safety related loads including the water coo ed motors on the charging pumps.

The non-essential loops are composed of non nuclear safety piping and components and cool non-safety related loads such as the reactor conlant pumps.

Cooling water for the saiety grade CCWS pumps and heat exchangers is provided by the service water system (SWS). The SWS consists of two separate, redundant safety related divisions.

Each division cools one of the two CCWS divisions. A single failure of any component in the SWS will not impair the ability of the SWS to meet its functional requirements.

The RCP's and supporting cooling systems are designed to withstand the NRC defined conditions as stated below:

l (1) for the loss of all AC power (i.e., S00) condition, the RCP seals are provided with seal cooling via an on-site alternate AC (AAC) powe' source r

l which is used to power the charging pumps which supply seal injection (SI) water to cool the shaft seals.

The AAC power is also used to power the CCW system pumps and SW system pumps to ensure component cooling water (CCW) is furnished to the charging pumps.

The 10 minute delay mentioned in Regulatory Guide 1.155 for furnishing AAC power to the charging pumps CCW pumps and SW pumps will not cause any problems for the RCP seals. The RCP seals are capable of withstanding without damage a loss of seal injection water and component cooling water for in excess of 10 minutes with the pumps in an idle condition as would happen during a loss of all AC power.

Re_sA9nse 440.119 (Cont'd):

(2) for the loss of non essential component cooling water function independent of SBO, the shaft seals are furnished with seal injection (SI) water to cool the shaft seals.

Essential CCW is furnished to the charging pumps.

Since the essential CCW system is safety grade and meets the single failure criter,a it is not credible that both divisions of the CCW system would be lost.

(3) Complete loss of the service water (SW) system is not credible since the two divisions are safety grade, fully redundant and meet the single failure criteria.

(4) The RCP seal cooling system is unaffected by a safety injection actuation signal (SIAS) or a containment-isolation actuation signal (CIAS).

The System 80+ RCP operational strategy has incorporated the guidance set forth in NRC Generic letter 83-10a by including design provisions which preclude seal damage due to 1,he loss of the component cooling water due to a SIAS or CIAS. CCW to the RCP's is not isolated on an SlAS or CIAS.

Seal injection flow is not-isolated on any PPS or ESFAS generated signal.

On a loss of air, CCW flow and seal injection flow to the RCP seals are unaffected. There are no pneumatically operated valves in the CCW flow path. Although there are pneumatic valves in the seal injection line, these valves fail in a position which ensures continued seal injection flow to the seals.

Improved seal cooling availability during off-normal conditions is a design basis of the System 80+ design, in response to the NRC concern that isolation of seal injection (SI) water to RCP's has been locntified as a significant contributor leading to high seal leakage, the System 80+ RCP's have independent and redundant seal cooling via S1 water and CCW and are capable of operating with SI water only or CCW only.

During normal operation both the Si and CCW methods of seal cooling are in operation.

This pump seal cooling capability is explained in more detail in our response to 440.125.

The probability of a loss of seal injection is not exacerbated by the System 80+ CVCS design. This issue is discussed in detail in the response-to Question 440.118. Additionally, CVCS unavailability does not im)act the CCW supply to the seals as the alternate method for seal cooling.

Tae LOOP scenerio is not a concern, since the CVCS provides seal injection powered from the AAC power source.

Simultaneously. CCW is provided to the seals, as this system is powered from the emergency diesel generators.

The NRC staff also questions the assumption that the shaft seals are capable of limiting seal leakage to a maximum of 8 gpm per pump in the unlikely event that all seal cooling is lost with the pump in an idle condition. As stated in our CESSAR DC response to GSI 23, this capability is based upon operating and test experience with multiple stage hydrodynamic shaft seals used in C-E designed plants. The capability is particularly based on the operating events at the Palo Verde plant. Additional information on these events is found in our response to 440.120.

ResAgnse 440.1191 Cont'd):

In the last paragraph of the subject question (440.119), the NRC repeats the i

concern that the CESSAR-DC resolution of the GSI-23 does not adequately address the issues.

The NRC further requests that C-E address the

~

applicability and feasibility of irrplementing the three resolutions proposed

'y Draft Reguletary Guide DG1008, 6

The first two DG1008 resolutions are summarized as follows:

(1) Treat the RCP seal assembly as a component of t'ho safety related reactor coolant pressure boundary. Apply quality assurance requirements consistent with 10CFR50 Appendix B and applicable General Design Criteria of Appendix A to 10CfR50.

(2) Provide RCP manufacturer recommended instrumentation and instructions for monitoring seal performance and detecting incipient RCP seal failures.

Provide RCP operating procedures to protect the seals for both normal and off-normal plant conditions.

The first resolution is not applicable to the System 80+ RCP seals because the seals are diready designed and manufactured to-a quality assurance program which com)1ies with many of the 10cfR50 Appendix 0 requirements in order to provide 11e reliability demanded by the end user.

In addition, each seal assembly receives final manuf acturing processing in a clean room where temperature, humidity and airborne particulates are controlled.

Dimensional requirements are verified by computer eided measurement systems.

Each seal assembly is hydrostatically pressure asted at 150% of RCS design pressure e...

operationally tested in a seal test rig which simulates actual pump operating conditions.

The costs necessary to implement resolution (1) completely will not provide any additional improvement in seal performance.

The second resolution will be im)1emented for the Sy' stem 80+ design based on using the successful and applica)1e instrumentation, instructions and operating procedures from the System 80 plant design as implemented at Palo t

l Verde and any revisions provided by the pump supplier at the time of component procurement.

C-C's position on these two resolutions is consistent with the industry positions taken in the NUMARC responses to DG 1008 and as supplemented in the CEOG response, CEN 408, The third DG1008 resolution calls for an independent seal cooling system which l

will be operable during off-normal plant conditions involving loss of all. seal cooling systems. As previously stated in this response, the System 80+ design incorporates independent seal cooling-via an on site AAC power source which is used to power the charging pumps which provide seal injection to cool the RCP seals.

Thus, the seal injection system meets all design requirements stated in Appendix A to DG 1008 for independent seal cooling systems.

l l

Summarizing, the System 80+ RCP seals are a highly reliable multiple stage design capable of withstanding off-normal operating conditions as proven by operating experience at the Palo Verde plant. The seals are manufactured to

,m,-

+

,-w.=,-.mw-,mm..ew.

,,,9-,

-p.,

w,,

,-w,y.,,-,,4--

gwm,

-g.-.,--,

,y+-,7.s vang p,w :

,w,w.w--,-

n

-,-,a w

I 4

R91ponse440.119_(Coni'Q:

high quality standards to ensure high reliability. The seals are cooled by two independent, diverse-and-redundant systems, i.e., seal injection and component cooling water.

These systems are designed to provide seal cooling under various off-normal operating conditions, particularly station blackout.

where an on-site alternate AC p w er source is used to power the charging pumps.

1 I

t

---,--,,,, mew

- m--r r e m+1e.----..-,v.--,-

<www.w.---1m,,

r#..--

,y-g

, y

.m.v,-

1, s.r-,.-,

y y-,,

p 1----..---v,.w-v-

Question 440.lLO:

According to CESSAR DC Appendix A proposed resolution of GSI-23, ABB/C-E cites an operating event at the Palo Verde Nuclear Generating Station (PVNGS) as partial demonstration of the CE KSB pump seal capability during 500 conditions or loss of CCW (justifying no large leak rates following loss of seal injection). liowever, there is an inadequate discussion of the operational history of Palo Verde Unit No. 2 RCP 28 (seals) to properly support RCP seal integrity during SB0 :onditions or loss of seal injection.

CESSAR DC Appendix A (page A-15) describes the licensee event in the following excerpt:

"In April 1986, Palo Verde Unit 2 RCP 2B experienced a loss of CCW and 51 for three hours. During this three hour interruption the pump was o)erated for 10 minutes before it was tripped. This resulted in the pump seals seing exposed to RCS hot standby temperature conditions.

No loss of seal function occurred and there was no measurcable increase in the leakage to the containment.

Following this event, the affected RCP was placed back into service without inspection of the seals. The RCP was operated for several months prior to a normal refueling and maintenance shutdown."

The staff does not believe that this isolated event provides adequate justification on seal performance following loss of St.

It should also be noted that the System 80+ GSI-23 resolution did not address a subsequent Palo Verde event that involved the same Unit No. 2 RCP 28.

LER 86-041 (dated 07/31/86) stnes that on July 1,1986, the PVNGS Unit No. 2 developed an unidentified leak greater than I gallon per minute (gpm) in the reactor coolant system. A closer examination of the Palo Verde LER data base indicates a failure of the RCP 28 seals, lhe information submitted for GSI-23 resolution has not provided any information ruling out the possibility that the previous event may have contributed to the July I seal failure.

Please provide any additional operational data which you believe supports your belief that loss of RCP seal injection will not result in significant seal failure and resulting large loss of RCS coolant.

liowever, as stated previously, the significant uncertainties regarding seal failure modes and likelihood would prudently require that GSI-23 resolution include inde)endent (SB0 capable) seal cooling as discussed in RAI 440.119 (Item 3).

Tie staff recommends that such an approach be utilized in demonstrating technical resolution of GSI-23.

Response 440.120:

In the subject question, it is stated that the CESSAR-DC Appendix A proposed resolution of GS!-23 does not provide adequate discussion of the operational history of the Palo Verde plant RCP's to support seal integrity during station blackout (SBO) conditions or loss of seal injection. An excerpt from CESSAR DC Appendix A which describes an event at Palo Verde is cited as follows:

l

I Response 440.120 (Contidl:

"In A)ril 1986, Palo Verde Unit 2 RCP 2B experienced a loss of CCW and $1 for t1ree hours. During this three hour interruption the pump was operated for 10 minutes before it was tripped.

1his resulted in the pump seals being exposed to RCS hot standby temperature conditions. No loss of seal function occurred and there was no measurable increase in the leakage to containment, following this event, the affected RCP was placed back into service without inspection of the scals. The RCP was o)erated for several months prior to a normal refueling and maintenance slutdown."

4 It is also noted that the SYSTEM 80 GSI-23 resolution does not address a subsequent Palo Verde event that involved the same Unit No. 2 RCP 28. This event is described in a Licensing Event Report with the following comments.

from the NRC staff:

LER 86-041 (dated 07/31/86) states that on July 1, 1986, the PVNGS Unit No. 2 developed an unidentified leak greater than I gallon per minute (gpm) in the reactor coolant system. A close examination of the Palo Verde LER data base indicates a failure of the RCP 2B seals. The information submitted for GSI-23 resolution has not provided any information ruling out the possibility that the previous event may have contributed to the July 1 seal failure."

Additional operational data to support the position that " loss of RCP seal injection will not result in significant seal failure and resulting large loss of RCS coolant" has been requested, it should be noted that the RCP seals have redundant seal cooling methods and that the seals are unaffected by a loss of seal injection water provided component cooling water is available.

Therefnre, it is believed that the NRC reviewer intended to request additional operat1onal data for a loss of both seal injection and comporant cooling water.

i C E has reviewed the available information from the April 1986 and July 1986 events at Palo Verde and offers the following additional information. A review of LER 86-015 which describes the April 1986 event and LER 86 041 which describes the July 1966 event shows that the earlier event was a contributor to the July 1,1986 seal malfunction.

I LER 86-015 states that seal injection (SI) water was shut off to all four pumps in Unit No. 2 because of temperature control problems with the seal injection heat exchanger which heats SI water if the water temperature drops below a certain value. S1 water was restored to three of the RCP's, but not RCP2B because of an apparent plugged filter in the pump cooling circuit.

RCP2B was shut down, the filter flushed and normal 51 water was restored to RCP28.

LER 86-015 shows that RCP2B was without SI water for approximately 3 hours3.472222e-5 days 8.333333e-4 hours 4.960317e-6 weeks 1.1415e-6 months and although not indicated in the LER, component cooling water was shut off to RCP2B for all or part of the 3-hour period.

The seals in-RCP2B were subjected to temperature transients during the event with the highest recorded temperature approaching 250*f. The LER 86-015 ovent is the same as the April 1986 event described in the CESSAR-DC Appendix A resolution of GSI 23.

1 4

Resp.pnse 440.lg0 (cont'd1:

LER 86 041 indicated that on July 1,1986 the leakage from Unit No. 2 RCP2B exceeded 1.0 gpm and the plant was shutdown at which point it was decided to replace the seals in all four pumps. Our records indicate that the leakage from RCP2B was between 2 and 3 gpm; considerably below the 25 gpm per pump criteria of Regulatory Guide 1.155. Subsequent examination of the seals did not reveal any evidence of the seal

popping open" phenomenon described in Draft Regulatory Guide DG 1008.

Evaluation of those two LER's indicates that the RCP seals were subjected to an off normal event (April 1986); stabilized after normal conditions were reestablished and continued to operate for three more months before RCP2B exhibited a leak considerably below the 25 gpm criteria.

The total operating time for the RCP2B seals was approximately 14 months before replacement.

This record provides evidence of the durability of the RCP seals to withstand off-normal operating events (loss of seal cooling).

There were two other events at Palo Verde which establish the capability of the RCP seals to withstand loss of seal cooling events.

These events are described in the CE00 report CEN-408 which was prepared in response to Draft Regulatory Guide DG1008 and are as follows:

Event Date: July 6, 1988 Plant:

Palo Verde. Unit No. 1 Seal Type:

CE/KSB

==

Description:==

Component cooling water and seal injection water were intermittently lost on RCP 2B for eight (8) hours on 7/6/88.

The loss was caused by an auxiliary transformer loop transient.

The seals reached 152'f af ter experiencing conductive heating through the pump shaft for approximately 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months .

Seal failure did not result.

Event Date: March 3, 1989 Plant:

Palo Verde. Unit No. 3 Seal Type: CE/KSB

==

Description:==

Unit 3 was at 100% power and was sche'duled to come down for a refueling outage in the next few days.

Due to a loss of site power all 4 RCP's experienced a loss of seal injection water and component cooling water (CCW), in addition the controlled bleed off (CB0) flow was inadvertently not isolated.

These conditions lasted for approximately 90 minutes, seal temperatures reached 437'f.

Seal damage to pump 1B was evident by abnormal CB0/ staging pressure after reestablishment of seal injection, following reestablishment of seal injection water two of the RCP's were started to establisn forced circulation in the RCS and run approximately 7 to 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months at RCS normal operating conditions

,,--w n-.-.-

e,.

~,.,..,,_.-n,w.,__._.,,,,..

,_m...,.

4

,. _,.. +

{

l Bp mons 3 440.120 (Cont'dl:

l with subsequent run time at decreasing RCS temperature and pressure for cooldown, which took approximately 29 hours3.356481e-4 days 0.00806 hours 4.794974e-5 weeks 1.10345e-5 months .

External seal leakage from pump 10 was later verified to be 1.25 GpH. Only pump 10 experienced leakage.

Seals in all four pumps were replaced. Again, subsequent examination of the seals did not reveal any evidence of the seals " popping open" phenomenon mentioned in DG 1008.

(NOTE:

ThiseventislistedinNVREG1401,AppendixA).

The above additional information provides further credence to the CESSAR-DC position that the System 80+ RCp shaft seals are highly reliabic and are capable of limiting seal leakage to a maximum of 8 gpm per pump for at least 7 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months in the unlikely event that alternate AC power is not available and a station blackout occurs.

It should be noted, however, that the System 80+ primary design basis for coping with station blackout and other loss of sealing cooling events is to maintain seal injection water flow to the seals as described in our responses to questions 440.118 and 440.119.

i

---~w

-c.,

t-m

+ - - --

m--

v

-*^m' s

r-ww -e -e < w = 9-we

- -ve-~rrwe*-v - - - -

=N---*

c--"*w?--

e-'vv-++e'--*e

l QLigstion MQ M 1:

Recently. Arizona Public Service (APS? personnel identified a potentially significant interf acing system LOCA (J5LOCA) event on the Palo Verde RCP seal cooling system while reviewing liRC Information Notico No. 89 54 " Potential Overpressurization of the Component Cooling Water System." By letter dated January 18, 1991, APS notified the NRC of the potential for a small break LOCA due to a tube rupture in the RCP high pressure seal cooler (llPSC).

A ilPSC tube rupture would be classified as an ISLOCA and results in overpressuri-ration of the CCW system.

The overpressurization of the CCW would resrlt in a CCW surge tank relief valve release of RCS inventory onto the roof of J.:

auxiliary building. The possibility of a HPSC tube rupture and its subsequent effects were not considered in the original design and is a previously unanalyzed event for the System 80 design.

Additionally, this event may impact GSI-23 for the System 80+ design since a postulated catastrophic ilPSC tube rupture may simultaneously initiate degradation of RCP seals of the affected pump because cooling and lubrication flow would be diverted to the break.

Therefore, the safety analysis for seal cooler tube rupture scenarios should include at least the following information:

(1) Evaluate for fuel damange under this case of small break LOCA conditions with:

(a)

Leak through only the ruptured seal cooler tube.

(b)

Leak through the ruptured seal cooler tube in conjunction with RCS leakage through a complete failure of the RCP seal stage assembly of the affected pump.

(2) The staff has evaluated the Palo Verde llPSC analysis (Ref. letter Trammell to APS issued 03/12/91) and has concluded that use of the leak-before-break (LDB) methodology is not applicable to a seal cooler tube rupture.

The NRC LBD methodology is based on data of pipes 4 inch in diameter or larger. Due to uncertainties in the elastic-plastic fracture mechanics and the accuracy of the radiation monitoring system (RMS) for detection of small leaks under transient conditions (based on RMS experience of steam generators), the LBB methodology is not applicable for pipes that are less then 6 inch in diameter.

Therefore, a non-mechanistic approach to seal cooler tube failure and consequence analysis should be used for the System 80+ design.

(3) Assess the radiological consequences and determine if the event is within a "small" fraction (10 percent) of the 10_ CfR Part 100 guidelines.. Use the apropriate criteria for such a failure as described in the Standard Review Plan (SRP failure of a Sma).1 Line Carrying Primary Coolant Outside containment."NURE Evaluate if the assumptions made in CESSAR-DC Section 15.6.2 for input parameters and initial conditions are the most limiting conditions for'a seal cooler tube rupture.

(4) inco porate this scenarlo into the System 80+ PRA as appropriate.

Question 440 d21 (Coat'_d_).:

(5)

Evaluate if the IRWST will have sufficient volume to permit operators to conduct an orderly RCS couldown and depressurization under leak rates determined for item fios.1(a) and 1(b) of this RAl.

(6)

Identify design features and associated cr.ergency procedure guidelines for the System 80+ design that would prevent or mitigate the potential for overpressurization of the CCW system due to a seal cooler tube rupture.

(7)

Propose any needed design modification to mitigate the consequences of a seal cooler tube rupture without terminating seal cooling / injection.

Epip_Qnso __440. lll t Recently, Arizona Public Service (APS) personnel identified a potentially significant interfacing system LOCA (ISLOCA) event on the reactor coolant pump (RCP) seal cooling system while reviewing t1RC Information flotice No. 89-54

" Potential Overpressurization of the Component Cooling Water System." APS notified the NRC of the potential for a small break LOCA due to a tube rupture in the RCP high pressure seal cooler (llPSC).

This HPSC tube rupture would be classified as an ISLOCA and would result in an overpressurization of the comaonent cooling water system (CCWS) which eventually results in a CCWS surge tant relief valve release of reactor coolant system (RCS) inventory onto the I

roof of the auxiliary building.

It was further stated that the possibility of a llPSC tube rupture and its subsequent effects were not considered in the original design and is a previously unanalyzed event for the System 80 design.

Based on the design criteria used for the llPSC as stated in our respor se to question 440.123, C-E believes that a HPSC tube rupture or the combinttion of a HPSC leak and a RCP seal failure is highly unlikely, however, System 60+

will be designed to accommodate the RCP llPSC event and potential over-pressurization of the CCWS by incorporating the following design criteria:

1) the CCWS will be able to accept the maximum in-leakage expected from a RCP HPSC tube rupture without overpressurizing the CCWS by appropriately sizing the existing CCWS HPSC relief valve and 2) the CCWS HPSC relief valve discharge will be contained within containment to prevent significant release of radioactivity to the environment and therefore, within a small fraction of the 10 CFR Part 100 guidelines, (1) The results of the Steam Generator Tube Rupture presented in section 15.6.3 of CESSAR-DC demonstrate that for RCS leaks up to 440 gpm, departure from nucleate boiling does not occur and all acceptance criteria are met. This flow rate bounds those expected for the HPSC leak and the combination of a HPSC leak and a RCP seal failure.

(2)

It was stated that the leak-before-break (LBB) aethodology is not applicable to a seal cooler tube rupture. C-E agrees that the LBB methodology will not be applied to the seal cooler tube rupture event.

i Reponto 440.RL{ Cont'd):

o (3) The CCWS IIPSC relief valve discharge will be contained within containment and, therfore, there will be no significant release of raioactivity to the environment. As a result, this event is within a small fraction of the 10 CFR Part 100 guidelines.

The assumptions made in CESSAR DC Section 15.6.2 for input parameters and initial conditions are the m t limiting conditions for a Double Ended Break of a Letdown Line Outs de Containment.

(4) The llPSC tube rupture scenario is considered to be a small break LO A and is already covered in the System 80+ small break LOCA PRA.

(5) The discharge of the CCWS llPSC relief valve will be directed to the Containment floor Drain Sump which is within the lloidup Volume.

The lloldup Volume has a spillway to the In Containment Refueling Water StorageTank(IRWST). When the lloidup Volume reaches 60,000 gallons, water spills ovi.r to the IRWST thereby replenishing the IRWST water vol ume.

Therefore, no matter what the leak rate to the CCWS is during a RCP $1PSC tube rupture, the operators will have sufficient water volume in the IRWST to conduct an orderly RCS cooldown and depressurization.

(6) Appropriate sizing of eacn RCP llPSC relief valve to accept the maximum expected in-leakage from a llPSC tube rupture will prevent overpressurization of the CCWS. The Emergency Procedure Guidelines for a loss of Coolant Accident for System 80+ will be fundamentally similar to those provided in " Combustion Engineering Emergency Procedure Guidelines," CEN-152, Revision 03. These guidelines are adequate for this scenario. The leak can be detected by a radiation detector which taps off of the CCWS pump outlet or by a rising surge tank level.

The CCWS surge tank has a high level alarm to alert the operators of an abnormal CCWS surge tank level, furthermore, on the primary side of the llPSC there are temperature indicators and nigh temperature alarms on the inlet and outlet of the llPSC which will also be used to diagnose the event.

The leak can be isolated by shutting the HPSC tube side isolation valves and/or by shutting the CCWS isolation valves for the affected RCP.

(7) The design will mitigate the consequences of a seal cooler tube rupture without terminating seal cooling / injection by (1) properly sizing the CCWS liPSC relief valve to accept the maximum expected in-leakage from a RCP HPSC tube rupture without overpressurizing the CCWS, and (2)'

directing the discharge from this relief valve to the Containment floor Drain Sump, l

Que_stion 440.122:

Evaluate the probability and the radiological consequences associated with (1) a RCP seal failure resulting in a throttle seal cooler (TSC) tube rupture and (2) throttle seal cooler tube rupture independent of a seal failure.

Ure the guidance of the previous RAI (440.121) for the HPSC tube rupture scenario.

Response 440.122:

C-E has been asked to evaluate the probability and the radiological consequences associated with (1) a reactor coolant pump (RCP) seal failure resulting in a throttle seal cooler (TSC) tube rupture and (2) a TSC tube rupture independent of a seal failure, it should be noted that a seal failure will not cause a TSC tube rupture because the RCP TSCs are designed.

for reactor coolant system pressure. Also, C E is asked to use the guidance of the previous RAI (440.121) for the HPSC tube rupture scenario.

System 80+ will be designed to accommodate a (RCP) throttle seal cooler (TSC) tube rupture and a potential component cooling water system (CCWS) overpress-urization. The design will incorporate the following criteria:

1) the CCWS will be able to accept the maximum in-leakage ex)ected from a RCP TSC tube rupture without overpressurizing the CCWS ay appropriately sizing the existing CCWS llPSC relief valve (which protects the HPSC and the TSC CCWS from overpressurization), and 2) the CCWS HPSC relief valve discharge will be contained within containment to prevent a significant release of radioactivity to the environment and therefore, within a small fraction of the 10 CFR Part 100 guidelines.

The results of the Steam Generator Tube Rupture presented in section 15.6.3 of CESSAR-DC demonstrates that for RCS leaks up to 440 gpm, departure from nucleate boiling does not occur and all acceptance criteria are met.

This flow rate bounds those expected for the TSC leak and the combination of a TSC leak and a PCP seal failure.

C-E will not apply the LBB methodology to the TSC tube rupture event.

The CCWS HPSC relief valve discharge will be contained within containment, and therefore, there will be no significant release of radioactivity to the environment.

This event is within a small fraction of the 10 CFR 100 guidelines. The assumptions made in CES HR-DC Section 15.6.2 for input parameters and initial conditions are the most limiting conditions for a Double-Ended Break of a Letdown Line Outside Containment.

The TSC tube rupture scenario is considered to be a small break LOCA and is already covered in the System 80+ small break LOCA PRA.

l l

l

- _ = _

Re_sponse 440.122 (Cont'd):

The discharge of the CCWS llPSC relief valve (which protects both the llPSC and TSC CCWS side from overpressurization) will be directed to the Containment floor Drain Sump which is within the lloidup Volume. The Holdu) Volume has a spillway to the In-Containment Refueling Water Storage Tank (IRWST). When the lloldup Volume reaches 60,000 gallons, water spills over to the IRWST thereby replenishing the IRWST water volume. Therefore, no matter what the leak rate to the CCWS is during a RCP TSC tube rupture, the operators will have sufficient water volume in the IRWST to conduct an o,rderly RCS cooldown and depressurization.

Appropriate sizing of each RCP CCWS HPSC relief valve to accept the maximum expected in-leakage from a TSC tube rupture will prevent overpressurization of the CCWS.

The Emergency Procedure Guidelines for a loss of Coolant Accident for System 80+ will be fundamentally similar to those provided in " Combustion Engineering Emergency Procedure Guidelines," CEN 152, Revision 03.

These guidelines are adequate for this scenario.

The TSC leak can be detected by a radiation detector which taps off of the CCWS pump outlet or by a rising CCWS surge tank level.

The CCWS surge tank has a high level alarm to alert the operators of a rising level.

The design will mitigate the consequences of a seal cooler tube rupture without terminating seal cooling / injection by (1) pro)erly sizing the CCWS HPSC relief valve (which protects both the llPSC and tio TSC CCWS side from overpressurization) to accept the maximum expected in-leakage from a RCP TSC tube rupture without overpressurizing the CCWS, and (2) directing the discharge from this relief valve to the Containment Floor Drain Sump.

l l

s

,,, ~ ~,.. -...

,c.

y

,.y.__.

-..r..

...m.

,,-,,em-.

Question 440,123:

Provide a structural / mechanical evaluation and the performance criteria for the design of the HPSCs and TSCs.

In addition, include any discrepancies that may exist in the seal cooler critoria as comaared to the EPRI VRD Section 3.4.2.6.1 where the thermal barrier heat exc1 anger (System 80+ HPSCs and TSCs) should have a stress and fatigue analysis which addresses all anticipated i

steady-state and transient conditions, including pump in hot standby, pump start from hot standby, loss of restoration of seal injection flow, and pump operation with a degraded seal cartridge, t

Re_iponse 440.123:

The high pressure seal cooler (HPSC) and throttle seal water (TSC) are designed and constructed in accordance with ASME Section III Subsection NB (Class 1) for the primary side and Subsection ND (Class 3) for the cooling water side of the llPSC and Subsection NB for the cooling water side of the TSC.

The design conditions are:

Primary Side:

Design Pressure 2500 psia Design Temperature 650'F Secondary Side:

Oesign Pressure 150 psi'g Design Temperature 200'F

The design conditions for the secondary side of the throttle seal cooler (TSC) are 150 psig and 200*F, however, the pump supplier has elected to upgrade th secondary side of the TSC to 2500 psia and 650'F and construct it to Subsection _NB because the TSC is attached directly to the pump. seal housing which is designed for RCS conditions.

As part of the RCP design process a seal cooler design stress analysis is performed for both the HPSC and TSC in accordance with Paragraph NB 3400 for loads associated with design, normal, upset, faulted, test and transient conditions.

The transient conditions include those the pump experiences from reactor coolant system transients plus loss of and restoration of seal injection water with pump operating and on hot standby and loss of and restoration of CCW with the pump operating and on hot standby.

In addition an analysis is perfou ed ta demonstrate that the high pressure cooler and internal tube bundle is rigid and, therefore, not subject to cyclic fatigue due to vibration. _ A similar analysis is performed on the throttle seal cooler tube to demonstrate that it is rigid and also not subject to_ cyclic fatigue.

The design criteria used for the HPSC's and TSC's is consistent with that suggested in EPRI VRO Section 3.4.2.6.1 with the following clarification.

The l

thermal barrier heat exchanger is usually a heat exchanger mounted internal to l

the pump and in some cases integral to-major pressure boundary components.

As such the stress analysis and particularly the fatigue analysis is critical to pressure boundary integrity.

In the case of the System 80+ RCP's, the thermal

Response 440.123_.(Cont'Q:

barrier function is performed by the high pressure stal cooler (IIPSC) in combination with seal injection water as ex)lained in the response to question 440.125.

The llPSC is mounted external to tle pum) and is a more traditional shell and tube heat exchanger.

The Palo Verde RC) llPSC and TSC were evaluated for cyclic loading and it was determined that the exclusion criteria of Paragraph NB 3222.4(d) was satisfied and a fatigue analysis was not required.

)

The System 80+ llPSC design is the same as the Palo Verde llP5C.

)

l l

l 4

,-.--.,-,._,...:,...~..c......__._..

i Que_stion 4402234:

(GSI-105:

Interfacing Systems LOCA at LWRs)

The evaluation of the llPSCs and ISCs should consider the events described in 440.121 as potential interfacing system LOCA pathways.

These heat exchangers should be included in the analysis for addressing ISLOCA under the guidance of RAI 440.47 and appropriately refl' ted in the resolutions of GSI-105 and GS!

B 63.

Rejsponsg_440d24:

C E is asked to consider the reactor coolant pump (RCP) high pressure seal cooler (llPSC) and throttic seal cooler (TSC) tube ruptures as potential interfacing system LOCA pathways. Further, these heat exchangers should be included in the analysis for addressing ISLOCA under the guidance of RAI 440.47 and appropriately reflected in the resolutions of GSI-105 and GSI B 63.

The RCP llPSC tube rupture and the RCP TSC tube rupture will not be potential interfacing system LOCAs with a direct path release to the environment when the design changes as stated in 440.121 and 440.122 are incorporated into the System 80+ design.

This position is based on the following:

1) there will be no significant release of primary coolant outside of containment via the component cooling water system (CCWS)-because the RCP llPSC relief valve discharge is contained within containment.

The liPSC relief valve protects both the llPSC and TSC CCWS sides from overpressurization; 2) the CCWS will not be overpressurized by this event due to appropriate sizing of the liPSC relief valve; and 3) any liPSC or TSC tube rupture that occurs can be isolated (see response to RAI 440.121and440.122).

Further, there will be no significant loss of reactor coolant system makeup water due to this event because the RCP llPSC relief valve discharge is directed to the Containment floor Drain Sump which is within the Holdup Volume and which spills over to the in Containment Refueling Water Storage Tank.

The resolutions of GSI-105 and GSI-63 are not affected by these design changes and do not have to be changed to accommodate these events. The CCWS is protected from overpressurization from a liPSC or a TSC tube rupture.

Therefore, upgrading of the CCWS system piping and CCWS isolation valves to RCS design pressure are not required.

It is stated that the heat exchangers should be included in the analysis for addressing ISLOCA under the guidance of RAI 440.47, however, RAI 440.47 does not deal with ISLOCAs.

RAl 440.47 deals with testing of the Shutdown Cooling System at full flow conditions. The RCP seal coolers are adequately designed for the seal cooler tube rupture event. The tube side of the HPSC and the TSCs are designed for RCS pressure while the shell side of the liPSC is -

designed for CCWS pressure and the shell side of the TSCs is designed for RCS

1 4

8elponse 440.124 (Cont'dl:

pressure.

If a ru)ture were to occur, the CCWS side shell side) of the seal coolers would not se overpressurized because the seal (cooler relief valve will a

i be appropriately sized to prevent overpressurization for this event.

4 l

r I

I 4

i 6

l l

f l

j Qu_eistion 440.125:

As part of the response to the above RAls related to RCP seal integrity (GSI-23) and llPSC/TSC tube rupture analysis, provide a color coded simplified P&l0(s) of the CE KS8 RCP shaf t seal system to be used in the System 80+

design clearly identifying:

(1)

Each seal, each seal injection cooler (liPSC and TSCs), associated instrumentation and alarms, seal cooler heat exchanger isolation valves.

(2) Seal injection flow directions throughout the shaf t seal assembly.

including the journal bearing, durinq normal seal injection and during loss of seal injection (with and witha t HPSC tube rupture), indication of points of seal injections, RCS controlled leakage, etc...

(3) All CCW interfaces with the RCP seal injection and associated piping, components, and CCW instrumentation that would prevent or mitigate the radiological consequences of a catastrophic tube break in the seal coolers (IIPSC and TSCs).

Re_sponse 440.lL5:

The System 80+ RCP P&lD is shown in figure 5.1.2-2 of CESSAR DC. The flow paths, instrumentation and components (llPSC, TSC's and ilPSC isolation valves) are schematically shown. The pressure and temperature entering each seal cavity is indicated and alarmed in the control room.

The temperature entering and leaving the HPSC is also indicated and alarmed.

The seal controlled bleed off flow is indicated and alarmed in the control room. All of these parameters can be recorded for the purpose of trending seal performance.

Operating limits for these parameters are established and plant operators can evaluate seal condition and performance instantaneously or on a long term basis.

The System 80+ RCP uses a system of three seals, figure 1, to scal the main i

shaft.

The seals are su) plied with filtered, chemically controlled seal injection water by the C1emical Volume Control System (CVCS). Two i

. hydrodynamic seals are mounted in series, with a third stage vapor seal mounted above the two lower stages. Reactor coolant system (RCS) pressure is reduced to volume control tank aressure in stages by the controlled leakage bypass system, which contains tirottling devices which are also called throttle seal coolers (TSC). The first two seals provide approximately 84 percent of the system pressure drop (42 percent each).

The pressure drop across the third seal is approximately 16 percent.

Each of the three seals is capable of operating at full system pressure.

Controlled bypass leakage is approximately 4 gpm and is piped to the volume control tank.

Any leakage past the vapor seal is piped t the reactor drain i

tank.

Seal materials consist of carbon for the rotating r ng and tungsten l

carbide for the stationary ring.

. ~

i I

4 ReJponse 440.115(Cont'd):

1he RCP seals are normally furnished with both CCW and seal injection (SI)

J water to provide independent and redundant seal cooling. The RCP seals are capable of continuous operation with either CCW or SI water and, therefore, I

loss of either system will not compromise the integrity of the seals.

RCP seal cooling is accomplished by incorporating a coolant recirculation system within the RCP.

51 water is injected directly into the recirculation i

system.

The system contains the liPSC which provides redundant cooling for the i

recirculated water by means of CCW on the secondary side of the llPSC.

The seal coolant recirculation system is a feed and bleed arrangement, i.e., 6.6 gpm of Sl water is feed in and 4.0 gpm is bleed out through the seals as controlled bypass leakage and the remaining 2.6 gpm passes into the RCP casing and then into the RCS.

Total recirculation within the system is approximately 25 gpm.

Operation of the seal cooling recirculation system is described below, flow diagrams for normal operation of the seal cooling recirculation system with 51 & CCW, with loss of S1 water and with loss of CCW are shown on figures 2 and 3.

For normal operation, figure 2, seal injection water (6.6 gpm) enters into the high pressure piping, mixes with the recirculated coolant and is directed to the llPSC before entering into the seal system.

for this condition the primary source for cooling is Sl water and the heat load on the 11PSC is low.

The TSC's are located before the second and third seal 2tages and provide supplementary cooling for these stages.

1he recirculation water (25 gpm) from the llPSC enters the high pressure side of the first seal and is divided into-two flow 3aths. A portion of the flow (21 gpm) is aumped through the journal bearing )y the auxiliary impeller.

This cools tie journal bearing and minimizes the ingress of contaminants into the seal system. Anproximately 2.6 gpm of this flow enters the RCS through the pump casing.

Ihe balance of the flow (18.4 gpm) recirculates back to the 11PSC but mixes with 6.6 gpm of Si before the flow enters the llPSC.

The second flow path (4.0 gpm) is through a TSC to the high )ressure side of the second seal.

Flow from the second seal continues througi another TSC to the third seal and then to the volume control tank (VCT) in the CVCS.

This controlled bypass leakage through the TSC's is commonly called controlled bleed off (C00) flow (4.0 gpm).

in the event seal injection (SI) water is not available figure 3, water (4.0 gpm)comesfromtheRCS,mixeswiththerecirculationflow and passes through the llPSC. As before, a portion of the water from the llPSC is circulated by the auxiliary impeller through the bearing mixes with water from the RCS and then back to the llPSC.

The other portion of the flow becomes controlled bleed off (CB0) and passes through the seals to the VC1.

For this condition the liPSC operates under maximum design heat load and cools mixed RCS water down to seal operating temperature, for a concurrent loss of seal injection water and a llPSC tube rupture, water from the RCS would flow into the 11PSC and through the ruptured tube. The controlled bleed off flow would decrease since the flow takes the path of least resistance and would bypass the seals and pass' into the itPSC.

1 fleiponse 44Qd2LLQ9fd.1:

If component cooling water is not available the seal cooling recirculation system operates the same as when Si and CCW is available except that the S1 water provides all of the seal cooling. The flow diagram for this condition 4

is the same as figure 2.

liigh pressure isolation valves are provided upstream and down stream of the llPSC.

These valves are designed to close against full system pressure.

The mechanical integrity of the lipSC, the llPSC isolation valves and the piping connecting these components to the pump is assured by classifying them as Safety Class 1, ASME B&pV Code Class I components.

The balance of the seal cooling recirculation system is contained within the pump pressure boundary seal housing which is a ASME B&pV Code Class I component.

All CCW interfacns with the RCp coolers (llpSC & TSC) are shown in figure 9.2.2.1 CESSAR DC. A leak into the CCW system due to a seal cooler tube rupture can be detected by radiation detectors within the CCW syste., or by a rising CCW system surge tank level.

'I l~

L

f YOs \\

\\

CONTROLLED nLtr.D OIT F1,0W (CBO) gg g

i 4

fSPRl WGS

/

//s

/

SHAFT SLEEVE

/

/-

STATIONARY FACF i

/

f h

ROTATitG FACE

/

Num san.

M i

// G

\\ ;

i/dik-

\\hD s '

N gNW

)

N 1

- L N

s "JR#*

N\\\\N g,

'amnT!*

N x

=

Ngy i

~

\\ /

'N/

N[/

/

~~

'\\,// d

,e

= s%

t k$h HYDRODYHAMit SHATT SEAL ASSEMET FIGURE 1

~

TAT Pfo.G I SEAL m

LEAKAGE Pol a SEAL CAVITY PRESSURE P02 = INTERMEDIATE PitESSURE Clio P03 = GACKUP PRESSURE

... FLOW 7?RESTRICTOR CCb' RIGID COUPLING I8 p

URE COOLER

--y H"

~ TOS l

ced THIRO SEAL P03 3

~

(BACKUP SEAL)

THROTTLE

~

o COOLER H.-

l To4 o

SECOND SEAL Po2 3

ccw

~ [

THROTTLE

~

~ COOLER h* ~T03 M H

~

c.

FIRST SEA 1.

)

, pot '

I l

T02 CYCLONE AVAILIARY ~~/ Mi Q FILTER IMPELLER J.

L,a l

JOURNAL BEARING i

T01 p

IMF6LLER

- aSEAL INJECTION

. Figuro 2 Flow Diagram for Hydrodynamic-5 haft Seal System.

Normal Operation - with CCW & SI r_.,,,r, y

-..u.-

,,_r-.

_y

...,.3

-,y, y.

...,w..y my,-.

-.9

, ~, _,.s.m..

.._,,m y,,._m

9.Prf +10 lkf lSEAL LEAKAGE Pol = SEAL CAVITY PRESSURE P02 a lNTERME0 LATE PRESSURE

. CB0 P03 = DACKUP PRESSURE

. FLOW i7 RESTRICTOR CCM RIGIO COUPLING -

HIGH PRESSURE COOLER L

~ l'~

H

-TOS J~

THIRD SE AL i

(OACKUP SEAL)

TifROTTLE o

COOLER l

H.-

I To4 o

SECOND SEAL pg2

~ THROTTLE

( _ COOLER H

FIRST SEAL 1NO m

P01 l

T02 CYCLONE AUXILIARY *""T i-~ 7 i

d FILTER 1MPELLER 1

1.,,,,,1

,L JOUliNAL l

BEARING JET PUMP

~

l

+

J l

T01 SEAL IMPELLER INJECTION = 0 Figure 3 Plow Diagram for Ilydrodynamic 5haf t Seal System.

Operation without SI 6 with CCW

RAI No. 440.126 Page 1 of 5 s

Question 440.126 Under LOCA conditions, if a loss-of-offsite-power (LOOP) occurred at some time interval after the emergency diesel generators (EDGs) are i

up to rated voltage and speed and after the required engineered safety features (ESF) actuations, the potential exists for draining the fluid systems during the time it takes to resequence, reload and restart pumps. Restarting essential pumps (safety injection and support systems) with voided lines may result in problems due to l

air / steam binding, pump over speed on low discharge resistance, or water hammer.

Essential systems should be capable of successful restart following loss of offsite power, if a LOOP were to occur at the time of turbine trip or at anytime following the accident.

Please evaluate the possibility and potential consequences of restoration of interrupted safety injection system (515) flow to the core with the following considerations:

1. Possibility of. air / steam entrainment in the direct vessel injection (DVI) lines resulting in:

a)

Air / steam binding of the SIS pumps b)

Water hammer on DVI lines and components after SIS pump-restart due to steam vcided lines.

2.

Possibility of steam entrainment in the DVI line resulting in SI pump overspeed on pump restart after being sequenced onto the EDG bus / load resulting in an overload of the emergency diesel generators.

3.

Possibility of draining other essential fluid. systems such as the SW, CCW, Shutdown Cooling (SCS). Emergency feedwater system, demonstrating that adequate safety system performance will be ast.umed for s delayed LOOP event.

Response 440-126 la) The physical layout of the System 80+ plant (with the safeguards pumps directly below the IRWST) provides pump protection against air and steam entrainment upon loss of normal power.

Equipment locations ensure a continuous positive pressure on the pump from both the cuction a,nd discharge side. The specific advantage of having the positive pressure is that there will be a water column seal protecting-the pump.

Backflon is prevented by a series of four check valves in-the discharge header.

The result.is that', if power is lost, ste'am and air will be isolated from the pump, thus preventing binding.

1

.~,--,_m,

,_,,,-.r--,.-~-,

--m--,..

-m-.m,m,_.-,

-r--

--r w.

I RAI No. 440.126 Page 2 of 5 ib) The question regarding water hammer in the OV! lines of the SIS is interpreted to be a result of the condensation-inouced phenomena experienced in the feedlines and feedrings of steam generators.

The scenario presented in the question conforms to the situation described in NUREG-1606. The issue identified in NUREG-1606 has been considered to be technically resolved with the incorporation of the design guidelines provided in NUREG-0918. These der,ign guidelines have been used in the design of the DV! lines and, hence, the potential for condensation-induced water hammer is expected to be negligible.

The following is a discussion on how the OVI line design has incorporated the guidelines of NUREG-0918. These items will protect not only the DVI lines from condensation induced water hammer, but will also minimize steam and air induction into the SIS for pump protection.

The first recommended guideline in NUREG-0918 is to keep the piping flooded at all times so as to eliminate steam entrance into the system. Although this is an ideal situation for the injection line, it is not possible for all postulated LOCA scenarios. However, the design of the SIS provides two features that will minimize the effect of voids in the injection line.

The first is the time limit required on the control system to t. witch power sources and reestablish steady state flow. This will be discussed in more detail under the second design guideline. The intent is to minimize the amount of RCS inventory that would be lost during a power source transfer. The second is the physical interface differences between the SIS and feedring and their respective sinks.

The feedring interface identified in NUREG-1606 discharges down through multiple holes located all along the ring. These holes act as orifices restricting flow out of the ring as the fluid level in the steam generator drops. The result is that if the fluid level drops at a sufficient rate, there would still be fluid in the ring above that in the generator leading to the phenomena detailed in figure 4 of j

NUREG 0918. The SIS interface with the RCS is-not like the feedring i

i e

,+,-a,w e-

-m

~w

,,,,w--

,,,,_,._,-.mn,wn,,,-y----

x

.,.,5 a

.-.,y.w

--m.,

r-, -,,

-e,

,w

,p--.g,

- - -. -. - ~. _..

RAI No. 440.126 Page 3 of 5 interface with the steam generators.

Instead, it is an abrupt pipe to vessel entrance withvat restrictions.

Therefore, there is no orifice type interface and the fluid level will drop at the same rate in both the DVJ line and the reactor vessel eliminating the fluid interface to

)

seal the steam into the line upon refill.

The second guideline presented in NUREG-0918 is to minimize the time that the flowrate has been interrupted during power source transfer.

This is where theie is a major difference between the $15 and the e

situation presented in NUREG-1606. NUREG-1606 and NUREG-0918 discussion is based on a time frame of about 20' minutes before the i

restoration of steady state flow has been established. This allows for a significant drop in water level and, hence, steam entrainment into the feedring. However, the SIS design has invoked very stringent time requirements to restore full delivery flow subsequent to an interruption of power.

Section 7.3.1.1.2.3.f-g, page 7.3-16 of CESSAR-DC details the requirements for establishing and reestablishing Sls flow subsequent to a loss in power.

The time limit for System 80+

to establish flow at the onset of an ESFAS without offsite power is 40 seconds (worst case), and to transfer the SIS pumps to the diesel generators subsequent to the generators operating at rated speed and voltage is 20 seconds. These time frames are clearly within the guidelines of NUREG 0918.

l The third design guideline presented in NUREG 0918 is to shorten the horizontal length of pipe connecting to the vessel. The intent is to minimize the potential volume in the injection line that can be filled with steam by providing a positive water seal. Horizontal lengths of piping are postulated to be susceptible to trapping-steam resulting in water hammer.

The volume in the safety injection lines near the reactor vessel is minimized, as in this guideline, and also a reason related to the safety analysis. The safety analysis establishes limiting volumes with associated boron concentration levels for the Safety injection System.

Therefore, comparing the volume established in the safety I

L

~--

m -

~ _ - - - -. -.. -. -. -.

RAI No. 440.126 Page 4 of 5 analysis for the region closest to the reactor vestil to the volume of the feedring as shuwn in figure 3 of NUREG 0918, shows that the S1 arrangement has limited the possible volume for steam entrainment.

Furthermore, part of the volume credited for the safety analysis is i

beyond the first check valve. Hence the actual volume available for steam entrainment will be even less than that employed in the safety analysis.

2)

The SI pumps are equipped with constant speed motors. Therefore, based on this and the protection against steam entrance described above in response to part 1, the SI pumps will not cause an overloading of the I

diesel generators due to overspeed followinD a LOOP.

3)

The following is provided to demonstrate that the safety function of the essential systems listed in the question will not be jeopardized subsequent to a delayed LOOP event.

(a) CCW (Component Cooling Water System) - The CCW is a closed loop system with no direct interface with the primary system.

All NSSS interfaces are across physical boundaries, e.g., heat exchangers, such that with a loss of power no fluid loss would occur. Therefore, the-CCW system would not be drained and would retain its safety function.

subsequent to a delayed LOOP evait.

i (b) SCS (Shutdown Cooling System) - The SCS utilizes the same j

discharge interfaces as the SIS and takes suction from the bottom of l

the RCS hot leg line.- Therefore,-based on the description provided above to part 1 of this question the SCS system would accomplish its safety function subsequent to a delayed LOOP event.

(c) SW (Station Service Water System)- The SW is a closed loop system with no direct interface with the primary system. All NSSS~ interface is across a physical boundary, i.e. heat exchanger, such that with a loss of power no fluid loss would occur. Therefore, the SW system would'not be drained and would retain its safety function subsequent to a delayed LOOP event.

RAI No. 440.126 Page 5 of 5 (d) EFW (Emergency.Feedwater System)- The'EFW interfaces with the feedwater system. As a result, the same guidelines of NUREG-0918 are applicable. The only notable ci/ference is that the Emergency Feedwater pumps have been included in the same classification for the time limit to restore full flow as the SI pump of 20 seconds.

Therefore, based on the description provided above to part 1 of this question, the EFW would not be drained and would retain its safety function subsequent to-a delayed LOOP event.

4

,s v

+ -

-n e

i OVESTION 440.127 l

(USI A-17: System Interaction in Nuclear Power Flants) USI A-17 l

deals with adverse systems interactions (ASIS) th nuclear power plants where intersyst o dependencies (or system interactions) have been divided into three classes based on the way they propagate; functionally coupled, spatially coupled, and induced l

human intervention coupled ASIS as defined by NUREG-1299 and Gencric Letter 89-18. USI A-17 is concerned with more than just water intrusion and internal flooding from internal sources since there are other coupling mechanisms, such as seismic events and pipe ruptures, that should be considered during the design phase ASIS review.

CESSAR-DC issue description of USI A-17 states that in NUREG-1229 the NRC concluded that for future plants, the existing SRP (NUREG-0800) in general covered the ASIS of concern.

It should be noted that the NUREG-1229 conclusions were formulated without the benefit of a design specific review of an-advanced design.

New or differently configured. systems.(i.e., SDS, IRWST, SIS,.

non-safety CVCS, etc...) may not have an SRP section or have an SRP section requiring modification and subsequently lend the possibility for undiscovered ASIS.

Therefore, please address the following item:

-i (1)

Identification of provisions to be proposed in the System 80+ Inspections, Tests, Analyses, and Acceptance Criteria (ITAAC) pr. gram-that account for identification and~

corrective actions for identified ASIS during the construction phase of a System 80+ plant.

(2)

Propose a comprehensive and specific program providing:

(a) ASIS identification via the CESSAR-DC Appendix.B i

PRALstudy.

(b) Full direction for' implementing the resolution actions.

I (c) Location of the program and findings to be; incorporated in CESSAR-DC.

RESPONSE 440.127 (1) USI A-17 is responded to in CESSAR-DC Appendix A and,as'a l

conclusion, states "the design process for the System 80+

Standard Design takes into account the possibility for interaction _ between systems.to occur that may-degrade p1 ant safety, but are not easily recognizable. To the extent practicable, as-the design progresses these interactions will be identified. Their impact on safety will be evaluated,. and the necessary corrective actions will be taken "

l

_,_~

M7

'fYo. n.7 The design process for System 80+ addresses the requirements to evaluate potential adverse systems interactions. A basic design requirement for plant general arrangements, safeguard systems and instrumentation was to maintain separation of components and power supplies so that adverse systems interactions, such as those identified in this RAI, would not occur. No adverse systems interactions have been identified nor are any expected.

As part of the normal design process, evaluation of the potential for ASI will continue. Any ASIS that are identified will be resolved so that the final design will not retain any ASIS which can have a significant impact on performance.

ITACC will be available to provide assurance that the facility is constructed and can be operated in conformity with the certified design. The ITACCs will be performed in conjunction with the tests and inspections required under the provisions of 10CFR Part 50.

The scope of these combined test and inspection programs is such that ASIS not identified and resolved during the design process would be found in the course of executing the programs to bring the plant to an operational state.

The impact of ASIS identi-fied in this manner would be evaluated and corrective actions taken, as appropriate.

I 2(a) The System 80+ PRA directly covers functionally coupled ASIS, As part of a s&duled update of the System 80+ PRA, fire and flood ri::k potential are being qualitatively assessed. This will in part, address spatially coupled ASIS Spatially coupled ASIS are addressed in part by the seis ic PRA.

Induced human intervention coupled ASIS will be evaluated in parallel with the System 80+ PFA update.

2(b) Significant ASIS identified during the design process will be evaluated for their impact on plant safety.

Appropriate design changes will be made to eliminate significant ASIS.

l l

2(c) The program summary (part 1, above) will be added to CESSAR-DC Appendix A, USI A-17.

Direction for reviewing plant actual construction and operational data to evaluate the potential for ASIS will be incorporated in the detailed construction turnover and test procedures developed for the specific plant. Evaluation would be performed as nart of the performance of system walkdowns, component and system operational testing, integrated system testing during steady state and transient testing and, finally, during test results review by plant technical teams.

CESSAR PdMCATl;ft 3

%/

ACCEPTANCE CRITERIA The acceptance criterion for the resolution of USI A-17 is that attention shall be paid in the detailed plant design to detecting and minimizing the potential for ASIS due to the effects of flooding and water intrusion from internal-plant sources, such as the incidents at operating plants referenced in NUREG-1174.

The objective is to proscrve the means for reaching and maintaining a safe hot' shutdown.

In addition, consideration should be given using the overall plant PRA to identify ASIS, especially with regard to concerns based on operating experience documented in LERs and/or NRC Information Notices.

RESOLUTION I

ASIS are difficult to predict or detect, and are determined by-the specific, detailed system designs and_ layouts.

They may also be influenced by buh ding design features.

For the System 80+ Standard Design, therefore, consideration is given during the development of the plant design to -identifying and ameliorating potential ASIS, particularly with regard to flooding and water intrusion events which are not covered by q

current SRPs, as discussed in NUREG-1174.

These events include water or moisture release from sources internal to plant structures, and may involve only small amounts of water and subtic communication paths to sensitive equipment such as electrical cabinets.

x At the same time, the design is evaluated --for 'its vulnerability to ASI's identified from. previous designs or experienced at operating plants and reported-in LERs and/or. NRC Information Notices.

This evaluation has been made for each of-the interaction incidents resulting-from water intrusion at operating plants _ described -in the NRC Information Notices referenced in NUREG-1174,'to identify the features of the System 80+ Standard Design wh.ich should ensure prevention of a similar-interaction.

l The analytical' uodols developed for the System 80+ Standard Cosign PRA-(CESSAR-DC Appendix B) have.the capability to evaluate the impact of any systems -' interaction detected which appears tb be significant.

As the -detailed design is _ developed, these analytical models will be used to identify potential.. ASIS - and provide guidanco on their climination.

Ser-f k

-Amendment-I A-76b December 21, 1990

$n.S e <--t A

The design process for System 80+ addresses the requirements to evaluate potential adverse systems interactions. A basic design requirement for plant general arrangements, safeguard systems and instrumentation was to maintain separation of components and power supplies so that adverse systems interactions, such as those identified in this RAI, would not occur. No adverse systems interactions have been identified nor are any expected.

As part of the normal design process, evaluation of the potential for ASI will continue. Any ASIS that are identified will be resolved so that the final design will not retain any ASIS which can have a significant impact on performance.

ITACC will be available to provide assurance that the facility is constructed and can be operated in conformity with the certified design. The ITACCs will be performed in conjunction with the tests and inspections required under the provisions of 10CFR Part 50. The scope of these combined test and inspection programs is such that ASIS not identified and resolved during the design process would be found in tne course of executing the programs to bring the plant to an operational state. The impact of ASIS identi-fled in this manner would be evaluated and corrective actions taken, as appropriate.

l l

l

o OUESTION 440.134 Since the safety depressuritation system is a safety grade system, propose' technical specifications for SDS operability for all appropriate modes of plant operation (include full power conditions).

RESPONBE 440.134 The safety depressurization system-technical specifications will be provided in a future amendment to CESSAR-DC, Chapter

16. See the response to the request for additional information from the NRC Technical Specification Branch, dated 10-16-91.

4 l

l J

Question 440.136 (GSI-22: Inadvertent Boron Dilution Event)

In the event of a SCS or DVI component is taken out of service for maintenance and the line downstream of the respective component is drained, are there any SCS or OVI line interfaces that have the potential for inadvertently refilling these lines with deborated water?

Response

Inadvertent refilling of tbc DVI portions of the Safety injection System (SIS) and the Shutdown Cooling System (SCS) with deborated water has been minimized to the extent practicable. The design of the SIS and the SCS has addressed the inadvertent boron dilution event presented in Generic Safety Issue 22 by controlling the system's source of water and preventing fluid back-flow into

he system, l

Specifically, all SIS and SCS fluid interfaces that supply makeup originate-from a source of borated water of sufficient concentration to meet the system requirements. The IRWST is the source of safety grade water for all l

operations of the SIS and SCS, In addition, the SCS can b'e filled from the CVCS.

l In addition, relief valve, vent and drain discharges are routed directly to one of three tanks (the reactor drain tank, equipment drain tank or the holdup volume tank) or to room sumps. The tanks are non-pressurized and are at a lower elevation than the pipe connection with the systems. This arrangement 4

precludes the possibility of siphoning the contents out of a tank, or sump, and diluting the boron concentration in either system.

4 4

QUESTION 440.138 Explain any provisions of the System 80+

administrative procedures and Technical Specifications that justify the assumption that the 180 gpm flow of one CVCS charging pumps is a conservativo dilution rate for MODE 5 midloop operations and not both charging pumps.

In addition, since the non-safety related CVCS does not have any corresponding Technical Specifications for its operability or technically specified lockout provisions for a charging line not in use, provide justification for using one charging pump for operations 1 modes 1, 2,

3, and 4 in the inadvertent deboration (ID) analysis.

RESPONSE 440.138 Powering of only one charging pump at a time is-a design feature of the System 80+ CVCS design.

In addition, administrative procedures will provide operator instruction on the proper operation of the standby pump.

The maximum flow rate from one charging pump of 180 gpm is therefore justified'for the Inadvertent Boron Dilution (IBD) analysis, i

I I

-

LD-92-020, Responds to Request for Addl Info Re C-E Std SAR-Design Certification

Contents

Text

Subject:

Dear Sirs:

;

= = = = = = = = =

Response

References:

Response

Navigation menu

LD-92-020, Responds to Request for Addl Info Re C-E Std SAR-Design Certification

Text

Subject:

Dear Sirs:

;

= = = = = = = = =

Response

References:

Response

Navigation menu

Search