ML20056F296

Forwards Comparative Mark Up of Insights List Showing Differences Between 930723 Version & 930810 Version

ML20056F296
Person / Time
Site:	05200001
Issue date:	08/17/1993
From:	Kelly G Office of Nuclear Reactor Regulation
To:	Duncan J GENERAL ELECTRIC CO.
References
NUDOCS 9308260325
Download: ML20056F296 (20)

Text

{{#Wiki_filter:p ucyg UNITED STATES 3 c.

• 3

,E NUCLEAR REGULATORY COMMISSION E WASHINGTON. D.C. 20566 o %,j. ~ ,8 Docket: 52-001 AugJst 17, 1993 NOTE 10: Ja'ck 1)uncan, GE, FROM: r) Kel,1y S DSSA, NRR

SUBJECT:

COMPARATIVE MARK;MP 0F THE INSIGHTS LIST Based on our phone conversation of August 16, 1993, I have enclosed a mark up of the insights list for the ABWR PRA. This list shows the differences between the July 23, 1993 version of the list and the one I faxed to you on August 10, 1993. Please let rne know if you have any qLastions about the differences. ?

Enclosure:

as stated 't i 9308260325 930817 V DR ADOCK 05200001 PDR g

4 LIST OF IMPORTANT? SAFETY INSIGHTS 4 MPORT ANT-I N S IGHT S-AND-A S SUMPT40N S-4N THE48WR-PRA July-23--M93 i Plant-Wide Insiahts I) The COL Applicant is to perform a seismic walkdown following the procedures of EPRI NP-6041, revision I to insure that the as-built plant matches the assumptions in the ABWR PRA-based seismic margins analysis and to assure that spatial systems interactions do not exist., [ITAAC ] -Flood 4*g -i n teract4enswere-evalua ted-4n4he-i nter-na $ fleeding-analys4+-4n the-ABWR PRA

2) The integrity of divisions is a very important assumption in the ABWR PRA.

The PRA assumes that no high pressure of high temperature piping lines penetrate walls or floors separating two different safety divisions. Piping penetrations are qualified to the same differential pressure requir.;ments as the walls or floors-they penetrate. [ITAAC ] -{44AAC 3.3 Pip 4eg-BAG} - 3) To prevent inadvertent spray or dripping from failing equipment, electric motors are all of drip proof design and motor control centers have NEMA Type 4 enclosures. [ Tier 2, SSAR Section ]

4) The fire analysis assumes that the routing of piping or cable trays during the detailed design phase will confirm with the fire area divisional assignments documented in the fire hazard analysis.

[lTAAC: -]

5) Subsection 9A.5.5 under "Special Cases - Fire Separation: for' Divisional Electrical Systems" lists the only areas of the plant where there is' equipment from_more than one safety division in a fire area. 'These should be the. only areas where multiple divisions share the same fire area. ((ITAAC

()' Combustion Turbine Generator 5-under " Spec 4el-Gases Fire-Separat4en-for4iv4s4enal-E4ec4r4eal Systcms" 44sts-the-enly-ereas-of-the-plant-where-there h equipment-from-more-than-see sa fety-d iv is4 en-in-a44 re-or-f4 eed-erea. These should-be-the only creas-where mul t4 pied ivis4 ens-s ha re-t he-same-f4 re/ flood-ereer (ebust4en-Turbine 4enerater [!TAAC-4-12-14-Gembust4en-Turbinc Cenereterv 44AAC-Ex42d340G3 The combustion turbine generator (CTG), in conjunction with the ac-independent water addition (ACIWA) system, have significantly reduced the estimated frequency of core damage from station blackouts (the dominant contributor to core damage in most BWR PRAs). In the ABWR SSAR,1GE. indicated that each of the~ emergency' diesel generators' (EDGs): and the CTG can:be used to power any"of the loads identified in the PRA-success criteria by manually closing selected i t

breakersL(notei. EDGs cannot~ power feedwatsr'ibmps)!4E-4nd4eeted thot c;ch of the-emergency-diescl gener+teri (EDCs)-and-4*-C4G-ean-bc c:cd-to-pcwcr cny of the-lead; identified-in-the-PRA-success--er4ter4e-by-manuaHM4es4ng selected breaker +r Even if offsite power is lost, the four onsite power sources can be used to power any safety or non-safety bus. This provids; significant flexibility which helps reduce the risk from station blackout and selected bus power losses. Procedures must be preparert by the COL applicant to direct this manual transfer of an EDG to a non-safety bus.?[COUA._stlofi.tsm7?i] .a m u.. An ' impo'rtintT sisuinption 'about ; thECTG isithat Tno'plidt*sspp6FC~syiisnii?iFi needed to; start or.rua:the CTG. ~ ' ^^ ^' ' ^ ^ ~ ^ ^ An-4mpor4 ant-assumpt4en-about-the CTC is that-es-supper 4-system; cre needed 10 start-er-run--the CTC. The CTG starts automatically and safety grade loads are to be added manually.',((1TAACL })( AC-Inde6endent ~ Wa_ tar' Addition Svstem' i The-ABWR-PRA-assumes-that-ea4ntenance en the CTC wiM-enly be performed-when the-plent-is-at-powee-This-4s-based on CE's expectat4en-that-4he4TG-wi44 need-to-be-used-dur4eg-shutdown-sperat4 ens c; 0 bat 4up to the EDC:. AC-4cdepend nt-Water-Addit 4en-System [14AAC 2.4.1] 9 This system is one of the single most important systems in the ABWR from the point of view of prevention and mitigation of severe accidents, since the accidents that have traditionally been identified in BWR PRAs as being the most challenging are station blackout and transients with failure of various ECCS or cooling systems. This system also provides benefits for fires, internal floods, shutdown events, seismic events, and events where containment cooling is lost.1 It can provide w~ater:T(ailesselimiketiptorTdrywsll?spriy ' ~ from a seismic category I diesel-driven pump'or alfire truck. ~It4an-prev)44e wa ter-{es-vessel-ea keup-or-drywell-spray)-from-a-seismie-ea tegory-1-44esel-i driven-pump &een-seismie-ae-meter-dr4ven pump, or c fire-4+eek-The use of the system as a backup source of water to the drywell sprays is perhaps the single-most important feature for reducing the consequences of severe accidents in the ABWR. In this role the system serves to: (1) reduce containment overpressure and delay the time to actuation of COPS, (2) eliminate the potential for drywell overtemperature failure in those events in which debris may be dispersed to the upper drywell, and (3) mitigate the consequences of suppression pool bypass by condensing steam produced in the drywell. The following"are im;iortant? asp'ehts ^6fith6TijitW,The4eMewing-are-er4t4 eel ~ aspects-of-the-systeer as' represented in th~e PRA:' l.;;;a'fiFeprotectionpump--]seismicjategofy}1[ diesel?driVenpumpj(i.e., at-independent) [ITAAC: 1, two44re-proteet4eh-pumpi ene-seismic-eategory 1-diesel-delven pump {i.e., oc-4ndependenth-ene-non-seismie-meter-dr4ven ump, 2. connectionprovidedoutsideofreactorbuilding,%hicballosiTfifs truck 7to be usedias l backup toTthe fire protection pumpsf[ITAACJ, -whichMMows-a-f4fetruck-4e-be-used-as-a-backsp4e-the-f4re-protec44cn pump

9 3. system piping and valves configured to allow fire protection water to be usedforeithervesselmakeupordrywellspray,["bbt)not?both limultaneously7[ITAAC -but-not-both-+hNnechsly ~T.. ~ ~ ^ ~ 4. all valves and controls needed for system operation can be accessed and manually operated in a straight-forward manner and can be operated successfully (including the environment the operator will be in)i-[ITAAC? following an earthquake, internal flood, fire,j or_;inte_rn_il sv_ int ~ m 5FdhesklalsesfpVovidsdltFpFevintMitkf16s~fforthsTfont6Ft 6olist g 6T5o r i fi ce s ; i n s tall ed TihIl Wiis6E litsdi,i pih~f tb"FistMEf t hslihj sE t tin gg 3 7F^3 seismic Category 11 water supplyfindependentLofithe!suppressif5Tpd61Tsd '~^ the' condensate storage tank [ITAAC'~;]. " ~ " ~ ~ ~ ~ ~ ' " ~ ^ 3 !QQT -er-internal-event-5. check-valves-prov4ded-te-prevent-backmw-free-the-reacter coc1cnt system 6. crif4c+s-instelled-4n thc cs;oc4ated-pipieg-to-restr-iet-the-4efest4en ~ rates-to-thee-vessel-and-drywell spreys. 7 seismie-Cetegory-4-water-supply-4ndependent-of-the suppress 4en pccl cnd the-conder. sate-storage-tank-RC4C [ NAf;C 2.'.4] RCIC is ac-independent and provides reliable high pressure injection. This makes RCIC particularly important in preventing station blackout from leading to core damage. In addition RCIC is very important for mitigation of control room fires or other emergencies that require the evacuation of the control room. The following capabilities are important for RCIC: 1. RCIC needs to be able to operate for 8 hours following a station blackout (using steam and de power) and the batteries at the end of 8 hours need to have sufficient power in them to allow for RCS depressurization by the ADS. RCIC pump and turbine are assumed in the PRA to be able to operate for at least eight hours without room coolers. [ Awaiting-GE-Input-COLT ActionfItem 19.9. THE40t4.OWING-TEX 4-WAS M0"E0 9] A-break-in-the-Reacter-Seryh-Water-{RSW)-System-can-cause-a41 cod in the Centrol-Building-that--could-4ead-te-eerc damage. THE-PRECEDING-TEXT-MAS-MGVED 2. For control room fires, the capability for local operation of RCIC outsidethecontrolroomisveryimportant.[{ITAACTE(capabilitfito perform)][ COL [ActihnjJtem M (existencefoCpr_ocedures)] ~ ~ ~ " ~~ i ~) 3. Sensitivity studies that increased SSC unavailabilities showed that an j increase in RCIC unavailability would cause the greatest increase in i estimated core damage frequency of any SSC. RCIC also was found to.be j the most sensitive system to increased outage time assumptions.T[ COL l y l l 1

Action;Itemto'belocludedinl RAP) 4. The suppression pool temperature up to which RCIC can operate is important for Class II sequences.0 The"ABWR PRA~ assumes that RCIC'can ~ operate'up to~aEsupprdssion p^ool temp ^erature ofj75.'7 *Ci(170 #F)~.~ [Awa4 ting 4E-4nput--ITAAC j]~ ^ ~~ ' ' ' ' ' ~ ~ ~ ~ ~ ~ " " ~ " ~ ~ Reactor Buildino~ Cooling? Water (RCW)/ Reactor'ShEVice Watsr7RSW) The'RCW'ahd RSW sjstimi"irf"sach'disifnsd silh'~twolFFillsliloopTVEich division. reach;1oopt sicapable of removing all component. heat loads'^' i associated with the operation of the ECCS; pumps'.l The' parallel 11 oops ~sithin each division'substantially reduce thelestimated core _ damage; frequency. [ITAACg] (Lutomatic?Standbfliquid Control SystsWSLCSFihd*R6EiFEul'ationTPuin6' Trio t The ABWR1has~itreliable ind'diU5Fse/scriin~5ystem^sithib6th~hidFiU11&snd electric run-in capabilities toL reduce the. probability'of an ATWS. SLCS and recirculation pum trip provide backup reactor shutdown capability.z Automatic initiation of.SLCS avoids the potential ?for operater error associated with manual-SLCSinitia' tion.-[lTAAC';) ~~ ~ Reactor Building' ~ The-ASWR-PRA-essemes-tAat-RGIC-cen-eperate-up-te-a-suppress 4cr. pool temperature-of-4M-% Reactor-Bei4 dine-f4TAAC 2.15.10] A flood in the reactor building could fail ECCS equipment and other important equipment. The following are assumptions in the ABWR internal flooding analysis that limit the chances and increase the mitigation capabilities of the ABWR design: I. ' The volume ~of the' reactor building' coFFid6F;lii level;B3F^ thatTurrounds the three ECCS divisions is sufficiently;1arge:t_o handle the biggest breakthatcanoccur(water;from_theTsuppressionipool).L{ITAAct 1 ~ The-volu' e-of-the-reec4er-building ^4ebrador-6n4 eve 143F-that~50r]rc=ds m the-three4GS44 v4s4 ens-4s-suff4eient4y-lerge-te-handle-tAe-b499est breaks-that-cen-oc+ur-{4nc4eding-water-frem both the-GST-and-the suppresslen-peeF). 2. Suppression pool flooding in an ECCS room will reach equilibrium level below the ceiling of the ECCS room in which the flood occurred.[lITAAC 1 3. l Floor drains directfpotentialIfl60dLwatersjto?roomsEshbre"s0mpsThndlump pumps are located. The drainTsystem'Is^ sized to withstand the maximum flood rate'from' a breat in'tne fire. water systemn 1 Sizing?of. the: drain system is toiincludejrovisions?for plugg,ingloflsome;dral,ns;byldebris. [lTAAC M /) 4 4F TNon-divisionalEdrafis311F8Fil6"ts'ths*66h ~disfil66EFssii@~5?bn " " ~ ~ ' ~ ' ~ ~ ~ " appropriate floorsk }[ITAAClmd]' I 3. floor-drains-direct-potential-flood-waters-t+-rooms where-sumps-and-sump pumps-are4ecated. The-dr a i n-system-is442ed-to-w ithstend-the-eax4eum i

ficed rate 4 rem : break-in-the fire water :y:temr--G4e4eg-ef-the drain system-4s-te-4nchde-provis4 ens-fer-pkgg4eg-ef-some drains by debri;. '4. Non-d44444enal-drains-wi44-drain-to-the-non-divisional : cmp on appropeiste-floors. 5. Floor Blf of the reactor building has overfill lines on the non-divisional sumps outside secondary containment. If the sump pumps fail or the flow rate exceeds the sump pump capacity, the lines will direct water to the non-divisional corridor of the first floor (B3F) inside secondary containment.R lTAAC G 6EPATkafsFseal fin 7tW6h F{ill M f ri)i '-~pon_tainmegtii.ntsgrityhillTAACM]~Q~ ~F6FidWts"niinfilh"sR65dify f ~~ ~ ~ ~ ~ ^ ^ ~ ~ " "^ ^ ~^" ~ ~ ~ 6. A-wa ter-seal-4s-prov44ed-to-ea4 n te4 n-second ary-eente inment--int eg r i ty. 7. The ABWR PRA flooding analysis assumes that on the B3F level, all wall and ceiling penetrations are above the maximum water level of all potential floods. Doors communicating from the ECCS pump rooms to the corridorontheB3Flevelarewatertightdoors.q[ITAACS) 8. If a flood were to occur during shutdown, some of the ECCS rooms may be open for maintenance. ABWR procedures specify that one safety division willbemaintainedintactatalltimesduringshutdown.((COLAction Item 19_.9.11p0)] Similarly, a fire in the reactor building could damage important equipment. The smoke control system in secondary containment is important in helping to prevent the migration of smoke and hot gas layers from a faulted division to another. This is accomplished by pressurizing the surrounding areas so that the smoke will be contained. This capability and its adequacy should be confirmed.;[ITAAC- ] Control Buildina Turbine 4ei444no [ITAAC-2d&d4-} F4eed s-in-the4urbine-Bu4444ng-c an-prepagate-to-ether-bu444ng s-th at-have s a fety-reh ted-equi pmen t-4n-them. The fe44 ewing design features-help 4e p revent-the-prepag a t-ion-ef-such-f4eedst 4. Fleee-drains-diceet-petent-ial ficod-watees-to-reems-where sumps and sump pumps-are-located. The drain-System i; 342cd to withstend-the-ea*4eum f4 eed-ra te-free-a-brea k-in-the-f4re-w a ter-sys t em. 54 zing-of-the-dra4e system-is-to-4nehde-provis4 ens-fee-pkgging-of-some-dre4es by debri;. 2. Non divisional-drains wi44-drain-te-the-non-div4sien:1 Sump: On appropr4ete-f4eees. C+ntrol-Bu4444no-f4TAAC 2.15rM-} Flooding in the control room can lead to core damage. The following design features are important in preventing flooding in the control building: 1 1. The ABWR internal flooding analysis assumes that flooding of the control i building from the UHS cannot be maintained by gravity alone. To limit i

i j the consequences of a RSW line break,.the RSW system will be designed so .that the UHS cannot dr_ain into the Control Building by gravity. [Interfa6e:Requirementi

)

1 2. To limit the consequences of a RSW line break, there is a maximum of 4000 meters of pipe (2000 each for supply and return) between the UHS and the RCW/RSW room, which can be discharged to the RCW/RSW room following RSW pump trip./[InterfadetReqstremen R f)

3. : "1 flo'or drains! direct L potential? flood; waters 5to; roomsNheWsUi@i3hd Tsiimp located.jThedrainEsystemf10kized~towithstindithe; maximum

lood ~ rate frolf atbreakit_n;the fire Waterisystem.dSizingToflths; drain [ystem is to include. provisions' for plugginglof somsdrains;by;debrisc s [ Interface Reqdirement i j][ Servicelater'Pumo HouseE 7 1. Floor-dra4eswiirec4-potent 4o4-f4eod-wat+es-te-r+ oms-where sumps and-sump pumps-are-4eceted. The drain-system-is sized-t+-wMhstand the maximum (4eed-ret e4 rem +4>reak-4n-the44re-water-syst em. S i24eg-of-the-dea 4n system-4s-te-inc4ede-prov4s4 ens-for-plugging-of-somewira4ns by debris. 4. Nan-divis4enalwir+4cs-w444-dra4n-te-the nca div4s4enal sumps on appr+pr4atc4100rs. i Ser+ke-Water Puma-House [ITAAC-L4L44, ITAAC 2.4.5] Previous PRAs and reliability studies have shown that loss of service water can be an important contributor to core damage. The service water pump house, which is outside the ABWR certification scope, is a building that must be designed to remove the following concerns: 1. Prevent fires or internal floods from impairing multiple safety trains. [ITAAC' ) 2. Prevent common cause failures such as intake blockage from debris from affecting multiple trains.i[ITAACi f) Circulating' Water System' C4 rmis tino-Wat er-Syst+H4 TAAC-2-4M&} Flooding from the circulating water system (an unlimited water supply) can lead to flooding of other buildings that do contain safety related equipment.F The follisin'g design fsat'ures? help Feducelthe^chsricesithatWdirdslatingyater system break will'cause core ~damagh:2-The4o74esing dss 4 n-featurerh~cip 9 reduce 4heQhancis4 hat 4hs-birculat4ng-water-system-break-w444-euse core damage + 1. The circulating water system (CWS) has three pumps and each pump has an associated motor operated isolation valve. To limit the consequences of a circulating water system break in the Turbine Building, for cases where the heat sink is at an elevation higher than grade level of the turbine building, an additional isolation valve is installed in each i

I l line.E(ITAAC???? 2M"' Interna 1lfloodU)aFFipisis5ted/mitigate ist6mit1ETiEti6ns!and ~~bperator$cti on s OToipFbvent s flood i ngl o f 3 areas 2s u i t h e ~'"~~~ ^^ Eonden ser< p i t7 there ' are t to2 be?sateril evel j sen soEM (two26ut logic),tolalarmitoithe c'ontrollroomiiff the7wateMleveligetsito61:highiin F the.pitland triintheMirculating satiriahdtturbinetservicelwatsr? And:3 osedsolation:valibsdnibothisjislemsMITAACs (~^*~~~~ pump ~~ s 1 Tdrbihi"SsWids' Wit ~eFMitii] Floadihy"ff6s"thi~tUF615s?iiWifilstsFTijifiMT(ihidhi1EltidYafsF~iU5519)Nin lead; to ; flooding Tof@ther;buildinssithat' doi contain; safety? rel ated : equi ~ ment. - p The following designifeatures~ help: reduce' thelchancesLthat :aiturbine service katerjystem preakyjllicause[coreidamsg6[^ ~ ~ ' "^^~ ^^^^~ ^^~ ~ ~^^""~~ I P Thi"tHEbi'nirs~sFVi Es *WitiFlijs tiiiR TSW)lhisit~G5765bi!idd Tiibh[p6ER his ' ~sn as'~ ociated 'motosoperated?lsolatibnivsWeb ?Tollimit'?theiconseq6encEi s pf;a tur6ine seFvice waterL:sistem breaklinithe1TnbinelBsilding,sfor" cises5where the h'eatisinkMsTitran'elevatibhlhlghsr thanigrideblesel Fbf the2 tu rbi ne1 bu il d i ngF^~an t addi t ibn al t i sol ati oni va161 s"i s s tal l ed ' i n reach linen 1[ITAACLc "~ ' ~ ~"' ~ ~ ' ' ~ ~ ^ ~ ~ " ~ ~ ~ ~ " ~

Interna 1L floods'] ass'pfe0Entbd/mitipitid'ihIpstiby[ibtbistid7EEt'Ibns and 2E

' operator actionss To prevent:floodingE6ffhreasTsurrbsndinsnthe" ~ tondenser pit, there are?tof be water levelisensorss(twolout-of-fodF - logic)? to. alarm toztheicontrol Croom:if: the1 water 21evel gets}toolhigh? in the pitiand'. trip the: turbine service water 3ndicirculating~fwaterl pumps ^ ~ ~ and close isolation:va.lves ~in' both ~ systems. i[IT_AACi?.a)~~ - ~. ~ ~ ~ - .n ReactoF $6FVtEi'Waf6FSystein)- Flobdihffforif ths~Riict'6F" Service WiteF(RSW)]sjitsNT(ihTUhliinitid7WitsF supply) can: lead tof core' damage. iThe following designifeaturesihel ~ the chancesjthatf af RSW sistem brehkNilleauselcfre? damage: ~~~~"pirednie 11 l A?br&aEih the RSWTsy5 fem;bsh EiUsef alflb6dlin]thi;C66tfol!B0l.fldihg}that ' could; lead to core ' damage. 2. Internal 41eed;^hrd prevented /mit49ated in part-by-automat 4e-est4cn: and operator-act4 ens. To prevent 44eedieg-of-areas-surrounding-th condenser-pitHhere-are40-be-water icvel-sensors-to-alerm-te-the centrol-reem4f-the-water-level-gete-too44 h-4n-the-pit. Diverse 9 sensors will 1+4p-the-e4rceht4ng-water and turbine-serv 4ee-water.=: end-close-feekt4en-valve: in both-systems-44-the-water-reache: :

igicr 4evel.

~ Reeeter-Service-Water-System--{44AAC 2. H. Forthisreason,fih?ahildiiph65 Eapability is installed in:ths RSWillheRtd*pisVhnt*bhE65trollediflodding:of 1 .the Cont'rol(Building'should theiRSWjjsolationjval$sgallityclosejoMiRSW Pipebreak.JITAACW.)

2. ' ?Witebilbielis&hsois~willTeliEitillid'inithE"FeactbFbbildissI26bling

" water l(RCW)freactor(service waterf(RSW)? room'slin[ths% control; building,~~ Thes.s s. ensor~s fare:Us_ed._! to ^ ale,~rt.~' thefope.~r_ators: to floo.dingx. ?: the"ro_ oms w- ~ ~. - ~ l i n n

^ 56d Tiind (s ign alit t6Tt rif RSW/ RCW f pUmiis[ihd Tcl ose~i sol at i6 n3il V5 i fi E^ the affectedTsystems. LThe' sensors ~are' diverse'and are arrang~ed-irt "altwo- ' but-of-fout ogicQ[ITAAC l i]^ ^ ' - ~ " ' ~ " ' " ~ l Rea_qtoF WatsF CTe~anlio" System C -an-ant 4-54 phen-valves is inste44ed-4n-the-RSW-14ees-to-pr+ vent-uncontrolled flooding-of-the-C+ntr+1-Building-should-the-RSW-4seht4en-valves 4a44-to-<4ese en-a-RSW-pipe breck. l Reac4er-WateM4eanue-Sys4(- [ITAAC 2.6.1] The Reactor Water Cleanup (CUW) System provides some benefit in the ABWR PRA by removing decay heat at high pressure. It would only be used in th.is mode if the containment cooling mode of the RHR system was disabled.E[ Tier;24SSAR Section; ) Thi~is01atiodTalVFi?ih~tfiE :RWCUlfstEsltiiustllieyapiblE~6f[ifoliilhil'iyilhit ~a differct.tialTpressure ' equal; to"the operating pressure of theTreactor2 coolant systemiin,the event, that therejis;alLOCAling thejRWCUL[ITAACf 1]L '" ~' The reliability 1of these" isolation 3alvbs?should.histch"thEFFeliabilityThisuined in the ABWR PRA (C,0L Action Item tolincludelin RAP]... Tem)erature sensitive" equipment.in the reactor. water cleanup system should;bela)1e:tol remain ~ ~ functional 1or should be' isolated when the CUW! system is used fas a Ldecaf?hdit i removal = path at high temperatures. ~ Temperature sensitive:. equipment *suchias the resin beds is'to be isolated automatically 70n_high water,temperatureLor manually by~ operator' action.. The entire CUW system-is' notito isolate on.high temperature off the incoming water [C0L' Action. Item-JJ. Ultimat'e Heat? Sink --The-4 soh t 4 on-v alves-4n-the-RWCU-system-must-be-eapable-ef-4seh t4eg-aga4nst-a44 f ferent4al-pressure-equal-to-the-opere14ng-pressure-of-the-r+act+r-cccknt sy s tem-i n-t he-event-th a t-there-ie-e-tDCA-4 n -the-RWCU. The-rel4ebi1ity cf these-4selat4en-velves-should-match-the-rehebi444y-assumed in the-ABWR PM. Only-temperatere sens4tivc equipment-shouh4solete-en-high-water temperaterc............. ~ ~ Ult 4eate-44 eat-Sink-{4TAAC 4.1, ITAAC-2A4v&} t The ABWR PRA assumed that the service water system and the ultimate heat sink would work well in tandem to deliver adequate cooling to needed equipment. There was no detailed examination of these systems in the PRA since they are not in the Certification scope. The ultimate heat sink and the Service Water Pump house should be designed in such a manner so that common cause failure of service water is extremely low. A site-specific PRA must be developed by the COL applicant to show that there are no vulnerabilities (e.g., due to debris clogging of the intake, internal or external fires,texternalfoEinternal floods) in the ~ ultimate hea' t:Lsink;and thejssrvice WaterJum[ House;[ Interface Item)dCOLActioniltemMJ. 3 t EbMildhn11ow6 Pah61P t -extereal-or-internal-f4eeds}-4n the u144 mate-heat-s4nk-and-the-Servic+-Wat+r Fump House.

(.. Remote-Shutdown-Panel [ITAAC 2.2.5]

1) The ABWR PRA fire analysis found that use of the remote shutdown panel is very important in mitigating fires in the control room. -Thelde~ sign ^of / the remote? shutdown panel was enhanced by GE ' adding controls 1for;:a: fourth;SRV' Jthree needed to depressurize;--The-design-of-the resote-shutdo0n~piFil ucs J

enhancid-by-GE-eddinilcentrib for c-forth SRV (three-needed-tc depressuri c, plus one for a single failure).((ITAACQ] Et-The4BWR-decay-heat-remove 4-ee14ebH4ty-study found-that operctor oc-t4 ens mak4*g-use of the remote-shutdown-panel were importent-dur4eg mode: 3,2) The 1 ABWR decay heat removal reliability study found that operator actions making use of the remote shutdown panel were important during modes 3, 4, and 5.[ [COLTAEtionTItem i $(pr:ocedures)] l Residual' Heat' Removal' SystsR Res44ual-Heat-Removal-Svetem--{44AAC 2.4.!] The Residual Heat decay heat during, Removal (RHR) system is very important for the removal of normal shutdown and in its ECCS function as low pressure j core flooder. The following design features and assumptions are important for assuring the RHR system is capable of removing decay heat in various modes and for various accident and transients: 1. An important failure mode for beyond design bases earthquakes is the failure of the RHR heat exchanger in such a manner as to drain the suppression pool.--Th4s-wou14-potent 4*lly lecd to core damage end would aHow-releases-to-enter-the-eteosphere unscrubbed-In the ABWR PRA-based seismic margins analysis, the RHR heat exchanger is assumed to haveaHCLPFof0.7.[COLActionItem[tolbe.1dded"tiDRAPt6~ check 9 seismic capacityfof equipment] 2. Inmodes3,4,and5,ithsLperm15siVssia6dlinhib.itsfissosistedilth'the RHR Mode' switch ensure that' valve 111ne upsiare' corrects forfmost!RHR functions,~ thereby Lhelping;to;preventjinadvertent'diversionlof@ater - - ~ from the RPV. [ITAAC ] -t he-permiss4ves-and-inhibits-assoc 4sted-w ith-the-RHR-Hode-switeh-ensere -that valve-line-ups-ere-correct-for-eU-RHR-funet4 ens 7-thereby-prevent 4eg l 4nadvertent-44 vers 4en-of-water-from-the RPV. 3. The ABWR PRA and the DHR reliability study have shown that it is important for the RHR not to fail as an intersystem LOCA.,?Thi RHR system has7thejsapability}tEwithitsiid 66Fmalf reactbr#sistem pressubes without'thelpipingLreaching its ultimateLcapacity; 'The RHR-system is des 4 ned-to-be-able-te-withstand-a-shortW-ef-exper-iencing normcl 9 reacter-system-pressures without-the-piping-reaching-41s-eM4eate cepac4tyr The DHR reliability study indicated that RHR valve interlocks are important in preventing low pressure RHR piping [from_ beinginadvertentl 4. The ABWR DHR reliability study determined a number of configurations of equipment for modes 3, 4, and 5 such that the estimated core damage frequency from decay heat removal failure conservatively was less than 1

in a million per year. An important assumption in this study was that the three RHR trains world be configured as follows during modes 3, 4, and 5: One loop would be isolated, in standby, and operable with no equipment in maintenance; a second loop would be the operating decay heatremovalloop;thethirdloopwouldbeinmaintenance.(( COL. Action , Item :, ) 5. Shutdown cooling piping connects to a nozzle in the RPV at an elevation that is above the top of the active fuel. This reduces the chances of uncovering the core by vessel drain down.((RAACM] 6. When in the shutdown cooling mode, some operating plants have experienced loss of decay heat removal on loss of power to logic circuits. For the ABWR design, the RHR system does not isolate on loss of logic power. [lTAAC

]

Hich Pressure Core Flood'Systt[D (1). HPCF pump B can be operated independently of the" essential multiplexing system. Hioh4ressure-Cor[h ced-Syst em [14MC 2.4.2] One-of-the-HPGF-pumps cen-be-operated-independent 4y-ef the essent4+1 mult4plexing system. This feature is an important factor in reducing the chances of the plant going to core damage since this design should reduce the chance of a common cause failure disabling all ECCS pumps. [ITAACf l}f_f)_. (2)... The HPCF pumps will be able to pump water a's hot asil71.*C (340 ~~ Three ECCS Trains Three-E{4S-Tre4*s-{4TAAC-&Three-ECES-Trains [ITAAC 2.4.2, ITAAC 2.4.?] The barrier between each of the three safety divisions in the ABWR is at a minimum a 3 hour fire barrier that also resists internal flood pressures. This design assumption significantly reduces the chance of an internal flood or fire propagating and causing core damage. _ [lTAAC~;] Ploing' Upgrades to Prevent ISLOCAs-In SECY 93'-087_ it was recommended thatTALWR desig~efs"reduceithe josibility n of a loss of_ coolant: accident outside of containment.by_ confirming 1that?all systems l(to the extent practical) and" subsystems connected toLthe reactor coolant system (RCS);can withstand full;RCS;pgessure;' " "~ "~ E4pi_ng-Vfgr_ades-to4revent--4614C4s 4n-SEC+-93487-4 t-was-rece =caded-that-AlWR-des 4 eers-reduce-the-poss4b4Mt-y 9 o f-a -4 es s -o f-cool an t-eu4 dent-ou te4de-of-con t ainmen t-by-des 4gn ing-el4-systems tio-t he-e x tent-proct 4c a13-and-sebsystems-cenneeted-to-the-reaeter-coolent-sys tem-{RC S)-to-wi thstend-ful4-RG S-presser +r Intersystem LOCAs are a concern because many releases associated with them are not contained, held up, or i

scrubbed, but rather are released directly to the environment.. BE h'as assured ~ thatthe,)interfacinglsystemsltothe_RCSjca(withstand lful1JCSLpressure. [ITAAC1f Lgfof"Retiriulation"Pioina" CE-has-modif4ed-the-d ign cf-inteefec4ng-systems-to-the-RC44e-upgradc the piping-te-withstand-full RCS pressure. t-aek-of-Rec 4eculat4en44einc [ITffC 2.1.3] There are no large pipes (i.e., > 2 inches in diameter) that penetrate the ABWR vessel below the level of the core. This has virtually eliminated LOCAs as a severe accident concern for the ABWR.(( Tier R SSAR;Sectionj

)

Electricalli0 riven ~C6ntrol' Rod Insertioni E4 ectr 4ea44 v4r4ven4entrol-Rod-Imer4++n In many BWR PRAs, ATWS is a significant contriFutor to core damage frequency and risk. The diversity (electrically driven) of the fine motion control rod system is importarft in lowering the estimated core damage frequency for ATWS ~ events for the ABWR. l[ITAAC

]

Electrical Wirina Penetrations Elettr4cel-Wicino-Penetrat ions PTAAC 2.12.10] Wiring penetrations between divisions should be rated as three hour fire barriers and should be capable of preventing water / oil from an internal flood from migrating to another division. [ITAAC. ] DC Powg Sucoly ( DC-Power-Sueely--{-ITAAC-2ded23 The ABWR PRA expects that loss of all de power will lead to core damage.' The ACIWA system is a very important'(for severe accidents)1 low pressure? system, and ADS,---The-AC-IWA-system-is-a-Icw pressoresystem-and-ABSf which is needed for reactor depressurization, requires de power to operate. ZIn;the ABWR design, failure of the' batterles:during LaTlargs ssismic event. will' prevent'~ the diesel generators from starting and loadingC: Batteries'are the only.~non-building SSC that could,-ThMBWR4RA-assumes-that-faiWre4f-the-bat 4ee4es wiR-not-prevent-the^4fesel-generator +4 rem-start 4ng-and-leading, even-fe4he event-of-an-earthquaker THE40t10 WING 4 EXT-WAS MOVED by themselves, decrease the HCLPF of any accident sequence below 0.5g.'69r This would occur if the HCLPF of the batteries were to fall below 0.5g.6 : 9 THE-PREGEDING4 EXT-WAS MOVED The dc power supply should be well anchored and carefully designed to handle

a design bases 0.39 earthquake. The ABWR PRA-based seismic margins analysis assumed that the HCLPF of the de power system (batteries and inverter) is 1.1 [ COL 2 Action' Item".']ib. If-it i: untrue-that-the EDC: can-stert end load "9 without-batter 4es,' then the4atter400 cre the-enly-sen4ui444eg SSC thct cou14r The emergency batteries provide an important backup to the inverters for providing DC power. For this to be assured, the seismic failure modes of the inverters and their AC supply must not allow an electrical fault to be propagated to the DC busses. The reverse case is also true (the inverters provide backup should the batteries fail). For this to be assured,fthe seismic failure modes of the' batteries 1ust'not allof an"electricalffault"to f be,propagatedf to the DC, busses.i[ITAACf f ~ ' ' ' ' ~ ~ ~ ~ ~ ' ' ^ ~ ~ 1afety System'toaitlnd Control". -the-diesels-eust-be-eble4e-ster 4-end-load-without DC power from-the ba t ter4es-and-the-se4sm k-fe44ere-eedes-of-the4att e r i c : must-net cllow on electr4tel-fau14-to be propagated-te-the DC bus:cs. Safety 4ystem4eq4c-and Cont +el There are four divisions of self-tested safety system logic and control (SSLC) instrumentation (two-out-of-four logic). The ABWR PRA assumes that this will be a highly reliable configuration to actuate ESF core cooling and heat removal system as well as actuating the CRD scram system for defense against ~ ATWS events. Assumptions about SSLC reliability and redundancy in the PRA substantiallyreducetheestimatedcoredamagefrequency.?[ COL?ActionTItemto be added to DRAP) Off-line testing for faults' not detected by the' continuous self-test festure ~ were judged to be important in the PRA analysis'[ COL Action Item to be included in RAP).-4ff-44ne-test 4ng-fer-feults-net-detec4ed4y-the-eent4euses self-tes t--feature-were-fudged-te-be-ieportant-4e-the-PRA-analys4s r Fire Truck The ACIWA makes use of a fire truck connection to provide water if the motor and diesel-driven pumps are unavailable. Th's PRA asismes the" reliability of the fire trucklis 0.997 ;[ COL; Action; Item to include fire truck l reliability in DRAP] P_eactoF Preiiure Vessel ilsolation~3n~ lbW Wate?TiVelf -The-PRA-assumes-the-evere14-rel4abi44ty-of-the-f4re-tr-uck-is-Od9, even in seismic-event:. This-wsuid ccm to imply-that-the-f4re-truck-wsu14-bc on;ite and-heused-in-e4u ild ing -th a t-wsu14-a44ew-trocle-spers t4en-fo14 ewing-a-se4sm4e eventr i Reactor-Pressure-Vessel-4selet4en-en-1-ow-Water level The ABWR shutdown reliability study indicated that the isolation of lines connected to the RPV on a low water level signal in modes 3, 4, and 5 prevents uncovering of the fuel for many potential RPV drain down events.{[lTAAC" L] O_perator' Check"That Vatertlaht' Doors Abe Dogaed'

The 'internar flooding ~ analysi' ras 5umes~ that Tall 1 watertight' doorsTare" closed s ind. dogged to prevent; floods'from propagating from'one area to.another.. The watertight doors"are alarmed to' alert the control? room operator thatta'~" watertight doortis open,(but willinotf alarmLto indicate ~ thatla door lisinot dogged. To guard'against"a door being leftLundogged,1 operators should check thedoorseveryshifttoassurethattheyareclosedanddogged.;[COLAction J, tem ,] iuppression Pool BYDass The suppression pool is an important containment feature for severe accident progression and fission product removal, since releases from the reactor vessel are either directly routed to the pool (e.g., transients with actuation of ADS) or pass through the pool via the drywell-wetwell connecting vents. However, the suppression pool function can be compromised in the ABWR design in the following ways: a single failure of a wetwell/drywell vacuum breaker (i.e., a stuck open = i vacuum breaker), or by excessive leakage of one or more vacuum breakers unisolated main steam line breaks rupture of the SRV discharge line(s) in the wetwell air space a inadvertent' opening and failure to close sample lines, drywell purge ~ lines, and containment inerting lines unisolated LOCAs in the reactor water cleanup and RCIC systems The following are _ important to assuring"a ' low riskL fromjetwell/drywell vacuum breaker bypass, as modelled in the PRA and aret to' be-included in DRAP:%e ~ following-are-c+itical-to-a ssur4 n<pa-low-cisk-from-wetwel4fd rywe14-vseuem breakec4ypass,-as-codelled--in-the PPA: i 1. a low probability of vacuum breaker leakage (PRA assumes a leakage probability of 0.18 per demand on system) 2. a low probability that the vacuum breakers fail to close (PRA assumes a failure to close probability of about 0.0005 per demand per valve) 3. a high availability of drywell or wetwell sprays (and ACIWA as a backup) to condense steam which bypasses the suppression pool. 4. a position indication switch on each vacuum breaker valve that will indicate the valve to be open should the gap between the disk and seating surface exceed 0.9 cm. (A gap less than 0.9 cm is necessary to assure credit for aerosol plugging taken in the GE analysis.) [ITAAC ]

5. ' placement and ' shielding'of theJaEuum breakers such'thsQool? swell associated with' COPS actuation will'not impactsoperationiof the? valves.

[lTAAC

]

~ ^ In addition, ~ it is'important;to assure"that7thelacuum break'sFs?ars7 losed. c To achieve this control room alarms will be installed'to' indicate if all the vacuum breakers-are closed.) '"~ 5. pcModit-donf4reat4on4y-the operators-eat-a14-vacuum 4reak. c40sedr (This reduces the potential for suppression pool bypass by assuring that the plant is not operated with a stuck open vacuum breaker, and.that pre-existing leakage paths will be limited to small flow areas.); (ITAACj []_ The following' are' impo'rtant to"assurini i"1oif riikTfrom"unisolated 16aliFsteam

line'breaksi-} 6. placement-and-sh4e144ng-of-the-vacuum 4reakers such-that-pocl well assoc 4sted-with40PS-actuat4en-wi44-net-4epact operet4en-of-the-valves--- ThedeHowing-are-ce4t4 cal-to-assuring-a-4ew-ehk-from-eniseleted-ma4e stc= 14ee4reaks+ 1 1. twoair-operated,springclose,Liailedclbsbd;isolationvalveslineach line [ITAAC'. ~). 2.: ' automatic MSIV actuation by redundint?solenoidslthrotigh~tsof6ut36f-four logic,;[ITAAC: j]; j l The followinfirb~important; to^assuririgTibfHskTfrom rUpturb"of?the SRV discharge lines,-faHed-e4esed-4selet4en-iialss24n4ach44ee ~~~ ~ 2. iu toma t4 c44E4 V-ec4 eat 4en4y-redundant-selene 4ds-through-two-eut-of-four log 4e 3. baekup-4 sele t4en-espabi44ty-free-the-turblee4ypas : vclvc The-feHowing-are-cr444 eel to cssur4ng-e4ew-r4sk-from-repter+-ef-the SRV discharge 44ees-particularly in seismic events: 1. discharge itnes are designed and fabricated.to. Quality Group;C requirements [ITAAC- ). d4scharge-44nes-are-designed-and4abr4eated-tc Oucli41-6rcup C requirement: 2. welds in the airspace region of the wetwell are non-d_estructively examinedtotherequirementsofASMESectionIII,; Class 2[lTAACf] -Gass-2 3. discharge lines are capable of accommodating seismic events at an acceleration level of 0.6g with a high confidence tha~t there is a low probability of failure (11CLPF) [ COL Action' Item to add to DRAP). The following is important to assuring a low risk from suppression' pool via i the sampie,6 -with-a44 h-cenf4dence-that-thcre is-a4ew-probabi1ity cf 9 9 fe44ure-{HC+PF} The-feHowing-4s-crit 4ce4-to-assuring-a4ew-ehk-from-suppression pool vic the sample-drywell purge, and containment inerting lines: 1. lines will be sealed closed _ du~ ring' power operation,.and under i administrative control..'[ COL Action. Item.;] ' The following are important to aisuringTTow risk"from LOCAsToutside [ ~ ~ containment: 14 nes-wH4-be-locked-c4esed4ur4ng-powe ri-eperet4 en, -and-ender administrat4ve-eenteel The-feHewing-ere-cr414 eel-to-essur4n94ew-cisk-from-1.OCAs-eutside containment + 1. redundant and seismically-qualified CyW system isolation valves, hualified to close'under p,ostulated break conditions: ITAAC J] 2.'~ ? blowout: panels ~in;the~RCIC and RWCU divisional 1 areas w[hich prevent overpressurization:and'irrphets on equipmente in: adjacent ~ areas land other divisions '[ITAAC T^ --quaHI4ed-to-c4ese-under-pesteleted4reak-eendit4 ens 2. blowout-panels-in-the4C4 C-a nd 4WC&d iv4 s ional-a rea s-which-preveet overpressur4zet4en-and-4epacts on equipment-in-adjacent-areas-and-etAee i i i

.d4v4e4+ns 3. reliable seating of redundant feedwater, SLC,fand ECCSidischargefcheck valvesi[ITAAC ] [ COL Action Item to~ add to.DRAP) -end-ECGS-dtocharge-< hec 4 Valvcs lower Drywell Desian The design of the ABWR lower drywell/ reactor cavity is such that there is a low probability that the cavity will be flooded at the time of reactor vessel failure, but a high probability that the cavity will be flooded subsequent to vessel failure. A dry cavity at the time of vessel failure reduces the potential for large ex-vessel steam explosions, whereas the subsequent flooding of the cavity helps minimize the impact of core concrete interactions. The following ABWR design features are important to assuring a dry cavity at tha time of vessel failure: 1. lack of any direct pathways by which water from the upper drywell (e.g., from drywell sprays) can drain to the lower drywell, other than by overflow of the suppression pool,i[ITAAC" ?] Tnegligible" prob' bility of3remature"or: spurious actusti6EofCthe passive 2. a flooder valves' at temperatures less thant500 F or under; differential pressures associated with reactor: blowdown andipool hydrodynamic? loads RAP), and,!on;flooder configuration);{ COL ActioniItem to beladded to [ITAAC: 3. a capability to accommodate approxir.iately'2.0 E+6"kg of water in the t suppression pool before the pool overflows linto the lower drywell. [ configuration;1TAAC; ); ' h. negl4 4ble-probabi444y-ef-premature or spurious-aeteat4en-of-thc passivc 9 (4 eeder-v alves-e t-tempera tures-less-than4004-er-under-44fferent4e4-pressures-enoc 4a ted-with-reac4er-blewdown-and-peel--hydrodynamic--leads r end-3.

-tepabi44ty-to-accommodate-approx 4mately-4300-eub4e-meters-ef-water-4e the-suppren4en-pool-before the pool 0ver44ews-4nte-the4 ewer-dr-ywel1.

The following features are important to assuring reactor pedestal and containment integrity for beyond 24 hours following reactor vessel failure, and to rendering CCI-induced containment fai_ lure a relatively insignificant contributor to risk.f(configuration;ITAACJ !] 4. a 1.7m thick reactor pedestal capable of withstanding approximately 1.55m off erosionifrom CCIJithoutjosslofisttuctuial integrityj[ITAAC c .h 55m,e f-cros4endrem-CC4-without4es s-of-structu ral-4ntegef ty ;-- 5. the use of basaltic concrete in the floor of the lower drywell, which minimizes the pfoduction!bfjonMondensible3ssesi[ITAACN9; [" ' "' 6; f assump shield;to preventicoreidebrlsifgom e.ntgrjng;the; lower;dfijell sump-[ITAACI],and

7. ' ' the 1ower drywell' floodePijitirii[!TAACIJ Whkh-minimizes 2the-produet4en4f-con 2condensible-g:ses, and---

6. -a-sump-shield-te-prevent-tere-debr4s-from-enter 4 ray-the-4 ewer-dr-yweM sump. 7. the-lower-d rywel441eeder-systeer

Note: The lower drywell flooder system in the ABWR provides a passive means -of adding water to the lower drywell following reactor vessel breach. This water would cover the core debris, thereby enhancing debris coolability, cooling the drywell, and providing fission product scrubbing. The passive flooder system is a backu the ABWR, including:"(1)lp to other means of lower drywell water addition inc6n : Vessel!and (2)' suppression" pool. overflow as'airesultiof Water addition from kater? sources outside containment.2tl-}2cint4fsd^4stiQiti;cithEE5gh"ihe i breached-reacter" vb:scl, '(2) ~'idpprc::ica pocl overflow c: o rc: ult of w:ter addit 4en drom-water :curce: cut +44e-containment, and (3) ingrc:: of supprc:sica pool-watee-efter-the-core debri: ho; penet-eated the wetwell drywe14-connect 4ng vents. PRA-based sensitivity studies indicate that the t incremental risk reduction offered by the passive flooder is system is minimal. This is because of credit taken in the ABWR for continued water addition using the ACIWA mode of RHR. Containment *.'ltimate Pressure Capacity i The ultimate pressure capacity of the ABWR containment is limited by the i drywell head, whose failure mode is plastic yield of the torispherical dome. Subsequent to the original SSAR submittal,?GE? increased 2the11timate~ pressure capability of the drywellThead from?100lpsig~to.134ipsig,-GE-4eerea:cd'the' i pressers-capabl44ty'-e(2the-drysblT Ecad-fiee 100';ssigTte-1-34 p;ig, and i increased the COPS setpoint from the original value of 80 psig to the final value of 90 psig. The strengthening of the drywell head increases the ability of the containment to withstand rapid pressurization events, such as direct 4 containment heating, without loss of structural integrity, and provides { additional margin between the COPS setpoint and the drywell failure pressure, thereby reducing the potential for.drywell failure prior to COPS actuation.J Th_edrywellihead:isthejlimiting. component;in!thecontainment~ pressure boundaryLduring slow overpressure eventsp )[Tierj2dSSAR/Sectiong)" t Containinent'Overoressur6 Protection'Systim'(COPSC i i Centainment-Overecessur+-Protection Sv: tem ' COPS) [ITAAC 2.10.5]. COPS is part of the atmospheric control system in the ABWR, and consists of a pair of rupture disks installed in a 10-inch diameter line which connects the wetwell airspace to the stack. COPS provides for a scrubbed release path in i the event that containment pressure cannot be maintained below the structural limit of the containment. Without this system, late containment overpressure j failures would be expected to occur in the drywell, resulting in unscrubbed i releases. COPS provides a significant benefit by reducing the source terms for l late releases, and minimizin loss of core cooling (e.g., g the potential for containment-failure-induced i in C1. ass II sequences). The following are important features of the system, as modelled in the PRA: l# 70pt6re^disiCactnationisti90Qiljg'f 5%Hj ~^~ ~ i 2I % pts +2di4k-aMist4eEit%sig 7,j]Y '[TieF2F~SSARISEtfdhTU] ~~^^~~ 2. =inimum44ew-area-(efter-actuat4cn) equivalent-to-8"-diametee l 3r piping (and disk) designed to flow steam at a rate equivalent to 2% reactorpower,Tand'acco#viodstTp~iakl~resiUFET16adsTissoeisted~with & y;.syst'em?ictuation9 [ITAAC M ]~ d ijlat16n[{iljs M ient jith j [ Tie E 2 ^ "'~' normally7 closed,or;automatj k i

i i SSAR Section ~ ?] 4.'-4nd-acc+mmodate-peak-presserc 1 cds essee4ated-wi44-system-ec4+at4en 4-- no norma 14y-e4esed-or-aut+ mat 4e-4solat4en-valves in vent-path G-two normally-open, fail-open isolation valves in the vent path, manually operated from the control room,[wjthlkeyslocklswit'ches1[ Tier 2,jsSAR 5.1~ 'pressureJTier2,;SSARSection;; []. ' " pa ity of related?ls61ationNalVes?to7close[againstlfulDi6t i ~ " ' ~ ' " ~ ~ ^ ~ Containment ~Ineitiho Systeini. i ~ Because the ABWR containmentiwill?bs iherted'duEingTpowe.F..operafton;[ITAAC ;], _~ ~ 5. cepabi44ty-of-related isciat4en-velves to-elese-against-fell vent pressurc-Conteinment-4*er4 ina *vst+m-Because-the-ABWRH: ente 4nmast-wi44-be-inerted-4ur4eg-power-oper-at4ew hydrogen combustion is not considered to be an important containment challenge, and was not modelled in tWe PRA. To assure the validity of this'treatmentT strict' controls.must belpisced on the period ~ of. time that the' reactor can.be operated with the containment'de-l inerted [ Technical Specifications - ].--T4-assureithe-v a44444y-of-th4e i treetwent Mir4et-centeels-must-be-placed-en-the-per4ed-ef-t4me-that-the reac4er-cen-be-operated-with-the conteinment-de--inerted-Direct Containment Heatino (DCH) DCH is the only severe accident phenomena that represents a significant challenge to containment integrity (5% probability of containment failure given reactor vessel failure at high pressure). The impact of DCH is " controlled" in ABWR by reducing the frequency of high pressure reactor vessel failure using ADS (30% of vessel failures). The following aspects of ADS should be assured by ITAAC and RAP: reliability / availability consistent with' Level l1 PRAfassumptions [DRAP), 1. f 2. no dependency on ac-power (ITAAC1. ], 3. availability of' sufficient.DC power; tolact6ats; ADS'in %1oniterm station blackout 2,SSARSection:jfollowingloss'of'RCICduelto.lbatterydepletion)j[ Tier s][ COLLAction1to add L to DRAP ~~"~~^~~~~~ ~' re14sb444ty/availab444tyens4 stent-with Evel]~1 PRA-assumpt4 ens 2. ne dependency on oc perter 3. cve44ab444ty-of-se44c4ent-OG-power-to-acteate in a-leng-tere-stet 4en bl ackout-f fe44 ewing-loss-of-RC4C-due-to-ba ttery-deplet4ent There are no specific ABWR containment design feature to deal with DCH loads other than the general arrangement of the drywell and wetwell, and connecting vents, which provide for a series of 90-degree bends that debris must traverse in order to reach the upper drywell.((c6nfjguFation ITAAC) Impoftht' Human ActionY

i 4mryent-Human-AcMens Human actions with high risk impact for the ABWR were identified based on the PRA and supporting analyses. Section 19D.7 of the SSAR includes a listing of these actions, classified into three categories corresponding to the COL-actions necessary to assure the validity of the PRA treatment of the action: (1) critical tasks, (2) maintenance items, and (3) COL procedures and planning. 1. The items identified as " critical tasks" in 19D.7, as well as actions to recover emergency diesels, have the greatest impact on core damage frequency and risk for the ABWR. Accordingly: these actions are to be addressed by the COL-applicant as part of the detailed design of human-system interfaces the following will be provided for each action:

1. clear unambiguous indication of conditions requiring the action

2. the operator must have the capability to perform the action in a straight forward manner

3. the operator must have clear written operating procedures regarding the actions to be taken

4. the7 operator must have thorough training in the conditions requiring the action.

[ COL Action" Item'j] 2. The probability of miscalibrating single and multiple sensors was assigned very low values on the basis that the COL-applicant would incorporate a special procedure governing calibration activities. At a minimum, the COL-applicants maintenance procedures for sensor i calibration should require that whenever a sensor is found to be out-of-i tolerance, before the sensor is recalibrated, the calibration instrument is first checked or an alternate instrument is used to confirm the condition. [COLLAction(Item ] 3. For items identified as " COL Procedures and Planning" items, the COL-applicant is to develop procedures to assure that these actions can be effectively implemented.' L[ COL Action (Item! [] Importance/ Uncertainty Analyses Examination of the top ten events contributing to uncertainties in the estimate of the ABWR core damage frequency (CDF) revealed that nine of these events were identified by importance analyses as leading contributors to CDF. The highest contributor to uncertainties in the CDF as well as the CDF estimate was RCIC test and maintenance. The remaining top contributors to uncertainties (andCDF)arelistedinSSARTable19D.10-5.T(( COL' Action? Item to add,to,0 RAP)-These-4tems-const4tute-en-4eportant-considerst4enW PJf. - 1 -}}