ML19290A356
| ML19290A356 | |
| Person / Time | |
|---|---|
| Site: | Crane  |
| Issue date: | 02/05/1968 |
| From: | US ATOMIC ENERGY COMMISSION (AEC) |
| To: | |
| Shared Package | |
| ML19290A343 | List: |
| References | |
| NUDOCS 7911060592 | |
| Download: ML19290A356 (62) | |
Text
-
e-a s.
February 5, 1968 SAFETY EVALUATION BY THE DIVISION OF REACTOR LICENSING UNITED STATES ATOMIC ENERGY COMMISSION IN THE MATTER OF METROPOLITAN EDISON COMPANY THREE MILE ISLAND NUCLEAR STATION UNIT 1 DAUPHIN COUNIY, PENNSYLVANIA DOCKET No. 50-289 1556 016 7911060 @ 2
-_~_
,e g
N a *
. TABLE OF CONIENTS Page No.
1.0 INTRODUCTION
1 2.0 SITE.
3 2.1 Description 3
2.2 Meteorology 4
2.3 Geology and Hydrology 5
2.4 Seismology.
6 2.5 Environmental Radioactivity Monitoring.
6 3.0 NUCLEAR STEAM SYSTEM DEFIGN 7
3.1 Summary Description 7
3.2 Nuclear Design..
9 3.3 Mechanical Design of Reactor Internals.
11 3.4 Thermal and Hydraulic Design.
12 3.5 Control Rod Drive Design.
15 3.6 Instrumentation and Control 16 3.6.1 Reactor Protection System 16 3.6.2 Reactivity Control.
21 3.6.3 Safe Shutdown from Remote Station 22 3.6.4 Radiation Monitoring System 22 3.7 Reactor Coolant System 23 3.7.1 Primary System.
23 3.7.2 Once-Through Steam Generator.
24 3.8 Secondary System.
26 1556 017
~
- iii -
Page No.
4.0 CONTAINNENT 27 4.1 Description 27 4.2 Loadings.
28 4.3 Structural Analysis 28 4.4 Construction.
29 4.5 Testing and In-Service Surveillance 30 4.6 Seismic Design.
30 4.7 Containment Leakage Prevention.
31 4.8 Containment Design Pressure 33 5.0 ELECTRICAL SYSTEMS.
34 6.0 ENGINEERED SAFETY FEATURES.
35 6.1 Emergency Core Cooling Systems 35 6.2 Core Barrel Check Valves 38 6.3 Containment Cooling Systems 39 6.4 Iodine Removal System 40 7.0 RADIOACTIVE WASTE CONTROL 42 8.0 ACCIDENT ANALYSIS 43 8.1 Incidents 43 U.2 Steam Line Break.
45 8.3 Rod Ejection Accident 45 8.4 Loss-of-Coolant Accident 47 9.0 RESEARCH AND DEVELOPMENT,
51 10.0 REPORT OF THE ADVISORY COMMITTEE ON REACTOR SAFEGUARDS 53 1556 018
~
- iv -
Page No.
11.0 TECHNICAL QUALIFICATIONS.
54 12.0 CONFORMANCE TO THE GENERAL DESIGN CRITERIA.
55 13.0 COMMON DEFENSE AND SECURITY 56
14.0 CONCLUSION
S 57 APPENDICES Appendix A - Report of the Advisory Committee on Reactor Safeguards.
59 Appendix B - Chronology of Regulatory Staff's Review of the Three Mile Island Nuclear Station, Unit 1 62 Appendix C - Report of the Environmental Meteorology Branch, Environ-mental Science Services Administration (formerly U.S.
Weather Bureau) 64 Appendix D - Report of the U.S. Geological Survey.
66 Appendix E - Report of the U.S. Coast and Geodetic Survey,
69 Appendix F - Report of Nathan M. Newmark Consulting Engineering Service 72 Appendix G - Report of the U.S. Fish ari Wildlife Service.
83 1556 019
e s
s 9
1.0 INTRODUCTION
The Metropolitan Edison Company (applicant) by. application dated May 1, 1967, and subsequent emendcents, has requested a license to construct and operate a pressurized water reactor, identified as Unit 1 at its Three Mile Island Nuclear Station in Dauphin County, Pennsylvania.
The proposed reactor is designed to operate initially at core power levels up to 2452 Mw thermal. The applicant anticipates, however, that the reactor will ultimately be capable of operating at a power level of 2535 Mw thermal. For this reason, the design of the major systems and components of the proposed facility, including the emergency core cooling systems and the containment structure which bear significantly on the acceptability of the facility under the site criteria guidelines identified in 10 CFR Part 100 of the Commission's regulations, have been analyzed and evaluated by the applicant and the regulatory staff at the higher power level of 2535 Mw thermal. The thermal and hydraulic characteristics of the reactor core were analyzed and evaluated at the initial power level of 2452 Mw thermal. Before operation at any power level above 2452 Mu(t) is authorized by the Commission, the applicant must submit a safety analysis and we, the regulatory staff, must perform a safety evaluation to assure that the core can be operated safely at the higher power level.
The technical safety review of the proposed plant which has been per-formed by the Commission's regulatory staff has been based on the applicant's Preliminary Safety Analysis Report (PSAR) and seven subsequent amendments all of which are contained in the application. This technical safety review or evaluation of the prelbninary design of the proposed plant was accomplished by the Division of Reactor Licensing with assistance from the Division of 1556 020
v.
. Reactor Standards and various AEC consultants, as requested. Within the Division of Reactor Licensing, the Reactor Projects group was assigned primary responsibility for the review. Assisting this group in its review were personnel within the Division representing varices special technical disciplines from the Reactor Technology and Reactor Operations groups. Their work was coordinated by the Reactor Projects group.
In the course of our review of the application, we held a number of meetings with representatives of the applicant, the nuclear steam system supplier (the Babcock and Wilcox Company) and the architect-engineer (Gilbert Associates) to discuss the proposed plant and to clarify the technical mate-rial submitted. As a consequence of these meetings, additional information was submitted as various amendments to the application. A chronology of the meetings and principal correspondence is given in Appendix B to this evalua-tion. Reports by our consultants on meteorology, hydrology and geology, seismicity, seismic design and environmental considerations are included in Appendices C through G to this evaluation.
In addition, the Commission's Advisory Committee on Reactor Safeguards
( ACRS) has also considered this project and has met and discussed it with both the applicant and the regulatory staff. The report of the ACRS is included as Appendix A.
The review and evaluation of the proposed design and construction plans of the applicant at this, the construction permit stage, is only the first stage of a continuing review of the design, construction and operation of the proposed nuclear power plant.
Prior to issuance of an operating license 1556 021
, for the facility, we will review the final design thoroughly to determine that all the Commission's safety requirements have been met. The unit would then be operated only in accordance with the terms of the operating license and the Commission's regulations and under the continued scrutiny of the Commission's regulatory staff.
The issues to be considered, and on which findings must be made by an atomic safety and licensing board before the requested license may be issued, are set forth in the Notice of Hearing issued by the Commission and published in the Federal Register on January 27, 1968, 33 F.R. 1082.
2.0 SITE 2.1 Description The site for the proposed reactor is in Londonderry Township, Dauphin County, Pennsylvania, about 10 miles southeast of Harrisburg, Pennsylvania on an island in the Susquehanna River above the York Haven Dam. The exclusion area will have a minimum radius of 2000 feet. The nearest population center with population greater than 25,000 is formed by the neighboring towns of Steelton and Harrisburg, combined population about 92,000. The nearest boundary of Steelton, south of Harrisburg and north of the site, is about 7 miles.
How-ever, since there is a substantial community, Middletown (population 12,000),
with a boundary about 2.2 miles from the site, we agree with the applicant that the low population distance should be specified as 2 miles. The following table gives the estimated 1967 populaticn figures at various distances from the proposed site.
Distance (miles) 1967 1556 022 0-2 2,300 2-5 24,000 5-10 110,000 10-20 500,000
_ 4 All land within the exclusion area houndary is owned by the Metropolitan Edison Conpany..The nearest residence outside the exclusion area is about 2200 feet fr om likereactorbuilding.
Cooling water for the reactor will be obtained from two closed cycle cooling towers which will reject heat to the atmosphere. Water for auxiliary sydtems and, in case of an accident, water for emergency systems will be obtained from the river. River water will be availabic to the facility intakIc structure it low river flows even if the York llaven Dam were to fail. Neither the York llaven Dam nor the cooling towers are there fore required to be Class I (carthquake resistant) structures since neither would be required to safely shut down the. plant even in the event of an accident.
The facility will be about 2.5 miles south of the Olmsted State Airport.
The applicant has stated that instrument landing approaches would pass about 7500 feet NNE of the site and that normal approaches and takeof fs are away from the site. We are continuing our evaluation of the application with respect to f
matters relating to the location of the Olmsted State Airport near the site of the proposed facility and will issue an addendum to this Safety Evaluation when our evaluation is completed.
2.2 Meteorolony Conservative dif fusion parameters have been used by the applicant in
' aasessing the consequences of accidents at the Three Mile Island site.
As dis-cussed in Section 8.0 of this report the meteorological model used by the regu-latory staff gives slightly higher doses at the exclusion boundary but these are still within the 10 CFR part 100 guidelines. The Environmental Meteorology Branch of the Institute for Atmospheric Sciences has reviewed the proposed meteorological assumptions and has indicated in its report, attached as Appendix C, that the model is appropriately conservative. The applicant also proposes to 1556 023
conduct an on-site program which we believe will verify the meteorological assumptions used in its calculations.
2.3 Geology and Hydrology No extraordinary geologic engineering problems associated with construc-tion of this facility are evident. Core borings taken at the site show that the foundation conditions in the sound bedrock underlying the site should be adequate for the proposed facility. The U.S. Geological Survey report on this site states, and we agree, that the appik ant's analysis appears to present an adequate appraisal of those aspects of geology pertinent to an evaluation of the site. The report is contained in Appendix D to this Safety Evaluation.
The flood of record at the site was the 1936 flood of 740,000 cubic feet per second (cfs) which resulted in a maximum water level of 299 feet above mean sea level (msl) at the upper end of the island. To provide protection against the maximum probable flood of 1,100,000 cfs the applicant will provide a dike ranging in height from 310 to 305 feet msl.
(The maximum probable flood represents the flood discharge that may be expected from the most severe com-bination of critical meteorologic and hydrologic conditions that are reasonably possible in the region.) The U.S. Geological Survey consultant states ( Appendix D) that the applicant's computations appear to result in a reasonable estimate of the maximum probable flood stages at the site and that adequate freeboard will be provided to protect against wave action or ice jams. We accepted these conclusions. The bridge to the island will be designed to provide access to the facility during the maximum probable flood.
1556 024
. 2.4 Seismology The applicant has proposed a design earthquake resulting in a horizontal ground acceleration of 0.06 g.
In addition, for a horizontal ground accelera-tion of 0.12 g the plant will be designed so that there will be no impairment of function of critical structures and components. We have accepted the ground acceleration values proposed by the applicant since they are in accord with the recommendations of the U.S. Coast and Geodetic Survey contained in its report on the seismicity of the site. The report is attached as Appendix E.
2.5 Environmental Radioactivity Monitoring To establish background radiation levels, the applicant has initiated an environmental program to monitor soil, river water, air and aquatic biota and will continue until the plant becomes operational. The samples will be analyzed for gross alpha, beta and gamma activity and if significant amounts of activity are found, samples will be analyzed for specific radionuclides.
We believe that the program proposed by the applicant will provide a reason-able basis upon which the post-operation environmental program can be developed.
A copy of the application was forwarded to the Fish and Wildlife Service for their review. Comments of the Fish and Wildlife Service are attached as Appendix G.
On the basis of the discussion in Sect '.on 2.0, we conclude that the site is acceptable for the proposed unit.
1556 025
, 3.0 NUCLEAR STEAM SYSTEM DESIGN 3.1 Summary Description The nuclear steam supply system consists of a light water moderated and cooled pressurized water reactor (PWR) which transfers reactor heat to two once-through steam generators from which steam passes to a turbine-generator unit. The low-enrichment UO Pellet fuel is held in zirconium 2
rods 0.4 inch in diameter and about 12 feet in length. The fuel rods are held in place by perforated can fuel assemblies which have eight lateral grid spacers over the 12-foot length in addition to the two end fittings.
Each assembly contains 208 fuel pins,16 control pin guide tubes and one in-core instrument guide tube.
The core is comprised of 177 of these fuel assemblies which rest on the lower grid plate which is attached to the core support barrel which is in turn attached to the reactor vessel wall near the top of the vessel.
The core obtains lateral support from the center grid plate, located at the top of the fuel assemblies. An upper grid plate above the core provides lateral guidance for the control rod assemblies.
Reactivity control is accomplished by 69 control rod cluster assemblies and by liquid poison (boric acid) in the reactor coolant. Each control rod cluster assembly consists of 16 stainless steel tubes, containing a silver-indium-cadmium alloy, which arc connected to a " spider" assembly at the top so that the 16 poison-filled tubes act as a unit. The control cluster assembly is withdrawn and inserted by a rack and pinion drive assembly mounted on the reactor vessel head and driven thro-on a magnetic clutch by a synchro-nous motor.
If a rapid reactor shutdown is desired, the control assembly 1556 026
s s
, may be dropped by gravity into the core by releasing the magnetic clutch.
As the fuel is depleted, criticality is maintained by removing the liquid poison from the system by a chemical addition and control system.
The nuclear flux level is monitored by neutron detectors external to the reactor vessel and by 51 in-core chambers which are inserted through the bottom head of the vessel and into the fuel assembly guide tubes in selected locations. Either the nuclear flux level, high or low reactor system pressure, high coolant temperature, or low coolant flow can initiate a reaccor trip through the reactor protection instrumentation which de-energizes the magnetic clutches on the control rods and scrams the reactor.
Water heated (from about 555 F to about 600 F at 2200 psi) while passing upward through the reactor core exits from the reactor vessel through two 36-inch diameter lines near the top of the vessel. Each " hot leg" enters the top of a once-through steam generator. The primary coolant passes downward through the steam generator within a bank of tubes where it is cooled by water and steam (at about 530 F and 900 psi) on the shell side. The coolant is returned to the reactor vessel from the bottom of the steam generators through four " cold legs" (two from each steam generator).
Each cold leg contains a reactor coolant pump which provides the circulatory driving force.
Steam generated on the shell side of the steam generators is super-heated by about 35 F before passing through steam lines to a turbine-generator unit outside the containment building. After passing through the 1556 027
s 9_
turbine, the ?.ow-pressure steam is condensed in the turbine cordenser and returned as feedwater to the steam generators by electrically driven condensate booster pumps in series with steam driven feedwater pumps.
The pressure vessel and primary system piping, steam generators, control rod drives, instrumentation, core internals and the first core fuel will be supplied by the Babcock and Wilcox Company (B&W). The steam turbine will be purchased from the General Electric Company.
The B&W system design is, on the whole, not unlike other recent pressurized water reactor designs and is identical to those proposed for use by the Duke Power Company at its Oconee Nuclear Station. The proposed design is founded on proven concepts and its similarity to other current designs for pressurized water nuclear plants provides a degree of assurance that a reactor of this type can be successfully built and operated.
The only subsystem of the nuclear steam system which differs sub-stantially in design concept from current practice and experience is the once-through steam generator which provides slightly superheated steam to the turbine-generator.
(The once-through steam generator has also been proposed for use in the Oconee Nuclear Station.) Other subsystems such as the rack and pinion control rod dr * <es and the instrumentation are new designs but are based on experience with similar concepts. These systems will be discussed in more detail in following sections of this report.
3.2 Nuclear Design The light water moderated and cooled core has been designed to allow operation at 2452 Mw thermal to a maximum fuel burnup of 55,000 megawatt days per metric ton of uranium. The total clean cold excess reactivity is 1556 028
(
. about 30% delta k/k. About 10% delta k/k is held by the control cluster assemblies and the remainder by soluble poison. The reactor can be made subcritical by 1% delta k/k with the highest worth control cluster stuck out of the core at hot conditions by inserting the other 68 control assemblies.
A similar margin can be obtained at cold conditions by insertion of soluble poison. The reactivity worth of the control cluster assemblies and the rate at which reactivity can be addel by the rods or by the soluble poison system is limited to ensure that credible reactivity accidents cannot cause damage to the system or cause extensive fuel failure. The nuclear design objec-tives and limits are similar to other pressurized water reactors now under construction.
The core is predicted to have a positive moderator temperature coeffi-cient of reactivity during part of the first fuel cycle. The positive coefficient has been calculated by the applicant to be about 1.0 x 10-4 delta k/k/ F at the beginning of core life. This is calculated to corre-spond to a maximum 0.5% delta k/k in reactivity which could be inserted by a reduction in moderator density.
If this reactivity were inserted during a loss-of-coolant accident caused by the break of a large system pipe, about 3 full power seconds of energy would be released. The resulting peak fuel temperature caused by such a transient would be less than 2000 F, based on the present calculations.
An acceptable value of the positive moderator temperature coefficient will be set at the operating license stage, based on the final design and more refined accident calculations. The applicant has agreed to reduce this coefficient by the addition of stainless-steel 1556 029
\\
11 -
shims if necessary.
Although we are continuing to evaluate the magnitude of the energy added during a loss-of-coolant accident, we believe that the proposed core design can be accepted at this time since the applicant has agreed, if necessary, to reduce or eliminate the positive coefficient to bring the consequences of the applicable accident within acceptable limits.
The applicant's calculations indicate the stability margin with respect to xenon oscillations is least for the axial direction and that azimuthal and radial oscillations are not expected.
Further analysis will be made using final values of core properties and if it is found that oscillations could occur, a method for controlling the oscillations will be developed.
Calculations have been made to illustrate the ability of control rods with a short poison section to control a divergent xenon oscillation. Since xenon osc'illations are relatively slow changes and since the flux imbalance could be detected on the proposed instrumentation, we believe that this method of control is feasible and that analytical and, if necessary, control techniques can be developed prior to the operating stage. Manipulation of the normal control cluster assemblies or power reduction can also be used to prevent or correct, to some extent, the undesirable effects of xenon oscillations.
3.3 Mechanical Design of Reactor Internals The reactor internals will be lesigned to withstand steady-state and anticipated operational transients and in addition will be designed to res is t the effects of seismic disturbances and blowdown forces resulting from a primary system pipe break. We and our seismic design consultant, Nathan M. Newmark, will review proposed loading combinations and deformation limits when these become available.
,~
e
. The fuel assemblies are designed for steady-state and transient conditions under the combined effects of flow-induced vibration, reactor pressure, fission gas pressure, fuel growth and thermal strain. The cold-worked Zircaloy-4 cladding is designed to be free-standing. The fuel rod spacers are designed to maintain spacing between the fuel rods but to permit thermal expansion of the rod.
Structural stability is obtained from a perforated can assembly around the 15 by 15 array (which includes 16 Zircaloy control pin guide tubes and one in-core instrument guide tube as well as the Zircaloy-clad UO2 Pellet fuel).
The control cluster travel is designed so that the control pins are always engaged in the fuel assembly control pin guide tubes, ensuring that the control assembly can be dropped into the core when required. Each pin of the cluster is also guided above the core by tubes slotted to allow passage of the spider connection. The internals are designed to ensure that the dynamic loading resulting from a loss-of-coolant blowdown will not prevent insertion of the control cluster assemblies. The stresses imposed on the control cluster during scram are minimized by a snubbing mechanism in the rod drive housing and by designing the assembly for the deceleration loads.
We believe that the design criteria for the mechanical design of internals, fuel assemblies and control elements are adequate.
3.4 Thermal and Hydraulic Desien The reactor core is designed to operate at a steady-state power level of 2452 megawatts thermal corresponding to an average linear heat 1556 031
p
. generation rate of 5.4 kw per foot of fuel rod and a peak of 17.5 kw per foot.
The calculated maximum fuel temperature is about 4160 F and the average fuel temperature about 1385 F.
Although the turbine-generator unit and other equipment are sized for a higher core power level (2535 Mwt) and the fission product release studies are based on this higher power level, the application is for a core power level of 2452 Mwt and we have reviewed the thermal-hydraulic characteristics of the core at this power level.
The reactor core is designed (1) to prevent fuel melting at the design overpower of 114% (2680 Mwt), (2) to provide a high degree of assurance that no departure from nucleate boiling (DNB) will be experienced in the core, and (3) to maintain steam voids in the hottest channel at a level well below the threshold of flow instability. The design overpower is the highest credible reactor power which could result from foreseeable reactor operational transients which are terminated by reactor protective systems action (action is initiated at 107.5% full power).
The thermal and hydraulic design evaluation presented in the PSAR made use of the BAW-168 heat transfer relationship to establish that DNB would not be reached at the 1147. overpower condition.
A probability study was included in the analysis as a means of demonstrating the sensitivity of the analysis to the various input parameters and to allow an expression of the fraction of the core endangered when at various hot channel DNB ratios.
B&W substantiated the design by the results of rod bundle burnout tests of similar geometry but with axially uniform heating. These results were corrected to fit the actual nonuniform case by use of a correction factor obtained 1556 032
i s from single-rod burnout data. The applicant also performed calculations using the Westinghouse W-3 correlation to confirm that the thermal design limits are met.
Axially nonuniform bundle tests, similar in geometry to the proposed design, are being run as part of the research and development program at B&W and the results of these tests will be applied to the final thermal design. We believe that the allowable design heat flux should be designated as a research and development item if the design is to be based on the B&W heat transfer data. On the basis of the preliminary research results sub-mitted it appears that B&W will be able to justify the chosen physical parameters and design limits on the basis of its program of rod bundle burn-out tests. We have the added assurance, however, that the design could be approved on the basis of the W-3 correlation if necessary.
The present proposal differs in design from previously constructed plants of this type in that it will have fewer outlet than inlet loops and only tuo outlet pipes on a large core. The coolant distribution within the reactor vessel must therefore be investigated and the associated pressure drops established.
The applicant has stated that a research and development program is underway to mecsure flow distribution in the core, fluid mixing in the vessel and core, and the distribution of pressure drop within the vessel. These tests will be conducted on a 1/6 scale model of the vessel and internals.
In addition, flow distribution, pressure drop, and mixing data will be obtained with a full scale fuel bundle test assembly and on various models of reactor flow cells.
1556 033
~
15 -
We have reviewed the development program s.s described above and belicie that there is reasonable assurance that the scale model testing and the full scale fuel bundle testir.g will provide the information necessary for approval of the design at the operating license review stage.
3.5 Control Rod Drive Design The drive mechanism proposed is a rack and pinion device driven by a synchronous stepping motor through a worm gear reducer, unidirectional clutch and magnetic clutch, drive shaft and miter gear set.
The drive is operated in primary coolant up to the magnetic clutch where a buffer seal and rotary seal prevent leakage of primary coelant.
The drive motor assembly utilizes a worm gear reducer to prevent torque from being transferred to the drive motor in the event an upward force is applied to the rack. A unidirectional clutch will be provided within the magnetic clutch to prevent upward movement of the rack without a rod with-drawal signr1 from the control system.
Normal rod withdrawal and insertion requires that the magnetic clutch be energized. Scram is accomplished by deenergizing the clutch.
The components of the drive that operate in reactor coolant will be capable of performing their function at 650 F.
The seal water injection to the buffer seal is expected to maintain the drive components at a lower temperature. The applicant has proposed a development program to fully test the proposed design to demonstrate that the design objectives are met.
Our review of the proposed design indicates that no unusual problems are apparent. We agree with the applicant's design objectives and believe that the development program will provide an acceptable control rod drive mechanism during the operating license review.
1556 034
, 3.6 Instrumentation and control 3.6.1 Reactor Protection System The reactor protection system monitors vital process variables and automatically causes reactor shutdown when predetermined conditions estab-lished for each variable have been exceeded. The variables monitored include (1) high reactor power, as measured by neutron flux, (2) low reactor coolant flow, (3) high reactor outlet temperature, and (4) high or low reactor pressure.
The protection system consists of four identical and independent pro-tection channels, each tenninating in a bistable and trip relay. Each of the above variables is monitored by four channels which are coincident and redundant.
The nuclear instrumentation has eight channels of neutron information divided into three ranges of sensitivity: source rang 6, intermediate range, and pcwer range. The three ranges combine to give a continuous measurement of reactor power from source level to approximately 125% of full power, or ten decades of information.
A minimum of one decade of overlapping infor-mation is provided.
The source range instrumentation channels consist of two redundant count rate channels, each using proprotional counters as sensors. These channels are not associated with a protection function; however, they do provide an interlock function (a control rod withdrawal hold and alarm on high startup rate).
1556 035
~
,q
.- The intermediate range instrumentation has two log-N channels, each using identical gamma-compensated ion chambers as sensors. Reactor trip initiation is provided by these channels.
The power range instrumentation consists of four linear level channels using three uncompensated ion chambers per channel. The gain of each channel is adjustable, providing a means for calibrating the output against a reactor heat balance. Protective action consists of reactor trip initia-tion at preset flux levels.
Primary loop flow information is measured as a function of pressure drop by four independent sensors in each of the two hot legs. The outputs of the eight sensors are combined as pairs such that four independent total flow signals are derived. Each total-flow signal is fed to one of the four power range channels, thus creating four independent power / flow channels.
In addition, each pump motor breaker has four contacts which are respectively connected to the four power / flow channels. The logic of the power / flow channels in two-out-of-four, and the channels are independently connected to the reactor protection system logic channels in the same manner as the power range channels. The power / flow channels will initiate a reactor trip if the reactor power exceeds 107.5% full power or if a mismatch exists between power and coolant flow.
There is one set of four pressure sensors and one set of four temperature sensors which respectively trip the reactor on high and low primary system pressure, and high coolant outlet temperature. The logic is two-out-of-four, and the instrument channels are independently connected to the four logic 1556 036
.m P channels in the same manner as the power range channels. One pressure channel also provides a signal to the pressurizer pressure controller. The other three channels will provide trip action on a redundant basis should a failure disable the one common channel and abzultaneously initiate a pressure transient.
In this, as in other areas in which the same signal is used for control and safety purposes, the ACRS has stated that the con-trol and protection instrumentation should be separated to the fullest extent practicable ( Appendix A). We will review the detailed final design with this recommendation in mind.
The nuclear and process instrument channels, by virtue of being redun-dant, can withstand any single failure without loss of protective function.
The coincident logic permits testing during reactor operation.
In addition, all instrument channels initiate a trip signal in the event of AC voltage loss.
The engineered safety features are automatically initiated as follows:
(1) operation of the core emergency injection systems upon detection of low reactor coolant pressure, (2) operation of the reactor building cooling and iodine removal systems upon detection of high reactor building pressure, (3) containment isolation upon detection of high reactor building pressure, and (4) initiation of isolation valves on lines which are directly open to the reactor building on receipt of a high radiation signal.
The engineered safety features' instrument channels do not control the parameters which they measure; i.e.,
there is separation of control and safety. Manual actuation capability, independent 'of the instrument channels, is provided.
1556 037
_s a The ACRS has indicated in its report ( Appendix A), and we concur, that the emergency core cooling sy.. :s (ECCS) could be made more reliable by pro. _ ding diver."' fication in the system actuation signal; that is, by choos-ing. va-iable 1. medition to low system pressure which would supply an actuation signal. This recommendation is made even though the present instru-mentation meets the single failure criterion. We will require that the emergency core cooling systems be actuated by a +:.ond method at the operat-ing license sta68-The initiating circuits for the safety feature systems are, with one exception, identical to those proposed for the Oconee Nuclear Station.
At Three Mile Island two separate sets of bistables actuate the reactor building spray pumps and the associated valves.
( At Oconee, one set of bistables accomplishes both actions.) The separate logic permits testing the reactor building spray system without actually spraying water by starting the pumps with the valves closed, and opening the valves with the pumps shut off. We agree that this constitutes a desiga improvement.
The containment emergency cooler fans and motor are the only components which must operate in the containment atmosphere for an extended period of time after a design basis loss-of-coolant accident. The fan motors will be designed so that windings and bearing surfaces are protected against the accident environment. Motor housings will be designed to withstand 60 psi, and will be provided with an air-to-water heat exchanger to be supplied from the same source as its accompanying ventilating cooling coil. The winding insulation will have been demonstrated to withstand an accumulated radiation 1556 038
% exposure greater than the expected lifetime and design basis accident expo-sures. Bearings will be of a seal type which will withstand the design basis accident p essure pulse and will be cooled along with the motor internal air.
If, after the design is completed, it is determined that an environ-mental test confirmation of bearing design is required, the applicant will perform a suitable test. We will also assure ourselves that the fan motor housings have been conservatively designed and, depending on the final design, may require a prototype environmental test of the complete motor unit.
The final trip circuit of the proposed reactor protection system consists of a single DC bus fed from two station batteries.
Any event which would prevent deenergizing the bus would prevent all rods from dropping. The ACRS has recommended ( Appendix A) that the system be revised. We understand that the applicant will comply with this request by splitting the bus into a number of sections so that the failure of one bus to release its rods will not prevent a reactor scram. As recommended by the ACRS we will review the revised design prior to installation of the protection system.
The in-core instrumentation system, consisting of 51 in-core chambers which are inserted through the bottom head of the vessel and into the fuel assembly guide tubes, at present provides no automatic control or protection func tion. The system is located entirely within containment, thereby pre-cluding the need for isolation of penetrations associated with the system.
If xenon oscillations prove to be a problem in the final core design, part-length rods may be required. The in-core instrumentation system could then 1556 039
. be used to supplement out-of-core irformation on xenon-induced core flux tilting to allow the operator to take proper corrective action. The self-powered in-core neutron detector units are currently under test in the Big Rock Point Nuclear Power Plant.
On the basis of the foregoing, we have concluded that the applicant will provide an acceptable protection system.
3.6.2 Reactivity Control Reactivity control is maintained by movable control rods and by soluble poison (boric acid) dissolved in the reactor coolant.
The control rod drives will be designed so that (1) no single failure can cause an uncontrolled withdrawal of any rod, (2) no more than two control groups can be withdrawn at one time, (3) the withdrawal speed will be Ibnited so as not to exceed 25 percent overspeed in the event of speed control faults, and (4) continuous position indication will be provided. Based on our analysis, we believe that the applicant's rod drive system criteria are acceptable, that no single failure in the control instrumentation can produce an excursion which will cause fuel damage and that the proposed rod drives can be built in accordance with these criteria.
Reactivity is also controlled by a permissive system which allows manual dilution of the primary system coolant boron concentration when a particular control rod group reaches the fully withdrawn position.
Dilution is automat-ically terminated when the rod group, driven down by the servo, reaches a prescribed position, or when the integrated dilution flow has reached a preset maximum. We understand that these circuits will be designed in accordance 1556 040
e with protection systen standards and no single failure will prevent auto-matic termination of dilution. On this basis we believe that the proposed design is acceptable.
In suemary, we conclude that the applicant's design criteria relating to reactivity controls are satisfactory and that the proposed preliminary designs conform to thess criteria.
3.6.3 Safe Shutdown from Remote Stations Criterion No. 11 of the proposed General Design Criteria, published for comment July 11, 1967, states, in part, "It shall be possible to shut the reactor down and maintsin it in a safe condition if access to the control room is lost due to fire or other cause." The applicant has indicated that capability to maintain the plant in a hot-standby condition will be possible from local stations if it were necessary to evacuate the control room. We understand that the applicant will provide local station control to enable a shutdown to the cold condition to ensure that the reactor can be maintained in a safe condition for an indefinite period of time.
3.6.4 Radiation Monitoring System The radiation monitoring system for this plant consists of three sub-systems: area gamma monitoring, atmospheric monitoring, and liquid monitoring.
The area monitors consist of those instrument channels which
'dicate general 1556 041
--~.
7s
. levels of radioactivity at selected locations in the plant. The atmospheric and liquid monitors consist of those instrument channels which measure radio-activity levels within specific plant processes and automatically initiate corrective action or indicate that corrective action should be taken.
The detectors selected for each location have sufficient ranges and sensitivities to provide readings within range during a design basis acci-dent and will be located in close proximity to the points of releases or areas of most probable equipment failure. All instruments will receive power from the vital instrument busses thereby assuring their availability to per-form their required function under accident conditions.
High radiation signals will be used to automatically shut off discharges from the liquid and gaseous waste disposal systems. These signals will also shut down the auxiliary, fuel handling and reactor building ventilation systems.
The cooling water systems which remove heat from potentially radioactive sources will be monitored to detect accidental releases. These systems are the inter-mediate cooling loop, the nuclear services closed cooling loop and the spent fuel cooling loop. A monitor is also provided in the plant effluent line just prior to discharge into the river. We believe that the radiation monitoring systems proposed for the Three Mile Island Station are acceptable.
3.7 Reactor Coolant System 3.7.1 Primary System The reactor coolant is transferred to the top of the two once-through steam generators through two 36-inch lines from the upper reactor vessel iS56 042
, plenum. Water is returned from the bottom of the steam generator to the vessel via four 28-inch lines. Circulation is provided by a singlerspeed, shaft-sealed pump in each of the four cold legs.
The applicant has stated that access for inspection can be gained to all internal surfaces of the primary vessel by removing vessel internals and that it will be possible to gain access to the external vessel surfaces although this would require the removal of thermal insulation. The scope and frequency of the inspection program will be reviewed at the operating license stage.
The applicant presented the results of an analysis of the thermal transient experienced by the hot reactor vessel wall when deluged with cold safety injection water after a loss-of-coolant accident.
Ductile yielding, brittle fracture and fatigue failure were considered in the anal-ysis. The results of the analysis indicate that no loss of vessel integrity would be experienced even if large flaws were presumed to exist in the vessel vall at the beginning of the quenching.
As recommended by the report of the ACRS ( Appendix A), we will further review the details of the calculational procedure to ensure that conserva-tive assumptions have been made in this analysis and that the calculational models are supported by experimental information should this be necessary.
3.7.2 Once-Through steam Generator In the 3&W single pass or once-through steam generator design the primary water enters the top of the steam generator, is cooled while passing downward through the Inconel tubes and exits from the bottom head. The 1556 043
. secondary feedwater is sprayed into an annulus near the generator carbon steel shell. The feedwater is heated by steam which is allowed to bypass from the heated region back to the annulus. When the feedwater reaches the bottom of the annulus it is near the saturation temperature and is boiled as it passes upward through baffling around the ttbes which contain the primary fluid. When the steam exits from the generator, all the water has been evaporated and the steam is dry with about 35 F of superheat.
At full power the feedwater to the steam generator is controlled by a combination of power demand, system frequency and secondary steam pressure.
In addition to these parameters, maximum and minimum demand limits and a rate limit control the feedwater flow. This integrated controller is similar in concept to the controllers used on conventional steam plants and will be further reviewed at the operating license stage.
Feedwater quality is maintained at a high level by demineralizers sized to at least one-half full flow. High quality water will minimize stress-corrosion problems in the steam generators.
Since the tubes are welded to the tube sheets which are in turn fixed to the generator shell, differential expansion and stresses can be experi-enced when the tube and shell temperatures are different.
During startup and shutdown when the temperature difference is greatest (about 400 F) the stresses are compressive and small; only about 25% of the code allowable stress for the Inconel material. Buckling of the tubes is avoided by lateral support at 40-inch intervals.
1556 044
~
. A development program for the steam generator has been proposed by the applicant, including vibration and blowdown tests, and we will require a report of the test data and an analysis of their significance before final approval of the design at the operating license stage. The applicant has indicated that both primary and secondary side bloudown tests will be per-formed. Our analysis to date indicates that the applicant has a sound design basis for the steam generators.
3.8 Secondary System Steam passes from the steam generator at about 5300 F and 900 psi through steam lines through the containment wall and to the turbine build-ing. Safety valves and steam line isolation valves are mounted on each line outside the containment. The steam line isolation valves provide assur-ance of a leak-tight barrier after a loss-of-coolant accident when there is leakage through the steam generatcr tubes. The steam passes through turbine stop valves and control valves to the turbine steam chest.
After passing through the turbine, the low energy steam is condensed in the main condenser and returned through feedwater heaters and two half-capacity steam turbine driven feedwater pumps to the steam generator. Two emergency steam driven feedwater pumps are provided for decay heat removal during normal or emer-gency shutdown. Emergency feedwater could also be delivered by a condensate pump run by both emergency power diesels but the secondary system would first have to be depressurized to 180 psi.
An extended source of feedwater could be obtained if necessary (for example in an extended " blackout" of off-site power) by a raw water connection to the emergency feedwater pumps.
1556 045
~,
, The secondary system is designed to reduce load automatically to station auxiliary loads in case of a blackout or other transient on the external power grid. This would be accomplished by briefly venting secondary steam to the atmosphere while feedwater flow is reduced to the generators.
We believe that the proposed design of the secondary system, including the euergency provisions to deliver feedwater to the steam generators, is acceptable.
4.0 CONIAINMENT 4.1 Description The containment structure proposed is constructed of prestressed concrete.
The containment encloses the primary system, steam generators, and related auxiliaries, and is a vertical right cylinder with a shallow ellipsoidal sector dome and a flat slab base. A welded steel liner, three-eighths inch thick for the cylinder and dome and one-fourth inch thick for the base slab is attached to the inside'~ surface of the concrete shell to provide leaktightness.
The cylinder walls are prestressed circumferential1y against hoop stress by three staggered systems of prestressing tendons anchored at six vertical buttresses. The cylinder walls are also prestressed vertically with a series of uniformly spaced tendons extending from the top of the ring girder (thick-ened section at cylinder-dome intersection) to the bottom of the base slab.
The dome is prestressed by a three way tendon system extending across the dome and anchored on a horizontal plane on the dome ring girder.
1556 046
- Local base moments are carried by reinforcing bars which extend diag-onally through the thickness of the slab and up the cylindrical wall about 12 feet.
A grid of supplemental reinforcing bars is provided on the exterior face of the cylinder and dome for crack control.
Additional reinformeement is provided on the interior face at the dome liner and in the anchorage zones. Rigid shear "T" and "L" connectors are provided on the liner exterior face to fasten the liner into the concrete.
The prestressing tendon pattern is deflected around the major cylinder penetrations (personnel and equipment access hatches) and additional steel reinforcement is provided for local moments and shear stresses.
4.2 Loadings The major loadings considered by the applicant include dead load, acci-dent pressure, accident temperature, seismic, and wind. The applicant has also considered external pressure, tornado and missile loadings. The manner of load combination for the containment considers all significant loads and has been found acceptable by our seismic design consultant, Dr. Newmark
( Appendix F).
4.3 Structural Analysis The static load stresses and deflections that are in a thin, elastic shell of revolution are calculated by an exact numerical solution of the general bending theory of shells. These equations used take into account the bending as well as membrane action of the shell.
The equipment access hatch is approximately 22 feet in diameter and the personnel hatch is 9-1/2 feet in diameter. This represents an increase 1556 047
, in typical overall hatch size for this type of containment and, to an extent, increases the designer's problems with regard to tendon deflection around the opening and proper reinforcement for local stresses. The Franklin Institute has been engaged to make a computerized finite element analysis of the design. The results of this design analysis will be used as the basis for developing a confirmatory instrumentation program for the opening to be used during the proof test. The preliminary design as described by the applicant is acceptable and we believe that the structural criteria can be met.
We will, of course, give care ful attention to the final design during the operating license review.
4.4 construction The materials of construction, i.e., the prestressing system, tendon protective coating, concrete, reinforcing steel, and liner plate materials are quality, proven materials.
A retaining wall and drainage system around the Reactor Building will provide protection of the liner and tendons against ground corrosion.
Permanent reference electrode stations will be installed to facilitate measurements of structure potentials.
A liberal concrete cover allowance on reinforcing steel has been specified to provide assurance that deterioration of the structure during its operating life will not be signifi-cant.
The Metropolitan Edison Company organization will be responsible for quality control to ensure that the plant is constructed in accord with the requirements of the design. MPR Associates, Inc., will act as a consult-ant on quality assurance and will perform an engineering function for Metropolitan Edison in this area. User testing of materials, separation of construction and inspection functions, authority for the quality control 1556 048
r personnel.to perform properly, and design group review of the construction progress by the applicant will provide assurance that a high quality struc-ture is obtained.
4.5 Testing and In-Service Surveillance An extensive program of accepta 2ce testing for both structural capa-bility and leaktightness has been indicated. The program to establish structural acceptance will include instrumentation around the large opening, at the discontinuities, on selected tendons and on the liner to provide assurance that any anomalous structural behavior will be detected. Likewis e,
extensive preoperational integrated leakage tests are proposed to establish the structure's leakage characteristics.
Detailed in-service surveillance programs have not been established.
However, the design has been changed from grouted tendons to an organic pack-ing to provide for tendon retensioning, removal and replacement. There fore,
we are satisfied that the structure will have adequate capability for a suit-able surveillance program and review of the details of this program can be left for the operating stage review.
4.6 Seismic Design The applicant has proposed to base the seismic design of the containment building on assumed ground accelerations of 0.06 g for the design, and 0.12 g for the maximum earthquake. The response spectrum proposed is a combination of the Golden Gate and El Centro recorded spectra and is satisfactory to our seismic design consultants, Nathan M. Newmark Consulting Engineering Services, (whose report is attached as Appendix F) as long as the design corresponds to the envelope of the two spectra. We understand that the applicant intends to conform to this requirement.
15Su6 049
. The containment design as proposed has a high degree of conservatism.
It is concluded that the design, as presently proposed, and the construction, as indicated, will result in structures adequate for the intended purpose.
4.7 Containment Leakage Prevention The containment leak rate is specified at 0.2% per day at 55 psig.
A fluid block system and a containment penetration pressuriration system are provided to ensure that a low containment leak rate will be obtained during accident conditions. Tests to verify containment leak rate performance will, however, be performed without these systems.
The fluid block system is used on those lines which connect directly to the containment atmosphere and consists of a pressurized water tank which injects water between or into isolation valves outside the containment on an engineered safety feature actuation signal. The penetration pressurization is accomplished by maintaining air pressure between the double barriers provided on the containment penetrations in the event of an accident.
The fluid block system is activated only during an accident and is locally interlocked with the isolation valves which must close to allow formation of the seal. The capacity of the system will be adequate to fill the 27 lines specified with an as y2t unspecified allowance for leakage. We believe that the system proposed will aid in reducing the containment leak rate but agree with the applicant that leakage specifications should be met without reliance on the systems since it is somewhat complex in operation and since leakage of water through isolation valves would eventually empty the fluid reserve. The final design of the system must take into account 1556 050
~
. leakage of the complete reserve liquid and compressed air volume into the containment.
In the event of loss of fluid into the containment, any leakage from the containment into the fluid storage volume would be retained in the closed systen and isolation could be reestr.blished by remote-manual closure of the local fluid-admission valves.
The penetration pressurization system will be activated by an engineered safety feature actuation signal. We understand that it will operate on an air reserve tank at about 60 psi. Since the reserve tank will be only a small fraction of the containment volume, the building pressure would not be signif-icantly affected even if the total air reserve leaked into the containment.
We believe that these systems, which have been added by the applicant to assure maintenance of a low containment leakage rate, will provide addi-tional assurance that a low leak rate can be maintained in any accident condition.
Lines which penetrate the containment have provision for isolation.
The degree of redundancy depends on the function and configuration of each system.
In general, lines which are (1) connected to the primary system, (2) normally open to the containment atmosphere, or (3) likely to be ruptured during en accident are protected by redundant automatic valves. Lines which must remain open to allow functioning of engineered safety features during an accident must have provision for manually actuated isolation.
Lines which vent the containment atmosphere are closed both on signals which actuate other engineered safety features and on a high containment radiation signal. Closed systems which have a low probability of rupture 1556 051
~
. during an accident are provided with at least one automatic valve external to the containment. The isolation system, including instrumentation, is designed so that no single failure can preclude containment isolation.
We have reviewed the instrumentation and valve arrangements proposed and have found that they conform to the design criteria and are acceptable.
4.8 Containment Design Pressure A parametric analysis has been performed by the applicant to establish the peak containment pressures during a loss-of-coolant accident and to size the containment cooling systems. A spectrum of primary system pipe break 2
sizes between 0.4 ft2 and 14.1 ft has been evaluated to determine the response of the reactor building pressure.
The highest blowdown pressure peak (52.1 psig at 40 seconds) was found 2
to result from a 3 ft break. The highest postblowdown pressure (52.0 psig 2 break. The second pressure peak at 180 seconds) resulted from the 14.1 ft is a consequence of the assumed transfer of decay and metal-water reaction heat to the containment and is Ibnited by the operation of the containment cooling systems. The calculated peak pressures are below the containment design pressure of 55 psig.
An analysis was also performed by the applicant to illustrate that the containment will withstand the metal-water reaction (including hydrogen recombination) associated with inoperability of core quenching systems. This calculation also gave a peak pressure less than the containment design pres-sure.
1556 052
. Our evaluation of the containment design pressure analysis and the con-tainment's capability to withstand metal-water reaction indicates that it is acceptable.
5.0 ELECTRICAL SYSTEMS Incoming power will be provided by three 230 kv lines; two from Middletown Junction, and one from Jae.kson. The right-of-way of the Jackson line is distinct from that shared by the Middletown lines. The three lines terminate at the site in a conventional " breaker-and-a-half" arrangement. This permits flexibility in cross-connecting the three lines to the two startup trans-formers, and in isolating faults.
We believe that the external power sources available for use at the plant provide a high degree of assurance that power will be available when required. As with previous applicants, however, we have required that the available on-site power which is directly under the control of the applicant meet a single-failure criterion.
On-site AC power will be provided from two 2850 kw diesel generators.
Either diesel generator can supply the power required by the emergency core cooling and containment cooling systems in the event of a loss-of-coolant accident. Based on our review of the information submitted we believe that the on-site power will meet.a single failure criterion and is acceptable.
The station DC system consists of two independent 250/125 volt sources which provide power for DC pump motors, control and instrumentation. Each DC system will be supplied by a battery and battery chargers. Tie circuits will be provided to permit one battery to back up the other. A backup charger will be provided for each battery. We believe that the proposed DC system is acceptable.
1556 053
. 6.0 ENGINEERED SAFETY FEATURES 6.1 Emergency Core Cooling Systems The applicant's design basis for the emergency core cooling systems is to prevent clad melting for the entire spectrum of reacte r coolant system failures. To provide assurance that this criterion is met and to prevent any mechanical damage that might interfere with core cooling, the applicant has sized the emergency core cooling systems for temperatures much lower than melting. The calculated peak clad temperature is about 19500 F (zorconium melting temperatsire is 33000 F) which occurs for the largest 2
2 (14.1 f t ) hot leg break. The smallest break considered to date is 0.4 ft but we believe that there is reasonable assurance that further analysis will show that the systems proposed will also be effective for smaller break sizes.
The applicant's criterion for maintenance of mechanical integrity dur-ing the blowdown is that deformation of reactor internals chall be limited to values which will ensure that control rods can be inserted and that the core will be cooled. The applicant's steam supply contractor (B&W) is currently performing calculations to establish load combinations and stress and deformation ibnits for the combined accident and earthquake loadings.
We believe that the applicant's design basis for maintenance of mechanical integrity during blowdown are acceptable and, in accordance with the recom-mendation of the Advisory Committee on Reactor Safeguards ( Appendix A) we will review the effects of blowdown forces on core internals and the develop-ment of appropriate load combinations and deformation ibnits when these become available.
1556 054
~
. Core cooling for any location and size of primary coolant pipe break up to the double-ended rupture of a recirculation pipe will be provided by (1) core flooding tanks (accumulators), (2) low pressure injection pumps and (3) high pressure injection pumps.
The core flooding tank system is composed of two tanks each apparated by check valves from the primary system. Borated coolant is maintained in the tanks at 600 psi by compressed nitrogen.
Injection of the borated cool-ant into the primary system is initiated by the stored energy when the reactor pressure drops below 600 psi. The tanks discharge directly to the reactor vessel. The water flows between the reactor vessel wall and the thermal shield and enters the bottom of the core. The combined coolant content of the two tanks is more than sufficient to ccver the midplane of the core assum-ing no liquid is initially in the reactor vessel. The design valuer chosen for the flooding system are calculated to accomplish this within 25 seconds after the double-ended rupture of a 36-inch reactor outlet line. The hot 0
spot temperature is 1Lnited to about 1950 F for the largest line break.
In addition to the flooding tanks, coolant injection is also provided by either of two low pressure pumps which will each deliver about 3000 gpm at a vessel pressure of 100 psig. These pumps initially take suction from the 350,000 gallon borated water storage tank and are converted to a recircu-lation mode by operator action after about 30 minutes; the tLme depending on the number of pumps in operation. The low pressure injection system delivers water to the same nozzles as the core flooding tanks. Under normal shutdown conditions these pumps serve as decay heat removal pumps.
1556 055
s 37 -
During the period while the nater source is the borated water storage tank, the three high pressure injection pumps can also deliver water to the reactor inlet coolant lines. Each high pressure pump will deliver about 350 gpm at 2200 psi (operating pressure), 400 gpm at 1800 psig (safety system initiation pressure). These pumps provide makeup for small breaks for which the reactor would remain at a high pressure.
In the unlikely case that reactor pressure should remain high over a long period of time so that the low pressure injection pumps could not inject directly into the vessel, the high pressure pumps could take suction from the outlet of the low pressure pumps in the recirculation mode.
One of the three high pressure pumps will be used continuously during plant operation to provide seal water to the reactor coolant pumps. The normal use of one pump provides assurance that an operable pump will be available if required for emergency service.
The applicant revised the originally proposed core cooling systems to comply with our interpretation of Criterion No. 44 of the proposed General Design Criteria. Two separable core cooling systems for the recirculation mode have now been proposed either of which can perform the core cooling function. Means are provided to detect and isolate a passive failure in one system without Lapairing the ability of the remaining system to deliver water to the reactor core.
We believe that since the core flooding tanks and borated water storage tanks are passive components and in use for only a short period of tume redundancy is not required in these systems. We conclude that the proposed 1556 056
~
~
' emergency core cocling systems meet the intent of the Commission's proposed General Design Criteria which were published for comment July 11, 1967. We will continue to review (1) the core cooling analyses for the full spectrum of line break sizes and locations and (2) the final design of the cooling systems when available.
6.2 Core Barrel Check Valves The applicant has recognized that a water seal in the cold leg of the primary coolant system after a loss-of-coolant accident could lead to formation of a " steam bubble" or vapor lock above the core which might prevent cort flooding. Because of this phenomenon, 14-inch diameter check valves have been proposed to relieve pressure from the hot leg to the cold leg. These would be mounted above the core in the core support barrel and would be held shut by the normal 30 psi differential during operation but would open on less than 1 psi applied in the reverse direction.
The applicant has indicated design precautions (such as a captured hinge design) to prevent loss of a valve during operation and has also analyzed the consequences of loss of a valve cover. The analysis indicated that a satisfactory DNB ratio would be maintained at normal power levels but that at the 1147. overpower condition (the highest thermal power calculated in any transient) the DNB ratio would be 1.24; below the design value of 1.3.
We understand that loss of more than one valve would be detectable by a change in flow rate of about 2%. We believe that the undetected loss of a valve or valves should not lead to a DNB ratio of less than 1.3 at the over-power condition and the final design of the core is expected to meet this requirement. The applicant has stated that flow distribution studies will be made on a model of the reactor to simulate the loss of check valves.
1556 057
s
. The app 1' cant has also considered the effects of expected vibrations in unseating the valve during normal operation and has stated that the energy imparted to the valve from the flowing water will not be great enough to induce vibration. However, in view of experience in which unexpected vibrations have occurred, it is necessary to conduct an experimental program to determine whether the valves could be unseated by induced vibrations. The ACRS has also indicated ( Appendix A) that this point should be verified experimentally. We have been informed by the applicant that an experimental program will be per-formed. The test will determine the vibrational characteristics of a prototype check valve and its support structure.
With the above reservation on the undetected loss of a valve and contin-gent on experimental vibration studies, we believe that the check valves in the core barrel should provide a satis factory solution to the steam bubble problem.
6.3 containment Cooling Systems Two containment cooling systems of different design principle are provided:
(1) containment spray pumps which take water initially from the borated water storage tank and then from the containment sump and deliver it to the contain-ment atmosphere through redundant spray headers and (2) three emergency cool-ing units each consisting of a fan and a tube cooler which will remove heat from the containment atmosphere and transfer it to the low pressure service water system.
The containment cooling requirement is that the post-blowdown reactor building pressure be maintained below the design containment pressure. This 6
requires an initial heat removal capacity of about 240 x 10 Btu /hr. This requirement can be satis fied by either: (1) 2 of 2 spray pumps, (2) 3 of 3 1556 058
. fan coolers or (3) 2 of 3 fan coolers and 1 of 2 spray pumps.
Adequate con-tainment cooling is supplied if either system is assumed to be completely inoperative or if each system is degraded by a single failure. We believe that these systems provide adequate redundancy for containment cooling and have sufficient capacity to reduce the containment pressure (and thereby reduce leakage) after the design basis accident.
6.4 Iodine Removal System An iodine " fixing" additive will be mixed with the containment spray water to remove iodine from the containment atmosphere after fission products have been released to the containment after an accident. The containment spray system is also used for heat removal from the containment after a loss-of-coolant accident. Two sprays are provided and either spray has the design capability to remove the required amount of iodine from the contain-ment atmosphere.
As discussed in Section 6.0 of this report, without iodine reduction the exclusion boundary 2-hour dose and the low population distance total dose exceed Part 100 guidelines by factors of 5.2 and 4.0, respectively, for TID-14844 release assumptions and the proposed leak rate of 0.2%/ day. The sodium thiosulfate spray system is proposed to bring the design basis loss-of-coolant accident doses within Part 100 guidelines.
There is evidence that a significant removal of iodine from the contain-ment atmosphere can be obtained by using a spray with a " fixing" additive.
The additive changes the absorption process from liquid-mass-transfer limited to gas-phase-lbnited by providing cn efficient " sink" within the droplet.
1556 059
-s s
. While the removal factors needed to meet site guidelines appear to be available under laboratory conditions, the stability and compatibility of the additives accident conditions have not been proven.
The applicant has outlined a research and development program designed to provide adequate information to justify the use of a chemical spray as an engineered safety feature. The program relies on current and future experi-ments by Oak Ridge National Laboratory (ORNL) to justify spray removal races.
B&W will study the radiation and thermal stability problem and corrosion and chemical attack on containment materials but is committed to investigate removal rates if the ORNL work is not forthcoming.
We understand that one additional area will be included in the spray research and development program. The efficiency of the chemical spray will be experimentally checked in an environment in which the spray water is hotter than the atmosphere to confirm analytical calculations which indicate no significant decrease in efficiency under these conditions. The above condition of cooler air than spray could occur about 15 minutes after the postulated accident as a result of operation of the building coolers.
We believe that the research and development programs outlined by the applicant in conjunction with current studies at ORNL will provide a satis-factory iodine removal system at the operating stage. We also believe that these programs will show that iodine reduction factors on the order of 5.2 in 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> and 4.0 over the course of the accident, required as indicated by our calculations, can be achieved.
1556 060
e w
s
, 7.0 RADIOACTIVE WASTE CONTROL The sizing of the waste handling and storage equipment has been performed on the basis of continued reactor operation with clad defects in 1% of the fuel rods. The primary system is maintained at high water purity and radio-active wastes removed by the chemical purification system. A small stream is bled from the primary system, reduced in pressure and temperature by the letdown coolers and pa sed through the demineralizer as necessary and then routed to the letdown storage tank. Makeup to the primary system is provided by pumping the water from the letdown storage tank through the seal water or high pressure injection system. Addition or dilution of borated water is also accomplished by this system by feeding the letdown storage tank from the chemical addition system.
Liquid wastes are collected from the demineralizer sluice or other miscellaneous sources, concentrated in evaporators and packaged for off-site disposal. Low concentration condensate from the evaporators is either reclaimed or discharged at concentration below those specified in 10 CFR Part 20 to the Susquehanna River after being diluted in the " blowdown" dis-charge from the cooling towers.
Solid wastes will be stored temporarily pending shipment from the site in containers approved for the purpose.
Gaseous wastes will be monitored, diluted and released to the atmosphere or stored in waste gas holdup tanks to provide for appropriate decay of the radioactivity.
1556 061
N
. The applicant has indicated monitoring of all likely sources of effluent release (as discussed in Section 3.6.4 of this report) and has performed an analysis on the liquid waste disposal systems to show that multiple equipment failures and operator errors would be required to allow undetected discharge of radioactive wastes.
An analysis was performed, as described in Section 8.1 of this report, to show that even if the wastes stored at the site under failed-fuel conditions were discharged, the public drinking supplies would not be endangered.
We believe that the waste disposal system described by the applicant will effectively control radioactive wastes generated on the site and it is therefore acceptable. The proposed release ihnits for the site will be reviewed by the regulatory staff at the operating license review stage.
8.0 ACCIDENT ANALYSIS 8.1 Incidents A number of operational transients were considered by the applicant including rod withdrawal during startup and from power, moderator dilution, and loss-of-coolant flow. The applicant's evaluation indicated, and we agree, that no significant radiological hazard would result.
The Babcock & Wilcox Company is pursuing a research program to gain knowledge of physical fuel properties at high burnups which should provide knowledge concerning the ability of the fuel to withstand expected transients at the end of its design lifetime.
In addition, the ACRS has recommended
( Appendix A) that consideration should be given to development of instru-mentation for the prompt detection of gross failure of a fuel element. We will review any proposals made by the applicant in this regard.
1556 062
('
44 -
Beyond the operating transients considered above, a number of incidents were evaluated including a steam generator tube rupture, a waste gas tank failure and an accidental release of liquid effluent. Rupture of a steam generator tube was postulated which was assumed to release fission products from primary system water with a fission product inventory corresponding to 1% failed fuel. When released through the turbine main condenser the result-ant doses would be less than 10 CFR Part 20 lLnits at the site boundary.
The release of activity from a waste gas tank failure after operation with one percent failed fuel was calculated to be within 10 CFR Part 20 limits. Limits on radioactive waste concentration will be set at the operating license stage.
An accidental discharge of 10,000 gallons of liquid waste (evaporator condensate) at activity levels corresponding to continued operation with 1%
failed fuel was postulated to occur at 50 gpm and be diluted by the cooling tower blowdown steam of 2000 gpm. Multiple equipment failures and operator errors would be required before the radioactive effluent could be released.
The calculations show that accidental discharge of these operational stored wastes would result in e,ncentrations below 10 CFR Part 20 limits in the river.
The only potential hazard to the public drinking supply would be an accidental release of stored wastes after a major accident when (it is expected) comprehensive monitoring programs, in addition to normal monitor-ing programs, would be undertaken and any accidental release would be detected and corrective actions initiated.
An analysis was performed to illustrace 1556 063
~
. that an extended (and undetected) release of wastes collected after the design basis loss-of-coolant accident must be postulated before 10 CFR Part 100 guideline doses would be approached. We believe that the analysis presented illustrates the potential magnitude of the problem and the corrective measures which are available and that the accidental release of liquid waste would not result in exposure of the public beyond 10 CFR Part 100 guidelines in case of a major accident.
8.2 steam Line Break A steam line failure was analyzed which resulted in the release of the fission products contained in the secondary system (which might be accumulated due to minor tube leakage in the steam generator). The applicant stated that the releases from this accident would be small and we agree that the resultanc doses would be well within the 10 CFR Part 100 guidelines.
Break of a main steam line during operation would cause cooldown of the primary system due to flashing of the secondary system inventory. The flashing of the relatively low feedwater inventory would cause a decrease in primary coolant temperature of about 50 F at the end-of-life conditions when the maximum negative moderator temperature coefficient is present. The large increment of reactivity held by the control rods and the injection of boron from the high pressure injection system is calculated to maintain the core in a shutdown condition even if one rod were assumed to remain out of the core.
8.3 Rod Ejection Accident The ejection of a control rod from the core is postulated to occur as a result of a break in the pressure housing of the control rod drive.
The 1556 064
-~
s
- maximum reactivity increment that could be inserted corresponds to the worth of the ejected rod in the core prior to the accident. The applicant has stated that the maximum worth of a control rod at full power is 0.46% delta k/k and the maximum worth at source level, 0.6% delta k/k. The parametric study presented showed the effect of ejected rods worth 0.1% to 0.7% delta k/k for both the full power and source level cases.
For the ejection of a 0.46% rod from full power the maximum enthalpy in the hottest fuel rod was calculated to be about 180 calories per gram (cal /gm). The applicant's sensitivity analysis, which arbitrarily increased the worth of the ejected rod, indicates that ejection of a rod worth 0.6%
from full power would result in a hot spot enthalpy of about 200 cal /gm.
This is still below the fuelmelting temperature and no significant rapid energy release to the water is expected.
An ejection of a 0.5% delta k/k rod at source power was calculated by ejecting a 1% rod with the core ini-tially 0.5% delta k/k suberitical. The results of the analysis indicate a resultant peak power level of about 40% full power.
A sensitivity analysis was performed to show the effect of variation of important parameters in addition to rod worth. These included Doppler coef-ficient, moderator coefficient and trip delay time. No large variations in the computed results were observed when the above parameters were varied over a range of values. The environmental analysis performed assumed that fuel gap activity was released into the containment building. The resultant doses at the site boundary would be small and well within 10 CFR Part 100 guidelines.
1556 065
s s
./ In response to our request the applicant evaluated the proposed design against the revised criteria and has stated that the facility will be designed with the intent to meet these criteria. We believe that the proposed facility conforms to the intent of the revised criteria. Recognizing that the proposed revised criteria may be modified as a result of comments by interested parties, we intend to review the proposed unit at the, operating license stage in light of the criteria as formulated at that time.
13.0 COMMON DEFENSE AND SECURITY The application reflects that the activities to be conducted would be within the jurisdiction of the United States and that all of the directors and principal officers of the applicant are American citizens. We find nothing in the application or otherwise to suggest that the applicant is owned, controlled or dominated by an alien, a foreign corporation or a foreign Government. The activities to be conducted do not involve any restricted data, but the applicant has agreed to safeguard any such data which might become involved in accordance with paragraph 50.33(j) of 10 CFR Part 50. The applicant will rely upon obtaining fuel as it is needed from sources of supply available for civilian purposes, so that no diversion of special nuclear material from military purposes is involved. For these reasons and in the absence of any information to the contrary, we have found that the activities to be performed will not be inimical to the common defense and security.
1556 066
/
14.0 CONCLUSION
S Based on the proposed design of the Metropolitan Edison Company's Three Mile Island Nuclear Station, Unit 1, on the criteria, principles and design arrangements for systems and components thus far described, which include all of the bmportant safety items, on the calculated potential consequences of routine and accidental release of radioactive materials to the environs, on the scope of the development program which will be conducted, and on the technical competence of the applicant and the principal contractors, we have concluded that, in accordance with the provisions of paragraph 50.35(a),
10 CFR Part 50 and paragraph 2.104(b) 10 CFR Part 2:
1.
The applicant has described the proposed design of the facility, including the principal architectural and engineering criteria for the design and has identified the major features or components for the protection of the health and safety of the public; 2.
Such further technical or design information as may be required to complete the safety analysis and which can reasonably be left for later consideration will be supplied in the final safety analysis reports; 3.
Safety features or components, which require research and develop-ment have been described by the applicant and the applicant has identified, and there will be conducted, a research and develop-ment program reasonably designed to resolve any safety questions associated with such features or components; 1556 067
s
. 4.
On the basis of the foregoing, there is reasonable assurance that (i) such safety questions will be satisfactorily resolved at or before the latest date stated in the application for completion of construction of the proposed facility and (ii) taking into consideration the site criteria' contained in 10 CFR Part 100, the proposed facility can be constructed and operated at the proposed location without undue risk to the health and safety of the public; 5.
The applicant is technically qualified to design and construct the proposed facility; and 6.
The issuance of a permit for the construction of the facility will not be inimical to the common defense and security or to the health and safety of the public.
1556 068
s l
- APPENDIX A (59)
ADVISORY COMMITTEE ON REACTOR SAFEGUARDS UNITED STATES ATOMIC ENERGY COMMISSION WASHINGTON. D.C. 20545 JAN 17 jgigg Honorable Glenn T. Seaborg.
Chairmn U. S. Atomic Encray Co=siccion Uachington, D. C.
20545
Subject:
REPORT ON THREE MIC ?.SId.ND UUCLEAR STATION UUIT 1
Dear Dr. Scaborg:
At its ninety-third centins, January 11-13, 1963, the Advicory Committee on Reactor Safcauards revicued the propocal of the Metropolitan Edison Co=pany to canctruct Three Mile Island Uuc1ccr Station Unit 1.
This project had been considered previoucly at Subco=1trec ucctings hold on January 4, 1953, in Washington, D.
C., and on October.19, 1967, in nerchey, Pa.
Daring its revicu, the Ccanittee had the benefit of discuccions with reprocentativcc and concultants of the Metropolitan Edicon Co=peny, the Babcock and Uilco:- Cce):ny, Gilbert Acccciatcc, Inc., and the ACC Regulc-tory Staff. The Co=ittcc also hcd available the dccu=ents listed belou.
The ctation is located on Three Mile Icicnd near the ecct chore of the Sucquchanna River in Dauphin County, Pennsylvanic, about 10 miles couth-cast of Harrisburg. Unit 1 is a precouriced-natcr reactor plant, rated at 2452 ICt, and is similar in deci n to the units alrecdy cpproved for 3
conceruction at the Daho Foucr Coc?cny's Occace nuclear Station.- Flood protcction is to be provided at the cito by cuitable carth dihec. Tuo natural-draft cooling toucrs are to be uced for condenacr-vater cooling.
The cecracncy core cooling cycten (ZCOS) includac tuo core ficoding tenho, tuo independent lou-proccure cycteac, cnd t:o independent hish preccure cystenc. Tuo separate cyctcco are provided for containment coolin3 Cac system concicts of three fan-coolic3 unito, cad the other consist of two cprcy cycteac. The applicant stctcd thct suitabic and periodic cc=ponent and integrated sycten tect: uill be perforced on thccc engineered ccfety features. To further incure lou containment lech retos, a fluid block syctea and a contain= cut pcnctrat provided.
1556 069 Operation of the ECCS is initict-DUPLICATE DOCUMENT cianals from transducers cctucte The Cormittec reco=cnds that in Entire document previously entered'into system under:
ANO No. of pages: