ML19323E356
| ML19323E356 | |
| Person / Time | |
|---|---|
| Site: | Sequoyah  |
| Issue date: | 05/19/1980 |
| From: | Mills L TENNESSEE VALLEY AUTHORITY |
| To: | Rubenstein L Office of Nuclear Reactor Regulation |
| References | |
| NUDOCS 8005230432 | |
| Download: ML19323E356 (25) | |
Text
_
o 400 Chestnut Street Tos:ce II May U, 1980 Director of Nuclear Reactor Regulation Attention:
Mr. L. S. Rubenstein, Acting Chief Light Water Reactors Branch No. 4 Division of Project Management U.S. Nuclear Regulatory Commission Washington, DC 20555
Dear Mr. Rubenstein:
In the Matter of the Application of
)
Docket No. 50-327 Tennessee Valley Authority
)
References:
1.
Letter from L. S. Rubenstein to H. G. Parris dated April 10, 1980 2.
Letter from L. M. Mills to L. S. Rubenstein dated May 12, 1980 In your letter to TVA dated April 10, 1980, you requested additional information on the special test program at Sequoyah Nuclear Plant and transmitted a set of questions from the Advisory Committee on Reactor Safeguards (ACRS).
Enclosed for your review are 10 copies of TVA's response to the ACRS questions. The additional information on the special test program was transmitted to you on May 12, 1980.
Very truly yours, TENNESSEE VALLEY AUTHORITY
%/
, 0..i-l L. M. Mills, Manager ',d i
Nuclear Regulation and Safety Enclosure (10)
'W t i
NRC QUESTIONS REGAPl)ING THE LICENSING OF THE SEQUOYAH NUCLEAR PLANT i
1.
The general subject of the nitrogen in the UHI cccumulator tank is of some interest. The nitrogen is prevented from entering the primary system by active means (series valves). What is the reliability which is associated with this system and what would be the effect of ingesting large quantities of this gas in the primary loop after a very small break in the pri=ary system or after a massive cooldown following a main steam line break with failure being failure to cut off the main feedwater.
Vortexing/ gas ingestion in the UHI tank would provide another mechanism for transferring gas into the primary system even through the valves closed on signal.
What would be the uncertainty associated with the measures taken to prevent this event (hardware used and the tests results and analysis used to determine setpoints).
I
Response
Questions on the reliability of the upper head injection system have been previously answered in NRC question 9 of WCAP 9639. With regard to vortex formation in the Sequoyah Nuclear Plant upper head injection tank, Westinghouse has conducted an extensive literature search to obtain experimental evidence or quantitative methods to evaluate the for ation of a vortex during draining.
This effort has determined that no theoretical studies of vortex formation have been developed which are able to satisfactorily predict whether vortexes will form or what the depth of the vortex will be, even for circular tanks with a center drain.
However, experimental evidence is available from which qualitative conclusions have been obtained.
Reference 2, a NASA report on " Studies on Liquid Rotation and Vortexing in Rocket Propellant Tanks" comments on qualitative visual studies of vortexing while draining a circular tank.
These studies employed a plexiglass model tank approximately 11 inches 1
in ID and 1-1/8 inch drain hole. The flow conditions observed visually, employing both flat and conical bottoms on the tank, included draining by gravity, with and without initial liquid rotation, and draining by pumping with and without liquid rotation. These tests were also conducted using a center drain and with the drain hole of fset one-half the tank radius.
The conclusions of this test program were that:
6
A.
There was "...no vortex formation at all without considerable l
initial rotation..."
B.
The range of viscosity provided in these studies by various combinations of temperature and percentage sugar added to the water had no apparent effect on vortex formation or strength.
C.
"... benefit is gained by locating the drain orifice away from the tank centerline. The vortex tends to form initially by depression or ' crater' in the free surface near or at the center with a long thin filament or core extending down to the orifice; when the orifice is off-center, this filament tend,s to be curved and unstable so that what vortex action does occur is only intermittent in nature."
Additionally, Westinghouse has also performed qualitative tests on vortex formation during UHI accumulator blowdown, utilizing a model of the vertical UHI accumulator with a discharge nozzle arrangement identical to the actual CHI vertical accumulator (i.e., discharge nozzles at a 30 angle from the vertical in the bottom hemispherical head). Also, in order to obtain a comparative basis for the UHI discharge nozzle arrangement, a third dis-t charge nozzle was placed directly in the center of the bottom hemispherical head of the test model. A sketch of this test model is presented in Figure 4.1.
These Westinghouse tests examined the effect that water discharge rate, discharge nozzle location, and discharge through two versus one 30 nozzles, had on formation.
In addition, all nozzle configurations (center nozzle, one 30 nozzle, and two 30 nozzles) and liquid discharge rates were l
)
examined with the liquid in the model accumulator deliberately prerotated ct one revolution /second and with nonrotated liquid.
4 The results of this comparative study showed that no apparent vortex forma-tion occurred with any discharge nozzle combination with nonrotated fluid.
With the liquid in the model deliberately prerotated before discharge, significant vortex formation occurred when the center discharge nozzle was utilized.
In ccmparison, ne apparent vortexing was observed, even with prerotated liquid, when discharged through both 35 inclined nozzles. When one 30 discharge nozzle was utilized with prerotated {1uid, vortex forma-tion was significantly impeded and the vortex was so unstable that it would quickly dissipate.
Based on the results of Westinghouse's tests and studies of vortex phenomena, it is concluded that the correct amount of water will be injected during the UHI blowdown portion of a loss-of-coolant-accident and that vortex formation will not occur, thus ensuring that nitrogen gas will not be delivered to the reactor vessel upper head.
Also, scale model tests were performed to evaluate the penetration depth of incoming nitrogen gas into the accumulator fluid during blowdown.
These tests showed that there was no possibility of nitrogen gas being injected by this mechanism.
In addition to the above described scale model tests, full scale blowdowns of the UHI system have been performed at four plants. During these full scale blevdown tests, water samples were obtained before, during, and i
l
\\
l J
i= mediately at the end of blowdown to quantitatively measure the a=ount of nitrogen in the discharged fluid. These samples have in all cases showed that the amount of nitrogen in the discharge fluid was not excessive.
It is to be noted that these full scale, full pressure blowdowns result in =uch higher UHI flowrates than would be obtained during worst case large LOCA conditions.
O
=
e 1
2.
To what extent has the NRC reviewed the details of the design of the auxiliary centrol room, its capability for overriding the control room functions, and the vulnerability of the auxiliary 1
control room to the events which would cause the loss of functions for the mal. control room.
Response
l A limited set of controls, as described in section 7.4 of the Sequoyah Final Safety Analysis Report, are provided in the auxiliary control room to provide the capability to bring the units to and maintain them in the safe shutdown condition. Each function is designed with a transfer switch to disconnect it from the main control room. Placement of the transfer switen in the lor.a1 (auxiliary) operating position will give an annunciating 1
alarm in the control room and will turn off the motor control position lights on the control room panels.
In the past, TVA has responded to NRC questions (for example, Q7.22) and has supplied complete I&C drawings of toe auxiliary control room to the NRC for their review.
During the several days of site visits at Sequoyah, TVA made design and operations employees available to NRC reviewers to discuss the auxiliary control room design.
Also, the TVA fire protection review evaluated the ability of the auxiliary i
l control room to withstand electrical and exposure fires.
Before transfer, the auxiliary control room is electrically disconnected i
from the main control room. A fire in the auxiliary control room would not affect the functional capability of the main control room.
Fire or smoke in the main control room are the conditions which might require I
the use of the auxiliary control room. The transfer to the auxiliary control room and its operation has been confirmed by preoperational testing.
i l
l l
e m
3.
What are the reliability classes for the readout / indicating equipment in the control room? Would the operator have a clear indication of the status of the plant ender amergency conditions?
How is operator action, in the event of conflicting instrument indications, treated in the procedures?
Response
Safety-related instrumentation in the MCR is seismically qualified and is Class IE.
Additional MCR instruments, as a result of NUREG 0578 and the NRC MCR review in accord with NUREG 0660, have ensured and confirmed that the operator has a useable, unambiguous indication of plant status in emergencies.
Most of the MCR instrumentation that is not Class 1E also remains available to the operator upon loss of offsite power. Over 90 percent of the operator's instruments remains functional. For example, most BOP instrumentation and the plant computer will continue to operate for two hours on battery power. For non-1E Westinghouse equipment, there are four battery powered buses which are also backed by diesel-supplied emergency power. Also, the status monitoring system is backed by diesel-supplied emergency power.
TVA's training program emphasizes the interpretation of all available information in order that the operator can diagnose the basic cause of any malfunction or abnormal occurrence. The plant abnormal and emergency instructions list specific confirmatory indications and expected system parameter changes associated with equipment malfunctions or postulated accidents.
The prescribed operator response to the abnormal situations also
4 lists the confirmatory indications to verify appropriate corrective action is being taken. Operator training and experience dictates that he resolve conflicting readings of a l
given safety-related parameter by ignoring that parameter and i
re ferring to additional information and analyzing a larger picture. This ability comes from his training to interpret all available information.
I 1
I i
I 2
i i
l s...
4 Scenarios have been identified in which the ice condenser containment compartment drains may be plugged. Has the additional structural load which would result from water accumulation been considered?
l
Response
Should the two drains in the floor of the refueling canal become plugged, the canal will begin to fill with water from the containment sprays. When the refueling canal is full the water would accumulate on the operating deck until it reaches a depth of about one foot. At this time the water would reach an equilibrium depth as it begins to flow into the lower compartment through the air return fans. This maximum additional load from accumulated water has been considered. The containment structure has ample margin with which to accommodate these loads. Plant procedures require that the drain plugs be removed during normal operation.
l
l 1
l i
1 5.
To what extent is the ice condenser containment vulnerable to dynamic / static loadings which would result when the external i
pressure is higher than the interior pressure? For what events would this type of load be significant?
Resoonse The only events that would expose the containment to an external loading are inadvertent containment spray initiation or inadvertant air return fan operation. These loads are essentially static loads should such an event reduce the temperature and therefore the pressure inside containment. The containment is equipped with a vacuum relief system comprised of three identical units. Each unit contains an inboard check valve in series with an outboard isolation valve. Any two of the vacuum relief units can per form the vacuum relief function. At a negative dif ferential pressure of 0.1 psid, the passive vacuum relief system operates to equalize the pressure across the containment shell. The design basis for the vacuum relief system is to assure that the containment does not exceed its negative design pressure differential of 0.5 psid. As the vacuum relief system operates the annulus pressure is reduced. Analysis has shown that the pressure reduction in the annulus never exceeds the design basis negative pressure differential for the concrete reactor building of 2.0 psid. All high and moderate energy lines passing through the annulus that could significantly pressurize the annulus are sleeved so that a pipe break cannot result in static or dynamic external loads.
j i
6.
Discuss the testing / analysis which has gone into establishing the operability of the containment purge valve. What uncertainties would be associated with the operability of this system? Are the dynamic forces on the ducting which are associated with the purge valve closure significant? What physical tests are required?
i i
Response
The operability of the containment purge valves is ensured by design and testing. The valves are located away from the effects i
of pipe break blowdown forces. The largest pressure differential any valve would experience if called upon to close during an accident is 8 psid.
The valve body itself is a 150 pound butterfly valve, and the operator was procure' to close against the forces on the valve disk with a large margin.
No credit is taken for structural integrity of the purge system ducting. All components important to the purge system isolation func tion, including the debris screens, are housed in the containment penetration piping and are outside the crane wall.
Periodic testing required by the technical specifications, which includes stroking the valves and leak testing, ensures continuous availability of these valves.
s
7.
To what extent !.as the release of radioactivity from the containment into the auxiliary building during an accident by way of penetration / seal failures been considered? How would access to the auxiliary building and adjacent structures be affected? What capability exists for short term cleanup? To what extent is the contral room environment protected from this and other accidents having potential consequences beyond the design basis?
Response
There are no direct flos paths from the primary containment to the auxiliary building. The containment is physically separated from the auxiliary building by an annular region between the containment and the shield building. This annular region is continuously maintained at a negative pressure relative to the containment and the auxiliary building by the emergency gas treatment system (EGTS). Annulus atmosphere treated by the EGTS is either recirculated to the annulus or discharged to the atmosphere through the shield building vent. The only means of containment contamination reaching the auxiliary building is by the indirect means of leakage from emergency systems in the auxiliary building which process contaiment fluids during an accident or through-the-line leakage. All leakage of these types will be processed by the auxiliary building gas treatment system (ABGTS). The ABGTS maintains the auxilir.ry building at a negative pressure relative to the outdoors and process all effluent prior to releasing it to the atmosphere. The main control room area l
is protected from airborne contamination by an emergency I
pressurization system which consists of filters and pressurization fans. Outside air is drawn into the control building, filtered,
and used to hold the main control room area at a positive pressure relative to the outdoors.
2 Containment penetration failures are not credible events, and no consideration has been given to increases in releases of radioactivity for such an extension of the design bases. Access to plant structures would be affected in proportion to the magnitude of the additional releases and would depend on the location of the failure. No capability to clean up auxiliary building atmosphere is available except the purging effect of normal ventilation systems. The control room environment is protected to some degree beyond the design bases because of the conservatisms in the design, but significant additional levels of release could elevate inhalation doses to control room operators beyond design values.
I l
l
8.
To what extent are the pressurizer heaters and associated support equipment environmentally qualified for accident conditions?
To what extent are the PORV's and associated equipment on primary-secondary systems environmentally qualified for accident conditions?
Resoonse The Sequoyah pressurizer heaters are powered and controlled from Class lE circuits. The portions of the heaters outside the pressurizer are not environmentally qualified for accident conditions. The PORV's and their associated block valves and controls are powered by emergency power if offsite power is lost.
i i
9.
The following questions apply to conditions during the base design flood:
a.
To what extent is the decay heat removal process dependent on natural convection and will the TMI-2 experience lead to any change in the method for dealing with this event?
4 b.
tiould the flood condition result in a release of any combustible fluids or toxic gases which are stored at the plant? How are these materials controlled to prevent fire and other damege?
Response
a.
Following the design base flood, residual core heat will be removed from the fuel by natural circulation in the reactor coolant system. Heat removal from the steam generators will be accomplished by adding river water from the fire protection j
system and relieving steam to the atmosphere through the power relief valves.
If one or both reactors are open to the containment atmosphere as during the refueling operations, then the decay heat of any fuel in the open unit (s) and spent fuel pit will be re' moved by flooding the refueling canal, connecting it to the spent fuel pit, and using tie spent fuel pit cooling system that is connected to the RHR system by a prefabricated spool piece. These modes of operation are fully described in FSAR section 2.4A.
The TMI-2 experience will not lead to any change in the method for dealing with this event, but because of the low power natural circulation testing and the additional inadequate core cooling instrumentation, the plant operators will be better prepared for this mode of operation.
4 b.
Bulk storage facilities for flammable liquids and toxic materials are designed to survive the design basis flood. The bulk storage 1
.~ _
y-i and transport of combustible and toxic materials onsite are restricted by flood mode procedures. These flood mode procedures also reduce the hazards significantly from miscellaneous sources of combustible and toxic gases. Combustible materials are 1
segregated and enclosed in fire resistant compartments, er the i
storage location is provided with fixed fire detection and protection equipment. Combustible material is handled in l
approved safety containers or flammable liquid storage containers and the quantities of miscellaneous combustible or toxic material are administrative 1y controlled, i
i 4
a o
-et v
y-y-
yw.--
p s
,--m y-_
I l
i 10.
To what extent were plant design engineers involved in the writing of the emergency procedures?
Response
Design employees were not traditionally involved in the writing of emergency procedures.
Sequoyah emergency procedures were prepared by the plant staff. During preparation of the emergency p rocedure s, plant employees were in frequent discucsions with design employees to obtain clarifications on the designer's intent of how a system should operate. On some systems, design employees conducted seminars for plant employees who were preparing procedures to more completely inform them of system operation. As a result of TMI-2, all of Sequoyah's emergency instructions have been formally reviewed by the TVA design engineers responsible for the safety systems and by the reactor vendor.
s
11.
To what extent has TVA, independently of Westinghouse, looked at the use/ design of the UHI? What does IVA believe are the advantages /
disadvantages of the UHI in a base loaded plant?
Response
TVA has performed its own conceptual and safety review of the Westinghouse j
design of the UHI.
The decision to install UHI at Sequoyah was made to limit the economic effects of the Appendix K rulemaking. UHI does this i
for Sequoyah by providing additional operating flexibility and by providing the bases for operation at design power.
l The Uhl-ECC3 evaluation approved by the NRC staff shows, that UHI is a significant benefit. These analyses of UHI performance show that a UHI
'l plant has a better response for many small LOCA's (less than four inches in circumferential break size) compared to the system responses without the i
Uhl.
For these small LOCA's, the UHI evaluation model shows that the core i
remains totally covered throughout the accident.
The analyses of UHI using effectiveness ECCS models or risk assumption models is limited. The i
j experimental programs to demonstrate UHI ef fectiveness are also limited.
However, at this time, all of these realistic analyses and experimental l
programs have provided confidence to TVA that the UHI system is a significant benefit.
1
(
TVA does not plan to load follow with Sequoyah Nuclear Plant nor to address the pros and cons of load following with its nuclear plants until about 1985.
h y
,y..y w
e,
--r_
. - - - - ~-
,_-.w.<--
-+,-----v..-
12.
Discuss the capability of the plant to withstand the loss of all ac power.
i Resconse The loss of all ac power is not a design basis for Sequoyah. However, I
design changes have been made to give the plant an ability'for an immediate response to such an event. Battery-powered de control and i
instrument circuits allow the plant to reach and maintain hot shutdown if all ac power is lost.
For heat removal from the primary system, the j
turbine-driven AFW pump can run for at least two hours using only battery power for control and a de-powered room fan to remove heat trom the pump room.
The Sequoyan Nuclear Plant unit 1 is designed to ensure the availability as well as to ensure reliable and capable operation of onsite electrical power supplies should the offsite ac power supply be interrupted or lost (blackout) and the plant can then be placed and maintained in safe shut-down.
Design features to provide this reliable operation in lude independent and emergency ac power supplies powered from redunaant diesel-driven ac generators. The redundancy and independence of these two onsite electrical power rupplies is carried through the distribution systems up to and including the powerutilizing safety systems as well as including the auxiliary feedwater pump motors used for heat removal which is important in maintaining safe shutdown for extended periods of time.
Should either of the onsite ac electrical power systems be lost or ince'Jrupted, the capacity of the redundant system is sufficient to main-tain the plant in safe shutdown as well as mitigating the consequences of postulated accidents.
Industry generated data is available indicating that
a reliability goals have been established and the plant can be evaluated to show that the design of the onsite ac electrical power system meets these goals and that the availability of this onsite ac electrical power supply system can be thus ensured.
A total loss of ac electrical power, that is, the interruption or loss of offsite electrical power along with the total loss of both the redundant onsite diesel generator electrical power supply systems is, therefore, not considered a design basis event because of its improba-bility. However, in the unlikely event that it would occur, and assuming maintenance of the reactor coolant inventory, safe shutdown heat removal is available by reliance on a steam turbine-driven auxiliary feedwater pump design which has the capacity for removing decay heat for an extended period of ti=e and is as separate and independent as possible from the motor-driven system. By designing the auxiliary feedwater system so that it meets such criteria, there is ensured the independence between the motor-driven auxiliary teedwater pumps and the turbine-driven pump as well as assurance of the self sufficiency of the turbine-driven pump.
Reactor ccolant inventary is maintained by pressurizer power-operated relief valves, letdown valves, and reactor coolant pump seals. Pressurizer relief valves are air-operated and close when the air supply is exhausted.
The letdown stream is isolated by loss of ac power.
Included in the design features of the Sequoyah Nuclear Plant unit 1 that i
are required to meet the criteria is the application (whure electrical power is required by auxiliaries of the turbine-driven auxiliary feedwater pump) of battery-derived electrical power, which in turn can supply both de and ac, through the use of inverters, for seferal hours. Application 5
of this battery power is thereby used on solenoid-controlled air-operated valves used for the maintenance of the reactor coolant boundary as well
~
as for self-sufficiency of the turbine-driven auxiliary feedwater pump.
Thus, we believe that demonstration can be made of acceptable conditions, including acceptable core temperature, for safe shutdown in the event of loss of offsite and onsite ac power for several hours, af ter which it is credible to believe that ac power has been restored.
1 i
1 1
+
t I
i I
I s
l i
1 I
i j
s
4 13.
Discuss the relative reliability of the various subsystems withir the de power system. Does the redundancy in the number of banks of batteries extend through the whole system? Are there cases, even with a large number of batteries, where certain redundant safety systems are served by just two batteries? Are such systems normally on critical duty? To what extent has the potential for other systems in the plant for causing fai'ures of the de power system been looked at?
Response
Yhe vital battery system is designed with sufficient equipment to provide two independent ESF trains and four independent reactor protection channels. Characteristics of this equipment which serve to enhance the reliability of the vital battery system are:
2.
A spare 100 percent capacity charger is provided for each pair of main battery chargers, b.
Each battery charger is designed to supply all of the normally connected loads and still recharge the battery from the design discharge condition.
c.
The batteries are always connected to the distribution system. Battery charging takes place online.
d.
Battery discharges are monitored by a separate discharge ammeter with an alarm in the main control room, e.
The heaviest single loads on the vital battery system are the vital ac uninterruptible power supplies and the emergency de lighting boards. These loads only draw power from the vital batteries when the emergency AC buses are unavailable.
f.
The vital battery buses supply primarily Class IE loads with l
the accident loading essentially equal to the normal loading.
I:
All heavy non-lE loads, such as the turbogenerator emergency pumps and the non-1E uninterruptible power supplies, are supplied from a separate, non-1E battery.
a
14.
Is it clear, in light of the TMI-2 experience, that the decay heat can 4
be removed from the core without serious core damage after loss of the seconcary loop? What additional improvements could be made in existing primary side hardware which would increase the reliability of the decay heat removal process without assistance from the secondary loops? Some specific topics to be considered would be improvements in the PORV system and pilot motors (on emergency power) on the reactor coolant pumps.
Response
4 l
In light of the recent PORV analysis work performed by Westinghouse for the owners group taken in conjunction with WCAP 9600 results, it is apparent that depressurization through the PORV's i; an effective, decay heat removal method if the secondary loops are unavailable. The system would be depressurized to a point where the safety injection flow matches the flow through the PORV's.
The total effective size of the PORV's governs the rate of depressurization, while the time at which all the PORV's are opened governs the degree of initial depressurization.
The larger the 4
PORV capacity, the easier it is to depressurize to the point where safety injection flow matches break flow, thus permitting longer operator action times.
Evaluation of the capacity of the Sequoyah pressurizer PORV's, based on rated flow characteristics, shows that the PORV blowdown capability from all PORV's is adequate to remove decay heat from the core following loss f
of a secondary heat sink. A further evaluation of the adequacy of the i
PORV's for decay heat removal may be necessary based on the results of planned EPRI PORV flow capacity tests.
h i
,,..,4
~
r
...o 15.
Westinghouse has claimed that a significant capability exists for the "sweepout" of noncondensible gases for high points in the primary system during the natural convectica process. What plans exist for the experimental demonstration of this phenomena?
F,esponse In the March 26, 1980, ACRS Subcommittee hearings on natural circulation, liarold Sullivan of the NRC staff indicated that the LOFT facility would be used to examine natural circulation behavior under the influence of varying amounts of noncondensible gases.
In the subsequent subcommittee meeting on April 24, the NRC had not yet defined the test numbers or formulated a schedule for these tests.
The relative velocities of the primary RCS fluid and noncondensible grs subjected to natural circulation flow constraints depend on a number of factors such as the system pressure when natural circulation is taking place, the amount of noncondensible gas, the pressure drop across the tubes, l
configuration of the bubbles, etc.
Westinghouse has performed natural i
circulation calculations at 800 psia for a mass flow rate of 450 lbm/see with a void fraction of 0.5 which indicates that the fluid velocity is 0.75 ft/sec. A bubble dynamic force balance calculation was performed for bubbles in the downhill side of the steam generator tubes at 's00 psia and a void fraction of 0.5.
This calculation revealed that bubbles would remain effectively stationary in the tubes for a fluid velocity of 0.5 ft/sec.
Se, a fluid velocity of '
5 f t/sec would sweep bubbles from the downhill section of the tubes at the ntural circulation conditions cited.
=
.