ML20009E901
| ML20009E901 | |
| Person / Time | |
|---|---|
| Site: | Zimmer |
| Issue date: | 07/22/1981 |
| From: | Borgmann E CINCINNATI GAS & ELECTRIC CO. |
| To: | Harold Denton Office of Nuclear Reactor Regulation |
| References | |
| NUDOCS 8107280533 | |
| Download: ML20009E901 (26) | |
Text
s THE CINCINNATI GAS & ELECTRIC C 26NY sW -
CD 0)
.Ef;I,7"L"c^"o",
l
,9 Docket No. 50-358 I
2 7 08N b July 22, 1981 y<,s~ =. w,
Mr. Harold Denton, Director Q,, i g,N'g Office of Nuclear Rr. actor Regulation
</,
U.S. Nuclear Regult, tory Comission Washington, D.C. 20555 RE: WM. H. ZIMMER NUCLEAR POWER STATION -
UNIT 1 - PIPE BREAKS IN THE BWR SCRAM SYSTEM
Dear Mr. Denton:
By NRC lett,er of April 24, 1981 to Mr. E. A. Borgmann from Mr. Robert L. Tedesco, the NRC requested that certain plant specific information be provided by August 2.
Attached are six copies of the Zimer Plant Specific Information. Our response to the NRC request for generic information was provided by letter of June 15, 1981.
Very truly yours, THE CINCINNATI GAS & ELECTRIC CCMPANY
[
j,- r ; --- -
EAB: dew E. A. BORGMANN Enclosure cc: Charles Bechhoefer State of Ohio
),
M. Stanley Livingston County of Hamilton)3s Frank F. Hooper Troy B. Conner, Jr.
Sworn to and subscribed before James P. Fenstermaker me this 23 gl-day of July, 1981.
Steven G. Smith William J. Moran J. Robert Newlin Samuel rl. Porter Ys
^^
F an W. Peter Heile Ngfar$9ublic James H. Feldman, Jr.
MARILYN J. LUERSEN John D. Woliver Notary Public. State of Ohio Rh my commission Dpires ;x: 7. Isaa David K. Martin George E. Pattison Andrew B. Dennison 8107280533 810722 h,g g PDR ADOCK 05000358 3
A PDR
.,y_,
_,y 4
J DOCKET NO. 50-358 f
WM.
H.
ZIMMER NUCLEAR POWER STATION - UNIT 1 RESPONSE TO 4-24-81 NRC LETTER ON i
l SAFETY CONCERNS ASSOCIATED WITH PIPE BREAKS IN THE BWR SCRAM SYSTEM 1
}
l
SECTION 1 SCRAM DISCHARGE VOLUME RUPTURE EVALUATION MKIIC0yTAINMENT 1.1 Introduction The effects of a postulated scram discharge volume rupture are discussed for BWR-5, MK II containment.
Throughout th( discussion it is postulated that a normal scram causes a large rupture in the scram dis-charge volume, resulting in release of the leakage flows from all control rod drives into the reactor building.
It is shown that if local isolation of the discharge is necessary, it can be accomplished long before reactor buildirg flooding would jeop-ardize those core cooling and heat removal systems which are located in the reactor building.
It is also shown that such an event is well within the capabilities of nlant systems for core cooling and decay heat removtl, even when the effects of liquid discharge in the reactor building are accounted for.
Final y, a systematic assessment of the probability of core damage due to such an event is made. It is shown that this postulated event has a much lower risk potential than other, more credible, events routinely analyzed in plant design and licensing.
It is concluded that no special provisions need to be made to prevent or mitigate the effects of a scram discharge volume rupture in a plant with a MK II con-tainment.
1.2 Equipment Arrengement The MK II primary containment, comprising the drywell and supprassion chamber, is a structure which encloses the reactor, the recirculation pumps and piping, and the safety / relief valves, which are used in emergencies for rapid depressurization.
The secondary containment, referred to as t? reactor building, encloses the primary containment thouses many of the reactor auxiliary systems, int
- control rod drive pumps, the emergency core coolint, ams (ECCS), and the residual haat removal syst' JR).
The CRD hydraulic control units (HCUs) are a..ted on a concrete floor inside the reactor buildu g, 71 feet above the basement floor.
1.1
j, The preferred and highest-capacity systems for nor-mal core cooling and decay heat removal are located outside the reactor building. These include the reactor feed pumps, the condensate booster pumps, and the condensate pumps for core cooling; and the turbine bypass valves, main condenser, and circula-ting water system for decay heat removal.
Also located outside the reactor building are the RHR system service water pumps. These safety-grade.
high capacity pumps are normally used to cool the RHR heat exchangers; but in an extreme emergency, they can be connected directly to the reactor via two valves in the reactor building operated from the control room. The RHR service water pumps draw from the plant's ultimate heat sink (Ohio River) and thus provide a supply of reactor cooling water which is unlimited for practical purposes.
It.is emphasized, then, that the principal components of both the preferred system and a high-capacity, highly reliable backup system are not subject to the effects of reactor building flooding.
l 1.3 Reactor Building Flooding Protection and Detection The RER pumps, ECCS pumps, CRD pumps, and reactor core isolation cooling (RCIC) pumps are located on the bottom floor of the reactor building. They are located in separate enclosed compartments at the four corners of the reactor building. The ECCS pump pads are elevated above the floor (three feet) on concrete platforms. The ECCS motors, which are drip-proof, are at an even higher level (bottom of. the motor is 10 ft, from the floor) and the equipment contols are located high on the building walls.
In the event of a break in the SDV after scram, the primary flowpath for released water would be via the HCU floor drains to the drain sumps in the basement. These drains, which are 6 inches in di-i ameter, are adequate for the flow expected from an SDV rupture.
l At the HCU floor elevation there are etairwells to the bottom floor. These stairwells provice another potential flowpath, although the HCU floor drains should prevent such flow. Floor drains at the bottom of the stairwells weC d transfer any accumulated water to the floor drain sumps. Therefore, the stair-wells do not present a flow path for preferential flooding of compnrtments with ECCS equipment.
1.2
1.3 Reactor Building Flooding Protection and Detection Continued There are also equipment hatches on the HCU floor.
These hatches have shielded step plugs that preclude significant water leakage to lower floors. Equip-ment hatches exist above ECCS pump compartments to provido rump removal and servicing capability. Due to the <slevated locations of the equipment and the use of dripproof motors, even direct leakage of water through the hatches into individual ECCS pump roomswould not immediately joepardize the function of these pumps and motors. One other potential flow path is via the grattings that allow access for tendon tightening. Flow from a ruptured SDV could flow di-rectly to the Reactor Building bottom floor, but this flow would be contained in an area separated from the ECCS rooms via water tight doors. And thus does not jeopardize ECCS equipment operation.
The reactor building sump pumps, total 450 gpm capacity, will pump liquid reaching the reactor building basement to che radwaste system which processes and then returns it to the condensate system. If the leakage rate exceeds the sump pump capacity for an extended time, general flooding of the basement could occur. However, as will be shown, reactor depressurization will reduce leakage from the SDV rupture to a value within the capacity of the sump pumps.
To determine the sensitivity of plant response to sump pump operation, analyses of reactor and con-tainment system response were conducted to determine the rate at which general flooding of the basement would occur with and without sump pump operation.
The analyses of liquid release are described in Section 1.6.
The calculated flowrate from the unisolated SDV rupture is tabulated in Table 1.4.1.
Conservatively, 90,000 gallons are needed to flood the basement to one foot depth. From the calculated flow transient, it results that 87 hours0.00101 days <br />0.0242 hours <br />1.438492e-4 weeks <br />3.31035e-5 months <br /> are required to flood the basement to two feet depth, without any allowance for the approximately 450 gpm drain sump removal to radwaste. The time is dependent on the time at which reactor depressurization is started. If it is started two hours following the event, instead of 30 minutes as assumed,61 hours7.060185e-4 days <br />0.0169 hours <br />1.008598e-4 weeks <br />2.32105e-5 months <br /> are required to flood the basement to two feet depth, without any allowance for the approximately 450 gpm drain sump removal to radwaste.
1.3
1.3 Continued It is also seen from Tablel Al that ai'ter the reactor is depressurised, the leakage from the rupture is well within the capacity of the drain sump pumps.
Thus, with these pumps operating, any accumulated water in the reactor building will gradually be pumped out, and general flooding will not occur.
Since ECCS pump motors and other electrical equipment are several feet above the floor, it can be seen that any potential common modo failure by flooding can occur only in the long term.
It will be shown in subsequent sections that the leakage can be stopped much sooner, and that a al-ternate means of core cooling and heat removal are readily available even if the flooding were to con-tinue.
The ECCS rooms and the suppression chamber area have water level switches which annunciate in the control room at a depth of a few inches below floor level.
Zimmer Pcwer Station also has high temperature alarms (140 F) in the ECCS rooms. In the unlikely event of an SDV pipe break, the operator would be alerted to the presence of accumulated water in these areas and could take contingency actions to protect the plant (for example, finding out why the high level and then testing and liaing up one or both RER service water pumps for injection if needed) well before flooding of the equipment could occur.
In summary, general flooding of the reactor building basement will not occur if the reactor building sump pumps are operating. Even if they are not operable, general flooding would not be cf concern for a period of days; within this interval, the flow from the SDV rupture could be terminated. Water is unlikely to reach the ECCS rooms via hatches or stairways, due to the size of the HCU floor drains. Even if it did, it would not immediately threaten equipment operability. ECCS room flooding is directly annun-ciated in the control room, permitting early con-tingency actions. For these reascus, flooding of the RHR, ECCS and RCIC equipment is not likely to threaten operability in the event of an unisolated SDV rupture.
1.4
1.4 Reactor Building Environment The release of energy into the reactor building due to an unisolated SDV rupture will cause the building's temperature, pressure and activity level to increase.
In this section, these effects are quantified to dem-onstrate that equipment will not be disabled due to environmental effects other than flooding, and to demonstrate that access to the HCU equipment is possible if the flow from the postulated rupture must be terminated locally.
The reactor building response was calculated using an analytical model which performs mass and energy balances on the drywell, suppression chamber, and reactor building. Mar and energy flows from one control volume to another, and from the reactor building to the environment, were included. The communication mechanisms modeled include, leakage paths, and heat transfer through structures. The response was conservatively calcualted by minimizing the effect of structural heat absorption.
The break flow and energy release to the reactor building were obtained from the analysis described in Section 1.6.
The analysis assumed manual de-pressurization of the reactor 30 minutes into the event. This reduces reactor pressure to the 50-100 psia range in approximately 10 minutes. The flow through the SDV rupture will then be subcooled water at low flow (much less than 1 gpm per drive).
It was assumed that no isolation of the SDV rupture takes place until the reactor is completely de-pressurized, and that RHR Shutdown Cooling is used i
to complete the depressurization. It was further conservatively assumed that the CRD pumps were not operating. If they were, dilution of the CRD dis-l charge flow with cool drive water would greatly reduce the temperature of the water discharged. The rupture flow and temperature are shown in Table 1.4.1.
TABLE 1.4.1 SDV BREAK FIDW DESCRIPTION Time After RPV Pressure RPV Temp SDV Rupture Flow Break (Min)
(psia)
( F)
(gpm) 40 135 350 96 70 89 319 54 173 24 238 48 250 14.7 211 32 295 14.7 201 32 1.5
1.4 continued A conservative estimate of the reactor building re-sponse to this mass and energy release is shown in figures 1.4.1 & l.4.2.
The figures show reactor building pressure and temperature assuming various reactor building leak rates, with no credit for either the Standby Gas Treatment System (SGTS) or the building HVAC to help reduce building temp-eratures. Typical leakage, controlled by the Standby Gas Treatment System, is 100% per day.
The reactor building temperatures and pressures will decrease from the maximum values shown in the figures becaa e the flow out of the break will be subcooled water. For the pressures calculated it is expected that the building leak rate would be substantially higher, than 100% per day, tending to lower both temperature and pressure in a more realistic evaluation. The operator can accelerate restoration of the building atmosphere to normal condition in a number of ways, including restoring building HVAC, or even opening equipment doors, if needed.
From this analysis, two important conclusions can be drawn. First, the bulk atmospheric conditions of the reactor building are within the expected capabilities of essential core cooling equipment located in the reactor building. Due to location, the temperature should be higher than bulk average near the SDV break and lower than average at the ECCS equipment. Second, the volume and temperature of the SDV rupture flow are sufficiently low after reactor depressurization (particularly when dilution by control rod drive water is considered) that access to the HCUs is possible for manual isolation of the flow within a reasonable time period.
The activity in the reactor building was calculated to demonstrate that the activity " spike" characteristic of shutdown would not make the HCUs inaccessible. The calculation was based on the following assumptions:
1)
Reactor depressurization begins within 30 minutes; 2)
The radioactivity released is due to the depressurization " spike";
3)
The noble gases released in the " spike" are contained within the primary containment and do not contribute significantly to the reactor building dose rate; 1.6
1.4 continued 4)
The iodine activity airborne in the reactor building considers the fraction of the primary coolant released through the SDV rupture and the fraction flashed to steam; 5)
The activity released to the reactor building is uniformly mixed in the reactor building and is not depleted due to building leakage.
6)
The iodine and noble gas inventory available for release are based on a conservative assumption for the number of leaking fuel rods.
Based on these assumptions, the calculated dose rates at the HCU floor level are as shown in Table 1.4.2.
TABLE 1.4.2 MK II REACTOR BUILDING DOSE RATE AT HYDRAULIC CONTROL UNITS Time After Break Dose Rate 1 hr.
0.4 R/hr.
8 hr.
0.1 R/hr.
8 hr.
0.1 R/hr.
24 hr.
0.07 R/hr.
l From these conservatively calculated results it is j
concluded that as soon as one hour after the time of the postulated SDV rupture, the dose rates will per-mit operator entry into the reactor building, con-firming that access to the HCUs is possible for manual isolation of the SDV rupture flow if it cannot be
' isolated by other means.
1.5 Operator Actions l
In the event of an SDV rupture following scram, auto-matic system operation would assure adequate core cooling, as discussed in Section 1.6.
However, the operaticns crew would be relied on to terminate the l
discharge of coolant into the reactor building.
This section discusses the alarms and indications available to detect the rupture, and demonstrates that the rupture can be detected and its effects remedied well before plant safety is jeopardized.
It is shown that even if no specific procedures l
are in place for diagnosing and remedying this postulated event, sufficient guidance is available to the operator to assure a safe shutdown.
SL3
1.5 continued A number of alarms and indications could indicate a possible pipe break outside the primary containment.
Table 1.5.1 lists those annunciator alarms and in-dications which would permit detection of an SDV rupture.
The response of the operations crew to any such emergency would be as follows:
a)
Verify reactor has shut down; b)
Verify automatic actions have accured; c)
Maintain reactor water level; d)
Monitor and control primary containment parameters; e)
Evacuate personnel; f)
Investigate and determine cause of reactor building ventilation isolation and other unique alarms; g)
Determine the cause of the scram; h)
Mitigate leakage and/or isolate break.
To illustrate in detail how the operations crew might respond to an SDV rupture, a detailed time line has been postulated, and is presented in Table 1.5.2.
The response times indicated are estinates based on extensive plant experience. This time line differs from the bounding analyses presented in Sections 1.4 and 1.6 since the purpose here is to show ex-pected plant and operator actions.
The operations crew will receive a number of alarms (in addition to those created by the scram) to in-dicate coolant leaking into the reactor building.
The probable first action to mitigate the leakage would be to isolate all primary system lines exist-ing the primary containment (Group 1). If this is not successful, a cooldown of the reactor would be initiated. The actual depressurization rate will depend on the operator's assessment of the severity of the situation, but if it is judged to be sufficiently severe (for example, if core cooling is threatened by equipment unavailability or fail-ure), the reactor can be depressurized very rapidly by manual actuation of the Automatic Depressurization System, as assumed in the analysis of Section 1.6.
1.8
1.5 continued One of the operator's actione follow:.ng the reactor scram would b to bypass the scram discharge volume high level signal and reset the trip signals if all Reactor Protection System (RPS) signals have cleared.
The reset would close the scram discharge valves and isolate the leak if it e.acurred downstream of these valves. However, it 19 postulated in Table 1.5.2 that for some reason the scram cannot be reset.
An initial entry into the reactor building would be made either to locate the break or to determine why the scram could not be reset. If by that time it was not known that there was a pipe rupture, it would be clear at once to the personnel attempting the entry. At that time, an effort might be made to close the manual scram isolation valves. However, the primary means of isolating.the flow would be to close the scram discharge valve remotely.
i l
l l
l l
1.9
l TABLE
.1
_MK II SDV PIPING BREAK DETECTION SIGNALS Available With Loss of Offsite Power Area Radiation Monitor Alarm Yes 1.
Reactor Building Equipment Sump Level Alarm Yes Reactor Building Floor DrainSump Level Alarm Yes ECCS Room Level Alams Yes CRD High Temperature Alam No Reactor Building Ventilation High Radiation i
Alarm Yes High ECCS Room Ambient Temperature Alarm Yes Reactor Building Low Differential Pressure No Reactor Building Ventilation Isolation No Personnel Observation of Leakage Yes
(
i t
{
l I
l i
1.10-l
If for any reason one of the scram signals without a bypass function could not be cleared, the asso-ciated scram signal could be temporarily disabled from the control room. Table 1.5.3 lists the scram signals and the associated bypass functions.
If some other mechanism precluded closing the scram discharge valves from the control room (e.g., loss of instrument air), the scram discharge valves could be isolated manually. It was shown in Section 1.4 that access for such local isolation is possible long before reactor building flooding would affect any ECCS pumps.
As stated in Section 1.2, the principal components of the preferred coolant injection systems (feed pumps, condensate booster pumps, and condensate pumps), the preferred heat removal system (main condenser), and a high-capacity, highly reliable backup system (RHR service water) are located out-side the reactor building and are thus not subject to the effects of reactor building flooding. The safety / relief valves, which would be used for emer-gency depressurization, are in the primary contain-ment and similary are immune to flooding. All of these systems are operable from the control room using established procedures, including placing feed pumps and the main condenser back in service following main steam line isolation. Thus in the highly unlikely event that the ECCS pumps were dis-abled due to flooding, sufficient equipment is still available to permit core cooling and decay heat removal.
It is concluded that there is ample information and time to detect a rupture in the SDY, that isolation of the rupture is possible in a variety of ways, and that core cooling and decay heat removal can be effected using established procedures for the op-eration of systems unaffected by the reactor building environment.
1.11
TABLE f.5.2 i
MARK II ESTIMATED SEOUENCE OF EVENTS
' FOR SDV RUPTURE Time in Min'utes
" Events 02:00 Reactor Scram all rods inserted.
01:40, CRD pump in runout 80-100 gpm, all CRD's in overtravel position, full in.
01:20 SDV high-high water level trips and alarms.
00:10 SDV filled and pressurized to 1000 psi.
00:00 SDV ruptures.
+
00:05 SDV level instruments reset and trip repeatedly -
pressure transients in the region of the hvel instruments.
i
+
00:15 Local SDV Area Radiation Monitor Alarm
+
01:00 Reactor building vent high radiation alarm.
+
01:10 Reactor building vent high/high radiation alarm.
+
01:15 Standby Gas Treatment System in operaticn.
+
01:16 Reactor operator alerted to a reactor building radiation release.
+
01:25 Emergency evacuation of the reactor building is ordered from the Control Room.
+
01:30 Reactor building sump high level alarm with associated sump pump operation.
+
01:45 Shift faroman and reactor operator attempt to identify the cause of the release.
+
02:00 Reactor and balance of plant continue the
' recovery from initial scram.
+
02:15 Reactor building sump high/high level alarm with associated sump pump cperation.
l 1.12
\\
Time in Minutes Events
'I
+
02:30 Additional Area Radiation monitor alarms annunciate from within the reactor building.
+
02:45 Reactor operator notes abnormally high coolant makeup flow rate is required to maintain RPV water level.
+
03:00 Reactor operator initiates a Group,I iso-lation of the RPV.
+
03:30 Notification of site management of the evacuation of the reactor building.
+
08:00 Reactor operator attempts to reset the initial reactor scram unsuccessfully.
+
10:00 Shift foreman and reactor operator make the determination that the cause for the release of primary water and high reactor building secondary containment radiation levels is associated with a break in the primary system piping.
This conclusion is based on:
(1) high reactor building radiation activity, (2) floor drain sump pumping operation, (3) additional RPV makeup water to maintain normal level,'(4) inability to reset the scram valves, and (5) personnel observation.
i
+
10:30 Personnel enter the control room for a briefing on plant conditions.
l
+
11:00 Observations asked of the stiff present in the control room who may have seen or heard anything peculiar in the reactor building.
+
13:00 Shift foreman and reactor operator conclude a rapid pressure reduction of the RPV is l
needed to reduce the secondary containment l
radiation release rate.
+-
14:00 Reactor operator initiates and confirms
~
manual start of the Low Pressure Core Spray and Low Pressure Coolant Injection system pumps.
+
15:00 Reactor operator initiates manual depres-l surization of the RPV using safecy relief valves discharging to the suppression pool.
l l
l 1
l 1.13 I
Time in Minutes Events
+
15:30 Reactor building floor area is flooded to a depth of v 1 inch.
^
Shift foreman selects a reactor buildicg
+
30:00 entry team to determine the cause of the release from the primary containment and to inspect secondary containment integrity.
+
41:00 liigh water level alarm annunciated in one of the ECCS corner rooms.*
+
45:00 Reactor operator confirms RPV level is maintained and secures the operating ECCS pump in the corner room displaying the high level alarm.
+
75:00 Reactor pressure is reduced to a point where initiation of the Residual Heat Removal Shutdown Cooling Mode may be started.**
+
76:00 Break outflow energy at the SDV is reduced as a result of RPV pressure reduction and dilution by cool CRD pump flow (180 ppm).
Waterlevelinthereactorbuilding floor area at a depth of 3 inches.
+
90:00 Reactor building initial entry team reports the release point to be at the SDV and initiates initial efforts to reduce outflow.
+ 120:00 Shift foreman initiates procedure for uncontrolled release (Site or General Emergency Procedure).
+ 150:00 Shift foreman formulates second reactor building entry team to close the CRD Hydraulic System manual isolation valves.
+ 170:00 EtCS pumps secured with the exception of the RHR shutdown cooling system.
RPV level j
makeup is supplied from the Condensate System.
^Floocing analyses assume drain sump pumps inoperable.
- If operator determined a need for rapid blowdown, and started at time l
15:00 as assumed, this pressure would be reached at time 25:00.
l 1.14
\\
Time in Minutes Events s
+ 180:00 Shift foreman is informed that complete (3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br />) closure of all HCU manual isolation valves has been achieved.
Water level in the reactor building floor area ia 5 inches deep.* Completion of shutdo'W5~ procedures and cleanup'of the reactor building commences.
i
- Flooding analyses assume drain sump pumps inoperable.
I
~
i I
I l
.e 9
1.15
..~.
TABLE 1.5.3 2EACTOR SCRAM SIGNAIS SIGNAL BYPASS Turbine Stop Valve Closure
<30% power Turbine Control Valve Fast Closure
-30% power Scram Discharge Instrument Bypass switch + " SHUTDOWN" Volume High Level or " REFUEL" Main Steam Line Isolation Other than "RUN"1 Valve Closure Drywell High Pressure None Reactor Vessel High Pressure None Reactor Vessel Low Level None Main Steam Line High Radiation None Manual None Reactory Mode Switch in " SHUTDOWN" 10 Seconds NEUTRON MONITORING i
a.
IRM high Mode Switch in "RUN" l
b.
IRM inop.
Mode Switch in "RUN" c.
APRM high (<l5%)
Mode Switch in "RUN" d.
APRM high (flow biased)
None 2
e.
APRM high (fixed)
None 2
f.
APRM inop.
None 1.
Reactor pressure must be below 600 psig to bypass.
7 I
2.
Channel bypass available.
(
l I
1.16
1.6 Coro Cooling This section demonstrates that the postulated SDV rupture is well within the capability of the normal and emergency core cooling systems.
1.6.1 Compliance with 10CFR50.46 Compliance with 100FR50.46 for design basis analysis is based on the assumed break of a single insert or withdraw line between the HCU and the containment.
The total let age flow for this case is less than 10 gpm and the core never becomes uncovered, so there is no fuel heatup.
However, even if an SDV rupture is postulated, com-pliance with 10CFR50.46 is easily demonstrated. If an SDV rupture occurs in. 251-BWR/4, of sufficient size to pass the full leakage flow of all 185 CRDs, the flow cross-sectional area for an equivalent single liquid break is 0.007 ft.2 (Z.immer with 137 CRD's would have a proportionally smaller size break). Appendix K analyses of small breaks for BWR/3s and BWR/4s shows the maximum calculated peak cladding temperature (PCT) occurs for liquid breaks of about 3.1 ft.2 The calculated PCT is in the 1300-1700 F range, depending on the plant. For smaller break sizes, the calculated PCT is lever; it is in the range of 900-1100 F for a liquid break of 0.007 ft.2, using all assumptions required in Appendix K analyses. Thus compliance with 10CFR50.46 for ar. SDV break is assured; plant specific analyses are not necessary to support this conclusion.
l.6.2 Multiple Failure Core Cooling Analysis Small pipe breaks in BWRs have been extensively analyzed in response to the USNRC's Bulletins and Orders Task Force findings (Reference 3 of NEDO-24342). The postulated unisolated SDV rupture is similar to (although smaller than) the small re-circulation line breaks in non-jet pump plants analyzed in Reference 3 of NEDO-24342.
1.17
For this study however, a special analyais was per-formed to demonstrate conclusively that the SDV rup-ture does not threaten adequate core cooling. This was done by showing that the RCIC, the smallest of the normal or emergency coolant injection systems, can prevent core uncovery even acting alone. The methods used were the same as those used in all of the small break analyses of Reference 3 of NEDO-24342.
Figures.l.6.1 through 1.6.3 show reactor pressure, reactor water level inside the core shroud, and break flows for this event. It is evident from Figure 1.6.2 that core uncovery would not occur, and that reactor water level wenld slowly recover due to the operation of RCIC alone.
Manual actuation of the ADS was assumed to occur at 30 minutes after the event, for the reasons dis-cussed in Section 1.3 Following depressurization, any one of the low pressure injection systems would overwhelm the inventory loss via the pipe rupture.
In order to realistically model the operation of the high capacity low pressure injection systems, which would be controlled manually to maintain water level, a continuous low flow equal to the RCIC capacity was used after depressurization in the evaluations.
Reference 3 of NED0-24342 analyses have covered the case where all of the high pressure injection systems fail, and ADS blowdown assures low pressure injection.
For this small break, realistic PCTs are near the saturated liquid temperature due to the very short time period of uncovery of the top of the fuel.
It follevs that an SDV rupture, even if unisolated, would be dealt with more than adequately by one pump in any of the following high-capacity systems in the plant analyzed:
Feedwater/ Condensate (2 pump trains)
High Pressure Coolant Injection (1 pump) l l
Low Pressure Coolant Injection (3 pumps)
Low Pressure Core Spray (1 pump)
RHR/ Service Water (2 pumps)
Adequate core cooling is thus assured if any one of 10 pumping loops is operable (the above 9 and RCIC). Of these, the principal components of the feedwater/ condensate and RHR/ service water systems are located outside the reactor childing, and are thus not affected by reactor building flooding.
l l
I 1.18
The risk of losing ECCS/RCIC through loss of suppression pool water to the reactor building is also easily ascertained. The suppression pool capacity is about 700,000 gallons of water, and the condensate storage tank capacity is 700,000 gallons (RCIC and HPlc can be switched to either source).
Even if the reactor pressure were maintained in the 135 psja range to permit condintued HPCS/RCIC injection, the SDV rupture flow would be only 130 gpm. At this rate, it would take seven (7) days to deplete a 1,400,000 gallon supply of water; additional water supplies are readily available.
It is noted also that the RHR service water system, which can be used for coolant injection, takes its suction from the plant's ultimate heat sink, which is of practically unlimited capacity. Clearly, the potential loss of water from the primary containment does not challenge the availability of water sources.
It is concluded that the postulated SDV rupture is well within the capability of the BWR's normal and emergency coolant injection systems.
Additionally, at Zimmer we have the ability to process and return to the condensate system the water being pumped to radwaste from the Reactor Building.
1.7 Long Term Decay Heat Removal The need for decay heat removal from the primary con-tainment is almost independent of the core cooling function because of the diversity of coolant injection systLms in the BWR, and because the one-milljon gallon suppression pool will passively absorb decay heat for hours following the SDV rupture. It was shown in Section 1.3 that reactor bui? ding flooding would not threaten the RHR equipment until more than 87 hours0.00101 days <br />0.0242 hours <br />1.438492e-4 weeks <br />3.31035e-5 months <br /> following the event even if the reactor building sump pumps are not operating; and it was shown in Sections 1.4 and 1.5 that the leakage from the postulated SDV rupture can be terminated well before then.
For these reasons, no special analysis of long term heat removal needs to be conducted in this study.
It should be stressed, however, that the preferred means of long term heat removal is the main con-denser, which can be made oparable by established procedures even after main steam line isolation.
The use of the main condenser is not affected by flooding in the reactor building.
1.8 Core Damage Probability An evaluation of the probability of core damage due
1.8 continued to an unisolated SDV rupture has been perfonned and is presented in detail in Appendix A of the NEDO-24342. The fre takentobe<3x10guencyofanSDVrupturewas events per reactor year, as developed in Section 6.3 of NEDO-24342. This value is believed to be an overestimate of the actual probability. Event trees were constructed to evaluate all possible failure paths, prob-abilities were assigned to failure modes based on the most recent studies (Reference 2 of NEDO-24342) and an uncertainty analysis was conducted.
The results show that the expected frequency'of core damage resulting from an unisolated SDV rupture is less than 2 x 10 ' events per reactor year. Even at the high'end of the error band of the analysis, the frequency is less than 1 x 10 7 events per re-actor year. The value is well below that calculated for other loss-of-coolant events.
It is concluded that the SDV rupture has a risk potential much lower than other, more credible, events routinely analyzed in plant design and licensing.
1.9 Environmental Qualification of Equipment Following a postulated rupture in the scram dis-charge volume piping, various equipment located in the reactor building will be required to operate to' depressurize and cool down the reactor. This equipment could be exposed to environmental con ditions of high temperature (140 F) and high rel-ative humidity for several hours.
General Electric design specifications (for BWR/4, 5, & 6) require that essential equipment be de-signed to operate under abnormal conditions which are similar to those expected in the reactor building after an SDV pipe rupture. The con-ditions specified for the core spray and RER systems are a temperature of 148*F, and a rel-ative humidity of 100%, for a duration of twelve hours. The specific components included e~e valves, operators, cabling, pt.mps, motors, seal coolers, instrumentation, controls, electrical equipment, and cables (power and instrumentation).
Based on IE Bulletin 79-01, qualification data searches and testing for all operating plants
~
have been done or are in progress. Preliminary investigations indicate that this equipment will operate satisfactorily under the envircnmental conditions expected to result from an SDV pipe rupture.
2 120
~
1.10 Summary In this section, which studied the effects of a postulated scram discharge volume rupture for BWR plants with a MK II containment, the following conclusions were reached:
(1) Disablement of ECCS and RHR equipment due to flooding would be highly unlikely; (2) Even if such disablement were postulated, it would not happen for several days, even if the reactor building sump pumps were inoperable; (3) Equipment in the reactor building would noi; be disabled by environmental effects other than flooding; (4) Access to the HCU's for manual isolation would be possible long before flooding would be of concern; (5) Established procedures and many indications would permit detection of the event, and per-mit a variety of options for its mitigation; (6) Core cooling would be assured even with the smallest of the plant's normal and emergency coolant injection systems acting alone; (7) Core cooling would be assured with any one of the plant's 10 coolant injection pumps operable, 4 trains of which are not subject to reactor building flooding; (8) The frequency of core damage due to an SDV rupture is much lower than the core damage frequency from many other postulated inventory-threatening events.
It is concluded that no special provisions need be made to prevent or mitigate the effects of a scram discharge volume rupture in a plant with a MK II containment such as Wm.. H. Zimmer Nuclear Power Station - Unit 1.
1.21
SECTION 2 COMPLIANCE WITH REACTOR COOLANT PRESSURE BOUNDARY REQUMEMENTS This section presents supplemental information which shows compliance of the scram discharge system with federal code requirements on reactor coolant pressure boundary design.
2.1 Evaluation of Code Coup 11ance 2.1.1 Reactor Coolant Pressure Boundary (RCPB) Definition, to Section 50.2 (v) of 10CFR50 The RCPB is defined to be the pressure containing components which are either: 1) part of the reactor coolant system, or 2) connected to the reactor coolant system, up to the outermost, redundant iso-lation barrier.
The Control Rod Drive (CRD) meets the second of these conditions and is therefore considered to be the RCPB for the scram discharn system. Redundant CRD seals and restrictive flow areas that are in-herent to the CRD provide redundant RCPB isolation.
The withdraw lines are therefore not considered part of the RCPB. The integrity of the isolation barriers and of the withdraw lines are discussed further in the following paragraphs.
2.1.2 RCPB Penetrating Containment, Compliance to 10CFR50 Appendix A General Design Criteria (GDC) 55 The scram discharge system's withdraw lines penetrate containment but are not considered to be part of the i
4 RCPB. The CRD isolates the withdraw lines from the reactor coolant through passive means. The small diameter (i.e., < 1 inch pipe size) withdraw lines perform important to safety functions and therefore, just as with many instrument lines, no automatic isolation valves are utilized. Excess flow check valves, commonly used on instrument lines where no flow exists, cannot be utilized on the withdraw lines without degrading the scram function. For these reasons the passive isolation barriers inherent in the CRD design are utilized for the RCPB isolation.
Regulatory Guide 1.11 describes design measures to assure compliance to GDC 55 for instrument lines that are important to safety. The passive isolation barriers utilized by the CRD meets the intent of Regulatory 2.1
Guide 1.11 by minimizing leakage from a postulated with-draw line rupture to a value which is within the ca-pability of the reactor coolant makeup systems. Tests have shown that under worst caso conditions leakage from a simulated withdraw line rupture is less than 10 gpm. The break flow from an instrument line failure is typically in excess of 20 gpm. Therefore, the con-sequence of a withdraw line break outside the primary containment are conservatively bounded by the standard design bases safety evaluations of an unisolable in-strument line break outside containment.
Although the CRD provides sufficient RCPB isolation, the integrity of the withdraw lines and SDV piping is required for a safe and orderly scram. Therefore, to minimize the probability and potential consequences of a line rupture, these lines are designed and fab-ricated to ASME Section III, Class 2, requirements.
These Code requirements assure adequate safety par-ticularly in the case of the SDV piping which is pressurized less than one percent of the time.
In summary, the scram discharge systems RCPB ends at the CRD. Rigorous tests have demonstrated the acceptability of the CRD as the RCPB.
Futhermore, the withdraw lines and the SDV piping, which connect i
to the RCPB, are considered important to safety and therefore are designed and fabricated to quality standards that tssure their integrity.
2.1.3 Application of Codes and Standards, Compliance to Section 50.55a of 10CFR50 (including footnote 2)
All pressure containing components of the CRD are de-signed and fabricated to the ASME Section III, Class 1 requirements.
As discussed previously, although the withdraw lines, are not part of the RCPB, they are important to safety and therefore designed and fabricated to ASME Section III, Class 2 requirements.
The currently applicable ASME III Class 1 and 2 re-quirements are considered fully adequate for scram discharge system design, particularly in the case of the SDV, wLich is pressucized less than one per-cent of the time.
2.1.4 Reactor Coolant Pressura Boundary Integrity, Compliance to 10 CFR50 Appendix A General Design Criteria (GDC) 14 The integrity of the CRD as the RCPB and the integrity of the lines that connect to it are assured through their design, fabrication, and testing. As discussed in Section 2.1.3, the pressure containing components of the CRD are designed and fabricated to ASME III, 2.2
?
Class I requirements. The CRD is designed and tested to withstand Seismic Category 1 loads. Tests, simulating a withdraw line rupture, have successfully demonstrated the RCPB integrity of the CRD.
2.1.5 Emergancy Core Cooling System Integrity, Compliance to 10CFR50 Appendix A General Design Criteria (GDC) 35 i
For MK II containment designs, the consequences of the design bases withdraw lino rupture relative to compliance with GDC 35 have already been assessed in the standard licensing review process. As discussed in Section 2.1.2, the consequences of a withdraw line rupture is bounded by the standard design bases evaluation of an instru-ment line break. Therefore, the compliance with GCD 35, if applicable, is assured by the documented in-strument line break analyses.
2.2 Summary In summary, the reactor coolant pressure boundary in the scram discharge system is defined to be at the Control Rod Drive. Based upon this definition, the Scram Discharge System is concluded to be in compliance with the federal code requirements for reactor coolant pressure boundary design.
2.3 i