Text

Forwards Preliminary Draft of Integrated Plant Safety Assessment Rept,Chapter 4, Integrated Assessment Summary. Encl Draft Includes Commitments Submitted in Response to NRC & Assessment Meetings
	ML17252A567
Person / Time
Site:	Dresden
Issue date:	10/15/1982
From:	Crutchfield D; Office of Nuclear Reactor Regulation
To:	Delgeorge L; COMMONWEALTH EDISON CO.
References
	TASK-***, TASK-RR LSO5-82-10-046, LSO5-82-10-46, NUDOCS 8210250203
	Download: ML17252A567 (61)
	v • d • e

- -.

)._.

, :~ *.r *r1 OCT 1 5 1982 Docket No. 50-237 LS05-82-10"'046 Mr. L. DelGeorge Directqr of Nuclear Licensing Commonwealth Edison Company Post Office Box 767 Chicago, Illinois 60690

Dear Mr. DelGeorge:

SUBJECT:

INTEGRATED ASSESSMENT.

SUMMARY

- DRESDEN UNIT 2 A preliminary-draft of the Integrated Plant Safety Assessment Report

(.IPSAR)., Chapter* 4 (Integrated Assessment Summary) for Dresden 2 is enclosed.

This draft has been provided to the ACRS for the SEP Subcommittee meeting to be held on October 26-27, 1982.

The staff presentation during.that meeting will address the Integrated.Assessment reviews of Oyster Creek, Dresden 2 and Millstone 1.

This draft includes your commitments.submitted in response to the difference summary in our letter of July 15, 1982, and our understanding of your positions as discussed with you~ staff in meetings held during the Integrated Assessment. A number of staff positions are present~d without a licensee position where a formal response has not yet been received.

You should complete your response to our July 15, 1982 letter as soon as possible so that your ptisitions can be reflected in the draft of the IPSAR.

Our current schedule is to issue the draft

IPSAR by October 27, 1982, and to review any changes from the Integrated Assessnient Summary with the ACRS Subcommittee on that date.

Enclosure:

As stated cc w/enclosure:

See next page Sincerely, Dennis M. Crutchfield, Chief

Operating Reactors.Branch #5 Division of Licensing c-0210250203 02101s.-.~--r~~

~~PDR ADOCK 05~0237 t:i:\\~-~~~~~~~~~~~~~~~~~~~~~~~~~

\\,J~c<p ~l;'."*=:o* !~~. "*""**~:' J.... gP..B.: 0..L.

..... ~RB.#.5.:.P.M.

..~...... ~0. '* ~~.:... ~...

suRNAME* **

.rna.~dk.... J;~.r:.iro~.~............ WB.lJ~.$~.1.1.. _...... P.O.'..C.9Jl.D.9.r... O....... ts,bU~J.....fMJ.7gJ..i~.

DATE*.. 10;.t5/.a2.......... 101.~t;;.a2.......... 10;..~-s"1a2......... 10.J./).JB.2....... lo/.'-.J.a2........ rnA~*fB2...

NRCFORM318(.10-80)NRCM0240 OFFICIAL RECORD COPY USGPO: 1981-335*960

l '.

,. - *---- :.. -.. :~

..... ~ **...

\\'

Mr. L. DelGeorge cc

,Robert G. Fitzgibbons Jr.

Isham, Lincoln & Beale Counselor~ at Law Three Fi~st N~tional Plaza Suite 5200 Chitago, Illinois 60602 Mr. B. B.

Steph~nson Plant Superintendent Dresden Nuclear Powe~ Statioh Rural Route* #1

Morris;* Illinois 60450 The Honorable Tom Corcoran United States.House of Representatives Washington, D. C.

20515

U *. S. Nuc 1 ear Regulatory Cammi ssi on Resident Inspectors Office.

. Dresden Station RR #1.

- .Morris, Illinois.. 60450

Mary J b Murray *

Assistant Attorney General

~Environmehtal Control Division 188 W. Raridolph'Street

Suite 2315 *

. Ch*icago*, Illinois 60601 Chairman Board of Supervisors of

.. * : ; * "'Grundy. County

.Grundy :County. Courthouse

Morris, Illinois 60450*

John F. Wal f~- Esquire

-~~. ::34d9 $hepherd Str.eet;

<' ":'Chev)". *Chase,*.Mar.Yl.and ** 20015

frr. LindaW.

0.Little.~*

- '*~.soO.Hetriti.tage Dri~e.*

,. :*:Rale.fgh*~~ North Carqlina. 27612** *

iJ udg.e

F'orres.i'J:.

Remi~k* :. :. *.- ;. * *.

~The.Car.ri.age *Haus~.~. Ap~rtment 20s

'.220LL St.reet',.. N'/w~::.... *... *. **.

Washing*tqri; *D<:~.-:~2003J; *.

" *;_ ~ :-.

\\*.*

~. '

Illinois Department. of nu cl ea'r Safety

1035 Outer Park Drive, 5th Floo~

Springfield; Illinois 62704

U. S. Environmental Protection Agency Federal Activitiei Branch Region V Office.

ATTN:

Regional* Radiation Representative 230 South Dearborn Street Chicago, Illinois 60604 James G. Keppl~r, ~egional Administrator Nuclear Regulatory Commission, Region Ill

799 Roosevelt Street Glen Ellyn, Illinois 60137

.~..

.. -.-~

... -<~*

INTEGRATED ASSESSMENT

SUMMARY

THE ATTACHED FILES ARE OFFICIAL RECORDS OF THE DIVISION OF DOCUMENT CONTROL. THEY HAVE 8EEN CHARGED TO YOU FOR A LIMITED TIME PERIOD AND MUST BE RETURNED TO THE RECORDS FACILITY BRANCH 016.

PLEASE DO NOT SEND DOCUMENTS CHARGED OUT THROUGH THE MAIL. REMOVAL OF ANY PAGE(S) FROM DOCUMENT FOR REPRODUCTION MUST BE REFERRED TO FILE PERSONNEL.

DEADLINE RETURN DATE RECORDS FACILITY BRANCH

4 INTEGRATED ASSESSMENT

SUMMARY

Table 4.1 contains the list of topics considered in the integrated assessment, whether Technical Specification requirements or backfit are needed, and whether or not the licensee proposes to backfit.

A more detailed description of each topic with identified differences follows.

4.1 Topic II-3.8, Flooding Potential and Protection Requirements; Topic II-3.8.1, Capability of Operating Plants To Cope With Design-Basis Flooding Conditions; Topic II-3.C, Safety-Related Water Supply (Ultimate Heat Sink (UHS))

10 CFR 50 (GDC 2)~ as implemented by SRP Sections 2.4.2, 2.4.5, 2.4.10, and 2.4.11 and Regulatory Guides 1.59 and 1.27, requires that structures, systems, and components impqrtant to safety be designed to withstand the e.ffects of natural phenomena such as flooding.* The safety objective of these topi°cs (II-3.8, II-3.8.1, and II-3.C) is to verify adequate operating procedures and/or system design are provided to cope with the design-basis flood.

The site grade elevation is 517 ft mean sea level (MSL).

During the staff's review of the hydrology-related topics, the following flooding elevations were identified, as defined by current licensing criteria:

probable maximum flood (PMF) still water - 525 ft MSL wave runup ~ 528 ft MSL As a result of these flooding levels, the staff has identified the following issues.

10/12/82 4-1 DRESDEN 2 SEP SEC 4 REGULATO.RY. DOCKET FILE CD.PI

. A 4.1.1 Design-Basis Groundwater Level The original design value for groundwater level at Dresden Unit 2 was 514 ft MSL.

Actual plant grade is at 517 ft MSL.

However, a 3-ft change in ground water level is not a significant change in structural loading when combined with other loads such as seismic.

Also, as part of its review of Topic III-3.A, 11 Effects of High Water Level on Structures, 11 the staff concluded that structural integrity would be maintained for water levels up to 517 ft MSL.

Therefore, based on margins in structures under postulated seismic loadings (Topic III-6, 11Seismic Design Considerations 11 ) and adequate margin for static loading, the staff concludes that further analysis of the effects of ground-water level on structures is not warranted.

Backfitting is not required.

4.1.2 Probable Maximum Flood The staff has calculated' the probable maximum flood for the Dresden site to be 528 ft MSL, including wave runup.

The Dresden Unit 2 plant is not protected to the PMF level as required by current licensing criteria.

In addition, the staff has determined that the expected 100-year water surface elevation and standard project flood will flood the service water pump motors.

It is the staff 1 s position that the licensee provide for protection of the plant site for all expected flooding levels.

The protection features should be addressed in plant emergency procedures.

These procedures are discussed in Section 4.1.4.

4.1.3 Roof Loadings The roofs of safety-related structures (turbine and reactor buildings and crib house) have not been designed to sustain the loading associated with the pro-bable maximum precipitation (PMP).

The design of the roof parapets will allow substantial accumulation of ponded water.

The staff 1 s position is that inservice inspection of roof drains is n6t a feasible solution because of the potential for blockage by debris and the frequency of inspection necessary to ensure drain tapacity~ Therefore, the* staff has recommended structural modifications 10/13/82 4-2 DRESDEN 2 SEP SEC 4

-. ~- --*'-

.:.. : -*~:.. '~ "'-.... -~-- :*.

to the parapets (i.e., scuppers) to ensure that loadings resulting from ponded water will be within the structural capability of the roof.

4.1.4 Flood Emergency Plan The licensee's flood emergency plan in its present form does not meet current criteria regarding its adequacy to provide for safe shutdown of the facility following a severe river flood.

Among the items identified during the topic review, the staff considers the following concerns to be significant:

(1)

The procedures relied on the capability of the licensee to predict floods sufficiently in advance to provide the time necessary to get the plant (2) to cold shutdown.

The licensee does not have the professional staff with the hydrologic experience necessary to devise and implement a river fore-cast system and elaborate flood emergency plan.

On the basis of the computed hydrograph information (i.e., flood stage versus time for a PMP), -there is not sufficient time to get the plant to cold shutdown using normal shutdown procedures.

The.emergency plan does not address o~her procedures that would be required in a limited time frame.

(3)

The emergency plan does not adequately address postflood conditions such as sources of emergency cooling water, time required to return safety systems to service, and fuel requirements and availability for diesel-and gasoline-powered equipment..

The existing flood emergency plan does not provide assurance that the ultimate heat sink can provide for a safe plant shutdown.

Flood scenarios exist that would result _in the inundat_ion of safety equipment.

Further, plant procedures require internal flooding of structures, which could result in a loss of all reactor cooling.

The staff has recommended that the liCensee have the capability to install and operate a portable emergency pump above the PMF level capable of providing 100%

10/13/82 4-3 DRESDEN 2 SEP SEC 4

- .J,..

- -~~ :*.;

makeup water to the isolation condenser and other cooling needs for the duration of the flood, including the time needed to restore the operation of flood-damaged components.

The plant currently has the capability to use a portable pump to supply cooling water directly to the isolation condenser using a fire hose connection.

The licensee has committed to revise the existing flood emergency plan to address the staff concerns, including the capability to operate an emergency pump.

A schedule for implementation of the procedure will be provided in November 1982.

4.2 Topic III-1, Classification of Structures, Components, and Systems (Seismic and Quality) 10 CFR 50 (GDC 1), as implemented by Regulatory Guide 1.26, requires that structures, systems, and components important to safety be designed, fabricated, erected, and tested to quality standards commensurate with the importance of safe.ty functions to be* performed.

The codes used for the *9esi-gn-,

fabrication, erection, and testing of the Dresden Unit 2 plant wer~ compared with current codes.

The development of the current edition of the American Society of Mechanical Engineers 11 Boiler and Pressure Vessel Code 11 (ASME Code) has been a process evolving from earlier ASME Code, American National Standards Institute, and other standards, and manufacturer's requirements.

In general, the materials of construction used in earlier designs provide comparable levels of safety.

The review of this topic identified several systems and components for which the*licensee was unable to provide information to justify a conclusion that the quality standards imposed during plant construction meet quality standards re-quired for new facilities.

The staff did not identify any inadequate compo-nents.

However, be~ause of the limited information on the components involved, the.staff was unable to conclude that.for code and standard changes deemed important to safety, the Dresden Unit 2 plant met current requirements.

10/09/82 4-4 DRESDEN 2 SEP SEC 4

4

.. i,:. :-

... : ~. --* :.

4.2.1 Radiography Requirements ASME Code,Section III, requires that Category A, 8, and C weld joints be radiographed.

Furthermore, ASME Code,Section III, 1977 Edition, requires that weld joints for Class 1 and 2 piping, pumps, and valves be radiographed.

The staff has reviewed, on a sample basis, the fabrication and construction inspection program implemented at Dresden Unit 2.

It finds that the program is generally in agreement with current requirements except that the following items have not been addressed:

(1) Class 2 vessels built to Class C requirements* and containing Category C joints, along with the examination technique employed, should be identified.

(2) The actual examination given to the recirculation system pump casing (this is a Class 1 component built to Class C requirements) should be described.

4.2.2 Fracture roughness ASME Code,Section III, requires fracture toughness testing of pressure-retaining material and material welded thereto.

The staff's safety evaluation forwarded by letter dated September 2, 1982 has identified the following areas where the fracture toughness requirements.have not been provided:

(1)

Reactor Shutdown Cooling System (RSCS), Reactor Building Closed Cooling Water (RBCCW) System, and Reactor Water Cleanup (RWCU) System The licensee has indicated that fracture toughness testing data do not exist for the RSCS, RBCCW, and RWCU systems.

The RSCS is designed to cool the reactor water when the temperature and pressure in the reactor fall below the point at which the main condenser can no longer be used.

If any of the system design limits are exceeded, automatic interlocks will prevent the system from being put into operation.* If the RSCS were inoperable or unavailable for any reason, the safety-grade low-pressure cbolant injection (LPCI) and core spray systems 10/09/82 4-5 DRESDEN 2 SEP SEC 4 *

.I

~ : :...

~ **. :..::.... *.. :*_-: *.. *_:_;_.,.*._*.~:_-_*

. -.. *;:* ~~..

could be used to inject cooling water into the reactor core.

Therefore, the staff has concluded that the RSCS is not required to bring the plant. to a safe shutdown condition.

The RBCCW system is designed to provide cooling for equipment and systems in

~he reactor building.

The system is not required to perform any postaccident heat removal functions.

The staff 1 s evaluation of SEP Topic IX-3, provided by letter dated June 30,. 1981, has determined that RBCCW flow to the equipment cooled by the RBCCW can be lost under both normal and postaccident conditions, and although operator action may be required to restore flow to continue plant operation, the consequences are of little safety concern.

Therefore, the staff has concluded that the RBCCW system is not important to safety.

The RWCU system is designed to remove impurities from the reactor coolant sy~tem

and is not required for any safe shutdown or postaccident function.

The RWCU system does form part of the reactor coolant pressure boundary.

Failures of this system are_ discussed in Section 4.16 regarding Topic V-II.A, 11 Requirements

for Is9latjpn of Hig.h""' and Low:-Pressure Systems.

11 Because of the low safety significance of the system and the cost of obtaining and testing samples of the systems, the staff has concluded that fracture

toughness testing is not necessary and backfitting is not required.

(2)

System Components For many components identified as requiring fractur:e toughness testing, the licensee has not provided the actual requirements imposed or the te~t results

.requested in the staff 1 s *draft evaluation forwarded.by letter dated March 9, 1982.. This information is necessary to ~omplete th~ staff 1s evaluation because of the radi ca i change *in *fracture,toughness test re-qutrements. that,occurred i ri 1972 arid the importa.nce of adequate fracture toughness to ens'ure. the integrity

of.the reactor coolant pressure *boundary and safe shutdown and accident-mi~'igatlng -systems;_ The staff is. lacking the necessary information for the.*.*

following.components:

10/09/82.

4-6 DRESDEN 2 SEP SEC 4.

(a) core spray system - pump casing (b) low-pressure coolant injection/containment cooling - pump casing, shell side of heat exchanger (c) high-pressure coolant injection - pump casing; piping, fittings, and valves (d) condensate/feedwater system - piping from reactor vessel to outermost containment isolation valve (e) main steam system - piping, fittings, and valves It is the staff's position that the licensee demonstrate adequate fracture toughness for these components or demonstrate that the consequences of their failure are acceptable.

4.3 Topic III-2, Wind *and Tornado Loa.dings 10 CFR 50 (GDC 2), as implemented by SRP Sections 3.3.l and 3.3.2 and Regulatory Guides 1.76 and 1.117, requires that the plant be designed to withstand the effects of natural phenomena such as wind and tornadoes.

The existing design and construction of structures important to safety do not meet current licensing criteria regarding the ability of safety-related struc-tures to resist tornado winds of 360 mph and differential pressures of 3.0 psi.

The following were identified by the staff as items not meeting the prescribed 1 cads.

4.3.1 Reactor Building Structure Above the Operating Floor The windspeed capacity for the reactor building steel structure and siding above the operating floor is lower than those required by the site-specific tornado-imposed loads.

In particular, the staff consultants have ~alculated that the limiting structural elements of* the east-side st~el columns and siding 10/12/82 4-7 DRESDEN 2 SEP SEC 4.

- < ~ -***

have a load capacity of 160 and 170 to 190 mph, respectively, and the south-side columns are able to withstand a 280-mph windspeed.

The only safety-related system located on the main floor of the reactor building is the spent fuel pool.

The safety concern would relate to failure of the steel columns in such a way that they would enter the spent fuel pool and damage the spent fuel assemblies.

Even in the unlikely event that fuel is sufficiently damaged to allow the release of radioactive gas to the pool, any subsequent release from the pool would be rapidly dispersed because of the turbulent nature of tornado winds.

Therefore, the radiological consequences would be inconsequential.

Further, the staff's evaluation of SEP Topic II-2.A, "Severe Weather Phenomena, 11 provided a probability analysis of expected tornado windspeeds.

The study showed the mean probability of exceeding a windspeed of 160 mph to be approximately 3 x 10- 5 per year and the mean probability of exceeding 280 mph to be approximately 5 x 10- 7 per year.

It i~ the staff's judgment that the probability of exceeding a tornado windspeed of 160 mph combined with the probability of the failed structure*

entedng t.he. spent fue 1 -pool in such a way as to cause fue 1 damage c~mbi ned with the small radiological consequences is sufficient to preclude upgrading of the reactor building structure, Backfitting, therefore, is not required.

4.3.2 Ventilation Stack The stack capacities provided to the staff by the licensee are lower (255 mph) than those required by the site-specific tornado-imposed loads.

Failure of the stack could affect the integrity of seismic Category I structures because the stack is in close proximity to these structures.

The staff's evaluation of SEP Topic II-2.A has determined that the m~an probability of a tornado with windspeed exceeding 255 mph is approximately 2 x 10- 6 per year!

For th~ following reasons, upgrading of the stack capacity to withstand a design-basis tornado is not recommended:

(1) There is a 1 ow probability* of a tornado wi ndspeed exceeding the stack capacity.

10/12/82 4-8 DRESDEN 2 SEP SEC 4

(2)

Failure of the stack would not result in an inability to achieve safe shutdown or in an adverse offsite radiological *impact.

(3)

Margins exist in the stack capacity analysis.

4.3.3 Components Not Enclosed in Qualified Structures The staff's analysis did not include the systems and components important to safety that are located outside qualified structures. It is the staff's position that the licensee identify those components and ensure that they are designed to withstand the postulated tornado loading or that their loss of function will not adversely affect safe operation of the plant.

4.3.4 Roof Decks Roof decks consisting of builtup roofing as opposed to structural roof slabs made of concrete were not investigated by the staff. It is expected that such roof ~eeks will have minimal resistance to differential pressure.. Therefore, it is the staff's position that the lfcen~~e provid~*an evaluation to demonstrate that failure of roof decks will not adversely affect safe plant operation or result in unacceptable offsite dose consequences.

4.3.5 Load Combination~

As a result of the topic review, the staff was unable to determine if straight wind loads (not tornado loads) were combined with other loads (i.e., operating pipe reaction loads and thermal loads).

The effect of combining wind loads with other loads is addressed with SEP Topic III-7.B, 11 Design Codes, Design Criteria, Load Combinations,- and Reactor Cavity Design Criteria.

11 4.4 Topic III-3.C, Inservice Inspection of Water Control Structures 10 CFR 50 (GDC.2, 44, and 45), as implemented by Regulatory Guide 1.127; requires that structures, systems, and components important to safety be designed to withstand natural phenomena such as floods and that a system to 10/12/82 4-9 DRESDEN 2 SEP SEC 4

. ---:_ -. -:~:. '.-.. -:.... \\

.-. *~*.. :.:::_~;.

~....,....

transfer heat to an ultimate heat sink be provided.

The inspection is intended for water control structures used for flood protection (on or off site) and emergency cooling water systems.

The safety objective is to ensure that water control structures that are part of the ultimate heat sink are available at all times during both normal and accident conditions.

The topic review identified several items for which current acceptance criteria are not met.

4.4.1 Flow-Regulation Station The staff found that the period of inspection for the flow-regulation station electrical and mechanical equipment does not comply with current licensing criteria.*

By letter dated September 2, 1982, the licensee has stated that the flow-regulation station is not safety related and that a specific inspection frequency is not necessary.

Failure of the station would be in the as-is configuration and plant operation could continue in the failed mode.

On the basis of the above, the staff has concluded that the flow-regulation.

station is not safety ~elated. Therefore, backfitting is not required, 4.4.2 Intake and Discharge Structures The staff found that the inspection frequency for the structural integrity of.

the intake and di~charge structures does not meet current criteria; since ~his frequency is based on observed sedimentation rates rathe~ than historical occurrences of movement.. Failure of the slopes could cause blockage of the canals.

The staff's evaluation of Topfc II"'.'4.E, "Stability of Slopes,'.' has concluded that the rock into-which the canals are cut is sound and capable of main~aining a.stabl~.vertical.cut under earthq~ake or other events.

In. addiiion; iufficierit water will be available in the ~anals and cooling l~ke to permit=-

saf.e shutdow_n,. even in.the unlikely event* of slope failure.

Therefore,

backfitting. is.not required. *.*

10/09/82 DRESDEN 2.SEP SEC 4.

~ :,......

4.4.3 Inspection Program The inspection program does not comply with current criteria because the program is not overseen by qualified engineering personnel who would document the results of inspections.

In addition, the inspectfon program should be formalized so that provisions will exist for special inspections immediately after the occurrence of extreme events.

By letter dated September 2, 1982, the licensee stated that procedural changes to ensure review and approval of the inspection program by qualified engineering personnel and to initiate inspection after extreme events have been initiated by the Dresden station.

The licensee has committed to modify the existing plant procedures in accordance with staff recommendations.

A schedule for implementation of the procedures will be provided in November 1982.

4.5 Topic III-4.A, Tornado Missiles 10 CFR 50 (GDC 2), as implemented by Regulatory Guide 1.117, prescribes structures, ~ystems, and components that ~hould be desigried to withstand the effects of a tornado, including tornado missiles, without loss of capability to perform their safety functions.

Regulatory Guide 1.117 requires that structures, systems, and components that should be protected from the effects of a design-basis tornado are (1) those necessary to ensure the integrity of the reactor coolant pressure boundary, (2) those necessary to ensure the capability to shut down the reactor and maintain it in a saf~ shutdown condition (including both hot standby and cold shutdown), and (3) those whose failure could lead to radioactive releases resulting in calculated offsite exposures greater than 25% of the guideline exposures of 10 CFR 100 using appropriately conservative analytical methods and assumptions.

The physical separation of redundant or alternate stru~tures or components required for the safe shutdown of the plant is not considered acceptable by itself for providing protection against the effects of t~rnadoes, including tornado-generated*

missiles, because of the large number and random direction of potential missiles that could result from a tornado as well as the need to consider the 10/09/82 4-11 DRESDEN 2 SEP SEC 4

single-failure criterion.* The staff has found that there are portions of safety-related systems that are not protected from tornado missiles.

4.5.1 Service Water System (SWS)

The staff has determined that the service water supply for two ventilation systems necessary for safe shutdown is not protected from tornado missiles.

These systems are (1) the control room ventilation system and (2) the auxiliary electrical equipment room ventilation system.

(1)

Control Room Ventilation System Portions of the SWS necessary for safe operation of the control room ventilation system are located.in a non-tornado-missile-protected section of the crib house.

NUREG-0737, 11Clarification of TMI Action Plan Requirements, 11 Item III.D.3.4; 11 Control Room Habitability Requirements, 11 states that all licensees should pro-vide assurance that the habitability systems will operate* u*nct'er all postulat~d conditions.

Implementation of the TMI Action Plan is being conducted indepen-dently of the SEP.

Therefore, backfitting is not required.

(2) Auxiliary Electrical Equipment Room Ventilation System The auxiliary.electrical equipment room houses equipment and systems essential for safe shutdown, including the reactor protection system motor-generators and instrumentation, the engineered safety system generators, and essential relays and switchgear.. The station SWS supplies the ventilation system for this area.

Portions of the SWS are located in a non-tornado-missile-protected section of the crib house.

It is the staff's position. that the licensee provide protection of the SWS or demonstrate that the necessary equipment located in the auxiliary electrical equipment room is adequately ventilated.

10/09/82 4-12 DRESDEN 2 SEP SEC 4

'*:.1

L 4.5.2 Station Battery Systems The staff's safety evaluation forwarded by letter, dated June 28, 1982, stated that the station batteries are not protected from tornado missiles because they are located in a room with concrete block walls.

During the August 1982 site visit, the integrated assessment team observed the battery room area.

Although the batteries themselves are contained in a concrete block wall enclosure, that enclosure is located within the east turbine building, which has reinforced concrete walls at least 12 in. thick.

Therefore, the staff concludes that the batteries are adequately protected from tornado missiles and backfitting is not required.

4.5.3 Diesel Generator Ventilation The diesel generator air intake and exhaust systems are not protected from tornado missiles.

Damage to the intake or exhaust system could result in diesel generator failure.

(1)

Diesel Generator 2 (DG 2)

The DG 2 air intake and exhaust systems are located on the main floor of the turbine building above the tornado-protected area.

Loss of DG 2 air intake would not result in loss of function because air can be drawn from inside the turbine building below the main floor.

However, loss of the DG 2 exhaust could result in loss of function if the exhaust were to fill the DG intake area and thus result in choking of the DG.

It is the staff's position that the licensee

must provide assurance that the DG will remain operable in the event that the exhaust system is damaged.

(2)

Diesel Generator 2/3 (DG 2/3)

DG 2/3 is located in a separate reinforced concrete structure south of the Unit 3 reactor building.

The air intake and exhaust units are located on the roof of that building and are not protected from tornado missiles.

Loss of either air intake or exhaust could result in loss of DG 2/3 caused by choking 10/09/82 4-13 DRESDEN 2 SEP SEC 4

from lack of air or inundation with exhaust fumes.

Therefore, it is the staff's position that the licensee must provide assurance that DG 2/3 will remain operable if the ventilation systems are lost.

4.5.4 Exterior Tanks During the August 1981 site visit, the staff identified the condensate storage tanks (CSTs) as external tanks and thus not protected from tornado missiles.

Because the CSTs are used in various scenarios for safe shutdown, it is the staff's position that the CSTs should be protected from tornado missiles or the licensee should provide assurance that safe shutdown can be accomplished using missile-protected systems or components.

4.6 Topic III-4.B, Turbine Missiles 10 CFR 50 (GDC 4), as implemented by Regulatory Guide 1.115 and SRP Section*

3.5.1.3, requires that structures, systems, and components important to safety be appropriately protected against dynamic effects, which include potential missiles.

The safety objective of this teview is to ensure that a11* the structures, sys-tems, and components important to safety (identified in Regulatory Guide 1.117) have adequate protection against potential turbine missiles either because of structural barriers or a high degree of assurance that failures at design or destructive overspeed will not occur.

General Electric is currently analyzing the probability for generating turbine missiles generically for its turbine designs.

This analysis will consider material properties, turbine disc design, inservice inspection intervals, and overspeed protection system characteristics as they relate to destructive over-speed missile generation.

The results of this analysis will be submitted to the staff and wi_ll identify recommended inspection intervals for the disc and control valves based on plant-specific turbine characteristics and test results.

10/09/82 4-14 DRESDEN 2 SEP SEC 4

~ *:. *.

To achieve the objective of unlikely failures in the interim, the staff recom-mends that (1) volumetric inspections of low-pressure turbine discs be conducted in accordance with General Electric procedures during the next refueling out-age unless the discs have been volumetrically inspected within the past 3 years (2) an inservice inspection program be developed and implemented that requires turbine disassembly at approximately 3-year intervals and inspection of all normally inaccessible parts performed in accordance with the proce-dures suggested by the turbine manufacturer (3) all main steam stop and control valves and reheat stop and intercept valves be dismantled and inspected at approximately 3-year intervals (4) main steam stop and control valves and reheat stop and intercept valves be exercised.at least once a week by closing each valve fully.

Dresden Unit 2 does not comply with Item (2) of the staff's recommended inspection program.

The licensee's current inspection schedule calls for a complete reinspection of the turbines within 6 years of the last inspections.

This inspection interval is. based on the turbine manufacturer's calculation of crack growth following a January 1981 wheel bore ultrasonic examination.

It is the staff's position that the licensee provide the staff with the proposed inspection schedule for the low-pressure portions of the turbine and the basis for the proposed schedule.

The staff will review th~ schedule and basis for inspection to determine interim acceptability until completion of the General Electric Company's probability analysis.

10/09/82 4-15 DRESDEN 2 SEP SEC 4

~--. -****. :...

I.

I i:

I:

4.7 Topic III-5.A, Effects of Pipe Break on Structures, Systems, and Components Inside Containment 10 CFR 50 (GDC 4), as interpreted by SRP Section 3.6.2, requires, in part, that structures, systems, and components important to safety be appropriately pro-tected* against dynamic effects such as pipe whip and discharging fluids.

The safety objective for this topic review is to ensure that if a pipe should break inside the containment, the plant could safely shut down without a loss of con-tainment integrity and the break would pose no more severe conditions than those analyzed by the design-basis accidents.

The staff has compared the licensee's proposed evaluation methods presented in his [[letter::05000237/LER-1982-035-03, /03L-0:on 820724,offgas Flow Indicated High During Normal Startup.Caused by Cracked Fillet Weld in 2D1 Feedwater Heater Emergency Spill to Normal Heater Drain Line Connection.Weld Cracked Due to Excessive Line Movement|letter dated August 23, 1982]] with the criteria and methods currently used for licensing new facilities.

In general it was found *that the licensee's pro-gram, methods of approach, and criteria used for the evaluation are adequate.

A detailed evaluation of the results will be performed when they are made available by the licensee.

During the review, the staff identified those areas where the licensee's ~ethodology differs from current criteria.

4.7.1 Jet Impingement on Target Pipe In considering the damage criteria, the licensee has used the assumption that a jet or whipping pipe is considered to inflict no damage on other pipes of equal or greater size and equal or greater thickness.

The licensee provided some justifications leading to the conclusion that the same rule that is applicable to pipe whip should also be applicable to jet impingement considerations.

However, the staff feels that the energy absorp-tion mechanism for a pipe-to-pipe impact is different from that for jet impingement on a pipe.

Therefore, it is the staff 1 s. position that the licensee should evaluate and address the effects of jet impingement regardless of the ratio of impinged and postulated broken pipe sizes.

10/09/82 4-16 DRESDEN 2 SEP SEC 4

-" ~-*-*---*--

4.7.2 Broken Pipe Impact on Target Piping In determining the acceptability of target piping, the licensee has used the criterion that the limiting factor for an applied equivalent static load is that the resulting strain in the target piping material does not exceed 45% of the minimum ultimate uniform strain of the material at the appropriate temperature.

This criterion is acceptable for avoiding cascading pipe breaks.

However, some piping systems are required to deliver certain rated flow and should be designed to retain dimensional stability when stressed to the allowable limits associated with the emergency and faulted conditions; i.e.,

the functional capability of the piping is required to be demonstrated.

The licensee was requested to provide justification to ensure that the target piping will remain functional as a result of jet impingement and pipe whip interactions.

The licensee indicated that he has performed a parametric study covering a range of geometric and load parameters.

The results of the nonlinear finite-element dynamic analysis indicate~ the coexistence of large localized

~train l~vels and sma~l ~lobal deformations.

Thus, the licensee det~rmined that it is possible to achieve strain levels approaching 45% of the minimum uniform ultimate strain of the material in a localized region without affecting the overall deformation or functionability of the target piping.

In reviewing the example in the licensee 1 s parametric study submitted in his [[letter::05000237/LER-1982-035-03, /03L-0:on 820724,offgas Flow Indicated High During Normal Startup.Caused by Cracked Fillet Weld in 2D1 Feedwater Heater Emergency Spill to Normal Heater Drain Line Connection.Weld Cracked Due to Excessive Line Movement|August 23, 1982 letter]], the staff found that the 45% of the minimum uniform ultimate strain reached at the point of load application was a global strain because a beam model was used for analysis.

Therefore, it is the staff 1 s position that the licensee demonstrate that the localized deformation associated with a global strain of 45% of the minimum ultimate unifor~ strain of the material would not affect the functionability requirement of the target piping.

10/12/82 4-17 DRESDEN 2 SEP SEC 4

4. 7. 3 Detectabi 1 tty Requirements The licensee's approach for the alternative safety assessment for selected high energy pipe break locations using fracture mechanics analysis i~ not consistent

- with the staff's guidance on the subject.

For example, the licensee did not address-the detectability requirements necessary to detect through-wall cracks, with a length equal to twice the wall thickness, in piping systems that have minimum flow rates associated with normal operating conditions.

The licensee proposed an approach based on the leak-before-break concept consisting of the fo 11 owing steps:

(1) The initial crack size is based on a Code-allowable surface defect.

(2) Crack growth is based on a f~tigue mechanism.

(3) The end-of-life crack size reflects the growth pot~ntial of the initial crack.under expected-operating conditions.

(4) The end-~f-life crack size is co~par-ed with-the critical crack length to establish the margin of safety.

(5) If the end-of-life crack becomes a through-the-wall crack, the leakage for this crack length is calc~lated.

(6). The* leakage from a through-the-wall crack that is of critital length is calculated, arid the-margin of safety on leakage from the critical-length

-crack as compared with the 1 eakage from the end-of-1 ife crack is established.

-(7)-

For the specific postulated break loi:atibn, the current-_capability to

~..

detect leakage is'determioed; and this capability is compared.with the

- leakag~ from the* crit_ic.al:..l.ength crac~. - Additional leakage detection capability as required to ensure-that the. margin of safety ~n leakage detection is greate*r ~han loO-percent is* provided;

. 10/12/82 4-18 DRESDEN 2 SEP SEC -4

The staff has reviewed the licensee's approach artd f6und it is not justified.

The licensee's analysis is based on pipe crack caused by fatigue failure of the pipe.

The staff's position is that piping failures are more likely caused by other mechanisms (i.e., stress-corrosion cracking).

Therefore, it is th.e staff's position that the licensee follow the staff's guidance for resolution of unresolved interactions.

4.7.4 Criteria Implementation In the course of the staff's review, two areas were identified where the licensee's approach was found generally acceptable pending staff review of the analysis results.

These areas are (1) pipe whip load formulation (2) interaction of pipe whip and jet impingement with the containment liner Therefore, to complete its evaluation of these items, the staff requires the lice~see to provide the criteria and results for pipe whip load formulation.

By letter dated August 31, 1982, the Jersey Central Power & Light Company described an evaluation that was performed for the Oyster Creek Nuclear Generating Station. This report su.pported a conclusion. that (1) the interac-tion between the drywell liner and a whipping pipe could only be glancing blow; (2) no sharp edges could hit the liner in a penetrating direction; and (3) the liner displacement. is limited by the concrete drywell which will prevent any rupture of the liner by a recirculation line, main. steam line, or feedwater piping.

The staff has reviewed the Oyster Creek submittal with regard to its applicability to Dresden Unit 2.. Because of the. similarity in design, the staff has found.that the Oyster Creek results are, 1n general; applicable to Dresden Unit 2.

Therefore, it is the staff's positibn that the licensee review the Oyster Creek evaluation to ensure-that the criteria and methodology used

.for bot~ pipe whip and jet impirtgem~nt are applicable to the.Dresden Unit 2

design.

10/09/82 4-19 DRESDEN 2 SEP SEC. 4

... *..* *' ~

__.,_,, :._.::....\\;.;. :. _:; ___,*;..:_.. *:.. _<,.:* *. *...

4.8 Topic III-5.B, Pipe Break Outside Containment 10 CFR 50 (GDC 4), as implemented by SRP Sections 3.6.1 and 3.6.2 and Branch Technical Positions (BTP) MEB 3-1 and ASB 3-1, requires, in part, that struc-tures, systems, and components important to safety be.designed to accommodate the dynamic effects of postulated pipe ruptures.

The safety objective for this topic review is to ensure that if a pipe should break outside the containment, the plant can be safely shut down without a loss of containment integrity.

The effects of pipe breaks for both the main steam isolation condenser and reactor water cleanup lines between the containment penetration area and the iso]ation valve outside containment with an assumed single active failure of the inboard containment isolation valve would result in a loss-of-coolant accident (LOCA) outside containment.

Current licensing criteria for this event ensure that a pipe break between the outside isolation valve and the contain-ment wall is unlikely.

This is accomplished by ensuring l6w pipe stress (BTP MEB 3-1) and high-quality pipe (i.e., seismic Category I).

No stress data are avai"lable to demonstrate that these piping sys~ems between the containment penetration and the isolation valve outside containment meet the stress limits. of BTP MEB 3-1.

A limited risk assessment of the importance of the various postulated pipe breaks as unisolable LOCAs was conducted for Dresden Unit 2.

It was determined that the LOCA frequencies associated with these pipe breaks are all less than 2 x 10- 7 per year, since both a pipe break outside containment and a failure of an isolation valve inside containment are necessary for.this sequence.

Even if all these events led to core melt with release, the higher frequencies of other core-melt sequences coupled with the virtual certainty of containment failure after core melt makes these LOCAs

. negligible from a risk perspective.

In addition, the small frequencies of pipe breaks result in a similar conclusion regarding the physical e.ffects associated with the pipe break.

Therefore, the probabilistic risk assessment (PRA) rated the importance to risk of pipe breaks between the co~tai~ment perietration and the isolation valve outside containment a~ low.

Backfitting, therefore, is not tequired.

10/09/82 4-20 DRESDEN 2 SEP SEC 4

. '.. *. :;,_;:.. *.:.. ~

~-- *- **-*

'*~-*.

4.9 Topic III-6, Seismic Design Considerations 10 CFR 50 (GDC 2), as implemented by SRP Sections 2.5, 3.7, 3.8, 3.9, and 3.10 and SEP review criteria (NUREG/CR-0098, 11Development of Criteria for Seismic Review of Selected Nuclear Power Plants 11 ), requires that structures, systems, and components important to safety shall be designed to withstand the effects of natural phenomena such as earthquakes.

4.9.1 Piping Systems The review of the adequacy of all safety-related p1p1ng supports is being reviewed for compliance with Office of Inspection and Enforcement (IE)

Bulletins 79-02 and 79-14 and was not duplicated as a part of the SEP piping seismic audit analyses.

As discussed in Chapter 6 of NUREG/CR-0891, 11 Seismic Review of Dresden Nuclear Power Station - Unit 2 for the Systematic Evaluation

Program, 11 the methods used for the original seismic piping design, especially for the design of piping supports, may not have been conservative.

In response to NRC 1 s 11 Notice of Violation, 11 the licensee.reported that a signif.icant number

of mo~ifications to existing supports and the addition* of ~e~ supports Would be required to complete his effort in response to IE Bulletin 79-14.

The licensee has proposed to correct, on a priority basis, piping support deficiencies asso-ciated with (1) the reactor coolant system pressure boundary piping up to the first normally closed isolation valve or the first isolation valve capable of being closed and (2) piping necessary to ensure at least one path for reactor decay heat removal.

The licensee has proposed to complete all work associated with IE Bulletin 79-14 by December 31, 1983.

The Final Safety Analysis Report (FSAR) seismic input (Housner ground-response spectrum anchored at 0.2 g) is more conservative than the site-specific spectrum that was developed by NRC for seismic reevaluation of the Dresden site.

On the basis of the low probability of an earthquake with ground motion that exceeds the NRC 1s site-specific spectrum, the conservatism of the FSAR seismic inp~t, and the margins that exist in FSAR design criteria for piping systems, the staff has determined that it is appropriate to resolve the.

10/09/82 4-21 DRESDEN 2 SEP SEC 4

11adequacy" or conservatism of the original design of piping supports as part of the IE Bulletin 79-14 effort.

4.9.2 Mechanical Equipment During the audit review of mechanical and el~ctrical equipment, the Senior Seismic Review Team found that information was lacking for three of the nine mechanical equipment items sampled.

These items are discussed below.

(1) The staff identified a lack of information with regard to motor-operated valves (MOVs).

By letters dated July 7, 1982 and September 3, 1982, the liceniee provided additional information regarding pipe stress resulting from MOVs.

However, information was not supplied regarding length of the valve lever arms and the associated limiting moment.

In order for the staff to complete its review, the licensee should provide this information.

(2)

The staff lacks sufficient* information to evaluate the structur~l integrity of the reactor vessel and *internal *supports.

The~efore, the staff will require the licensee to provide an analysis of the capability of the reactor internal supports to withstand the SEP-defined earthquake without loss of structural integrity.

(3) The staff lacks sufficient information to evaluate the structural integrity of the recirculation pump and supports.

Therefore, the staff will require the licensee to provide an analysis of the capability of the recirculation pump and supports to withstand the SEP-defined earthquake without loss of structural integrity.

4.9.3 Qualification of Cable Trays.

The staff lacks sufficient information to conclude that the seismic qualifica-tion of electrical cable trays is acceptable.

Programs undertaken by the SEP Owners Group are intended to provide a set of general analytical methodologies 10/09/82 4-22 DRESDEN 2 SEP SEC 4

"':.;,....: ~......,.

for the seismic qualification of cable trays and for documentation of the func-tionability of other safety-related electrical equipment subjected to seismic loads; these programs have not been completed.

It is the staff 1s position that the licensee implement a plant-specific analysis of the structural integrity of cable trays on completion of the SEP Owners program and, if necessary, upgrade cable tray support systems to ensure their ability to maintain their integrity under safe shutdown earthquake loading.

The NRC has initiated a generic program to develop criteria for the seismic qualification of equipment in operating plants as an unresolved safety issue (USI A-46).

Under this program, an explicit set of guidelines (or criteria) that should be used to judge the adequacy of the seismic qualification (both functional capability and structural integrity) of safety-related mechanical and electrical equipment at all operating plants will be developed.

The ongoing SEP Owners Group program for equipment qualification will be considered in the development of the USI A-46 criteria.

4.10 Topic III-7.8, Design Codes, Design Criteria, Load Combi~ations, and Reactor Cayity Design Criteria 10 CFR 50 (GDC 1, 2, and 4), as implemented by SRP Section 3.8, requires that structures, systems, and components be designed for the loading that will be imposed on them and that they conform to applicable codes and standards.

Code, load, and load combination changes affecting specific types of structural elements have been identified where existing safety margins in structures are significantly reduced from those that would be required by current versions of the applicable codes and standards.

Approximately 30 specific areas of design code changes potentially applicable to the Dresden Unit 2 plant have been identified for which the current code requires substantially greater safety margins than did the earlier version of the code, or for which no original code provision existed.

The significance of.the identified code changes cannot be assessed until a plant-specific review of their applicability~ as well as of margins in the 10/09/82 4-23 DRESDEN 2 SEP SEC 4

J. ~~. **.-.:. *._ *:.'

original design, is completed.

This does not infer that existing structures have inadequate safety margins.

The review, however, will clarify if the original margins are comparable to those currently specified.

This will include consideration of the appropriate applied loads (e.g., roof loading resulting from probable maximum precipitation and snow) and load combinations.

By letter dated August 2, 1982, the licensee provided information regarding the applicability of the identified code changes to the Dresden Unit 2 plant and an assessment of the as-built safety margins.

This information is currently being reviewed by the staff and will be addressed in a supplement to this report.

Any further actions required of the licensee will be identified following staff review of the consultant's report.

4.11 Topic III-8.A, Loose-Parts Monitoring and Core Barrel Vibration Monitoring 10 CFR 50 (GDC 13), as *implemented by Regulatory Guide 1.133, Revision 1, and SRP S_ectiqn 4.4, requires a.loose-parts monitoring program* for the primary sys-.

tern of light-water-cooled reactors.* Dr~sden Unit 2 does noi have a loose-parts monitoring program that meets the criteria of Regulatory Guide 1.133.

A loose-parts monitoring program could provide an early detection af loose parts in the primary system that could help prevent damage to the primary system.

Such damage relates primarily to (1) damage to fuel cladding resulting from reheating or mechanical penetration (2) jamming of control rods (3) possible degradation of the component that is the source of the loose part to such a lev~l that it cannot properly perform its safety-related function Backfitting of a loose-parts monitoring program is being considered in Revision 1 to Regulatory Guide 1.133. If the staff decides to implement the 10/09/82 4-24 DRESDEN 2 SEP SEC 4

._.:.*. :..* *;' k)

recommendations of this revision, then the need to implement a loose-parts monitoring program on operating reactors will be addressed generically.

The following factors were considered in making the recommendation that no backfitting be done at this time:

(1) A summary of 31 representative loose-parts incidents at 31 reactors (from the value-impact statement of Revision i to Regulatory Guide 1.133) indi-cates that structural damage occurred as a result of loose parts in only nine incidents.

None of these incidents caused a safety-related accident.

(2)

Most loose parts can be detected during refueling inspections.

(3)

The limited PRA of this issue for Dresden Unit 2 concluded that eliminating loose parts-induced transients by installing a loose-parts monitoring system would have no effect on risk.

Backfittin~, therefore, is not recommended for Dresden Unit 2 at this time.

4.12 Topic III-10.A, Thermal-Overload Protection for Motors of Motor-Operated Valves 10 CFR 50.55a(h}, as implemented by Institute of Electrical and Electronics Engineers (IEEE) Std. 279-1971 and 10 CFR 50 (GDC 13, 21, 22, 23, and 29),

requires that protective actions be reliable and precise and that they satisfy the single-failure criterion using quality components.

Regulatory Guide 1.106 presents the staff position on how thermal-overload protection devices can be made to meet these requirements.

The Dresden Unit 2 design does not meet current licensing criteria for all safety-related valve functions because the adequacy of the setpoints for unbypassed thermal overloads has not been established.

10/09/82 4-25 DRESDEN 2 SEP SEC 4

4.12.1 Thermal Overloads Because poor valve reliability may lead to the failure of more than one valve during emergency conditions and multiple valve failures have not been analyzed for their effect on system performance and plant safety, the staff recommends that action should be taken to improve valve reliability.

The limited PRA of this issue for Dresden Unit 2 concluded that a single valve can*have its unavailability reduced by about 14% by the elimination of spurious thermal overload trips by bypassing the thermal overload protection. It was concluded that because many valves are affected, the issue is of medium importance to risk.

It is the staff's position that the licensee bypass thermal overloads with an emergency core cooling system signal or ensure the adequacy of the setpoints for unbypassed thermal overloads.

4.12.2 Tcirque Switches In MOV designs that use a torque switch instead of a limit switch to limit the opening or closing of the valye, the automatic opening or closing signal should be used in conjunction with a corresponding limit switch, and thermal overload switches should remain as backup protection over the first 10% of valve travel.

The licensee has investigated the plant design and has reported that a limit switch bypasses the torque switch to initiate valve movement in all cases.

Thus, the staff considers this issue resolved, and backfitting is not required.

4.13 Topic V-5, Reactor Coolant Pressure Boundary (RCPB) Leakage Detection 10 CFR 50 (GDC 30), as implemented by Regulatory Guide 1.45 and SRP Section 5.2.5, prescribes the types and sensitivity of systems and their seismic, indi-cation, and testability criteria necessary to detect leakage of primary reactor coolant to the ~ontainment or to other interconnected systems.

Regulatory Guide *1.45 recommends that at least three separate leak detection systems be installed in a nuclear power plant to detect unidentified leakage of 1 gpm from 10/09/82 4-26 DRESDEN 2 SEP SEC 4

the RCPB.to the primary containment within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months .

Leakage from identified sburces must be isolated so that the flow of this leakage maY be monitored sepa-rately from unidentified leakage.

The detection systems should be capable of performing their functions after certain seismic events and of being checked in the control room.

Of the three separate leak detection methods recommended, two of the methods should be (1) sump level and flow monitoring and (2) airborne particulate radioactivity monitoring.* The third method ~ay be either monitoring the condensate flow rate from air cdolers or monitoring airborne gaseous radioactivity.

Other detection methods--such as monitoring humidity, temperature, or pressure--should be considered to be indirect indications of leakage to the containment.

In addition, provisions should be made to monitor systems that fnte0face with the RCPB for signs"of intersystem leakage by methods such as monitoring radioactivity and water levels or flow.

A limited risk assessment of the importance of the sensitivity of leakage detec-tion system~ to risk was_c~nducied for Dresden Unit 2 by u~ing the Millstone Unit 1 Int:egrated Reliability Evaluation Program (!REP) study.

This study only addressed leakage detection as it related to the small-break LOCA (as described

.ih Appendix D").

For this event," it was-deter~ined.that the importance of leak detection capability (i.e.*, t_he sensitivity of detectors to leak rate and time) to risk was very dependent on time for a leak to b_ecome a break. If the leak-before-break time was short (less th~n 1 houf) or long (more than 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months ), the benefits of ;~proved leak detection capability were low.

This

.occurs because the existing Dresden systems can detect leak 0ates of 1 gpm in about 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months , and current criteria would require detection of a lea~ of 1 gpm i~.1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months .

Furthe~, the LOCA sequence for boiling-w~ter reactors (BWRs) is not a dominant sequence.. Therefore, the. PRA rate_d the importance of i ncreas~d sensitiyity o.f leakage detection systems-to risk as low, However, this

.assessment does not address the* staff's pr'i ncfpa l concern with respect to leakage det~ction; which. is not the LOCA event but is related to-high energy pipe break* (HEPB) discussed in Section 4.7.

. The*currerit licensing *position of detection of a leak of 1. gpm within* 1 hour* '

- may not be sufficient for consideration of HEPBs. *-.In fact; for some postulated*

.break locations, where separation and/or-restraint is_ :,not practical Or p~ssible 10/09/82 4-27'

DRESDEN 2 SEP. SEC 4

~.'.

~*<.. ;_..,

.. ""*.. ~. : ~...

to mitigate the effects of an HEPB, it may be necessary to use local leak detection.

It is the staff's position that leakage detection systems and sensitivity should be reviewed in conjunction with 11 Effects of Pipe Breaks on Structures, Systems, and Components Inside Containment 11 (Topic III-5.A), and that the limited PRA based on the LOCA for BWRs does not reflect the staff's principal concern with respect to RCPB leakage.

4.13.1 System Sensitivity The_ sump pump actuations are not monitored continuously as recommended in Regulatory Guide 1.45.

However, the equipment and floor drain sumps in the drywell are pumped at the beginning of each shift.

The amount is recorded and compared with that recorded during previous shifts to determine changes or trends.

Since the accident at TMI, the operator, on receiving a sump high level alarm, manually initiates the pumping process.

Again, the amount is recorded and compared to determine changes or trends.

Although leak rate trends are determined once per shift, this does not meet the current requirements for being able to detect a 1-gpm leak rate in 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months .

In addition, the other monitoring systems (airborne particulate and gaseous radioactivity) do not meet the staff's requirements for system sensitivity.

Therefore, it is the staff's position that the licensee provide leakage detection capability to detect a 1-gpm leak in 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months .

4.13.2 Seismic Qu~lification The detection systems do not meet the recommendations of Regulatory Guide 1.45 with regard to the staff's position that the leakage detection systems be*

operable following a seismic event.

Therefore, it is the staff's position that the licensee provide at least one leakage detection system capable of detecting a 1-gpm leak in 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months that will remain operable following a safe shutdown earthquake.

10/09/82 4-28 DRESDEN 2 SEP SEC 4*

c :.: :

~*

4.13.3 -System Testability Both the airborne particulate and gaseous monitoring systems can be tested dur-ing normal operation.

However, the sump level monitoring system does not meet the recommendations of Regulatory Guide 1.45 with regard to testability dur_ing plant operation.

The current practice of pumping the sump and recording the amounts every shift ensures sump pump and level monitoring operability.

There-fore, the staff concludes that current operating practice meets the intent of the system testability requirements.

Therefore, backfitting is not required.

4.14 Topic V-6, Reactor Vessel Integrity Appendices G and H to 10 CFR 50 and 10 CFR 50.55a(g), as implemented through Regulatory Guide 1. 99, require -that reactor v.essel integrity be ensured by review of aspects such as fracture toughness, surveill~nte progr~ms, and neutron irradiation.

The staff's review of this topic identified the following issues: -

(1)

The licensee was asked to supply information on spec~fic reactor vessel materials and surveillance materials.

(2)- At the next surveillance capsule t'est, _the licensee should determi-ne the upper shelf energy.

By letter dated*March '31, 1982, the licensee asked to ainerid the Dresden Unit 2 Technical.Specifications as they pertain to Appendi_ces G and H to 10 CFR 50.

As part of its review of the proposed aniendment, the staff will address and

- r~iolve.item~ (i) a~d (2).

Beca~se this ~valuati6n is be1ng perfqrmed as,part- _

of rout.ine licensing*a_ctions of:operating _reactors, no further action is required for.this topic.

10/09/82 -

. ' 4-29 D~ESDEN 2 SEP SEC 4_

'. **~--

-~*.......... ~.-..*

4.15 Topic V-10.B, Residual Heat Removal System Reliability The topic review for SEP Topic V-10.B was performed in conjunction with Topics V-11.B, 11 Re_sidual Heat Removal System Interlock Requirements 11 and VII-3, 11Systems Required for Safe Shutdown.

11 The differences identified for these topics will be discussed in Section 4.25, which addresses Topic VII-3.

4.16 Topic V-11.A, Requirements for Isolation of Hi~h-and Low-Pressure Systems*

10 CFR 50.SSa, as implemented by SRP Section 7.6 and BTP ICSB 3, requires that interlock systems important to safety be adequately designed to ensure their availability in the event of an accident.

This includes those systems with direct interface with the reactor coolant system that h~ve design pressure ratings lower*than the reactor ~oolant system design pre~sure.

The reactor water cleanup {RWCU) system does not satisfy the current licens1ng requ.irements.

Isolation on the suction *side* of the RWCU system is provided by

three motor-operated v~lvei (MOVs), an-inboard valve (~losest to the react~r

coolant system), a pump suction valve, and a pump bypass valve.

Isolation on the discharge side is provided by an MOV and three chetk valves.

All the MOVs have position indication in the control room.

None of the MOVs will open if pressure in the low-pressure portiori~ of the system is ~igher than its design pressure.

All the MOVs will close* on high RWCU system temperature, lo~ flow, high~ RWCU system pressure, low reactor level, high drywell pressure, or loss of co~trol power; The iriterlbcks for these valves use the same sensors and relays.* Because the interlocks for the isolation valves are not independent (i.e:, one pressure sensor actuates all thr_ee*valves), the_staff has determined

-that Dresden Unit 2 does-not comply with current licensing* requirements.

-~y letter dated September _15, 1982, the licensee provided information regarding the relief capacity of the*RWCU system so that pressure is.maintained within

.. the. desi gh

l *i 1T1i ts assumi rig'.fa i 1 ur~ 'of the _valve* pres sure* switch.:

. 10/09/82*

4-30

ORESDEN 2 SEP SEC 4

The scenario of concern is a failure in the full-open position of the RWCU system pressure control valve.

The original General Electric design specifica-tion for the RWCU system states, 11 Relief valve sizing must ensure system integ-rity.

In sizing the relief downstream of the PRV maximum relief flow conditions must be used.

11 The maximum flow through the pressure control valve in the failed-open position is 1,300 gpm.

The 6-in. relief valve is rated at 1,260 gpm at 150 psig, and the 1-in. relief valve is rated at 40 gpm at 140 psig.

The 6-in. relief valve discharges to the main condenser.

The 1-in.

I relief valve discharges to the reactor building equipment drain tank.

This tank has a 5,000-gal capacity and is automatically pumped on high level to the 33,000-gal waste collector tank at a rate of 50 gpm.

Therefore, adequate relief capacity is provided to handle full system flow assuming a pressure control valve failure.

Actuation of the relief valve, assuming failure of the pressure control valve, results in a loss of reactor coolant to the hotwell.

The operator can detect high pressure in the RWCU system by a high-pressure alarm set at 150-psig or by a high-temperature alarm that monitors the discharge side of the 6-ih. relief valve.

Both.arinunciator procedures for these alarms instruct the operator to check for ~ressure control: valve malfunction.

The procedure for the high-pressure alarm annunciation also indicates that the system should isolate automatically.

The operator has sufficient indication to manually isolate the system if necessary.

The limited PRA performed for this issue has concluded that the importance to risk depends on proper sizing of the relief capacity of the RWCU system.

As described above, the RWCU system's relief capacity is sufficient to handle full system fl ow, assuming fa i 1 ure of the pressure control va 1 ves.

Therefore, the PRA classifies the issue of low importance to risk.

On the basis of the above considerations; the staff has concluded that the design of the RWCU system is adequate to prevent overpressurization and resulting LOCA outside containment.

Therefore, backfitting is not required.

10/13/82 4-31 DRESDEN 2 SEP SEC 4

4.17 Topic V-I!.8, Residual Heat Removal System Interlock Requirements The review for SEP Topic V-11.B was performed in conjunction with that of Topics V-10.8, "Residual Heat Removal System Reliability," and VII-3, 11Systems Required for Safe Shutdown."

The differences identified for these topics will be discussed in Section 4.25, as part of Topic VII-3.

4.18 Topic VI-4, Containment Isolation System 10 CFR 50 (GDC 54, 55, 56, and 57), as implemented by SRP Section 6.2.4 and Regulatory Guides 1.11 and 1.141, requires isolation provisions for the lines penetrating the primary containment to maintain an essentially leaktight bar-rier against the uncontrolled release of radioacti~ity to the environment.

The staff's review of the containment penetrations has identified several areas LlidL Liu rruL LU11rur*111 Lu LUr'l'i=r1L liLi=11~ill!:J Lr'iLi=l'id rur* LUllLdi11111i=r1L i~uldLiurr.

The limited PRA for Dresden Unit 2 evaluated the contribution to risk of containment isolation.

The_PRA has concluded that t~e overwh~lmingly dominant.

portion of ris~ from nuclear power plants is from core-melt accidents, not other (low-consequence) releases, such as those resulting from non-core-melt accidents, that result in relatively low (compared with core melt) doses to the

public.

Because of the small size and low design pressure of the Dresden Unit 2 containment, the pressure generated by steam and noncondensible gases during a core melt will fail the containment if no other failure mechanism occurs first.

Therefore, because of the characteristics and relative consequences of leakage releases and containment ruptures by overpressure, the PRA has concluded that no benefit can be achieved by increasing the reliability of isolation of the containment because it will fail by overpressure anyway, and thus classifies these issues' importance to risk as low.

On the basis of the PRA analysis, the staff has not recommended physical modifications of the Dresden Unit 2 facility to comply with the GDC requirements.

However, because of the significant contribution to offsite radiological consequences from containment leakage following non-core-melt 10/12/82 4-32 DRESDEN 2 SEP SEC 4

accidents, the staff has recommended modifications in various areas (such as administrative controls), as discussed in the following sections.

4.18.1 Locked-Closed Valves All valves located between the inboard and outboard containment isolation valves or before the final outboard isolation valve (if there are none inside containment) should be locked closed to ensure the integrity of piping between these valves.

The licensee does use methods of administrative control on many of these lines in the form of valve checklists and outage cards.

However, these procedures do not meet current licensing requirements for ensuring that the valves are not inadvertently opened during periods when containment integrity is required.

It is the staff's position that these va.lves should be adm1n1stratively controlled and locked in a closed position as required by NRC regulations (GDC 55., 56, and 57).

It is also the staff's experience that system lineup procedures and valve chec~lists are not.designed to ensure containment integrity; rather they are designed to en~ure proper system functibn.

A specific admi~istrative procedure to periodically ensure that containment isolation valves are in the proper position is essential.

At other plant~ manual valves have been left open for extended periods.

The affected valves are located on either test, vent, drain, or capped branch lines that connect to piping penetrating the containment.

The valves, which should have mechanical locking devices and for which appropriate administrative control should be provided, are listed in Table II of the staff's safety evaluation report forwarded by letter dated September 24, 1982.

4.18.2 Leakage Detection The low-pressure coolant injection (LPCI), core spray, and reactor building closed cooling water (RBCCW) systems are closed systems as defined in GDC 57; they are provided with remote manual isolation valves rather than automatic isolation valves.

10/09/82 4-33 DRESDEN 2 SEP SEC 4

During the Appendix J leak detection review, the staff identified the RBCCW

~ystem valves 3702 and 3703 as containment isolation valves requiring leakage detection capability.

By letter dated August 27, 1982, the licensee committed to install the proper leak rate test taps on the RBCCW lines.

The modifica-tions are expected to be completed during the fall 1984 refueling outage.

The other identified systems serve an essential emergency core cooling system function and the staf£ agrees that automatic isolation valves should not be used.

However, because operator action is required to initiate isolation, if necessary, the operator must know when to do so.

This requires leakage detection capability and appropriate procedures to indicate under what conditions these valves should be closed.

The operating station for these remotely operated valves must be accessible, but it need not be in the control room.

It is the staff's positton that adequate leakage detection and appropriate procedures for operator action should be provided and the operating station should be relocated to an accessible area, where necessary, for the following valves:

(1) LPCI 1501-5A, B, c, D 1501-22, A, B (2) Core spray 1402-3A, B

. 1402-25A, B 4.18.3 Manual Isolation Valves GDC 55, 56, and 57 (Appendix A to 10 CFR 50) state that containment isolation valves should be either automatic or locked closed unless they can be demon-strated acceptable on another defined basis.

The staff has identified valves 4327-500, -502, and 1916-500 on the demineralized water supply lines and valve 4609-501 on the service air supply line as manual valves that are not locked closed.. (These valves are primary-containment isolation valves as opposed to test, vent, or drain lines discussed in Section 4.18.1.) It is the staff's 10/09/82' 4-34 DRESDEN 2 SEP SEC 4

position that manual isolation valves are not justifiable alternatives to these provisions.

Therefore, the licensee must provide locking devices for the valves.

4.18.4 Check Valves as Isolation Valves The following systems use check valves in series instead of a check valve inside and a remote manual valve outside the drywell for containment isolation as required by GDC 55 and 56.

These systems are the feedwater system (valves 2-220-58A and B inside and 2-220-62A and B outside containment) and the high-pressure coolant injection system (HPCI)(valves 2301-34, -45, -71, and -74, all located outside containment).

HPCI valves 2301-71 and -74 are actually stop check valves that are locked open and only closed for performance of leak testing; this is equivalent to the use of two check valves outside containment.

The feedwater system supplies the reactor through two parallel 18-in. lines, each containing two check valves in series (one inside and one outside contain-ment).

Remote manual isolation valves exist (in the turbine building) at the discharge.*end of each high-pressure heat~r stage (three units in parallel).

For the following reasons, replacing a feedwater check valve with a remote manual isolation valve or adding a remote manual isolation valve outside containment is not recommended:

(1)

The high-pressure heater discharge valves provide backup isolation capability.

(2)

The existing feedwater check valves are subject to local leakage rate tests, in accordance with 10 CFR 50, Appendix J.

(3)

The isolation reliability would not be significantly improved by adding a remote manual valve.

10/12/82 4-35 DRESDEN 2 SEP SEC 4

Replacing an HPCI stop check or check valve with a remote manual valve or adding a remote manual valve is not recommended for the following reasons:

(1) The existing stop check and check valves are subject to local leak rate testing in accordance with 10 CFR 50, Appendix J.

(2)

Two of the valves in question (2301-45 and -74) are on exhaust steam lines from the HPCI turbine discharging to the suppression pool water.

This system is a closed system outside containment and a single isolation valve is acceptable.

(3)

The remaining valves (2301-34 and -71) return water from the HPCI turbine moisture drain pot to the torus above the water.

These are small (2-in.)

lines designed to eliminate water slug buildup thereby permitting rapid start of the unit.

The system is connected to the standby gas treatment system (SBGTS).

Backleakage of radioactivity would be treated by the SBGTS before being.discharged to the atmosphere.

Therefore, backleakage is not a safety concern.

(4) The isolation capability of either system would not be significantly improved by adding a remote manual valve in place of a check value.

4.18.5 Valve Location The HPCI condensate drain and turbine exhaust lines contain two check valves outside containment rather than one valve inside and one outside as required by GDC 55.

The relative benefit of one valve inside and one valve outside rather than two valves outside containment was evaluated for the Palisades Plant (see NUREG-0820, Appendix D).

In this study no improvement could be identified for moving a valve inside containm~nt. This is because the probability of failure of both valves was greater than the probability of failure of the pipe between the containment and the first isolation valve.

Because of minimum improvement in containment isolation capability and low importance of leakage to overall BWR risk, backfitting is not recommended.

The use of check valves as isolation valves is discussed in Section 4.18.4.

10/09/82 4-36 DRESDEN 2 SEP SEC 4

4.18.6 Branch Lines With Single Isolation Valves The staff has identified branch lines that contain a single locked-closed isolation valve and a threaded capped stop.

The single valves are 1501-70 A and Band 1599-27 A and B located on the LPCI system pump suction lines and 1402-10 A and B located on the core spray system pump suction lines.

Because of the safety significance of the torus water, it is the staff 1 s position that a threaded cap does not constitute an acceptable isolation barrier because it can be easily removed and is not subject to leak testing.

Therefore, these branch lines should be provided with another locked-closed valve or the threaded cap should be welded in place.

4.19 Topic VI-6, Containment Leak Testing 10 CFR 50, Appendix J, requires that tests be performed to ensure that leakage through the primary reactor containment and systems and components penetrating primary containment shall not exceed allowable leakage rate values as specified in the Technical Specifications or associated bases.

At Dresden Unit 2, the licensee requested exemptions from certain requirements of the containment leak tests.

The staff has granted the requested exemptions with the exception of (1) the reactor building closed cooling water (RBCCW) supply and return isolation valves and (2) the containment airlock.

By letter dated August 27, 1982, the licensee provided a schedule for installation of the proper local leak rate test taps on the RBCCW lines.

The current schedule (taking into consideration engineering, procurement, and installation) calls for completion of the modifications during the fall 1984 refueling outage.

4.20 Topic VI-7.A.4, Core Spray Nozzle Effectiveness 10 CFR 50.46 requires that each BWR be provided with an emergency core cooling system designed to provide adequate cooling of the nuclear fuel under postulated accident conditions.* Appendii K to 10 CFR 50, 11 ECCS Evaluation 10/09/82 4-37 DRESDEN 2 SEP SEC 4

........ *. *. ' -~. '.

Models, 11 sets forth the required and accep-table factors of the evaluation models.

Information derived from Japanese core spray tests suggested that the central fuel bundles of a BWR/3 core may receive low core spray flow.

Dresden Unit 2 is a BWR/3 plant.

The staff is reviewing this concern independently of the SEP as a matter related to Generic Issue A-16, 11Steam Effects on BWR Core Spray Distribution. 11 The staff has evaluated the related information and has concluded that the Japanese data do not provide a basis for changing its conclusion that core spray flows for a BWR/3 are not less than the minimum flow required for core spray heat transfer.

Therefore, the staff has concluded that no further SEP action is necessary for the following reasons:

(1)

The Japanese data for a BWR/5 may be applicable only to a BWR/4 and a BWR/5 -because they have a siini 1 ar spray nozzle des*ign.

The BWR/3 spray nozzle design is different from BWR/4 or BWR/5 designs.

(2)

Even though there are no core spray test data in a steam condition for a BWR/3 configuration, a BWR/6 30° sector steam test and 360 full-scale tests in an air environment performed in the United States indicate that the core spray overlap~ the center bundles causing high flow rate over the

_central region of the core.

As a result, flow to each bundle is not less than the minimum spray flow required for core spray heat transfer.

(3) General Electric (GE) has informed the staff in a conversation that GE analyses show that for limiting cases of a BWR/3 with core spray assumed to flow down peripheral channels to increase the reflood rate (as observed in the Lynn test), the calculated peak clad temperature did not exceed the 10 CFR 50.46 limit of 2200°F with no credit taken for the spray cooling effect.

The staff has requested GE to submit these analyses for its revie~.

10/09/82 4-38 DRESDEN 2.SEP SEC 4

- -~*- ~... ' :.. '......

4.21 Topic VI-7.C.l, Appendix K - Electrical Instrumentation and Control (EI&C) Re-Reviews 10 CFR 50 (GDC 2, 4, 17, and 19), as implemented by SRP Sections 8.3.1 and 8.3.2, requires that the onsite electric power distribution system be designed to provide (1) redundancy of safety-related components and ~ystems, (2) elec-trical interconnection between redundant portions, and (3) physical separation between redundant components of the system.

Physical separation of power, instrumentation, and control cables associated with the various components (buses, switchgear, etc.) of the distribution sys-tems, as it complies with Regulatory Guide 1.75, is included with this topic review.

Additional review guidelines for cable separation, as well as for the physical separation of redundant distribution systems, is defined in 10 CFR 50, Appendix R.

A limited PRA for this issue has been conducted.

The items discussed in Sections 4.21.1 and 4.21.5 have not been evaluated because it is an assumption of PRA that the equipment is.of *an adequate design to peffo~m the function for which it is intended.

The remaining items were analyzed with respect to evaluating the potential impact of the staff 1 s recommended actions on plant safety.

On the basis of discussions with plant personnel, the PRA contractor assumed that procedures already exist that conform to the staff 1 s recommenda-tions and that implementation of the staff 1 s recommendations would not increase plant reliability.

Thus, the PRA has classified this issue 1 s importance to risk as low.

The staff has reviewed existing plant procedures and has found they do not conform to its recommendations.

Therefore, the conclusions reached in the PRA are invalid.

It is the staff 1 s position that the licensee take appropriate action, as described in the following sections, to ensure that the plant EI&C features will perform their intended safety functions.

10/12/82 4-39 DRESDEN 2 SEP SEC 4

4.21.1 Breaker Adequacy (1)

Battery Charter Isolation Division I motor control centers (MCCs) and Division II MCCs can be subjected to common faults and transients that may occur on the de system if their respective battery charger output breakers are both closed.

Individual manually operated circuit breakers connect the outputs of each of the chargers to the single battery and de loads.

The manual aspect of the design meets review guidelines defined in Position D.4.c of Regulatory Guide 1.6.

However, I

there are no interlocks to prevent the simultaneous closing of the manually operated circuit breakers.

This is a deviation from review guidelines defined in Position D.4.d of Regulatory Guide 1.6.

However, the two ac breakers and two de breakers per charger plus the isolation characteristics of each charger provide isolation and separation of ac power sources.

Thus, there is no direct connection of ac power systems.

It is the staff's position that the licensee verify the adequacy of the protective relaying so that operator error will not result in a loss of redundant ac sources.

(2) 125-V DC Automatic Transfer The design of the 125-V de system provides for the automatic transfer of the control and instrument power for the diesel generator (DG 2/3) from the Unit 2, Division I, 125-V de distribution panel to the Unit 3, Division I, 125-V de distribution panel.

The Unit 3 battery/battery-charger combination is the power source for both Unit 2, Division II, and Unit 3, Division I.

Therefore, the diesel generator control and instrument loads are automatically transferred between redundant.divisions.

This is a deviation from current review criteria.

The worst condition would be a fault on the circuit feeding the DG 2/3 load.

For a fault at this location to have an effect on the Unit 2 125-V de system, two breakers would have to fail.

For this failure to propagate to the Unit 3 125-V de system after the Unit 2 125-V de system has had multiple failures, the load must transfer to Unit 3 and two more breakers would have to fail.

Breaker-failure mechanisms exist that may cause failure of one or more ac or 10/,12/82 4-40 DRESDEN 2 SEP SEC 4

de breakers in series and are not limited to gross mechanical failures.

Such mechanisms include (a) failure of a load breaker to clear a fault before the bus feeder reaches its trip setpoint (may be caused by a lack of adequate protection curves resulting from failure to revise settings as new loads and/or sources are added to a system)

(b) a ground fault tripping an ac feeder breaker instead of a load breaker (caused by inadequate ground-fault protection)

(c) protective relay setpoint drift outside the error band assumed in the coordination of load and feeder breakers (caused by infrequent testing of the relays)

It is the staff 1s position that the licensee verify the adequacy of the protec-tive relaying so that a fault in the DG 2/3 control system will not result in a loss of redundant de sources.

(3) Standby 250-V Battery Chargers The standby 250-V battery charger (a Division I system) is supplied power from either the Unit 3 or Unit 2, Division II, power source through a key-interlock switch.

When power is supplied from Division II of Unit 3 to the Unit 2 battery, there is sharing between Units 2 and 3.

This sharing is covered by SEP Topic VI-10.B.

When power is supplied from Division II of Unit 2 to the Unit 2 battery, there is an interconnection between redundant divisions.

It is the staff's position that the licensee verify the adequacy of the protective relaying so that a fault in one de system would not be transferred to the other de system.

The licensee has committed to provide a short-circuit analysis to demonstrate the adequacy of plant protective rel~ying. A schedule for completion and sub-mittal of the analysis to the staff will be provided in November 1982.

10/12/82 4-41 DRESDEN 2 SEP SEC 4

~ *--** '

4.21.2 Disconnect Links Division I main de Bus 2 is interconnected to Division II reserve de Bus 2 through circuit breakers, disconnect links, and the Division I 125-V de distri-bution panel.

There are 16 locations where similar interconnections can be made between redundant divisions.

The breakers are molded case breakers and are not of the type that can be racked out; they can only be placed in the open position.

These breakers are only used during maintenance operations.

However, no administrative controls are provided to verify that the disconnect links are placed in the open position following completion of the maintenance activities. It is the staff's position that the licensee provide procedures to ensure that the disconnect links are opened in each circuit that has a normally open circuit breaker.

4.21.3 Use of Breakers During Power Operations There is no control circuitry at Dresden Unit 2 that is designed to open the two tie breakers (252-2829 and 252-2928) for redundant 480-V Buses 28 and 29 conc~rre~~lj with ~he las~ of offsi~e power.

Nor are there-limiting conditions for operation in regard to these breakers with respect to how long they may be closed during normal operation.

This co~ld result in overload of a diesel generator and is a deviation from review guidelines.

Therefore, it is the staff's position that the licensee provide assurance that use of Breakers 252-2829 and 252-2928 during power operation be prohibited.

4.21.4 Control Power for DG 2/3 As previously described in Section 4.21.1, DG 2/3 instrumentation and control power can be connected to the Unit 3 125-V distribution panel via a normal seeking automatic bus transfer.

This is a deviation from current licensing criteria.

The Technical Specifications for Dresden Unit 2 establish a limiting condition for operation (LCO) of 7 days for continued operation with a battery or diesel generator out of service.

This 7-day limit is not in agreement with Standard Technical Specification (STS) limits.

The STS limits, which are based on generic risk estimates, require that a failed battery system be restored to 10/12/82 4-42 DRESDEN 2 SEP SEC 4

operable status within 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months or the plant be shut down.

It is the staff's

,position that the licensee provide an LCD curtailing the time during which the instrumenta~ion and control power for DG 2/3 may be obtained from the Unit 3 125-V de distribution panel when the plant is not shut down.

Because the bat-teries and DG 2/3 are shared between the two units, the staff has concluded that the STS requirements should be applied to this aspect of the Dresden Unit 2 design.

4.21.5 Isolation of Class lE Sources from Non-Class lE Loads The 480-V ac Switchgear 27 normally receives ac power from Bus 24.

The de control power is, however, from Division I.

This is a deviation from review guidelines because 480-V Switchgear 27 is non-Class lE.

It is the staff's position that the licensee should demonstrate, by suitable short-circuit analyses and coordination curves, that all non-Class lE loads are adequately i?olated from Class lE sources by at least two circuit breakers in series (e.g.

Switchgear 27 feeder breaker and individual load feeder breakers should be coordinated to ensure that faults are not transferred to the Cl~ss IE bus).

Two breakers.are physical~y present; however, their trip. devi~es may flot.b~

coordinated.

The licensee has indicated that a short-circuit analysis will be done.

No schedule has been provided for completion and submittal to the staff.

4.22 Topic VI-10.A, Testing of Reactor Trip System and Engineered Safety Features, Including Response-Time Testing 10 CFR 50 (GDC 21) requires that the reactor protection system be designed to permit periodic testing of* its functioning, including a capability to test channels independently.

10 CFR 50.55aa(h), through IEEE Std. 279-1971 and IEEE Std. 338-1971, requires that response-time testing be performed on a periodic basis for plants with construction permits issued after January 1, 1971.

The staff's review of response~time testing at Dresden Unit 2 has shown that mechanical systems that provide-the major time delays, such as control rod 10/12/82 4-43 DRESDEN 2 SEP SEC 4

drive systems, diesel generators, and the major emergency core cooling system valves and pumps and containment isolation valves, are response-time tested.

In addition, plant procedures are used to response-time test the reactor protection system logic relays.

Only the sensors are not tested.

The staff performed a limited PRA of the issue for the Dresden Unit 2 plant to estimate the improvement in overall safety if additional response-time testing was required.

The results of this PRA indicated that additional response-time testing has low safety significance.

This occurs because this testing is concerned with events on the order of seconds.

The !REP studies (Millstone Unit 1, Browns Ferry (NUREG/CR-2802),.Arkansas Nuclear One, Calvert Cliffs, and Crystal River Unit 3) have shown that response times of 20 to 40 minutes are sufficient for emergency core cooling system actuation for both BWR and pressurized water reactors.

Functional tests are sufficient to demonstrate function on the order of minutes, and these tests are performed at Dresden Unit 2.

Therefore, it is the staff's judgment that response-time testing of instrumentation, other than that already required by the Dresden Unit 2 Technical Specifications, should not be required.

4.23 Topic VI-10.B,. Shared Engineered Safety Features, Onsite Emergency Power, and Service Systems for Multiple-Unit Facilities 10 CFR 50 (GDC 5) requires that structures, systems, and components important to safety shall not be shared among nuclear power units unless it can be shown that such sharing will not significantly impair their ability to perform their safety functions.

4.23.1 Sharing of DC Systems The 125-V and 250-V de systems are shared, which. is not in compliance with current licensing requirements.

However, the staff's review of the present de designs shows that they satisfy the single-failure criterion if the disconnect links are open and are not paralleled. These_ devices are to be reevaluated as

. part of the resolution of Topic VI-7.C.l.

10/12/82 4-44 DRESDEN 2 SEP SEC 4

There are no physical or electrical interlocks or LCOs preventing parallel operation of the shared 125-V and. 250-V de battery systems.

Such operation, combined with a single failure, would result in a loss of capability to supply accident or safe shutdown loads following a loss of offsite power.

The staff's audit of operating procedures (e.g., DOP 6900-4) indicates that there are no procedures requiring paralleling of the 250-V de systems during reactor operation.

However, there are no requirements to prevent the paralleling of the 250-V batteries.

Plant procedure DOP 6900-6 requires that the 125-V batteries be paralleled as part of the ground-fault detection procedures.

The limited PRA for this issue has determined that the probability of operating the de batteries in parallel, leading to failure, is very small.

Therefore, the PRA classified this issue's importance to risk as.low.

However, the PRA also identified one aspect of this event that is beyond the scope of the analysis.

The possible effects of the fault created in the use-of parallelling procedures include:, *tripping the plant", degradati.on of the high-pressure coolant injection system, and failure of the isolation condenser system.

Different circuit breakers/fuses would have to fail to effect these events.

If the worst case is assumed and all three events were to occur, the use of this procedure could lead to a significant accident sequence.

Sufficient information is not available to determine the likelihood of this worst case or of the different per~utations of faults that may be caused by the use of this procedure to determine their contribution to plant risk.

NUREG-0666 and Regulatory Guide 1~81 establish the basis for the staff's posi-tion that de systems in multiunit nuclear power plants should not be shared.

In the ~ase of parallel operation, a single failure could result in a loss of engineered safety features in both plants and, simultaneously, initiate plant transients. Given that a ground fault exists, the wisdom of paralleling 125-V de batteries (and doubling the available fault ~urrent) is questionable.

The added possibility of a major upset occuring simultaneously is neither J0/12/82 4-45 DRESDEN 2*sEP SEC 4

r

- ~~. -

acceptable nor necessary given the availability of other ground-fault detection systems using different techniques.

Therefore, it is the staff's position that the licensee provide assurance that paralleling of the shared 125-V and 250-V de systems be prohibited during power operation.

4.23.2 Diesel Generator Bypass The staff has found that there are no LCOs that require or interlocks that prevent the normal/bypass switches for the DG 2/3 from being in 11bypass 11 during operation of either unit.

Such operation, combined with a single failure, could render the required accident and safe shutdown loads inoperable following a loss of offsite power.

In a letter from T. J. Rausch to P. O'Connor dated August 20, 1982, the licensee stated that the operating procedures had been changed so that they req_l..lire a 11 normal-normal 11 alignment of these switches.

The staff has reviewed these procedures and found them acceptable.

4.23.3 Battery Status Indication Complete information of the status of the shared de batteries, chargers, and buses is not available to operators of each unit.

Battery status indication will be addressed under SEP Topic VIII-3.B.

4.23.4 Battery Room Ventilation The battery room ventilation system is not powered from an onsite source.

The staff is concerned because the time of highest hydrogen concentration occurs while the diesel generator is being used to recharge the batteries.

The licensee's response was that manual methods could be used to load the vent fan onto DG 2.

A review of procedure DGA-12 does not include loading of any fans, although Bus 27 is reenergized.

This item is being evaluated as part of SEP Topic IX-5, 11Ventilation Systems, 11 and is addressed in Section 4.29.

10/12/82 4-46 DRESDEN 2 SEP SEC 4

4.24 Topic VII-1.A, Isolation of Reactor Protection System From Nonsafety Systems, Including Qualifications of Isolation Devices 10 CFR 50.SSa(h) through IEEE Std. 279-1971 requires that safety signals be isolated from nonsafety signals and that no credible failure at the output of an isolation device shall prevent the associated protection system channel from meeting the minimum performance requirements specified in the design bases.

4.24.1 Reactor Protection System (RPS) Control Systems The analog signals from the nuclear flux monitoring system intermediate range monitors (IRMs), local power range monitors (LPRMs), and average power range monitors (APRMs) are not isolated from the control room process recorders and indicating meters as required by IEEE Std. 279.

A limited PRA was performed for this issue.

The PRA determined that a fault in the nonsafety part of the nuclear flux monitoring channel or APRM could fail the high ne!Jtron flux signal or APRM.

However, the probability of reactor protection system (RPS) failure is totally dominaied ~Y common-~ode mechanical faults associated with the control rod drive system, and eliminating the isolation problem would not effect RPS unavailability.

Thus, the PRA classified the issue of low importance to risk.

However, the staff disagrees with the PRA.

The neutron flux monitoring system, consisting of the IRMs, LPRMs, and APRMS, is designed to provide the operator with information required for safe operation of the reactor core and provide inputs to the RPS and rod block circuitry to ensure that power density and level do not exceed preset limits.

Because of the safety significance of the neutron flux monitoring systems, it is the staff's position that the licensee provide assurance that common-mode electrical faults occurring in the control room process recorders and indicators will not disable the neutron flux monitoring systems.

10/12/82 4-47 DRESDEN 2 SEP SEC 4

1

' I:

4.24.2 Process Computer The APRM scram function is derived from relay actuation resulting from amplified analog signals sensed by these relays.

The amplified analog signals are input directly to the process computer with fuses as the isolation device.

Fuses do not meet the intent of IEEE Std. 279 for isolation devices (e.g. fuses will not isolate ground faults). It is the staff's position that the licensee should address the adequacy of the isolation circuitry to ensure that the RPS is protected from potential common-mode electrical faults that could be propagated from the process computer.

4.24.3 RPS Channel Power Supplies Power to the RPS buses is supplied from two motor-generator sets.

The isolation of each RPS channel and its motor-generator set does not conform with current licensing criteria as defined in IEEE Std. 208-1974, Part 5.2.

The licensee has committed by letter dated.December 11,.1980 to install Class*

lE ~rotection at the interface between the RPS powei s~p~l~ and the RPS.. The licensee has stated that the system will be in accordance with the conceptual design proposed by the General Electric Company and found acceptable by the staff.

This modification will be completed during the next scheduled refueling outage.

The staff agrees with the licensee's proposed design and schedule.

4.25 Topic VII-3, Systems Regui~ed for Safe Shutdown 4.25.1 Procedures for Shutdown From Outside Control Room 10 CFR 50 (GDC 19), as implemented by SRP Section 7.4, requires the capability to promptly achieve and maintain a hot shutdown condition from outside the con-trol room with the potential of capability of achieving subsequent cold shutdown through the use of suitable procedures.

During the topic review it 10/12/82 4-48 DRESDEN 2 SEP SEC 4

~ -~------ -::.... ~*-.-::

was determined that Dresden Unit 2 did not have procedures for accomplishing this objective.

The licensee has provided the staff with Procedure EPIP 200-20, Revision 1, April 1982, which details the method for achieving and maintaining a hot shutdown condition assuming evacuation of the control room.

Instructions are provided for local operation of the isolation condenser, diesel generator start and loading, and operation of the control rod drive and the condensate transfer pumps.

This procedure satisfies the staff's position regarding achieving and maintaining a hot shutdown condition from outside the control room.

However, the licensee does not have procedures for subsequently achieving a cold shutdown condition.

The licensee's submittal. dated July 1, 1982 regarding the Appendix R fire protection review provides a commitment to modify the safe shutdown procedures so that they include the capability to achieve cold shutdown from outside the control room.

Since the fire protection reviews are being conducted independently of SEP,*no further*SEP attio~ is required on this subject.*

Backfitting, therefore, is not required.

4.25.2 Use of Safety-Grade Systems 10 CFR 50 (GDC 19 ~nd 34), as implemented by SRP Section 5.4.7, BTP RSB 5-1, and Regulatory Guide 1.139, requires that the plant can be taken from normal operating conditions to cold shutdown by using safety-grade systems and either onsite or offsite power, assuming a single failure.

The initial topic review showed that Dresden Unit 2 did not have procedures for achieving cold shutdown from normal operating conditions using only safety-grade systems and either onsite or offsite power, assuming a single fa i 1 ure~.

The licensee has provided the staff with copies of revised procedures (DGP 2-3, Revision 7, May 1981~ and DGA 12, Revision 2, June 1981).

These procedures provide information regarding various automatic and manual actions to be taken 10/12/82 4-49 DRESDEN 2 SEP SEC 4

to ensure that the plant can achieve a cold shutdown using the essential safety systems as identified in the staff's topic review.

The staff has reviewed the procedures and has concluded that the operating procedure adequately address use of the systems identified as essential to achieve and maintain a cold shutdown condition.

4.25.3 Residual Heat Removal Single-Failure Criteria 10 CFR 50 (GDC 34) requires that a system to remove residual heat be provided with suitable redundancy to ensure that for onsite electric power system operation's the system's safety function can be accomplished, assuming a single failure.

At Dresden Unit 2, long-term cooling is susceptible to single failures if the shared diesel generator is not available to Unit 2.

This problem was addressed in the staff's evaluation of SEP Topic VI-10.B.

The staff concluded that Unit 2 shutdown will commence with use of the isolat1on condenser and the HPCI system until the shared diesel generator can be manually transferred to Unit 2 to support long-term. cooling.. The staff's audit ?f operating procedures and drawings has confirmed the adequacy of this method of operation.

Backfitting, therefore, is not required.

4.25.4 Inservice Testability 10 CFR 50 (GDC 21), as implemented by IEEE Std. 279-1971, requires that protection systems be designed for inservice testability commensurate with the safety function to be performed.

At Dresden Unit 2, the shutdown cooling system is designed for full reactor pressure but less than full reactor temperature.

Therefore, system interlocks are based on temperature requirements.

Current licensing criteria for the interlocks are not met because there are no testing requirements.

The limited PRA for this issue has determined that testing of the temperature interlocks would increase the availability of the shutdown cooling system by about 15%.

This evaluation is based on the assumption that the temperature 10/12/82 4-50 DRESDEN 2 SEP SEC 4

interlocks are not tested and that exceeding the design temperature would fail shutdown cooling.

Therefore, the PRA classified this issue as having medium importance to risk.

It is the staff's position that the licensee provide for inservice testability of the shutdown cooling system temperature interlocks or provide assurance that the shutdown cooling system is designed for full reactor temperature.

The licensee has committed to provide for testing of the temperature interlocks.

A schedule for completion will be provided in November 1982.

4.26 Topic VIII-2, Onsite Emergency Power Systems (Diesel Generator) 10 CFR 50 (GDC 17), as implemented by SRP Sections 8.1 and 8.3.1 and Regulatory Guide 1.9, requires that onsite electric power systems shall be provided to permit functioning of components important to safety.

Regulatory Guide 1.9 specifies that the standby diesel generator systems be designed so that spurious actuation of* protective trips does not prevent diesel generators from performi0g that function.

4.26.1 Annunciators In conjunction with a generic review of diesel generator annunciators, the staff determined that Dresden Unit 2 does not comply with current criteria as specified in IEEE Std. 279-1971.

By letter dated February 2, 1979, the licensee agreed to make suitable modifications to the annunciators.

These modifications were completed in 1979.

No further action is required.

4.26.2 Protective Trips The staff has determined that three diesel generator protective trips are not bypassed during accident conditions.

Two of the protective trips, engine overspeed and high differential current, are acceptable for use during e~ergency operation so that the generator is not damaged.

The other trip, underfrequency, does not meet current licensing requirements and should be bypassed during emergency operations.

10/12/82 4-51 DRESDEN 2 SEP SEC 4

. - -. -- :..,;.. ~...

.. '*". - *--*-*****-:..:._:... ~.* -*-**

A limited PRA of the importance of bypassing diesel generator trips indicates

,that the importance of this issue to risk is low.

However, the reliability of ac power is a dominant sequence for risk at Dresden Unit 2 (based on the results of Millstone Unit 1 and Browns Ferry IREP studies).

Because the importance of diesel generator availability is high, even though the improvement by bypassing these trips is small, the staff concludes that these trips should be bypassed.

By letter dated September 10, 1982, the licensee indicated that modifications will be implemented to bypass the underfrequency protective trip during emergency operations for all diesel generators.

A schedule for completion of the modifications will be provided in November 1982.

4.27 Topic VIII-3.A Station Battery Capacity Test Requirements 10 CFR 50 (GDC 18), as implemented by Regulatory Guide 1.129, requires periodic testing to determine battery capacity and demonstrate that the batteries will provide sufficient power under accident conditions.

The Dresden Unit 2 program for testing the batteries does not satisfy these requirements.

The limtted PRA performed for this issue has determined that a lois Of de ~o~er does have an impact on the dominant sequences leading to a core-melt accident.

Using the as~umption that all past battery testing was ineffective, the PRA study concluded that implementation of adequate battery testing would improve battery reliability by approximately a factor of 15.

Therefore, the PRA has classified this issue of high importance to risk.

The staff proposes that the testing of the batteries be in accordance with IEEE Std. 450-1975, IEEE Std. 308-1974, BTP EICSB 6, and the 11 Standard Technical Specifications for General Electric Boiling Water Reactors 11 (NUREG-0123).

It is the licensee's position that current testing exceeds the staff's proposed testing requirements because an 8-hour discharge test is performed each refueling outage.

This test is conservative if the test discharge rate exceeds the design discharge rate.

It is the staff 1 s position that the licensee demonstrate that the existing battery test program meets or exceeds the recommendations of Regulatory Guide 1.129 or modify the program to meet the recommendations.

10/12/82 4-52 DRESDEN 2 SEP SEC 4

- - ~ ** : < -

...... -* *... *.:. - -*,........ ~- ;_ *****--***----

4.28 Topic VIII-3.B, DC Power System Bus Voltage Monitoring and Annunciation 10 CFR 50.55a(h), through IEEE Std. 279-1971, and 10 CFR 50 (GDC 2, 4, 5, 17, 18, and 19), as implemented by SRP Section 8.3.2, Regulatory Guides 1.6, 1.32, 1.47, 1.75, 1.118, and 1.129, and BTP ICSB 21, require that the control room operator be given timely indication of the status of the batteries and their availability under accident conditions.

The Dresden Unit 2 control room does not have indication of battery voltage, battery current, battery breaker/fuse open alarm, battery charger output current, or battery charger output breaker/fuse open alarm.

Therefore, the de power system monitoring is not in compliance with current licensing criteria.

A limited PRA was performed to determine the importance to risk of de instrumentation, indication, and alarms.

It was determined that the proposed additional monitoring devices would reduce the de bus unavailability by about a factor of 5.

This reduction is due almost equally to a reduction in breaker unavailability-and battery una_vailability.

DC power appears in som_e dominant accident sequences, and resolution of this issue would have a significant impact on the value of the top event in the fault tree.

This issue is, therefore, of high risk importance, as discussed in Appendix D.

It is the staff's position. that the licensee modify the existing de power system monitoring for breaker or fuse position and battery availability.

4_29 Topic IX-5, Ventilation Systems 10 CFR 50 (GDC 4, 60, and 61), as implemented by SRP Sections 9.4.1, 9.4.2, 9.4.3, 9.4.4, and 9.4.5, requires that the ventilation syst~ms shall have the capability to provide a safe environment" for plant personnel and for engineered safety features.

4.29.1 Battery Room Ventilation The battery room contains the batteries that provide emergency de power essential for postaccident shutdown of the reactor.

Specifically designed 10/12/82 4-53 DRESDEN 2 SEP SEC 4.

ventilation is considered essential to ensure removal of hydrogen generated as a result of battery charging after loss of offsite power.

Following a loss-of-offsite-power event, operator action is required to reinitiate the battery room ventilation system.

During that inoperative period, hydrogen is

generated because of continued battery charging.

It is the staff's position that the licensee should define the maximum period the ventilation system could be inoperative and demonstrate that of hydrogen generated during that period will not exceed the minimum combustion limits or provide for adequate ventilation to. preclude the potential for buildup of combustible hydrogen.

4.29.2 Low-Pressure Coolant Injection (LPCI)/Core Spray and Diesel Generator Rooms The ventilation systems for the LPCI/core spray and diesel generator rooms are subject to disabling single failures.

(1)

LPCI/Core Spray Room The LPCI and emergency core spray pumps are located in corner rooms on the basement level of the reactor building that are serviced by the reactor building ventilation system.

The reactor building ventilation system can be manually supplied with emergency diesel power.

In addition, each LPCI pump room contains its own room cooler.

These individual units cool by means of the diesel generator cooling water system, and their fan motors are supplied by electrical motor control centers that are designated as 11diesel-powered essential service.

11 Despite provision of essential electrical service, the fans of the LPCI cubical coolers do not have the redundancy to ensure cooling in the event of a failure within the unit.

However, because action can be taken to manually restore reactor building ventilation and because room cooling is provided, backfitting is not recommended.

(2)

Diesel Generator Rooms DGs 2 and 2/3 are housed in separate rooms served by separate ventilation syst~ms. Cooling is provided by the diesel service water systems, and the 10/12/82 4-54

.DRESDEN 2 SEP SEC 4

. --*:.. c.:..:. :.: ___

--~' _-

'-~- *... ~.,.. -

- -- ~ ;_ '.*..... -,_. --~~.

ventilation systems both vent the rooms and cool associated switchgear equipment.

Both DG rooms are ventilated by a single 30-hp fan that is automatically loaded to essential service motor control center (MCC) 29-2 (essential service, DG 2).

Outside air and/or turbine building air is supplied to the fan through a set of temperature-controlled dampers.

Should the single ventilation fan fail, the large double doors between the turbine building and DG 2 could be opened to promote natural convection.

Access to the DG 2/3 building is through two single inseries doors, both of which would have to be opened to provide natural convection.

The limited PRA evaluation performed for this issue was based on the IREP study of Millstone Unit 1.

During that review, no potential system failures resulting from support system ventilation failures were identified.

On the basis of a review of the Dresden Unit 2 plant configuration, it was determined that the Millstone Unit 1 results are applicable to Dresden Unit 2.

Therefore, the PRA has classified this issue 1 s importance to risk as low.

However, because of the necessity of maintaining DG availability for mitigating accident conditions and the susceptibility of the DG ventilation systems to other types of failures (e.g., tornado missiles), the staff has determined that ad~quate ventilation of the DGs is necessary.

Therefore, it is the staff 1 s position that the licensee evaluate the consequences of losing the DG room ventilation system.

If it is determined that ventilation is required for system performance, corrective actions and a proposed schedule should be established.

4.30 Topic XV-1, Decrease in Feedwater Temperature, Increase in Feedwater Flow, Increase in Steam Flow, and Inadvertent Opening of a Steam Generator Relief or Safety Valve 10 CFR 50.34 requires that each applicant for a construction permit or operating license provide an analysis and evaluation of the design and performance of structures, systems, and components of the facility with the objective of assessing the risk to public health and safety resulting from operation of the facility, including determination of the margins of safety during normal operations and transient conditions anticipated during the life of the facility.

10/12/82 4-55 DRESDEN 2 SEP SEC 4

(I A,

. ::.... ~ :...

10 CFR 50 (GDC 10 and 15), as implemented by SRP _Sections 15.1.1 through 15.1.4, requires that plants be adequately designed to mitigate the consequences of feedwater system malfunctions that result in an increase in feedwater flow.

The staff review of a feedwater controller failure has determined that the acceptance criteria are met only if the turbine bypass system is operable.

Currently, the licensee does not have Technical Specifications that require surveillance of the turbine bypass system or that limit the reactor power or minimum critical power ratio (MCPR) when the turbine bypass system is found to be inoperable.

Because the feedwater controller failure with failure of the turbine bypass may be a limiting transient, exceeding the fuel design limits could result.

It is also possible that another transient limits MPCR or reactor power and no change is required.

The staff concludes that analysis of feedwater controller failure without bypass should not be required for the current fuel cycle for the following reasons:

(1) The licensee cufrently plans to _shut down in.eariy 1983 fo~ ~efueling.

The licensee will perform a reload analysis for the new core configuration before startup.

This analysis will include an evaluation of anticipated transients.

If credit is taken in the reload analysis for operability of turbine bypass, the staff will require appropriate surveillance of the turbine bypass valves and limits for reactor power or MCPR if the turbine bypass is found inoperable.

Technical Specifications will be developed and reviewed as part of the core reload evaluation to reflect the fuel vendor and cycle-specific characteristics of the core.

(2)

PRA studies of BWRs indicate that feedwater controller transients without bypass are of low importance to risk.

Backfitting, therefore, is not recommended.

10/12/82 4-56 DRESDEN 2 SEP SEC 4

r-,

~*

(

.J.

4.31 Topic XV-16, Radiological Consequences of Failure of Small Lines Carrying Primary Coolant Outside Containment 10 CFR 100, as implemented by SRP Section 15.6.2, requires that the radiological consequences of failure of small lines carrying primary coolant outside contain-ment be limited to small fractions of the exposure guidelines of 10 CFR 100.

The staff has determined that Dresden Unit 2 does not comply with current*

acceptance criteria.

Based on the existing Technical Specification limits for primary coolant activity, the potential offsite doses would substantially exceed the applicable dose limits.

It is the staff's position that reactor coolant activity limits should be maintained within the limits imposed on new operating reactors, that is, within the limits of the Standard Technical Specifications (STS) for General Electric Boiling Water Reactors (NUREG-0123).

This is necessary to limit plant operation with potentially significant amounts of failed fuel so that the radiological consequences of events that do not further damage fuel but do involve a release of reactor coolant to the environment will be low.

Reducing reactor _coolant activity to the STS level wo~ld not result in calculated.doses within the limtts* s~e~ified in current licensing criteria; however, the doses are within the guidelines of 10 CFR 100.

Therefore, since the offsite dose consequences are within the guidelines of 10 CFR 100 and the probability of failing the line before the isolation valve and excess flow check valve is low, it is the staff's position that backfitting the BWR STS limits for reactor coolant activity is sufficient to ensure that the radiological consequences to the environment from a failure of small lines are acceptably low.

The limited PRA for Dresden Unit 2 has classified this issue's importance to risk as low.

This is du~ to the overwhelming portion of risk from core-melt accidents.

However, because of the significant radiological impact resulting from this accident in the absence of core melt,* it is the staff's position that primary coolant activity be maintained within acceptable limits.

10/12/82 4-57 DRESDEN 2 SEP SEC 4

r_

~ -.:

The licensee has proposed to develop site-specific primary coolant activity limits and surveillance requirements that will ensure that the radiological consequences of a small line failure will be within the guidelines of 10 CFR 100.

4.32 Topic XV-18, Radiological Consequences of a Main Steam Line Failure Outside Containment 10 CFR 100, as implemented by SRP Section 15.6.4, requires that the radiologi-cal consequences of failure of a main steam line outside containment be limited to small fractions of the exposure guidelines of 10 CFR 100.

On the basis of an independent assessment of the radiological consequences of a main steam line failure outside containment, the staff has determined that Dresden Unit 2 does not meet the current acceptance criteria. If the existing Technical Specifica-tion limits for primary coolant activity are used, the potential offsite doses would exceed the applicable dose limits.

It is the staff 1s position that the licensee should maintain the primary coolant activity within the General Electric STS limits, which would meet the acceptance criteria.

Since the staff 1 s analysis shows that the small-line failure is more limiting than the m~in steam *1in~ failure, r~solution of Topic XV~l6 will also re~olve the concerns of Topic XV-18.

10/12/82 4-58 DRESDEN 2 SEP SEC 4

ML17252A567

Contents

Text

Dear Mr. DelGeorge:

SUBJECT:

SUMMARY

Enclosure:

SUMMARY

SUMMARY

Navigation menu

ML17252A567

Text

Dear Mr. DelGeorge:

SUBJECT:

SUMMARY

Enclosure:

SUMMARY

SUMMARY

Navigation menu

Search