ML18018A359

Forwards 21 Responses to Reactor Sys Branch (440 Series) Questions Discussed at Reactor Sys Branch Safety Review Meeting Held on 820921.Remaining 17 Items Will Be Addressed in Near Future

ML18018A359
Person / Time
Site:	Harris
Issue date:	09/30/1982
From:	Mcduffie M CAROLINA POWER & LIGHT CO.
To:	Harold Denton Office of Nuclear Reactor Regulation
References
NUDOCS 8210050106
Download: ML18018A359 (41)

Text

REGULATOR NFORMAT ION DISTRIBUTION w TEM (BIDS)

ACCESSION NBR:8210050106 DOC ~ DATE: 82/09/30 NOTARIZEOi NO DOCKET FACIL:50-400 Shearon Harr is- Nuclear Power Plantg Unit 1~ Carolina 05000400 50-401 Shearon Harris Nuclear Power Planti Unit 2~ Carolina 05000401 AUTH'AME AUTHOR A F F Il I AT I ON MACOUFFIEiM,A~ Carolina Power L Light Co.

REtC IP NAME

~ RECIPIENT AFFILIATION OENTONgH RE Office of Nuclear Reactor Regulationi Director

SUBJECT:

Forwards 21 responses to Reactor Sys Branch (440 Series) questions discussed at Reactor Sys Branch safety review meeting held on 820921 ~ Remaining 17 items will be addressed soon in near future.

DISTRIBUTION CODE: B001S COPIES 'ECEIVED:LTR ENCL SIZE e.

TITLE: Licensing Submittal: PSAR/FSAR Amdts 8, R lated Correspondence NO,TE S!

RECIPIENT COPIES RECIPIENT COPIES ID LTTR ENCL IO CODE/NAME LTTR ENCl CODE/NAME'RR/DL/ADL 1 0 NRR LB3 BC 0 NRR LB3 LA 1 0 LICITRAgM~ 01 1 1 INTERNAL: ElD/HDS 1 1 0 IE FILE 1 1

-IE/DEP EPDS 35 1 1 IE/DEP/EplB 36 3 3 NRR/DE/AEAB 1 0 NRR/DE/CEB 11 1 1 NRR/DE/EQB 3 3 NRR/DE/GB 28 2 2 NRR/OE/HGFB 30 2 2 NRR/DE/MEB 18 1 1 NRR/OE/MTEB 17 1 1 NRR/DE/QAB 21 1 1 NRR/DE/SAB 24 1 1 NRR/DE/SEB 25 1 NRR/OHFS/HFEB40 1 NRR/DHFS/LQB 32 1 1 NRR/DHFS/OLB 34 1 1 NRR/DHFS/PTRB20 1 1 NRR/DS I/AEB 26 1 1 NRR/DS I/ASB 27 1 1 NRR/OSI/C"B 10 1 1 NRR/DSI/CSB 09 1 1 NRR/OS I/ETS8 12 1 1 NRR/DSI/ICSB 16 1 1 NRR/DSI/PSB 19 1 NRR/DS I/RAB 22 1 1 NR . SB 23 1 NRR/DST/LGB 33 1 1 G FI E 04 1 1 RGN2 2 2

<IB 1 0 EXTERNAL; ACRS 41 6 6 BNL(AMDTS ONLY) 1 1 DMB/DSS (AMDTS) 1 1 FEMA REP OIV 39 1 1 LPDR 03 1 1 NRC POR 02 1 1 NSIC 05 1 1 NTIS 1 1 TOTAL NUMBER OF COPIES REQUIRED: LTTR 55 ENCL 49

~ I w

~ ll tt ty II t<< I yll h h f' y h flfht tll >>w frl , yh 4'4l lg e'h Lh' W o ~ W

',W('4"

'4 M'f "hg MP h, MMf MI>, f.ylhr)- MM,0 )r, 47W ~ o

'JF'I 1> M ) klr ~, ii fth hf Ij h >t

'MPQ>4 4 htf l'h 5I f', h

>4 1 >fg 'll 'Mh <M>ry 4 l 1

~ l>>

f'

.,f )" f 'I,ll k 41 Illy W>> W

~ Ilpf / ) i ) ill I4, ll >4 y f lll "I 1,1I y,

\y$ Q.h J Q Ilfh w 4 I I, 44 >I il,, ll hk ',,rf 4 ~ ltw, g g, wk 4,

'4 tl r, 11 ll 11

" M 1

W g 4 I I i-,l II

Ilt.,'t I 'lj '

71 14 MI

',Rkh 4 r. I I fI hk I , yI t '-M It ( Mal

) kkr ','f !hk i 'r( '

,I'i,)+Mt ll'I I,kk

)'kk tl

.,'I 4' hk W i li hk M 1

44. MI N

"')'h I I Itt h'kkhl WI <<

(, "h M lJ

>1 hk 4>

f I (Il'l >>tl <<',w, "h) 44

>I 4l ) f>t~fk W ty tt kt

'I

<,'f tt I I y >I Ph I y ' IMMY Mt

~1 ~

I C!PQE, Carolina Power & Light Company September 30, 1982 Mr. Harold R. Denton, Director Office of Nuclear Reactor Regulation United States Nuclear Regulatory Commission

, Washington, D.C. 20555 SHEARON HARRIS NUCLEAR POWER PLANT UNIT NOS. 1 AND 2 DOCKET NOS. 50-400 AND 50-401 SAFETY REVIEW QUESTION RESPONSES-REACZOR SYSTEMS BRANCH

Dear Mr. Denton:

Carolina Power & Light Company (CP&L) hereby transmits one (1) original and forty (40) copies of our responses to the Reactor Systems Branch (440 Series) Questions. These Questions were generated by:

NRC letter dated April 26, 1982, CP&L responses dated August 2, 1982, CP&L responses dated August 31, 1982, NRC letter dated August 18, 1982, EG&G telecopy dated September 8, 1982, and EG&G telecopy dated September 10, 1982.

These questions were discussed at the Reactor Systems Branch Safety Review Meeting held at the Shearon Harris Nuclear Power Plant (SHNPP) on September 21, 1982. Twenty-one (21) responses are being submitted at this time. The remaining seventeen (17) items will be addressed in the near future.

I fl Yours very truly, M. A. McDuffie Senior Vice President Engineering & Construction PS/cr (901C5T3)

Attachment pool cc: Mr. E. A. Licitra (NRC)

Mr. G. F. Maxwell (NRC-SHNPP)

Mr. J. P. O'Reilly (NRC-RII) 821005010b 820930 PDR ADOCK 05000400 A PDR 411 Fayetteville Street ~ P. O. Box 1551 o Raleigh, N. C. 27602

II J

I V

FSAR Question 440.110 (Section 15.4.4)

Figure 15.4.4-5 shows minimum DNBR occurring at approximately 18 seconds and Table 15.4.1-4 states minimum DNBR occurs at 12.5 seconds. Address this apparent discrepancy.

Response to FSAR Question 440.110 Neither the figure nor the table are correct. Attached are revised figures and the revised table. Section 15.4.4.2 states that "following initiation of-startup of the idle pump, the inactive loop flow reverses and accelerates to its nominal full flow value<<in approximately 20 seconds ." This value is incorrect. It should read 25 seconds.

The FSAR will be updated to reflect these changes .

440.110-1

~I

~I

~ l TABLE 440.110-1 TIME SEQUENCE OF EVENTS FOR STARTUP OF AN INACTIVE REACTOR COOLANT LOOP AT AN INCORRECT TEMPERATURE INCIDENT Time Event (Seconds)

Initiation of pump startup 0.0 Power reaches P-8 trip 7.6 setpoint Rods begin t6 drop 8.1 Minimum DNBR occurs 9.0 440.110-2

pt 0

~

~ '.0000

':. 80000

.S0000

.II0000

. 20000 Cl Cl CI

,a Vl

..- a.,a C)

C5' Q D o

.-C5 TtHE t SEC~

~ ~

8at&tRON HARRIS FIQURF NUCLEAR:POWFR PLANT IMPROPER STARTUP OF AN INACTIVF.

Cgrallng 'REACTOR COOLANT PUMP

'owot fc;4ght Company wo.<<o-l FINALSAFETY ANALYSIS RF7ORT

~ ~

i.aaoo

i. OOOO

.aOOOO CD LJ

.60000

hOQOO

+~ 5 l .aoOOO O.O C7 CD 8 aCl -8 CD CD CD O,

CD CD CD CD C5 CD C5 %SO P~

%I O

AJ AJ CD TIME 'SKCl

~~

~ ~

SHE'ARON HARRIS FIGURE NUCLEAR POWER PLANT IMPROPER.STARTUP Qf AN INACTIVE --

Carolina REACTOR COOLANT PUMP

~ Pawe'5 Light Company i:IIIIAuSaFEW ANAu SIS REPORT mo. tl0-~

re ~

"I I ~ ~

' ~

2. CCM l.@00 4.%COO t.zone g . 1.0000 9 ". l0000 I .50000

,85000 0.0 a CD CD C) CD a Ci a CD

~

CD o a C)

C) Q7 C2 lfl CS Cl AJ Clg a

"TlHK (st)

SHARON HARRIS FIGURE NUCLEAR POWER PLANT IMPROPER STARTUP OF AN INACTIVE Caroline Power%.Light Coolpsny REACTOR COOLANT PUMP ~ '5~~

egg, No- 3 FINALSAFETY ANALYSIS REPORT

~ ~

~

~ ~

~ '. 2%00. 0 46/'88i89i85 14: 35

~ r 2300,0 2200.0 in 2100. 0 2000. 0 1900; 0 1S00.0 CD C7 CD CD CD O ~ CD CD C) CD CD CD CD CD CD CD CD CD lA CD CD

~ <4 04

~

' TtMK t SEC)

.pgr

~ ~ ~ ~

~ ~ rr ~ ~

~ ~

~ ~ r~ ~

~ ~~ ~ ~ ~ ~

r' ~ ~

~ ~ r>> r ~

I

~ ~ 1

'W r ~

~ i r e r r

~ ~l ~

~ ~ -~

~ ~ r ~ ~

Sr e rv r ~ rr ~

~ ~ gr ~ r ~ ~ rr rr ~ ~r~ r ~

~ ~-

r ~ ~

"7" rg ~ ~ ~ ~ ~ ~

~ rr ~ rr J

r

~ r ~ ~ le ~ \~ r ~ r ~

~ rt ~

~ r ~ ~ rr

~~C (,eeet SHEARON HARRIS FIGURE NUCLEAR POWER PLANT IMPROPER STARTVP QF AN INACTIVE Ca/ollna REACTOR COOLANT PUMP Power h Light Company FINALSAFETY ANALYSIS REPORT

~ 'I e

, ~

~ ~

2 r

ca cc 2

C.

Ocn y2 r~ ~o

~~a 02 r gas tcc y gl 3)

EA en/ r-

~ C/l m ~

I g.6 D

O Q

m fA

~

n~

Q n~

Ow rO 22.

2 4 q.IN'; C,c<c-)

g

~

~

$a

~

g 0

FSAR Question 440.112 (Section 15.6.5)

Provide the analysis for a small break LOCA that verifies the 3-inch break is the worst case. The supplied data in Section 15.6.5 is insufficient in that it appears that as the break size decreases the peak clad temperature increases.

Response to FSAR Question 440. 112 A complete spectrum of Small Break Loss of Coolant Accidents were examined in WCAP-9600, "Report on Small Break Accidents for Westinghouse NSSS." The studies in that report indicated the maximum PCT occurred for the 3" break, thus the PCT does increase as bgeak size decreases for the FSAR cases, but then decreases as break sizes decrease below 3".

440.112-1

FSAR Question 440.113 (Section 15.6.5)

Section 15.6.5.3.3 discusses small break LOCAs and references a Westinghouse sensitivity study that applies only to large break LOCAs (WCAP-8573). Provide the correct sensitivity study for your small break LOCAs.

Response to FSAR Question 440.113 The correct reference for Small Break Sensitivities with the Westinghouse Evaluation Model is WCAP-9600, "Report on Small Break Accidents for Westinghouse NSSS."

440.113-1

FSAR estion 440.115 (Section (5.4.7)

The response to question 440.23 did not discuss the procedures available to the operator for responding to the lifting of an RHR relief valve or what alerts the operator to the opening of RHR relief valves as requested.

FSAR Question 440.23 (Section 5.4.7)

Section 5.4.7.2.4 of FSAR states that "Each inlet line to the RHRS is equipped with a pressure relief valve sized to relieve the combined flow of all charging pumps at the relief valve set pressure. Each valve has a relief flow capacity of 900 gpm at a set pressure of 450 psig." This capacity appears to be less than the capacity indicated by the performance curve (Figure 6.3.2-9) for the charging pumps. What alerts the operator to the opening of RHRS relief valves2 What procedures are available to the operator for responding to this event2 Response to FSAR estion 440.115 Operator response to an open RHR relief valve would be to isolate the affected RHR train. Depending on system parameters, various indications would aid the operator. The leak could be inferred from changes to PRT level, pressure, and temperature.

These would be provided by pressure indication 472, level indication 470, and temperature indication 471.

A decrease in pressurizer level would also be observed with low level being alarmed. Decrease in RHR pressure and flow may be noted via pressure indications 601 A/B, 600 A/B, and flow indication 602 A/B.

Specific procedures will be developed to diagnose a lifted relief valve and isolate the affected train.

440.115-1

FSAR Question 440.116 (Section 5.4.7)

The response to question 440.24 did not address items 2 and 3. Specifically, address alarms and indications which will alert the operator to air bound conditions of the RHR pumps and further operator actions to correct the malfunction.

FSAR Question 440.24 (Section 5.4.7)

Recent plant experience has identified a potential problem regarding the loss of shutdown cooling during certain reactor coolant system maintenance evolutions. On a number of occasions when the reactor coolant system has been partially drained, improper reactor coolant system level control, a partial loss of reactor coolant inventory, or operating the RHR system at an inadequate HPSH has resulted in air binding of the RHR pumps with a subsequent loss of shutdown cooling. Regarding this potential problem, provide the following additional information:

1. Discuss the design or procedural provisions incorporated to maintain adequate reactor coolant system inventory, level contxol, and NPSH during partial drain evolutions.

2. Discuss the provisions incorporated to ensure the rapid restoration of the RHR system to service in the event that the RHR pumps become air bound.

3. Discuss the provisions incorporated to provide alternate methods of shutdown cooling in the event of loss of RHR cooling during shutdown maintenance evolutions. These provisions should consider maintenance evolutions during which more than one cooling system may be unavailable, such as loss of steam generators when the reactor coolant system has been partially drained for steam generator inspection or maintenance.

Response to FSAR Question 440.116 Flow and pressure indications downstream of the pump would provide indication that flow had decreased. On identifying this situation, the affected train would be isolated and heat removal accomplished by the redundant train.

Procedures will be developed to address the provision of alternate sources of cooling should this event occur.

440.116-1

FSAR Question 440.117 (Section 5.4.7)

The response to question 440.32 did not address the possibility that interlocks may cause more than one valve or component to fail simultaneously. In your design, are there any interlock failures that could cause more than one valve or component to fail?

FSAR Question 440.32 (Section 5.4.7)

Several interlocks are utilized in the ECC and RHR systems. Potential interlock failures should be addressed in the failure modes and effects analysis.

Response to FSAR Question 440.117 This item is under discussion with the ICSB. The possibility than an interlock might cause more than one component or valve to fail simultaneously could be a consequence of a failure of a single shared component that transmits an erroneous signal to more than one component.

There are two kinds of possibilities her'e:

1. A single interlock is shared by more than one valve or component in separate electrical trains. RHR suction isolation valves and the pressurizer PORUs for RCS pressure control during low temperature operation exhibit this condition. The evaluation for the case of the RHRS suction isolation valves has been evaluated in Section 5.4.7 which identifies appropriate operator actions.

2. A signal goes to several components on the same train. For example, the wide range pressure signal is transmitted to a PORU interlock on one train and the RHR isolation valves on the same train. A failure of such a shared interlock does not defeat the protective function because not affect the redundant train.

it does 440.117-1

FSAR Question 440.118 (Section 6.3)

In your response to question 440.34 you indicate failure of more than one steam dump valve has a low probability. If this could be caused by a single failure of a control grade system, it is considered a credible failure and should be addressed.

FSAR Question 440.34 (Section 6.3)

Section 6.3.3.1 of FSAR discusses the failure of a single steam dump. In your design, could a single failure in the steam dump control circuitry cause more than one steam dump to fail open or inadvertently come open?

Response to FSAR Question 440.118 As stated in our response to 440.34, the probability of failure of more than one steam dump valve is low. That statement .implicitly recognizes that there is a distinction between potential non-design basis systems interaction and a random single failure of a component. The statement in 440.34 reply refe'rs to the fact that an unanticipated systems interaction is not ruled out. As implied in the 440.34 reply, the review shows that if more than one steam dump valve were to open, it would not be the effect of a single random failure of a component.

440.118-1

FSAR Question 440.120 (Section 6.3)

Expand your response to question 440.41 to include consideration of the possibility that the ECC accumulator isolation valves may be closed with power removed and certain charging and/or SI pumps may have their circuit breakers open for low temperature overpressure considerations.

FSAR Question 440.41 (Section 6.3)

Certain automatic safety injection signals and certain safety systems components, such as accumulators, charging pumps and/or SI pumps, are blocked to preclude unwanted actuation of these systems during normal shutdown and startup operations. Describe the alarms available to alert the operator to a failure in the primary or secondary system during this phase of operation and the time frame available to mitigate the consequences of such an accident. If applicable, provide or reference sensitivity studies to demonstrate that these cases are bound by existing analyses.

Response to FSAR Question 440.120 To minimize the possibility of low temperature overpressure transients during startup and cooldown, low pressurizer pressure and low steam line pressure safety injection actuation logic is manually blocked at 1900 psi. At 1000 psi, power is locked out from the accumulator isolation valves and from the non-operating charging pumps. It should be noted that the high containment pressure safety injection actuation logic cannot be blocked.

If a steamline rupture occurs while both of these SI actuation signals are blocked, steamline isolation will occur on high negative steam pressure rate. An alarm for steamline isolation will alert the operator of the accident. The nuclear power'nd core flux increase is terminated at RCS pressure that approximates the beginning of accumulator discharge. This transient is, however, terminated by the boron resulting from BIT in)ection so no adverse impact would be expected to result from accumulator isolation.

For large LOCAs, sufficient mass and energy would be released to the containment to automatically actuate SI when the containment high pressure setpoint is reached. At this time, the operator would be alerted to the occurrence of a LOCA by the following safety-related indications:

1. loss of pressurizer level,

2. rapid decrease of RCS pressure, and

3. increase in containment pressure.

In addition to the above, the following indications are normally available to the operator at the control board:

1. radiation alarms inside containment, 440.120-1

2. increase in sump water level,

3. decrease off scale of accumulator water levels and decrease in pressure,

4. ECCS valve and pump position and status light in ECCS energized indication, and annunciators light as safeguards equipment becomes energized, and

5. flow from ECCS pumps.

LOCAs during startup and cooldown have been evaluated to determine the effects of the unavailability of the accumulators. The limiting case is, of course, cooldown due to the presence of decay heat. Although all safety injection pumps would be available during the event, it has been determined that with only one HHSX pump, 2 RHR pumps, and no accumulator discharge, peak clad temperature would reach only about 1100'F. Additionally, it has been determined that with only one HHSX pump, one RHR pump, and no accumulator discharge, the peak clad temperature reaches only about 1700'F. This is significantly below the Appendix K requirement and is bounded by the ECCS analysis presented in Chapter 15.

For very small LOCAs (approximately less than two-inch diameter) in which the containment high pressure setpoint may not be reached, the operator would observe the safety-related indications plus the first two normally available indications.

In addition, a charging flow/letdown mismatch would provide the operator with another indication of leakage from the RCS. Since the operator would observe the pressurizer level and receive additional indications that a LOCA occurred, a manual SX would be initiated.

Studies reported in WCAP-9600, "Report on Small Break Accidents for Westinghouse NSSS System" for a generic three-loop plant with minimum safeguards, indicate that break sizes smaller than two inches do not result in significant core uncovery, (i.e., there is only a loop seal uncovery). Loop seal uncovery occurs at about 1400 seconds for a two-inch cold leg LOCA. Core recovery is almost immediate and no second uncovery occurs. Evaluations and supporting calculations (not reported) indicate that the core will begin to uncover at about 2100 seconds after a two-inch small break LOCA is opened in a cold leg. Manual initiation of minimum safeguards safety injection prior to the blowing of the loop seal will prevent core uncovery (other than loop seal uncovery).

440. 120-2,

FSAR estion 440.121 (Section 6.3)

Regarding your response to question 440.42, the spurious movement of a motor-operated valve is 'considered to be a single failure. WCAP-8966 has not been approved by the staff for generic reference. Such failures that would prevent the ECCS from performing its function for each mode of ECCS should be corrected. Identify these valves and means of correction. Specifically, address failures of all hot leg injection valves and failure (open) of the containment sump to containment spray pumps valve.

FSAR Question 440.42 (Section 6.3)

The ECCS should retain its capability to cool the core in the event of a failure of any single active component. Section 6.3.1 of FSAR states "Spurious movement of a motor-operated valve due to the actuation of its positioning device coincident with a LOCA has been analyzed and found not to be credible for consideration." It is the staff's position that the spurious movement must be specifically addressed. Identify all single failures that could prevent the ECCS from performing its function for each mode of ECCS operation and discuss the direct effect of each failure.

Response to FSAR estion 440.121 Since there are two valves in each RHR sump line, the opening of one of them would have no impact. There is not a credible failure that would open both valves at once.

In compliance with BTP EICSB-18, power is locked out of the following ECCS valves:

Position During Valve Normal Operation 8808 A, B, and C Open 8888 CLosed 8885 Closed 8884 Closed 8889 Closed 8888 A and B Open Concern has been expressed that spurious or inadvertent opening of motor operated valving to the containment spray pumps could allow the draining of the RWSZ into the containment. This is not possible because whenever a signal is generated, either automatically or manually, to open the sump valves a close signal is simultaneously sent to valves 2CZ-V2SA and 2CZ-V3SB, (see FSAR Figure,6.2.2-1) which isolate the RWST. Also, Class 1E level monitors in the sump provide level indication and alarm in the Control Room such that the postulated event would be known to the operators at an early stage.

The spurious opening of the containment sump motor operated valving to the containment spray pumps is not considered possible due to the design of the 440.121-1

/l E

control system servicing the operators. The valves in question, 2CT-V6SA and 2C1.'-V7BA are automatically opened on a two out of four "low low" signal in the RWST provided that the Containment Spray pumps are running. Remote manual opening of the sump valves from the Control Room is possible at any time regardless of whether the CS pumps are running or not, but the operator must refer to sump level indication beforehand.

For these valves to open, power must be applied to the MCC output relays servicing the motor operators. There is no way for this to occur other than by the normal means. Et is not possible for a loss of power to the logic cabinets associated with the RWSZ level detectors to cause a false two out of four signal to be generated to open the valves because the output bistables and output relays must be energized to operate. C All the equipment associated with the RWST and Containment Spray System is designed to safety grade 'quality standards as described in Wapters 3 and 6 of the FSAR to assure maximum reliability.

440.121-2

FSAR Question 440.124 (Section 6.3 and 15.0)

The response to question 440.67 mentions Seabrook loading sequence, but does not state whether this is applicable for Shearon Harris. Provide correction to your response.

FSAR Question 440.67 (Section 6.3 and 15.0)

Provide a time sequence for the operation of the ECCS components that were used in the Chapter 15 analysis with and without offsite site power. What are the bases for these times and will they all be verified during preoperational testing?

Response to FSAR Question 440.124 There is an read Shearon error in the response to 440.67.

Harris.

Instead of Seabrook, it should 440.124-1

FSAR Question 440.125 (Section 15.1.2)

The response to question 440.69 references a reactor trip as a result of turbine trip. Is this a safety grade trip signal at SHNPP? FSAR Section 7.2.1.1.2(f) indicates that no credit is taken in any of the safety analyses (Chapter 15) for the reactor trip on turbine trip. Provide an evaluation of the Chapter 15 analysis to verify that credit is only taken for safety grade trips.

FSAR Question 440.69 (Section 15.1.2)

In Section 15.1.2.1 of FSAR regarding increased feedwater flow incidents, you state "The overpower overtemperature protection (overtemperature and overpower AT trips) prevents any power increase which could lead to a DNBR less than 1.30." Later in 15.1.2.2-b it reads "Following turbine trip, the reactor will be automatically tripped." In the time sequence of events for this transient, Table 15.1.2-1, you do not identify the signal utilize'd to initiate a reactor trip. Provide clarification of the reactor trip sequence used in this analysis and the justification for the assumed sequence.

Response to FSAR Question 440.125

,, Although the reactor is tripped as a result of the turbine trip in a high excessive feed accident, this trip is not required for safety. As stated in the response to Question 440.68, if the reactor was not tripped as a result of the turbine trip, it would eventually trip on low-low steam generator level, which is a safety grade trip. Once the feedwater isolation valves close due to the high-high level signal, the level in the steam generator will drop and the transient will be similar to the loss of load accident, which is a heat-up event already addressed in Section 15.2.2. The reactor trip on turbine trip is used for the excessive feed accident in order to be consistent with the fact that this is a cool-down transient, not a heat~p transient. Since the trip is not needed for safety, the statement in Chapter 7 is valid.

440.125-1

FSAR Question 440.126 (Section 15.1.2)

Erovide or reference the sensitivity study which indicates that the increase in feedwater flow transient with automatic rod control is the worst case.

What features at Shearon Harris would account for this difference from other recently reviewed Westinghouse designs.

Response to FSAR Question 440.126 Figures 440.126-1 through 440.126-2 show the transient results for the excessive feedwater accident without rod control. These may be compared to Figures 15.1.2-1 and 15.1.2-2 in the FSAR which show the case with rod control. As stated in the response to Question 440.70, it can be seen that the differences are slight.

There are many plant parameters which could cause the change in the limiting case, especially since the difference between the two cases is so small. Some of these parameters are steam generator type, rod control system constants, and feedwater enthalpy.

440.126-1

5 ~

K '1 MCQ c5 "1 8500

~ C7 LJ

'5. 0000 CC

'75000 CL

~ -'~ "Sir+35

'85!40 qe acr

l. 2COO 5.0000

~ C X

CI ANO

~

.2NN LO a/0!.'g('l.

II le ZPD 0 CL lr ~

a+

IM CC 0 2506 0 CC llle

~Vlrr e

~

4A CC

~ 44 1500 0 NE. 0

~ &~

" N0.000 N. DCO I

I aD.DOD 0.0 CZO CD Cf0. CD C

'50.00 I

~

as 510.00 520.00 Lk 5M;00

'. 540.00

5. DÃ0

i. 5000

1. 0000 3.5000

3. 0000 2.0000 C7 C7

FSAR Question 440.127 (Section 15.2.3)

The response to question 440.74 did not clarify the various time delays and what are included in the delays. Provide further explanation so it is easily understood exactly what events occur at the various times and what is included in the delays.

FSAR Question 440.74 (Section 15.2.3)

In Section 15.0.6 of the Shearon Harris FSAR it states "There are various instrumentation delays associated with each trip function, including delays in signal actuation, in opening the trip breakers, and in the release of the rods by the mechanisms. The total delay to trip is the difference between the time that trip conditions are reached and the time the rods are free and begin to fall. Limiting trip setpoints assumed in accident analyses and the time delay assumed for each trip function are given in Table 15.0.6-1." With respect to accident analyses, the critical parameter is the time of insertion of the rod cluster up to the dashpot entry. In some of the analyses there is some confusion as to what time delays, are being considered. A case in point is the analysis for turbine trip incidents. In Table 15.2.3-1 Accident 1, the overtemperature AT reactor trip setpoint is reached in 7.8 seconds and rods begin to drop in 9.8 seconds. From Table 15.0.6-1 we see that the time delay of the overtemperature AT is 6 seconds (which includes the total time delay from the time the temperature difference in the coolant loops exceeds the trip set). No explanation is given for the two seconds from reaching the overtemperature AT reactor trip setpoint and the time that the rods begin to drop. Provide clarification of these various time delays assumed for the analyses and show that the total delay to insertion up to the dashpot is conservative in all cases.

Response to FSAR Question 440.127 As stated in the FSAR, the total delay time to trip is the difference between the time the trip condition is reached and the time the rods begin to fall.

This includes the response time of the sensors, signal processing (analog and logic), gripper coil voltage decay, and trip breaker opening. The total response time is based on the parameter being measured, the signal compensation (if any), as well as the logic time and rod release, the last being constant for all cases.

For the OTET trip, part of this delay is accounted for directly in the modeling of the code (four seconds), the rest is accounted for as an added delay (the two second value seen in Table 15.2.3-1, Accident 1). Items modeled directly by the code are loop transport delays (the coil sees the trip AT before the sensor does), and the analog calculations of the OTAT setpoint equation including the lead/lag compensation on Tavg and AT. The rest of the logic delays and the rod release delays are accounted for in the added delay until rod drop. The apparent inconsistency between Table 15.0.6-1 and Table 15.2.3-1, Accident 1, is that the first table presents the entire delay, whereas the second table explicitly mentions only the added-on delay.

However, the total delay is accounted for in the analysis.

440.127-1

The six second delay will be used to determine the acceptance criterion for the startup testing program which verifies that all time delays used in the FSAR are conservative. It should be noted that the individual component times are not important; rather, the overall response time is met.

440.127-2

I ~

FSAR estion 440.128 (Section 15.2.8)

Provide an assessment of the response to question 440.79 versus the response to question 440.65(2) with verification that the analysis of the feedwater system pipe break assumes no operator action. The response to question 440.65 indicates that operator action is required.

FSAR estion 440.79 (Section 15.2.8)

What operator actions, if any, are assumed in your analysis of the feedwater If operator actions are assumed, system pipe break'? show that sufficient time as defined by ANSI N660.is available for completion of these actions.

4 Response to FSAR Question 440.128 The response to Question 440.79 does not state that no operator action is required. No operator action is assumed to be completed until 30 minutes after the break. For consistency with Question 440.65, the wording in the response to Question 440.79 may be changed to read "by the operator within 30 minutes."

440.128-1

FSAR estion 440.129 The response to question 440.87 is incomplete as valves mentioned in the opening paragraph did not match the Table 440.87-1 valve list. Provide a discussion which lists all valves capable of causing a boron dilution during refueling and specifically list for each valve the administrative controls employed to prevent a boron dilution.

FSAR Question 440.87 (Section 15.4.6)

Section 15.4.6.2 of FSAR states "An uncontrolled boron dilution accident cannot occur during refueling as a result of a reactor coolant makeup system malfunction. This accident is prevented by administrative controls which isolate the reactor coolant system from the potential source of unborated water. Valves FCV-110B, FCV-111B, 8441, 8453, and 8439 in the CVCS will be locked closed during refueling operations. These valves will block the flow paths which could allow unborated makeup water to reach the RCS."

Describe the function of each valve, the type of valve, method of lock out, the administrative controls, and the effects and consequences of single failures and operator errors. Justify the assumption of having no source of dilution flow during refueling.

Response to FSAR Question 440.129 During refueling operations, potential boron dilution is prevented by administrative control of the valves listed on Table 440. 129-1.

The FSAR will be amended to reflect Table 440.129-1.

440. 129-1

TABLE 440.129-1 ADMINISTRATIVE CONTROLS TO PREVENT DILUTION DURING REFUELING Valve Position Valve Location/ID Durin Refuelin Lock Description/Comments 1-8455 Closed Yes RMW to the CVCS makeup control system.

(2-X42D) Valve must be closed.

1-8308 Closed Yes Boric Acid Batch Tank suction. Do not open valve unless batching tank concen-tration is )2000 ppm boron, and valve

~ 1-8302 (makeup water supply to batch tank) is closed.

1-8302 Closed Yes Reactor Makeup Water to Batching Tank.

Do not open unless suction valve 1-8308 is closed.

1-7054 Closed No Place valve in "maintain close" at valve 3-DA42R control switch and place BTRS master switch in "off". No lock required.

1-7004 Closed Yes RMW to BTRS loop. Valve must be closed.

3-X42D 1-7052 Closed Yes Resin sluice to BTRS demineralizers.

3-X42D Valve must be closed.

1-8513 Closed Yes Resin sluice to CVCS demineralizer.

2-X42D Valve must be closed.

B629A/B Closed Yes Recycle Evaporator Feed Pump to charging 3-X92D Pump Suction. Valve must be closed.

1-8545 Open No BTRS isolation valve. Place valve con-3-IA54DD trol switch in "maintain open" position.

440.129-2

'I FSAR estion 440.130 (Section 15.4.6)

Concerning your response to question 440.88, verify that potential sources of boron dilution which could originate from the containment spray system have been evaluated and factored into dilution prevention measures during shutdown.

FSAR Question 440.88 (Section 15.4.6)

A PWR recently experienced a boron dilution incident due to inadvertent injection of NaOH into the reactor coolant system while the reactor was in a cold shutdown condition. Discuss the potential for a boron dilution event caused by the chemical addition portion of the CVCS and by dilution sources other than the CVCS (for example, via the engineered safety systems),

Response to FSAR Question 440.130 The containment spray system has been evaluated and determined not to be a boron dilution source during shutdown.

440.130-1

FSAR Question 440.131 (Section 15.4.6)

Your response to question 440.89 is incomplete. Provide verification that your boron dilution analysis assumes that all fuel assemblies are installed in the core.

FSAR Question 440.89 (Section 15.4.6)

For each dilution event analyzed, confirm that a conservatively high reactivity addition rate is assumed taking into account the effect of increasing boron worth with dilution and that all fuel assemblies are installed in the core.

Response to FSAR Question 440.131 For all boron dilution events analyzed, all fuel assemblies are in the core.

440.131-1

gh C

FSAR Question 440.135 (Section 6.3)

In your response to question 440.107 you stated, "The operator has the ability to isolate the rupture." Provide a discussion on the assumed operator action which list alarms and indications which alert the operator to the need for action and the time frame available for the operator to complete the action.

This discussion should also cover other alarms or operator actions which could be expected during this same time frame.

FSAR estion 440.107 (Section 6.3)

Figure 6.3.2.5 indicates that the common header of the miniflow lines for the 3 safety injection pumps is designed to non-safety grade standards. Discuss the consequences of a postulated failure for non-seismic design miniflow common header with respect, to safety injection pump operation.

Response to FSAR estion 440.135 The pipe in question is a seismically designed and analyzed pipe; failure is thus not expected.

440. 135-1

~

Ag

. r