ML19345C243
| ML19345C243 | |
| Person / Time | |
|---|---|
| Site: | Millstone  |
| Issue date: | 11/14/1980 |
| From: | Crutchfield D Office of Nuclear Reactor Regulation |
| To: | Counsil W NORTHEAST NUCLEAR ENERGY CO. |
| References | |
| TASK-05-10.B, TASK-05-11.A, TASK-05-11.B, TASK-07-03, TASK-09-03, TASK-5-10.B, TASK-5-11.A, TASK-5-11.B, TASK-7-3, TASK-9-3, TASK-RR LSO5-80-11-015, LSO5-80-11-15, NUDOCS 8012040211 | |
| Download: ML19345C243 (84) | |
Text
_.
D La f^
!(paug o,,
UNITED STATES s, s.,
g NUCLEAR REGULATORY COMMISSION g
.p WASHINGTON, D. C. 20555
- ...../
November 14, 1980 h
O Docket No. 50-245 v;
n L505-80-11-015 y
h y
e kh f.
Mr. W. G. Counsil, Senior Vice President
@5
M t' "
2, Nuclear Engineering and Operations j
Northeast Nuclear Energy Company 5
1 Post Office Box 270 '
,9 o
N Hartford, Connecticut 06101
Dear Mr. Counsil:
RE: SEP TOPICS V-10.8, V-11.A V-11.B. VII-3 and IX-3 (SAFE SHUTDOWN SYSTEMS) - MILLSTONE NUCLEAR POWER STATION, UNIT NO.1 Enclosed is a copy of our current evaluation of Safe Shutdown Systems (Revision 1) for Millstone Nuclear Power Station, Unit No.1.
Th)sassess-ment conpares your facility, as described in Docket No. 50-245, with the criteria currently used by the regulatory staff for licensing new facilities.
Please inform us if your as-built facility differs from the licensing basis assumed in our assessment within 90 days of receipt of this letter.
This evaluation will be a basic input to the integrated safety assessment for your facility unless you identify changes needed to reflect the as-built conditions at your facility. This assessment may be revised in the future if your facility design is changed or if NRC criteria relating to this subject is modified before the integrated assessment is completed.
I am also enclosing Staff Positions regarding the SEP Safe Shutdown Systems review for your facility.
Sin erely, Dennis M. Crutchfield, C ef Operating Reactors Branch #5 Division of Licensing l
Enclosures:
1.
Completed SEP Topics -
Safe Shutdown Systems 2.
Staff Positions cc w/ enclosures:
See next page 8012040$ll
o
..o
' Mr. W. G. Counsil November 14, 1980 cc w/ enclosures:
William H. Cuddy, Esquire Connecticut Energy Agency Day, Berry & Howard ATTN: Assistant Director Counselors at Law Research and Policy One Constitution Plaza Development Hartford, Connecticut 06103 Department of Planning and Energy Policy Natural Resources Defense Council 20 Grand Street-917 15th Street, N. W.
Hartford, Connecticut 06106 Washington, D. C.
20005 Director, Criteria and Standards Division Northeast Nuclear Energy Company Office of Radiation Programs-ATTN: Superintendent (ANR-460)
Millstone Plant U.~S. Environmental Protection P. O. Box 128 Agency Waterford, Connecticut 06385 Washington, D. C.
20460 Mr. James R. Himmelwright Northeast Utilities Service Company U. S. Environmental Protection P. O. Box 270 Agency Hartford, Connecticut 06101 Region I Office ATTN: EIS COORDINATOR Resident Inspector JFK Federal Building c/o U. S. NRC Boston, Massachusetts 02203 P. O. Box Drawer KK Niantic, Connecticut 06357 Richard E. Schaffstall.
KMC Incorporated Waterford Public Library 1747 Pennsylvania Avenue, N. W.
Rope Ferry Road, Route 156 Washington, D. C.
20006 Waterford, Connecticut 06385 First Selectman of the Town of Waterford Hall of Records 200 Boston Post Road Waterford, Connecticut 06385 John F. Opeka Systens Superintendent Northeast Utilities Service Company P. O. Box 270 Hartford, Connecticut 06101 4
t
a.
a
- ~
ENCLOSURE 1
)
SEP REVIEW OF SAFE SHUTDOWN SYSTEMS FOR THE MILLSTONE NUCLEAR POWER PLANT UNIT NO. 1 REVISION 1 Date: November 14, 1980
o.
9 '
TABLE OF CONTENTS Page 1.0 INTR 000CTION............................................
1 2.0 DISCUSSION.'.......
7 2.1 Normal Plant Shutdown and Cooldow1.................
7
- 2. 2 Shutdown and Cooldown with Loss of Offsite Power...
8 3.0 SHUTDOWN AND COOLDOWN FUNCTIONS AND METH005.............
10
- 4. 0 COMPARISON OF SAFE SHUT 00WN SYSTEMS WITH CURRENT NRC CRITERIA................................................
27 4.1 Functional Requirements............................
32 4.2 Residual Heat Removal System Isolation Requirements.......................
33 4.3 Pres sure Rel ie f Requi rements.......................
35 4.4 Pumo Protection Requirements.......................
36 4.5 Test Requirements..................................
37 4.6 Operational Procedures.............................
37 4.7 Auxiliary Feedwater Supply.........................
38 Table 4.1 Classification of Safe Shutdown System........
39 Table 4.2 List of Safe Shutdown Instruments.............
42 Table 4.3 Safe Shutdown Systems Power Supply and Location.........................................
44 5.0 RESOLUTION OF SYSTEMATIC EVALUATION PROGRAM TOPICS......
47 5.1 Topic V-10.B RHR System Reliability................
47
- 5. 2 Topic V-ll.A Requirements for Isolation of High and Low Pressure Systems....................
48 5.3 Topic V-ll.B RHR Interlock Requirements............
49 5.4 Topic VII-3 Systems Require for Safe Shutdown......
49
6.0 REFERENCES
52 APPENDIX A. Safe Shutdown Water Requirements.................
A-1 l
I vm
o o
1.0 INTRODUCTION
The Systematic Evaluation Program (SEF) review of the " safe shutdown" subject encompassed all or parts of the following SEP topics, which are among those identified in the November 25,.1977 NRC Office of Nuclear Reactor Regulation document entitled " Report on the Systematic Evaluation of Operating Facilities":
1.
Residual Heat Removal System Reliability (Topic V.10.8) 2.
Requirements for Isolation of High and Low Pressure Systems (Topic V-11.A) 3.
RHR Interlock Requirements (Topic V-ll.8) 4.
Systems Required for Safe Shutdown (Topic VII-3) 5.
Station Service and Cooling Water Systems (Topic IX-3)
The review was primarily performed during an onsite visit by a team of SEP personnel.
This onsite effort, which was performed during the period August 17 and 18, 1978, afforded the team the opportunity to obtain current information and to examine the applicable equipment and procedures, and it also gave the licensee (Northeast Nuclear Energy Company)'the opportunity to provide input into the review.
The review included specific system and equipment requirements for remaining in a hot shutdown condition
.ned in the Millstone Unit No. 1 Technical Specifications as all operable control rods fully inserted, reactor mode switch in shutdown, no core alterations being performed and reactor coolant temperature greater than 212*F) and for proceeding to a cold shutdown condition (defined as all operable control rods fully inserted, reactor mode switch in i
~
e a
2 the shutdown position, no core alterations being performed, reactor coolant temperature equal to or less than 212*F and the reactor vessel vented).
The review for transition from operating to hot shutdown considered the requirement that the capability exists to perform this operation from outside the control room.
The review was augmented as necessary to assure resolution of the applicable topics, except as noted below:
Topic V-ll.A (Requirements for Isolation of High and Low Pressure Systems) was examined only for application to the Shutdown Cooling System. Other high pressure / low pressure interfaces were not investigated. The shutdown cooling system is the Millstone Unit No. 1 equivalent of an RHR system.
Topic VII-3 (Systems Required for Safe Shutdown) was completed except for determination of design adequacy of the systems.
Topic IX-3 (Station Service and Cooling Water Systems) was only reviewed to consider redundancy and seismic and quality classification of cooling water systems that are vital to the performance of safe shutdown system components.
(No discussion of Topic IX-3 is included in the report.
The information gathered during the safe shutdown review will be used to resolve this topic later in the SEP.)
The criteria against which the safe shutdown systems and components were compared in this review are taken from the:
Standard Review Plan (SRP) 5.4.7,
" Residual Heat Removal (RHR) System"; Branch Technical Position RSB 5-1, Rev. 1, " Design Requirements of the Residual Heat Removal System"; and Regulatory Guide 1.139, " Guidance for. Residual Heat Removal." These documents
w 1
3 represent current staff criteria and are used in the review of facilities being processed for operating licenses.
This comparison of the existing systems against the current licensing criteria led naturally to at least a partial comparison of design crite;ia, which will be input to SEP Topic III-1, " Classification of Structures, Components and Systems (Seismic and Quality)." This report will also be reviewed for its application to the resolution of other topics.
As noted above, the five topics were examined while neglecting possible interactions with other topics and other systems and components not directly related to safe shutdown.
For example, Topics II-3.B (Flooding Potential and Protection Requirements), II-3.C (Safety-Related Water Supply), III-4.C (Internally Generated Missiles), III-S.A (Effects of Pipe Break on Structures, Systems and Compopents Inside Containment), III-6 (Seismic Design Considera-tions), III-10. A (Thermal-Overload Protection for Motors of Motor-Operated Valves), III-ll (Component Integrity), III-12 (Environmental Qualification of Safety-Related Equipment), and V-1 (Compliance with Codes and Standards) are among several topics which could be affected by the results of the safe shutdown review or could have a safety impact upon the systems which were reviewed.
These effects will be determined by later review.
Further, this review did not cover in any significant detail the reactor protection system l
nor the electrical power distribution, both of which will also be reviewed later.
The staff considers that the ultimate decision concerning the safety of any of the SEP facilities depends upon the ability to withstand the SEP Design Basis
o a
4 Events (DBEs).
The SEP topics provide a major input to the DBE review, both from the standpoint of assessing the probability of the event and that of determining the consequences of the event. As examples, the safe shutdown topics pertain to the listed 08Es (the extent of applicability will be determined during plant-specific review):
Impact Upon Probability Tooic DBE Group or Consequences of OBE V-10.B VII (Spectrum of Loss of Coolant Consequences Accidents)
V-ll. A VII (Defined above)
Probability V-11.8 VII (Defined above)
Probability VIII-3 All (Defined as a generic topic)
Consequences IX-3 III (Steam Line Break Inside Consequences Containment)
(Steam Line Break Outside Containment)
IV (Loss of AC Power to Station Consequences Auxiliary)
(Loss of all AC Power)
V (Loss of Forced Coolan' Flow)
Prcbability (Primary Pump Rotor Seizure)
(Primary fump Shaft Break)
VII (Defined above)
Consequences Completion of the safe shutdown topic review (limited in scope only as noted above), as documented in this report, provides significant input in assessing the existing safety 'argins at Millstone Unit No. 1.
m i
I l
s; 5
Piping System Passive Failures The NRC staff normally postulates piping system passive fa# lures as 1) accident initiating events in accordance with staff positions on piping failures inside and outside containment, 2) system leaks during long term coolant recirculation i
following a LOCA, and 3) failures resulting from hazards such as earthquates, tornadoes, missiles, etc.
In this evaluation, certain piping system passive-failures have been assumed beyond those normally postulated by the staff, e.g.,
the catastrophic failure of moderate energy systems.
These assumptions were made to demonstrated safe shutdown system redundancy given the complete failure of these systems and to facilitate future SEP reviews of DBEs and other types which will use the safe shutdown evaluation as a source of data for the SEP facilities.
SRP 5.4.7 and BTP RSB 5-1 do not require the assumption of piping system passive failures.
Credit For 0 erating Procedures For the safe shutdown evaluation, the staff may give credit for facility operating procedures as alternate means of meeting regulatory guidelines.
.Those procedural requirements identified as essential for acceptance of an SEP topic or DBE will be carried through the review process and considered in the integrated assessment of the facility.
At that time, we will: (1) decide which procedures are so important that they should be included in technical j
specifications and (2) establish an administrative procedure (e.g., FSAR changes) for ensuring that the other operating procedures are not changed l
l t
l l
a 6
not changed without appropriate consideration of their importance to the topic or DBE evaluations.
O
7 2.0 OISCUSSION 2.1 Normal Plant Shutdown and Cooldown Recirculation pump ficw is reduced by means of the individual loop normal flow controller which in turn lowers core power.
As core power is reduced, the reac.or pressure control system repositions the turbine control valves to maintain system pressure at approximately 1000 psig.
This flow reduction continues in a manner to produce the desired rate of power reduction until 6
32 x 10 lbs/hr is' achieved. One of the three condensate pumps is then stopped, and power reduction is continued by control rod insertion in a preselected pattern.
A feedwater pump and a second condensate pump and boosten pump are shut off.
Core flow is then reduced to its minimum value.
Feedwater control is maintained in automatic at this point. Before reaching 10% power, the station loads are transferred from the main generator by switching from the station service transformer to the reserve station transformer.
Power reduction to 10%
continues with control rod insertion, and then the speed load changer is used for continued load recuction.
Before load is reduced to zero, the turbine generator is taken out of service and steam is bypassed to the main condenser to remove care heat.
l The reactor conlant system (RCS) recirculation pumps are running at minimum speed, one feedwatar train is in service, the turbine is on turning gear, and RCS pressure is in " automatic." Control rod insertion continues while subcritical until all rods are in.
l l
l
.c
.~.,e.
a 8
The RCS is cooled at a rate of less than 100*F per hour by bypassing steam to the main condenser.
Shutdown cooling can be placed in service at RCS pressure of < 150 psig and loop temperature < 350 F (interlocked).
This step is usually delayed until the bypass valves are closed, main steam line isolation valves are closed, the reactor vessel level is increased via the feedwater system, and the vessel head cooling system is in service to achieve more uniform vessel head cooling. The shutdown cooling system (SCS) is now placed in service, with reactor building closed cooling water system (RBCCW) providing cooling water on the secondary side of the SCS heat exchanger.
The RBCCW heat exchangers are in turn cooled by the service water system which takes and returns cooling water from Long Island Sound. This system is normally used to bring the RCS below 212*F cold shutdown. Generally, the RCS is brought to approximately 125 F and maintained at this value by adjusting flow through RBCCW or SCS heat exchangers.
- 2. 2 Shutdown and Cooldown with Loss of Offsite power A loss of offsite power would not automatically result in the loss of the main condenser and a reactor trip because the plant is designed to withstand this transient while dumping steam to the condenser.
However, if the condenser were unavailable for heat removed, the reactor could stay in the hot condition briefly while pressure is controlled with relief valves.
If pressure continued to remain high, the isolation condenser would activate automatically or could be manually initiated. The single closed valve in the return condensate line is opened, and main steam passes through the isolation condenser tubes boiling off water in the secondary side of the condenser. Makeup water to the secondary side of the condenser is provided by transfer pumps taking suction
e a
9 from the condensate storage tank. Thus, the reactor is cooled by boiling until the SCS initiation temperature limit is reached. The SCS may then be put in service as above since the RBCCW and service water systems are powered by onsite electrical sources. -Cooldown is acccmplished as in 2.1.
If the isolation condenser were unavailable, a full feedwater string could be powered by the onsite gas turbine driven generator and cooling could be provided by controlled venting via relief valves and the feedwater system.
Alternatively, the reactor may be depressurized with relief valves and low pressure coolant could be injected via the low pressure coolant injection system which is powered by onsite power.
1 l
- - - -. i
10 3.0 SHUTDOWN AND C00LDOWN FUNCTIONS AND METH005 This section will describe the systems available at Millstone Unit No.1 (Millstone 1) to accomplish the necessary functions for the safe shutdown of the reactor following either the loss of offsite power or the loss of onsite AC power.
Seismic and quality group classifications of the pertinent equipment (based upon USNRC Regulatory Guides 1.26 and 1.29) will be addressed in Section 4.0.
The losses of offsite and onsite AC power are not considered to be concurrent or sequential events, but rather, for the purposes of this evaluation, are taken as wholly independent occurrences.
The loss of onsite AC power is a situation which presents little difficulty for Millstone 1.
Upon loss of the unit auxiliary transformer, which is supplied from the station main generator, power is automatically provided by the station startup transformer (Reserve Station Service Transformer), which is in. turn supplied from the 345 kV switchyard.
The 345 kV switchyard is connected to three 345 kV lines, any of which can supply power to the startup transformer, keeping all auxiliary loads operating.
This transformer can supply all auxiliary loads for Millstone 1 with the unit's main generator operating at full power.
In-depth consideration has been given to recovery from the unlikely loss of all l
offsite power. Millstone 'I has the capability for bypass to the condenser of 100% of the steam generated by the reactor at full power.
Since Millstone l
Unit 2 (a pressurized water reactor) does not have this bypass capability, 1
m
0 4
1 11 l
l Millstone 1 is automatically separated from the power grid upon loss of two (out of three) 345 kV transmission lines, thus providing an outlet for Unit 2's generated power.
Upon loss of the two (or three) 345 kV lines, automatic Millstone 1 actions, requiring no operator response except verification, include a select rod insert and APRM high flux setdown to 90%. When this decrease in power occurs, and the bypass valves automatically open, the feedwater heaters will no longer be effective since the automatic throttling down of the turbine control valves and intercept valves will decrease the amount of extraction steam being supplied to the feedwater heaters.
This results in a decrease in feedwater temperature and a subsequent increase in power.
The operator, as part of his procedural immediate action, will decrease reactor power to the minimum attainable using the recirculation pump master manual controller and will adjust generator speed and excitation as required to maintain house loads.
As part of subsequent action, the operator will start the diesel generator and gas turbine generator, further assuring maintenance of in-house loads.
An automatic reactor scram is included in the generator load rejection (loss of offsite power) protective circuitry.
This scram will occur only if the bypass valves fail to open within 260 milliseconds following load rejection. Reliance would then be placed upon the emergency power sources.
Millstone 1 has experienced two full load rejection incidents, both attributable to lightning strikes.
During the first such incident all systems functioned as intended. During the second, a turbine trip and scram occurred due to a secondary system malfunction.
However, at the time of the scram the
o 12 diesel generator was running, as required by procedure, and it picked up essential loads immediately, assuring safe shutdown and actually demonstrating the Millstone i safe shutdown capability.
Even if a diesel were not running, the generator lockout signal on turbine trip would start the diesel and gas turbine.
Northeast Nuclear Energy Company (NNECO) is considering modification of this starting feature because it results in spurious starts (upon turbine trips when offsite power is available).
It is obvious, from the above discussion, that under " normal" loss of offsite power conditions, the plant's capability to run back to house loads will assure the ability to stay hot with the core cooled, and the requirement to start both emergency power sources will assure power to systems, including feedwater (powered by the gas turbine generator) utilized for shutdown and cooldown.
Should a loss of offsite power be followed by a reactor scram, the isolation condenser would automatically initiate at reactor vessel pressure greater than or equal to 1085 psig for 15 seconds.
The isolation co. denser consists of:
a shell designed to American Society of Mechanical Engineers (ASME) Boiler.and Pressure Vessel Code Section VIII for 15 psig at 300*F; two tube bundles designed to ASME Section III and designed.for 1250 psig (full reactor coolant system pressure) at 575 F, and associated connections for draining, filling, venting, and level measurement.
ine isolation condenser capacity will be equal to the decay heat five minutes after isolation. Although the isolation condenser will assist in removing decay heat after the 1085 psig 15 second timer completes its sequence and initiates condenser flow, initial pressure relief is provided by the six
a 13 electro pneumatic relief valves. The valves, which all have relief setpoints at 1095 psig, will then lift as necessary to prevent excessive pressures until the decay heat ratio has decreased to isolation condenser capacity.
Three of the electro pneumatic relief valves have 800,000 lb/hr capacity each, with the others each having 840,000 lb/hr relief capacity. All are DC powered, but require air for opening and remaining open.
The accumulators (one per valve) are sized for three openings of their valve and with their connections to the valves are Class I.
The remainder of the air supply system to these valves and accumulators is not Class I.
However, even in the highly unlikely dual loss of the isolation condenser and the air supply to the accumulators, the combination of valve opening and the feedwater coolant injection system (FWCIS-to be discussed later) will be satisfactory to depressurize the reactor coolant system.
The isolation condenser system contains four motor-operated valves, two on the steam line from the dedicated reactor vessel nozzle to the condenser, and two on the condensate return line to one of the two reactor coolant system recirculation loops. One valve on each line (steam and condensate) is inside containment and is powered by " emergency" AC from motor control center (MCC) 2-3, which is supplied by the gas turbine generator upon loss of offsite and main generator power. The valves are not shed from the bus upon loss of normal power and are automatically reenergized when bus power is restored.
The diesel generator can also supply power to these valves if the gas turbine should be inoperable.
i
e 14 The two valves outside containment, one on the steam line, the other on condensate, are powered by DC from 125 volt DC MCC DC-11A-1.
The DC powered valve on the condensate return line to the reactor vessel is the only one of the four moter-operated valves which is normally shut and which must open to initiate flow.
(The condenser tubes are thus normally pressurized to reactor coolant system pressure.) This valve is located outside containment and can be manually actuated in case of motor failure.
The isolation condenser systen inciries excess ficw sensors on both steam and condensate lines, which would close all four valves upon sensing a break in either lin'e.
This isolation system has in the past been adjusted to be too sensitive, which could possibly cause system isolation as the condenser was initiating.
If this were combined with the highly unlikely simultaneous loss of MCC 2-3, it would result in condenser isolation with no means of re-initiating flow because of the inaccessibility of the two AC powered valves.
However, NNECO has adjusted the sensitivity of the excess flow sensors, and is considering the addition of a redundant power supply for the two AC valves, although no action has yet been taken to implement such a change.
Level in the shell (low pressure) side of the isolation condenser is automatically controlled.
Level control switches function to maintain a level between 69 and 80 inches by operating the makeup-to-condenser shell valve 1-IC-10.
This valve is AC powered from MCC 2-1 and will be powered even upon loss of normal AC power sources.
The valve is readily accessible in the reactor building and can be manually operated should the need arise.
It is
l 15 also operable from the control room, in a remote-manual mode, if the automatic level control system should fail.
6 Makeup water to the isolation condenser is normally supplied by the condensate transfer system from the condensate storage tank (225,000 gallons minimum).
However, the demineralized water storage tank (50,000 gallons), which is adjacent to the condensate storage tank, can also be used to supply water to the condensate transfer system through a normally locked-closed valve which is easily accessible. There are two condensate transfer pumps in the system, both of which can be provided power from the gas turbine generator upon loss of all other AC sources. There is an air-operated valve on the discharge of each
~
transfer pump. The valve, which prevents flow surges on pump start, will fail open upon loss of instrument air, and it can be manually overridden, thus assuring a supply of water to the condenser.
In the unlikely event that the condensate transfer system should fail, the fire water system can be used to supply makeup to the isolation condenser. The fire water system which is a shared system with Millstone Unit No. 2 includes two electric pumps and a diesel-driven pump, which is highly reliable according to plant sources.
The diesel engine is provided a 250 gallon fuel supply, normally kept at least half full.
Approximately eight hours of running time can be obtained from 125 gallons of fuel.
The fire water is supplied from two tanks, each of which contain 250,000 gallons.
7 Makeup to the tanks is from a 12-inch city water supply line, thus providing substantial makeup capability.
There are only manual valves in the fire water l
system line providing isolation condenser makeup.
i
l 16 After the reactor has been sufficiently depressurized by the isolation condenser system, the shutdown cooling system is utilized to maintain the reactor coolant system in a cold shutdown condition.
The shutdown cooling system (SCS) takes its suction from one of two recirculation loops and exits the drywell through a normally-closed AC powered motor-operated valve.
Outside the drywell, the line divides into two separate branches, each containing (as major equipment) a CC powered motor-operated isolation valve, a pump, a heat exchanger, and a second DC powered motor-operated isolation valve.
The two branches rejoin hrf or to reentering the drywell, and outside the drywell is an AC powered motor-operated isolation valve prior to the system's discharge into the low pressure coolant injection system (LPCIS) and hence into the reactor coolant system.
The shutdown cooling system was designed for full reactor coolant system pressure (1250 psig) at 350 F.
It incorporates interlocks to assure the system will not operata until temperature requirements are met. The AC-and OC powered valves may be opened at any time.
However, the SCS pumps may not be started until the suction pressure exceeds 4 psig and the reactor coolant temperature is below 350*F as measured by sensors on each reactor coolant recirculation loop.
The SCS will isolate automatically upon low reactor water level, which shuts only the system inlet (AC) valve. Although the discharge (AC) valve does not isc! ate at this time, a check valve downstream of the discharge valve was included in the system to prevent reactor coolant system backflow through the SDCS. Both AC-F <ered va? es will isolate upon initiation of the LPCIS.
17 The SCS will also automatically isolate by pump trip on increase of water temperature to greater than 350'F.
Recent plant analysis indicates that the system would have no adverse effects if the interlocks were overridden and the SCS operated on a one-time basis at greater than 350*F.
Power to the AC suction valve is provided by MCC 2A-3 and power to the AC discharge valve by MCC 2-3.
Althougn both MCCs can be supplied by emergency sources, failure of either MCC could result in the SCS being inoperable, since the valves are inside containment and are therefore inaccessible.
Each of the four DC-isolation valves is powered from 125 volt DC MCC DC-llA-1.
Cooling to the SCS heat exchangers and SCS pump bearings and packings is provided by the reactor building closed cooling water (RBCCW) system.
Each RBCCW pump is 100% capacity, but depending upon time of year and temperature, operators must drop other RBCCW loads in order that the SCS functions as intended. Normally only two of the three RBCCW heat exchangers (which are in turn cooled by service water) are required for SCS cooling within 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> after shutdown.
Both RBCCW pumps are tripped upon loss of normal AC power and power must be restored by operator action. One pump can be supplied by the diesel generator and one by the gas turbine generator, so diversity of power supplies exists.
There are two AC powered motor-operated isolation valves in the RBCCW system /SCS system interface. One valve is on the RBCCW discharge from the SCS heat exchanger, and the other is on the line for RBCCW suction from
1 18
" nonessential" loads (SCS is a nonessential load during normal operation).
Both valves receive emergency AC power from MCC 2-2 and access is available for manual operation should this MCC fail.
The RBCCW heat exchangers are cooled by the service water (SW) system. There are four SW pumps, only one of which is necessary for cooling the R8CCW under reactor shutdown conditions. However, two pumps can be suoplied from emergency sources. One is supplied from the gas turbine generator, is not shed from the bus upon loss of power, and is therefore automatically reenergized when the gas turbine generator picks up load.
The other is supplied by the diesel generator, is shed from the bus, but is picked up automatically when the diesel generator begins to pick up loads.
In addition, a third pump can be added if enough other loads are shed from the emergency power supplies.
All valves supplying service water to the RBCCW heat exchangers are manually operated.
The SCS is at a higher pressure than the RBCCW system, and RBCCW system pressure is higher than the SW system. Although a leakage path from the SCS heat exchangers through the RBCCW heat exchangers to the environment is unlikely, radiation monitors have been added to the cooling medium discharge of the heat exchangers. These monitors provide warning of any leakage.
The discussion above has centered on the primary means utilized at Millstone 1 f
to depressurize the reactor and provide cooling following a loss of offsite j
(AC) power and a subsequent reactor scram. However, even assuming a loss of the isolation condenser, Millstone 1 has substar+4al backup capability to
19 attain a hot or cold shutdown condition.
This capability is in the form of the feedwater coolant injection system (FWCIS), combined with the electro pneumatic relief valves and either the low pressure coolant injection (LPCI) system or core spray (CS) system.
The FWCI system consists of one condensate pump, one condensate booster pump, and one feedwater pump, all powered by the gas turbine generator. Two complete
" strings" of pumps (out of three) are available for FWCI operation, with selection of string A or 8 made from the control room.
The only motor-operated valves in the systera are the Feed Water Regulating Valves, located outside the containment and thus accessible if necessary for manual operation for reactor coolant level control in the reactor vessel.
The pumps in the selected FWCI string will not restart automatically upon restoration of AC power (as provided by the gas turbine generator) unless a low-low reactor water level signal or high drywell pressure signal (or both) exists. These signals from the reactor protection system are indicative of a loss-of-coolant accident and would automatically enable the pump starting logic.
In the absence of such automatic initiation, the operator will bring the FWCI system on manually as provided by procedure.
Because the gas turbine generator is not ready to load for 48 seconds after starting, the electro pneumatic relief valves will be required to operate, relieving pressure, until the FWCI system is operating.
At that time, the injection, at rates up to 8000 gpm of cold water, will provide substantial i
depressurization, resulting in the reclosure of relief valves.
If the FWCI should provide such significant inventory that reactor vessel water level
o.
20 1
becomes too high prior to depressurization and concurrent temperature decrease to SCS initiation limits, the operator can utilize the relief valves to continue depressurization or can increase discharge from the reactor vessel through the reactor water cleanup system.
As noted, FWCI system operation depends upon the proper operation of the gas turbine generator. This turbine has not been as reliable as anticipated in the FSAR and a later (1973) reliability study.
Problems have included, among others, logic errors, erroneous tripping of speed switches, and failure to meet the design 48-second on-line time.
Also, as noted above, NNECO is considering modification of gas turbine starting circuits to preclude starting upon generator lockout when offsite power is available.
The 48-second time delay to gas turbine loading readiness and the 64-second time delay to FWCI automatic initiation, as described in FSAR Table VIII-7, are considered satisfactory and would not result in core uncovery in this scenario.
Figure XIV-2.6 of the FSAR notes that 115,000 lb of coolant would have to be discharged through a inain steam line break prior to uncovery of the top of the core. As noted above, three of the relief valves have 800,000 lb/hr capacity, and three have 840,000 lb/hr capacity, providing a ?otal of 4,920,000 lb/hr blowdown, or 82,000 lb/ min, if all relief valves conservatively remain open.
This means 1.4 minutes (84 seconds) would elapse prior to uncovery of the top of the core.
Since the operator would realize after one or more relief valves had lifted that the isolation condenser had failed to initiate, he could direct his actions to bring FWCI on the line for depressurization.
-6 21 Even assuming the multiple failure of the isolation condenser and the gas turbine generator /FWCI combination, Millstone I still retains the capability to depressurize and cool down by remote-manual use of the relief valves and either the core spray or low pressure coolant injection (LPCI) engineered safety systems.
According to the SAR (Page VI-2.31), the relief valves, even when used automatically (with a time delay) under the adverse automatic initiation conditions (small loss-of-coolant accident break and coincident indication of reactor low-low level, drywell high pressure and FWCI low flow), can depressurize the vessel in sufficient time to allow core spray or LPCI systems (discussed below) to provide adequate core cooling to prevent clad melting, even though the core is temporarily and partially uncovered.
(SAR Figures VI-2.25 and VI-2.26).
Under the circumstancer of this analysis we have assumed, in addition to the loss of offsite power, the loss of both the isolation condenser and the FWCI system.
In this case, the operator could choose to remain at hot standby, maintaining level with the centrol rod dr /e system while relieving pressure through the relief valves.
If plant conditions dictated the need to immediately decrease pressure and cool the system, the use of the relief valves would serve this purpose, and would probably accomplish the necessary depressurization prior to uncovering the top of the core.
However, even were the level to decrease to the low-low water level prior to blowdown initiation, the SAR analysis mentioned above concludes that no clad melting would occur.
[
We find the temporary and partial uncovery of the core in this scenario to be
{
an acceptable event, given first that we have assumed an extremely low l
22 probability occurrence and second that no core melting would occur since a large influx of cooling water would be available upon completion of the depressurization. Note that if tha FWCI system were available to provide makeup to the recirculation system, the blowdown could be conducted in a deliberate manner, unlike the automatic initiation condition postulated in the SAR, and no core uncovery would occur.
The core spray system consists of two independent trains, each drawing water from the torus (the condensate storage tank is an alternate supply) and delivering it to the vessel through dedicated spray nozzles.
Each train is rated at 3600 gpm (at 90 psig), which is 100% of that required by loss-of-coolant accident analyses.
Even though one core spray pump is powered from a bus normally supplied by the gas turLine generator during a loss of offsite power, this bus will be supplied by the diesel should the gas turbine fail to start.
However, only one pump can be energized at a time by the diesel generator because of load limitations.
If the first pump signaled to start does not, the second may be started.
(If the gas turbine were available, but the diesel were not, the loads would be supplied by the gas turbine generator in the same manner.)
There ere three motor-operated valves in each train, each of wnich is powered from emerg_ncy buses.
However, only one valve in each train is required to operate (open) to admit water to the core.
Failure of this valve to open can be readily overcome, since the valve is located outside primary containment.
23 Another system which would be available to provide cooling water to the reactor vessel is the low pressure coolant injection (LPCI)/ containment spray cooling system.
This system includes four pumps, in two independent trains, only three of which are necessary to provide 100% design system flow (15000 gpm at 0 psi).
The fourth pump can be started if any of the others fail.
Although starting of the pumps is automatic only in a LOCA situation, they can all receive power from the diesel generator and would thus be available in this scenario.
Like the core spray system, the LPCI system can inject water into the core once reactor coolant system pressure is decreased to 300 psig.
All motor-operated valves in the LPCI system, in addition to being provided power from buses which can be supplied from the diesel generator, are outside primary containment and can be manually operated.
Water for the LPCI system is taken from the torus.
Approximately 630,000 gallons of water is available for use.
The LPCI discharge is directed into either (or both) reactor recirculation loop at the discharge of the recirculation pump.
Excess inventory in the core could be let down through the reactor water clean-up system to the radioactive waste treatment system, or alternatively to the main condenser hotwell.
Although cooling of the torus water (after the relief valve blowdown for l
reactor depressurization) will probably not be necessary during the shutdown and maintenance of core cooling, in the short term, the capability exists l
within the LPCI/ containment cooling system to provide such cooling.
Each train l
24 of two pumps includes a heat exchanger, the shell side of which is provided water by the emergency service water (ESW) system.
The ESW system includes four pumps, two supplying water to one train's heat exchanger and two to the other.
These pumps can be provided power from the diesel generator, once other loads such as unneeded LPCI pumps have been shed from the bus. One LPCI pump, in the containment spray cooling mode, and one ESW pump can then be utilized to cool the torus water, while core spray provides cooling water to the core.
All motor-operated valves in the containment spray cooling system are on buses capable of supply from the diesel, and ce also external to containment and thus accessible for manual actuation.
The two m' tor operated ESW valves on the o
discharge of the heat exchangers are also accessible for manual operation in case of motor or power supply failure.
Only one aspect remains to be addressed - the loss of either RBCCW or SW 1
systems, resulting in loss of shutdown cooling system capability and subsequent reheating of the reactor coolant system.
If the isolation condenser were i
available, the situation presents little difficulty in that the condenser will provide necessary cooling and only requires makeup water to the shell side, as discussed above.
In the absence of the isolation condenser (admittedly an extnmely unlikely multiple failure, but discussed here only to illustrate the substantial backup capability of Millstone 1), the operators could choose either of two methods for core cooling.
The first method is the use of the relief valves to relieve pressure and decrease inventory, followed by the judicious use of core spray or LPCI systems to provide cold water and make up inventory losses. Carried to
e 25 its extreme, this method could result in complete filling of the reactor vessel with discharga through the relief valves to the torus, return to the vessel by LPCI, and torus cooling by containment cooling spray.
The staff is continuing to assass the ability of the electropneumatic relief valves to remain open for the extended period of time necessary for long term core cooling in the cold shutdown condition without the availability of the plant air systems.
The other method available to the operators if the temperature at initiatici is less than 200?F is to let down hot water through the reactor water cleanup (RWCU) system to the main condenser or radioactive waste system, accepting damage to the demineralizer resins of the RWCU system and overriding the high temperature interlock which would otherwise isolate RWCU (the RWCU system nonregenerative teat exchanger is cooled by RBCCW, assumed to be out of service because of its own failure or that of the SW system). While discharging water through the RWCU system, cold water could be added to the vessel from core spray or LPCI.
If the RBCCW and SW systems were operable but shutdown cooling were not, some cooling could still be maintained by increasing the RBCCW flow to the RWCU system aonregenerative heat exchanger.
Conclusion As can be readily seen from the foregoing discussion, Millstone Unit I has the ability to withstand multiole failures and still retail the capability to decressurize ed cool tLe reactor core, l
.a
.)
i i
e i
'26 i
t
~
We are satisfied that Millstone Unit No.' 1 can be safely shut down upon loss.of
~
~
onsite or offsite AC power, even considering failure of a single major component.
t.
4-I 9
1 e
t i
a i
i 1
1 i.
I i
1-9 i
J l
i~,
27 i
4.0 COMPARISON OF SAFE SHUTDOWN SYSTEMS WITH CURRENT NRC CRITERIA The current criteria used in the evaluation of the design of systems required to achieve cold shutdown for a new facility are listed in the Standard Review Plan (SRP) Section 5.4.7 and Branch Technical Position RSB 5-1 (or proposed Regulatory Guide 1.139). This section discusses the comparison of these criteria with the safe shutdown systems of the Hillstone Unit 1 nuclear power plant.
"A.
Functional Requirements The system (s) which can be used to take the reactor from normal operating conditions to cold shutdown
- shall satisfy the functional requirements listed below.
1.
The design shall be such that the reactor can be taken from normal operating conditions to cold shutdown
- using only safety grade systems.
These systems shall satisfy General Design Criteria 1 through 5.
2.
The system (s) shall have suitable redundancy in components and features, and suitable interconnections, leak detection, and isolation capabilities to assure that for onsite electrical power system operation (assuming offsite power is not available) and for offsite electrical power system operation (assuming onsite power is not available) the system function can be accomplished assuming a single failure.
3.
The system (s) shall be capable of being operated from the control room with either only onsite or only offsite power available with an assumed single failure.
In demonstrating that the system can perform its function assuming a single failure, limited operator action outside of the control room would be considered acceptable if suitably justified.
" Processes involved in cooldown are heat removal, depressurization, flow circulation, and reactivity control. The cold shutdown condition, as described in the Standard Technical Specifications, refers to a subtritical reactor with a reactor coolant temperature no greater than 200 F for a PWR and 212*F for a BWR.
4 28 4.
The syttem(s) shall be capable of bringing the reactor to a cold shutdown condition, with only'offsite or onsite power available, within a reasonable period of time following shutdown, assuming the most limiting single failure."
Background
A " safety grade" system is defined, in the NUREG 0138 (Reference 1) discussion of issue #1, as one which is designed to seismic Category 1 (Regulatory Guide 1.29), quality group C or better (Regulatory Guide 1.26), and is operated by electrical instruments and controls that meet Institute of Electrical and Electronics Engineers Criteria for Nuclear Power Plant Protection Systems, (IEEE 279).
The Millstone Unit 1 nuclear power plant was constructed prior to the issuance of Regulatory Guides 1.26 and 1.29 (as Safety Guides 26 and 29 on 03/23/72 and 06/07/72 respectively).
Also Proposed IEEE 279, dated August 30, 1968, was issued late in the construction phase of the facility.
General Design Criterion 1 requires that these systems be designed, fabricated, erected and tested to quality standards, that a quality assurance (QA) program be implemented to assure that these systems perform their safety functions and that an appropriate record of design, fabrication, erection and testing be kept. At the time that Millstone 1 was licensed, the NRC (then AEC) criteria for QA were under development. Since that time, various QA related regulations and criteria have been. instituted by the NRC, and the QA program for operation of the plant was approved by the staff on November 5,1976.
4
29 The plant Technical Specifications and QA program require appropriate QA records to be kept.
General Design Criterion 2 requires that structures and equipment important to safety be designed to withstand the effects of natural phenomena without loss of capability to perform their safety function.
The Staff SER (Reference 2) addressed the design of the Millstone Unit i nuclear power plant with respect to natural phenomena.
In case of flooding caused by a hurricane, the Staff stated that "the plant can be shutdown and maintained in a safe condition since the critical equipment required for such action is protected to at least 25 ft. mean sea level" and the maximum flood height postulated by the Staff was 20.7 ft mean sea Tevel.
The licensee's seismic design bases specify that for ground accelerations of 0.17g, there will be no loss of function of critical structures and components necessary to ensure a safe and orderly shutdown.
The Staff, in the SER, agreed that the accelerations were aopropriate and these conclusions were correct.
The Staff SER also states that "the design of Unit 1 is adequata to assure safe plant shutdown considering the effects of wind loadings and potential missiles."
These conclusions will be reviewed as part of the SEP.
General Design Criterion 3 raquires that structures, systems and components important to safety be designed and' located to minimize the effects of fires and explosions.
l
30 The Staff has completed an evaluation of the fire safety requirements of the Millstone Unit i nuclear power plant.
The results of this evaluation are given in Reference 3.
General Design Criterion 4 requires that equipment important to safety be designed to withstand the effects of environmental conditions for normal operation, maintenance, testing and accidents.
Equipment should also be protected against dynamic effects such as internal and external missiles, pipe whip and fluid impingement.
The SEP will evaluate the extent to which Millstone Unit 1 conforms to GDC 4 when reviewing topics III-12 " Environmental Qualification of Safety Related Equipment," III-5.A " Effects of Pipe Breaks Inside Containment," III-5.8 " Pipe Breaks Outside Containment," and III-4 " Missile Generation and Protection."
4 General Design Criterion 5 relates to the sharing of structures, systems and components important to nuclear safety among nuclear units.
Millstone Unit 1 and Millstone Unit 2 (a PWR) are both presently in operation at the same site. Several systems are common to both ' nit I and Unit 2.
Among those systems, the following are important for safe shutdown and cooldown of Unit 1:
(1) As mentioned in Section 3, Millstone Unit 1 has 100% bypass capability and is automatically separated from the power grid upon-loss of two out of three 345. lev transmission lines.
This provides an outlet for the generated power of Unit 2.
31 (2) The firewater system includes two 250,000 gallon tanks.
These tanks are common to both Unit I and Unit 2.
(3) One of the two electrically powered fire pumps is powered from Unit 2.
The sharing of systems'between the two nuclear units at the Millstone site will be reviewed as part of SEP Topic VI-10.B " Shared Engineered Safety Features, On Site Emergency Power and Service Systems for Multiple Unit Facilities."
The BTP RSB 5-1 functional requirements focus on the safety grade systems that can be used to take the reactor from operating conditions to cold shutdown. The staff and licensee developed a " minimum list" of systems necessary to perform this task. Although other systems may be used to perform. shutdown and cooldown functions, the following list is the minimum number of systems required to fulfill the BTP RSB 5-1 criteria:
1 1.
Reactor Control and Protection System 2.
Six Electropneumatic Relief Valves (3 of which constitute the Automatic Pressure Relief System of the ECCS) 3.
Feedwater Coolant Injection System l
4.
Service Water System (for diesel generator cooling) 5.
Low Pressure Coolant Injection / Containment Spray System 6.
Emergency Service Water System (for containment cooling) 7.
Instrumentation for shutdown-and cooldown*
^ Safe shutcown instruments are identified in Table 4.2.
32 8.
Emergency Power (AC and DC) and control power sr the above systems and equipment.
In addition to these systems, other systems may function as backup for the above systems and components.
The preceding discussion in Section 3 described both these systems and the systems which may function as backup. Table 4.1 lists the minimum' safe shutdown systems for the Millstone Unit 1 Nuclear Power Plant along with a comparison of present criteria with the criteria to which these components and subsystems were designed. Table 4.3 provides safe shutdown system power supply and location information.
The functional requirement to achieve cold shutdown conditions within a reasonable period of time is evaluated in A; pendix A.
4.1 Functional Recuirements The Reactor Centrol and Protection System (RCPS) is designed on a channelized basis to provide physical and electrical isolation between redundant reactor trip channels.
Each channel is functionally independent of every other channel and receives power from two independent sources.
The power source for the RCPS is the instrument buses which can receive power from either onsite or offsite sources.
The RCPS fails safe (tripped) on loss of power.
The system can be manually tripped both from the control room and from other locations outside the control room.
The RCPS is designed so that a single failure will not prevent a reactor trip.
Initiation of a reactor trip causes the insertion of sufficient reactor control rods to make the core i
subcritical from any credible operating condition assuming the most reactive control rod remains in the fully withdrawn position.
a 33 The design of the RCPS, as well as safe shutdown related electrical control and power systems will be evaluated later in the SEP.
The normal shutdown systems (and backup systems) have been reviewed in Section 3.
The isolation condenser would normally be relied upon for couling from full power conditions upon loss of the main condenser which is not available upon loss of offsite power.
The isolation condenser is czpable of cooling the reactor tJ rear cold shutdown conditions.
If the pressure is reduced to the actuation pressure of the LPCI or core spray systems by the FWCI or Automatic Pressure Relief Systems, either of these systems could be manually initiated and would take the reactor to cold shutdown conditions.
Thus, even if the shutdown cooling system at Millstone Unit I were inoperable, the reactor can be taken to cold shutdown conditions using the Emergency Core Cooling System (ECCS).*
4.2 RHR System Isolation Requirements The RHR system shall satisfy the isolation requirements listed below.
1.
The following shall be provided in the suction side of the RHR system to isolate it from the RCS.
(a) Isolation shall be provided by at least two power-operated valves in series.
The valve positions shall be indicated in the control room.
- The staff is continuing to evaluate the ability of the electro-pneumatic relief valves to function without the plant air systems for extended periods of time.
1 1
34 (b) The valves shall have independent diverse interlocks to prevent the valves from being opened unless the RCS
' pressure is below the RHR system design pressure.
Failure of a power supply shall not cause any valve to change position.
(c) The valves shall have independent diverse interlocks to orotect against one or both valves being open during an RCS increase above the design pressure of the RHR system.
The purpose of these requirements is to provide assurance that a low pressure shutdown cooling system will not be exposed, either through a single operator error or failure of a single valve to a pressure greater than design pressure.
However, the Millstone Unit 1 Shutdown Cooling System is designed.for reactor coolant system design pressure, 1250 psig.
The design temperature is 350*F, which is lower than the reactor coolant system design temperature (575*F).
It is likely that the SCS could withstand the design pressure at the higher temperature on a one time basis.
As pointed out in Section 3, multiple failures of valves (all of which are normally shut) and interlocks would be necessary-in ceder for this situation to exist.
Section 3 dascribed the interlock on the RHR system which prevents opening of the suction and discharge valves on the SCS if the reactor coolant temperature in either coolent recirculation loop is greater than 350*F.
The valves are motnr operated and would fail in their "as-is" condition (which would be closed unless the SCS were in operation). Additionally, the pumps will trip, stopping flow and exposure to temperature, should coolant temperature increase.to 350*F.
Thus, the Millstone Unit 1 SCS' meets the present criteria for SCS system l
isolation.
J e
35 2.
One of the foowing shall be provided on the discharge side of the RHR system to isolate it from the RCS:
(a) The valves, position indicators, and interlocks described in item 1 (a)-(c).
(b) One or more check valves in series with a normally closed power-operated valve.
The power-operated valve position shall be indicated in the control room.
If the RHR system discharge-line is used for an ECCS function the power-operated valve is to be opened upon receipt of a safety injection signal once the reactor coolant pressure has decreased below the ECCS design pressure.
/) Three check valves in series. or (d) Two check valves in series, provided that there are design provisions to permit periodic testing of the check valves for leak tightness and the testing is performed at least annually.
The Millstone Unit 1 SCS has two motor operated valves, one AC (inside containment), one DC (outside containment on each leg) which meet the requirements of 2.(a).
4.3 Pressure Relief Requirements The RHR system shall satisfy the pressure relief requirements listed below.
1.
To protect the RHR system against accidental overpressurization when it is in operation (not isolated from the RCS), pressure relief in the RHR system shall be proviGed with relieving capacity in accordance with the ASME Boiler and Pressure Vessel Code. The most limiting pressure transient during the plant operating condition when the RHR system is not isolated from the RCS shall be considered when selecting the pressure relieving capacity of the RHR system.
For example, during shutdown cooling in a PWR with no steam bubble in the pressurizer, inadvertent operation of an additional charging pump or inadvertent opening of an ECCS accumulator valve should be j
considered in selection of the design bases.
25 2.
Fluid discharged through the RHR system pressure relief valves must be collected and contained such that a stuck open relief valve will not:
a.
Result in flooding of any safety-related equipment.
b.
Reduce.the capability of the ECCS below that needed to mitigate the consequences of a postulated LOCA.
c.
Result in a non-isolatable situation in which the water
-provided to the RCS to maintain the core in a safe condition is discharged outside of the containment.
A 3.
If interlocks are provided to automatically close the isolation valves when the RCS pressure exceeds the RHR system design pressure, adequate relief capacity shall be provided during the time period while the valves are closing.
The Shutdown Cooling System at Millstone Unit 1 is independent of the ECCS.
Therefore, a failure of the Shutdown Cooling System would not affect the ECCS.
Since the Shutdown Cooling System is designed for reactor design pressure, the reactor safety / relief valves could pro +4ct the Shutdown Cooling System as well as the reactor vessel from a pressure transient.
4.4 Pump Protection Recuirements The design and operating procedures any RHR system shall have provisions to prevent damage to the h.' system pumps due to overheat-ing, cavitation or loss of adequate pump suction fluid.
The SCS pumps are provided with bypass lines which return the pump discharge flow to the pump suction.
Thus, even if the downstream valve were closed while the pump was running, the pump would be protected from overheating.
Cavitation protection is provided by the interlock which trips-the pump (and prevents its starting) if the suction pressure falls below 4 psig.
A temperature interlock also protects the pump from overheating by tripping the pump if the temperature is greater than or equal to 350*F.
37 4.5 Test Requirements The isolation valve operability and interlock circuits must be designed so as to permit on line testing when operating in the RHR mode. Testability shall meet requirements of IEEE Standard 338 and Regulatory Guide 1.22.
This is discussed in Section 5 of this report.
The preoperational and initial startup test program shall be in conformance with Regulatory Guide 1.68.
The programs for PWRs shall include tests with supporting analysis to (a) confirm that adequate mixing of borated water added prior to or during cooldown can be achieved under natural circulation conditions and permit estimation of the times required to achieve such mixing, and (b) confirm that the cooldown under natural circulation conditions can be achieved within the limits specified in the emergency operating procedures.
Comparison with performance of previously tested plants of similar design may be substituted for these tests.
Regulatory Guide 1.68 was not in effect when Millstone Unit 1 was being designed and constructed; however, the licensee committed to and performed preoperational tests of the Shutdown Cooling System during startup of Millstone Unit 1 to confirm operability, and many uses have shown the system to be reliable for removing decay heat.
The licensee performs an annual calibration check of the temperature isolation interlocks of the Shutdown Cooling System.
4.6 Ooerational procedures The operational procedures for bringing the plant from normal operating power to cold shutdown shall be in conformance with Regulatory Guide 1.33.
For pressurized water reactors, the operational procedures shall include specific procedures and information for cooldown under natural circulation conditions.
The licensee has procedures to perform safe shutdown operations including-shutdown to hot standby, operation at hot standby, hot shutdown, operation at
a 38 hot shutdown and cold shutdown including long-term decay heat removal.
The licensee has also provided the operating staff procedures covering off-normal and emergency conditions for reactor shutdown and decay heat removal under conditions of loss of system or parts of system functions normally needed for shutdown and cooling the core.
Procedures for operation of systems used in safely shutting down the reactor are also included in the plant operating procedures.
These procedures include provisions identified in Regulatory Guide 1.33.
These procedures were reviewed and are in conformance with Regulatory Guide 1.33.
Certain operations were identified to the reviewers which constitute alternate ways and paths to achieve cooling water source alignment or heat sink alignment.
Some of these methods are not included in their procedure system.
4.7 Auxiliary Feedwater Supply The seismic Category I water supply for the auxiliary feedwater system for a PWR shall have sufficient inventory to permit operation at hot shutdown for at least 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br />, followed L,y cooldown to the conditions permitting operation of the RHR system.
The inventory needed for cooldown shall be based on the longest cooldown time needed with either only onsite or only offsite power available with an assumed single failure.
Boiling Water Reactors such as Millstone 1 do not have an auxiliary feed system.
However, the cooling water inventory requirements for a safe shutdown of the faci.lity, using the systems identified in Section 4.0, are evaluated in Appendix A.
TABLE 4.1 CLASSIFICATION OF SAFE SHUTDOWN SYSTEMS MILLSTONE 1 Quality Group Seismic Plant Plant Components / Subsystems R.G. 1.26 Design R.G. 1.29
- Design Remarks i
Automatic Pressure Relief System Valves (3)
ASME III ASME III Category I Class I Class 1 Containment Torus ASME III ASME III Category I Class I Contains water supply Class 2 Class B for CS and LPCI systems Feedwater Coolant ASME III-
?
Category I Class II Boundary of system Injection system Class 2 provided in Referenca 4.
Condensate System ASME III
?
Category I Class II The piping in the condensate Class 2 and feed systems is Class II um but has been shown to meet Class I requirements.
Main Condenser ASME III
?
Category I Class II hots'lls Class 2 FWCI. Condensate ASME III
?
Category I Class II Class I requirements.
Transfer Pumps Class 2 Condensate Storage ASME-III
?
Category I Class I Tank Class 2 Sarvice Water System ASME III
?
Category I Class I Bourndary of system Class 3 provided in Reference 4.
. ~
TABLE 4.1 (Continued)
Quality Group Seismic Plant Plant Components / Subsystems R.G. 1.26 Design R.G. 1.29 Design Remarks low Pressure Coolant Injection / Containment Spray System Pumps (4)
ASME III ASV.E III Category I Class I Class 2 Class C Piping and valves ASME III ASME III Category I Class I Class 2 Class C Categoryk Class I Heat exchangers (2) ASME III ASME III tube side Class 2 Class C shell side ASME III ASME VIII Category I Class I (ESW)
Class 3 Tema Class R
Emergency Service Water System Pumps (4)
ASME III
?
Category I Class I Class 3 Emergency Power System Diesel generators NA Category I Class I DC Systems NA
TABLE 4.1 (Continued)
Quality Group Seismic Plant Plant Components / Subsystems R.G. 1.26 Design R.G. 1.29 Design Remarks Gas turbine generator NA Category I Class I Diesel generator mechanical ASME III
?
Category I Class I auxiliaries Class 3 Instrumentation and NA Category I Class I Centrol Systems D
4 t
g
TABLE 4.2 LIST OF SAFE SHUTDOWN INSTRUMENTS Component / System Instrument Instrument Location References R: actor Recirculation Reactor Vessel Level System
(
Reactor Vessel Wide Range Pressure (
Pressure Suppression Torus temperature TE Reactor Build. Corner DWG. G-187476 System (torus)
(Room (-26')
TR Control Room Emergency Service ESW flow FT Reactor Build. Corner DWG. G-187476 Water System Rooms (-26')
(FT 1542 A&B, RI 1540-1A&lB)
FI Control Room Low Pressure Coolant LPCI flow FT Reactor Build. Corner DWG. G-187476 Injection / Containment Rooms (-26')
g Spray System (FT 1549 A&B, FR 1540-7)
FR. Control Room Feedwater Coolant iWCI Pressure PT Turbine Build.
DWG. G-187482 Injection, System (P1&PR 2-27 & 2-28)
Pi Control Room Condenser Hotwell Level LT Turbine Build.
(LT 2-1 & 2-2,iRC 2-1)
LRC Control Room Condensate Storage Tank LT DWG. G-187487 Level (LT & LI 7-50)
LI Control Room Diesel Generator Generator output Control Room voltage and current Gas Turbine Generator Generator output Control Room voltage and current
TABLE 4.2 (Continued)
Component / System Instrument Instrument Location References Service Water System SWS to diesel generator PS Diesel Gen. Room DWG G-187484 pressure alarm PAL Control Room (PS & PAL 4-55)
Emergency AC Power Bus energized indication Control Room (4KV Buses 1,3,4,5,6,7, 480 V Buses 2, 2A)
Emergency DC Power Bus energized indication Control Room (125 V Buses 1 & 1A)
O t
)
,,y TABLE 4.3 SAFE Sil0TDOWN SYSTEMS POWER SUPPLY AND LOCATION Component / System Power Supply Location Automatic Pressure Air operated In drywell (approx. 80')'
Relief valves 125 VDC Air Control Solenoids feedwater Coolant Injection System feed pumps lA, IB, 1C 1A, 1B - 4KV Bus #1 Turbine Build. (14')
IC - 4KV Bus #2 condensate pumps IA, 18 - 4KV Bus #3 Turbine Build. (14')
1A, IB, 1C condensate booster pumps IA, 18 - 4KV Bus #3 Turbine Build. (14')
1A, IB, 1C IC - 4KV Bus #4 FWCI condensate transfer 4KV Bus #3 Reactor Build. Corner pump Room (-8') NW Condensate Storage Tank In yard, north of Reactor Build.
Low Pressure Coolant Injection / Containment Spray System pumps IA, IB, IC, ID 1A & IC 4KV Bus #6 IB &lD 4KV Bus #5 Reactor Build. Corner Room (-26') NE heat exchangers Reactor Build. Corner Room (-26') SW
4 TABLE 4.3 (Continued)
~
Component / System Power Supply Location Emergency Service Water System pumps IA, IB, 1C, ID 1A & IC - 4KV Bus #6 Reactor Build. Corner 1B & ID - 4KV Bus #5 Rooms (-26')
Strvice Water System pumps 1A, 18, 1C, 10 1A - 4KV Bus #3, IB - 4KV Bus #4 Screen House IC - 4KV Bus #5, 10 - 4KV Bus #6 Diesel Generator Air started Turbine Build.
125 VDC Control Power (12') SF side 480 V Bus 2 & 2A (diesel auxiliaries)
,m Gas Turbine Generator Air started Emerg. Turbine 125 VDC Control Power Generator Building 4KV Bus
- 1 4KV Bus #7 or Offsite Power Turbine Build. (36')
4KV Bus
- 2 Offsite Power Turbine Build. (36')
4KV Bus
- 3 4KV Buses #5, #7* or Offsite Power Turbine Build. (36')
4KV Bus
- 4 4KV Buses #6, #7* or Offsite Power Turbine Build. (36')
4KV Bus
- 5 Diesel Generator or 4KV Bus #3*
Turbine Build. (36')
4KV Bus
- 6 Diesel Generator
- or 4KV Bus #4 Turbine Build (36')
1
- Normal source during loss of offsite power.
T 1
TABLE 4.3 (Continued)
Component / System Power Supply Location 4
4KV Bus
- 7 Gas Turbine Generator or Offsite Power Turbine Build. (36')
(27KV line) 480V Bus
5 a
6 I
- i i
. 5.0 RESOLUTION OF SEP TOPICS The SEP topics associated with safe shutdown have been identified in the INTRODUCTION to this assessment. The following is a discussion of how Millstone Unit No. 1 (Millstone 1) meets the safety objectives of these topics.
5.1 Topic V-10.B RHR System Reliability The safety objective for this topic is to ensure reliable plant cooldown capability using safety grade equipment subject to the guidelines of SRP 5.4.7 and BTP RS8 5-1.
The Millstone 1 systems have been compared with these criteria, and the results of these comparisons are discussed in Section 4.0 of
~'
this assessment.
Based on these discussions, we have concluded that the Millstone I systems fulfill the topic safety objective with the following comments:
1.
The Shutdown Cooling System and isolation condenser are not considered to be safety grade systems.
However, the ECCS systems, including FWCI, ADS, LPCI, and Core Spray, can be utilized to effect reactor cooldown.
2.
Component redundancy and single-failure proof requirements are not met in the case of the shutdown cooling system, in that failure of the AC powered suction valve inside containment would result in loss of the system.
However, the ECCS systems would still be available.
l
. 3.
Component redundancy (and single-failure proof) requirements are also not met in the case of the isolation condenser. The single supply (steam) and return (condensate) lines each include an AC powered isolation valve which is inside containment.
Failure of these valves in the closed position would result in system inoperability.
However, these valves are normally open and fail open on loss of electrical power.
As noted in Section 3, it would take simultaneous spurious isolation of the condenser and loss of the power supply to create any problem. Additionally, even if this highly unlikely scenario were to occur, the ECCS systems would still'be available.
4.
No procedure exists to perform a shutdown and cooldown to cold conditions with the systems identified in Section 4.0.
The lic.ensee will be required to develop such a procedure.
5.2 Topic V-ll.A Requirements for Isolation of High and Low Pressure Systems The safety objective of this topic is to assure that adequate measures are taken to protect low pressure systems connected to the primary system from being subjected to excessive pressure which could cause failures and in some cases potentially cause a LOCA outside of containment. As noted in Section I, only the shutdown cooling system was examined.
The shutdown cooling system is designed for full reactor pressure but less than full reactor temperature.
Therefore, interlocks (with the exception of the pump suction low pressur?
interlock) are based upon temperature considerations.
i
m System operation cannot begin until temperature in both reactor coolant recirculation loops and at the pumps' suctions is less than 350*F (and pump suction pressure exceeds 4 psig). This will enable pump-start permissive interlocks and allow the system to be started. Additionally, the pumps will trip, effectively isolating the system (a check valve on the system discharge prevents backflow) if temperature should increase to 350*F when the system is in operation.
Because of the system's full pressure design and the incorporated interlocks (even though they are temperature-based), we consider the applicable requirements to have been met.
Also, there are annual calibration requirements for these interlocks which we consider acceptable.
5.3 Tooic V-ll.B RHR Interlock Recuirements f
The safety objective of this topic is identical to that of Topic V-11.A.
The staff conclusion regarding the Millstone 1 interlocks, as discussed in Section 5.2, is that adequate interlocks exist.
In addition to these requirements, and as a matter to be resolved separately from the SEP, the NRC staff has determined that certain isolation valve configurations in systems connecting the high-pressure Primary Coolant System (PCS) to lower-pressure systems extending outside containment are potentially significant contributors to an intersystem
. loss-of-coolant accident (LOCA). Such configurations have been found to represent a signif'; ant factor in the risk computed for core melt accidents (WASH-1400, Event V). The sequence of events leading to the
- 49a -
core melt is initiated by the failure of two in-series check valves to function as a pressure isolation barrier between the high-pressure PCS and a lower-pressure system extending b.eyond containment. This causes an overpressurization and rupture of the low-pressure system, which results in a LOCA that bypasses containment.
The NRC has determined that the probability of failure of these check valves as a pressure isolation barrier can be significantly reduced if the pressure at each valve is continuously monitored of if each valve is periodically inspected by leakage testing, ultrasonic examination, or radiographic inspection. NRC has established a program to provide increased assurance that such multiple isolation barriers are in place in all operating Light Water Reactor plants. This program has been designated 00R Generic Implementation Activity B-45.
In a generic letter of February 23, 1980, the NRC requested all licensees to identify suxceptible valve configurations which may exist in any of their plant systems communicating with the PCS, For plants in which valve configurations of concern were found to exist, licensees were further requested to indicate:
- 1) whether, to ensure integrity, continuous surveillance or periodic testing was currently being conducted, 2) whether any valves of concern were known to lack integrity, and 3) whether plant procedures should be revised or plant modifications be made to increase reliability.
e
i 5.4 Topic VII-3 Systems Required for Safe Shutdown The Safety objectives of this topic are:
1.
To assure the design adequacy of the safe shutdown system to (a) initiate automatically the operation of appropriate systems, including the reactivity control systems, such that specified acceptable fuel design limits are not exceeded as a result of anticipated operational occurrences or postulated accidents, and (b) initiate the operation of systems and components required to bring the plant to a safe shutdown.
2.
To assure that the required systems and equipment, including necessary instrumentation and controls to maintain the unit in a, safe condition during hot shutdown are located at appropriate locations outside the control room and have a potential capability for subsequent cold shutdown of the reactor through the use of suitable procedures.
3.
To assure that only safety grade equipment is required for a plant to bring the reactor coolant system from a high pressure condition to a low pressure cooling condition.
Safety objective 1(a) will be resolved in the SEP Design Basis Event reviews.
These reviews will determine the acceptability of the plant response, including automatic initiation of safe shutdown related systems, to various Design Basis Events, i.e., accidents and transients.
~
. Objective 1(b) relates to availability in the control room of the control and instrumentation systems needed to initiate the operation of the safe shutdown systems and assures that the control and instrumentation systems in the control room are capable of following the plant shutdown from its initiation to its conclusion at cold shutdown conditions.
The ability of Millstone 1 to fulfill objective 1(b) is discussed in the preceding sections of this report. Based on these discussions, we conclude that safety objective 1(b) is met by the safe shutdown system at Millstone 1 subject to the findings of related SEP Electrical Instrumentation, and Control topic reviews.
Safety objective 2 would require the capability to shutdown to both hot shutdown and cold shutdown conditions using systems, instrumentation, and controls located outside the control room.
The Millstone 1 procedures include four directed at shutdown outside the control room, two of which assume that initial actions have been taken inside the control room.
Two also assume failure of the isolation condenser. The procedures provide the steps to operate the necessary equipment to place the plant in a shutdown condition.
None of these include specific steps to proceed to cold shutdown conditions. The licensee will be required to provide such procedures.
The adequacy of the safety grade classification of safe shutdown systems at Millstone Unit No.1, to show conformance with safety objective 3, will be completed in part under SEP Topic III-1, " Classification of Structures, Components, and Systems (Seismic and Quality)," and in part under the Design Basis Event reviews.
Table 4.1 of this report will be used as input to Topic III-1.
1,
i
- 6. 0 REFERENCES 1.
Staff Discussion of Fifteen Technical Issues Listed in Attachment to z
November 3,1976 Memorandum from Director, NRR to NRR Staff, NUREG 0138, November 1976.
2.
Letter to Millstone from AEC Division of Reactor Licensing transmitting Safety Evaluation Report for Millstone Unit 1, March 13, 1976.
3.
Letter to W. G. Counsil, Northeast Nuclear Energy Company from D.
L. Ziemann, USNRC dated September 26, 1978.
4.
Northeast Utilities letter W. Council to D. Ziemann, dated September 13, 1979 forwarding additional information on Millstone 1 Inservice Inspection and Testing Program.
f 1
APPENDIX A SAFE SHUTDOWN WATER RE0VIREMENTS 1
Introduction Standard Review Plan (SRP) 5.4.7, " Residual Heat Removal (RHR) System" and Branch Technical Position (BTP) RSB 5-1, Rev. 1, " Design Requirements of the Residual Heat Removal System" are the current criteria used in the Systematic Evaluation Program (SEP) evaluation of systems required for safe shutdown.
BTP RSB 5-1 Section A.4 states that the safe shutdown systems shall be capable of bringing the reactor to a cold shutdown condition, with only offsite or onsite power available, within a reasonable period of time following shutdown, assuming the most limiting single failure.
BTP RSB 5-1'Section G, which i
applies specifically to the amount of auxiliary feed system (AFS) water of a pressurized water reactor available for steam generator feeding, requires the seismic Category I water supply for the AFS to have sufficient inventory to permit operation at hot shutdown for at least four hours, followed by cooldown to the conditions permitting operation of the RHR system.
The inventory needed for cooldown shall be based on the longest cooldown time needed with either only onsite or only offsite power available with an assumed single failure.
A reasonable period of time to achieve cold shutdown conditions, as stated in SRP 5.4.7 Section III.5, is 36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br />.
For a reactor plant cooldown, i
the transfer of heat from the plant to the environs is accomplished by using water as the heat transfer medium.
Two modes of heat removal are available.
The first mode involves the use of reactor plant heat to boil water with the i
A-1
i resulting steam venteo to the atmosphere.
The water for this process is typically demineralized, " pure" water stored onsite and, therefore, is available only in. limited quantities. The systems designed to use this type of heat removal process (boiloff) are the steam generator for a pressurized water reactor (PWR) or the emergency (isolation) condenser for a boiling water reactor (BWR). The second heat removal mode involves the use of power operated relief valves to remrve heat in the form of steam energy dirtctly from the reactor coolant syste.a.
Since it is not acceptable to vent the reactor coolant system directly to the atomosphere following certain accidents, the steam is typically vented to the containment building from where it is removed by containment heat removal systems.
The containment heat removal systems are in turn cooled by a cooling water system which transfers the heat to an ultimate heat sink - usually a river, lake, or ocean. When using the blowdown mode, t
reactor coolant system makeup wcter must be continuously supplied to keep the reactor core covered with coolant as blowdown reduces the coolant inventory.
Systems employing the blowdown heat removal mode have been designed into or backfitted onto most BWRs.
The efficacy of the blowdown mode for PWRs has received increased staff attention since the Three Mile Island Unit 2 accident in March 1979. Additional studies of the viability of this mode for PWRs are in progress or planned.
This evaluation of cooling water requirements for safe shutdown (and cooldown) is based on the use of the systems identified in the SEP Review of Safe Shutdown Systems which has been completed for each SEP facility.
The Review of Safe Shutdown Systems used SRP 5.4.7 and BTP RSB 5-1 as a review basis.
It.
should be noted that the SEP Design Basis Events (DBE) reviews, which are A-2
currently in progress, may require the use of systems other than those which are evaluated in this report for reactor plant shutdown and cooldown.
In those cases, the water requirements for safe shutdown will have to be evaluated using the assumptions of the 08E review.
DISCUSSION The requirement that a plant achieve cold shutdown conditions within approx-imately 36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br />, as profferred in BTP RSB 5-1 and SRP 5.4.7, is based mainly on the fact ttJt the amount of onsite-stored water for the AFS of a PWR is limited, and it is desirable to be able to place the RHR system in operation and transfer the plant heat to an ultimate heat sink prior to the exhaustion of the onsite-stored AFS water supply.
Remaining in a hot shutdown condition, with reactor coolant system temperature and pressure in excess of RHR initiation limits, requires the continued expenditure of pure water via the boiloff mode to remove reactor core decay heat. A BWR relying on the emergency condenser system for cooldown would also be susceptible to the potential exhaustion of onsite-stored pure water.
Should the onsite-stored water supply at a plant be expended, the capability usually exists to use raw water from a river, lake or ocean for example, to supply the boiloff systems. However, use of raw water can lead to the degradation, through corrosion, of the boiloff system materials, i.e., steam generator and emergency condenser tubes. This degradation can occur rapidly even if fresh water makeup is used.
If seawater ~ were used, chloride stress -
corrosion cracking of the tubes could occur well within one week.
If raw A-3
4 fresh water were used, caustic stress corrosion cracking of tube materials could occur,in less than 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> for both stainless steel and inconel tube ma'erials through NaOH concentration.* A plant cooldown and depressurization would help reduce the rate of tube. cracking by reducing the stresses in the tube materials.
Also, the leakage rate of reactor coolant through potential cracks in the tubes would be reduced if the plant were in a cool, depressuaized state.
The original design criteria for the SEP facilities did not require the ability to achieve cold shutdown conditions.
For these plants, and for the majority of operating plants, safe shutdown was defined as hot shutdown.
Therefore, the design of the systems used to achieve cold shutdown was determined by the reactor plant vendor and was not based.on any safety concern. Our safe shutdown reviews have pointed out a differnece in the vendor approach to system design for cold shutdown.
This difference is reflected in the Standard Technical Specification definition of cold shutdown.
For a BWR, cold shutdown requires reactor coolant temperature to be $ 212 degrees Fahrenheit.
For a PWR, cold shutdown requires reactor coolant temperature to be 1 200 degrees Fahrenheit.
These differences in cold shutdown temperatures require the use of additional systems to achieve cold shutdown for a PWR over and above the systems needed for a BWR.
For example, a BWR could use an isolation condenser alone to reach 212 degrees Fahrenheit (although the approach to 212 degrees Fahrenheit would be asymptotic); but a PWR, in addition to the steam generators, must use an RHR and supporting systems to get below 200 degrees Fahrenheit.
i
- "vanRooyen, Daniel,and Martin W. Kendig, ' Impure Water in Steam Generators and Isolation Generators,' BNL-NUREG-28147, Informal Report, June 1980,"
i A-4
.l EVALUATION Table 1 provides plant specific data and assumptions used in the staff calculation of safe shutdown water requirements for the Millstone 1 nuclear plant.
Table 2 provides the results of the calculation. The systems used to conduct the cooldown are i<.'entified in Section 4.0 of the SEP Safe Shutdown Report for Millstone 1.
The cooldown method employed is reactor system depressurization (and cooling) with the safety / relief valves.
Reactor system inventory is maintained by the feedwater coolant injection (FWCI) system at high pressures until the low pressure cooling injection (LPCI) can supply flow.
(The contol rod drive hydraulic system could also be used to maintain reactor system inventory at high pressur es, but no credit is taken for t.t.s system since it was not designed as a safety system.) The LPCI pumps can inject water to the reactor system at a pressure of approximately 350 psig or less.
No credit is taken in this analysis for the reactor system cooldown caused by the injection of cold water by the FWCI.
In this analysis, the FWCI is assumed to be strictly a makeup system to maintaiq reactor system coolant inventory.
Reactor system temperature as a function of time during the cooldown is snown on Figure 1.
After reactor trip, the plant is heating up to the safety / relief valv6 setpoint (558*F) because the main condenser is no longer available for l
heat removal (offsite power is lost). One of three relief valves in the Automatic Pressure Relief System is capable of removing core decay he.
a few seconds after reactor trip.
A-5
After one of the relief valves lift, the reactor system coolant inventory will begin to decrease, and a feedwater coolant injection (FWCI) pump is used to maintain reactor vessel level. The FWCI pump capacity (8000 gpm) is sufficent to maintain vessel level immediately after the reactor trip. The source of water for the FWCI pump is the Condensate Storage Tank (CST) which contains a minimum of 225,000 gal. (1,876,500 lb.) of water for FWCI use alone.
The relief valves discharge to the primary containment torus.
The volume of i
water which is normally stored in the torus provides a heat sink for the energy removed from the reactor system by condensing the steam discharged from the relief valves.
To cool the torus, the plant operator would use the contain-ment heat removal systems:
LPCI and emergency service water (ESW).
The ESW system transfers the reactor system heat to the ultimate, heat sink.
When reactor system pressure is reduced to below 350 psig, the LPCI system can take over the coolant injection function of the FWCI.
Since the LPCI system obtains its water from the torus, consumption of onsite pure water ceases, and long term reactor cold shutdown conditions would be maintained by the relief valves, LPCI, ESW and the primary containment systems.
In the above described cooldown, the single active failure that was postulated was the failure of one safety / relief valve out of the three available.
The LPCI and ESW have redundant trains and any single active failure would not prevent these systems from performing their functions.
If a failure of the FWCI pump power supply were assumed, the operator would be required to A-6
t commence the cooldown immediately by opening the relief valves to depressurize the reactor system sufficiently for LPCI system use.
This would be done by manually starting the LPCI system and initiating the Automatic Pressure Relief (APR) system.
l Based on our review of safe shutdown water requirements at Millstone 1, we have concluded that sufficient onsite-stored pure water exists to perform a plant cooldown in a reasonable period of time in accordance with BTP RSB 5-1.
However, as noted in Section 5.1 of the SER Review of Safe Shutdown Systems, the licensee must develop a procedure for shutdown and cooldown with the systems identified in Sectioh 4.0 of that report.
A-7
d 4
4 TABLE 1 Plant: Millstone 1 Power (MW):
2011 Normal Operating Temp. (*F): 547 Safety valve lift (psig):
1115 Initial secondary inventory (lbm): NA Secondary makeup vater temp. (*F): NA PORV flow area (ft 2): 0.098 (one safety / relief valve)
Emerg. Condenser total ht. xfer. coeff.: NA Stored sensible heat (bTV/*F):
fuel - 29000, metal - 224,000 water - 1,540,000 Pure water onsite (1bm):
1,876,500 (technical specification limit in the CST)
Cooldown assumptions:
4 1.
At t=0 reactor trips.
2.
Oecay is in accordance with proposed ANS 5.1 (1973).
3.
Plant remains at hot shutdown for four hrs. prior to cooldown.
4.
Relief valve mass flow rate is in accordance with the Moody critical flow model.
4 I
A-8
~
24
' e TABLE 2 Plant: Millstone 1 Phase I (reactor trip to safety lift):
Time to safety valve lift (sec):
30 Phase II (safety valve lift to cooldown start):
Time to boil secondary dry, assume no' feedwater (min): NA Decay heat generated prior to cooldown start (BTU):
338E6 Feedwater expended prior to cooldown start (1bm):
257,400 lb (from the CST)
Phase III (cooldown):
(a APR valve)
Time (hrs)
Temperature (*F)
Pressure (psia)
Decay heat generated (BTU) 4 558 1115 338E6 4.5 401 249 368E6 5
365 162 396E6 6
331 104 451E6 8
301 68 553E6 10 283 51 646E6
'1 12 272 43 732E6 22 250 30 1098E6 24 248 29 1180E6 A-9
600 FIGURE 1 REACTOR SYSTEM TEMPERATURE VS TIME 4 1 relief valve opened 500 C
o._,
M!
400 RM n!rp
. __ _ _ SCS initiation temperature 300 l
1 i
l i
200 0
TO T5 20 26 TIME (HOURS) l l
BNL-NUREG-28147 INFORMAL REPORT LIMITED DISTRIBUTION l
Ii4 PURE WATER IN STEAM GENERATORS AND ISOLATI0fl GENERATORS Daniel van Rooyen and Martin W. Kendig June 1980 Corrosion Science Group Department of Nuclear Energy Brookhaven National Laboratory Upton, New York 11973 NOTICE: This document contains preliminary information and was prepared primarily for interim use. Since it may be subject to revision or correction and does not represent a final report, it should not be cited as reference without the expressed consent of the author.
l l
FIN A3106 1
i I
-m
,.v_.
e TABLE OF CONTENTS Page
SUMMARY
1 ST AT EM ENT O F P R0 B L EM......................................................
2 CHLORIDE STRESS CORROSION CRACKIf;G........................................
3 CA UST I C C RA C KI NG..........................................................
5 Local Boiling, Chemical Reactions, Species in Sol ution..................
6 Ra tes of SCC of SS and Inconel 600 i n Cau sti c...........................
8 CRACKING OF INCONEL AND SS IN RELATIVELY PURE WATER WITH A SMALL AMOUNT OF OXYGEN PRESENT................................................
10 R E FE R E N C E S................................................................
12 FIGURE 1..................................................................
13 TABLE 1...................................................................
14 APPENDIX A................................................................
A-1 O
I I
1 I
i i
1 ItiPURE WATER IN STEAtt GENERATORS AND ISOLATION GEllERATORS Daniel van Rooyen and itartin W. Kendig Corrosion Science Group Department of ?!uclear Energy Brookhaven National Laboratory Upton, ?!ew York 11973 I
SUMMA P.Y 1.
Stress corrosion cracking (SCC) can occur in stainless steel (SS) and Inconel 600, but they do not behave in the same way.
C.
55 is prone to SCC in Cl~ as well as NaOH.
Inconel 600 is less prone to SCC in NaOH, and nonnally resists SCC in C1~.
3.
Impure water ingress into PWR steam generators or BWR isolation condensers is discussed in terms of Cl" - cracking and MaOH cracking, taking into account the kinetics of chemical changes, concentration changes and SCC.
Changes in chemistry are relatively rapid.
is present. The pH droo 4.
Cl cracking of SS can occur at low pH or if 03 in the use of sea water is believed to be less important than the presence of 0 -
2 5.
t!aOH cracking is a greater likelihood in SS than in Inconel, although both materials are susceptible.
6.
Operation at temperature for up to a week with incure water may lead to SCC of the tubes by Cl or NaOH.
7.
Elinination of 0 will reduce the chances of Cl~ SCC of SS, NaOH cracking 2
of Inconel, or pure water cracking of sensiti:ed SS.
8.
Silica may hold catential as an incredient to suporess caustic femation due to concentration effects in alkaline impure waters.
9.
Lowering the temoerature as nuickly as cossible would also be beneficial in a steam generator with Inconel 600 tubes and a caustic-ferming environrent.
1 l
i STATEMENT OF PRCBLEM A meetinn was held in late June 1979 in Bethesda to discuss the matter of
.imoure water that may be introduced into PWR steam generators or SWR isolation condensers.
J. R. Weeks and D. van Rooyen represented BNL.
It was said that new plants are or will be required to have a 36-hour supply of feedwater avail-able in case of emergency. Also, such new plants are being designed to be caoable of reaching cold shutdown within a period of 36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br />.
In older plants, there are no such rules for supplies of feedwater to be available, and if it becomes ' exhausted for sore reason then the plant would have to use an inpure source for emergency cooling under cold shutdown is reached.
Some of these plants may only have a 30 minute supply of pure water on hand.
Of major concern to the !!RC is the possibility that stress co'rrosion crack-ing (SCC) will occur.
Tube materials are typically stainless steel (SS) or Inconel 600, and both of these materials under certain conditions are subject to SCC. The most likely impure water that would find entry in steam generators or isolation condensers would be sea water, lake water, river water or water frca a nunicipal supply.
In the case of sea <ater, the pH of the resulting solu-tion will drop and chloride can concentrate in crevices or at areas of local boiling.
Essentially, threa problems are associated with chloride entry, i.a., those of SCC, accelerated corrosion of carbon steel and pitting. Of these, only the cracking of SS in chlorides is addressed in the section on sea water because pitting and denting are not forms of corrosion associated with safety questions in the time ceriod of about one week.
Fresh water, from which carbon dioxide could be expelled, if ir.troduced into a stean generator or isolation condenser, is usually exoected to shcw a oH rise, so that caustic cracking may become a problem. The oH can also rise as a result of the reaction of Na salts in the impure water with existing oxides or hydroxides in the systen, giving free ?!aCH.
In this case, both Inconel 500 and SS are known to underco SCC.
River water or other sources of fresh water are known to con-tain sodium salts, and therefore, the matter of caustic crackinc will be dis-cussed in this secticn, including both of these alloys..
e The questions that were raised by NRC for Brookhaven to look into concern mainly the matter of time.
In other words, how long can a certain impure water be tolerated in the components that have been mentioned above? An additional question concerns the possibility of additions or other steps that could be taken to reduce or mitigate the effects of the impure water on tube integrity.
It was agreed that the Brookhaven review would consider a period of approx-imately one week which would cover temperatures from operating temperature dcwn to cold shutdown.
In practice, a substantial portion of this time period would involve boiling and steaming while orderly emergency procedures and repairs are carried out. NRC felt that one week would be a reasonable basis for the present analysis.
CHLORIDE STRESS CORROSION CRACKING Chloride cracking is considered a potential problem for SS but not for Inconel 600 tubing, which has a hich nickel content. The cracking of SS in chlorides depends both on the chloride concentration, the pH of the solution, and the electrochemical potential. The higher the ootential" the less chloride is usually required for cracking to start, and the opposite is also true. When Cl" is introcaced, the pH can be lowered in local recions such as c-evices.
For this to happen, local corrosion is needed. The latter is stimulated by 0
r xidi:ing species. The pH drop will affect SCC, but since the oxidi:ing 2scecies will do the same, we emphasi:e the oxidi:ing aspect in this discussion.
A curve showing the relationshio between chloride concentration and oxygen con-centration was developed many years age (1) and is irr.luded in Fig. I with other data taken from a recent paper by Gorden.(11) Subsequent work by R. L. Jones (2) has extended the knowledge about the effect of electrochemical potential, using solutions with.1 N Nacl (which is equivalent to about 0.65 Nacl or 0.36", Cl-)
U and tests which were made at 290 C.
No SCC was found in 30-hour tests without
'High oxygen concentrations give rise to nich electrochemical cotentials, so that the clot of chloride versus oxycen concen; ation is the same in principle as chloride versus electrochemical cotential ne ef'ects of 09 cer se can dif#er frem that of controlling the' potentia 4t the same value'by elictronic acparatus, as shcwn by Rosborp and Rosencren 31 for sensiti:ed SS in pure water.
[
]
i a
any applied electrochemical potential, in tests done in an atmosphere of helium, i.e., no oxygen present. As the potential was increased, using electrochemical instruments, SCC was observed to take place in about +1000 mV on the hydrogen scale. This is ouite a high ootential, corresponding to an oxygen concentra-tion well in excess of that in feedwater in contact with air. Cracks start from pits under these conditions and some additional work showed that when the in-struments were switched off after pitting had started, in order to lower the potenti:1, then no cracks penetrated the material.
This suggests that even if cnlorice and oxygen are present for a time long eno;.on to start pitting, SCC may still not be serious if the oxygen is removed soon enough. Time is obviously will reduce the critical in this regard, but at any stage tta removal of 02 chances of SCC. A point of uncertainty remains, since it is not established whether an existing crack will qrow or would be arrested in the absence of 0
- 2 Recent data also indicate that there is an absence of cracking in C-rings 0
stressed above the. yield point exposed to solutions at 600 F with low 02 and high chloride. These tests indicated only an extremely slight amount of inter-granular penetration, which was not typical of SCC in sensitizec SS. The oxygen was somewhere bei s 200 ppb, which was the maximum level in the starting solu-tion; unfortunately.ne effluent frequently contained zero or much less oxygen than was introduced. Consequently, the tests can only be considered to have been oxygenated to the maximum of 200 opb, and under various (most?) time per-iods probably contained no oxygen at all. The test does reinforce the conclusion though that removal of oxygen or keeping the oxycen very low will eliminate the risk of early SCC in SS.
The use of sea water in an emercency situation for cooline the steam gen-erator would necessarily introduce an air-saturated aqueous electrolyte with high chloride. This, when in contact with SS at ocerating temcerature in the vicinity of 290 C, would definitely pose a threat of early SCC, certainly well within a one week period unless the oxygen is removed from the solution. There-fore, i# sea water is used as standby coolant, it should be deaerated or its use should be discontinued within a natter of hours in order to reduce the ha:ard of SCC in $$. The points of carticular vulnerability here would be' those sites where chlorides concentrate as a-result of boiling or as a result 4-l
o i
of corrosion taking place inside the crevices or inside pits that would form as a result of the intrusion of sea water.
The relationship between cracking and chloride concentration (as well as electrochemical potential), correlates well with the work by Jones, who found no cracking in his tests in a 30 hour3.472222e-4 days <br />0.00833 hours <br />4.960317e-5 weeks <br />1.1415e-5 months <br /> test period when 0 was absent, and po-2 tential not controlled. Also, he observed no pits in his tests.
It seems reasonable to assume that the test by Jones could have run considerably beyon'd 3C neurs with the sare result, since the electrochenical ectential was not suit-at:le for cracks or cits to develoo.
Consequently, under similar c:nditions a steam generator with SS tubes or an isolation condenser would be excected to operate without cracking for a ceriod of several days.
However, Jones' work cces not cover the case where local boiling takes place and where chlorides could be concentrated by a large factor. As discussed in the next secticn (for caustic cracking), local changes in concentration due to heat flux can occur relatively raoidly, so that the kinetics of SCC are expected to be rate de-temining. Conditions of increased concentration and heat flux would have to be explored in greater detail before a final conclusien can be drawn regarding the lcw 0 solutions.
2 Additional laboratcry results by ?.csborg in Sweden (3) and B. M. GordenfU) help screwhat to clarify the cuantitative aspects of the ouestion of Cl~ and O levels.
Fig.1 includes older data together with more recent relationships g
between chloride and oxyaen, as sumarized by Gordon.
A remark here is needed concerning crack cropagation and crack initiation.
In SS the crack velocity can be of the crder of 0.005 - 0.01" per hour. Con-secuently, once cracks initiate, they could penetrate a thin-wall tube cuite cuickly. Many alloys with increased resistance to Cl~ SCC have lancer survival tires only because cracks do not initiate readily.
In " imune" alloys, both initiation and crepacation are extremely slew or absent.
CAUSTIC CRACXI?lf, Whereas the influx C # sea water into a stear generator or an isolation cen-
- enser causes a droo in cH, other natural wa ers such as river water, lake water, 5
e e
l i
and perhaos nunicipal water supplies would lead to higher pH and introduce the danger of caustic cracking.
Since the SCC problem is affected by several variables in this case, it is necessary to consider the two pertinent factors separately, in order to detennine their effects on the kinetics of caustic SCC:
1.
The rate and degree of concentration of t!aCH due 'a boiling, chemical reactions, and the effect on pH of solution chemistry.
2.
The SCC of the metals involved.
Local Boilina, Chemical Reactions, Saecies in Solution It is inportant to establish seme idea of the time needed to fom a 1-104 localized solution of NaOH from the natural impure water and the environment within the condenser or steam generator.
Concentration of alkalf in waters can result from the high temperature shift of the equilibrium below to the right:
NaHCO ;2NaCH - CO I (I) 3 2
The chemical kinetics are rapid and the species always exist at ecuilibrium even at low tenperatures. However, scale femation and crevices within the steam generator produce hign heat flux crevices where the sodiun hydroxide will concentrate. The chemical reaction will not 49:temine the extent of high alka-line formation, but rather the thernal hydraulics will determine the concentra-tion. Hence, if occluded high heat flux regions exist, NaCH will concentrate from an influx of alkaline waters such as those containing NaHCO.
W. Pearl 3
et al.I I calculated a concentration of 0.1 molal NaOH within an isolated 0
crevi:e witn a heat flux giving a 10 C temperature rise above bulk during a hycothetical influx of itississipoi waters. Herever, hydroly able species such as silicates which consure OH" to fem insoluble products will have a.. strong nederating influence on the rise in OH' concentration (see Aopendix A). The dynanics of the steam formation crovide the rate determining step, not the chemical kinetics of reaction I.
Scecific rates will ce cualitatively described later.
l 1
I,
_. ~,
.e.,
The case for the situation where a dissolved sodium salt reacts with cor-resion products to form the alkaline crevice is different, as discussed next.
The anions of some heat-flux-concentrated dissolved sodium salts can react with natal oxide and hydroxides within occluded regions to produce free dis-solved NaOH. For example, a possible scheme by which sodium phosphate will react with magnetite is as follows:*
hid Ut (II) Na HPO4 (bulk)
Ma HPO4 (crevice) 2 2
i (III) 4 H O + 8 Na HPO4 + 3 Fe )4 dT*
2 2
3 Fe (PO )2 + 6 Fe(PO ) + 16 NaOH 3
4 4
(see Economy et al., ref. (4)
The steanina dynanics which cause local concentration as considered previously will detemine the rate of (II). The chemical kinetics of (III), however. prob-ably detemine the rate of the overall process renresented by the sequence of reactions. Times between 10-15 hours are recuired for III to equilibrate at
' 230 C for.09 mole phosphate /kg H )*( }
0 2
There is more infomation suggesting that the hide-out process is more ra::id than reaction (III).
S. Yashira et al. reported the existence of a cor-rosive concentration of phosphate within a semi-isolated crevice to be inde-pendent of bulk phosphate concentration or Na/ phosphate ratio as observed after the 400 hours0.00463 days <br />0.111 hours <br />6.613757e-4 weeks <br />1.522e-4 months <br /> of the test. Conceni. ration of cyrophoschates produced the same rates as observed after 100 hours0.00116 days <br />0.0278 hours <br />1.653439e-4 weeks <br />3.805e-5 months <br />. The concentration process clearly is not the rate determining steo for corrosion.
In tests at BNL, using a
'An exarple of cracking that eccurred in the field is Ben:nau, where it was sus-pected that Na pnospnate reacted with iron oxide for ed earlier in the life of the steam generator and which was converted into NaOH and fren phosphate when dosine with phospnate was started. As will be examined later. it has been specu-lated and calculated bv various scientists, that NaOH of a relatively high con-centration can be generated especially in areas where it will not readily diffuse away such as crevices or underneath decosits. Other incredients buffer these local electrolytes, so that the final pH decends on the overall electrolyte composition.
7
o
.01hiFe50 solution at 100 C, the concentration at a steam blanketed region 2 4 via hide-out of Fe(OH)3 through precipitation occurred within 1-2 hours, as sh6wn by a rapid droo in local solution conductivity.
In sunnary then, concentration of species produced by heat flux proceeds quite raafdly and will be controlled by the relative rates of flow into and steaming from occluded regions.
If concentration of NaOH proceeds merely by a heat flux concentrating mechanism of NaOH in the bulk solution, it will occur quite raoidly. Socawhat longer times will be required if chemical reactions between hide-out materials must occur to produce the alkalinity.
For the pur-poses of SCC predictions, it has to be assumed that the time to form dangerous levels of NaOH, once impurities have been introduced, is short, i.e., one day or less.
An interesting possibility for mitigating the NaOH SCC problem is to add silicate to the incure water. As stated above, it is calculated to have strong suopressing effects on the level of caustic that is formed locally.
(This is not standard practice, so that unidentified secondary pitfalls may exist, e.g.,
cessible builduo of local acidity and scale formation.)
Rates of SCC of SS and Inconel 600 in Caustic Laboratory tests with caustic have been done by various groucs such as Westinghouse (6'7'O'N and B&W(10) so that there is a good amount of data for predicting what would happen in NaCH solutions of various concentrations. Un-fortunately, an unknown aspect in this correlation to be made with field condi-tions is that the influx of impurities will not give rise to a predetemined concentration of NaOH and a fixed electrochemical potential. Therefore, in different parts of the steam generator a whole series of caustic concentrations may arise decending on location, as stated before, and also on the concentration of other species such as silicates.
Consequently, it is necessary to consider the effect of several levels of NaCH and 02 plus other ions in trying' to determine how SS and Inconel alloy tubes will perform.
It is generally accected that the use of slowly straining soecimens gives rest severe results, followed by U-bends, and that C-rings oive the longest failure times. However, since stresses of unkncwn levels can exist under oper-ating conditions, it is felt that sufficiently conservative conclusions can be
-8 w
based on results with high stress, i.e., U-bends, for which the largest number of data are available.
Westinghouse data indicate that U-bends of Type 304 SS in deaerated 105 NaOH can crack in three days or less and similar results are obtained in higher l
concentrations. At 90",and 1105 o? the yield in 105 NaOH, 304 shows only minor surface penetrations in 220 days, and 25 mil cracks in 33 days, respectively.
Obviously the stress level is proven to be quite significant. Compared to this, Alloy 600 cracks in a matter of several months and Alloy 800 (Inconel) behaves
.more like SS than the nickel base alloy. Since the earlier discussions showed that chemical changes can occur rapidly to raise the pH, it is evident that tnere should be concern about SCC in SS within a matter of a few days if impure (NaOH-forning) water is introduced. Mitigating factors would. be (1) absence of high stress, and (2) species in solution that suppress MACH level.
For Inconel 600 in cases where 0 is not present, less probability of SCC within 2
one week exists, because laboratory data indicate relatively long failure times.
This is believed to be a result of the higher Ni content cf Inconel.
The cerformance of SS, and. Alloys 600 and SCO in 505 caustic with and with-cut additions is given.in Table I, taken fran reference (3).
It is evident that Alloy 600 is much more resistant that 30455. Also, some additions such as Pb0 or SiO would be detrimental.
2 In practice, it must be considered that the introduction of river. water or other relatively "high Na" imoure water will be air-saturated, and the oxygen would be replenished as rmre and more of this solution is used, so that. specific steps will be needed if 0 is to be removed.
Earlier International Nickel Co.
2 results showed that Inconel 600 cracks in caustic soda at high concentration with an over-cressure of oxygen or air. While the level of oxygen in the Inco test was higher than the level of 6-8 ppn expected to be introduced by a solution in ecuilibrium with air, the field condition will nevertheless continue the supoly of air (0 ), whereas in the closed system used by Inco the 0 was cradually 2
2 lowered by consumotion during the test period.
In this ca'se, therefore, Inconel 500 is in an ill-defined grey area where it is not certain whether it pcssesses adeouate resistance :o SCC for one week if air is not removed. Another comolica-tion is that results obtained by Theus at St.W(10) indicated that a small shift
.g.
in the anodic direction can introduce SCC in Inconel 600.
This observation in-dicates that there are two bands of electrochemical potential in which there is a danger of SCC of Alloy 600 in caustic:
the one lines at a high level, cor-responding to a considerable over-pressure of air in the International Nickel Co. tests, and the second one is lower and nearer the electrochemical potential o'f a deaerated solution and corresponds to the SW and Westinghouse controlled potential data. A safe zone is believed to exist between these two, and there-fore there may well be cause for concern over a relatively low level of oxygen or otner oxidi:ing species which could cause a sufficient shif t of the corro-sien potential in the deaerated solution to move into the first band of caustic levels. The amount cracking, which could be as dangerous as much higher 02 of oxygen required for this shift has act been detemined accurately, and such tests are needed.
The bottom line for Inconel 600 is, therefore, that contact at operating temoeratures with MaOH-feming impure water should be avoided or discontinued can be removed, or (b) HaOH 'orma-in less than two or three days, unless (a) 02 tion suporessed Tn local regions.
Further, lowering the temperature as quickly as possible would be beneficial, as caustic SCC of Inconel 600 is known to be strongly temperature-dependent. Also, it is evident that a better knowledge of what local conditions in tems of NaCF and stress may. develoo in service, would make predictions a great deal easier. The addition of Sf0, which can buffer 2
the buildup of MaOH, may also intensify the situation if large amounts of caustic are cresent, as can be seen in Table I.
CRACKINr, OF INCONEL AND SS IN RELATIVELY PURE WATER WITH A SMALL AMOUNT OF 0xYGEN PRESENT The cracking of SS in water with only a little oxygen present has occurreo in sensiti:ed SS even at low temperatures. Should such material be in service, then the simple introduction of a small amount of oxygen could cose a' problem in highly stressed or actively straining regions. The cracking rates appear to U
be a maximum at 200 C.
An analysis of the situation in a steam cenerator or isolation condenser indicates that the chances of such cracking are low, because l
the tubes are not usually installed in the sensitized condition, so that the time recuired for cracking can be excected to be icnger than ene week.
This i l l
l
f e
P would not be the conclusion for sensitized material; for this reason, it is also important to consider welds, the original material, and also the possible longer term ' sensitization that is known to occur at operating temperature. Experi-mental data along these lines are incomplete, and require emphasis if the SCC problem in impure water is to be addressed comprehensively.
Referance to
" original material" above concerns mill practice which may not be sufficiently controlled to ensure delivery of 100% unsensitized stainless steel tubing.
I -
REFERENCES 1.
W. L. Williams, Corrosion 14,,1958.
2.
R. L. Jones, Corrosion 31,, 1975.
3.
B. Rosborg and A. Rosengren (Studsvik Energiteknik, Sweden), unpublished.
4.
G. Economy et al., Proc. Intl. Water Conf. 36,, p. 161 (1975).
5.
W. L. Pearl, S. G. Sawachka, "PNR Secondary Hater Chemistry Study," NWT 116-10 Tenth Progress Report (EPRI Agreement 1404-1) Nuclear Water Maste Technology, P.O. Box 6406, San Jose, California 95150 (February 1978).
6.
F. W. Pement, I.L.W. Wilson and R. G. 8speden, Paper 450, Annual NACE Con-i ference, Atlanta, Georgia, f' arch 12-16, 1979.
7.
I.L.W. Wilson and R. G. Aspden, Corrosion 32,, 193 (1976).
8.
I.L.H. Wilson, F. W. Pecent, R. G. Aspden and R. T. Begley, Nuclear Tech-nology 31,70(1976).
9.
I.L.W. Wilson, F. W. Penent and P., G. Aspden, Corrosion 34, 311 (1978).
10.
G. W. Theus, Nuclear Technolocy 28,, 388 (1976).
11.
- 3. M. Gordon, fiaterials Performance 19, d4 (April 29,1980).
4 NOTE: Literature references to the subject of SCC are overwhelming, and several dozen, if not several hundred, could well be cited here but would not add to the basic arguments that were made above.
N
i l
l
.7 2** M,.
A.i
=
A.
v.
7 4
6 W
5' W=
"O.' +
9., *t,i
~
1 i
t b
I YY i
- v.,==== T T..
.g
...=, 2 C
=.
y A
a v
. p.
=
=
v Ca3 ces
- cay, v.
- v.
ge:
,.g C=
o 4
.et 1
~~ - ___
y e
V ~..k_'~~
-5
+
s 5
v,..~.
e,
v.
O..
.s..
i
.c
=..
Figure 1.
The Effects of Oxygen and Chloride on the SCC of Austenitic Stainless Steels in High Temperature yater 1
13-
TABII 1 (Ref.8)
Stress Corroelon Test Incidence of Fe-Ni-Cr Alloye in Strong Caustic with Additives
[ Mill-anneated C-rings in duplicate, at 110% of yield stre'ngth, exposed to equimolar 50%
4XCH + NaOH) + additive; 6:0*F: 1 3. or 6-month exposure.
One sample / heat metallographically examined for crackang.]
Type 304 Additive Monttts Stainless Steel Incoloy 500 Inconal 600*
1 Cracked Not cracked Not cracked None 3
Cracked Not cracked Not cracked 6
Cracked Cracked Cracked Secondary sludge
- 3 Not cracked Cracked Not cracked 6
Cracked Cracked Cracked 10% Slos 3
Cracked Cracked Cracked 6
Cracked Cracked Cracked
% Pb (as PbC) 3 Cracked Cracked Not cracked 6
Cracked Cracked Cracked 1000-ppm Cl* (as Nacl) 6 Cracked Not cracked Cracked 1000-ppm F* (as F*)
6 Cracked Not cracked Cracked 0.5% As tas Ae 03) 6 Cracked Cracked Cracked 1% 3 (as MsBoi) 6 C' racked Cracked Cracked 10% soda 11te' 6
Cracked Cracked Cr. eked 5%2n 6
Cracked Not cracked Cracked 1% Cu (Cua0 + Cu) 6 Cracked Cracked Cracked 5% Cr (as Cr Os) 6 Cracked Cracked Cracked
!ll% NaNC:
6 Cracked Not cracked Cracked "Five heats of Inconel 600,2 samples per heat.
55 g of sludge in 500 ml of caustic solution. Sludge f rom plant with : yr of all-volatile treatment and 3 mwnths e phosphate.
" Sodalite approumated by a molar ratio of 9/8/12/8 of Na:Sios/Abos/NaC1/SiO.
-u-
t l
APPENDIX A W. Pearl and' S. G. Sawochka* have made a calculation of the pH rise due e
to concentration of impurities introduced by a fif ssissippi River inleakage, Concentrating effect is limited by B.P. elevation which was taken to be e
10 C
= -loa H'
H'. = H+ concentration ojDefinepH i neutral pH is that where H
= 0H~~
0 e For an isolatad cavity with the 10 C temperature rise and a fresh water in-gress (flississippi Water), the hydroxyl ion may reach a concentration of 0.1 molal in the absence of silica. This corresponds to a room temperature oH of 13.
Silica can produce a suppressing (beneficial) effect.
Through hydrolytic precipitation silica will buffer the solution to lower pH at high concentration factors.
e.g.,100 opb silica will reduce the level to s 10' to 10-3 molal for the same conditions.
"PWR Secondary Water Chemistry Study 10th Progress Report NWT 116-10, Feb. 1978, EPRI =404-1) 1 I
A-1
-o
[
ENCLOSURE 2 STAFF POSITIONS REGARDING SEP SAFE SHUTOOWN SYSTEMS REVIEW I
MILLSTONE 1 NUCLEAR PLANT 4
1.
The licensee must develop, by April 1981, plant operating / emergency pro-cedures for conducting a plant shutdown and cooldown using only the systems and equipment identified in Section 4.0 of the SEP Safe Shutdown Systems report.
2.
The licensee rmast develop, by April 1981, plant operating / emergency procedures for conducting a plant cooldown to cold shutdown conditions from outside the control room.
- 3.. Considering air (or nitrogen) leaks from the electropneumatic Automatic Pressure Relief valve actuation systems, the licensee must demonstrate that these valves will be available for long term core cooling or must provide the means to assure their availability #ar this function. Operator actions outside the control room to assure long term availability of the valves would be considered acceptable if suitably justified.
--