ML003734245

NRC Comments on Appendix B to NEI 97-04, Design Bases Program Guidelines

ML003734245
Person / Time
Site:	Nuclear Energy Institute
Issue date:	07/18/2000
From:	Carpenter C NRC/NRR/DRIP/RGEB
To:	Pietrangelo A Nuclear Energy Institute
Magruder S, NRR, 415-3139
References
-nr, NEI-97-04
Download: ML003734245 (30)

Text

July 18, 2000 Director, Licensing Nuclear Generation Division Nuclear Energy Institute Suite 400 1776 I Street, NW Washington, DC 20006-3708

SUBJECT:

NRC COMMENTS ON APPENDIX B TO NEI 97-04, -DESIGN BASES PROGRAM GUIDELINES"

Dear Mr. Pietrangelo:

This letter forwards NRC staff comments on the November 17, 1999, version of Appendix B to NEI 97-04, "Design Bases Program Guidelines." The comments are being provided to you to facilitate discussion at a public meeting on the subject of endorsing the NEI guidelines via a Regulatory Guide scheduled for July 27, 2000.

I believe that the comments are editorial in nature and that they will Improve the clarity of the guidance. Enclosure 1 is a redline/strikeout version of the general and specific guidance and is a marked up version of the guidance. I look forward to discussing these comments with you, along with the comments you provided on the draft Regulatory Guide in your letter dated June 15, 2000, at the meeting and to reaching closure on this issue.

Sincerely,

/RA/Barry Zalcman for Cynthia A. Carpenter, Chief Generic Issues, Environmental, Financial and Rulemaking Branch Division of Regulatory Improvement Programs Office of Nuclear Reactor Regulation Project No. 689

Enclosures:

As stated cc w/encls: See next page DISTRIBUTION: ADAMS PUBLIC RGEB R/F SCollins/RZimmerman JJohnson BSheron DMatthewslCAder CCarpenter SWest EMcKenna RWeisman SMagruder OGC Document Name:g:\slml\nrcdbcomments.ltr.071800.wpd DISTRIBUTION: See attached page Document Name:g:\slm1\nrcdbcomments.Itr.071800.wpd OFFICE RGEB SC:RGEB C:RGEBI I

NAME SMagruder:sw iSWeVi Cegf 4 DATE 7/10 /0000 77/ It/00 OFFICIAL OFFICE COPY

UNITED STATES NUCLEAR REGULATORY COMMISSION WASHINGTON, D.C. 205554001 July 18, 2000

£'eazrs Mr. Anthony Pietrangelo Director, Licensing Nuclear Generation Division Nuclear Energy Institute Suite 400 1776 1 Street, NW Washington, DC 20006-3708

SUBJECT:

NRC COMMENTS ON APPENDIX B TO NEI 97-04, "DESIGN BASES PROGRAM GUIDELINES'

Dear Mr. Pietrangelo:

This letter forwards NRC staff comments on the November 17,1999, version of Appendix B to NEI 97-04, wDesign Bases Program Guidelines.' The comments are being provided to you to facilitate discussion at a public meeting on the subject of endorsing the NEI guidelines via a Regulatory Guide scheduled for July 27, 2000.

I believe that the comments are editorial in nature and that they will improve the clarity of the guidance. Enclosure I is a redline/strikeout version of the general and specific guidance and is a marked up version of the guidance. I look forward to discussing these comments with you, along with the comments you provided on the draft Regulatory Guide in your letter dated June 15, 2000, at the meeting and to reaching closure on this issue.

Cynti r, Chief Generic Ises, Environmental, Financial and Rulemaking Branch Division of Regulatory Improvement Programs Office of Nuclear Reactor Regulation Project No. 689

Enclosures:

As stated cc w/encls: See next page

REDLINE AND STRIKEOUT VERSION OF GENERAL AND SPECIFIC GUIDANCE General Guidance 10 CFR 50.2 design bases rire set rt nulearoWer plants fin s afet report (FSAR), consist of the following:

• Design basis functions: Functions performed by ytmsstructures, and om ponents (SSCs) that are (1) required y,'otherwise arenpeessaiy to iyh, regulations, license conditions, orders or technical me specifications, or (2)credited in Micensee safety analyses to meet NRC requirements.

• Design bases values: Values or ranges of values of controlling parameters established ase refers b unds for desigsn bases funional 6e6uirements. These vaiues m blhed by NRC requirement, establshed 2)e d romor confirmed by) analyses pnari,j d J A, teB l

, (3)',chosen by the licensee from an applicable code, standard or guidance document es reference bbounds for design to meet design bases functional reqttirements re tod te iihe1sAR Specific Guidance (a) SCs ifiorhI'ch theF'SAR dentifies 10 CFR 50.2 design bases functions include mustbe pable of -perfoniiring those f~uc q under he bounding conditions

-e~cribMinIe FARwhich - the SSCs must perform design bases functons.

These bounding conditions may be derived from normal operation or any accident or events for which SSCs are required to function, Including anticipated operational occurrences, design basis accidents, external events, natural Enclosure 1

phenomena, and other events specifically addressed in the regulations such as Station Blackout ($0 and ii Sr WS.

(b) The 10 CFR 50.2 design bases of a facility are a subset of the uW licensing basis and are required pursuant to 10 CFR 50.34(a)(3)(ii) and (b)and 10 CFR 50.71 (e)to be included Inthe updated FSAR.

(c) Underlying the 10 CFR 50.2 design bases is substantial supporting design Information. Supporting design information includes other design inputs and design analyses iet o ed fom NRC requiiTre ts ,Oraet P E RA, and design output documents. Supporting design information may be contained in the UFSAR (asgesgn pepscrpti nfotin) or other documents, some of which are docketed and some of which are retained by the licensee.

rE:VI NUCLEA! ENERGY INSTITITE Anthory R.PlOt9ngelo '

-IRECTOR UCENSG -

ECLER GENERATON November 17, 1999 Mr. David B. Matthews, Director Division of Regulatory Improvement Programs Office of Nuclear Reactor Regulation U.S. Nuclear Regulatory Commission Washington, DC 20555-0001 PROJECT NUMBER 689

Dear Mr. Matthews:

Enclosed for NRC endorsement is revised Appendix B to NEI 97-04, Design Bases Program Guidelines. The enclosure reflects only minor differences from the version we sent to you on October 28.

Based on the November 5 NRC staff presentation'to ACRS, we understand that the staff plans to endorse the industry guidance without exception in a draft regulatory guide to be forwarded to the Commission later this month. Subject to Commission approval, DG-1093 will be published shortly thereafter in the FederalRegister for public comment. Early next year, we intend to work with the staff on any final adjustments to the guidance based on public comments received to facilitate NRC endorsement in a final regulatory guide.

We are pleased that we have come to closure on issues surrounding the interpretation of 10 CFR 50.2 design bases. The common understanding achieved will greatly improve the clarity and efficiency of several affected regulatory processes including reportability determinations, 10 CFR 50.59 evaluations, FSAR updates, the inspection process, and the proper characterization of design discrepancies.

Please call me if you have any questions regarding the enclosure.

Sincerely, OriginalSigned By Anthony R. Pietrangelo Enclosure c: Stewart L. Magruder, Jr.

Enclsoure 2 I.

Revised NEI 97-04, Appendix B Guidance and Examples for Identifying 10 CFR 50.2 Design Bases 10 CFR 50.2 Definition Design bases means that information which identifies the specific functions performed by a structure, system, or component of a facility and the specific to be or ranges of values chosen for controlling parameters as reference bounds values design. These values may be (1) restraints derived from generally acceptedfor of-the-ark" practices for achieving functional goalssor (2) requirements "state-derived from X analysisbased on calculations and/or experiments) of the effects of a postulated accident for which a structure, system, or component must meet its functional X X goals.

General Guidance 10 CFR 50.2 design bases consist of the following:

• Design bases functions: Functions performed by SSCs that are (1) required to meet regulations, license conditions, orders or technical specifications, or (2) t credited in safety analyses to meet NRC requirements.

• Design bases values: Values or ranges of values of controlling parameters SI established by NRC requirement, established or confirmed by safety analyses, s

or chosen by the licensee from an applicable code, standard or guidance version document as reference bounds for design to meet design bases functional requirements.

Specific Guidance:

a) 10 CFR 50.2 design bases functions include the bounding conditions under which SSCs must perform design bases functions. These bounding conditions may be derived from normal operation or any accident or events for which are required to function, including anticipated operational occurrences, SSCs basis accidents, external events, natural phenomena, and other events design specifically addressed in the regulations such as Station Blackout and ATWS.

b) The 10 CFR 50.2 design bases of a facility are a subset of the licensing basis and are required pursuant to 10 CFR 50.34(a)(3)(ii) and (b) and 10 CFR 50.71(e) be included in the updated FSAR. to c) Underlying 10 CFR 50.2 design bases is substantial supporting design information. Supporting design information includes other design inputs, analyses, and design output documents. Supporting design information design contained in the UFSAR or other documents, some of which are docketedmay be some of which are retained by the licensee. and Revised NEI 97-04, Appendix B November 1999

I...

Relationship of 10 CFR 50.2 Design Bases Functions to Licensing Basis and Part 50 Requirements 10 CFR 50.2 design bases functional requirements are derived primarily from the \

principal design criteria for an individual facility (the minimum standardsWhich) are set by 10 CFR Part 50 Appendix A) and NRC regulations such as thO and ATWS rules that impose functional requirements or limits on plant design. 10 CFR 50.2 design bases are a subset of a plant's licensing basis. While a plant's licensing basis includes all applicable requirements of Part 50, not all Part 50 requirements have corresponding 10 CFR 50.2 design bases. For example, in Appendix A, several GDC contain requirements for fabrication, construction, testing, inspection, and quality. These are requirement the designwf SSCs-not requirements for the performance of intended S C function and are therefore not 10 CFR 50.2 design bases. /

COOtS 1 01~r6 FAAOW <iZcATO.UCnO't SUtc k5 DEANeSM% P"D Relationship of 10 CFR 50.2 Design Bases to Appendix B Both 10 CFR 50.2 design bases and supporting design information are subject to design control and other requirements of 10 CFR Appendix B, as applicable -

according to the safety classification of SSCs.

Relationship of 10 CFR 50.2 Design Bases to 10 CFR 50.59 Both 10 CFR 50.2 design bases and supporting design in aion contained in the UFSAR are controlled in accordance with 10 CFR 50.59 Specific guidance in NEI 96-07, Guidelines for Performing 10 CFR 50.59 Etaluations, a define the scope of information subject to specific 10 CFR 50.59 criteria for control of design basis limits for fission product barriers (10 CFR 50.59(c)(2)(vii)) and methodology used in establishing design bases or in the safety analyses (10 CFR 50.59(c)(2)(viii)).

Relationship of 10 CFR 50.2 Design Bases to FSARs The original FSAR, including the 10 CFR 50.2-design bases presented therein in accordance with 10 CFR 50.34(b), was reviewed by the NRC in connection with granting the original license. 10 CFR -50.2 design bases for a plant may change as a result of new NRC requirements subsequent to the initial operating license. UFSARs should be updated in accord with 10 CFR 50.71(e) and NEI 98-03 to reflect new or modified design bases. In conjunction with NEI 98-03, this guidance may be used to support UFSAR updates to reflect new or modified design bases going forward. However, this guidance is not intended to be used to judge the completeness of existing 10 CFR 50.2 design bases Revised NEI 97-04, Appendix B November 1999 2

in the UFSAR or as the basis for adding or renov ng dePail 4arfrom the existing design bases in the UFSAR. 10 CFR 50.34(b)(2) requires the FISAR to include a description of structures, systems, and components "...sufficient to permit understanding of the system designs and their relationship to safety evaluations." Thus, design values such as system design pressure and temperature are required to be in the FSAR and are considered supporting design information.

Based on the differentiation provided by this guidance, a given passage of UFSAR description may contain a mixture of both 10 CFR 50.2 design bases and supporting design information. For example, UFSARs may include supporting design i ation under the heading of "System XYZ Design Bases." This guidance may be used to6iseern 10 CFR 50.2 design bases from supporting UFSAR descriptionAs Licensees are not expected to reformat or reorganize existing UFSAR information based on this guidance.

Relationship of 10 CFR 50.2 Design Bases to Regulatory Guidance and NRC Commitments o~ TNE A general commitment to a regulatory guide doco not constitutea design basis o- D en.entjper the 10 CFR 50.2 definition because "s not design bases functions or reference boundcfor design. <a cr 'i A t ~~0of5bES9 While regulatory guides are not requirements, a specific provision of a guidance document that has been committed to may be chosen by a licensee as a value or range of values for a design basis controlling parameter (e.g., per Regulatory Guide 1.52, charcoal filters shall have a 99% efficiency in order to meet NRC requirements for MCR habitability).

Relationship of 10 CFR 50.2 Design Bases to Design Bases Documents To enhance understanding of design bases information in support of specific technical and licensing activities, many licensees have prepared documents commonly known as design bases documents (DBDs). DBDs typically include 10 CFR 50.2 design bases and supporting design information organized on a system or topical basis. Design bases information provided in DBDs should be consistent with the 10 CFR 50.2 design bases and associated description presented in UFSARs.

Revised NEI 97-04, Appendix B November 1999 3

4-Relationship of 10 CFR 50.2 Design Bases to Topical Design Issues Topical design bases are design bases requirements that apply to multiple systems. The following areas, as applicable to specific SSCs, contain topical design bases (licensees may define additional topical areas beyond those identified):

• Fire Protection

• Flooding (internal and external)

• Tornado I Hurricane

• Seismic Criteria

• Missiles (internal and external)

• Separation (Hazards)

• Electrical Separation/lndependence

• Single Failure Criteria

• Pipe Break Criteria

• Environmental Qualification (electrical and mechanical)

• Station Blackout (SBO)

• Anticipated Transients Without Scram (ATWS)

Relationship of 10 CFR 50.2 Design Bases to SSC Design Requirements and Other Design Information SPCIsw;@ l SSCs are conservatively designed to ensure the capability to perfo 0 CFR 5 design basis functions. This includes ensuring that SSC designs meet all applicable codes, standards and NRC requirements. Such SSC design r-eqm (e.g.,

civil/structural, mechanical, electrical) do not constitute 10 CFR 50.2 design bases unless they coincide with a design basis functional requirement of the SSC. The containment is an example where an SSC design, coincies with 10 CFR 50.2 design bases. The design pressure of the containment is a controlling parameter for its design basis function -asa fission product barrier that is credited in the safety analyses. Thu5discovery of a condition that indicates that the containment does not meet its design pressure would mean that the containment is outside its design bases.

pshelf ICA." or,%FIT However, becausdesign bases are a subset of design Dequiiremenyts, deviation from an SSC desiit does not necessarily place that SSC outside its design bases. For example, AFW system design pressure is not a design basis controlling parameter because it does not coincide with the design basis function of AFW credited in the safety analyses to adequate remov heat from the reactor core in the event main feedwater is lost. Rather, system desi pressure is part of the UFSAR 4 Revised NEI 97-04, Appendix B November 1999 4

description required by 10 CFR 50. 34(b)(2) st permit Slt.ficilext understanding of the AFW system design bases. This and other design iforn ation was considered by the NRC staff in concluding in its SER that the design of lhe .AFV system is adequate to support performance of its design basis (heat removal) finction. Deviations from either 10 CFR 50.2 design bases or supporting design information should be evaluated and remedied in accordance with Generic Letter 91-18 (Revision 1),

... Resolution of Degradedand Nonconforming Conditions," {i.e., ensure safety first, perform operability/reportability determinations) etc.). Again using the AFW example, discovery of a condition that. indicates that. AYW piping does not meet its ASME Code design pressure would not place the AFW system outside its design bases unless a licensee evaluation concluded that the piping was so degraded that the AFW system would not be able to perform its design basis function as credited in the safety analyses.

Relationship of 10 CFR 50.2 Design Bases to Individual SSC Functions Functions credited in te safety analyses or to meet NRC requirements are 10 CFR 50.2 design bases functions. Individual SSC functions are, in general, subsidiary to 10 CFR 50.2 design bases functions. The safety analyses and NRC requirements provide the context for determining whether SSCs have 10 CFR 50.2 design bases functions. ) cA(*6LE O PEFo1.Ml($36 10 CFR 50.2 design bases roouiremontr include the bounding conditions S.df-ugekerr. These bounding conditions may be established as topical design bases requirements.

Relationship of 10 CFR 50.2 Design Bases to Design Inputs i.< Acz, o i,0 14 -t D Consistent with NUREG-1397 and ANSI N45.2.11-1974, 10 CFR 50.2 design bases are a subset of design inputs. Bathe ANSI definition, design inputs are "those criteria, parameters, bases or other design requirements upon which the detailed final design is based." Thus)10 CFR 50.2 design bases are a subset of the Prquiremnt that final detailed designs must meet.

STAOD A&.-'~S COSLjs FOL --jucu Tht- 'L-k7SAV TEr0F Revised NEI 97-04, Appendix B November 1999 -

Examples of 10 CFR 50.2 Design Bases and Supporting Design Information The examples that follow reflect th pre ia-mewo-rk dane.

The examples illustrate the type oXjfrmation considered toTeil CFR 50.2 design bases and the distinctionef10 CFR 50.2 design bases AV -from supporting design information. The examples are not intended to completely describe the design bases for a given system for a given plant. Individual licensees may identify additional or different design bases functional requirements or controlling parameters based on plant-specific factors.

BWR Containment System 10 CFR 50.2 Design Bases Examples of Design Bases Controlling Functional Requirements Parameters Chosen as Reference Bounds for Design A. The Containment System (including 1. The Containment System shall provide a the containment structure and barrier which, in the event of a loss-of-isolation system) shall provide an coolant accident (LOCA), controls the essentially leak-tight barrier against release-of fission products to the secondary the uncontrolled release of containment and the environment to ensure radioactivity to the environment and that any radiological dose is less than the ensure that the containment design values prescribed in 10 CFR Part 100.

conditions important to safety are not exceeded for as long as postulated 2. The Containment System shall be capable accidents require. of maintaining its leakage rate performance for at least 30 days following the accident.

Basis:

• GDC 16, Containmentdesign 3. The Atmospheric Control shall establish

• GDC 38, Containment heat removal and maintain the containment atmosphere

• GDC 50, Containment design basis to less than X.X% by volume oxygen during

• GDC 51, Fractureprevention of normal operating conditions.

containmentpressure boundary

• GDC 54, Piping systems penetrating 4. The containment shall be designed to containment withstand the design basis pressure of XX psig.

Revised NEI 97-04, Appendix B November 1999 6

B. The containment isolation system shall 1. The MOVs in the containment isolation be capable of rapid, automatic isolation system shall be capable of closing against of all piping that connects directly to the calculated peak design basis accident the containment atmosphere and pressure in Y seconds following receipt of a penetrates the containment boundary containment isolation signal.

upon receipt of a containment isolation signal.

Basis:

• GDC 54, Piping systems penetrating containment

• GDC 56, Primarycontainment isolationri, Topical Requirements (Examples)

C. The containment shall be designed to See draft example Topical Design Bases for withstand the effects of earthquakes, seismic and tornadoes (attached.)

tornadoes and other natural 1, M~,I 1-11 aEx- tI lo01 capability Lout to perform its safety function.

Basis:

GDC 2, Design bases for protection against naturalphenomena D. The containment isolation system shall See draft example Topical Design Bases, for be designed to have sufficient Single Failure (attached).

redundancy to perform its safety function in the event of a single failure.

Basis:

. GDC 54, Piping systems penetrating containment

• GDC 56, Primarycontainment isolatioZk.

E. Class lE components in the See EQ Topical Design Bases containment isolation system shall be environmentally qualified to perform their safety function worst case design basis accident conditions.. - °4tkJG KOLOwlJG AsA Basis:

GDC 4, Enuironmental and dynamic effects design based Revised NEI 97-04, Appendix B November 1999 7

Note: This system relies upon performance by interfacing systems of certain design basis functions. For example, generation of auto-start signals is a design basis requirement of ESFAS and RPS, provision of specific indications, controls and alarms may be design basis requirement'for the Y.

main control room and/or remote shutdown panel, and provision of electrical power from separate 1E busses is a design basis requirement of the Electrical Distribution System.

Examples of Supporting Design Information for the BWR Containment System

• The containment is designed to permit and facilitate initial demonstrations of structural capabilities at test pressures up to and including 1.15 times the design pressure.

• The containment isolation valves are designed and fabricated in accordance with

-ASME,Section III.

• The containment is designed to meet the leakage testing requirements of 10 CFR Part 50, Appendix J.

• The containment is designed, fabricated, constructed, and tested as a Class MC vessel in accordance with Subsection NE of the ASME Code.

• The drywell is a steel pressure vessel with a spherical lower portionf XX feet in diameter, a cylindrical upper portion XX feet in diameter, and an elliptical top head XX feet in diameter.

• The pressure suppression chamber is a steel torus-shaped pressure vessel located below and encircling the drywell with a major diameter of XXX feet and a cross-sectional inside diameter of XX feet.

• A total of 8 vent pipes having an internal diameter of X feet connect the drywell and the pressure suppression chamber.

Revised NEI 97-04, Appendix B November 1999 8

PWR Auxiliary Feedwater System 10 CFR 50.2 Design Bases Examples of Design Bases Controlling Functional Requirements Parameters Chosen as Reference Bounds for Design A. The Auxiliary Feedwater System 1. The AFW system shall supply a (AFW), in conjunction with the minimum of XXX gpm of feedwater condensate storage tank, shall within xx secs to the intact steam automatically provide feedwater to generator(s) against a maximum the steam generators to remove pressure of YYYY psig.

residual heat from the reactor core upon loss of main feedwater. The system safety function shall be to transfer fission product decay heat and other residual heat from the reactor core at a rate such that specified acceptable fuel design limits and the design conditions of thb reactor coolant pressure boundary are not exceeded.

Basis:

GDC 34, Residual heat removal B. The AFW system shall be designed to 1. The AFW system shall be capable of provide for adequate heat removal in removing residual heat from the the event of a single failure or in the reactor core without relying on AC absence of AC power. power for a period of X hours.

Basis: 2. The AFW system shall include two GDC 34, Residual heat removal motor driven pumps and one turbine 10 CFR 50.63, Station Blackout driven pump configured in two separate and independent trains.

Revised NEI 97-04, Appendix B November 1999 9

C. From a condition of full power, the AFW 1. A usable volume of XXX gallons system shall be capable of providing shall be maintained as a safety feedwater for the removal of reactor core grade source of water in order to decay heat until reactor coolant system satisfy the AFW system feedwater temperature and pressure are brought to requirements.

the point at which the RHR system may be placed into operation. Capability shall 2. The AFW system shall deliver be provided to manually initiate and water to the steam generators at control AFW flow, as credited in the safety not more than xxx degrees F.

analyses.

3. Maximum AFW flow shall be Basis: ZZZZ gpm, as credited in the GDC 34, Residual heat removal safety analyses.

1.

Topical Requirements (Examples)

D. The AFW system and the structure See draft examples of Topical Design housing the system shall be designed to Bases for seismic and tornado withstand the effects of earthquakes (attached).

without loss of capability to perform their safety function. The AFW system shall be protected from tornadoes and other natural phenomena by the structures housing the system.

Basis:

GDC 2, Design bases for protection against naturalphenomena v

E. Class 1E components in the AFW system See EQ Topical Design Bases.

shall be environmentally qualified to perform their safety function W orst case design basis accident conditions.

Basis: -DA06 hat FOLLD-OW.06 GDC 4, Environmentaland Dynamic Effects Design Bases Revised NEI 97-04, Appendix B November 1999 10

Note: This system relies upon performance by interfacing systems of certain design basis functions. For example, generation of auto-start signals is a design basis requirement of ESFAS and RPS, provision of specific indications, alarms, and manual controls may be design basis requirements for the main control room and/or remote shutdown panel, and provision of electrical power from separate lE busses is a design basis requirement of the Electrical Distribution System.

Examples of Auxiliary Feedwater System Supporting Design Information

• The AFW System provides water to the steam generators for heat removal during plant startup, hot standby, normal cooldown, refueling, and maintenance.

• System (piping) design pressure is (XXXpsi) and temperature is (GMF).

• The AFW system is designed and constructed in accordance with the requirements of ASME Section III (9XX).

• The CST is lined to prevent corrosion and is insulated to mitigate temperature variations.

• The AFW System has control devices and status lights on the AFW shutdown panel for each MDAFW pump, each steam supply valve for the TDAFW pump, and each AFW control valve.

• Provisions are incorporated in the AFW design to allow for periodic operation to demonstrate performance and structural leak tight integrity.

• The AFW pumps are provided with mini-flow protection with a mini-flow return line with a flow control valve that isolates when the flow exceeds a preset minimum.

• The AFW motor driven pumps are horizontal, centrifugal pumps driven by electric motors.

Revised NEI 97-04, Appendix B November 1999 11

Emergency Diesel Generator System 10 CFR 50.2 Design Bases Design Bases Controlling Parameters Chosen as Functional Requirements I Reference Bounds for Design A. The Emergency Diesel 1. To have sufficient capacity and capability to power all Generator System (EDG) required emergency loads under worst-case loading shall be capable of conditions, EDGs shall have a minimum continuous rating of automatically starting XXXX kW.

and have sufficient 2. A minimum of XXXXX gallons shall be available in the EDG capacity to provide AC fuel oil storage tank to supply the minimum number of power to the emergency required diesels for X days of operation.-

buses to power required emergency loads during 3. The air start receivers shall have sufficient capacity for at the worst loading least X starts without recharging.

situations, shut down the reactor, and maintain it 4. Each diesel generator shall be capable of operating in its in a safe shutdown service environment during and after a design bases event condition in the event of a without support from offsite power. Each generator shall be loss of offsite power or able to start and operate with no environment cooling degraded bus condition. available for the time required to sequence the cooling equipment on to the bus-bar.

Basis:

GDC 17, Electricalpower 5. The EDG speed and voltage controls shall be designed to achieve rated voltage and frequency and accept load within systemap"- XX seconds after receipt of an engine start signal.

GDC 4, Environmental and Dynamic Effects 6. The EDG auto-start signals shall be initiated for loss of Design Bases voltage, degraded bus voltage conditions, and upon receipt of GDC 5, Sharing of SSCs an accident signal.

7. The EDG System shall be designed such that at no time during the EDG loading sequence shall the voltage decrease to less than 75% of nominal.

8. The EDG System shall be designed such that the voltage will be restored to within 10% of nominal in less than 60/ of each load block time interval, except during the first load block when the voltage shall be-restored to 100% of nominal prior to the start of the second load block.

9. The EDG System shall be designed such that at no time during the loading sequence will the frequency decrease to less than 95% of nominal.

I.

Revised NEI 97-04, Appendix 5 November 1999 12

10. The EDG System shall be designed such that the frequency will be restored to within 2% of nominal in less than 60% of each load block time interval.

11. During recovery from transients caused by the disconnection of the largest single load, the speed of the EDG shall not exceed the nominal speed plus 75% of the difference between nominal speed and the overspeed trip setpoint or 115% of nominal, whichever is lower.

Topical Requirements (Examples)

B. The EDG System shall be designed for See draft example Topical Design Bases for Protection Against Natural seismic and tornado (attached).

Phenomena without loss of capability to perform its safety functions. The structures housing the system and the system itself are designed to withstand the effects of earthquakes.

The system is protected from other natural phenomena by the structures housing it.

Basis:

GDC 2, Design bases for protection against naturalphenomena C. The EDG system shall have sufficient See draft example Topical Design Bases for redundancy to perform its safety single failure (attached).

function in the event of a single failure.

Basis:

GDC 17, Electricalpower systems Note: This system relies upon performance by interfacing systems of certain design basis functions. For example, generation of auto-start signals is a design basis requirement of ESFAS and RPS, specific indications, controls and alarms may provision of be design basis requirementifor the main control room and/or remote shutdown panel, X and provision of electrical power from separate lE busses is a design basis requirement of the Electrical Distribution System.

Revised NEI 97-04, Appendix B November 1999 13

Examples of EDG System Supporting Design Information

• When full, each diesel generator fuel oil day tank is designed to provide X hour of operation before starting the first transfer pump. If the automatic transfer pump fails to start, a low-level alarm will sound. This alarm provides X hours of fuel oil remaining. A low-low level alarm warns the operators to start the second (back-up) transfer pump with at least X hour of fuel oil remaining in the tank.

• Each day tank is designed and constructed to ASME Code,Section VIII, Division I.

• The EDG has a rating of XXX% of its continuous rating for a period of two continuous hours out of any 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> of operation.

• The air start receivers provide adequate volume to supply starting air for X engine starts without recharging assuming a leak rate of XX.XX psig per hour and a cranking duration of approximately X seconds or sufficient for 2 to 3 engine revolutions.

• The momentary voltage drop on starting any step of loads may not drop below XX volts at generator terminals and returns to 90% of rated voltage within one second.

• Diesel fuel oil has a minimum fuel oil heating capacity of XXX,XXX BTU/Gallon at XX F.

• The generators meet applicable guidance including, Regulatory Guide 1.6 -

Independence Between Redundant Standby (Onsite) Power Sources and Between Their Distribution Systems; Regulatory Guide 1.9 - Selection of Diesel Generator Set Capacity for Standby Power Supplies; and NEMA MG1.

• The EDG design should be such that the transient following complete loss of load does not cause the speed of the unit to attain the overspeed protective trip setpoint.

Revised NEI 97-04, Appendix B November 1999 14

Containment Isolation MOV's r-10 CFR 50.2 Design Bases Examples of Design Bases I

Functional Requirements Controlling Parameters Chosen as Reference Bounds for Design eaMrse 6e ---

A. Containment isolation MOVslcapable of Containment isolation valves shall be rapid, automatic isolation of piping that closed or must be capable of closing penetrates the containment boundary upon against the calculated peak design basis receipt of a containment isolation signal. accident pressure within XX seconds after receipt of a containment isolation Basis: signal.

GDC 54, Pipingsystems penetrating containment i

B. Automatic containment isolation MOVs The fail-safe valve position shall be as shall be designed to fail in the position of credited in the safety analyses.

greatest safety.

Basis:

• GDC 55, Reactor coolant pressure boundary penetratingcontainment

• GDC 56, Primary containment isolation Topical Requirements (Examples)

C. Containment isolation MOVs shall be See draft example Topical Design Bases designed to withstand the effects of for seismic and tornadoes (attached.)

earthquakes, tornadoes and other natural phenomena without loss of capability to perform their safety function.

Basis:

GDC 2, Design bases for protection against naturalphenomena I

Revised NEI 97-04, Appendix B November 1999 15

10 CFR 50.2 Design Bases Examples of Design Bases Functional Requirements Controlling Parameters Chosen as Reference Bounds for Design D. Containment isolation MOVs shall be See EQ Topical Design Bases environmentally qualified to perform their safety functionmnder worst case design basis accident conditions.

Basis:

GDC 4, Environmentaland dynamic effects design bases.'-

E. Containment isolation MOVs and appurtenances shall be protected from See Pipe Break Criteria Topical Design missiles and the effects HELBs, e.g., pipe Bases whip, jet impingement.

Basis:

GDC 4, Environmentaland dynamic effects design base4d'-

Note: Containment isolation MOVs rely upon performance by interfacing systems of certain design basis functions. For example, generation of isolation signals is a design basis requirement of ESFAS and RPS, provision of specific indications, controls and alarms may be design basis requirements xe for the main control room andlor remote shutdown panel, and provision of electrical power from separate lE busses is a design basis requirement of the Electrical Distribution System.

Examples of Supporting Design Information for Containment Isolation MOVs:

• Motor-operated valves used for containment isolation that are allowed to be open during normal conditions are equipped with a hand wheel that allows manual operation of the valves in case of a power failure.

• The use of Limitorque operators has been specified for all motor-operated containment isolation valves

• Seismic design for containment isolation MOVs reflects consideration of the valve and operator as a combined unit.

Revised NEI 97-04, Appendix B November 1999 16

Turbine Generator Svstem Examples of Design Bases Controlling 10 CFR 50.2 Design Bases Functional Parameters Chosen as Reference Bounds Requirements for Design A. The Turbine Generator System shall be 1. Turbine discs are made from materials and designed to protect systems, structures processes that minimize flaw occurrence and components important to safety and maximize fracture toughness.

from the effects of turbine missiles by providing assurance of turbine disc integrity.

Basis:

GDC 4, Environmental and dynamic effects design bases B. The Turbine Generator Overspeed 1. Normal overspeed protection is achieved by Protection System shall be designed to the speed governor action of the eletro-minimize the probability of generating hydraulic control system which cuts off turbine missiles. steam at approximately XXX percent of rated turbine speed by closing the control Basis: and intercept valves.

GDC 4, Environmental and dynamic effects design bases 2. An emergency overspeed protection mechanical device is set to close all steam valves at approximately XXX percent of rated turbine speed.

3. A backup overspeed protection electrical trip circuit closes all steam valves at approximately XXX percent of rated turbine speed.

Note: This system relies upon performance of interfacing systems for certain design bases functions for a pressurized water reactor. For example, the generation of a turbine trip under conditions indicative of an ATWS event is a design basis requirement in accordance with 10 CFR 50.62(c)(1) for the ATWS mitigating system. If credited in plant-specific safety analyses, another design bases function would be that reactor coolant pumps shall remain connected to the turbine generator for a short duration under certain loss of forced reactor coolant flow events to prevent the DNBR from exceeding its limit.

Revised NEI 97-04, Appendix B November 1999 17

Examples of Turbine Generator System Supporting Design Information

• The turbine wheels and rotors are made from vacuum-melted, or vacuum-degassed, Ni-C Mo-V alloy steel by processes which minimize flaw occurrence and provide adequate fracture toughness.

• The turbine wheel and rotor materials have the lowest fracture appearance transition temperatures and the highest Charpy V-notch energies obtainable, on a consistent basis, from a water-quenched Ni-Cr-MO-V material at the sizes and strength levels used.

• Charpy tests on the turbine wheel and rotor materials are in accordance with the American Society of Testing Materials (ASTM) Specification A370.

L

• The turbine generator is equipped with an electro-hydraJlc control (EHC) system that combines the principles of solid-state electronics and high-pressure hydraulics to regulate steam flow through the turbine.

• The control system has three major subsystems; a speed control -unit, a load control unit, and valve flow control units.

• The turbine speed control unit provides speed control, acceleration, and overspeed protection functions.

• The flow of the main steam entering the high-pressure turbine is controlled by four stop valves and four governing control valves.

• Each stop valve is controlled by an electro-hydraulic actuator, so the stop valve is either fully open or fully closed.

• The combined intermediate stop valves, located in the hot reheat lines at the inlet to the low-pressure turbines are stop and intercept valves in one casing and control steam flow to the low pressure turbines.

• The load control unit develops signals that are used to proportion the steam flow to the stop valves, control valves, and intercept valves. Signal outputs are based on a proper combination of the speed error signals and load reference signals.

• The valve flow control unit regulates the steam flows as directed by the load control unit.

Revised NEI 97-04, Appendix 8 November 1999 18

Seismic Topical Design Bases 10 CFR 50.2 Design Basis Functional Requirements Structures, systems, and components important to safety shall be designed to withstand the effects of earthquakes without loss of capability to perform their safety function. (GDC 2, Design Bases for ProtectionAgainst Natural Phenomena, and 10 CFR 100, Appendix A)

Example of Design Bases Controlling Parameters Chosen as Reference Bounds for Seismic Design A. Structures, systems, and components shall be analyzed and designed to withstand the effects of an operating basis earthquake with a peak ground acceleration of X.Xg and a safe shutdown earthquake with a peak ground acceleration of X.Xg. iW4K' Basis: Seismic loadings are characterized by the safe shutdown earthquake (SSE) and the operating basis earthquake (OBE). The SSE is defined a he maximum vibratory ground motion at the plant site that can be reasonably f predicted from geologic and seismic evidence. The OBE is that earthquake fwhich, considering the local eology and seismology, caa-be reasonably K e c teee durinnplani fe.__JF- He B. Category II systems, eiqtpment, and components installed in Seismic Category I Structures whose failure could result in loss ofiequired safety function ofI~eismic Category I structures, eqipmt~.system$, or component%are either separated by distance or barrier from the affected structure, system, equipmet,`or component or designed together with their anchorages to maintain their structural Integrity during the SSE.

Basis: Seismic Category II systems, equaipmet, and components installed in Seismic Category I structures shall not cause the loss of t4 required safety function ofyi~eismic Category I structures, equipmefrt, system% or components.

Revised NEI 97-04, Appendix B November 1999 19

Examples of Seismic Supporting Design Information

• Seismic classification of plant structures, systems, and components is in accordance with NRC Regulatory Guide 1.29, Seismic Design Classification.

Seismic Classification of radioactive waste management systems, structures and components is in accordance with NRC Regulatory Guide 1.143, Design Guidance For Radioactive Waste Management Systems, Structures, And Components Installed In Light Water Cooled Nuclear Power Plants.

• Seismic design response spectra are in conformance with NRC Regulatory Guide 1.60, Design Response Spectra for Seismic Design of Nuclear Power Plants.

• Seismic damping values used in the structural dynamic analysis are the same as those provided in NRC Regulatory Guide 1.61, Damping Values for Seismic Design of Nuclear Power Plants with the exception of damping values for cable trays and supports. The damping values for cable trays and supports are values based on test reports (specific reference) and were approved by the NRC in (specific reference).

• For Seismic analysis of ASME Boiler and Pressure Vessel Code,Section III, Division 1, Code Class 1, 2, and 3 piping systems, ASME Code-Case N-411 damping values given in Reference E may be used provided the following criteria are satisfied:

1. Increased pipe deflections due to greater piping flexibility do not violate plant separation criteria.

2. Criteria outlined in NRC Regulatory Guide 1.61 do not mix with the criteria of Code Case N-411 for a given piping analysis.

3. With the exception of the stress calculations described in Reference F, Code Case N-411 damping values are not used in conjunction with multiple response spectrum methodology piping analysis.

• Category II structures are designed using the Uniform Building Code, X=X edition.

Revised NEI 97-04, Appendix B November 1999 20

Tornado Topical Design Bases 10 CFR 50.2 Design Basis Functional Requirements Structures, systems, and components important to safety withstand the effects of tornadoes without loss of capabilityshall be designed to function. (GDC 2, Design Bases for ProtectionAgainst to perform their safety NaturalPhenomena, and 10 CFR 100)

Examples of Design Bases Controlling Parameters Chosen as Reference Bounds for Tornado Design A. Category I structures housing safety related eiF~nttsystem~and components shall be designed to withstand the effects basis tornado as described as follows: due to the design

• Maximum peripheral tangential velocity - xxx mph.

• Translational velocity - xx mph maximum/ x mph minimum.

• Maximum wind velocity - xxx mph

• Radius from the center of the tornado where the maximum wind velocity occurs - xxx ft.

• Atmospheric pressure drop - x psi.

• Rate of pressure drop - x psi/s.

Basis: Nuclear power plants must be designed so that a safe condition in the event of the most severe tornado the plants remain in be predicted to occur at a site as a result of severe that can reasonably meteorological conditions.

B. Category II structures, equipettsystems, and components for tornado loadings shall be investigated to ensure not designed their failure will not effect the integrity of adjacent Category I structures.

This design ensures that Category I structures, equipment, systems, and components required for safe shutdown after a tornado will perform their intended safety functions.

Basis: Category II structures, 4quiptertt, systems, and components not designed for tornado loadings shall not cause the failure of adjacent Category I structures.

Revised NEI 97-04, Appendix B November 1999 21

Examples of Tornado Supporting Design Information

• Thetparameters define the design basis tornado conform to those given in U.S. NRC Regulatory Guide 1.76, "Design Basis Tornado For Nuclear Power Plants," August 1974, for Region X plant locations.

• Tornado wind pressure loadings and differential pressures loadings shall be transformed into effect loads on Category I structures in accordance with Topical Report X=X (specific reference).

Revised NEI 97-04, Appendix B November 1999 22

Single Failure Topical Design Bases 10 CFR 50.2 Design Basis Functional Requirements Fluid and electrical systems required to perform their intended safety function in the event of a single failure shall be designed to include sufficient redundancy and independence such that neither (1) a single failure of any active component (assuming passive components function properly) nor (2) a single failure of a passive component (assuming active components function properly),

results in a loss of the capability of the system to perform its safety functions.

(GDC 17, Electricalpower systems; GDC 21, Protection system reliabilityand testability; GDC 24, Separation of protection and control systems; GDC 25, Protectionsystem requirements for reactivity control malfunctions; GDC 34, Residual heat removal; GDC 35, Emergency core cooling; GDC 38, Containment heat removal; GDC 41, Containment atmosphere cleanup; GDC 44, Cooling water; GDC 54, Piping systems penetratingcontainment; GDC 55, Reactor coolant pressure boundarypenetrating containment; GDC 56, Primarycontainment isolation)

Examples of Design Bases Controlling Parameters Chosen as Reference Bounds for Single Failure Design Fluid and electrical systems shall be designed to assure that a single failure, in conjunction with an initiating event, does not result in the loss of the system's ability to perform its intended safety function. The single failure considered shall be a random failure and any consequential failures in addition to the initiating event for which the system is required and any failures which are a direct or consequential result of the initiating event. Whenever practical, the design shall provide for a 30-minute delay between the indication of the initiating event and the initiation of any operator action, either locally or remotely, from any control panel.

Basis: These criteria ensure that the requirements of 10 CFR Part 50 are addressed regarding the design against single active or passive failures in safety-related systems following various initiating events.

Single Failure Supporting Design Information

• An initiating event is a single occurrence, including its consequential effects, that places the plant or some portion of the plant in an abnormal condition. An initiating event and its resulting consequences are not a single failure. An initiating event can be a component failure, natural phenomenon, or external man-made hazard.

• Active components are devices characterized by an expected significant change of state or discernible mechanical motion in response to an imposed demand upon the system or operation requirement. Examples of active components Revised NEI 97-0a, Appendix B November 1999 23

include switches, circuit breakers, relays, valves, pressure switches, turbines, motors, dampers, pumps, and analog meters, etc.

• Passive components are devices characterized by an expected negligible change of state or negligible mechanical motion in response to an imposed design basis load demand upon the system. Examples of passive components include cables, fuses, piping, valves in stationary positions, fluid filters, indicator lamps, cabinets, cases, etc.

• An active component failure is a failure of an active component to complete its intended safety function(s) upon demand. Spurious action of a powered component originating within its automatic actuation of control systems shall be regarded as an active failure unless specific features or operating restrictions preclude such spurious action.

• A passive component failure is a failure which limits the component's effectiveness in carrying out its design function(s). When applied to a fluid system, this means a breach of the pressure boundary resulting in abnormal leakage. Such leakage shall be limited to that which results from a single pump seal failure, a single valve stem packing failure, or other single-failure mechanism considered possible by a systematic analysis of system components.

• The design of safety-related systems (including protection systems) is consistent with IEEE Standard 379-1972 and Regulatory Guide 1.53 in the application of the single-failure criterion.

• The protection system is designed to provide two, three, or four instrumentation channels for each protective function and two logic train circuits. These redundant channels and trains are electrically isolated and physically separated.

Thus any single failure within a channel or train will not prevent protective action at the system level, when required.

• Design techniques such as physical separation, functional diversity, diversity in component design, and principles of operation, shall be used to the extent necessary to protect hgainst a single failure.

Revised NEI 97-04, Appendix B November 1999 24

Nuclear Energy Institute Project No. 689 cc: Mr. Ralph Beedle Ms. Lynnette Hendricks, Director Senior Vice President Plant Support and Chief Nuclear Officer Nuclear Energy Institute Nuclear Energy Institute Suite 400 Suite 400 1776 I Street, NW 1776 I Street, NW Washington, DC 20006-3708 Washington, DC 20006-3708 Mr. Alex Marion, Director Mr. Charles B. Brinkman, Director Programs Washington Operations Nuclear Energy Institute ABB-Combustion Engineering, Inc.

Suite 400 12300 Twinbrook Parkway, Suite 330 1776 I Street, NW Rockville, Maryland 20852 Washington, DC 20006-3708 Mr. David Modeen, Director Engineering Nuclear Energy Institute Suite 400 1776 I Street, NW Washington, DC 20006-3708 Mr. Anthony Pietrangelo, Director Licensing Nuclear Energy Institute Suite 400 1776 I Street, NW Washington, DC 20006-3708 Mr. H. A. Sepp, Manager Regulatory and Licensing Engineering Westinghouse Electric Company P.O. Box 355 Pittsburgh, Pennsylvania 15230-0355 Mr. Jim Davis, Director Operations Nuclear Energy Institute Suite 400 1776 I Street, NW Washington, DC 20006-3708