ML19323B954

Responds to Presidents Commission Request for Info Re Use of Failure Modes & Effects Analysis in Licensing Process. Forwards Reactor Sys Branch Requirements for Use of Analysis.Excerpts from Reg Guide 1.70 Encl

ML19323B954
Person / Time
Site:	Crane
Issue date:	06/18/1979
From:	Novak T Office of Nuclear Reactor Regulation
To:	Lynd S Office of Nuclear Reactor Regulation
Shared Package
ML19323B948	List: ML19323B947 ML19323B951 ML19323B952 ML19323B953 ML19323B954
References
TASK-TF, TASK-TMR NUDOCS 8005140453
Download: ML19323B954 (10)

Text

{{#Wiki_filter:. O 8 0 os 14 o 9 53 pn sta<i ?, UNITED STATES 87,.-(f'i NUCLEAR REGULATORY COMMISSION [m7 ~# l WASHING TON. D. C. 20555 \\M / gig jg79 g, NOTE T0: Sue Lynd FROM; T. M. Novak, Chief, Reactor Systems Branch, DSS

SUBJECT:

INQUIRY FROM PRESIDENT'S TMI COMMISSION 1. Systems where we require FMEAs (SRP Requirements) a. ECCS (SRP 6.3. FMEA was omitted from this SRP. Rev. 1, which has not yet been issued, corrects this oversight.)* b. RHR (SRP 5.4.7, p. 5.4.7-5. Item 1 under Review Procedures.) c. Control Rod Drives (SRP 4.6, p. 4.6-3. Item 1 under Review Procedures.) d. Interlocks (EG&G recently completed FMEA on Interfaces, not specifically required). e. B&W plants have been requested to perform FMEA on ICS as part of Bulletin orders. ) 2. Identify any areas wh'ere they do not comply with our SRP acceptance ,V criteria with regard to single failures. 3. Review applicants suu.aittal and require compliance to SRP or branch positions where deviations occur. 4. NRC has, under technical assistance contracts to national labs, has FMEAs performed in ECCS. Thomas M. Novak, Chief Reactor Systems Branch Division of Systems Safety cc: Del Bunch

• M0TE: Applicants have been providing FMEA because it is required by Standard Format, Rev. 2, p. 5-41, Section 6.3.2.5.

O. V \\ l

a s A STAEARD FORMAT REG GUIDE 1.70 m ( I \\f Q The relief valve capacity,and settings or venting provisions included in the system should be stated. Specify design requirements for ECC deliv-ery lag times. Describe provisions with respect to the control circuits for motor-operated isolation valves in the ECCS, including consideration of inadvertent actuation prior to o' during an accident. This description r should include discussions of the controls and interlocks for these valves (e.g., intent of IEEE Std 279-1971), considerations for automatic valve closure (e.g., reactor coolant system pressure ir~2eds design pressure of residual heat removal system) and for automscic valve opening (e.g., preselected reactor coolant system pressure or ECCS signal), valve position indications, valve interlocks, and alarms. 6.3.2.3 Applicable Codes and Classifications. The applicable indus-try codes and classifications for the design of the system should be identified. 6.3.2.4 Materials Specifications and Compatibility. Identify the material specifications for the ECCS and discuss materials compatibility and chemical effects of all sorts. List the materials used in or on the ECCS by commercial name, quantity (estimate where necessary), and chemical composition. Show that the radiolytic or pyrolytic decomposition products, if any, of each material will not interfere with the safe operation of this or any other engineered safety feature. 6.3.2.5 System Reliability. Discuss the reliability considerations p incorporated in the design to ensure that the system will start when ( needed and will deliver the required quantity of coolant within specified lag times (e.g., redundancy and separation of components, transmission lines, and power sources). Provide a failure mode and effects analysis of the ECCS. Identify the functional consequences of each possible single failure, including the effects of any single failure or operator error that causes any manually controlled electrically operated valve to move to a position that could adversely affect the ECC3. The potential for passive i failures of fluid systems during long-term cooling should be considered as well as single failures of active components. For PWR plants, the single- ) failure analysis should consider the potential boron precipitation problem as an integral part of the requirement for providing for long-term core 1 cooling. Identify the specific equipment arrangement for the plant design and provide an evaluation to ensure that valve motor operators located within containment will not become submerged following a LOCA. Include all equip-ment in the ECCS or any other system that may be needed to limit boric acid precipitation in the reactor vessel during long-term cooling or that may be required for containment isolation. 6.3.2.6 Protection Provisions. Describe the provisions for protect-ing the system (including connections to the reactor coolant system or 6, C tV 6-41 y 737, q-m7 . c. ...w.. g

1 STANDARD REVIEW PLAN For operating license (OL) reviews, the pmcedures are utilized to verify that the [ ) initial design criteria and bases have been appropriately implemented in the final ( design as set forth in the Final Safety Analysis Report. The OL review also includes the proposed technical specifications, to assure that they are adequate in regard to limiting conditions of operation and periodic surveillance testing. As noted in subsections I end II, the RSP review for PWRs is limited to the low pressure - low temperature RHR system. For RWRs, the review is to include all of the systems used to transfer residual heat from the reactor over the entire range of poten-tial reactor coolant temperatures and pressures. The following steps are to be applied by the reviewer for the appropriate systems, depending on whether a PWR r,,- BWR is being reviewed. These steps should be adapted to CP or OL reviews as appropriate. 1. Using the description given in the appifcant's Safety Analysis Report (SAR), including component lists and performance specifications, the reviewer determines that the system (s) piping and instrumentation are such as to allow the system (s) to operate as intended, with or without offsite power and given any single active componenf failure. Thie is accomplished by reviewing the piping and instrumenta-tion diagrams (P& ids) to confirm that piping arrangements permit the required flow paths to be achieved and that suf ficient process sensors are available to measure and transmit required information. A failure modes and effects analysis (or similar system safety analysis) provided in the SAR is used to determine conform-ance to the single f ailure criterion. \\(', i 2. Using the comparison tables of SAR Section 1.3, the RHR system is compared to designs and capacities of such systems in similar plants to see that there are no unexplained departures from previously reviewed plants. Where possible, compari-sons should be dade with actual performance data from similar systems in operating plants. 3. From the system description and Pi!Ds, the reviewer determines that the isolation requirements of Branch Technical Position RSB 5-1 (Ref. 11) are satisfied. 4. The reviewer determines that the RHR system design has provisions to prevent damage to the RHR pumps in accordance with Branch Technical Position RSB 5-1 (Ref. 11). The reviewer checks tne isolation valves in the suction line for potential closure, NPSH requirements, pump runout, and potential loss of miniflow line during pump testing. If operator action is required to protect the pumps, the reviewer evaluates the instrumentation required to alert the operator and the adecuacy of the time frame for operator action. S. Using the system process diagrams, P& ids, failure modes and effects analysis, and component performance specifications, tne reviewer determines that the system (s) has the capacity to bring the reactor to cold shutdown conditions in a reasonable period of time, assuming a single fallu-e of an active component with only either / i ( ) 'O ] O D 9n 4 6 4 7-5 Rev. 1 M uh 3 o. =4' ,..-- = g m.- ,g,, s7

,g._. _

. c.2 7.,. 7 ~ gm. 3, 3<- s. ..w

STANDAF.D REVIEW PLAN i forth in the applicant's prolininary safet'y analysis report (PSAR) meet the acceptance criteria given in Section II of this review plan. During the operating license (OL) ) review, the reviewer veriffes that the initial design criteria and bases have been appro-N priately implemented in the final design as set forth in the final safety analysis report (FSAR). s 1. The R$8 reviews the CRDS design with respect to fluid systems and possible single failures. The review of the system description includes piping and instrumentation diagrams (P& ids), layout drawings, process flow diagrams, and descriptive infomation on essential supporting systems. The SAR is reviewed to ascertain that failure modes and effects analyses have been completed to detemine that the control rod drive system (not the individual drives) is capable of perfoming its safety-related func-tion following the loss of any active component. The RSB reviewer further confims, on the basis of previously approved systems or independent failure modes and effects analyses, that the minimum system requirements are met for the failure conditions. 2. The CRDS, P&lDs, layout drawings, and component description and characterictics are reviewed by the RSB to verify that essential portions of the system are correctly identified and are isolable from non-essential portions. The essenual portions should be protected from the effects of high or moderate energy line breaks. Layout drawings of the system are reviewed to assure that no high or moderate energy piping systems are close to the CRDS, or that protection is provided from the effects of high or moderate energy pipe breaks. 3. For plants containing control rod drive cooling systems (e.g., using air or water as coolant), the description and drawings are reviewed to determine that the systems [/ meet the design requirements. Essential equipment should be delineated in the SAR. The major function of the cooling system in PWR's is to cool the drive mechanism and remove heat from the CRDS motors to preclude motor burnout or damage. Failure of a CRDS motor could result in a rod drop. In BWR's, the major function of the cooling water is to cool the drive mechanism and its seals to preclude damage resulting from long-tem exposure to reactor temperatures. The control rod drive hydraulic system includes the cooling function as part of its design. The RSB reviewer confims by failure modes and effects analysis that the cooling system is capable of maintaining the CRDS temperature below the applicant's maximum temperature criterion. The EICSB reviewer in SRP 7.2 confims that there are sufficient instrumentation and controls available to the reactor operator to provide infomation in the control room to monitar the CRDS conditions, including the more significant parameters such as coolant flow, temperature, and pressure and stator temperature. 4 In coordination with the PEB, the RSB reviews the functional tests of the CRDS as related to rod insertion and withdrawal and scram operation and time. The reviewers check the elements of the test program to ensure that all required thermal-hydraulic conditions have been included for all postulated operating conditions. Experimental D n n [p} a o o 11/24/75 v ' ~ ~ " ~ '*i' 's 9, [**',". ~ ~" ' 6 5 :~ ~ 5 ~-, o ', ~ e * X', e y ~ _c g. M,

V AUXILIARY SYSTEMS BRANCH - FMEA 1. Appl.icants are required to do an FMEA in the following areas (SRP): a. Flood protection (3.4.1) b. Internally generated missiles (outside ccntainment) (3.5.1.1) c. Structures, systems and components to be protected from externally generated missiles (3.5.2) d. Plant design for protection against postulated high energy piping failures in fluid systems outside containment (3.6.1) f e. Main steam isolation valve leakage contrcl system - BWR (6.7) f. Spent fuel pool cooling system (9.1.3) 9 Fuel handling system (9.1.4) h. Station service water system - safety related sections (9.2.1) 1. Reactor auxiliary cooling water systems (9.2.2)

j. Ultimate heat sink (9.2.5) k.

Condensate storage-facilities - safety related sections (9.2.6) 1. Compressed air system - safety related sections (9.3.1) m. Equipment and floor drainage system - safety related areas (9.3.3) n. Chemical and volume control system - PWR, safety related areas (9.3.4) o. Standby liquid control system -BWR (9.3.5) p. Ventilation systems - safety related areas (9.4.1 to 9.4.5) ~ q. Condensate and feedwater system - safety related sections (10.4.7) r. Auxiliary feedwater system - PWR (10.4.9)

j -{ ) i + . l l l l i 1 l t 2. Be able to safely shutdown the plant from all operating conditions r i l l assuming single. failure. i f-3. Check tha't the plant can be safely shuti down assuming single failure. 4 4. We audit the applicant's proposed systems. i 6 I i ( 1 I i, A i P 5 r n I i l O 1, a

k STANDARD REVIEW PLAN [ A '[ sh needed for flood protection, including adequacy of detectors.tnd alarms necessary to detect rising water ;evels within structures, and will evaluate tie consequences of flooding on other safety-related instrumentation and electrical ecaipment in affected areas (SRP Section 7.6). l II. ACCEPTANCE CRITERIA Acceptability of the flood protection massures described in tie SAR, including related portions of Chapter 3 of the SAR, is based on specific general design criteria and regulatory guides and on the reviewer's independent evaluation and calculations with respect to area or component flooding. Listed below are specific criteria as they relate to flooding: 1. General Design Criterion 2, " Design Bases for Protection Against Natural Phenomena," as related to system and components capable of withstanding flood conditions. 2. Regulatory Guide 1.102, " Flood Protection for Nuclear Power Plants," as related to the protection of structures, systems, and components important to safety from the effects of floods. 1 3. Branch Technical Position ASB 3-1 and MEB ?-! as related to structures, systems and components capable of withstandi:.g the effects of flooding from failures in flui1 piping systems. I ( 4. If safety-related structures are protected from below grade groundwater seepage by ( means of a permanent dewatering system, then the system should be designed as a safety-related system and meet tie single failure criterion requirements. An additional basis for determining the acceptability of the facility will be the degree of similarity to previously approved plants with respect to means of providing flood protection. For those areas of review identified in subsection I of this SRP section as being the responsibility of other branches, the acceptance criteria and their methods of application are contained in the SRP sections corresponding to those branches. III. REVIEW PROCEDURE The review procedures below are used during the construction permit (CP) review to determine that the design criteria and bases and the preliminary design as set forth in the preliminary safety analysis report meet the acceptance criteria given in subsection i l II. For the review of operating license (OL) applications the procedures are utilized I U to verify that the initial design criteria and bases have been appropriately implemented in the final design as set forth in the final safety analysis report. The reviewer will select and emphasize material from the paragraphs below as may be appropriate for a particular case, i i s. l%%" lf% \\ ) NI Rev. 1 3.4.1-2

L

r: .- m y w-c. ,I.,, .q a rR~ y,,%,. m.r %ty. .p ~ ~~. A, u,. ...., _. =.J,-:uz.. w. .\\ .,_.p. .s

n, ~ E i STEhDARD R'EVIEW PLAN N Upon request from the primary reviewer, the secondary review branches will provide input \\ for the areas of review stated in subsection I. The primary reviewer obtains and uses such input as required to assure that this review procedure is complete. The objective in the review of the rea'ctor facility, structures, systems and components, with regard to protection requirements for internally generated missiles, is to identify the SSC that are needed to perform a safety function. Some structures and systems are designed as safety-related in their entirety, others have portions that are safety-related, and others are classified as not needed for safety. In order to determine their safety category, the ASB evaluates the SSC with regard to their function in achieving and maintaining a safe reactor shutdown condition or in preventing accidents or mitigating the consequences of such accidents.,The single failure criterion is used in the analysis. The safety functions to be performed by the SSC in tne various plant designs are essentially the same. However, the location and arrangement of the SSC and the methods used vary I from plant to plant depending upon the individual design. The review identifies varia-tions in plant designs that must be evaluated on an individual case basis. Structures, I systems, or components that perform a safety function, or by virtue of their failure could have an adverse effect on a safety function should be protected from the effects of l internally generated missiles. The information provided in the SAR pertaining to SSC design bases and criteria, system descriptions and safety evaluations, piping and instrumentation diagrams, station layout (N drawings, and system and component characteristic and classification tables are reviewed l to identify potential sources of missiles and to determine the SSC that require protection in order to maintain their safety-related functions. The reviewer may use failure mode and [ effect analyses and the results of reviews by other branches in evaluating specific SSC C and the origin of possible missiles, in identifying the structures, systems, and components that require protection from internally generated missiles and the adequacy of the protec-b t'on provi 'd. Components within one train need not be protected from missiles originat-ing from tf.e tame train. .a Tne reviewer determines that nonsafety-related structures, systems, or components are y, protected from internally generated missiles if their failure by a missile impact could prevent the intended safety function of the SSC. ',a. j{ IV. EVALUATION FINDINGS [*- The reviewer verifies that sufficient information has been provided to satisfy the require-ag.$ ments of this SRP section and that his evaluation is complete and adequate to support l 1 conclusions of the following type, to be included in the staff's safety evaluation report: [ "The review of possible effects of internally generated missiles (cutside containment) included structures, systems, and components whose failure could prevent safe shut- ~ down of the plant or result in significant uncontrolled release of radioactivity. Based on the review of the applicant's proposed design criteria, design bases, and ^ safety classifications for essential structures, systems, and components necessary to maintain a safe plant shutdown, the staff concludes that the structures, systems i 3.5.1.1-3 Rev. 1 2 o b A

g ' STANDARD REVIE'W PLAN 1. General Design Criterion 4, with respect to protection of structures, systles, and p c { components against the effects of externally generated missfies to maintain their \\ essential safety functions. 2. Regulatory Guide 1.13, as related,to the spent fuel pool systems and structures being capable of withstanding the effects of externally generated missiles and preventing missiles from contacting stored fuel assemblies. 3. Regulatory Guide 1.27, as related to the ultimate heat sink and connecting conduits being capable of withstanding the effects of externally generated missiles. 4. Regulatory Guide 1.115, as related to the protection of structures, systems, and components important to safety from the effects of turbine missiles. 5. Regulatory Guide 1.117, as related to the protection of structures, systems, and components important to safety from the effects of tornado missiles. III. REVIEW PROCEDURES The procedures below are used during the construction permit (CP) review to determine that the applicant's list of SSC that require protection from externally generated missiles is complete and meets the acceptance criteria given in subsection II. For operating license (OL) applications, the procedures are used to verify that the CP-stage list continues to be appilcable and complete, or has been supplemented as appropriate. The reviewer will select and emphasize material from the paragraphs below, as may be appropriate for a particular case. The first step in the review is to determine the safety-related SSC. Some structures and systems are considered safety-related in their entirety, others have only portions that are safety-related, and others are classified as nonsafety-related. In order to determine the safety category of the SSC, the ASB evaluates the SSC of the facility with respect to their necessity for achieving and maintaining safe reactor shutdown, or for performing accident prevention or mitigation functions. The information provided in the SAR pertaining to SSC design bases, design criteria, descriptions and safety evaluations, together with the system and component characteristic tables and safety classification tables are reviewed to identify safety functions performed by the SSC. The safety functions to be performed by the SSC in various designs remain essentially the same. However, the location or arrangement of the SSC and the methods used vary from plant to plant depending upon the individual designer. The reviewer identifies variations in design and evaluates them on a case-by-case basis. J$ The second step in the review is to determine the SSC, or portions of SSC, that require protection against externally generated missiles.,T,he reviewer uses engineering judgment _ h (. and the result _s of failure modes and effects analyses in conjunction with the result M reviews under other SRP sections for specific SSC in determining the need for missile N{ 'ii'rotection. Most safety-related systems are located within structures that are resistant Rev. 1 3,$,g.y s.g l y. Y 4 .? ih> fh)pLWff ,*jf

.__..d STAtlDARD REVIEW PLAtt ( ~. a. APCSB confirms with the RSS the seismic desic.i classifications of systems and components defined as essential safety-related features in Appendix A of BTP APCSS 3-1. b. APCSB identifies protective structures, piping restraints, and other measures used for protection against pipe breaks outside containment. Review of the specific c aspects of these ele.nents recomended in B.2.b of 3TP APCSB 3-1 is done by thew SEB and >'9 as follows: (1) SEB re'iews the design of protecti.e' structures in connection with the review of otSer Category I structures c. der Standard Review Plan (SRP) 3.8.4. (2) MEB reviews the design of piping restraints and other protective measures in connection with the review of break locatio.15 and dynamic effects of piping failures under SRP 3.6.2. APCSB identifies portions of high and moderate energy fluid system piping between c. containment isolation valves that are subject to the recomendations of B.2,c of BTP APCSB 3-1. MEB reviews the design of these portions of piping in connection with the review of break locations and dynamic effects of piping failures under SRP 3.6.2. { d. MTEB reviews inservice inspection aspects of piping within protective structures or guard pipes, between containment isolation valves, or subject to other pro-l tective measures, with regard to the recomendations of B.2.d of BTP APCSB 3-1. 6-This review is done in connection with the review of inservice inspection of ( Class 2 and 3 components under SRP 6.6. \\ 3. APCSB reviews analyses of postulated piping failures with respect to the guidelines of Section B.3 of BTP APCSB 3-1. The locations and types of failures to be considered and the dynamic effects associated with the failures are reviewed by the MES under SRP 3.6.2. APCSB reviews analyses of piping failures in high and moderate energy fluid sys-a. tems postulated according to the guidelines of B.3.a of BTP APCSB 3-1. b. APCSB reviews the assumptions made in the analyses with regard to: .. e (1) The availability of offsite power. (2) The failure of a single active component in systems used to mitigate the hk) - E Eences of the piping failure. r, n. (3) The special provisions applicable to certain, dual purpose systems. 2::. - y 45 4 (4) The use of available systems to mitigate the consequences of the piping Il

failure, a

3.6.1-2 ( 11/24/75 W Q. s

7907nA an, 1 bu#E d . +. "e NUREG 75/087 ykm asc os f ~, 'g U.S. NUCLEAR REGULATORY COMMISSION i ~! STANDARD REVIEW PLAN OFFICE OF NUCLEAR REACTOR REGULATION SECTION 6.7 MAIN STEAM ISOLATION VALVE LEAKAGE CONTROL SYSTEM (BWR) REVIEW RESPONS!B!tITIES Primary - Auxiliary Systems Branch (ASB) l Secondary - Containment Systems Branch (CSB) 1 Structural Engineering Bra h (SEB) Mechanical Engineering Br (MEB) Materials Engineering Branch (MTEB) Instrumentation and Control Systems Branch (ICSB) l Power Systems Branch (PSB) l ) 1. AREAS OF REVIEW Direct cycle boiling water reactor (BWR) plants hav5 redundant quick-acting isolation valves on each main steam line from the reactor to the turbine. In the event of a loss-of-coolant accident (LOCA), any leakage of contaminated steam through these valves is l controlled oy a leakage control system. The leakage control system must satisfy the requirements of General Design Criteria 2, 4, and 54. The review of the main steam isolation valve leakage control system (MSIVLCS)< overs the l ~ entire leakage control system including the source of the sealing medium, if any, and ~ ~ pumps, valves, and piping to the points of connection or interf ace with the main steam p supply system. Emphasis is placed on the components of the leakage control system that-( are required to remain functional following a design basis LOCA. l s 1. ASB reviews the desjgn o' the MSIVLCS and essential subsystems to assure their ability to function. folli. - 0,a postulated LOCA including the loss of of41te power. The system is reviewed to determine tngt: a. A malfunction or failure of a. active component of the system, or loss of the source of sealing fluid, if any, will not reduce the functional performance of the system. b. The failure of non-seismic Category I equipment or components will not have an adverse effect on the ability of the system or components to function. l c. The capability of the system to perform its intanced safety function is maintained assurgingyingle active failure of a main steam line isolation l {h< valve. F,c

e yp k{

U3NRC STAND ARD REVIEW PLAN

• .= ::" ="~' '." 5 : " *: "" ";" "/".'.".:'.'t.":"l,%.

' '0 = 1="*./"* .:=. =

..=..=========.=

==:

m I w ~ pw en .a.,.neasee a n. __-_.,_u.- ,) A.sve.o.a. - . o c.m 4 a (,

• ?*

n[ # '..i .* p -t am *,j ^

N STANDARD REVIEW Pl:$N g 'N d. Provisions to provide adequate make-up to the pool. e. Provisions to preclude loss of function e lting from single active failures or failures of non-safety-related components or systems. f. The means provided for the detection and isolation of system components that could develop leaks or failures, g. The instrumentation provided for ini,tiating appropriate safety actions, h. The ability of the system to maintain uniform pool water ternperature conditions and minimize corrosion products, fission products, and " purities in the water. The applicant's proposed technical specifications are reviewed for operating license applications as they relate to areas covered in this review plan. Secondary reviews are performed by other branches and the results used by the APCSB to complete the overall evaluation of the system. The secondary reviews are as follows: The SEB determines the acceptability of the design analyzes, procedures, and criteria used to establish the ability of structures housing the system and supporting systems to withstand the effects of natural phenomena such as the safe shutdown earthquake (SSE), the procaole maximum flood (PMF), and tornado missiles. The MEB reviews the seismic qualification of components and confims that the system is designed in accordance with applicable codes and standards. The RSB determines that the assigned seismic and quality group classifications for the system components are acceptable. The MTEB verifies that inservice inspection requirements are met for system components and upon request, verifies the compatability of the materials of construction with service conditions. The i E!CSB upon request, detemines the adequacy of the design, installation, inspection, and I testing of all essential electrical components required for proper operation. (s. II. ACCEPTANCE CRITERIA Acceptability of the design of the spent fuel pool cooling and cleanup system, as described in the applicant's safety analysis report (SAR), including related sections of Chapters 2 and 3 of the SAR is based on specific general design criteria and regulatory guides, and on independent calculations and staff judgments with respect to system functions and com-ponent selection. Listed below are specific criteria related to the spent fuel pool cooling and cleanup systems. 1. The design of the spent fuel pool cooling and cleanup system is acceptable if the integrated Cesign is in accordance with the following criteria: a. General Wtign Criterion 2, as related to structures hous%g the system and the system itelf being capable of withstanding the effects of natural phenomena such as earthquakes, tornadoes, hurricanes, and floods, as established in Ch?oters 2 and 3 of the SAR. b. General Design Criterion 4, with respect to structures housing the systems and the system being capable of withstanding the effects of external missiles and internally generated missiles, pipe whip, and jet impingement forces associated with pipe breaks. j 9.1.3-2 . s. 2 -Ni 11/24/75

.u...c._ST.ApDARD REVIEW PLAN =.O e l a / 1. The system performance requirements for the FHS are reviewed to determine that they cover the handling system concept used in the design, and describe the component and 1 subsystem functions within the integrated system. The performance requirements should also define any degradation considered for components and describe the procedures that are followed to detect and correct degraded conditions. 2. The performance specifications required as part of the design and described in the I SAR are reviewed to determine that the design, material selection, manufacturing, installation, testing, and operating procedures are in accordance with state-of-the-art practice. The reviewer verifles that the consensus standards, engineering codes, and industrial or manufacturing association st.andards selected and used are adequate and appropriate for the FHS. 3. Crane information presented in the SAR is reviewed to determine that the specific l arrangement of the system and subsysters and the load handling paths to be used are described with respect to locations of essential equipment. The reviewer determines that the fuel cask will not be transported over spent fuel or safety-related equip-ment. For overhead cranes and other lifting devices with load limitations or that are separated from essential equipment, the reviewer covers the following points: The size, shape, and dimensicns of the potentially most damaging load (the load a. which, if dropped by the crane, will cause the most damage), its weight and center of gravity, lifting points, stability, and handling speeds, are comnared with the performance specifications to determine the compatibility of the m I design with load handling and movement requirements. The reviewer uses the d requirements of codes and standards and, if required, performs an independent analysis to determine acceptability of the system. j b. The instrumentation and control system, including the limit and safety devices provided for automatic and manual operation for both normal and emergency { conditions, that are required to operate to maintain safety in the event of a failure of the system, are reviewed. The results of failure modes and effects analyses are used by the reviewer to determine that the control system adequately 'Timits loads or limits crane load movement, assuming a single failure, without f affecting the function of essential equipment or causing the release of radioactivit). h. The description of operating and test procedures ptesented in the SAR is reviewed c. to determine that load proof-testing, design-rated load testing, nondestructive .m

b testing, preventative checks, and examinations of hookup are in accordance with jh '

the requirements of the safety standards set forth in ANSI standards. 4. For cranes that have been designed to be single failure proof, the reviewer determines

• ,r}

that the design conforms to Branch Technical Position ASB 9-1. y. Sy 7'A Rev. 1 9,j,4,4 g h

,f,. g STANDARD REVIEW PLAN L' \\ power during normal and emergency conditions to safety-related pumps, valves and other components. II. ACCEPTANCE CRITERIA Acceptability of the design of the service water system, as described in the applicant's safety analysis report (SAR), including related sections of Chapters 2 and 3 of the SAR is based on specific general design criteria and regulatory guides. Listed below are specific criteria as they relate to the SWS. The design of the service water system is acceptable if the integrated system design is in accorennce with the following criteria: 1. General Casign Criterion 2, as related to structures housing the system and the system itself being capable of withstanding the effects of natural phenonna, such as earthquakes, tornadoes, hurricanos, and floods. 2. General Design Criterion 4, with respect to structures housing the syrrem and the system itself being capable of withstanding the effects of external n. tiles and internally generated missiles, pipe whip, and jet impingement forces associated w'?h,,ipe breaks. 3. General Design Criterion 5, as related to the capability of shared systems and components important to safety being capable of perforraing required safety l functions. ) J 4. General Design Criterion 44, to assure: a. The capability to transfer heat loads from safety-related structures, systems, and components to a heat sink under both normal operating and accident conditions, g i b. Component redundancy so that the safety function can be performed assuming a h ve component f_ailure coincident with the loss of offsite power. The capability to isolate components, subsystems, or piping if required s D c. that the system safety function will not be compromised. 5. General Design Criterion 45, as related to design provisions to permit inservice l inspection of safety-related components and equipment. 6. General Design Criterion 46, as related to design provisions to permit operational functional testing of safety-related systems and components. 7. Regulatory Guide 1.26, as related to the quality group classification of systems and components. .e L ~s \\ "j) 9.2.1-3 Rev. 1 4c 5 e ~ ~d&9 ' r[ d j (- 3 77;, R' k, (4'g. g'W[...,; ,,; y ,,,j_7eu. = } s 3 y y .S_.. s w. g

.-. a _ _.__ E STANDARD REVIEW PLAfi for system c' aents and, upon request, will verify the compatibility of the materials of N constructic th service conditions. The E!CSB will determine the adequacy of the design, installation, inspection, and testing of all essential electrical components required for proper operation. ACCEPTANCE CRITERIA Acceptability of the designs of cooling w7nter systems as described in the applicant's safety analysis rerort (SAR), including related sections of Chapters 2 and 3 of the SAR, is based on specif4.: general design criteria and regulatory guides, and on independent calculations and staff judgments with respect to system functions and component selection. Listed below are soecific criteria as they relate to the cooling water systems. The design of a cooling water system is acceptable if the integrated system design is in j accordance with the following criteria: 1. General Design Criterion 2, as related to structures housing the system and the system itself being capable of withstanding the effects of natural phenomena such as earth-quakes, tornadoes, hurricanes, and floods. 2. General Design Criterion 4, with respect to structures housing the system and the system itself being capable of withstanding the effects of external missiles and inter-nally generated missiles, pipe whip, and jet impingement forces associated with pipe breaks. 3. General Design Criterion 5, as related to shared systems and components important to safety being capable of performing required safety functions. 4 General Design Criterion 44, to include: a. The capability to transfer heat loads from safety-related structures, systems, and components to a heat sink under both normal operating and accident conditions. b. Component redundancy so that safety functions can be performed assumino a single _ active component failure coincident w.th the loss of offsite power. c. The capability to isolate components, systems, or piping if required so that the system safety function will not be compromised. 5. General Design Criterion 45, as related to the design provisjons to permit inservica n inspection of safety-related components and equipment. e 4 ,N 6. General Design Criterion 46, as related to the design provisions to permit operational /d functional testing of safety-related systems or components to assure: 4.' g, a. Structural integrity and system leak tightness. ,&w : * =N w 9.2.2-3 OT h.. 11/24/75 e f

t-j '- ^ * *

• STANDARbREVIEWPLN

. _....- w w 2. General Design Criterion 4, relative to structures housing the systems and the system itself being capable of withstanding the effects of external missiles and internally generated missiles, pipe whip, and jet impingement forces associated with high and moderate energy pipe breaks. l 3. General Design Criterion 5, as related to shared systems and components impor'.rnt j to safety being capable of performing required safety functions. 4. General Design Criterion 44, as related to: a. The capability to transfer heat loads from safety-related structures, systems, and components to the heat sink under both normal operating and accident conditions. b. Suitable component redundancy so that safety functions can be performed assuming a single active component failure coincident with,1,osL of offst_t h ~ power. r c. The capability to isolate components, systems, or piping if required so that safety functions are not compromised. 5. General Design Criterion 45, as related to the design provisions to permit inservice inspection of safety-related components and equipment. 6. General Design Criterion 46, as related to the design provisions to permit opera-t i+ tion functional testing of safety-related systems or components. e 7. Regulatory Guide 1.26, as related to quality group classification of system components. 'L*. 8. Regulatory Guide 1.27, as related to the design and functional requirements of the k ultimate heat sink. 4 l 9. Regulatory Guide 1.29, as related to the seismic design classification of system components. 10. Regulatory Guide 1.72, as related to plastic piping used in ultimate heat sink's spray pond. 11. Regulatory Guide 1.102, as related to the protection of structures, systems, and components important to safety from the effects ef flooding. 12. RegulatoryJ,uide 1.117, as related to the protection of structures, systems, and components important to safety from the effects of tornado -'issiles. l 1 O l Rev. 1 l

9. 2. 5-3

~ STAtiDARD REVIEW PLAtt ~ i t. ~'N i General Design Criterion 4, with respect to the system being capable of b. [ withstanding the effects of external missiles and internally generated missiles, pipe whip, and jet impingement forces associated with pipe breaks. General Design Criterion 5, as related to the capability of shared systems c. end components to perform required safety functions. d. General Design Criterion 44, to assure: (1) Redundancy of components so that under normal and accident conditions the safety function can be performed assumino a sinalt active component failure coincident with the loss of offsitej oweru C) The capability to isolate components, subsystems, or piping if required so that the system safety function will not be compromised. (3) The capability to provide sufficient makeup water to safety-related cooling systems. General Design Criterion 45, as related to design provisions made to perm!t e. inservice inspection of safety-related components and equipment. f. General Design Criterion 46, as related to design provisions made to permit p. operational functional testing of safety-related systems and components to ( assure structural integrity, system leak tightness, operability and perform-ance of active components, and capability of the integrated system to func-tion as intended during normal, shutdown, and accident conditions. g. Regulatory Guide 1.26, as related to the quality group classifications of components and systems. h. Regulatory Guide 1.29, as related to the seismic design classification of system components. 1. Regulatory Guide l'.102, as related to the flood protection provided for nuclear power plants. j. Regulatory Guide 1.117, as related to the tornado missile protection provided for nuclear power plant's structures, systems and components. k. Branch Technical Positions ASB 3-1 and HEB 3-1, as related to breaks in high and moderate energy piping systems outside containment. s 1. If a changeover from a nonsafety-related condensate storage source to a l safety-related water source is required for safe shutdown or accident mitiga-q } tion, then the changeover feature (automatic) should meet all the requirements j for a safety-related system or component. 9.2.6-3 Rev. 1 ~. O g

• A

-T ,,f." ,,7 g .s.

v. a y

g. ..STAtlDARD REVIEW PLArf 4. Regulatory Guide 1.26, as related to the quality group classification of systems and ) components. 4 5. Regulatory Guide 1.23 as related to the seismic design classification of system components. ~ 6. Branch Technical Positions APCSB 3-l and MEB 3-1, as related to breaks in high energy piping or cracks in moderate energy piping systems outside contai.nent. III. REVIEW PROCED'.RES The procedures below are used during the construction permit (CP) review to determine that the design criteria and bases and the preliminary design as set forth in the preliminary safety analysis report meet the acceptance criteria given in Section II of this plan. For operating license (01.) reviews, the procedures are used to verify that the initial design criteria and bases have been appropriately implemented in the final design as set forth in the final safety analysis report. The procedures for OL reviews include a determination that the content and intent of the technical specifications prepared by the applicant are in agreement with the requirements for system testing, minimum performance, and surveil-j lance developed as a result of the staff's review. j l As a result of various CAS designs provided for different plants, there will be variations in system requirements. For the purpose of this plan, a typical system is assumed whien has two independent systems, the plant service air system, and a safety-related control air N system (SRCAS). For cases where there are variations from this arrangement, the reviewer adjusts the review procedures given below. However, the system design would be required to 1 ( meet the acceptance criteria in Section II. The reviewer will select and emphasize mate-rial from this plan as appropriate for a particular case. .s 1. The SAR is reviewed to identify from information in the system description section and the piping and instrumentation diagrams (P&lDs) the SRCAS equipment used for normal operation and for safety feature operation. The reviewer determines that the system design is acceptable, taking into account the worst expected component operational degradation (e.g., wet or dirty air). The procedures to be followed to detect and correct these conditions when degradation becomes excessive are also reviewed. $s'. 2. T_he reviewer,gino the res'ults of failure modes _and effects analyses, determines that c the system, when cperating in the norinal mode, is capable of sustainTrig the loss of any active component. The reviewer determines, on the basis of previously approved systems or independent calculations, that the minimum system requirements (as stated 45 % in the SAR) are met for these failure corditions. W N T-3. The system P& ids, layout drawings, and component descriptions and characteristics are reviewed to determine the following: g a. Essential portions of the SRCAS are correctly identified and are isolable from the non-essential portior.s of the system. The P& ids are reviewed to verify that 9.3.1-3 h 11/24/75 4 O

E _...~ w

• t STANDARD REVIEW PLAff e

E 2. The EF05 performance requirements section of the SAR is reviewed to confirm that It describes component allowable operational degradation (e.g., drain blockage, sump pump luakage, or failures) for safety-related portions of the system and i describes the procedures that will be followed to detect and correcs these conditions if they become excessive. The reviewer determines that essential portions of the system can sustain the loss of any active component and meet minimum system requirements. The system P& ids, layout drawings, and component descriptions and characteristics are then reviewed for the following points: Essential portions of the EFDS are correctly identified and are isolable a. from the non-essential portions of the system to the extent required by system performance requirements. b. Essential portions of the EF05 are classified Quality Group C or higher and seismic Category I. Components and system descriptions in the SAR are reviewed to verify that the seismic and safety classifications have been included, and that the P&lDs indicate any points of change in piping quality group classification. 3. The reviewer verifies that the system safety functions will be maintained, as required, in the event of adverse environmental phenomena such as earthquakes, tornadoes, hurricanes, and floods, or in the event of certain pipe breaks. The reviewer evaluates the system, using engineering judgment, failure _ modes and effects analyses, and the results of reviews performed under other SRP sections, l to determine that: l a. Failure of non-essential portions of the system, or of other systems not i designed to seismic Category I Standards and located close to essential portions of the system, or of non-seismic Category I structures that house, ) i support, or are close to essential portions of the EFDS, will not preclude operation of the essential portions of the EFDS. Reference to SAR Chapter 2 (which describes site features) and the general arrangement and layout drawings will be necessary. Statements in the SAR to the effect that the above conditions are met are acceptable. b. System capability to prevent drain or flood water from backing up in the drainage system into areas housing safety-related equipment has been incor-parated. Statements in the SAR that this capability is provided are acceptable. ,( c. Provisions are made in the system to control and direct the flow of radio-4, active weste fluids to the radwaste area. It will be acceptable if the i systee P&l0s and design criteria show that the potential for inadvertent J. transfer of contaminated fluids to noncontaminated drainage system for disposal het been precluded. bt 9.3.3-4 M a J. .,ne

k.T STANDARD REVIEW PLAN followed to detect and correct these' conditions when they become excessive. The reviewer, using the fesults of failure modes and effects analyses, comparisons with previously approved systems, ur independent calculations, as appropriate, determines that the system can sustain the loss of any active component and meet the minimum system requirements for site shutdcman or accident sitigation. The system P& ids, layout drawings, and component descriptions and characteristics are then reviewed for the following points: ) Essential portions of the CVCS are correctly identified and are verified to be a. isolable from the non-essential portions of the system. The P& ids will be reviewed to verify that they clearly indicate physical divisions between such portions and indicate design classification changes. System drawings are also reviewed to see that they show the means for accomplishing isolation and the system description is reviewed to identify minimum performance requirements for the isolation valves. b. Essential portions of the CVCS, including the isolation valves separating essential portions from non-essential portions, are classified Quality Group C l and seismic Category I. Component and system descriptions in the SAR are reviewed to verify that the above seismic and safety classifications have been included, and that the P& ids indicate any points of change in piping quality group classification. N c. Design provisions have been made that permit appropriate inservice inspection and functional testing of system components important to safety. It will be acceptable if the SAR information de*ineates a testing and inspection program andifthesysten$drawingsshowtheconnectionsandspecialpipingandequipment required by this program. d. The system description and drawings are reviewed in conjunction with the reactor coolant system to determine that the CVCS has sufficient pumping capacity to maintain the RCS water inventory within the allowable pressurizer level range for all normal modes of operation, including startup from cold shutdown, full power operation, and plant cooldown. It is further ascertained from a review oftheP&lDsthatmakeuptotheRSCcanbeaccomplishedviatworedundant appropriately designed flow paths. e. Using the results of evaluations performed by the CPB, the ASB verifies the l adequacy of the system for reactivity control in the following areas: (1) Boration of the reactor coolant system is accomplished through either of two flow paths and from either of two boric acid sources. This is verified from t % review of P& ids and system description. 9.3.4-5 Rev. 1

L

?' w -a w p M p ~n .ax2

c f STANDARD REVIEW PLAN N Upon request from the primary reviewer, the secondary review branches will provida f input for the areas of review stated in subsection I. The primary reviewer obtains and uses such input as required to assure that this review procedure is complete. For the purpose of this SRP section, a typical system is assumed for use as a guide. l It is assumed that the SLCS consists of a boron solution tank, a test water tank, two positive displacement pumps, two explosive valves, and associated lacal valves and controls. For cases where there are variations from this system. the reviewer would adjust the review procedures given below. However, the system cesign would be required to meet the acceptance criteria given in subsection II. l 1. The SAR is reviewed to determine that the system description and piping and instru-l mentation diagrams (P& ids) delineate the SLCS equipment. The reviewer, using the results of failure modes and effects analyses, compariions with previous 5y approved systems, or independent calculations, as appropriate, determines that the system can sustain the loss of any active component and meet the minimum system require-ments for the safe shutdown and accident mitigation. The system P& ids, layout I drawings, and component descriptions and characteristics are reviewed to determine the following: The SLCS is classified Quality Group B and seismic Category I. Component and I a. system descriptions in.the SAR should verify that these classifications have been included, and the P& ids'should indicate any points of change in piping O' quality group classification. b. Design provisions have been made that permit appropriate inservice inspection and functional testing of the system. It will be acceptable if the SAR information delineates a testirg and inspection program and if the system drawings show the connections and special piping and equipment required by this program. Using the results of the evaluation performed by the Core Performance Branch, c. the ASB determines that the system has the capability to store the required l quantity of neutron absorber in solution and that the injection rate is sufficient to bring the reactor from rated power to cold shutdown at any time in core life with the control rods remaining withdrawn in the rated power pattern, taking into account the reactivity gains from complete decay of the 1 rated power xenon inventory, an allowance for imperfect mixing and leakage, y and dilution by the residual heat removal system. E* f[..

• The system P& ids indicate that ' adequate means are provided to maintain the d.

(,cc system temperature above the saturation temperature of the neutron absorber

1. g*;

solution. .b Rev. I 9.3.5-4 fh. ~y. hi-x.-- 7."i. 7.::W J: -.. N,.: Aw.w,; w:s~.:e ms.w.W,.n%g 7n sw.~ ~ x

5 SidriDARDREVIEWPLAtt u III. REVIEW PROCEDURES The procedures below are used during the construction permit (CP) review to determine that the design criteria and bases and the preliminary design as set forth in the preliminary safety analysis report meet the acceptance criteria given in subsection II. l For the review of operating ifcense ap'plications, the procedures are used to verify that the initial design criteria and bases have*been appropriately implemented in the final design as set forth in the final safety analysis report. The procedures for OL reviews include a determination that the content and intent of the proposed technical specifications are in agreement with the requirements for system testing, minimum performance, and surveillance developed as a result of the staff's review. Upon request from the primary reviewer, the secondary review branches will provide input for the areas of res!ew stated in subsection I. The primary reviewer obtains and uses such input as required to assure that this review procedure is complete. As a result of various CRAVS designs proposed by applicants, there will be variations in system requirements. For the purpose of this SCP section, a typical system with l redundant subsystems is assumed with each subsystem having an identical essential (safety features) portien. For cases where there are variations from this typical arrangement, the reviewer would adjust the review procedures given below. However, the system design would be required to meet the acceptance criteria given in subsection II. The reviewer will select and emphasize material from this SRP section as may be appro-priate for a particular case. y 1. The SAR is reviewed to verify that the system description and piping and instr een-tation diagrams (P& ids) show the CRAVS equipment used for normal and emergency operations, and the ambient temperature limits for the areas serviced. The system performance requirements section is reviewed to detemine that it describes allow-able component operational degradation (e.g., loss of cooling function, damper leakage) and describes the procedures that will be followed to detect and correct these conditions. The reviewer, using results from fM lure modes and effects analyses,, determines that the safety-refated portion of the system is capable of functiNing in spite of the loss of any active component. 2. The system P& ids, layout drawings, and component descriptions and characteristics are then reviewed to detemine that: a. Essential portions of the CRAVS are correctly identified and are isolable from non-essential portions of the system. The P& ids are reviewed to verify that they clearly indicate physical divisions between such portions and indicate design classification changes. System drawings are also reviewed to verify that they show the means for accomplishing isolation and the system description is reviewed to identify minimum performance requirements for the 'g isolation dampers. For the typical system, the drawings and description are f] reviewed to verify that two automatically operated isolation dampers in s .h Rev. 1 9,4,1 4 >e m.d, IMhL%,pur;s.34. Mt "iE'7 l5C 7 * 77 M 3

• ' N N"^ P M.1 G N.' C U;\\ M [-de.*w.,varM[:'L W #.'*

t

e STANDARD REVIEW PLAN 11. Regulatory Guide 1.117, as related to the protection of structures, systems, and r-components important to safety from the effects of tornado missiles. 3 12. Branch Technical Positions ASB 3-1 and MEB 3-1, as related to breaks in high and moderate energy piping systems outside containment. 13. Branch Tecnnical Position ASB 10-2, as related to the design guidelines to reduce the potential for water hammer in steam generators with top feedring designs (attached). For those areas of review identified in subsection I of this SRP section as being the responsibility of other branches, the acceptance criteria and their methods of application are contained in the SRP sections corresponding to those branches. III. REVIEW PROCEDURES The procedures below are used during the construction permit (CP) review to determine that the design criteria and bases and the preliminary design as set forth in the prelilLinary safety analysis report meet the acceptance criteria given in subsection II. l For the review of operating license (OL) applications, the procedures are used to verify ) that the initial design criteria and bases have been appropriately implemented in the final design as set forth in the final safety analysis report. Upon request from the primary reviewer, the secondary review branches will provide input 7 for the areas of review stated in subsection I. The primary reviewer obtains and uses ( such inputs as required to assure that this review procedure is complete. D The procedures for OL applications include a determination that the content and intent of the technical specifications prepared by the applicant are in agreement with the require-ments for systee testing, minimum parformance, and surveillance developed as a result of the staff's review. The reviewer will select and emphasize material from this SRP section as may be appro-l priate for a particular case. The SAR is reviewed to determine that the system description and diagrams delineate the function of the condensate and feedwater system under normal and abnore11 conditions. The reviewer veriffes the following: 1. The system has been designed to function as required for all modes of operation. gr.asultenf_failuremodesandeffectsanalysespresentedintheSAR,ifany, are used in making this determination. 2. The system piping is designed to preclude hydraulic instabilities from occurring in the piping for all modes of operation. As appropriate, the reviewer -y evaluates the results of model tests and analyses that are relied on to verify tr,. $o e Rev. I bh 10.4.7-4 4 1" 1 h1 E [ I'*, .y -%'F a4 . d-Q '. " p ,e, ] g a - ng i' w3 m g-A,c. 4 7 c W S A... 4

• Y 4.,$t N Ar'-

-] 4.5;- J u. V %._*.. _- '. 'X,M M M i-4

2 0 STANDARD REVIEW PLAN Component and system descriptions in the SAR include appropriate seismic and q c. ) quality group classifications, and the P&lDs indicate any points of change in y (./ piping quality group classification. d. Design provisions have been made that permit appropriate inservice inspection and functional testing of system components important to safety. It is acceptable if the SAR information de1Jneates a testing and inspection progrm and if the system drawings show the necessary recirculation loops aromd pumps or isolation valves as may be required by this program. 2. The reviewer verifies that the system safety function will be maintained as required, in the event of adverse environmental phenomena, breaks or cracks in fluid system piping outside containment, system component failures, loss of an onsite motive power source, or loss of offsite power. The reviewer uses engineering judgment ard the results of failure modes and effects analyses to determine that; The failure of portions of the system or of other systems not designed to a. seismic Category I standards and located close to essential portions of the system, or of non-seismic Category I structures that house, support, or are close to essential portions of the AFS, will not precluoe operation of the essential portions of the AFS. Reference to SAR sections describing site features and the general arrangement and layout drawings will be necessary, as well as the SAR tabulation of seismic design classifications for structures (~] and systems. [ h Y b. The essential portions of the AFS are protected from the effects of floods, hurricanes, tornadoes, and internally or externally generated missiles. Flood protection and missile protection criteria are discussed and evaluated in detail under the SRP Section 3 series. The location and design of the system, l structures, and pump rooms (ctbicles) are reviewed to determine that the degree of protection provided is adequate. A statement to the effect that the system is located in a seismic Category I structure that is tornado missile and flood protected, or the components of the :;ystem will be located in individual cubicles or rooms that will withstand the effects of both flooding and missiles is acceptable. The essential portions of the system are protected from the effects of high c. and moderate energy line breaks in accordance with Branch Technical Position ASB 3-1. Layout drawings are reviewed to assure that no high or moderate i energy piping systems are close to essential portions of the AFS, or that protection from the effects of failure will be provided. The means of providing such protection will generally be given in Section 3.6 of the SAR and procedures for reviewing this information are given in SRP Section 3.6. l b '\\ I / Rev. I 10.4.9-6 -u ' k y.4 _ QQly.' k wJ:S2 '% o

47 >p-

• t~

CONTAINMENT SYSTEMS BRANCH RESPONSES TO THE QUESTIONS FROM THE PRESIDENT'S TMI COMMISSION 1. Where we require appl. to do FMEA (Failure Modes and Effects Analysis) Section 50.34 of 10 CFR Part 50 requires the submittal of safety analysis reports tdth each application. Rev' fon 2 of the " Standard Format and i Content of Safety Analysis Reports for Nuclear Power Plants " NURJJ-75/094, j requires that the results of FMEA's be included in the safety analysis reports (e.g., see pages 6-19,6-27and6-37). Recent safety analysis reports have included the results of FMEA's. i 2. What we want them to do with #1 We require applicant's to perform FMEA's so that the worst cases can be identified and considered for adoption as design basis events; i.e., events that the plant will be designed to accommodate without exceeding certain dose guidelines 3. What we do with #1 We review appli c t FMEA's to assure that the analyses are ccmplete and correct and that appropriate des 1gn oasis events have been identified and adopted. 4 4. Where we (NRC) do FMEA While most FMEA's are performed by applicants, on occasion the staff and/or its consultants perfonn FMEA's. The objectives of FMEA's performed by the staff include development of preliminary assessments of new issues and development of bases establishing new licensing requirements. Examples of staff performed FMEA's include:

1) the discussion paper that sets the bases for Appendix I to SRP 6.2; and 2) the staff analyses that identified a need s

for establishing temperature limits for the suppression pools of boiling water reactor plants.

i k M DARD R R W REG GUIDE 1.70 i Liquid entrainment correlations for fluid leaving the core and entering the steam generators should be described and justified by comparison with experimental data. Experimental data should be provided to justify any assumptions made regarding steam. quenching by ECCS water. 6. Single Failure Analysis. Provide a failure mode and effects ar.alysis of the emergency core cooling systems to determine the single active failure that results in mnfmizing the energy release to the containment following a lo.ss-of-coolant accident. This analysis should be done for each postulated break location. 7. Metal-Water Reaction. Discuss the potential for additional energy being added to the containment as a result of metal-water reaction within the core. Provide a sensitivity analysis of the containment pressure as a function of metal-water reaction energy addition. 8. Energy Inventorics. For the worst hot leg, cold leg pump suction, and cold leg pump discharge pipe breaks, provide inventories of the energy transferred from the primary and secondary systems to the containment and the energy remaining in the primary and secondary systems. The table format is shown in Table 6-16. 9. Additional Information Required for Confirmatory Analysis. To j permit confirmatory analyses to be performed, the following information f( should be tabulated: the elevations, flow areas, and friction coefficients within the primary system that are used for the containment analyses and the safety injection flow rate as a function of time. Representative values with justification should be provided for empirical correlations (such as those used to predict heat transfer and liquid entrainment) that are significant to the analysis. 6.2.1.4 Mass and Energy Release Analysis for Postulated Secondary System Pipe Ruptures Inside Containment (PWR). This section should identify the computer code used and/or present a detailed description of the analytical l model used to calculate the mass and energy released following a secondary ~ l system steam or feedwater line break. A spectrum of break sizes and y various reactor operating conditions should be analyzed to ensure that g the most severe secondary system pipe rupture has been identified. Smaller and smaller break areas of steam line breaks should be considered starting with the double-ended rupture, until no liquid entrainment is calculated to occur. The following information should be included: I $.. 1. Mass and Energy Release Data. Mass and energy release data for I $ the most severe secondary system pipe rupture with regard to break size ( c,. and location and operating power level of the reactor should be presented d@' in tabular form with time in seconds, mass flow rate in Ibm /sec, and corresponding enthalpy in Btu /lbm. Separate tables should be provided l for the mass and energy released from each side of a double-ended break. 2. Single-Failure Analysis. A failure mode and effects analysis should be performed to determine the most severe single active failure 6-19 If f M = g p 's j

STANDARD FORMAT l' REG GUIDE i.70 O Provide failure mode and effects analyses of the containment heat removal systems. Graphically show the integrated energy content of the containment atmosphere and recirculation water as functions of time following the postulated design basis loss-of-coolant accident. Graphically show the integrated energy absorbed by the structural heat sinke and removed by the f an cooler and/or recirculation heat exchangers. Provide an estimate of the amount of debris that could be generated during a loss-of-coolant accident and of the amount of debris to which sump inlet screens may be subjected during postulated pipe break accidents. 6.2.2.4 Tests and Inspections. Describe the program for the initial performance testing after installation and for subsequent periodic operability testing of the containment heat removal systems and system components. Discuss the scope and limitations of the tests. Describe the periodic inspection program for the systems and system components. The results of tests performed and a detailed, updated testing program should be provided in the FSAR. 6.2.2.5 Instrumentation Requirements. Describe the instrumentation provisions for actuating and monitoring the performance of the containment heat removal systems and system components. Identify the plant conditions [-s and system operating parameters to be monitored and justify the selection s (, of the setpoints for system actuation or alarm annunciation. Specify the locations outside the containment for instrumentation readout and alarm. The design details and logic of the instrumentation should be discussed in Chapter 7 of the SAR. 6.2.3 Secondary Containment Functional Design The secondary containment system includes.the secondary containment structure and the safety-related systems provided to control the ventilation and cleanup of potentially contaminated volumes (exclusive of the primary containment) following a design basis accident. This section will discuss the secondary containment functional design. The ventilation systems (i.e., systems used to depressurize and clear the secondary containment atmosphere) should be diacussed in Section 6,5.3, " Fission Product Control Systems," and Chapter 15, " Accident Analyses." 6.2.3.1 Design Bases. This section should discuss the design bases (i.e., the functional design requirements) of the secondary ccntainment system, including the following considerations: 1 1. The conditions that establish the need for controlling the leakage from the primary containment structure to the secondary containment structure; 2. The functional capability of the secondary containment system .( to depressurize and/or maintain a negative pressure throughout the secondary

• fC s

6-27 l t, [{ %'E' $ $ -fZ d f $ ; *f. ? - - { (;;yW;'f-'. * " Tjl= $74 ]@ ;- EWS g Q' Q;

W STANDARD FORMAT REG GUIDE 1.70 12. Analyses of the functional capability of the spray and/or fan systems to mix the containment atmosphere and prevent the accumulation of combustible gases within containment subcompartments. Provide plan and elevation drawings of the containment showing the airflow patterns that would be expected to result from operation of the sp ay and/or fan systems with a single failure assumed. 13. Analyses or test results that demonstrate the capability of the airflow guidance ductwork and equipment housings to withstand, without loss of function, the external differential pressures and interral pressure surges that may be imposed on them following a loss-of-coolant accident. Provide failure mode and effects analyses of the combustible gas control systems. 6.2.5.4 Tests and Inspections. Describe the program for the initial performance testing and subsequent periodic operability testing of the combustible gas control systems and system components. Discuss the scope and limitations of the tests. Describe the inspection programs for the systems and system components. For thwe equipments that will be shared between nuclear power units at multi-unit sites, describe the program that will be conducted to ensure that the equipment can be transported within the allotted time safely and by qualified personnel. The results of tests performed and a detailed updated testing and inspection program should be provided in the FSAR. A 6.2.5.5 Instrumentation Requirements. Discuss the instrumentation provisions for actuating the combustible gas control systems and backup purge system (e.g., automatically or remote manually) and monitoring the performance of the systems and system components. Identify the plant con-ditions and system operating parameters to be monitored and justify the selection of the setpoints for system actuation or alarm annunciation. Specify the instrumentation readout and alarm location (s) outside the containment. Design details and logic of the crumentation should be discussed in Chapter 7 of the SAR. 6.2.6 Containment Leakage Testing General Design Criteria 52, 53, and 54 require that the reactor containment, containment penetrations, and containment isolation barriers be designed to permit periodic leakage rate testing. Appendix J, " Primary Keactor Containment Leakage Testing for Water-Cooled Power Reactors," to 10 CFR Part 50 specifies the leakage testing requirements for the reactor containment, containment penetrations, and containment isolation barriers. This section should present a proposed testing program that complies i with the requirements of the General Design Criteria and Appendix J to A.' 6-37 i YW. . ~ '. ['; 7 " }9" ..] " o }',

G

~~V~. 7 .c '~ .}}