Text

Informs Commission of NRC Plans for Issuing Draft SER on Chapter 5 of Advanced LWR Requirements Document
	ML20011C620
Person / Time
Issue date:	07/28/1989
From:	Taylor J; NRC OFFICE OF THE EXECUTIVE DIRECTOR FOR OPERATIONS (EDO)
To:	;
References
	TASK-PINC, TASK-SE SECY-89-228, NUDOCS 8908040233
	Download: ML20011C620 (94)
	v • d • e

f k h....."+ N...........

l go l

foig g

RELEASED T HE PDR g.....j i

r i

who 96 i.

in r

................n.....:

i July ?8, 1989 POUCY ISSUE s = - a-228 (NEGATIVE CONSENT)

F,ori The Comissioners r

From:

James M. Taylor, Acting Executive Director for Operations

Subject:

DRAFT SAFETY EVALUATION REPORT ON CHAPTER 5 0F THE ADVANCED i

LIGHT WATER REACTOR REQUIREMENTS DOCUMENT p

l

Purpose:

10 inform the Comission of the staff's plans for Mji{'

issuing the draft safety evaluation report (SER) on F ' '-

Chapter 5 of the Advanced Light Water Reactor (ALWR)

Requirements Document.

Discussion:

TheElectricPowerResearchInstitute(EPRI),in i

conjunction with the utility sponsored ALWR Steering l

Comittee, is preparing a compendium of technical i

requirements applicable to the design of an ALWR plant i

referred to as the ALWR Requirements Document. When completed, this document will be a comprehensive statement i

of utility requirements for the design, construction, and i

performance of an ALWR power plant for the 1990s and l

beyond, t

I The Requirements Document will consist of three parts.

Part I the Executive Sumery, will be a man 6gement-leyc1 i

synopsIsoftheRequirementsDocument inc?cding the design objectives and pt.ilosophy, the overall physical configurstion 1

and features of a future nuclear ptsnt casignsteps necessary to take ar criteria i

beyond the conteptual destin ht4te tc a compitted, fur.ction.

ina power plant.

Pr.rt 11 will consist of.13 chapters and

[

will contain utility design ren.virement!, for er evolutiewy q

L

)

CONTACT:

T. Kenyon, NRR/PDSNP I

492-1103 Yl r

hY h

%mj

___ o B4drotoA33 #fM'#

W M

mmMMmmmmma I

~

e i

I I

The Comissioners l nuclear power plant (approximately 1350 W e). Part !!! will l

contain utility design requirements for nuclear plants that utilize passive features in their designs (approximately l

300400 We),

j The staff is preparing draf t $ERs to discuss the results of i

its review of the Requirements Document on a chapter by.

chapter basis. When EPRI has revbmitted all three parts in i

its final document, the staff will issue a final SER to provide its final conclusions on the Requirements Document.

l Attached is the draf t SER in which the staff provides the status of its review of Chapter $ of the Requirements Document. Chapter 5 discusses engineered safety systems.

Key issues covered in the review include:

i public health and safety goal severe accident prevention and mitigation severe-accident containment performance criteria hydrogen generation and control source-term issues l

anticipated transients without scram high/ low pressure interface design operation of residual heat removal system with reduced reactor coolant system inventory j

equipment survivability during a severe accident t

station blackout fire protection The steff plans to forward this draf t SER to the ALWR Steering Comittee, EPP.1, and the ACR$ in order to provide the status of the review and to delineate the open issues remaining in regard to Chapter $.

The >csitions in this draf t $ER reflect the staff's current tiinking on these issues. After additional interactions with the ALWR Steering Comittee and EPRI. the staff intends to issue another draf t SER on Chapter 5, in which it will discuss the resolution of the issues.

Reconenendations:

That the Comission 1.

Note the staff's plans to issue the draft SER on i

@ter 5 of the ALWR Requirements Document provided in the enclosure, j

I i

[

i The Commissioners :

l i

r E

2.

Note that the staff intends to illut the draf t $[R InTplace it in the Public Document Room within 10 working days of the date of this paper unless otherwise instructed by the Commission.

3.

Note that the staff is scheduled to brief the E ission on the status of its review of the EPRI ALWR Requirements Document on August 1, 1989.

l

/

i

( __ _ W j

nos M. Tay1

, Acting i

Executive Director 3

for Operations l/

b'-

i

Enclosure:

Draft SER on Chapter 5 of the ALWR Requirements Document l

L SECY NOTE:

l In the absence of instructions to the contrary, SECY will notify the staff on August 15 d 989 that the Commission, l

by negative consent, assents to the action proposed in this paper.

l DISTRIRUTIOM:

Comniscioners OGC IG GPA i

REGIONS l

EDO f

ACRS ASLBP i

ASLAP SECY i

i i

I l

j

kd Chf[-d.

r I

.O 7pel9 o

p 1

DRAri SAFETY EVALUATION REPORT ON CHAPTER S Of THE ADVANCED LIGHT WATER REACTOR REQUIREMENTS DOCUPENT

)

prepared by the Office of Nuclear Reactor Regulation U.S. Nuclear Regulatory Comission July 1989

[

l' l

4 6

l i

p i

i l

[

t ABSTRACT l

l t

The Electric Power Research Institute (EPRI) is preparing a compendium of

(

technical requiresents applicable to the design of an advanced Itght heter reactor (ALWR) power plant referred to as the ALWR Utility Requirepents Docupent. When completed, this document is intended to be a comprehensive statement of utility requires =nts for design, construction, and performance of an ALWR power plant for the 1990s and beyond.

i r

i The Requirerents Docunent will consist of three parts:

Parti,lhdxecutive

[

Summary is a management-level synopsis of the Requirements Document, including i

design objectives and philosophy, overall physical configuration and features i

of a future nuclear plant design, and the steps necessary to take the proposed l

ALWR design criteria beyond the conceptual design state to a completed, functioning power plant.

Part !! will consist of 13 chapters and will contain i

utility design requirements for an evolutionary nuclear power plant (approximately1350MWe). Part !!! will contain utility design requirements l

for nuclear plants that utilfre passive features in their designs (approximately 300600MWe).

The U.S. Nuclear Regulatory Comission, Of fice of Nuclear Rcactor Regulation, st6ff is preparin9 crr.ft safety evaluation reports (65I.Rs) to discvss the results of its review of the Pequiroments Document on a chaptu by.ch.9.pter basis. When EPRI has submitted c11 three parts in their roll up document, the i

staff will issue a final safety evaluation report ($ER) to discuss its final

}

conclusions regarding the Requirenents Document.

l In $vptember 1987, the staff issued the first D$ER in this series which addressed the Requirenents Document Executive Sunsnary and Chapter 1. 'Overall Requirenents," regarding the overall objectives and requirements of the ALWR program. Chapter 2, " Power Generr. tion Systems," was evaluated in the second D$ER which was issued in February 1988. The third DSER, issued in May 1988, covered Chapter 3, " Reactor Coolant System and Reactor Non $4fety Auxiliary EFRI Chapter 5 DSER 11 July 1969 l

r

l l

l

$ystems.* The fourth DSER, issued in June 1988, covered Chapter 4, " Reactor

$y:,tems. '

This 0$[R distusses the staff's review of Chapter 5.

Engineered $afety Systems." This chapter was prepared by Bechtel power Corp., Com6ustion Engineering, Inc., Commonwealth Edison Company, Duke Power Company, General l

Electric Costany, MPR Associates, Inc., $. Levy Incorporated, $ argent and

(

Lundy Engineers, Stone and Webster Engineering Corp., Westinghouse Electric Corp., and Yankte Atomic Electric Company under the project direction of the l

Electric Power Research Institute Palo Alto, CA. and' the ALWR Utility l

Steering Comittee. The requirements apply to boiling water reactors anc pressurtred water reactors in sites up to 1350 MWe.

I s

t t

l l

i l

i i

l i

I l

EPRI Chapter 5 DSER iii July 1989

c TABLE Of CONTENTS

!.agt ABSTRACT............................................................

11 1

INTRODUCTION AND GENERAL DISCUS $10N............................

11 1.1 S cope a nd S tru ctu re of Chapte r 5..........................

13 1.2 ALWR Design Bases.........................................

14 1.3 Regulatory stab 11tration..................................

14 1.4 Outstanding !ssues........................................

15 2

TOP-LEVEL REQVI RENENT$ COMMON TO bWR$ AND PWR$................. 21 2.1 ALWR Public Safety Goa1...................................

21 2.2 S t a t i o n B 1 a c i ou t.......................................... 26 2.3 Zirconium Water Reaction and Hydrogen Generation..........

2-7 2.4 Decay Heat Calculations (ANS 5.1).........................

2-8 2.5 Fire Protection...........................................

2-9 2.6 Severe Accident Analyses..................................

2-10 3

ALWR CORE DAMAGE PREYENTION REQUIREMENTS............,..........

31 3.1 Inservice Testing.........................................

3-1 3.2 Diesel Generator Start Time...............................

3-2 3.3 Electric Yalve Operators..................................

3-3 3.4 Anticipated Transients Without Scram......................

33 4

BWR CORE-DAMAGE PREVENT ION REQUI REMENTS........................ 4-1 4.2 Elimination of Core Spray.................................

4-1 4.2 Anticipated Transients Without Scr6m......................

4-1 4.3 S t a ndby L iqu io Control Sy s tem............................. 4-2 4.4 Safety Classific6 tion of Containment Spray System.........

43 4.5 Suppres sion Pool Bypa s s Lea ka ge.......................... 4-3 EPRI Chapter 5 D$ER iv July 1989

i TABLEOFCONT[NTS(Continued)

I i

E!st i

4.6 Suppression rool Temperature-Monitoring system............

4-5 l

5 5

PWR CORC DAMAGE-PREVENTION REQUIREMENT $........................ 51 i

t 5.1 Introduction..............................................

5-1 5.2 Residual Heat Removal System..............................

5-1 5.3 E me rgency Feedwa t e r Sy s t em................................

52 I

5.4 S a f e ty I n j e c t i o n Sy s t em...................................

5-5 5.5 $afe ty Depres suritation a nd Vent Sys ten...................

5-5 6

MIT!GATION REQUIREMENTS........................................

6-1 i

6.1 Introduction..................................

........... 61 f

6.2 Containnent I solation System Design.......................

6-1 s

6.3 Conta inpent L e s ta ge Rat e Tes ting.......................... 6-4 i

6.3.1 Containnent Integrated Leak Rate Test..............

6-4 i

6.3.2 Ty pe B A i r L o c k T e s t s.............................. 6-5 6.3.3 Type C Containnent Local Leak Rate fests...........

6-6 6.4 Fi ss ion P rodu ct L ea ka ge Cont ro1...........................

6-7 i

6.5 Combustible Gas Contro1...................................

6-6 l

t 6.5.1 Metal-Water Reaction and Hydrogen Concentration....

6-8 6.5.2 Radioly tic Hydrogen Genera tion..................... 6 10 6.5.3 Inerting/lgniters..................................

6-10 6.6 Severe A cci dent Requ i rements..............................

6-11 6.6.1 Containment M6rgin.................................

6-12 6.6.2 Cavity / Pedestal Drywell Configuration, Debris Coo 1 ability........................................

6-12 i

i EPRI Chapter 5 D$ER v

July 1989

,m e

m,

TABLE OF CONTENTS (Continued) i Uit 6.6.3 Containment Heat Remove 1...........................

6 14

{

6.6.4 Fission Product Contro1............................

6 14 i

6.6.5 RCS Depressurization capab111ty....................

6 15 6.6.6 Equipment Survivability............................

6 16 6.6.7 Centainment Nixing Provisions......................

6-17 l

6.6.8 Severe Accident Management.........................

6 17 i

6.6.9 Externally Initiated Severe Accidents.............. 6 18 7

BWR MIT IGATION/CONTAllHENT REQUIREKENTS........................

7-1 7.1 Introduction..............................................

7-1 7.2 Performance Requirements..................................

7-1 i

t 7.3 Equi pent Des ig n Requ t rena nt s............................

73

)

t P

PKR MIY!GATION/ CONTAINMENT RE0VIPEMENTS........................

8-1 8.1 Primary Containment.......................................

8-1 l

8.2 Co n t a i nne n t S p r ay Sy s t em.................................. 8-3 8.3 Fis sion Product Removal and Control System................ 8-5 i

(

9 CONCLUSION.....................................................

9-1 1

APPENDICES 1

p t

A DEFINITIONS B

GENERIC SAFETY AND LICENSING ISSUE TOPit PAPERS f

C OPTIMlZATION SUBJECTS f

EPPI Chapter 6 DSER v1 July 1989

i J

DRATT SAFETY EVALUATION REPORT ADVANCED LIGHT WATER REACTOR REQUIREMENTS DOCLMENT CHAPTER 5, *ENCINEERED SAFETY SYSTEMS *

)

i 1

INTRODUCTIDN AND GENERAL DISCUS $10N j

The Electric Power Research Institute (EPRI) is preparing a compendium of l

technical requirements applicable to the design of an advanced light water reactor (ALWR) power plant referred to as the ALWR Utility Requirements l

Document. When completed, this document is intended to be a comprehensive j

statement of utility requirements for design, construction, and performance of l

an AlkR power plant for the 1990s and beyond.

i The Requirements Document will consist of three parts:

Parti,TM,Emecutive f

e Sunnary, is a management-level synopsis of the Requirenents Document, including design objectives and philosophy, overall physical configuration and l

features of a future nuclear plant design, and the steps necessary to take the l

proposed ALWR design criteria beyond the conceptual design state to a

{

completed, functioning power plant. Part !! will consist of 13 chapters and

.{

will contain utility design requirements for an evolutionary nuclear power plant (approximately 1350 MWe).

Part !!! will contain utility design i

requirements for nuclear plants which utilire passive features in their i

designs (appreximately 300-600 P.We),

i The U.S. Nuclear Regulatory Commission, Of fice of Nuclear Reactor Regulation,

{

staff is preparing draft safety evaluation reports (DSERs) to discuss the results of its review of the Requirements Document on a chapter-by-chapter basis. When EPRI has submitted all three parts in their roll-up document, the

[

staff will issue a final SER to discuss its final conclusions regarding the Requirerents Docunent.

The staff is conducting its review of the Requirements Docunent as described in NUREG-1197

Advanced Light Water Reactor Program."

As noted therein, the staff is using NUREG-0800 " Standard Review Plan" (SRP),

for review guidance.

In addition to the criteria of NUREG-0800, the staff's review reflects the requirerents of 10 CFR Part $2. "Early Site Permits; Standaro Design Certifications; and Combined Licenses for Nuclear Power i

I EPRI Chapter 5 DSER 1-1 July 1989

i

(

\\

i Reactors", and the Comission's ' Policy $tatement on Severe Reactor Accidents Regarding future Designs and Existing Plants" (50 FR 32138).

l In September 1987, the staff issued the first DSER in this series which addressed the Requirements Document Executive Summary and Chapter 1. 'Overall Requirements,' regarding the overall objectives and requirements of the ALWR f

program.

Chapter 2, " Power Generation Systems,* was evaluated in the second

{

DSER which was issued in February 1988. The third D$[R, issued in May 1988, covered Chapter 3, ' Reactor Coolant $ystem and Reactor Non $4fety Auxiliary f

Systems.' The fourth D$ER, issuto in June 1988, covered Chapter 4,

Reactor j

Systens '

I i

)

On December 8,1967, the ALWR Utility Steering Committee ($teering Committee) submitted Chapter 5 of the Advanced Light Water Reactor Requirements Document j

(Requirements Dorument) entitled

Engineered Safety Systems' for staff review.

{

Additional information was submitted by letters dated August 16, 1988 and l

$sptarter 15, 1988. The chapter was prepared ty Bechte? Power Corp.,

Conbustion Engineering, Inc., Comnonwealth Edison Company Duke Power Company, j

General Electric Company, MPR Associates, Inc., $. Levy Incorporated Sargent and Lundy Engineers, Stone antt Webster EnCineering Corp., Westingoouse Electric Corp., and Yankee Atomic Electric Corp &ny under the project direction j

of the Electric Power Research Institute, Palo Alto, CA and the ALWR Utility I

Steering Committee.

Key issues in the Chapter $ review include:

I public health and safety goal l

severe accident prevention and mitigation severe accident containment perfonnance criteria hydrogen generation and control j

source-term issues fire protection l

containment local leak rate test interval emergency power source start and load sequence tine elimination of core spray for BWRs i

EPRI Chapter 5 DSER 1-2 July 1989

I elimination of the standby liquid control system ($LC$) as a backup f

for ATW$

l PWR safety injection system design including the in containment

[

refueling water storage tank and direct vessel injection

{

use of RHR and C$ pump crossconnections as backups to allow maintenance during plant operation f

resolution of generic safety issues PWR high/ low interface design i

The staff's evaluation of Chapter 5 of the Requirements Docunent is documented in Chapters 2-8 of this draft safety evaluation report (DSER). The foru t of this DSER follows that of Chapter 5 of the Requirenents Document as closely as possible.

Unless otherwise noted, references to sections of the Requirenents f

Document are directed toward the Chapter 5 submittal, Copies of this report are av611able for inspection at the NRC Public Document l

Room 2120 L Street, N.W., Washington, D.C. 20555.

l The NRC project manager for the staff's review of the ALWR Utility Require-f ments Docunent is Thomas J. Kenyon.

He may be contccted by calling l

(301)492-1103 or by writing to: Division of Reactor Projects - 111, !Y, Y, f

and Special Projects U.S. Nuclear Regulatory Commission, Washington, D.C.

20555.

1.1 Scope and Structure of Chapter 5 Chapter 5 of the Requirenents Document defines the ALWR Utility Steering Committee's requirements for design of the engineered safety systems for advancedlightwaterreactors(ALWRs).

Engineered safety systems are provided to prevent or mitigate the effects of a spectrum of postulated accidents.

Chapter 5 applies to evolutionary boiling water reactors (BWRs) and pressurized-water reactors (PWRs)(approximately 1350 MWe).

In the near future, the ALWR Utility Steering Committee intends to submit parallel chapters of the ALWR Utility Requirements Docunent applicable to facilities using such innovative concepts as passive safety systems.

l EPRI Chapter 5 DSER 1-3 July 1989

b i

1.2 ALWR Design Bases l

l The term 'ALWR design bases

refers to the three sets of requirewents that i

form the foundation for the ALUR design.

The first set of requirements forms the ' licensing design basis' which includes the requirements necessary to sat-1sfy regulatory criteria. These requirerents and associated analytica) l anthods are based on conservative, NRC approved methods, and equipment is j

designes to safety grade standares.

The second set is the

risk evaluation basis' which extends the licensing design basis to meet public safety l

objectives. The risk evaluation basis utilizes probabilistic risk assessment (FRA) methods.

The third set of design bases is the

performance design l

basis' which is based on utility economic and investment protection l

considerations and employs realistic, designer selected, best-estimate methodology.

The licensing design basis is intended to provide an ' adequate level of safety," whereas the risk evaluation and performance design bases provide additional or " enhanced protection.'

1.3 Re,julatory Sta g t,ation Consittent with the overall AWR program approach, as described in NUREGa1197, regulatory stabilization for the ALWR is to be achieved through identification f

and resolution of plant optimization subjects and generic safety and licensing

}

issues.

Generic safety and licensing issue topic papers related to engineered safety l

systems are addressed in Appendix B of this report.

l l

Plant optimization subjects presently do not meet regulatory requirements.

EPRI proposes to resolve these issues by providing technically supportable alternatives to current regulatory requirements.

The ALWR optimization issues relating to engineered safety systems include:

source terms for design-basis accidents containment leek rate testing hydrogen control l

l EPRI Chapter 5 DSER 14 July 1989

Optimization subjects are discussed in Appendix C of this report.

1.4 Outstanding issues As a result of the NRC review of the ALWR btility Fequirements Document, a i

number of items ren,ain outstanding at the tire of this report.

Because it has I

either not completed its review and reached a final position or it has reached a conclusion different from EFRI in these areas, the staff considers these l

issues to be open.

These issues fall into one of four categories: (1) issues that require satisfactory resolution before the staff can complete its review of Chapter 5 of the Requirenents Document, (2) issues for which staff review of other related chapters of the Requirements Document has not yet been completed, (3) confirmatory issues for which the staff will ensure followup of commitnents in the Requirewnts Documents, and (4) issus that require satisfactory resolution in support, of a plant specific applicatirn. The open itens, with appropriatet references to sections of this report given in parentheses, tre listed k1ow:

Issues to Be Aesolved Before the Staff Can Cotoplete Its Review of Chapter 5 i

(1) ALWR public safety goal (2.1) f (2) severe accident containment perforr,ance criteria (2.1)

(3) netal water reaction and hydrogen generation and control during a severe accident (2.3, 6.5.1, B.8, C.3) i (4) automatic standby liquid control system (4.3)

(5) effective distribution of boron injection (4.3)

(6) safetyclassificationofcontainmentspraysystem(4.4,7.2) i (7) Suppression pool-bypass leakage (4.5, 7.2)

(8) suppression pool temperature-nonitoring system (4.6)

(9) operation of residual but removal (RHR) system with reduced reactor coolant system inventory (Generic Letter 87-12)(5.2)

(10) safety depressurization and venting system (5.5, 6.6.5, 8.10)

(11) useofremotemanualvalvesonessentialnon-ESFlines(6.2)

(12) containmentisolationprovisionsforIRWSTconnections(6.2)

(13) Type C leak testing (6.2) l (14) Type B testing of air-locks (6.3.2) l EPRI Chapter 5 DSER 1-5 July 1989 l

I

r o

(15) Type C contairment valve leak rate testing interval (6.3.3, C.1)

()()

interf ace requirements for fission product leakage control systens (6.4)

(17) control systems for radiolytically gererated hydrogen (6.5.2, 8.8, C.3)

(18) timing of igniter activation in the event of an accident (6.5.3, B.B.

C.3)

(19) containmentheatremoval(6.6.3)

(20) functionability of fission procuct control systems during a severe accident (6.6.4)

(21) equipment survivability criteria for severe accidents (6.6.6)

(22) severeaccidentmanagement(6.6.8)

(23) dynamic effects of pipe breaks during severe accidents (7.2, 8.1))

(24) main steam isolatiere valve (MSIV) leakage rate (7.2)

(25) contatunent leak rate (8.1. E.2, C.2.5) l (26) postaccidentpHcontrol(8.2.C,2.1' (27) contairement integrity check (B.2) l (28) pWR high/ low pressure ititerface iesign (B.L) i (29) deletion of charical adsorbers (0.2.2)

(30) BWR suppression pool fission preeuct scrubbing (C.L.3)

(31) timing of fission product releases inte contair. rent (C.2,4)

Issues To Be Addressee in Staff Review of subsequent Requirenents Document l

Chapters i

(1) stationblackout(2.2,B.9)

(2) fireprotection(2.5) l (3) inservice testing of valves (3.1) l (4) anticipatedtransientswithoutscram(3.4,4.2) i (5) containmentloadingduringsevereaccidents(6.6.1)

(6) cavity / pedestal-drywell configuration, debris coolability (6.6.2)

(7) containmentatmospheremixing(6.6.7)

(8) externallyinitiatedsevereaccidents(6.6.9)

(9) protection against BWR containment reverse pressurization (7.1) j (10) fission procuct leakage control system (7.1) l EPRI Chapter 5 DSER 1-6 July 1989

i e

Confirmatory Issues (1) Appendix J local leakage testing (3.1)

(2)

I w temperature overpressure protection (LTOP)(5.2)

F (3) automatic / manual initiation of feedwater flow (5.3)

(4) use of liquid in Type C containment leak rate testing (6.3.3)

(5) actuation of the containment spray system (8.2)

(6) tw-temperature overpressure protection (B.10)

Plant-Specific Issues (1) station blackout (2.2 B.9)

(2) diesel generator start times (3.2)

(3) elimination of RWR core spray (4.1)

(4) Laitty injection systom ($!$) design pressure (5 4)

(5) radiolytical)y generated hydrogen control system (6.5.2) l (6) analysis of oxygen generation curing a severe accident (6.5.3)

(7) suppressio.pooldesign(7.3)

(6) emergancy feewater system design analysis (B.4)

(9) high/1w.pressureinterfacedesign(B.5) i (10) pressureisolationvalvetesting(B.5)

I f

i t

l l

l t

l EPRI Chapter 5 DSER 1-7 July 1989 1

1

2 TOP LEVEL REQUIREMENTS COMMON TO BWR$ AND PWR$

The design bases of the ALWR are intended to provide a balance between core protection and core damage mitigation. The core-damage prevehtion functions include: (1) the core coolant inventory function. (2) the decay heat removal function, (3) the diverse reactivity function, and (4) the RCF pressure control function.

The mitigation functions includet (1) the containment ititegrity function and (2) the fission product control function. The engineered safety systems, in conjunction with supporting systems described in other chapters of the Requirements Document, serve to provide these functions.

Sections 2.1 through 2.4 of Chapter 5 of the Requirements Document define e

top level requirerents applicatle to both the core deure preventien and mitigation features of EWfts ar.d PVRs. The following is e oiscussica of the stcff's review of the issues addrest.e( in Section 2 cf Cnapter 6 of the Requirements Document.

2.1 ALWRPublicSaf,etyGog Section 2.2.I of Chapter 5 of the Requirements Document states:

TheEngineeredSafetySystemsshallcollectively(andinconcert with the other features specified in the Requirements Document) permit the ALWR to meet or exceto the safety goals specified in i

Chapter 1, Section 1.4. A. specifically:

Frequency of core damage t 1.0x10"b event per reactor-year.

l Whole-body dose at an assumed 0.5-mile site boundary must be less than 25 rem for events whose cumulative frequency exceeds 4

1.0x10 per reactor-year.

Both criteria shall be deronstrated by PRA.

1 The Steering Committee's basis for selecting 25 rem as the whole body dose criterion is that this value is recognized as "a very low dose with no observable health effects." The Steering Corzittee's basis for the associated EPRI Chapter 5 DSER 2-1 July 1989

accident frequency is that 1.0x10 6 is *1ow enough to satisfy the utilities' desire for exct11ence and the public perception," and is analytically comonstrable.

The staff has evaluated these objectives in comparison with the Coerission's safety goal policy, which was announced on August 4,1986($1FR23044). The Commission's safety goal proposed as qualitative goals that the operation of a nuclear power plant should pose very low risks to nearby individuals and to

society, in addition, the following quantitative objectives were to be used in determining achievement of these goals:

The rist: to an overage individual in the vi:inity of a nuclear power p'ent, of pronst fatalities from a reactor accident should not e/ceed 0.1 percent of the sum of prompt fatality risks from othwr accic'ents.

The i-isk to the population in the alta near a nuclear power plant of cancer fatalittes iesulting from reactor operation should not excted 0.1 percent of the sum of cancer fatality risks from all other causes.

No specific guidance with regard to core damage frequency is provided in the policy statement.

However, as a possible guideline for regulatory implement.

ation, the Commission further proposed to the staff that it consider that the "overall mean frequency of a large release of radioactivity to the environment from a reactor accident should be less than 1 in 1,000,000 per year of reactor operation." Before the staff can complete its evaluation to determine whether EPRI's second ALWR public safety criterion, given above, is consistent with this guideline, the term " cumulative frequency" regarding a large release needs to be clarified.

Pending this clarification by EPRI and staff's sub-sequent evaluation, this issue remains open.

In addition to designing an ALWR to meet the given public safety goal, the designer will also be required to show that the facility meets the dose gui.falines of 10 CFR Part 100 for the limiting design-basis accidents.

EPRI Chapter 5 DSER 2-2 July 1989 i

I y'

j i

?

In a letter to the staff datet April 6,1988, the Chairman of the ALWR Utility t

8 Steering Counittee indicated that the ALWR public safety criteria do not contain explicit criteria for conditional probability of containment failure or other mitigation features since the Steering Committee believes that such criteria could potentially distort the balance in safety design and inhibit 1

innovative improvements in core protection features. The letter cites the consistency of this position with the conclusions of the February 3, 1988 NUMARC Containment Integrity Working Group Report.

The staff believes that a fundamental principle of safety, defense-in-depth, 1s based on the concept that multiple barriers should be provided to ensure i

the integrity of. those barriers to prevent any significant release of radioactivity.

In its Severe Accident Policy Statement, the Commission indicated that it "... fully expects that vendors engaged in designing new (or custom) plants will achieve a higher standard of severe-accident safety performance than.their prior designs." A defense-in-depth approach reflects an awareness of the need to make safety judgements in the face of uncertainties; in effect, not putting all the eggs in one basket.

In that regard, the reactor containment boundary should serve as a reliable barrier against fission product release for credible severe-accident

. phenomena / challenges.. Every effort should be made to eliminate or further

' reduce the likelihood of a sequence that could bypass the containnent. The continued reliance on the traditional principle of containment of fission products following an accident is seen as the logical and prudent approach to addressing reasonable questions which will persist regarding our ability to accurately predict certain aspects of severe accident behavior.

In order to ensure balance between prevention and mitigation, some criteria on containment performance are appropriate. Accordingly, a general goal of limiting the con-

[

ditional containment failure probability to less than 1 in 10 when weighted over credible core-d6 mage sequences would constitute appropriate attention to the defense-in-depth philosophy.

Pr:babilistic risk assessment is a very powerful tool that permits systematic integrated assessment of design strengths and weaknesses.

However, because very low frequency scenarios (approximately 1.0x10-6 per reactor-year) are being adarussed, it is importent to keep perspective of the very large EPRI Chapter 5 DSER 2-3 July 1989

1 I

4 i

- uncertainties in the quantification of these scenarios. The overall uncertainties in severe accident behavior are driven largely by insufficient i

data for assessing consnon-cause failures, difficulty in quantification of the potential for human errors, and overtions over completeness of analyses and f

uncertainties in phenomenological behavior, for this reason, the staff considers it acceptable to utilize a deterministic containment performance criterion i

that would provide a level of containment performance comparable to that which could be demonstrated using a probabilistic containment failure goal of 10-percent given a severe accident.

l The containment function, i.e., maintenance of a leak tight barrier against radioactivity release, is faced with distinct challenges as a result of a severe accident. Those challenges may be roughly divided into two categories, energetic or rapid energy releases and slower, gradually evolving releases to the closed containment system.

Examples of containment loadings that fall into the first category incluoe high-pressure core melt ejection with direct containment heating, hydrogen combustion, and the initial release of stored energy from the reactor coolant system.

Slow energy releases to the containment are typified by decay heat and noncondensible gas generation.

Engineering practice in conteinment design calls for providing passive capability in dealing with energetic energy releases where practicable while long-term energy releases may be controlled by both passive means as well as through active intervention. On this basis, the staff concludes the following general criteria for containment performance during a severe-accident challenge are appropriate for the evolutionary ALWRs.

The containment should maintain its role as a reliable leak tight barrier by ensuring that containment stresses do not exceed ASME service level C limits for a minimum period of 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months following the onset of core damage.

EPRI Chapter 5 DSER 2-4 July 1989

l i

Maintaining containment integrity for the first 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months is based on providing f

sufficient time for the remaining airborne activity in the containment (principallynoblegasesandiodine)todecaytoalevelthatwouldnot exceed 10 CFR Part 100 dost guideline values if controlled venting were to occur after that time. During this 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months period, containment integrity l

should be provided, to the extent practicable, by the passive capability of i

the containment itself and any related passive design features (e.g.,

suppressionpool). The staff further believes that following this 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months period, the containment should continue to provide a barrier against the uncontrolled release of fission products.

However, in keeping with the concept of allowing for interventiun in coping with long-term or gradual energy release, the staff believes that after 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months , the containment design may utilize controlled, elevated venting to reduce the probability of a catastrophic failure of the containment. Alternatively, a design may utilize diverse containment heat removal systems or rely on the restoration of normal containment heat removal capability if sufficient time is available for major recovery actions (e.g., 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months ). Any systems, either venting or diverse heat removal, to be used to prevent long-term containment failure need not meet the full complement of regulatory requirements associated with safety systems. The design of those systems need only assure an appropriate reliability for operation.

Furthermore, accident mitigation features that deal with core damage accidents can be evaluated on a best-estimated basis.

In evaluating the capability of the containment design, it is necessary to consider the loading associated with (1) stored energy from the reactor coolant system, (2) chemical reaction energy associated with core degradation, (3) decay heat, (4) hydrogen combustion and other noncondensible gas i

generation, as appropriate, including core-concrete interaction energy consistent with the design. The staff concludes that other energy release l

mechanisms (e.g., direct heating) should be addressed by reducing their likelihood to sufficiently low levels through design features.

l The staff concludes that containment system design features dealing l

with the above challenges to the integrity of the containment would lead to a I

rugged containment system.

In view of the low probability of accidents that would challenge the integrity of the containment, the staff concludes that the unreliability of the mitigation systems, from the onset of core damage to t

EPRI Chapter 5 DSER 2-5 July 1989

l 4

I l

t prevention of significant releases, should not exceed approximately 0.1.

However, the staff intends to ensure that the containment can deal with all credible challenges and does not intend to apply the conditional containment failure probability guideline in a manner that could be interpreted to j

potentially detract from overall safety. The staff will accept a CCDF of 0.1 or a deterministic containment performance goal that offers comparable pro-

{

tection, l

i In lieu of requiring the inclusion of a conditional containment failure probability goal in the Requirements Document, the staff concludes i

that EPRI should propose and justify an explicit measure of containment performance during a severe accident which is to be included in the Requirements Document.

This is an open item that must be satisfactorily I

addressed before the staff can complete its review of Chapter 5 of the Requirements Document.

I 2.2 Station Blackout I

Section 2.3.3 of Chapter 5 of the Requirements Document requires the ALWR tn be capable of maintaining a safe condition during a blackout (loss of

l

[

power)for8 hours.

The anclysis that will be used to verify this cap 4, a ',

will use mechanistic system performance and best-estimate analytical me5 -

L The staff is concerned that these analytical techniques may not be conservative enough to provide the assurance needed that an ALWR can meet the i

requirements of the blackout rule (10 CFR 50.63).

In a letter to the staff dated September 15, 1988, the Steering Comittee stated that a separate coping analysis will be conducted to confirm compliance with the blackout rule. The

^

analytical methodology for this analysis will be consistent with the guidance provided in NUMARC 8700 and Regulatory Guide 1.155. The staff endorses the l.

use of these documents for the station blackout analysis.

Because determination of the actual coping duration and the ALWR capability to recover L

during that period is partially dependent on site-specific characteristics, the subject station blackout analysis required to show compliance with 10 CFR i

l 50.63 will necessarily be plant-specific.

The staff's evaluation of this I

issue is discussed in Section B.9 of this report. Additional requirements that address station blackout are provided in Chapter 11 of the Requirements Document. The staff will address these add ional requirements when it reviews Chapter 11.

EPRI Chapter 5 DSER 2-6 July 1989

l S

.f i

2.3 Zirconium-Water Reaction and Hydrogen Generatig In its letter dated August 16, 1986, the Steering Comittee stated that "Because of the multiplicity of regulatory requirements regarding hydrogen control for severe accidents, the specific Regulation that the ALVR is required to meet is not clear at this time."

On that basis, the Connittee submitted the proposed ALWR hydrogen control requirements as an optimization issue, requesting the staff to evaluate the proposed ALWR requirements on the basis of their unique technical merits independent of current and future regulations.

Section 2.4.1.7 of Chapter 5 of the Requirements Document specifies that containment and combustible gas control systems shall be designed to accommodate 75 percent in-vessel zircontum-water reaction of the active fuel cladding, and 13 percent containment uniform hydrogen concentration.

It states that 75 percent cladding oxidation is believed to be a conservative i

upper limit on the amount of hydrogen generated in a degraded-core situation including recovery.

It is the Steering Comittee's position that no significant ex-vessel hydrogen generation due to core-concrete interaction would occur under severe-accident conditions.

l The proposed' zirconium-water reaction assumption of 75 percent is considerably greater than the value prescribed by Regulatory Guide 1.7 for design-basis-accident considerations and is believed to be a mid-range estimate of in-vessel hydrogen generation for severe accidents (Ref: NUREG-1150, February 1987 Tables J.4.1 and J.4.2).

The proposed 13-percent hydrogen concentration limit is based on theory and extrapolations of experimental data described in

" Technical Support for the Hydrogen Control Requirement for the EPRI Advanced Light Water Reactor Requirements Document" (Task 8.3.5.4, Fauske and Associates,Inc., June 1988).

It is the limit below which it is asserted to be very unlikely that detonations in hydrogen-air-steam mixtures will occur.

However, due to the uncertainties in the the phenomenological knowledge of hydrogen generation and combustion, it is the staff's position that ALWRs should be designed to (1) accommodate hydrogen equivalent to 100-percent metal-water reaction of the fuel cladding and (2) limit containment hydrogen concentration to no greater than 10 percent.

The staff's position is EPRI Chapter 5 DSER 2-7 July 1989

i consistent with the requirements of 10 CFR 50.34(f) as referenced in 10 CFR I

Part $2. Furthermore, because hydrogen control is necessary, given present analytical capabilities, to preclude local concentrations of hydrogen to detonable limits, the staff concludes ALWRs should provide containment-wide hydrogen control (e.g., igniters) for severe accidents. Additional advantages of providing hydrogen control mitigation features (rather than reliance on i

random ignition of richer mixtures) includes the lessening of pressure and temperature loadings on the containment and essential equipment. This is an open item that must be satisfactorily addressed before the staff can complete its review of Chapter 5 of the Requirements Document.

This item is also addressed in Sections 6.5.1, B.8, and C.3 of this report.

2.4 Decay Heat Calculations (ANS 5.1)

Section 2.2.6 of Chapter 5 of the Requirements Document states that design of decay heat removal systems, (excluding analyses performed in accordance with Appendix K to 10 CFR Part 50), will be based on decay-heat generation rates as given in ANS Standard 5.1 (October 1979). The staff concludes this is acceptable for realistic evaluations permitted by the revised 10 CFR 50.46 and Appendix K to 10 CFR Part 50.

' 10 CFR 50.34(g) requires that the design of decay heat removal systems be evaluatedagainstBranchTechnicalPosition(BTP)ASB9.2whichrequiresan additional 20-percent uncertainty factor be included for the first 1000 seconds following shutdown and 10 percent between 1000 seconds and 10,000,000 seconds.

However, a recent comparison to the ORIGEN code (described in an attachment to the Steering Connittee's letter of August 16,1988) has shown ANS 5.1 to be a conservative predictor of decay heat generation. On this basis, the staff has concluded that ANS 5.1 can be used in lieu of BTp-ASB 9.2 for decay-heat-generation rates in design of decay-heat-removal systems.

EPRI Chapter 5 DSER 2-8 July 1989

=

---r-

,y,

l

[

[

2.5 Fire Protection l

t Section 2.3.2 of Chapter 5 of the Requirements Document indicates that fire protection will be as specified in 10 CFR 50.48 and Appendix R.

The Requirements Document states that for equipment in the same general area, a

3. hour fire barrier will be utilized in lieu of physical separation unless it is " impractical or less safe." However, no guidelines are provided in the j

Requirements Document as to the application of these criteria.

n It is the staff's position that fire issues that have been raised through operating experience and through the External Events Program must be resolved l

for ALWRs. To minimize fire as a significant contributor to the likelihood of severe accidents for advanced plants, the staff concludes that current NRC guidance must be enhanced. Therefore, the criteria delineated in the Requirements Document must ensure that safe shutdown can be achieved, assuming that all equipment in any one fire area will be rendered inoperable by fire 4

j and that re-entry into the fire area for repairs and operator actions is not possible. Because of its physical configuration, the control room is excluded from this approach, provided an independent alternative shutdown capability that is physically and electrically independent of the control room is included in the design.

The ALWR design criteria must provide fire protection t

for redundant shutdown systems in the reactor containment building that will i

ensure, as much as practicable, that one shutdown division will be free of fire damage. Additionally, criteria should be provided in the Requirements Document that ensure that smoke, hot gases, or the fire suppressant will not migrate into other fire areas to the extent that they could adversely affect safe-shutdown capabilities, including operator actions. Because the layout of a nuclear plant is design-specific, plant-specific design details will be reviewed by the staff on an individual basis. The staff will require a description of safety-grade provisions for the fire-protection systems to l

ensure that the remaining shutdown capabilities are protected, as well as demonstration that the design complies with the migration criteria discussed above.

Fire-protection requirements are being addressed in Chapter 9 of the Requirements Document.

Therefore, the staff will address the results of its review of this subject when it reviews Chapter 9.

,s l

EPRI Chapter 5 DSER 2-9 July 1989

f d

2.6 Severe-Accident Analyses

{

t Section 2.4.2 of Chapter 5 of the Requirements Document specifies that provisions be made and realistic analyses be conducted for severe accidents, including in-vessel and ex-vessel core debris cooling and cavity flooding.

The staff accepts the position that severe-accident analyses should be based on realistic or best-estimate methods with proper ennsideration of uncertainties in phenonenological modeling.

In the absence of detailed, explicit regulatory criteria, the Requirements Document states that the plant designer will utilize industry-developed methods (e.g., MAAP) to demonstrate that the risk objectives of the ALWR public safety goal are met and the staff will, as appropriate, conduct independent analyses using staff-developed nethods, to assess applicants' analyses. See Section 6.6 of this report for an evaluation of severe-accident mitigation features.

t e

)

EPRI Chapter 5 DSER 2-10 July 1989

3 ALWR CORE-DAMAGE-PREVENTION REQUIREMENTS Core-damage prevention relies on four functions: (1)thecore. coolant-inventory function, (2) the decay-heat-removal function, (3) the diverse reactivity-control function, and (4) the RCS pressure-control function. Core-damage-prevention requirements applicable to both PWRs and to BWRs are defined in Section 3 of Chapter 5 of the Requirements Document. General requirements applicable to both PWR and BWR core-damage-prevention functions are presented in in the same section of the Requirements Document.

3.1 Inservice Testino Section 3.4.1 of Chapter 5 of the Requirements Document requires systems to be inspectable and testable.

In its letter dated April 4, 1988, the staff stated its position that future facilities must be better able to acconnodate the testing requirements of the ASME Code and that future licensees will be required to provide a technical );stification for each valve which cannot be practicably exercised quarterly during operation in fulfillment of Code requirements. The staff letter stated the conditions under which the testing may be delayed until cold shutdown and recommended that the Requirements Document specify that the final ALWR design conform to its position. The April 4, 1988 letter also informed the Committee of staff positions relating to inservice testing of check valves, pressure isolation valves, solenoid-operated valves, excess flow valves, and control rod drive valves.

In its August 16, 1988 letter, the Steering Connittee stated that work has been initiated to revise Chapter 1 of the Requirements Document to include specific inservice inspection and testing requirements.

This is an open item that will be addressed after EPRI submits the proposed revision to Chapter 1 of the Requirements Document.

The April 4, 1988 letter also informed the Steering Committee of staff positions related to inservice testing of support system valves for the emergency diesel generators.

In its letter dated August 16, 1988, the Steering Committee indicated that specific testing requirements for onsite power supplies will be addressed in Chapter 11 of the Requirements Document.

The staff will address these testing requirements when it reviews Chapter 11.

EPP! W pter 5 DSER 3-1 July 1989 1

't :

j

y a

l i

In response to the staff's April 4 1988 statement that containment isolation valves that also serve as pressure boundary valves are subject to both Appendix J local leak rate test requirements and A$ME Section XI inservice i

testing requirements, the Comittee committed to clarify Section 6.2.2.2.1 of Chapter 5 of the Requirements Document to delete the word

operability" so as not to preclude leakage testing from the scope of the requirements.

l Contingent upon completion of this action, the staff finds this acceptable.

3.2 Diesel Generator Start Time Section 3.4.5 of Chapter 5 of the Requirements Document requires that engineered safety systems be designed so that the onsite power source start time need not be shorter than 20 seconds and the combined start time and load sequencing time need not be shorter than approximately 40 seconds. The stated l

rationale for the requirement is that operating plants have sometimes exceeded i

the current 10-second start time requirement by a few seconds or have experienced governor stability problems and emergency overspeed shutdowns.

The staff questioned how the design of the diesel starting system might be changed to take advantage of this increased starting time and improve the starting reliability of the machine.

The Steering Comittee responded that a 20-second starting time improves diesel generator reliability by:

l (1) Alleviating the requirements on the governor characteristic and r

eliminating most of the instability problems.

(2) Allowing the use of a ramp generator to control the acceleration of the unit to full speed. With this scenario, the unit accelerates freely up to approximately 50 percent speed, at which point the governor controls the acceleration to full speed following a predetermined ramp, thereby eliminating any overshoot.

(3) With the use of the ramp generator, the engine will safely get to full speed in 13-14 seconds. A 6-7 second margin is then provided before load sequencing in order to allow lube cil pressure to build up and stabilize.

EPRI Chapter 5 DSER 3-2 July 1989

L This eliminates the failure to start due to a trip on low lube oil l

pressure.

In addition, this ensures that all parts of the engine are properly lubricated before any large load is applied, therefore, reducing engine wear.-

[

The staff finds that the longer starting period allowed for the diesel generator will likely improve the reliability for those conditions at which it is directed. This is based on the assumption that the sequencing-on of the engineered safety system loads can be delayed with no adverse effects on the functional capability of the respective systems. Also, the amount of unreliability added by the ramp generator circuitry in the diesel generator must be considered.

The use of increased starting and loading intervah is acceptable, providing the increased intervals are properly incorporated into plant-specific accident analyses and shown by such analyses to result in acceptable consequences. The staff will require the ALWR designer / applicant to demonstrate the acceptability of such an analysis.

3.3 Electric Valve Operators

Section 3.4.11 of Chapter 5 of the Requirements Document states that valve operator motor controls shall generally not be designed to automatically stop l

valve motion due to an electric overload except during valve operational l

testing. ThisrequirementisingeneralagreementwithPosition1.(a)of Regulatory Guide 1.106 (Rev.1) which states that thermal overload protection devices should be continuously bypassed and temporarily placed in force only when the valve motors are undergoing periodic or maintenance testing. The ALWR requiremtnt is therefore acceptable.

p 3.4 Anticipated Transients Without Scram Although not discussed explicitly in Chapter 5 of the Requirements Document, l

the ALWR requirement to resolve the issue concerning anticipated transients withoutscram(ATWS)iscompliancewith10CFR50.62(referredtoastheATWS rule). The staff finds compliance with the ATWS rule an acceptable approach EPRI Chapter 5 DSER 5-3 July 1989

to resolution, except in the area of diversity. While requiring a diverse scram system for Combustion Engineering and Babcock & Wilcox facilities, the ATWS rule did not require this feature on Westinghouse reactors because the Westinghouse NSSS design has certain features that would reduce the consequences of an ATWS in the unlikely event one were to occur, and because of the cost of backfit to e.n operating reactor.

The staff concludes that a diverse scram capability is a worthwhile measure of prevention for all advanced LWRs, especially when incorporated into the initial design.

Therefore, the staff concludes that the EPRI Requirements Document should include a requirement that, unless the ALWR designer can demonstrate that the consequences of an ATWS are acceptable, the ALWR PWR should have diverse reactor protection system input to the control rods. The requirements that address instrumentation and controls of the ALWR design are being developed in Chapter 10 of the Requirements Document, which has not been submitted for staff review. The staff will address this issue when it reviews Chapter 10.

1 l

EPRI Chapter 5 DSER 3-4 July 1989 I

i 4 BWR CORE-DAMAGE-PREVENTION REQUIREMENTS The Requirements Document states that the BWR core coolant inventory control, decay heat removal, and RCS pressure control functions will be provided by the

]

following systems in the ALWR design:

high-pressureinjection(HPI) system reactorcoreisolationsystem(RCIC) l decay heat removal (DHR) system automaticdepressurizationsystem(ADS)

These systems are grouped into three divisions, each division having independ-

)

ent service water, ac power, and de power supplies. Divisions I and 2 are 1

identical, each has a motor-driven high-pressure injection pump and one or

]

more motor-driven low pressure DHR pumps.

Division 3 consists of a i

steam-driven high pressure injection pump (RCIC), an automatic depressuri-1 zation (ADS) system, and a DHR pump.

Each division has a heat exchanger. Any of the three divisions is capable of performing the low-pressure injection or suppression-pool cooling function.

Two of the civisions can provide containment spray.

)

4.1 Elimination of Core Spray The ALWR BWR design does not include a core spray system. This is based on the elimination of large recirculating system piping resulting in there being no postulated large or medium LOCAs below the core, and that reflood cooling is sufficient to protect against core damage. The staff finds this acceptable subject to confirmation by detailed LOCA calculations that core spray is not necessary to meet 10 CFR 50.46 requirements. The staff will require the ALWR l

designer / applicant to perform and demonstrate the acceptability of such an analysis.

4.2 Anticipated Transients Without Scram The Requirements Document does not specify a requirement for an automatic pump trip to resolve staff concerns regarcing anticipated transients without scram EPRI Chapter 5 DSER 4-1 July 1989

'i=

1 k,

I L

(ATWS)forALWRBWRs. The staff concludes that this should be added or justification for exemption to the ATWS rule should be provided. The requirements that address instrumentation and controls of the ALWR design are being developed in Chapter 10 of the Requirements Document, which has not been

(

submitted for staff review. The staff will address this issue when it reviews Chapter 10.

l 4.3 Standby Lievid Control System q

The diverse reactivity control function required by GDC 26 is provided by the l

standby liquid control system ($LCS).

The ALWR proposed design is similar to the SLCS in current BWRs. The system design basis requires that the amount of i

sodium pentaborate and its minimum injection rate be sufficient to bring the reactor from full rated condition to cold shutdown with a margin and hold it there while allowing for xenun decay.

The margin should be sufficient to allow for mixing and dilution by the shutdown cooling water. Since a 13-percent solution of sodium pentaborate will be used, adequate heating means must be provided to maintain solution temperature above its saturation temperature and prevent precipitation, i

i The sodium pentaborate solution is injected into the reactor vessel through o

' the high and low pressure safety injection lines.

It was determined

[

experimentally that this method of injection will provide good mixing of the l

injected fluid with the reactor vessel water.

In addition to differing from existing facilities in the means of injection to the vessel, this pump

+

discharge path also differs from previous designs by not including explosive squib valves in the pump discharge linas.

Elimination of these valves is justified by close proximity of the suction valves to the storage tank and system lines filled with demineralized water. The staff concludes these features are acceptable,

,p, The Requirements Document does not specifically invoke or reference the SLCS performance requirements of the ATWS rule (10 CFR 50.62). The ATWS rule re-quires that SLCSs meet specific flow conditioni, and, for facilitics granted a construction permit after July 26, 1984, have an automatic initiation feature.

Also, criteria have not been specified te ensure that the insertion of boron EPRI Chapter 5 DSER 4-2 July 1989

1 into the vessel is distributed effectively and is thoroughly mixed.

Therefore, the staff concludes that the Requirements Document design criteria 1

ensures thorough mixing of the injected boron. The staff concludes that the Steering Cosmittee should address these issues in the Requirements Document.

These are open items that must be satisfactorily addressed before the staff can complete its review of Chapter 5 of the Requirements Document.

4.4 Safety Classification of Containment _ Spray System The ALWR BWR containment heat-removal system consists of suppression-pool cooling and wetwell spray (WS) and drywell spray (DS) features, which are sharea functions of the RHR system. The purpose of these systems is to prevent excessive containment temperatures and pressures, thus maintaining i

containment integrity and equipment operability following a LOCA.

'I For design of the WS and DS, the Requirements Document does not address all

't the acceptance criterie that are described in SRP Section 6.2.2, " Containment Heat Removal Systems." Furthermore, the Requirements Document states that the

[

WS and DS system design and equipment need not be safety-grade, whereas the

}

SRP Section 6.2.2 acceptance criteria regarding GDC 38 states that the containment heat removal system design should meet the redundancy and power source requirements of an engineered safety feature system.

Furthermore, SRP

~

Section 6.2.2 calls for heat removal systems to be designed to Quality Group B and seismic Category I standards. On the basis of these discrepancies, the staff has not been able to accept the requirements for design of the l

containment heat removal system. This is an open item that must be satisfactorily addressed before the staff can complete its review of Chapter 5

.of the Requirements Document. See also Section 7.2 of this report.

l 4.5 Suppression-Pool-Bypass Leakage a

In a pressure-suppression contairment, steam released from the primary system following a postulated LOCA is collected in the containment drywell and directed through connecting vents to the suppression pool located in the wetwell. The steam is condensed as it enters the suppression pool. Thus, no steam enters the wetwell airspace. However, the potential exists for steam to EPRI Chapter 5 DSER 4-3 July 1989 h

l i

bypass the suppression pool by leakage through the vacuum breakers or directly from leak paths in the drywell-to-suppression chamber vent pipes, the diaphragm well seal around diaphragm penetrations, or cracks in the concrete diaphragm.

i The capability to tolarate steam bypass (ANY) from the drywell to the wetwell space is discussed in Appendix A to SRP Section 6.2.1.1.C for small primary l

steam breaks in the Mark I, II, and III containment designs.

The capability of the Mark I design is of the order of 0.02 ftt; the capability of the Mark

!! containment is approximately 0.05 f te and the Mark III design has a capability of 1 f t8

)

In a letter dated August 16, 1988 responding to the staff's RAI regarding steam bypass capability in the ALWR BWR containment, the ALWR Steering Comittee stated that the approach being taken in the design of the advanced BWR will be to minimize the potential leakage paths between the drywell and wetwell. This is to be accomplished by requiring a rigid steel-lined 1

diaphragm floor to eliminate any leakage path through the concrete, and requiring that all connections between the drywell and wetwell enter the suppression pool under water with no passage of steam in vertical downcomers

.i i

through the wetwell air space. This arrangement will minimize the potential leakage paths from the drywell to the wetwell which bypass the suppression 3

pool. Additionally, the vacuum breaker system will be designed to prevent bypass. The Steering Conmiittee further stated that the improved configuration i

of the ALWR BWR provides the basis for a very small drywell-to-wetwell airspace bypass leakage, but the maximum allowable equivalent leakage area for steam bypass of the suppression pool was not 11entified.

The staff commends the intended approach being taken in the design of the ALWR BWR to minimize the potential leakage paths between the drywell and wetwell.

However, since the maximum allowable leakage area for steam bypass of the J

suppression pool was not provided for this design approach and, specifically, since the design criteria do not explicitly identify greater capability to tolerate bypass leakage, the staff cannot concluce that the ALWR BWR requirements are acceptable at this time.

Furthermore, since the BWR pressure-suppression design is sensitive to relatively small bypass leakage EPRI Chapter 5 DSER 4-4 July 1989

?.

o l

areas, the staff concludes that ALWRs that utilize that design concept should l

demonstrate a sufficient capability to tolerate bypass leakage.

This is an l

open item that must be satisfactorily addressed before the staff can complete

]

its review of Chapter 5 of the Requirements Document.

4.6,$,g pression-Pool Temperature-Monitoring,$ystem i

NUREG-0783, " Suppression Pool Temperature Limits for BWR Containments,"

recommends that the suppression-pool telnperature-monitoring system meet the general design requirements listed below:

Each applicant or licensee demonstrate adequacy of the number and distribution of pool temperature sensors to provide a reasonable measure of the bulk temperature.

Sensors be installed sufficiently below the minimum water level, to ensure that the sensors properly monitor pool temperature.

Pool temperature be indicated and recorded in the control room. Where the suppression pool temperature limits are based on bulk pool temperature, operating procedures or analyzing equipment should be used to minimize the actions required by the operator to determine the bulk pool temperature. Operating procedures and alarm set points should consider the relative accuracy of the measurement system.

Instrument set points for alarms be established so that the plant will operate within the suppression-pool temperature limits.

All sensors be designed to seismic Category I, Quality Group B standards, and be capable of being energized from onsite emergency power supplies.

EPRI Chapter 5 DSER 4-5 July 1989

O t

In section 4.5.3.4.3 of Chapter 5 of the Requirements Docusent, the Steering i

Committee states that suppression pool temperature sensors shall be located in each quadrant of the suppression pool. However, the Requirements Document i

does not include justification or analysis to demonstrate the adequacy of the number and distribution of such temperature sensors.

Further, the Requirements Document does not incorporate the above general design r

requirements of NUREG-0783. On the basis of its review, the staff is unable j

to conclude that the suppression-pool temperature-monitoring system is acceptable. This is an open item that must be satisfactorily addressed before l

the staff can complete its review of Chapter 5 of the Requirements Document.

t i

i i

F 1

i l

l l

EPRI Chapter 5 DSER 4-6 July 1989 l

,.L j

f

' S PWR CORE-DAMAGE-PREVENTION REQUIREMENTS i

5.1 ' Introduction

]j Section 5 of Chapter 5 of the Requirements Document identifies core-damage i

prevention requirements for PWRs. The Requirements Document states that PWR I

core damage is prevented by the following systems:

l J

i residualheatremoval(RHR) system emergency feedwater (EFW) system safety injection system (SIS) safety depressurization and vent system (SDVS)

.4 i

In its letter dated August 16, 1988, the Steering Committee described its probabilistic basis for providing two divisions of safety systems in PWRs.

The information presented indicates that the decision was based on previous PRAs, from which it has been concluded that this approach will enable the ALWR to meet its safety goals. Since two divisions is also consistent with regulatory requirements, this approach is acceptable to the staff.

5.2 Residual Heat Removal System

- i The Requirements Document states that the RHR system should consist of two divisions, each with a low-pressure motor-driven pump and heat exchanger located outside containment. The RHR system design pressure and temperature conditions is specified to be 900 psig and 400 degrees F.

These design conditions will preclude the possibility of RCS/RHR intersystem LOCA should the RHR system be subjected to the higher RCS pressure. (See Section B.5 of thisreport.) The two RHR pumps have backup cross-connections to the containment spray pumps to facilitate amintenance.

1 Section 5.2.3.1.3 of Chapter 5 of the Requirements Document specifies requirements relating to potential loss of decay heat removal when the RCS level is lowered for maintenance during shutdown operations (mid-loop operation). Section 5.2.3.13.2 of Chapter 5 of the Requirements Document specifies requirements relating to shutdown level instrumentation. Although l

EPRI Chapter 5 DSER 5-1 July 1989 s

1 1

)

the requirements.are consistent with measures applicable to operating reactors L

as described in Generic Letter 88-17, the staff position for ALWRs is that L

design changes are necessary to eliminate the risks associated with mid-loop operations.

(This issue is a subissue of Generic Issue 99, " Loss of RHR j

Capability in PWRs" (see also Section B.5 of this report)). The staff concludes that additional design criteria should be included in the

'I 1

Requirements Document.

This is an open item that must be satisfactorily q

addressed before the staff can complete its review of Chapter 5 of the l

Requirements Document, i

L

.O in a letter dated March 28, 1988 regarding low temperature overpressure j

protection (LTOP)(also discussed in Chapter 4 of the Requirements Document),

l the Steering Consnittee stated that RHR system requirements in Chapter 5 of the Requirements Document will be modified to reflect requirements for LTOP and to j

require that the minimum end-of-life pressure relief set points for LTOP be considered in sizing RHR relief capacity.

In a letter dated September 23, 1988, the staff acknowledged its acceptance of these commitments as resolving a

the LTOP issue for ALWRs. The staff will confirm that the proposed revision to Chapter 5 of the Requirements Docunent satisfactorily adcresses this 5

concern.

5.3 Emergency Feedwater System Chapter 5 of the Requirements Docunent describes the ALWR EFWS as a dedicated c

safety-related system that has no normal operational functions. The EFWS provides feedwater to the steam generators following transients or accidents i

such as reactor trip, loss of main feedwater, steam or feedwater line breaks, steam generator tube ruptures, and anytime the main and startup feedwater systems are not available.

The ALWR EFWS should consist of two independent, identical subsystems.

Each subsystem will be comprised of one motor-driven and one turbine-driven feedwater pump, an emergency feedwater storage tank (EFWST), and associated piping, valves, and instrumentation and controls.

Each subsystem will be powered by one of two separate Safety Class IE electrical power sources. The ALWR EFWS is designed so that any two pumps for four steam generator plants, and any one pump for two steam generator plants, shall be capable of satisfying the flow requirenents for design-basis EPRI Chapter 5 DSER 5-2 July 1989

C

,C l

conditions plus any additional flow required for pump minimum flow protection.

l Any single pump shall be capable of satisfying the minimum flow requirement for best-estimate decay heat removal evaluations for e. vents with core-damage frequencies greater than 1.0x10-5 per reactor year.

Each of the i

safety-related EFWSTS will contain enough condensate-quality water to achieve safe cold shutdown, based on' l

i

- a main feedline break without isolation of EFW flow to the affected steam j

generator for 30 minutes 1

refill of the intact steam generators 9

8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months of operation at hot standby conditions Subsequent cooldown of the reactor coolant system within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months to conditions that permit operation of the RHR system j

I continuous operation of one reactor coolant pump The Requirements Document states that a cross-connect line must be provided between the'two EFWSTs to allow feedwater supply to all EFW pumps.

In aedition, a backup supply of condensate-quality feedwater shall be provided to the EFWSTs and the transfer of water to the EFWSTs @all be possible under station blackout conditions.

However, this backup apply need not be safety-l related. The Requirements Document also specifies interfacing requirements for the alternate water supply to the EFWS.

The Requirements Document states that the EFWS must be equipped with four cavitating venturi flow meters (two for two steam generator plants), one on each e

discharge line to the steam generator.

In the event of steamline or feedwater L

line rupture, these cavitating venturi flow meters will choke the EFWS flow to the steam generators to prevent pump damage due to runout and to prevent excessive rates of cooldown of the reactor coolant system.

If the break is inside the contain-ment, the cavitating venturi flow meters will limit the effect of EFWS on the mass and energy released to the containment.

EPRI Chapter 5 DSER 5-3 July 1989 i

7 J '. ;

In addition, the Requirements Document states that the EFWS must be provided

)

with a means to detect potential EFWS pump steam binding as a result of steam and hot water leakage through check valves in the pump discharge lines. This I

shall consist of temperature monitoring of the portion of discharge piping up-stream of the check valves, with indication and alam in the control room.

Appropriate vents and drains shall be provided for removing steam in the event

]

steam is detected. The Requirements Document also states that the EFWS must -

j be provided with means to permit periodic surveillance testing of EFW pumps i

and valves and functional testing of the integrated operation of the system.

Flow to the steam generators is to be prevented during testing to avoid unnecessary thermal transients and inputs of oxygenated water to the steam generators. Appropriate 6ccess shall be provided to test power-operated valves. Means must be provided to test the pumps at the design flow with the reactor in operation.

'l 1

Section 5.3.2.4 of Chapter 5 of the Requirenants Document specifies automatic

,o,r manual options for initiation of emergency feedwater flow.

In its letter

(

dated August 16, 1988, the Steering Consnittee committed to revise Section 5.3.2.4 of Chapter 5 of the Requirements Document to specify automatic.a.nd

)

manual initiation of EFW flow.

The staff considers both automatic and manual j

initiation to be necessary and accepts the commitment to revise the Requirements Document accordingly.

The staff will confirm that the proposed j

revision to Chapter 5 of the Requirements Document satisfactorily addresses this concern, a

Section 5.3.2.5.1 of Chapter 5 of the Requirements Document states that

{

emergency feedwater supplied to steam generators shall be of the same or 1

better quality as secondary system makeup water, except that the requirement on oxygen can be excluded. This is consistent with the SRP and is acceptable.

1 On the basis of its review, the staff finds that the described EFWS design requirements are consistent with the criteria as described in SRP Section 10.4.9, " Auxiliary Feedwater Systems," and are therefore acceptable. The staff will confirm that the proposed revisions to Chapter 5 of the I

Requirenents Document satisfactorily addresses confinnatory issues discussed l~

above.

See Section B.4 of this report for a discussion on generic safety l

EPRI Chapter 5 DSER 5-4 July 1989

issues on the EFW system reliability.

5.4 Safety Injection System L

The Requirements Document describes a safety injection system (SIS) which consists of two high-pressure divisions, each having two trains (total of four retor-driven 50-percentpumps). Low-headpumpsandseries(piggyback) pump j

alignment are not employed in the ALWR design. The SIS pumps should be located outside the containment, should take suction from a common in-containment refueling water storage tank (IRWST), and should inject directly into the vessel by way of independent piping connections to the reactor vessel.

Discharge connections to the hot legs should also be provided.

Each division will have sufficient capacity to satisfy DBA LOCA requirements in accordance with regulatory requirements, and small-break LOCA investmentprotectionrequirements[i.e.,nofueld6magefor6-inch (12-inch target) break].

The number of. SIS accumulators is not specified, and will be

" minimized."

Injection pressure will be selected by the designer and will be high enough to permit feed-and-bleed cooling. The IRWST eliminates the need to switch SIS suctiun to a containment sump for continued supply of injection water. This feature greatly reduces complexity and increases system reliabil-

{

ity. The IRWST also serves as an RCS relief discharge tank. For the reasons stated above, the staff concludes these features are acceptable. The staff will require the designer / applicant to demonstrate that SIS injection pressure is sufficient to permit feed-and-bleed operation.

5.5 Safety Depressurization and Vent System The Requirements Document states that a safety depressurization and vent system (SDVS) will be provided for the ALWR which consists of a single passive piping system containing two active, safety-grade valve trains.

Four valves will be installed in two parallel flow branches, in piping from the pressurizer to the IRWST, to provide single-active-failure vent and depressurization capability for natural circulation cooldown, steam generator tube rupture, and feed-and-bleed conditions. One valve assembly flow path (train) is adequate for feed-and-bleed cooling in event of a total 'oss of EPRI Chapter 5 DSER 5-5 July 1989

7-

,1 (i

\\

+.:

fi l.'

..feedwater if feed and bleed is established tweediately.

Both paths are-required if feed and bleed is delayed for 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months after safety valve lift. See Sections 6.6.5 and B.10 of this report for a discussion of the open item l

concerning the SDVS.

i y

1 I

J i

)

e, 6

1 I

\\

)

l EPRI Chapter 5 DSER 5-6 July 1989

'f.

i j

6 MITIGATION REQUIREMENTS

'6.1 Introduction Section 6.0 of Chapter 5 of the Requirements Document specifies mitigation requirements applicable to both BWRs and PWRs. Mitigation relies on two functions: (1)thecontainmentintegrityfunctionand(2)thefissionproduct

[

control function. The containment is intended to provide a barrier to the uncontrolled release of radioactivity in the event of an accident.

l 6.2 Containment 1 solation System Design The function of the containment isolation system is.to permit the !.ormal and emergency passage of fluids through the containment boundary while preserving the ability of the boundary to prevent or limit the escape of fission products that may result from postulated accidents. The containment isolation system includes the portions of all fluid systems penetrating the containment that perform the isolation function.

The Steering Conunittee states that isolation provisions in lines that penetrate the containment boundary shall be in accordance with ANSI /ANS 56.2-1984, " Containment Isolation Provisions for

,3 Fluid Systems After a LOCA," and Regulatory Guide 1.141. However, ANSI /ANS 56.2-1984 has not been approved by the staff for the design of containment isolation systems. The staff has reviewed the ALWR requirements for containment isolation systems against the guidelines of SRP Section 6.2.4,

" Containment Isolation System," and ANSI /ANS 56.2-1976, which has been approved by the staff.

General Design Criteria 55 and 56 require that each line that penetrates the containment and is part of the reactor coolant pressure boundary or is connected directly to the containment atmosphere have one isolation valve inside and one isolation valve outside containment, unless it can be demonstrated that the design is acceptable on some "other defined basis."

Each valve must be automatic or locked closed.

In satisfying GDCs 55 and 56, Section 3.6 and Appendices A and B of ANSI /ANS 56.2-1976 provide guioelines that the staff have found acceptable.

EPRI Chapter 5 DSER 6-1 July 1989

4(

o, 1

i The Requireements Document specifies that remote manual valves, instead of j

automatic valves, should be used for essential lines which are not part of engineered safety systems. This position for containment isolation is inconsistent with the guidance described in Section 3.6.3, " Remote Manual c

Valves," of ANS!/ANS 56.2-1976.

The staff concludes that the Requirements Document has not provided an acceptable justification for an alternative to this guidance. Therefore, this is an open item that must be satisfactorily

{

addressed before the staff can complete its review of Chapter 5 of the l

Requirements Document, t

In Section 6.2.2,1.2 of Chapter 5 of the Requirements Document, it is stated j

that if a single isolation valve is employed for an engineered safety feature l

line (e.g., lines connected to the suppression pool in a BWR and lines connected to the in-containment refueling water storage tank in a PWR), the valve need not be enclosed in a leaktight enclosure if the line inside the containment is subrerged under water at all times following a LOCA.

Note 56.1 in Appendix A of ANSI /ANS 56.2-1976 states that lines connecting directly to the suppression pool should each be provided with a single remote manual or automatic isolation valve. These valves are attached to lines that are an I

extension of the containment and are enclosed in a pump room adjacent to the containment which has provir. ions for environmental control of any fluid lea kage. The lines from the suppression pool would always be submerged, so no containment atmosphere can impinge upon the valves. Should a leak develop outside the containment, the fluid would be contained by the controlled leakage pump room. The configuration of the connection of the lines to the suppression pool assures that the connections are always submerged and prevents the escape of containment atmosphere.

In addition, the systems which the lines from the suppression pool connect to outside the containment must be closed systems (outside containment) to meet the appropriate requirements of closed systems described in ANSI /ANS 56.2-1976. The Steering Cossnittee has not indicated that all of these criteria will be met for IRWST connections.

Therefore, the staff has not been able to conclude that the containment isolation provisions for these lines are acceptable. Therefore, this is an open item that must be satisfactorily addressed before the staff can complete its review of Chapter 5 of the Requirements Document.

EPRI Chapter 5 DSER 6-2 July 1989

in its letter dated August 16, 1988 (in response to Question No. 480.8), the Steering Commiittee described its position regarding seismic cesign for closed systems and Type C testing of valves in closed systems performed in accordance

)

with Appendix J of 10 CFR Part 50. The response states that seismic design will be employed where practical to qualify closed systems outside the containment as "wxtensions of containment" in ordtr to eliminate the need for Type C testing of the valves.

It is the staff's position that a closed system outside the containment that meets the criteria of Section 3.6 of ANS!/ANS 56.2-1976 can be considered a second containment isolation barrier, thereby eliminating the need for a second containment isolation valve at each i

penetration.

However, each barrier (i.e., the single isolation valve at each penetration, and the closed piping system outside the containment) is subject to leak rate testing. Therefore, this is an open item that must be satisfactorily addressed before the staff can complete its review of Chapter 5 of the Requirements Document.

i In Section 6.2.2.3.1 of Chapter 5 of the Requirements Document, the Steering Committee states that isolation valve closure times shall be in accordance with ANSI /ANS 56.2-1984 for standard commercial valve operators. This requirement is essentially the same as that of ANSI /ANS 56.2-1976, which has been approved by the staff, and, therefore, the staff finds it acceptable.

1 In Section 6.2.2.2 of Chapter 5 of the Requirements Document, the Steering Committee states that Type C testing is not required for PWR main steam, feedwater, emergency feedwater, or steam generator blowdown isolation valves.

These isolation valves are associateo with secondary systems. The closed system inside containment precludes containment atmosphere from reaching the associated isolation valves; therefore, the valves will not be relied on to j

limit containment leakage. The staff finds this criterion acceptable.

On the basis of its review, the staff concludes that the Requirements Document is inconsistent with NRC guidelines, as described in SRP Section 6.2.4,

" Containment Isolation System," and that the Steering Comittee has not provided acceptable justification for alternatives to this guidance as discussed above.

Therefore, these items are considered open issues that must i

1 EPRI Chapter 5 DSER 6-3 July 1989

O, l

be satisfactorily addressed before the staff can complete its review of Chapter 5 of the Requirements Document.

6.3 Containment Leakage Rate Testing The Requirements Document states that the design of containment penetrations and isolation valves should permit periodic leakage rate testing at the pressure specified in Appendix J of 10 CFR Part 50.

Incluoed are those penetrations that have resilient seals ano expansion bellows (e.g., personnel air locks, equipment hatch, fuel transfer tube, and electrical penetrations).

The Requirements Document provides that containment leak rate testing be performed in accordance with regulatory requirements and the test methods be in accordance with ANSI /ANS-56.8 " Containment System Leakage Testing Requirements," in lieu of ANSI N45.4-1972, " Leakage Rate Testing of Containment Structures for Nuclear Reactors." The staff's evaluation of this position follows.

6.3.1 Containment Integrated Leak Rate Test Paragraph III.A.3 of Appendix J to 10 CFR Part 50 requires that containment integrated leakage rate tests be performed in accordance with American National Standard, ANSI 45.4-1972. ANSI 45.4-1972 requires that leakage calculations be performed using either the total time method or the l

point-to-point method. ANSI /ANS 56.8-1987 (which has not been approved by the i

staff) uses a different calculational method known as the mass point method.

The staff and industry recognize that the mass point method is superior to the point-to-point and total time methods. The mass point method calculates air

{

mass at each point in time and plots it against time. A linear regression line is plotted through the mass time points using a least square fit. The slope of this line is the leakage rate.

In the total time method, a series of leakage rates are calculated on the basis of air mass differences between an initial data point and each individual data point thereafter.

If for any reason (such as instrument error, lack of temperature equilibrium, ingassing, or outgassing) the initial data point is not accurate, the result of the test will be affected.

In the point-to-point method, the leakage rates are based EPRI Chapter 5 DSER 6-4 July 1989

w e

on the was difference between each pair of consecutive points which are then averated to yield a single leakage rate estinte. Mathematically, this can be shown to be the difference between the air was at the beginning of the test and air mass at the end of the test exprested as a percentage of the containment air mess. The staff concludes that the use of the leak rate test nethod as described in ANS!/ANS 56.8 1987 for a facility design complying with the Requirosents Document is an acceptable alternative to the methods specified in ANSI 45.4 1972 and can be used in support of an exemption to paragraph !!!.A.3 of Appendix J to 10 CFR Part 50.

This acceptance extends to the use of the mass point method only, not to AN$1/AN$ 56.8-1987 in its entirety.

In Section 6.3.2.2 of Chapter 5 of the Requirements Docupent, the $ttering Comittee states that integrated leak rate tests (IRLis) can proceed to completion should a leak occur during testing, provided the leak can be isolated, subsequent retsirs are performed, and local *as found" minus 'as left" leskape rate test results when added to the Type A result demonstrate that the integrated leakage rate test acceptance criteria are set. The staff finds that this criterion established by the Steering Connittee for integrated leakage rate tests acceptable.

l 6.3.2 Type B Air Lock Tests in Section 6.3.2.2 of Chapter 5 of the P.equirements Document, the $teering Coppittee states that air Ic '.s which are not used during a 6-month period may f

be tested at containment design pressure af ter the r. ext usage rather than at 6 l

months, as required by Appendix J to 10 CFR Part 50.

However, supporting data i

l (e.g.,long-termdeteriorationofseals)fromoperatingexperienceorfrom

[

l experirents with appropriate analyses have not been provided to justify this deviation from the Appendix 0 requirement. On the basis of its review, the l

staff is unable to conclude that the proposed change to the air lock Type B 1

test interval is acceptable. Therefore, this is on open item that must be

)

satisfactorily I,ddressed before the staff can conelete its review of Chapter 6 of the Requirements Document.

EPRI Chapter 5 DSER 6-5 July 1989 j

'O

o f

l 6.3.3 Type C Containment Local Leak Rate Tests i

i in Section 6.3.2.2 of Chapter 5 of the Requirements Document, it is stated j

that those valves that are in lines designed to be filled with 6 liquid for at 1 east 30 days subsequent to an accident may te leakage rate tested with a l

liquid. Liquid leakage is not converted to equivalent air leakage nor added j

to the Type C testing total, but is reported as liquid leakage.

The staff j

finds this acceptable, providing that l

Such valves have been demonstrated to have fluid leakage rates that do not exceed their design leakage rates.

l I

The installed isolation valve seal water system fluid inventory is i

sufficient to ensure the sealing function for at least 30 days at a pressure of 1.10 P, (calculated peak pressure).

i i

Tharefore, contingent upon inclusion of these provisions in Section 6.3.2.2 of f

Chapter 5 of the Recuireewnts Docmuent, the staff finds this acceptable.

Appendix 0 to 10 CFR Part 50 requires that Type C tests be performed during

{

each reactor shutdown for refueling, but in no case at intervals greater than 2 years. The Requirements Docusent provides that the maximum interval between Type C tests be 30 months rather than the 24-month interval currently required l

by Appendix J.

This is based on the expectation that there would not be any significant increase in the average leakage rate from all valves subjected to i

Type C testing if the test interval were to be increased to 30 months.

In I

Section C.1 to Chapter 5 of the Requirenants Document, the 5tsering Cosmittee provided the rationale for this proposal which is considered an optiMration issue in teres of risk, occupational exposure, and costs. Additionally,the

{

staff notes that the Requirements Document proposes administrative controls, l

and no continuous or periodic short-duration checks of containment integrity.

l However, supporting data (e.g., long-term deterioration of seals and valve seats) from operating experience or experitaents with appropriate analyses has not been provided to justify this deviation from the Appendix J requirement.

On the basis of its review of the information provided, the staff is unable to conclude that the proposed change to the Type C test interval is acceptable.

EPRI Chapter 5 DSER 6-6 July 1989

l 6

l 1

Therefore, this is an open item that must be satisfactorily addressed before the staff can complete its review of Chapter 5 of the Requirements Document.

See also Section 4.4 of this report.

7.3 Equipment Design Requirments I

Section 7.3 of Chapter 5 of the Requirerents Document requires the suppression pool and associated airspace to be enclosed.

This feature, provided by a

[

]

steel diaphragm lined floor, is intended to prevent the potential spread of i

radioactivity in the pool water into operating areas and to keep the pool i

water from being contaminated by material falling into the pool.

It also provides for separation of the containment from equipment areas required to be accessible curing operation, making practical the use of inerting for i

combustible gas control.

The Requirenents Document specifies that the suppression pool will be stred to accommodate the DBA without an " upper pool r

dump

as required by the Mark III containment design.

For severe-accident mitigation, capability will be provided to gravity dump a limited amount of the suppression pool water into the lower drywell in order to provide core debris cooling as described in Section 6.6 of this report.

The staff finds these features acceptable, subject to final staff review of more detailed information during the review of a design-specific application.

I EPRI Chapter S DSER 7-3 July 1989

.a a-

,-.n..-

8 PWR MIT!GATION/CONTA!NMENT REQUIREMENTS 8.1 Primary Containment t

The Requirements Document states that the PWR containnent should be designed l

to provide a leak-tight barrier to prevent uncontrolled release of i

radioactivity in the event of a postulated accident. The Requirements Document describes the PWR containment as a "large, dry type containment."

Chapter 6 of the Requirements Document further indicates that a steel-f cylindrical type is preferred.

The Requirerents Document states that a containment spray (CS) system to provide containnent heat removal and fission I

product control functions should be included in the design.

j The Requirements Document states that:

i The containment design pressure and temperature sust be equal to or t

greater than the pressure and temperature conditions resulting f rom postulated loss-of-coolant, steam line, or feedwater line break j

accidents.

l t

The containment must accommodate the thermal and pressure loads expected l

during a severe accident using best estimate analysis.

The containment shall have sufficient free internal volume to ensure that the concentration of hydrogen inside the containment is less than 13-percent by volume, based on uniformly distributed concentrations of l

hydrogen generated by the equivalent of a 75 percent-active fuel cladding-water reaction during an accident.

To satisfy the requirements of GDC 16 and 50 regarding sufficient design margin for plants at the construction pemit stage of review, SRP Section 6.2.1.1. A. "PWR Dry Containments, Including.tubatmospheric Containments,"

states that the containeent design pressure should provide at least a 10-percent margin above the accepted calculated containment pressure following a loss-of-coolant acciderit or a steam or feedwater line break.

In Section l

2.4.1.3 of Chapter 5 of the Requirenents Docunent, the Steering Connittee EPRI Chapter 5 DSER 8-1 July 1989

I; i

?

i states that at the preliminary design stage, a margin shall be provided

{

between calculated peak pressure and design pressure of 10 percent for dry containments and 15 percent for pressure-suppression containments. On the basis of its review, the staff finds that Requiresents Document requirement l

for the containwent design pressure acceptable.

The staff's evaluation of the l

requirements for hydrogen concentration ard generation is discussed in l

Sections 2.3 and 6.5 of this report, f

The Requirements Document provides that the containment be designed to ensure that adequate protection exists from external pressure conditions that may result, for example, from inadvertent operation of containnent heat removal systems.

The staff finds that Requirements Document external pressure design I

criterion conforms with the NRC criteria as described in SRP Section 6.2.1.1.A and is, therefore, acceptable, f

i Section 8.1.3.2 of Chapter 5 of the Requirements Docunent requires that f

instrusentation be provided to monitor conditions within the containrent I

following an accident. This instrumentation shall include capability for sensuring containment radioactivity, pressure, temperature, and in-containment refueling water storage tank (IRWST) level. The staff finds that Requirements

[

Docunent criterion for instrurentation related to containment functional design conforras with the NRC acceptance criterion as described in SRP Section 6.2.1.1. A and is, therefore, acceptable.

l l

Containnent Design Leak Rate Under present review criteria, containment design leak rate is not a fixed l

maximum value, but is selected as that value which, in combination with other l

plant and site parameters, would give calculated coses not exceeding the l

values given in 10 CFR Part 100 as a result of the accident postulated and evaluated using Regulatory Guide 1.4 Typical containment design leak rates are 0.1 - 0.2 percent per day for current. generation single-containment PWRs.

Under the criteria of Regulatory Guide 1.4, containment leakage is assumed to l

l be the maximum allowed by the facility's technical specifications for the first 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months of an accident release, and one half that value for the remainder of the accident.

i EPRI Chapter 5 DSER 8-2 July 1989 t

O In Sections 1.2.3.5 and 8.1.2.5 of Chapter 5 of the Requirement.s Document, the Steering Connittee states that (1) the contairment leak rate allowance must be 0.5 percent per day or greater at design pressure in order to provide more operating flexibility for containment leak rate testing and associated maintenance, while still poeting 10 CFR part 100 dose criteria for design-basis events, and (2) the contairment leakage varies as a function of containnent pressure. These positions represent significant relaxations of f

containment Itak rate. Although the rationale in the Requirements Document l

for the position stated in section 8.1.2.5 of Chapter 5 notes that the t

containment features will be selected to minimize leakage, the incentive to

)

increase leakage to 0.5 percent per day is also stated to include a reduced f

need to maintain valve leakage integrity and avoid lost power generation i

assor.14ted with the inability to satisfy containment integrated leakage rate requirements. The staff is concerned that, in large measure, the basis for i

these relaxations coses from the application of new source term approaches (seeSectionC.2ofthisreport).

The rtaff will review this issue in concert l

with its review of the source-term issues. This is an open item that must be satisfactorily addressed before the staff can complete its review of Chapter 5

)

of the Requiresents Document. See also Sections 8.2 and C.2.5 of this report.

l l

Sections 7.2.5 and 8.1.2.4 of Chapter 5 of the Requirements Document provide that containment subcompartment pressure capability be evaluated in accordance f

with Section 3.0 of Appendix A to Chapter 1 of the Requirements Document.

l This section indicates that leak-before-break criterion is to be used to f

eliminate the need to consider the dynamic effects of pipe breaks, including rapid subcompartment pressurization. The staff's evaluation of this issue is

(

provided in Section 7.2 of this report.

i 8.2 Containment Spray System i

r The Requiresents Document states that the function of the containnent spray i

system (C$$)istoreducethecontainmenttemperatureandpressurefollowinga l

LOCA or secondary system pipe rupture accioent inside the containment by removing thermal energy from the containment atmosphere.

In addition, the l

Requirements Docunent states that the CSS should be designed to remove fission products from the containnent atmosphere in order to reduce the inventory of i

i EPRI Chapter 5 DSER 8-3 July 1989 1

u-fission products available for leakage from the containment.

The Requiresents Document states that the CSS should consist of an IRWST which is shared by two independent,100 percent capacity trains.

Each train should contain a containsent spray (CS) pusp, a heat exchanger, a suction line from the IRWST, a discharge line to the containment spray headers, and associated piping, valves, instrumentation, and controls.

The Requiresents Document provides that the containsent spray purps be i

identical to the kHR pumps.

Interconnections should be provided to permit the

[

use of an RHR pump as a backup to a CS pump if a CS pump is out of service. In f

addition, the Requirerents Docusent provides that the CSS design shall ensure

{

that required pump NPSH is available for all operating conditions. Supporting analyses shall account for suction piping and other head losses. No credit j

shall be taken for coolant subcooling or elevated containment pressure.

The l

Requiresents Docuneet states that the IRWST level shall be assured to be at the minimum value calculated during CSS operation, assuming worst case instrumentation errors.

The Requirements Document stipulates that the suction l

connection to the IRWST shall be designed to ensure that vortexing cannot l

occur.

I On the basis of its review, the staff finds that the provisions discussed above are consistent with the guidance of SRP Section 6.2.2, "Containsent Heat Removal Systems," and are therefore acceptable.

In its letter dated August 16, 1988, responding to Question No. 480.2, the Steering Comittee indicated that Section 8.2.2.1.1 of Chapter 5 of the i

Requirements Document will be revised to more clearly define the design basis

[

for the capacity of the containment spra) system. The revised requirement j

will specify that the system must have sufficient capacity to reduce containment pressure to less than 50 percent of containment design pressure l

(as opposed to peak accident pressure) within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months after a postulated accident.

EPRI's approach represents a deviation from the SRp and is unoer consideration by the staff. The staff requires further justification regarding the applicability of the leak test acceptance criteria in order for it to complete its review. This is an open item that must be satisfactorily EPRI Chapter $ DSER 8-4 July 1989

l addressed before the staff can complete its review of Chapter 5 of the Requirements Document. $te also Sections 8.1 and C.2.5 of this report.

Section 8.2.2.2.2 of Chapter 5 of the Requirements Document specifies that the spray water will not contain additives for maintaining basic pH in order to i

enhance iodine removal.

Recent research has concluded that, because of the chemical foms of the iodine fission products, spray additive is unnecessary for iodine reeoval purposes. As indicated in Section C.2 of this report, the elimination of additive is consistent with the December 1988 revision of SRP 1

Section 6.5.2 and is acceptable. However, the Steering Comittee has not addressed Branch Technical Position 6.1 which requires chemical additives for

)

postaccident pH control to prevent corrosion of austenitic stainless steel.

This is an open item that must be satisfactorily addressed before the staff can complete its review of Chapter 5 of the Requirements Document.

See also Section C.2.1 of this report, i

Section 8.2.3.9.2 of Chapter 5 of the Requirements Document specifies a

(

fouling factor of 0.0005 for the design of CS heat exchangers. The staff l

questioned the Steering Committee on the selection of this value.

In its August 16, 1988 response to the staff's questions, the Steering Comittee i

indicated that 0.001 would be used for the CS heat exchanger. The staff l

concludes that a fouling factor of 0.001 is acceptable based en consistency i

with Standard T-2.41 of the Tubular Heat Exchangers Manufacturers Association.

{

i in its August 16, 1988 letter, the Consnittee also comitted to revise Section 8.2.3.13.2 of Chapter 5 of the Requirements Document to specify the capability foru.anual(inadditiontoautomatic)actuationofthecontainmentspray l

system. This is consistent with IEEE-279. Therefore, contingent upon completion of this action, the steff concludes this is acceptable.

i 8.3 Fission Product Rweval and Control System The fission product removal and control function for the PWR is provided by the containment spray system described in Section 8.2 above.

EPRI Chapter 5 DSER 8-5 July 1989

O P

9 CONCLUSION Chapter $ of the Requirenents Docunent specifies requirements that, s::bject to l

resolution of the identified open items, if properly translated into a dec1gn in accordance with the NRC regulations in force at the time of submittal, should result in a nuclear power plant that will have all the attributes l

required by the regulations to ensure that there is no undue risk to the l

health and safety of the public or to the environment.

In addition to complying with existing regulations, such a facility would also be consistent with Connission policies for severe accident protection and public safety goals.

i r

i j

l I

t i

t EPRI Chapter 5 DSER 9-1 July 1969

)

-.m o

)

APPENDIX A l

I DEFINITIONS 1

Appendix A of Chapter 5 of the Requirements Domment contains definitions of tems and acronyms.

The staff did not evaluate this appendix.

t i

1 i

i i

?

[

t i

i f

i i

EPRI Chapter 5 DSER A-1 July 1989

APPENDIX B GENERIC SAFETY AND LICENSING !$5UE TOPIC PAPERS i

B.1 ISSUE D.2 - EMERGENCY CORE COOLING SYSTEM CAPABILITY FOR FUTURE PLANTS i

!ssuet This issue was initiated by the ACR$ in 1972 to ensure that appropriate j

efforts are made to provide a basis for optimization of emergency core cooling systems (ECC$s).

It involves the exploration of new approaches to ECCS j

design.

ALWR Proposal: The Requirerents Document contains no requirements specifically intended to resolve this issue for ALWRs.

It is the Steering Consnittee's position that this issue is resolved by the general design improvements being specified for ALWRs. These include (1) additional therinal hydraulic margins for utility investment protection, (2) enhanced divisional separation, (3) l bestestimatedesignfornofueldamagewitha6-inchciameterLOCA,(4) target design for no fuel damage with a 12-inch diameter LOCA, (4) three divisions cf ECCS (BWRs), ($) direct vessel injection for BWR low-pressure coolant injection, (6) an in-containment refueling water storage tank (for PWRs), and (7) four redundant 50 percent-capacity trains of direct vessel f

safetyinjection(forPWRs).

Staff Finding:

This issue has been prioritized " DROP" on the basis that implementation of the CoFEission's Severe Accident Policy Statement will

[

address the safety concerns. Thus, the Requirements Document connitaent to satisfy the policy statement requirements (Section 1.2.4.1 of Chapter 5 of the Requirements Document) is an acceptable resolution of this issue for ALWRs.

B.2 ISSUE !!.E.4.3 - CONTAINMENT DESIGN-INTEGRITY CHECK

!ssue: Following an outage, a plant could inadvertently be returned to operation without all access openings being closed. This issue originated with the discovery at a nuclear power plant in 1979 that two 3-inch containnent exhaust valves had been lef t open for approximately 11 years. To EPRI Chapter 5 DSER B-1 July 1989

u i

W l

i ensure containment integrity, an independent means should exist for directly verifying contairmer.t integrity during plant operation.

i J

ALWR Proposal: The EPRI proposed resolution of this issue is through the

)

incorporation of design features to enhance administrative control of j

containment integrity.

In addition to the leak rate testing performed to i

satisfy regulations, the Requirements Document states that specific design features will focus on reducing the probability of a containment penetration j

being inadvertently left open.

The Requirements Document states that by clearly identifying all isolation valves, ensuring easy access for verification, providing better position indication, and including fail-safe l

design features, the probability of a large penetration being left open is substantially reduced, t

Staff Finding:

The staff assessment (NUREG-1273) of Generic Safety Issue II.E.4.3, "Contain#ntnt Integrity Check," generically resolved the issue for operating reactors and questioned the cost benefit of a backfit for current operating plants that would require a continuous or short-term periodic gross check of containment integrity.

However, such a system would not be a backfit for an ALWR.

Also, it is not clearly evident, from the information presented in the Requiresents Docunent, that ALWRs of evolutionary design will have a j

significantly reduced number of containment penetrations.

The staff considers that the next generation of LWRs should have an improved capability to detect inadvertent containment bypass.

The staff concludes that the Steering l

Comittee should address the concerns stated above. This is an open item that must be satisfactorily addressed before the staff can complete its review of Chapter 5 of the Requirements Document.

l B.3 ISSUE 93 - STEAM BINDING OF AUXILIARY FEEDWATER PUMPS (PWRs)

Safety signific6nce:

In current PWR plants, the emergency / auxiliary feedwater (EFW) system is isolated from the main feedwater system by a series of check i

1 valves. On several occasions heated main feedwater leaked into the EFW system through those valves, flashed to steam, and caused steam binding of the EFW pumps.

The potential for common-mode failure is present because the pumps are connected by way of corinon suction piping.

EPRI Chapter 5 DSER B-2 July 1989

.- - \\

u i

1 i

ALWR troposal:

The Requirements Document approach to the resolution of this issue is two-fold.

The primary approach is to alert the operator to conditions that are indicative of a potential for steam binding, so that appropriate action can be taken before the onset of steam binding in any ErW pumps.

To achieve this, the Requirements Document recuires that seans be proviced to detect potential EFW pump steam binding as a result of steam / hot water leakage through check valves in the pump discharge lines.

This is to be detected by monitoring the temperature of a portion of the discharge piping upstream of the check valves, with indication and alars in the control room.

Appropriate vents are also to be provided for removal of steam in the event steam binding occurs. The Reovirements Document a' Iso requires that the ETW system consist of two subsystems, each containing one motur-driven pump, one turbine-driven pump, one EFW storage tank and associated piping, valves, instrumentation, and controls. This arrangement of four pumps in two trains is intended to minimize cross-connections between individual trains, and thus will minimize the potential for common-mode failure due to steam binding.

]

Staff finding:

The staff generically resolved this issue for operating reactors by issuing Generic Letter S8-03. The ALWR proposal complies with the generic resolution and is therefore acceptable.

B.4 EMERGENCYFEEDWATERSYSTEMDESIGN(PWRs)

Issues:

Issue 122.la, Davis-Besse Loss of All Feedwater Event - Connon Mode Failure of i

Auxiliary Feedwater pump Discharge Isolation Yalve Closed Position Issue 122.1b, Davis-Besse Loss of All Feedwater Event - Excessive Delay in Recovery of Auxiliary Feedwater I

Issue 122.1c, Davis-Besse Loss of All feedwater Event - Adequacy of Emergency Procedures. Operator Training and Available Plant Monitoring Systems issue 124, Auxiliary Feedwater System Reliability 1

EPRI Chapter 5 DSER B-3 July 1989

~

\\

i

!ssue 12!.!!.7, Long Tem Generic Actions as a Result of the Davis Pesse Event j

L of 6/g/85 Reevaluate provisions to Automatically Isolate feedwater from i

Steam Centrator During Line Break

)

Issue 126.!!.11, Long Ters Generic Actions as a Result of the Davis 4 esse Event of 6/g/45 - Recovery of Main feeowater as Alternative to ATW t

hfety Sicnificancet A function of the auxiliary feedwater (AFW) system in f

the majority of the current plants is to supply water to the secondary side of the steam generators ($Gs) during system fill, normal plant heat up, normal plant hot standby, and normal plant cold shutdown. The AfW system also functier.s following loss of normal feedwater flow, including loss due to j

offsite power supply failure, and provides emergency feedwater following such I

postulated accidents as a main feedweter lire break or a main steam line brea k.

The loss of all feedwater at Davis Eesse resulted in an NRC investigation of the event. The investigation indicated that the potential inability to remove decay heat from the reactor core was due to questionable reliability of the ETW system caused by any or all of the following loss of all auxiliary feedwater oue to common-mode failure of the AFW pump discharge isolation valves to open excessive delay in recovery of auxiliary feedwater due to difficulty in restarting AFW pump steam-driven turbines once they tripped In addition, the investigation of the event indicated that (1) a two train system with a steam turbine driven AFW pump may not be able to achieve the desired level of reliability and (2) the provision to automatically isolate AFW from a steam generator affecteo by a main steam or feedwater line break may tend to increase the risk that adequate decay heat removal is not available rather than to decrease it.

SWRResolution:

The Requirements Document approach to the resolution of these issues is through tne provision of an ETW system that has a EPRI Chapter 5 DSER Ba July 1989

f c.

b substantially improved capability over that of typical current plants. The approach simplifies the system design and substantially reduces the potential for common-mode failures. This approach differs from current designs in that the EFW system is a dedicated safety related system that has no function for normal operation. To achieve these, the Requirements Document provides that:

A safety-grade supply of feedwater should be provided of sufficient volume to permit safe cold shutdown, based on:

(1)amainfeedwaterline break without isolation of EFW flow to the affected steam generator for 30 minutes, (2) refill of the intact steam generators. (3) 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months of operation at hot standby conditions, (4) subsequent cooldown of the reactor coolant system within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months to conditions which permit c Fration of the RHR, and (6) continuous operat%n of one reactor coolant rumr.

me EFW system should employ two non-condensing steam turbine-driven l

pumps and two electric motor-driven pumps. Any two pumps for four steam generator plants and any one pump for two steam generator plants must be capable of satisfying the flow requirements for licensing design basis-accident conditions. Any single pump must be capable of satisfying the flow requirement for best-estimate evaluations of core damage frequency.

This design approach is significantly different from the two-train steam turbine-driven AFW pumps employed at Davis-Besse.

l Each turbine-driven pump should be supplied with steam only from the i

steam generator it supplies with feedwater, i

A cavitating venturi should be provided in the discharge line to each steam generator to prevent pump cavitation due to runout and also to minimize other potentially adverse effects of having excessive EFW flow.

The rate of opening of the steam supply valves to the turbine-driven pumps must be limited to the extent required to ensure reliable startup of the pumps.

EPRI Chapter 5 DSER D-5 July 1989

c

.u c

p.,

Restart of the turbine-driven pumps following an overspeed trip must be facilitated by ensuring ready access to pumps, by labeling the components required to reset the overspeed trip, and by requiring the manufacturer to provide a clear set of reset instructions to be posted tOacer.' to each pump.

For cesigns that employ an electronic trip that

. s+t calon the mechanical overspeed trip, reset capability from the ca nrnl NN must be provided.

Isolation and flow regulating valves in the turbine-driven pump discharge lines should be capable of performing their safety function independent of normal offsite and emergency onsite ac power. Manual capability should be provided to permit positioning of these valves in the event of a loss of power.

Automatic and manual initiation of emergency feedwater flow will be provided. The EFW control system must have a safety-grade actuation feature which would feed the steam generator at a maximum rate for steam generator water level below the minimum steam generator water level i

assumed in the plant safety analysis.

The steam generator system should be designed so that actuation of the EFW is not required for at least 20 minutes following the point at which the low-level set point is reached.

I i

The minimum flow delivered to the steam generators under licensing l

design-basis-accident conditions should ensure adequate heat removal from l

the reactor coolant system.

The minimum flow delivered to the steam generators shouN ensure adequate heat removal from the reactor coolant system for best-estimate evaluations of core damage frequency.

The plant designer will define the mass and energy input to the containment resulting from fluw of EFW to the affected steam generator following a main steam line break and is to ensure that this is accounted for in the containment design. Operator action to terminate flow for EFW EPRI Chapter 5 DSER B-6 July 1989 l

y o

to the affected steam generator should not be assumed before 30 minutes.

The system should not rely on automatic isolation of EFW to prevent containment overpressurization.

The plant designer must perform an analysis of each automatic control loop of the EFW system to demonstrate capability for stable operation over the full range of operating conditions.

Staff Evaluation: The ALWR proposea resolution satisfactorily addresses the staff's auxiliary feedwater system reliability concerns and is acceptable.

The staff will ensure the acceptability of the analyses performed by the designer / applicant discussed above.

I B.5 HIGH/ LOW-PRESSURE INTERFACE DESIGN Issues:

Issue 96, RHR Suction Valve Testing Issue 99, RCS/RHR Suction Line Valve Interlock on PWRs Issue 105, Interfacing System LOCA at BWRs issue 120, On-Line Testability of Protection Systems (Leakage Testing of PressureIsolationValves)

Safety Significance: The connon concern in these issues is that either test errors, valve leakage, or multiple valve failures could permit overpressurization of low-pressure systems connected to high-pressure systems.

Pipe rupture resulting from overpressurization could result in loss of decay heat removal or containment bypass failure.

ALWR Proposed Resolution:

For BWRs. the Requirements Document states that low-pressure systems which could be overpressurized by the RCS should be designeo to withstand full RCS pressure without structural failure (i.e., 500 psig 9 360 degrees F).

Pressure isolation valve instrumentation and controls EPRI Chapter 5 DSER B-7 July 1989 j

i a

shouldbeprovidedto(1)preventopeningshutdowncoolingconnectionstothe vessel in any loop when the pool suction valve, discharge valve, or spray valves are open in the same loop, (2) prevent opening the shutdown connections to and from the vessel whenever the RCS pressure is above the shutdown range, i

(3) automatically close shutdown connections when RCS pressure rises above the shutdown range, and (4) prevent operation of shutdown suction valves in event of a signal that the water level in the reactor is low.

For PWRs, the Requirements Document states that low-pressure systems which could be overpressurized by the RCS should be c:esigned to withstand full RCS pressure without structural failure (i.e., 900 psig 9 400 degrees F).

Relief valves, sized to protect against overpressure transients, should be provided on the RHR system.

RHR suction valves should be provided with permissive interlocks to prevent opening if RCS pressure exceeds RHR design pressure.

The Requirements Document states that RHR isolation valve controls must provide that the valves be closed and opened by operator action only. There should be no auto-closure features on the interlocks. See Section 5.2 of this report relating to protection against loss of decay heat removal during mid-loop operations.

Staff Evaluation:

The staff concludes that these design features of low-pressure systems to withstana full RCS pressure, and e11mination of the auto-closure feature of PWR permissive interlocks, are acceptable. However, the staff notes that, in addition to specifying these features, the Requirements Document should also specify for PWRs that: (1)valveposition indication should be available in the control room when isolation valve operators are deenergized and (2) high-pressure alarms should be provided to warn control room operators when rising RCS pressure approaches the design pressure of attached low-pressure systems and both isolation valves are not closed. This is an open item that must be satisfactorily addressed before the staff can complete its review of Chapter 5 of the Requirements Document.

The staff notes that for some low-pressure systems attached to the RCS, it may not be practical or necessary to provice a higher system ultimate pressure capability for the entire low-pressure connected system. The staff will 4

EPRI. Chapter 5 DSER B-8 July 1989

f evaluate these exceptions on a case-by-case basis during specific design certification reviews.

The staff will review inservice testing programs and technical specifications for ALWR applications to ensure that pressure isolation valves are adequately j

tested. Plant administrative controls and training requirements will be I

reviewed during the each facility's operating license review.

8.6 ISSUE 117 - ALLOWABLE OUTAGE TIMES FOR DIVERSE, SIMULTANEOUS EQUIPMENT OUTAGES

)

Safety Significance:

Simultaneous outages of components appearing in the same accident sequence, even though not involving manifestly redundant divisions of the same system, can give rise to high risks that do not warrant imediate shutdown. Operators are frequently called upon to pass judgement upon the

]

acceptability of taking components out of service for maintenance or surveillance, as well as to track compliance with technical specifications.

They need more help than current documentation or training gives in identifying such high-risk outage combinations, l

ALWR Proposed Resolution:

The Steering Comittee indicates that high-risk I

combinations of equipment inoperability will be identified in the PRA. These PRA insights will be available for use in the development of technical

]

specifications.

Staff Evaluation: By letter dated November 22, 1988, the staff indicated that the technical specifications should be developed, where practicable, upon risk and reliability considerations. Therefore, the staff concludes the EPRI approach to development of the technical specifications is acceptable, i

B.7 ISSUE 132 - RHR PUMPS INSIDE CONTAINMENT Safety Significance:

RHR pumps located inside the containment that have not been qualified for a harsh environment cannot be given credit in licensing analyses for providing long-term decay heat removal.

l

(

EPRI Chapter 5 DSER B-9 July 1989

p t

-l ALWR Proposed Resolution: The Requirements Document specifies that all RHR pumps should be located outside the containment.

Staff Evaluation:

The ALWR proposal satisfactorily resolves the issue.

B.8 HYDROGEN CONTROL Issue A-48. Hydrogen Control Measures and Effects of Hydrogen Burns on Safety Equipment b

i Issue 121 Hydrogen Control for Large Dry Containments t

Safety Significance: Regulatory requirements relating to DBA hydrogen generation may not be adequate with respect to severe accidents.

For the unlikely event of a degraded-core accident, scenarios have been postulated that result in the release of large quantities of hydrogen to the containment.

Rydrogen in significant quantity can be formed as a result of the reaction of zirconium fuel cladding at high temperature with steam.

Experience gained from the THI-2 accident indicates that design capability may be required for handling larger hydrogen releases than was previously assumed.

In addition, the Industry Degraded Core Rulemaking (IDCOR) Program also identified the need to detennine the effect of hydrogen burns on safety-related equipment in containments that are not inerted. This consideration has been the subject of experimental research projects.

ALWR Proposed Resolution: The approach being taken by the Requirements Document to control the hydrogen generated by a spectrum of postulated accidents is to require that the ALWR be able to accomodate the design basis-accident conditions with an acceptable 1.! vel of margin under the dominant severe accident sequences. Hydrogen control systems are to be provided to prevent the buildup of a detonable mixture of hydrogen and oxygen. The Steering Comittee assumes that the hydrogen concentration inside the containment is to be limited to 13 percent by volume, based on uniformly distributed concentration of hydrogen generated by the equivalent of a 75 percent active fuel cladding zirconium oxidation during an accident.

EPRI Chapter 5 DSER B-10 July 1989

Staff finding:

On the basis of its review and evaluation, the staff finds that the proposed approach to the resolution of GSI A-48 and GSI-121 is not acceptable. See Sections 2.3, 6.5, and C.3 of this report for the staff's evaluation cf this issue.

B.9 ISSUE A STATION BLACK 0UT

)

gif,c,ugom " Station blackout" means the complete loss of alternating current (ac)' electric power to the essential and nonessential switchgear buses (i.e.,

1 loss of offsite electric power system concurrent with turbine trip and unavailability of the onsite emergency ac power system).

10 CFR 50.63, which became effective July 21, 1988, requires that each light-water-cooled nucle 6r power plant licensed to operate must be able to withstand station blackout for a specified duration and recover from it.

Section B.9 of Chapter 5 of the Requirements Document addresses station blackout for the ALWR.

It identifies the key ALWR requirements that are 1

applicable to station blackout. The most pertinent of these is the requirement that systems be provided to maintain the plant in a safe condition during a station blackout for 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months , assuming mechanistic system performance and best-estim6te analytical methods without a single failure in addition to station blackout. The staff questioned the Steering Comittee on the use of

" mechanistic system performance and best estimate analytical methods" in the ALWR 8-hour station blackout analyses, pointing out that these techniques may not always be conservative enough to provide the assurance needed that an ALWR can meet the requirements of the rule.

In a letter dated September 15, 1988, the Steering Comittee responded that the 8-hour blackout requirement specified in Section 2.3.3 of Chapter 5 of the Requirements Document is an ALWR plant investment protection requirement, selected to provide additional margin in the ALWR design. The Steering Comittee stated that the analyses that will be conducted fcr this 8-hour investment protection event will be consistent with the performance evaluation basis (i.e., using realistic, best-estimate methods that eliminate excess conservatism and mechanistic calculations that are based on actual phenomena occurring in the event) and will not necessarily be the same as the coping L

EPRI Chapter 5 DSER B-11 July 1989 1

.e.

l analysis utilized to comply with the station blackout rule. The Steering Constittee stated that the coping analyses which will be conducted to confirm compliance to the station blackout rule for the ALWR will be consistent with the guidance provided in NUMARC 8700 and Regulatory Guide (RG) 1.155.

The Steering Comittee also stated in its response that the consnittee viewed the station blackout evaluation called for by 10 CFR 50.63 as part of the risk evaluation basis portion of the ALWR Design Bases.

The risk evaluation basis, which uses PRA methods, is not consistent with the use of NUMARC 8700 and RG 1.155. The staff spoke to EPRI program staff representatives regarding this and they indicated it was not intended that the ALWR PRA be used to demonstrate compliance with the station blackout rule but that the methodology of NUMARC 8700 and RG 1.155 be used.

==

Conclusion:==

On the basis of the statements that mechanistic system performance and best estimate analytical methods are directed toward the investment protection aspect of station blackout rather than to the licensing aspect and that the analysis used to confinn compliance to the rule will be consistent with the guidance provided in NUMARC 8700 and RG 1.155, the

[

. Steering Comittee's proposed method of analysis for station blackout is t

considered acceptable. Because determination of the actual coping duration and the ALWR capability to recover during that period is partially dependent on site-specific characteristics, the subject station blackout analyses required to demonstrate compliance with 10 CFR 50.63 will necessarily be plant-specific. However, the staff is presently reviewing Chapter 11 of the Requirements Document which provides additional electrical design details that relate to station blackout.

In that chapter, EPRI is proposing a separate and diverse alternate ac power source (combustion turbine generator) that will have the capability to po;er station-blackout loads.

This will provide a separate means of coping with a station blackout in addition to the 8-hour investment-protection coping capability addressed here. A detailed evaluation of the proposed alternate ac power source will be provided in the staff's evaluation of Chapter 11 of the Requirements Document.

ML20011C620

Contents

Text

Subject:

Purpose:

Enclosure:

Navigation menu

ML20011C620

Text

Subject:

Purpose:

Enclosure:

Navigation menu

Search