ML20071L478
Text
r 1
i
- 'p* CE%
o UNITED STATES n
~'
NUCLEAR REGULATORY COMMISSION
- E W ASHINGTON, D.C. 20555 l
\\
/
I August 7, 1989 OFFICE OF THE SECRETARY MEMORANDUM FCR:
Chairman Carr Commissioner Roberts Commissioner Rogers. /
Commissioner Curtiss ddI FROM:
gamuel J. Chilk, Secretary
SUBJECT:
SECY-89-228 - DRAFT SAFETY EVALUATION REPORT ON CHAPTER 5 OF THE ADVANCED LIGHT WATER REACTOR REQUIREMENTS DOCUMENT Per the request of Commissioner Curtiss, we have converted l
SECY-89-228 from Negative Consent to a Notation paper.
Attached i
for your use are Notation Vote Sheets for the paper.
Please respond to SECY by c.o.b. Tuesday. Auaust 15, 1989.
Attachment:
As stated l
Cc:
l tY>
LD
's 5
M w
a i
m
~
Q 2
i~-
eo i
l 9
I G
i I
i l
1 1
9400030121 940629 PDR CDP 9F3 NRCC CORRESPONDENCE PDR
Note to:
Commissioner Curtiss From:
K.
A.
Connaughton
Subject:
" Draft Safety Evaluation Report on Chapter 5 of the Advanced Light Water Reactor Requirements Document" Comments Section 2.1 - ALWR Public Safety Goal 0
The 25 rem 0.5 mile public safety goal is to encompass events
-6 whose " cumulative frequency" exceeds 1 x 10 per reactor year.
The staff's determination with respect to consistency with the NRC Safety Goal Policy large release guideline is on hold pendir.ig clarification of the term " cumulative frequency."
)
i More precisely, what is at issue is how to determine the events with a " cumulative frequency"of greater than 1 x 10-6,
As a practical matter it would seem necessary to define a lower limit of individual event frequency below which events need not be considered.
O The staff intends to require traditional design basis accident analysis to demonstrate conformance with 10 CFR Part 100 dose guidelines. Nothing in this section of the draft SER (or Part 100, for that matter) forecloses the staff's acceptance of more realistic, deterministic source term assumptions than the TID-14844 assumptions (see Appendix C, Section C.2 for a more detailed discussion on the source term optimization subject).
i 0
The staff's discussion concerning balancing prevention and mitigation (in particular, requirements for robust containment, irrespective of the level of prevention achieved) is consistent with past regulatory practice for existing LWRs.
j Given the similarity of the evolutionary LWRs to existing plants, this approach seems reasonable.
O The staff's proposed conditional containment failure probability of 0.1 weighted over credible core-damage i
sequences needs to be refined to stand up to the criticism from EPRI.
Specifically, " credible" in this context needs definition.
Also, reductions in event frequency through enhanced prevention should not result in a conditional containment failure probability penalty.
0 The stuff apparently acknowledges the CCFP concept's shortcommings.
The staff invites alternative containment performance criteria to specify an adequate level of severe accident mitigation capability.
O F The staff specifies both short and long term containment
\\
challenges and respective performance guidelines.
Regarding the long term challenges, the staff is willing to accept either diverse containment heat removal capabilities or controlled venting.
Arguably, the use of venting is a policy issue that the Commission should decide.
Section 2.2 - Station Blackout 0
The Blackout rule will be applied consistent with existing plants.
The staff would be on tenuous ground, however, if it required of a given applicant, that the investment protection blackout criteria be applied and analyses performed to comply with the Requirements Document.
Section 2.3 - Zirconium-Water Reaction and Hydrocen Control 0
No comment, only a question.
Has EPRI provided all they have in support of their position?
h h 4I2 kt
[ LM 5-d(
16 0 t
t u ou W - n cor.
,E P C - 13%
w.
1 Secticn 2.4 - Decay heat calculations (ANS 5.11 O
No comment.
l Section 2.5 - Fire Protection i
0 Watch out!
The staff feels that current NRC " guidance" needs to be enhanced.
Does the staff believe that this guidance should be codified?
E $ - (M h
6 tm/
b((
S vMW tushn(
q 9
% g. 8
\\
l
e Section 2.6 - Severe Accident Analysis 0
No Comment i
l l
l i
fjyg Qh 1.
Significance of Requirements Document o
Will establish licensing requirements Subsequent review of future reactor designs wil o
be limited to determining that the requirements in the RD have been appropriately translated into the design.
will the RD be complete before o
Schedule final SERs on individual designs, so that decisions made in the context of the RD can be i
incorporated in those individual designs?
What remains to be done to 2.
Major Policy Issues resolve:
gh due >
o Source term
-W
~
o Hydrogen Do we have everything from EPRI on gj e the hydrogen issue -- or are we g
_ [g)k CLg d waiting for further justification?
i I
(Detonability limits -- NRC 10%;
EPRI - 13%; Clad oxidation - NRC -
g4 N N.
100%; EPRI - 75% max) bg o
Venting ft[b For the long-term containment challenges, the staff proposes
/
accepting either diverse containment
- h u.)Dugg heat removal capabilities or controlled venting.
N i
Y fbO
~~~
On venting, EPRI argues that we should take on the containment issue kg$M d
directly and ensure that e
containments are strong enough to y
p00(
survive severe accidents (note conflict with point below).
M9 i
M6At 4
o Fire Protection l
Staff feels that curent " guidance" h(
needs to b enhanced.
Should this I
e, M 40 1
guidance be codified?
(EPRI wants to follow existing App. R guidance).
L CX LM $
i i
- 3. Containment Performance Objective
(
&Ad d
o DSER on Chapter 5 proposes to break out containment performance as a separate objective N
f
-- and to require, either deterministically or
\\ { Y, )
y h
d.
through a
conditional containment failure a [f6d d b l b cf {4) criterion, that future designs meet this h
A.
How does this square with the safety Clt04bt M( {
[6[t( 0 g cr #_
objective.
goal, where the staff rejected this g
g
/@A t
approach?
B.
This criterion led to venting hh D
g 4
(Murley, at integration meeting).
]'
+
C.
Essentially means, if adopted for all h k6i)%
D h&st kpg. % Al' Lk m d b60le g
i I
future reactors, that containments will be required.
4.
Optimization Issues o
If the approach in.the Requirements Document 1
l-differs from what is required in the
~
regulations, how do you intend to proceed --
will the regulations, at some
- point, be l
i amended?
j f
l 5.
Other issues -- risk-based technical specifications 6.
When should Commissioners raise concerns / comments about the approach being taken?
i l
i j
l
)
l f
l l
l
m m mmmm--mrmrF T
f...ug' k....f.A July 28, 1989 pQ{l{yl$$y{
m W-89-228 i
For:
The Commi(ssionersNEGATIVE CONSENT) from:
James M. Taylor, Acting Executive Director for Operations
Subject:
DRAFT SAFETY EVALUATION REPORT ON CHAPTER 5 0F THE ADVANCED LIGHT WATER REACTOR REQUIREMENTS DOCUMENT
Purpose:
To inform the Commission of the staff's plans for issuing the draft safety evaluation report (SER) on Chapter 5 of the Advanced Light Water Reactor (ALWR)
Requirements Document.
Discussion:
The Electric Power Research Institute (EPRI), in conjunction with the utility-sponsored ALWR Steering Comittee, is preparing a compendium of technical requirements applicable to the design of an ALWR plant referred to as the ALWR Requirements Document. When completed, this document will be a comprehensive statement of utility requirements for the design, construction, and performance of an ALWR power plant for the 1990s and beyond.
The Requirements Document will consist of three parts:
Part I, the Executive Summary, will be a management-level synopsis of the Requirements Document, including the design objectives and philosophy, the overall physical configuration and features of a future nuclear plant design, and the steps necessary to take the proposed ALWR design criteria beyond the conceptual design state to a completed, function-ing power plant. Part II will consist of 13 chapters and will contain utility design requirements for an evolutionary CONTACT:
T. Kenyon, NRR/PDSNP 492-1103 fO3"
-ssssssssss----r-s
The Commissioners nuclear power plant (approximately 1350 MWe). Part III will contain utility design requirements for nuclear plants that utilize passive features in their designs (approximately 300-600 MWel.
The staff is preparing draft SERs to discuss the results of its review of the Requirements Document on a chapter-by-chapter basis. When EPRI has submitted all three parts in its final document, the staff will issue a final SER to provide its final conclusions on the Requirements Document.
Attached is the draft SER in which the staff provides the status of its review of Chapter 5 of the Requirements Document. Chapter 5 discusses engineered safety systems.
Key issues covered in the review include:
public health and safety goal severe-accident prevention and mitigation severe-accident containment performance criteria hydrogen generation and control source-term issues anticipated transients without scram high/ low pressure interface design operation of residual heat removal system with reduced reactor coolant system inventory equipment survivability during a severe accident
- station blackout fire protection The staff plans to forward this draft SER to the ALWR Steering Corrmittee, EPRI, and the ACRS in order to provide the status of the review and to delineate the open issues remaining in regard to Chapter 5.
The positions in this draft SER reflect the staff's current thinking on these issues. After additional interactions with the ALWR Steering Committee and EPRI, the staff intends to issue dnother draft SER on Chapter 5, in which it will discuss the resolution of the issues.
Recommendations:
That the Commission 1.
Note the staff's plans to issue the draf t SER on Chapter 5 of the ALWR Requirements Document provided in the enclosure.
l I
l 1
i The Commissioners l i
2.
Note that the staff intends to issue the draft SER ana place it in the Public Document Room within 10 working days of the date of this paper unless j
otherwise instructed by the Commission.
3.
Note that the staff is scheduled to brief the Commission on the status of its review of the EPRI 4
ALWR Requirements Document on August 1, 1989.
/
k___~f i
l mes M. Tay1 Acting Executive Director for Operations
Enclosure:
Draft SER on Chapter 5 of the ALWR Requirements Document i
j SECY NOTE:
In the absence of instructions to the contrary, SECY will notify the staff on August 15, 1989 that the Commission, by negative consent, assents to the action proposed in this paper.
DISTRIBUTION:
Commissioners OGC IG GPA REGIONS EDO ACRS ASLBP ASLAP SECY
T' l
DRAFT SAFETY EVALUATION REPORT ON CHAPTER 5 0F THE ADVANCED LIGHT WATER REACTOR REQUIREMENTS DOCUMENT prepared by the Office of Nuclear Reactor Regulation j
U.S. Nuclear Regulatory Commission i
July 1989 l
."l
.g ABSTRACT The Electric Power Research Institute (EPRI) is preparing a ctependium of technical requirements applicable to the design of an advanced light water reactor (ALWR) power plant referred to as the ALWR Utility Requirements Document. When completed, this document is intended to be a comprehensive statement of utility requirements for design, construction, and performance of an ALWR power plant for the 1990s and beyond.
The Requirements Document will consist of three parts: Part I, The Executive Summary is a management-level synopsis of the Requirements Document, including design objectives and philosophy, overall physical configuration and features of a future nuclear plant design, and the steps necessary to take the proposed ALWR design criteria beyond the conceptual design state to a completed, functioning power plant. Part II will consist of 13 chapters and will contain utility design requirements for an evolutionary nuclear power plart (approximately 1350 We). Part III will contain utility design requirements for nuclear plants that stilize passive features in their designs (approximately 300-600 MWe),
The U.S. Nuclear Regulatory Comission, Office of Nuclear Reactor Regulation, staff is preparing draft safety evaluation reports (DSERs) to discuss the results of its review of the Requirements Document on a chapter-by-chapter basis. When EPRI has submitted all three parts in their roll-up document, the staff will issue a final safety evaluation report (SER) to discuss its final conclusions regarding the Requirements Document.
In September 1987, the staff issued the first DSER in this series which addressed the Requirements Document Executive Summary and Chapter 1, "Overall Requirements," regarding the overall objectives and requirements of the ALWR program. Chapter 2, " Power Generation Systems," was evaluated in the second DSER which was issued in February 1988. The third DSER, issued in May 1988, covered Chapter 3, " Reactor Coolant System and Reactor Non-Safety Auxiliary EPRI Chapter 5 DSER 11 July 1989
I l
1
[
Systems." The fourth DSER, issued in June 1988, covered Chapter 4, " Reactor i
Systems."
This DSER discusses the staff's review of Chapter 5, " Engineered Safety Systens. " This chapter was prepared by Bechtel Power Corp., Combustion Engineering Inc., Commonwealth Edison Company, Duke Power Company, General Electric Company, MPR Associates, Inc., S. Levy Incorpcrated, Sargent and Lundy Engineers, Stone and Webster Engineering Corp., Westinghouse Electric Corp., and Yankee Atomic Electric Company under the project direction of the Electric Power Research Institute, Palo Alto, CA. and the ALWR Utility Steering Committee. The requirements apply to boiling water reactors and pressurized water reactors in sizes up to 1350 MWe.
4 l
l l
EPRI Chapter 5 DSER iii July 1989
l TABLE OF CONTENTS Pace ABSTRACT............................................................
11 1
INTRODUCTION AND GENERAL DISCUSSION............................
1-1 1.1 Scope and Structure of Chapter 5..........................
1-3 1.2 A LW R D e s i g n Ba s e s......................................... 1-4 1.3 Regulato ry Stabil iza tion.................................. 1-4 1.4 Outstanding Issues........................................
1-5 2
TOP-L EVEL REQ UI REMENTS COMMON TO BWRS AND PWRS................. 2-1 2.1 A LWR Pub l i c S af ety Go a l................................... 2-1 2.2 Station Blackout..........................................
2-6 2.3 Zirconium-Water Reaction and Hydrogen Generation..........
2-7 2.4 Decay Heat Calculations (ANS 5.1).........................
2-8 2.5 Fire Protection...........................................
2-9 2.6 Seve re Accident Analyses.................................. 2-10 3
ALWR CORE-DAMAGE-PREVENTION REQUIREMENTS.......................
3-1 3.1 Inservice Testing.........................................
3-1 3.2 blesel Generator Start Time...............................
3-2 3.3 Electric Valve Operators..................................
3-3 3.4 Anticipated Transients Without Scram......................
3-3 4
BWR CORE-DAMAGE-PREVENTION REQUIREMENTS........................
4-1 4.1 Elimination of Core Spray.................................
4-1 4.2 Anticipated Transients Without Scram......................
4-1 4.3 Standby Liqu id Control System............................. 4-2 4.4 Safety Classification of Containnent Spray System.........
4-3 4.5 S uppres s ion-Pool-Bypa s s Lea ka ge........................... 4-3 EPRI Chapter 5 DSER iv July 1989 q
c-L-
8 4
9 i
h N
/
9
[
L TABLE OF CONTENTS (Continued)
.P,ajLe 6.6.3 Containment Heat Removal...........................
6-14 6.6.4 Fis s ion P roduct Control............................ 6-14 6.6.5 RCS Depressu rization capabili ty.................... 6-15 6.6.6 Equ i psent Surv ivab ili ty............................ 6-16 6.6.7 Containment Mixing Provisions......................
6-17 6.6.8 Severe-Accident Management.........................
6-17 6.6.9 Externally Initiated Severe Accidents.............. 6-18 7
BWR MITIGATION / CONTAINMENT REQUIREMENTS........................
7-1 7.1 Introduction..............................................
7-1 7.2 Performance Requirements..................................
7-1 7.3 Equipment Design Requirements.............................
7-3 8
PWR MITIGATION / CONTAINMENT REQUIREMENTS........................
8-1 8.1 P ri ma ry Conta i nme n t....................................... 8-1
~
8.2 Containment Spray System..................................
8-3 8.3 Fission Product Removal and Control System................
8-5 9
CONCLUSION.....................................................
9-1 APPENDICES A
DEFINITIONS B
GENERIC SAFETY AND LICENSING ISSUE TOPIC PAPERS C
OPTIMIZATION SUBJECTS EPRI Chapter 5 DSER vi July 1989
1
,1 DRAFT SAFETY EVALUATION REPORT ADVANCED LIGHT WATER REACTOR REQUIREMENTS D9CUMENT CHAPTER 5, " ENGINEERED SAFETY SYSTEMS" 1 INTRODUCTION AND GENERAL DISCUSSION The Electric Power Research Institute (EPRI) is preparing a compendium r.1 technical requirements applicable to the design of an advanced light water c
reactor (ALWR) power plant referred to as the ALWR Utility Requirements Document. When completed, this document is intended to be a comprehensive statement of utility requirements for design, construction, and performance of an ALWR power plant for the 1990s and beyond.
x The Requirements Document will consist of three parts: Part I, The Executive Summary, is a management-level synopsis of the Requirements Document, including design objectives and philosophy, overall physical configuration and features of a future nuclear plant design, and the steps necessary to take the proposed ALWR design criteria beyond the conceptual design state to a completed, functioning power plant. Part II will consist of 13 chapters and
' will contain utility design requirements for an evolutionary nuclear power plant (approximately 1350 MWe). Part III will contain utility design requirements for nuclear plants which utilize passive features in their designs (approximately 300-600MWe).
The U.S. Nuclear Regulatory Commission, Office of Nuclear Reactor Regulation, staff is preparing draft safety evaluation reports (DSERs) to discuss the results of its review of the Requirements Document on a chapter-by-chapter basis. When EPRI has submitted all three parts in their roll-up document, the staff will issue a final SER to discuss its final conclusions regarding the Requirements Document. The staff is conducting its review of the Requirements Document as described in NUREG-1197 " Advanced Light Water Reactor Program."
As noted therein, the staff is using NUREG-0800, " Standard Review Plan" (SRP),
for review guidance.
In addition to the criteria of NUREG-0800, the staff's review reflects the requirements of 10 CFR Part 52, "Early Site Permits; Standard Design Certifications; and Combined Licenses for Nuclear Power EPRI Chapter 5 DSER 1-1 July 1989
\\
Reactors", and the Commission's " Policy Statement on Severe Reactor Accidents Regarding Future Designs and Existing Plants" (50 FR 32138).
In September 1987, the staff issued the first DSER in this series which addressed the Requirements Document Executive Summary and Chapter 1 "Overall Requirements," regarding the overall objectives and requirements of the ALWR program. Chapter 2, " Power Generation Systems," was evaluated in the second DSER which was issued in February 1988. The third DSER, issued in May 1988, covered Chapter 3, " Reactor Coolant System and Reactor Non-Safety Auxiliary Systems." The fourth DSER, issued in June 1988, covered Chapter 4, " Reactor Systems."
On December 8, 1987, the ALWR Utility Steering Committee (Steering Committee) submitted Chapter 5 of the Advanced Light Water Reactor Requirements Document (Requirements Document) entitled " Engineered Safety Systems" for staff review.
Additional information was submitted by letters dated August 16, 1988 and September 15, 1988. The chapter was prepared by 8echtel Power Corp.,
Combustion Engineering, Inc., Commonwealth Edison Company, Duke Power Company, General Electric Company, MPR Associates, Inc., S. Levy Incorporated, Sargent and Lundy Engineers, Stone and Webster Engineering Corp., Westinghouse Electric Corp., and Yankee Atomic Electric Company under the project direction
' of the Electric Power Research Institute, Palo Alto, CA and the ALWR Utility Steering Committee.
1 Key issues in the Chapter 5 review include:
public health and safety goal severe accident prevention and mitigation severe-accident containment performance criteria hydrogen generation and control source-term issues fire protection containment local leak rate test interval emergency power source start and load sequence time elimination of core spray for 8WRs EPRI Chapter 5 DSER 1-2 July 1989
i elimination of the standby liquid control system (SLCS) as a backup for ATWS PWR safety injection system design including the in-containment refueling water storage tank and direct vessel injection use of RHR and CS pump crossconnections as backups to allow maintenance during plant operation resolution of generic safety issues PWR high/ low-interface design The staff's evaluation of Chapter 5 of the Requirements Document is documented in Chapters 2-8 of this draft safety evaluation report (DSER). The format of this DSER follows that of Chapter 5 of the Requirements Document as closely as possible. Unless otherwise noted, references to sections of the Requirements Document are directed toward the Chapter 5 submittal.
Copies of this report are available for inspection at the NRC Public Document Room, 2120 L Street, N.W., Washington, D.C. 20555.
The NRC project manager for the staff's review of the ALWR Utility Require-ments Document is Thomas J. Kenyon. He may be contacted by calling (301)492-1103 or by writing to: Division of Reactor Projects - III, IV, V,
' and Special Projects, U.S. Nuclear Regulatory Commission, Washington, D.C.
20555.
1.1 Scope and Structure of Chapter 5 Chapter 5 of the Requirements Document defines the ALWR Utility Steering Committee's requirements for design of the engineered safety systems for advanced light water reactors (ALWRs).
Engineered safety systems are provided to prevent or mitigate the effects of a spectrum of postulated accidents.
Chapter 5 applies to evolutionary boiling-water reactors (BWRs) and pressurized-water reactors (PWRs)(approximately 1350 MWe).
In the near future, the ALWR Utility Steering Committee intends to submit parallel chapters of the ALWR Utility Requirements Document applicable to facilities using such innovative concepts as passive safety systems.
{
EPRI Chapter 5 DSER 1-3 July 1989
J 1.2 ALWR Design Bases The term "ALWR design bases" refers to the three sets of requirement that form the foundation for the ALWR design. The first set of requirements forms the " licensing design basis" which includes the requirements necessary to sat-isfy regulatory criteria. These requirements and associated analytical methods are based on conservative, NRC-approved methods, and equipment is designed to safety-grade standards. The second set is the " risk evaluation basis" which extends the licensing design basis to meet public safety objectives. The risk evaluation basis utilizes probabilistic risk assessment (PRA) methods. The third set of design bases is the " performance design basis" which is based on utility economic and investment protection considerations and employs realistic, designer-selected, best-estimate methodology. The licensing design basis is intended to provide an " adequate level of safety," whereas the risk evaluation and performance design bases provide additional or " enhanced protection."
1.3 Regulatory Stabilization Consistent with the overall ALWR program approach, as described in NUREG-1197, regulatory stabilization for the ALWR is to be achieved through identification and resolution of plant optimization subjects and generic safety and licensing issues.
Generic safety and licensing issue topic papers related to engineered safety systems are addressed in Appendix B of this report.
Plant optimization subjects presently do not meet regulatory requirements.
EPRI proposes to resolve these issues by providing technically supportable l
alternatives to current regulatory requirements. The ALWR optimization issues relating to engineered safety systems include:
source terms for design-basis accidents containment leak rate testing hydrogen control EPRI Chapter 5 DSER 1-4 July 1989
s Optimization subjects are discussed in Appendix C of this report.
1.4 Outstanding Issues As a result of the NRC review of the ALWR Utility Requirements Document, a number of items remain outstanding at the time of this report. Because it has either not completed its review and reached a final position or it has reached a conclusion different from EPRI in these areas, the staff considers these issues to be open. These issues fall into one of four categories: (1) issues that require satisfactory resolution before the staff can complete its review of Chapter 5 of the Requirements Document, (2) issues for which staff review of other related chapters of the Requirements Document has not yet been completed, (3) confirmatory issues for which the staff will ensure followup of comitments in the Requirements Documents, and (4) issues that require satisfactory resolution in support of a plant-specific application. The open items, with appropriate references to sections of this report given in parentheses, are listed below:
Issues To Be Resolved Before the Staff Can Complete Its Review of Chapter 5 (1) ALWR public safety goal (2.1)
(2) severe-accident containment performance criteria (2.1)
(3) metal-water reaction and hydrogen generation and control during a severe accident (2.3,6.5.1,B.8,C.3)
(4) automatic standby liquid control system (4.3)
(5) effective distribution of boron injection (4.3)
(6) safety classification of containment spray system (4.4, 7.2)
(7) suppression-pool-bypass leakage (4.5, 7.2)
(8) suppression-pooltemperature-monitoringsystem(4.6)
(9) operation of residual heat removal (RHR) system with reduced reactor coolant system inventory (Generic Letter 87-12) (5.2)
(10) safety depressurization and venting system (5.5, 6.6.5, B.10)
(11) use of remote manual valves on essential non-ESF lines (6.2)
(12) containment isolation provisions for IRWST connections (6.2)
(13) Type C leak testing (6.2)
(14) Type B testing of air-locks (6.3.2)
EPRI Chapter 5 DSER 1-5 July 1989
(15) Type C containment valve leak rate testing interval (6.3.3, C.1)
(16) interface requirements for fission product leakage control systems (6.4)
(17) control systems for radiolytically generated hydrogen (6.5.2, B.8, C.3)
(18) timing of igniter activation in the event of an accident (6.5.3, B.8, C.3)
(19) containment heat removal (6.6.3)
(20) functionability of fission product control systems during a severe accident (6.6.4)
(21) equipment survivability criteria for severe accidents (6.6.6)
(22) severe-accidentmanagement(6.6.8)
(23) dynamic effects of pipe breaks during severe accidents (7.2, 8.1))
(24) main steam isolation valve (MSIV) leakage rate (7.2)
(25) containment leak rate (8.1, 8.2, C.2.5)
(26) postaccidentpHcontrol(8.2,C.2.1)
(27) containment integrity check (B.2)
(28) PWR high/ low-pressure interface design (B.5)
(29) deletion of charcoal adsorbers (C.2.2)
(30) BWR suppression pool fission product scrubbing (C.2.3)
(31) timing of fission product releases into containment (C.2.4)
Issues To Be Addressed in Staff Review of Subsequent Requirements Document Chapters (1) stationblackout(2.2,B.9)
(2) fire protection (2.5)
(3) inservicetestingofvalves(3.1)
(4) anticipated transients without scram (3.4, 4.2)
(5) containmentloadingduringsevereaccidents(6.6.1)
(6) cavity / pedestal-drywell configuration, debris coolability (6.6.2)
(7) containment atmosphere mixing (6.6.7)
(8) externally initiated severe accidents (6.6.9)
(9) protection against BWR containment reverse pressurization (7.1)
(10) fission product leakage control system (7.1)
EPRI Chapter 5 DSER l-6 July 1989
Confirmatory Issues (1) Appendix J local leakage testing (3.1)
(2) low-temperature overpressure protection (LTOP)(5.2)
(3) automatic / manual initiation of feedwater flow (5.3)
(4) use of liquid in Type C containment leak rate testing (6.3.3)
(5) actuation of the containment spray system (8.2)
(6) low-temperature overpressure protection (B.10)
Plant-Specific Issues (1) stationblackout(2.2,B.9)
(2) diesel generator start times (3.2)
(3) elimination of BWR core spray (4.1)
(4) safety injection system (SIS) design pressure (5.4) l (5) radiolytically generated hydrogen control system (6.5.2) l (6) analysis of oxygen 9 2neration during a severe accident (6.5.3) j (7) suppression pool design (7.3) l l
(8) emergency feedwater system design analysis (B.4)
(9) high/ low-pressure interface design (B.5) l l
(10) pressureisolationvalvetesting(B.5)
J l
l l
l l
EPRI Chapter 5 DSER 1-7 July 1989
i 2 TOP-LEVEL REQUIREMENTS COMMON TO BWRS AND PWRS The design bases of the ALWR are intended to provide a balance between core protection and core-damage mitigation. The core-damage prevention functions include: (1) the core coolant inventory function, (2) the decay heat removal function, (3) the diverse reactivity function, and (4) the RCS pressure control function. The mitigation functions include: (1) the containment integrity function and (2) the fission product control function. The engineered safety systems, in conjunction with supporting systems described in other chapters of the Requirements Document, serve to provide these fun;tions.
Sections 2.1 through 2.4 of Chapter 5 of the Requirements Document define top-level requirements applicable to both the core damage prevention and mitigation features of BWRs and PWRs. The following is a discussion of the staff's review of the issues addressed in Section 2 of Chapter 5 of the Requirements Document.
2.1 ALWR Public Safety Goal Section 2.2.2 of Chapter 5 of the Requirements Document states:
The Engineered Safety Systems shall collectively (and in concert with the other features specified in the Requirements Document) permit the ALWR to meet or exceeo the safety goals specified in Chapter 1, Section 1.4.A, specifically:
Frequency of core damage t 1.0x10-5 event per reactor-year.
Whole-body dose at an assumed 0.5-m11e site boundary must be 1ess than 25 rem for events whose cumulative frequency exceeds 1.0x10-6 per reactor-year.
Both criteria shall be demonstrated by PRA.
The Steering Committee's basis for selecting 25 rem as the whole-body dose criterion is that this value is recognized as "a very low dose with no observable health effects." The Steering Committee's basis for the associated EPRI Chapter 5 DSER 2-1 July 1989
accident frequency is that 1.0x10-6 is " low enough to satisfy the utilities' desire for excellence and the public perception," and is analytically demonstrable.
The staff has evaluated these objectives in comparison with the Commission's safety goal policy, which was announced on August 4, 1986 (51 FR 23044). The Commission's safety goal proposed as qualitative goals that the operation of a j
j nuclear power plant should pose very low risks to nearby individuals and to l
society.
In addition, the following quantitative objectives were to be used in detr mining achievement of these goals:
l l
The risk to an average individual in the vicinity of a nuclear j
l l
power plant, of prompt fatalities from a reactor accident should not exceed 0.1 percent of the sum of prompt fatality risks from l
other accidents.
The risk to the population in the area near a nuclear power plant l
of cancer fatalities resulting from reactor operation should not exceed 0.1 percent of the sum of cancer fatality risks from all other causes.
No specific guidance with regard to core damage frequency is provided in the policy statement. However, as a possible guideline for regulatory implement-ation, the Commission further proposed to the staff that it consider that the L
"overall mean frequency of a large release of radioactivity to the environment from a reactor accident should be less than 1 in 1,000,000 per year of reactor operation." Before the staff can complete its evaluation to determine whether EPRI's second ALWR public safety criterion, given above, is consistent with this guideline, the term " cumulative frequency" regarding a large release needs to be clarified. Pending this clarification by EPRI and staff's sub-sequent evaluation, this issue remains open.
In addition to designing an ALWR to meet the given public safety goal, the designer will also be required to show that the facility meets the dose guidelines of 10 CFR Part 100 for the limiting design-basis accidents.
EPRI Chapter 5 DSER 2-2 July 1989
In a letter to the staff dated April 6,1988, the Chairman of the ALWR Utility Steering Comittee indicated that the ALWR public safety criteria do not contain explicit criteria for conditional probability of containment failure or other mitigation features since the Steering Committee believes that such criteria could potentially distort the balance in safety design and inhibit innovative improvements in core protection features. The letter cites the consistency of this position with the conclusions of the February 3,1988 NUMARC Containment Integrity Working Group Report.
The staff believes that a fundamental principle of safety, defense-in-depth, is based on the concept that multiple barriers should be provided to ensure the integrity of those barriers to prevent any significant release of radioactivity.
In its Severe Accident Policy Statement, the Commission indicated that it "... fully expects that vendors engaged in designing new (or custom) plants will achieve a higher standard of severe-accident safety performance than their prior designs." A defense-in-depth approach reflects an awareness of the need to make safety judgements in the face of uncertainties; in effect, not putting all the eggs in one basket.
In that
)
regard, the reactor containment boundary should serve as a reliable barrier against fission product release for credible severe-accident j
phenomena / challenges.
Every effort should be made to eliminate or further
~ reduce the likelihood of a sequence that could bypass the containment.
The continued reliance on the traditional principle of containment of fission products following an accident is seen as the logical and prudent approach to addressing reasonable questions which will persist reggrding our ability to accurately predict certain aspects of severe accident behavior.
In order to ensure balance between prevention and mitigation, some criteria on containment perfonnance are appropriate. Accordingly, a general goal of limiting the con-ditional containment failure probability to less than 1 in 10 when weighted over credible core-damage sequences wwld constitute appropriate attention to the defense-in-depth philosophy.
Probabilistic risk assessment is a very powerful tool that permits systematic integrated assessment of design strengths and weaknesses.
However, because very low frequency scenarios (approximately 1.0x!O-6 per reactor-year) are being acoressed, it is importent to keep perspective of the very large EPRI Chapter 5 DSER 2-3 July 1989
uncertainties in the quantification of these scenarios. The overall uncertainties in severe accident behavior are driven largely by insufficient data for assessing connon-cause failures, difficulty in quantification of the potential for human errors, and questions over completeness of analyses and uncertainties in phenomenological behavior. For this reason, the staff considers it acceptable to utilize a deterministic containment performance criterion that would provide a level of containment performance comparable to that which could be demor.strated usir,g a probabilistic containment failure goal of 10-percent given a severe accident.
The containment function, i.e., maintenance of a leak tight barrier against radioactivity release, is faced with distinct challenges as a result of a severe accident. Those challenges may be roughly divided into two categories, energetic or rapid energy releases and slower, gradually evolving releases to the closed containment system. Examples of containment loadings that fall into the first category include high-pressure core melt ejection with direct containment heating, hydrogen combustion, and the initial release of stored energy from the reactor coolant system. Slow energy releases to the containment are typified by decay heat and noncondensible gas generation.
Engineering practice in containment design calls for providing passive capability in dealing with energetic energy releases where practicable while long-tenn energy releases may be controlled by both. passive means as well as through active intervention. On this basis, the staff concludes the following general criteria for containment performance during a severe-accident challenge are appropriate for the evolutionary ALWRs.
The containment should maintain its role as a reliable leak tight barrier by ensuring that containment stresses do not exceed ASME service level C limits for a minimum period of 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> following the onset of core damage.
EPRI Chapter 5 DSER 2-4 July 1989
l 1
Maintaining containment integrity for the first 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> is based on providing 1
sufficient time for the remaining airborne activity in the containment i
(principally noble gases and iodine) to decay to a level that would not j
exceed 10 CFR Part 100 dose guideline values if controlled venting were to occur after that time. During this 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> period, containment integrity should be provided, to the extent practicable, by the passive capability of the containment itself and any related passive design features (e.g.,
suppressionpool). The staff further believes that following this 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> j
period, the containment should continue to provide a barrier against the i
uncontrolled release of fission products.
However, in keeping with the concept of allowing for interventiun in coping with long-term or gradual energy release, the staff believes that after 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />, the containment design may utilize controlled, elevated venting to reduce the probability of a catastrophic failure of the containment. Alternatively, a design may utilize diverse containment heat removal systems or rely on the restoration of normal containment heat removal capability if sufficient time is available for major recovery actions (e.g., 48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br />). Any systems, either venting or diverse heat removal, to be used to prevent long-term containment failure need not meet the full complement of regulatory requirements associated with safety systems. The design of those systems need only assure an appropriate reliability for operation.
Furthermore, accident mitigation features that deal with core damage accidents can be evaluated on a best-estimated basis.
I i
In evaluating the capability of the containment design, it is necessary to consider the loading associated with (1) stored energy from the reactor coolant system, (2) chemical reaction energy associated with core degradation, (3) decay heat, (4) hydrogen combustion and other noncondensible gas generation, as appropriate, including core-concrete interaction energy i
consistent with the design. The staff concludes that other energy release mechanisms (e.g., direct heating) should be addressed by reducing their 4
likelihood to sufficiently low levels through design features.
The staff concludes that containment system design features dealing with the above challenges to the integrity of the containment would Icad to a rugged containment system.
In view of the low probability of accidents that would challenge the integrity of the containment, the staff concludes that the unreliability of the mitigation systems, from the onset of core damags to EPRI Chapter 5 D$ER 2-5 July 1989
m.
prevention of significant releas2s, should not exceed approximately 0.1.
However, the staff intends to ensure that the containment can deal with all I
credible challenges and does not intend to apply the conditional containment failure probability guideline in a manner that could be interpreted to potentially detract from overall safety. The staff will accept a CCDF of 0.1 or a deterministic containment performance goal that offers comparable pro-tection.
In lieu of requiring the inclusion of a conditional containment failure probability goal in the Requirements Document, the staff concludes that EPRI should propsa and justify an explicit measure of containment performance during a severe accident which is to be included in the Requirements Document. This is an open item that must be satisfactorily l
addressed before the staff can complete its review of Chapter 5 of the l
Requirements Document.
2.2 Station Blackout Section 2.3.3 of Chapter 5 of the Requirements Document requires the ALWR to be capable of maintaining a safe condition during a blackout (loss of ac power) for 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br />. The analysis that will be used to verify this capability
- will use mechanistic system performance and best-estimate analytical methods.
The staff is concerned that these analytical techniques may not be conservative enough to provide the assurance needed that an ALWR car. meet the requirements of the blackout rule (10 CFR 50.63).
In a letter to the staff dated September 15, 1988, the Steering Comittee stated that a separate coping analysis will be conducted to confirm compliance with the blackout rule. The analytical methodology for this analysis will be consistent with the guidance provided in NUMARC 8700 and Regulatory Guide 1.155. The staff endorses the use of these documents for the station blackout analysis.
Because determination of the actual coping duration and the ALWR capability to recover l
during that period is partially dependent on site-specific characteristics,.
the subject station blackout analysis required to show compliance with 10 CFR 50.63 will necessarily be plant-specific. The staff's evaluation of this issue is discussed in Section B.9 of this report. Additional requirements that address station blackout are piovided in Chapter 11 of the Requirements Document. The staff will address these additional requirements when it reviews Chapter 11.
EPRI Chapter 5 DSER 2-6 July 1989
l l
2.3 Zirconium-Water Reaction and Hydrooen Generation In its letter dated August 16, 1988, the Steering Comittee stated that "Because of the multiplicity of regulatory requirements regarding hydrogen control for severe accidents, the specific Regulation that the ALWR is required to meet is not clear at this time."
On that basis, the Comittee submitted the proposed ALWR hydrogen control requirements as an optimization issue, requesting the staff to evaluate the proposed ALWR requirements on the basis of their unique technical merits independent of current and future regulations.
Section 2.4.1.7 of Chapter 5 of the Requirements Document specifies that containment and combustible gas control systems shall be designed to accomodate 75 percent in-vessel zirconium-water reaction of the active fuel j
cladding, and 13 percent containment uniform hydrogen concentration.
It states that 75 percent cladding oxidation is believed to be a conservative l
upper limit on the amount of hydrogen generated in a degraded-core situation including recovery.
It is the Steering Comittee's position that no significant ex-vessel hydrogen generation due to core-concrete interaction would occur under severe-accident conditions.
' The proposed zirconium-water reaction assumption of 75 percent is considerably greater than the value prescribed by Regulatory Guide 1.7 for design-basis-accident considerations and is believed to be a mid-range estimate of l
in-vessel hydrogen generation for severe accidents (Ref: NUREG-115J, February l
1987,TablesJ.4.1andJ.4.2). The proposed 13-percent hydrogen concentration l
limit is based on theory and extrapolations of experimental data described in
" Technical Support for the Hydrogen Control Requirement for the EPRI Advanced Light Water Reactor Requirements Document" (Task 8.3.5.4, Fauske and Associates, Inc., June 1988).
It is the limit below which it is asserted to be very unlikely that detonations in hydrogen-air-steam mixtures will occur.
However, due to the uncertainties in the the phenomenological knowledge of hydrogen generation and combustion, it is the staff's position that ALWRs should be designed to (.) accommodate hydrogen equivalent to 100-percent metal-water reaction of the fuel cladding and (2) limit containment hydrogen concentration to no greater than 10 percent. The staff's position is f
EPRI Chapter 5 DSER 2-7 July 1989
7 consistent with the requirements' of 10 CFR 50.34(f) as referenced in 10 CFR Part 52. Furthermore, because hydrogen control is necessary, given present analytical capabilities, to preclude local concentrations of hydrogen to detonable limits, the staff concludes ALWRs should provide containment-wide hydrogen control (e.g., igniters) for severe accidents. Additional advantages of providing hydrogen control mitigation features (rather than reliance on random ignition of richer mixtures) includes the lessening of pressure and temperature loadings on the containment and essential equipment. This is an j
open item that must be satisfactorily addressed before the staff can complete j
its review of Chapter 5 of the Requirements Document. This item is also
}
addressed in Sections 6.5.1, B.8, and C.3 of this report.
l i
2.4 Decay Heat Calculations (ANS 5.1)
I Section 2.2.6 of Chapter 5 of the Requirements Document states that design of j
decay heat removal systems, (excluding analyses performed in accordance with l
l Appendix K to 10 CFR Part 50), will be based on decay-heat generation rates as
{
giveninANSStandard5.1(October 1979). The staff concludes this is l
acceptable for realistic evaluations permitted by the revised 10 CFR 50.46 and Appendix K to 10 CFR Part 50.
i i
~ 10 CFR 50.34(g) requires that the design of decay heat removal systems be i
i j
evaluated against Branch Technical Position (BTP) ASB 9.2 which requires an j
additional 20-percent uncertainty factor be included for the first 1000 j
seconds following shutdown and 10 percent between 1000 seconds and 10,000,000 j
seconds. However, a recent comparison to the ORIGEN code (described in an i
attachment to the Steering Cosmittee's letter of August 16,1988) has shown ANS 5.1 to be a conservative predictor of decay heat generation. On this I
basis, the staff has concluded that ANS 5.1 can be used in lieu of BTP-ASB 9.2 1
i for decay-heat-generation rates in design of decay-heat-removal systems.
I i
)
I i
i i
EPRI Chapter 5 DSER 2-8 July 1989 i
2.5 Fire Protection Section 2.3.2 of Chapter 5 of the Requirements Document indicates that fire protection will be as specified in 10 CFR 50.48 and Appendix R.
The Requirements Document states that for equipment in the same general area, a 3-hour fire barrier will be utilized in lieu of physical separation unless it j
is " impractical or less safe." However, no guidelines are provided in the Requirements Document as to the application of these criteria.
It is the staff's position that fire issues that have been raised through l
operating experience and through the External Events Program must be resolved l
for ALWRs. To minimize fire as a significant contributor to the likelihood of l
severe accidents for advanced plants, the staff concludes that current NRC guidance must be enhanced. Therefore, the criteria delineated in the l
Requirements Document must ensure that safe shutdown can be achieved, assuming that all equipment in any one fire area will be rendered inoperable by fire and that re-entry into the fire area for repairs and operator actions is not possible. Because of its physical configuration, the control room is excluded from this approach, provided an independent alternative shutdown capability l
that is physically and electrically independent of the control room is included in the design. The ALWR design criteria must provide fire protection j
' for redundant shutdown systems in the reactor containment building that will ensure, as much as practicable, that one shutdown division will be free of fire damage. Additionally, criteria should be provided in the Requirements Document that ensure that smoke, hot gases, or the fire suppressant will not migrate into other fire areas to the extent that they could adversely affect safe-shutdown capabilities, including operator actions. Beciuse the layout of l
a nuclear plant is design-specific, plant-specific design c'etails will be j
reviewed by the staff on an individual basis. The staff will require a description of safety-grade provisions for the fire-protection systems to ensure that the remaining shutdown capabilities are protected, as well as demonstration that the design complies with the migration criteria discussed above.
Fire-protection requirements are being addressed in Chapter 9 of the Requirements Document. Therefore, the staff will address the results of its review of this subject when it reviews Chapter 9.
EPRI Chapter 5 DSER 2-9 July 1989
2.6 Severe-Accident Analyses i
Section 2.4.2 of Chapter 5 of the Requirenents Docurent specifies that provisions be made and realistic analyses be conducted for severe accidents, including in-vessel and ex-vessel core debris cooling and cavity flooding.
The staff accepts the position that severe-accident analyses should be based on realistic or best-estimate methods with proper consideration of uncertainties in phenonenological modeling.
In the absence of detailed, explicit regulatory criteria, the Requirements Document states that the plant designer will utilize industry-developed methods (e.g., MAAP) to demonstrate that the risk objectives of the ALWR public safety goal are met and the staff will, as appropriate, conduct independent analyses using staff-developed methods, to assess applicants' analyses.
See Section 6.6 of this report for an evaluation of severe-accident mitigation features.
EPRI Chapter 5 DSER 2-10 July 1989
I.,
3 ALWR CORE-DAMAGE-PREVENTION REQUIREMENTS Core-damage prevention relies on four functions: (1) the core-coolant-i inventory function, (2) the decay-heat-removal function, (3) the diverse
{
reactivity-control function, and (4) the RCS pressure-control function. Core-l damage-prevention requirements applicable to both PWRs and to BWRs are defined in Section 3 of Chapter 5 of the Requirements Document. General requirements applicable to both PWR and BWR core-damage-prevention functions are presented in in the same section of the Requirements Document.
3.1 Inservice Testing f
Section 3.4.1 of Chapter 5 of the Requirements Document requires systems to be inspectable and testable.
In its letter dated April 4, 1988, the staff stated l
its position that future facilities must be better able to accommodate the l
testing requirements of the ASME Code and that future licensees will be required to provide a technical justification for each valve which cannot be practicably exercised quarterly during operation in fulfillment of Code requirements. The staff letter stated the conditions under which the testing may be delayed until cold shutdown and recommended that the Requirements Document specify that the final ALWR design conform to its position. The April 4,1988 letter also informed the Comittee of staff positions relating to inservice testing of check valves, pressure isolation valves, soler.cid-operated valves, excess flow valves, and control rod drive valves.
In its August 16, 1988 letter, the Steering Comittee stated that work has been initiated to revise Chapter 1 of the Requirements Document to include specific inservice inspection and testing requirements. This is an open item I
that will be addressed after EPRI submits the proposed revision to Chapter 1 of the Requirements Document.
The April 4,1988 letter also informed the Steering Comittee of staff positions related to inservice testing of support system valves for the emergency diesel generators.
In its letter dated August 16, 1988, the Steering Comittee indicated that specific testing requirements for onsite power supplies will be addressed in Chapter 11 of the Requirements Document.
The staff will address these testing requirements when it reviews Chapter 11.
EPRI Chapter 5 DSER 3-1 July 1989 4
m
s i
l In response to the staff's April 4, 1988 statement that containment isolation valves that also serve as pressure boundary valves are subject to both Appendix J local leak rate test requirements and ASME Section XI inservice testing requirements, the Committee connitted to clarify Section 6.2.2.2.1 of Chapter 5 of the Requirements Document to delete the word " operability" so as not to preclude leakage testing from the scope of the requirements.
Contingent upon completion of this action, the staff finds this acceptable.
3.2 Diesel Generator Start Time j
l i
l Section 3.4.5 of Chapter 5 of the Requirements Document requires that engineered safety systems be designed so that the onsite power source start
)
l time need not be shorter than 20 seconds and the combined start time and load i
sequencing time need not be shorter than approximately 40 seconds. The stated rationale for the requirement is that operating plants have sometimes exceeded the current 10-second start time requirement by a few seconds or have experienced governor stability problems and emergency overspeed shutdowns.
The staff questioned how the design of the diesel starting system might be changed to take advantage of this increased starting time and improve the starting reliability of the machine.
~ The Steering Committee responded that a 20-second starting time improves diesel generator reliability by:
(1) Alleviating the regs utments on the governor characteristic and eliminating most of the instability problems.
(2) Allowing the use of a remp generator to control the acceleration of the unit to full speed. With this scenario, the unit accelerates freely up to approximately 50 percent speed, at which point the governor controls the acceleration to full speed following a predetermined ramp, thereby eliminating any overshoot.
(3) With the use of the ramp generator, the engine will safely get to full speed in 13-14 seconds. A 6-7 second margin is then provided before load sequencing in order to allow lube oil pressure to build up and stabilize.
EPRI Chapter 5 DSER 3-2 July 1989
i l
l This eliminates the failure to start due to a trip on low lube oil pressure.
In addition, this ensures that all parts of the engine are properly lubricated before any large load is applied, therefore, reducing engine wear.-
The staff finds that the longer starting period allowed for the diesel generator will likely improve the reliability for those conditions at which it is directed. This is based on the assumption that the sequencing-on of the engineered safety system loads can be delayed with no adverse effects on the functional capability of the respective systems. Also, the amount of unreliability added by the ramp generator circuitry in the diesel generator must be considered.
l l
The use of increased starting and loading intervals is acceptable, providing l
the increased intervals are properly incorporated into plant-specific accident analyses and shown by such analyses to result in acceptable consequences. The staff will require the ALWR designer / applicant to demonstratt the I
acceptability of such an analysis.
3.3 Electric Valve Operators i
' Section 3.4.11 of Chapter 5 of the Requirements Document states that valve operator motor controls shall generally not be designed to automatically stop valve motion due to an electric overload except during valve operational testing. This requirement is in general agreement with Position 1.(a) of l
Regulatory Guide 1.106 (Rev.1) which states that thermal overload protection devices should be continuously bypassed and temporarily placed in force only when the valve motors are undergoing periodic or maintenance testing.- The l
ALWR requirement is therefore acceptable.
3.4 Anticipated Transients Without Scram Although not discussed explicitly in Chapter 5 of the Requirements Document, the ALWR requirement to resolve the issue concerning anticipated transients l
without scram (ATWS) is compliance with 10 CFR 50.62 (referred to as the ATWS l
rule). The staff finds compliance with the ATWS rule an acceptable approach EPRI Chapter 5 DSER 3-3 July 1989 l
to resolution, except in the area of diversity. While requiring a diverse scram system for Combustion Engineering and Babcock & Wilcox facilities, the ATWS rule did not require this feature on Westinghouse reactors because the Westinghouse NSSS design has certain features that would reduce the consequences of an ATWS in the unlikely event one were to occur, and because of the cost of backfit to an operating reactor. The staff concludes that a diverse scram capability is a worthwhile measure of prevention for all advanced LWRs, especially when incorporated into the initial design.
Therefore, the staff concludes that the EPRI Requirements Document should include a requirement that, unless the ALWR designer can demonstratt that the consequences of an ATWS are acceptable, the ALWR PWR should have diverse reactur protection system input to the control rods. The requirements that address instrumentation and controls of the ALWR design are being developed in Chapter 10 of the Requirements Document, which has not been submitted for staff review. The staff will address this issue when it reviews Chapter 10, i
l l
EPRI Chapter 5 DI R 3-4 July 1989
\\
?
f
)
4 BWR CORE-DAMAGE-PREVENTION REQUIREMENTS
~
l.
l The Requirements Document states that the BWR core coolant inventory control, j
decay heat removal, and RCS pressure control functions will be provided by the j
following systems in the ALWR design:
i high-pressure injection (HPI) system reactor core isolation system (RCIC) l decay heat removal (DHR) system j
automaticdepressurizationsystem(ADS)
These systems are grouped into three divisions, each division having independ-ent service water, ac power, and dc power supplies. Divisions I and 2 are identical, each has a motor-driven high-pressure injection pump and one or more motor-driven low-pressure DHR pumps. Division 3 consists of a steam-driven high-pressure injection pump (RCIC), an automatic depressuri-zation (ADS) system, and a DHR pump. Each division has a heat exchanger. Any of the three divisions is capable of performing the low-pressure injection or suppression-pool cooling function. Two of the civisions can provide 1
containment sprey.
4.1 Elimination of Core Spray The ALWR BWR design does not include a core spray system. This is based on the elimination of large recirculating system piping resulting in there beir.g no postulated large or medium LOCAs below the core, and that reflood cooli.?
j is sufficient to protect against core damage. The staff finds this acceptable subject to confirmation by detailed LOCA calculations that core spray is not 4
necessary to meet 10 CFR 50.46 requirements. The staff will require the ALWR designer / applicant to perform and demonstrate the acceptability of such an analysis.
4.2 Anticipated Transients Without Scram The Requirements Document does not specify a requirement for an automatic pump trip to resolve staff concerns regarcing anticipated transients without scram EPRI Chapter 5 DSER 4-1 July 1989
(ATWS) for ALWR BWRs. The staff concludes that this should be added or justification for exemption to the ATWS rule should be provided. The requirements that address instrumentation and controls of the ALWR design are being developed in Chapter 10 of the Requirements Document, which has not been submitted for staff review. The staff will address this issue when it reviews Chapter 10.
4.3 Standby Liquid Control System The diverse reactivity control function required by GDC 26 is provided by the standby liquid control system (SLCS).
The ALWR pr6 posed design is similar to the SLCS in current BWRs. The system design basis requires that the amount of sodium pentaborate and its minimum injection rate be sufficient to bring the reactor from full rated condition to cold shutdown with a margin and hold it there while allowing for xenon decay. The margin should be sufficient to allow for mixing and dilution by the shutdown cooling water. Since a 13-percent solution of sodium pentaborate will be used, adequate heating means must be provided to maintain solution temperature above its saturation temperature and prevent precipitation.
The sodium pentaborate solution is injected into the reactor vessel through the high and low pressure safety injection lines. _It was determined experimentally that this method of injection will provide good mixing of the injected fluid with the reactor vessel water.
In addition to differing from existing facilities in the means of injection to the vessel, this pump discharge path also differs frce previous designs by not including explosive squib valves in the pump discharge lines.
Elimination of these valves is justified by close proximity of the suction valves to the storage tank and system lines filled with demineralized water. The staff concludes these features are acceptable.
The Requirements Document does not specifically invoke or reference the SLCS performance requirements of the ATWS rule (10 CFR 50.62). The ATWS rule re-quires that SLCSs meet specific flow conditions, and, for facilities granted a construction permit after July 26, 1984, have an automatic initiatic. feature.
Also, criteria have not been specified to ensure that the insertion of boron EPP! Chapter 5 DSER 4-2 July 1989
into the vessel is distributed effectively and is thoroughly mixed.
Therefore, the staff concludes that the Requirements Document design criteria ensures thorough mixing of the injected boron. The staff concludes that the Steering Comittee should address these issues in the Requirements Document.
These are open items that must be satisfactorily addressed before ti.e staff can complete its review of Chapter 5 of the Requirements Document.
4.4 Safety Classification of Containment Spray System The ALWR BWR containment heat-removal system consists of suppression-pool cooling and wetwell spray (WS) and drywell spray (DS) features, which s.e sharea functions of the RHR system. The purpose of these systems is to prevent excessive containment temperatures and pressures, thus maintaining containment integrity and equipment operability following a LOCA.
For design of the WS and DS, the Requirements Document does not address all the acceptance criteria that are described in SRP Section 6.2.2, " Containment Heat Removal Systems." Furthermore, the Requirements Document states that the WS and DS system design and equipment need not be safety-grade, whereas the SRP Section 6.2.2 acceptance criteria regarding GDC 38 states that the containment heat removal system design should meet the redundancy and power source requirements of an engineered safety feature system.
Furthermore, SRP Section 6.2.2 calls for heat removal systems to be designed to Quality Group B and seismic Category I standards. On the basis of these discrepancies, the staff has not been able to accept the requirements for design of the containment heat removal system. This is an open item that must be satisfactorily addressed before the staff can complete its review of Chapter 5 of the Requirements Document. See also Section 7.2 of this report.
4.5 Suppression.. Pool-Bypass Leakage In a pressure-suppression containment, steam released from the primary system following a postulated LOCA is collected in the containment drywell r.nd directed through connecting vents to the suppression pool located in the wetwell. The stean is condensed as it enters the suppression pool. Thus, no stean enters the wetwell airspace. However, the potential exists for steam to EPRI Chapter 5 DSER 4-3 July 1989 t
I bypass the suppression pool by leakage through the vacuum breakers or directly from leak paths in the drywell-to-suporession chamber vent pipes, the diaphragm wall seal around diaphragm penetrations, or cracks in the concrete diaphragm.
The capability to tolerate steam bypass (A/fii) from the drywell to the wetwell space is discussed in Appendix A to SRP Section 6.2.1.1.C for small primary steam breaks in the Mark I, II, and III containment designs. The capability of the Mark I design is of the order of 0.02 ft2; the capability of the Mark II containment is approximately 0.05 ft2 and the Mark III design has a capability of I fta, In a letter dated August 16, 1988 responding to the staff's RAI regarding steam bypass capability in the ALWR BWR containment, the ALWR Steering Comittee stated that the approach being taken in the design of the advanced BWR will be to minimize the potential leakage paths between the drywell and wetwell. This is to be accomplished by requiring a rigid steel-lined diaphragm floor to eliminate any leakage path through the concrete, and requiring that all connections between the drywell and wetwell enter the suppression pool under water with no passage of steam in vertical downcomers through the wetwell air space. This arrangement will minimize the potential
- 1eakage paths from the drywell to the wetwell which bypass the suppression pool. Additionally, the vacuum breaker system will be designed to prevent bypass. The Steering Committee further stated that the improved configuration of the ALWR BWR provides the basis for a very small drywell-to-wetwell
{
airspace bypass leakage, but the maximum allowable equivalent leakage area for I
steam bypass of the suppression pool was not identified.
4 The staff commends the intended approach being taken in the design of the ALWR l
BWR to minimize the potential leakage paths between the drywell and wetwell.
However, since the maximum allowable leakage area for steam bypass of the suppression pool was not provided for this design approach and, specifically, since the design criteria do not explicitly identify greater capability to
]
tolerate bypass leakage, the staff cannot concluce that the ALWR BWR 1
requirements are acceptable at this time.
Furthermore, since the BWR pressure-suppression design is sensitive to relatively small bypass leakage i
2 EPRI Chapter 5 DSER 4-4 July 1989
/
areas, the staff concludes that ALWRs that utilize that design concept should demonstrate a sufficient capability to tolerate bypass leakage. This is an open item that must be satisfactorily addressed before the staff can complete its review of t,hapter 5 of the Requirements Document.
4.6 Suppression-Pool Temperature-Monitoring,Sg tem NUREG-0783, " Suppression Pool Temperature Limits for BWR Containments,"
recommends that the suppression-pool temperature-monitoring system meet the general design requirements listed below:
Each applicant or licensee demonstrate adequacy of the number and distribution of pool temperature sensors to provide a reasonable measure of the bulk temperature.
Sensors be installed sufficiently below the minimum wrter level, to
(
ensure that the sensors properly monitor pool temperature.
l Pool temperature be indicated and recorded in the contiol room. Where the suppression pool temperature limits are based on bulk pool temperature, operating procedures or analyzing equipment should be used to minimize the actions required by the operator to determine the bulk pool temperature. Operating procedures and alarm set points should l
consider the relative accuracy of the measurement system.
- Instrument set points for alannt he established so that the plant will operate within the suppression-pool temperature limits.
All sensors be designed to seismic Category I, Quality Group B standards, and be capable of being energized from onsite emergency power supplies.
l l
EPRI Chapter 5 DSER 4-5 July 1989
In Section 4.5.3.4.3 of Chapter 5 of the Requirements Document, the Steering Comittee states that suppression-pool temperature sensors shall be located in each quadrant of the suppression pool. However, the Requirements Document does not include justification or analysis to demonstrate the adequacy of the number and distribution of such teiuperature sensors. Further, the Requirements Document does not incorporate the above general design requirements of NUREG-0783. On the basis of its review, the staff is unable to conclude that the suppression-pool temperature-monitoring system is acceptable. This is an open item that must be satisfactorily addressed before the staff can complete its review of Chapter 5 of the Requirements Document.
l EPRI Chapter 5 DSER 4-6 July 1989
3 I I
V l
l l
5 PWR CORE-DAMAGE-PREVENTION REQUIREMENTS l
5.1 Introduction Section 5 of Chapter 5 of the Requirements Document identifies core-damage prevention requirements for PWRs. The Requirements Document states that PWR core damage is prevented by the following systems:
residual heat removal (RHR) system emergency feedwater (EFW) system i
safety injection system (SIS) safety depressurization and vent system (SDVS)
In its letter dated August 16, 1988, the Steering Connittee described its probabilistic basis for providing two divisions of safety systems in PWRs.
{
The information presented indicates that the decision was based on previous PRAs, from which it has been concluded that this aporoach will enable the ALWR to meet its safety goals. Since two divisions is also consistent with regulatory requirements, this approach is acceptable to the staff.
]
5.2 Residual Heat Removal System l
\\
l l
The Requirements Document states that the RHR system should consist of two I
divisions, each with a low-pressure motor-driven pump and heat exchanger located outside containment. The RHR system design pressure and temperature conditions is specified to be 900 psig and 400 degrees F.
These design conditions will preclude the possibility of RCS/RHR intersystem LOCA should theRHRsystembesubjectedtothehigherRCSpressure.(SeeSectionB.5of thisreport.) The two RHR pumps have tackup cross-connections to the containment spray pumps to facilitate maintenance.
Section 5.2.3.1.3 of Chapter 5 of the Requirements Document specifies requirements relating to potential loss of decay heat removal when the RCS level is lowered for maintenance during shutdown. operations.(mid-loop operation). Section 5.2.3.13.2 of Chapter 5 of the Requirements Document specifies requirements relating to shutdown level instrumentation. Although I
EPRI Chapter 5 DSER 5-1 July 1989 L
the requirements are consistent with measures applicable to operating reactors as described in Generic Letter 88-17, the staff position for ALWRs is that design changes are necessary to eliminate the risks associated with mid-loop operations.
(This issue is a subissue of Generic Issue 99, " Loss of RHR Capability in PWRs" (see also Section B.5 of this report)). The staff concludes that additional design criteria should be included in the Requirements Document. This is an open item that must be satisfectorily addressed before the staff can complete its review of Chapter 5 of the Requirements Document.
In a letter dated March 28, 1988 regarding low-temperature overpressure protection (LTOP)(also discussed in Chapter 4 of the Requirements Document),
the Steering Comittee stated that RHR system requirements in Chapter 5 of the Requirements Document will be modified to reflect requirements for LTOP and to require that the minimum end-of-life pressure relief set points for LTOP be considered in sizing RHR relief capacity.
In a letter dated September 23, 1988, the staff acknowledged its acceptance of these commitments as resolving the LTOP issue for ALWRs. The staff will confirm that the proposed revision to Chapter 5 of the Requirements Document satisfactorily addresses this Concern.
~ 5.3 Emergency Feedwater System Chapter 5 of the Requirements Document describes the ALWR EFWS as a dedicated safety-related system that has no normal operational functions. The EFWS provides feedwater to the steam generators following transients or accidents such as reactor trip, loss of main feedwater, steam or feedwater line breaks, steam generator tube ruptures, and anytiene the main and startup feedwater systems are not available. The ALWR EFWS should consist of two independent, identical subsystems.
Each subsystem will be comprised of one motor-driven and one turbine-driven feedwater pump, an emergency feedwater storage tank (EFWST), and associated piping, valves, and instrumentation and controls.
Each subsystem will be powered by one of two separate Safety Class IE electrical power sources. The ALWR EFWS is designed so that any two pumps for four steam generator plants, and any one pump for two steam generator plants, j
shall be capable of satisfying the flow requirements for design-basis i
l EPRI Chapter 5 DSER 5-2 July 1989 l
J
conditions plus any additional flow required for pump minimum flow protection.
Any single pump shall be capable of satisfying the minimum flow requirement for best-estimate decay heat removal evaluations for events with core-damage frequencies greater than 1.0x10-5 per reactor year. Each of the safety-related EFWSTs will contain enough condensate-quality water to achieve safe cold shutdown, based on:
a main feedline break without isolation of EFW flow to the affected steam generator for 30 minutes refill of the intact steam generators 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> of operation at hot standby conditions Subsequent cooldown of the reactor coolant system within 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> to conditions that permit operation of the RHR system continuous operation of one reactor coolant pump The Requirements Document states that a cross-connect line must be provided between the two EFWSTs to allow feedwater supply to all EFW pumps.
In j
- addition, a backup supply of cor,densate-quality feedwater shall be provided to the EFWSTs and the transfer of water to the EFWSTs shall be possible under station blackout conditions. However, this backup supply need not be safety-related. The Requirements Document also specifies interfacing requirements for the alternate water supply to the EFWS.
The Requirements Document states that the EFWS must be equipped with four cavitating venturi flow meters (two for two steam generator plants), one on each discharge line to the steam generator.
In the event of steamline or feedwater line rupture, these cavitating venturi flow meters will choke the EFWS flow to the steam generators to prevent pump damage due to runout and to prevent excessive rates of cooldown of the reactor coolant system.
If the break is inside the contain-ment, the cavitating venturi flow meters will limit the effect of EFWS on the mass and energy released to the containment.
EPRI Chapter 5 DSER 5-3 July 1989
4 f
In addition, the Requirements Document states that the EFWS must be provided with a me_ans to detect potential EFWS pump steam binding as a result of steam and h0t water leakage through check valves in the pump discharge lines. This shall consist of temperature monitoring of the portion of discharge piping up-stream of the check valves, with indication and alam in the control room.
Appropriate vents and drains shall be provided for removing steam in the event steam is detected. The Requirements Document also states that the EFWS must be provided with means to permit periodic surveillance testing of EFW pumps and valves and functional testing of the integrated operation of the system.
Flow to the steam generators is to be prevented during testing to avoid unnecessary themal transients and inputs of oxygenated water to the steam generators. Appropriate access shall be provided to test power-operated valves. Means must be provided to test the pumps at the design flow with the reactor in operation.
Section 5.3.2.4 of Chapter 5 of the Requirements Document specifies automatic or manual options for initiation of emergency feeo ter flow.
In its letter dated August 16, 1988, the Steering Committee committed to revise Section 5.3.2.4 of Chapter 5 of the Requirements Document to specify automatic and i
manual initiation of EFW flow. The staff considers both automatic and manual initihtion to be necessary and accepts the comitment to revise the
' Requirements Document accordingly. The staff will confirm that the pr' posed l
revision to Chapter 5 of the Requirements Document satisfactorily addresses this concern.
i Section 5.3.2.5.1 of Chapter 5 of the Requirements Document states that emergency feedwater supplied to steam generators shall be of the same or better quality as secondary system makeup water, except that the requirement l
on oxygen can be excluded. This is consistent with the SRP and is acceptable.
On the basis of its review, the staff finds that the described EFWS design requirements are consistent with the criteria as described in SRP Section 10.4.9, " Auxiliary Feedwater Systems," and are therefore acceptable. The j
staff will confirm that the proposed revisions to Chapter 5 of the Requirenents Document satisfactorily addresses confirmatory issues discussed above. See Section B.4 of this report for a discussion on generic safety EPRI Chapter 5 DSER 5-4 July 1989
issues on the EFW system reliability.
5.4 Safety Injection System The Requirements Document describes a safety injection system (SIS) which consists of two high-pressure divisions, each having two trains (total of four motor-driven 50-percent pumps). Low-head pumps and series (piggyback) pump alignment are not employed in the ALWR design. The SIS pumps should be located outside the containment, should take suction from a common in-containment refueling water storage tank (IRWST), and should inject directly into the vessel by way of independent piping connections to the reactor vessel. Discharge connections to the hot legs should also be provided.
Each division will have sufficient capacity to satisfy DBA LOCA requirements in accordance with regulatory requirements, and small-break LOCA investment protection requirements [i.e., no fuel damage for 6-inch (12-inch target) break]. The number of SIS accumulators is not specified, and will be
" minimized." Injection pressure will be selected by the designer and will be high enough to permit feed-and-bleed cooling. The IRWST eliminates the need to switch SIS suction to a containment sump for continued supply of injection water. This feature greatly reduces complexity and increases system reliabil-
)
ity. The IRWST also serves as an RCS relief discharge tank. For the reasons
~ stated above, the ~,taff concludes these features are acceptable. The staff will require the designer / applicant to demonstrate that SIS injection pressure is sufficient to permit feed-and-bleed operation.
5.5 Safety Depressurization and Vent System i
The Requirements Document states that a safety depressurization and vent system (SDVS) will be provided for the ALWR which consists of a single passive piping system containing two active, safety-grade valve trains.
Four valves will be installed in two parallel flow branches, in piping from the pressurizer to the IRWST, to provide single-active-failure vent and depressurization capability for natural circulation cooldown, steam generator tube rupture, and feed-and-bleed conditions. One valve assembly flow path (train) is adequate for feed-and-bleed cooling in event of a total loss of EPRI Chapter 5 DSER 5-5 July 1989
feedwater if feed and bleed is established immediately. Both paths are required if feed and bleed is delayed for 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> after safety valve lift. See
{
Sections 6.6.5 and B.10 of this report for a discussion of the open item concerning the SDYS.
i i
i i
l i
i l
EPRI Chapter 5 DSER 5-6 July 1989
i i
6 MITIGATION REQUIREMENTS 6.1 Introduction Section 6.0 of Chapter 5 of the Requirements Document specifies mitigation requirements applicable to both BWRs and PWRs. Mitigation relies on two j
functions: (1) the containment integrity function and (2) the fission product control function. The containment is intended to provide a barrier to the uncontrolled release of radioactivity in the event of an accident.
6.2 Containment Isolation System Design The function of the containment isolation system is to permit the normal and i
emergency passage of fluids through the containment boundary while preserving the ability of the boundary to prevent or limit the escape of fission products that may result from postulated accidents. The containment isolation system includes the portions of all fluid systems penetrating the containment that perform the isolation function. The Steering Committee states that isolation provisions in lines that penetrate the containment boundary shall be in accordance with ANSI /ANS 56.2-1984, " Containment Isolation Provisions for Fluid Systems After a LOCA," and Regulatory Guide 1.141. However, ANSI /ANS
~ 56.2-1984 has not been approved by the staff for the design of containment isolation systems. The staff has reviewed the ALWR requirements for l
containment isolation systems against the guidelines of SRP Section 6.2.4,
" Containment Isolation System," and ANSI /ANS 56.2-1976, which has been approved by the staff.
1 General Design Criteria 55 and 56 require that each line that penetrates the containment and is part of the reactor coolant pressure boundary or is connected directly to the containment atmosphere have one isolation valve 1
inside and one isolation valve outside containment, unless it can be demonstrated that the design is acceptable on some "other defined basis."
Each valve must be automatic or locked closed.
In satisfying GDCs 55 and 56, Section 3.6 and Appendices A and 8 of ANSI /ANS 56.2-1976 provide guicelines that the staff have found acceptable.
EPRI Chapter 5 DSER 6-1 July 1989
i The Requirements Document specifies that remote manual valves, instead of automatic valves, should be used for essential lines which are not part of engineered safety systems. This position for containment isolation is inconsistent with the guidance described in Section 3.6.3, " Remote Manual Valves," of ANSI /ANS 56.2-1976. The staff concludes that the Requirements Document has not provided an acceptable justification for an alternative to this guidance. Therefore, this is an open item that must be satisfactorily i
addressed before the staff can complete its review of Chapter 5 of the Requireinents Document.
In Section 6.2.2.1.2 of Chapter 5 of the Requirements Document, it is stated that if a single isolation valve is employed for an engineered safety feature line (e.g., lines connected to the suppression pool in a BWR and lines connected to the in-containment refueling water storage tank in a PWR), the valve need not be enclosed in a leaktight enclosure if the line inside the containment is submerged under water at all times following a LOCA. Note 56.1 in Appendix A of ANSI /ANS 56.2-1976 states that lines connecting directly to the suppression pool should each be provided with a single remote manual or automatic isolation valve. These valves are attached to lines that are an extension of the containment and are enclosed in a pump room adjacent to the containment which has provisions for environmental control of any fluid lea kage. The lines from the suppression pool would always be submerged, so no containment atmosphere can impinge upon the valves. Should a leak develop outside the containment, the fluid would be contained by the controlled 1eakage pump room. The configuration of the connection of the lines to the suppression pool assures that the connections are always submerged and prevents the escape of containment atmosphere.
In addition, the systems which the lines from the suppression pool connect to outside the containment must be closed systems (outside containment) to meet the appropriate requirements of closed systems described in ANSI /ANS 56.2-1976. The Steering Corsnittee has not indicated that ell of these criteria will be met for IRWST connections.
Therefore, the staff has not been able to conclude that the containment isolation provisions for these lines are acceptable. Therefore, this is an open item that must be satisfactorily addressed before the staff can complete its review of Chapter 5 of the Renuirements Document.
1 EPRI Chapter 5 DSER 6-2 July 1989
I In its letter dated August 16, 1988 (in response to Question No. 480.8), the Steering Comittee described its position regarding seismic cesign for closed systems and Type C testing of valves in closed systems performed in accordance with Appendix J of 10 CFR Part 50. The response states that seismic design will be employed where practical to qualify closed systems outside the containment as " extensions of containment" in order to eliminate the need for Type C testing of the valves.
It is the staff's position that a closed system outside the containment that meets the criteria of Section 3.6 of ANSI /ANS 56.2-1976 can be considered a second containment isolation barrier, thereby eliminating the need for a second containment isolation valve at each penatration. However, ehch barrier (i.e., the single isolation valve at each penetration, and the closed piping system outside the containment) is subject to W k rate testing. Therefore, this is an open item that must be satisfactorily addressed before the staff can complete its review of Chapter 5 of the Requirements Document.
In Section 6.2.2.3.1 of Chapter 5 of the Requirements Document, the Steering Comittee states that isolation valve closure times shall be in accordance with ANSI /ANS 56.2-1984 for standard commercial valve operators. This requirement is essentially the same as that of ANSI /ANS 56.2-1976, which has been approved by the staff, and, therefore, the staff finds it acceptable.
In Section 6.2.2.2 of Chapter 5 of the Requirements Document, the Steering Comittee states that Type C testing is not required for PWR inain steam, feedwater, emergency feedwater, or steam generator blowdown isolation valves.
These isolation valves are associateo with secondary systems. The closed system inside containment precludes containment atmosphere from reaching the associated isolation valves; therefore, the valves will not be relied on to limit containment leakage. The staff finds this criterion acceptable.
On the basis of its review, the staff concludes that the Requirements Document is inconsistent with NRC guidelines, as described in SRP Section 6.2.4,
" Containment Isolation System," and that the Steering Comittee has not provided acceptable justification for alternatives to this guidance as discussed above.
Therefore, these items are considered open issue 3 that must EPRI Chapter 5 DSER 6-3 July 1989
e
~
be satisfactorily addressed before the staff can complete its review of Chapter 5 of the Requirements Document.
6.3 Containment Leakage Rate Testing The Requirements Document states that the design of containment penetrations and isolation valves should permit periodic leakage rate testing at the pressure specified in Appendix J of 10 CFR Part 50.
Included are those penetrations that have resilient seals and expansion bellows (e.g., personnel air locks, equipment hatch, fuel transfer tube, and electrical penetrations).
3 The Requirewnts Document provides that containment leak rate testing be performed ',n accordance with regulatory requirements and the test methods be in accordance with ANSI /ANS-56.8 " Containment System Leakage Testing Requirements," in lieu of ANSI N45.4-1972, " Leakage Rate Testing of Containment Structures for Nuclear Reactors." The staff's evaluation of this position follows.
6.3.1 Containment Integrated Leak Rate Test i
Paragraph III.A.3 of Appendix J to 10 CFR Part 50 requires that containment integrated leakage rate tests be performed in accordance with American
- National Standard, ANSI 45.4-1972. ANSI 45.4-1972 requires that leakage calculations be performed using either the total time method or the i
point-to-point method. ANSI /ANS 56.8-1987 (which has not been approved by the staff) uses a different calculational method known as the mass point method.
The staff and industry recognize that the mass point method is superior to the point-to-point and total time methods. The mass point method calculates air mass at each point in time and plots it against time. A linear regression line is plotted through the mass time points using a least square fit. The slope of this line is the leakage rate.
In the total time method, a series of leakage rates are calculated on the basis of air mass differences between an initial data point and each individual data point thereafter.
If for any reason (such as instrument error, lack of temperature equilibrium, ingassing, or outgassing) the initial data point is not accurate, the result of the test will be affected.
In the point-to-point method, the leakage rates are based EPRI Chapter 5 DSER 6-4 July 1989 l
on the mass difference between each pair of consecutive points which are then averaged to yield a single leaktge rate estimate. Mathematically, this can be shown to be the difference between the air mass at the beginning of the test and air mass at the end of the test expressed as a percentage of the conti d ent air mass. The staff concludes that the use of the leak rate test method as described in ANSI /ANS 56.8-1987 for a facility design complying with the Requirements Document is an acceptable alternative to the methods specified in ANSI 45.4-1972 and can be used in support of an exemption to paragraph III.A.3 of Appendix J to 10 CFR Part 50. This acceptance extends to the use of the mass point method only, not to ANSI /ANS 56.8-1987 in its entirety.
In Section 6.3.2.2 of Chapter 5 of the Requirements Document, the Steering Committee states that integrated leak rate tests (IRLTs) can proceed to completion should a leak occur during testing, provided the leak can be j
i isolated, subsequent repairs are performed, and local "as found" minus "as 1 eft" leakage rate test results when added to the Type A result demonstrate that the integrated leakage rate test acceptance criteria are met. The staff finds that this criterion established by the Steering Comittee for integrated 1
l 1eakage rate tests acceptable.
i
~ 6.3.2 Type 8 Air-Lock Tests In Section 6.3.2.2 of Chapter 5 of the Requirements Document, the Steering
~
Committee states that air locks which are not used during a 6-month period may be tested at containment design pressure after the next usage rather than at 6 months, as required by Appendix J to 10 CFR Part 50. However, supporting data (e.g., long-term deterioration of seals) from operating experience or from experiments with appropriate analyses have not been provided to justify this deviation from the Appendix J requirement. On the basis of its review, the staff is unable to conclude that the proposed change to the air lock Type B test interval is acceptable. Therefore, this is an open item that must be satisfactorily addressed before the staff can complete its review of Chapter 5 of the Requirements Document.
4 l
^
EPRI Chapter 5 DSrd 6-5 July 1989
t I,
i j
6.3.3 Type C Containmeat Local Leak Rate Tests
~
In Section 6.3.2.2 of Chapter 5 of the Requirements Document, it is stated l
that those valves that are in lines designed to be filled with a liquid for at least 30 days subsequent to an accident may be leakage rate tested with a liquid. Liquid leakige is not converted to equivalent air leakage nor added to the Type C testing total, but is reported as liquid leakage. The staff finds this acceptable, providing that:
Such valves have been demonstrated to have fluid leakage rates that do not exceed their design leakage rates, j
The installed isolation valve seal-water system fluid inventory is j
sufficient to ensure the sealing function for at least 30 days at a pressure of 1.10 P, (calculated peak pressure).
j Therefore, contingent upon inclusion of these provisions in Section 6.3.2.2 of
]
Chapter 5 of the Requirements Document, the staff finds this acceptable.
Appendix J to 10 CFR Part 50 requires that Type C tests be performed during l
each reactor shutdown for refueling, but in no case at intervals greater than j
' 2 years. The Requirements Document provides that the maximum interval between l
Type C tests be 30 months rather than the 24-month interval currently required by Appendix J.
This is based on the expectation that there would not be any significant increase in the average leakage rate from all valves subjected to Type C testing if the test interval were to be increased to 30 months.
In Sectfen C.1 to Chapter 5 of the Requirements Document, the Steering Comittee provided the rationale for this proposal which is considered an optimization issue in tenns of risk, occupational exposure, and costs. Additionally, the staff notes that the Requirements Document proposes administrative controls, and no cr*:stinuous or periodic short-duration checks of containment integrity.
However, supporting data (e.g., long-term deterioration of seals and valve seats) from operating experience or experiments with appropriate analyses has not been provided to justify this deviation from the Appendix J requirement.
On the basis of its review of the information provided, the staff is unable to conclude that the proposed change to the Type C test interval is acceptable.
j i
i EPRI Chapter 5 DSER 6-6 July 1989
Therefore, this is an open item that must be satisfactorily addressed before the staff can complete its review of Chapter 5 of the Requirements Document.
See also Section C.1 of this report.
6.4 Fission Product Leakage Control The Requirements Document states that a function of the fission proouct leakage control ystems (FPLCS) and structures is to limit the potential re-lease of radioactive materials that would result from postulated accidents so that the resulting offsite doses are less than the guideline values of 10 CFR Part 100 and the control room personnel exposure limits are less than the limits of GDC 19. The detailed design of the system and the evaluation of the radiological consequences from postulated accidents is not within the scope of the Requirements Document because several of the key values used in the analytical model are site dependent, such as containment design, containment isolation system, building and equipment arrangement, and meteorological fac-tors. However, the Requirements Document does specify some system interface requirements. For example, the Requirements Document states that the FPLCS i
function shall include collecting and processing of the fission products released through the identified and unidentified leakage paths during design-basis events.
In addition, the Requirements Document states thht the FPLCS
- boundary and/or those internal components that house or through which high-energy lines pass should be designed to acconnodate the failure of such lines.
Leak-before-break technology will be used in the analyses. The staff's evaluation of EPRI's leak-before-break approach is provided in the draft safety evaluation report on Chapter 1, dateo September 1987.
The Requirements Document provides that the analysis of the pressure and j
temperature response of FPLCS boundary to a LOCA and the radiological consequences from postulated accidents, including fuel-handling accidents, be based on realistic assumptions.
However, the Requirements Document has not proviced the detailed justifications for the use of best estimate instead of the conservative analyses provided by the guidelines of SRP Section 6.5.3.
Therefore, on the basis of its review, the staff has not been able to conclude that the Requirements Document provides appropriate interface requirements consistent with SRP Section 6.5.3, " Fission Product Control Systems and EPRI Chapter 5 DSER 6-7 July 1989
i Structures." Therefore, this is an open item that must be satisfactorily addressed before the staff can cc:nplete its review of Chapter 5 of the Requirements Document.
6.5 Combustible Gas Control The following discussion is an evaluation of the combustible gas control features proposed in the Requirements Document. These items are also addressed in Section B.8 and C.3 of Chapter 5 of the Requircaents Document.
6.5.1 Metal-Water Reaction and Rydrogen Concentrai. ion The Requirements Document specifies that:. (1) the means for hydrogen control must be capable of handling an amount of hydrogen equivalent to that generated from oxidatiun of 75 percent of the fuel cladding surrounding active fuel and (2) the hydrogen concentration inside containment shall be controlled to ensure that the uniformly distributed concentration does not exceed 13 percent under dry conditions or that the atmosphere is rendered non-combustible. The Comission has stated that advanced designs should, at a minimum, meet the requirements set forth in 10 CFR 50.34(f). Although this section of the regulations was originally written for a select group of plants whose
- construction permits were pending as of February 1982, 10 CFR Part 52 established these requirements to be a minimum standard for future plants. By letter dated September 15, 1988, the Steering Committee provided further justification for the Re pirements Document approach. The staff's evaluation of this issues follows.
The requirements of 10 CFR 50.34(f) specify that a hydrogen control system that can safely accomodate hydrogen generated by the equivalent of a 100-percent fuel-cladding metal-water reaction must be provided in the design of nuclear plants for which the regulation is applicable. Additionally, the regulation specifies that the hydrogen control system must be designed to ensure that uniformly distributed hydrogen concentrations in the containment do not exceed 10 percent, rather than the 13 percent specified by the Requirements Document, or that the postaccident atmosphere will not support hydrogen combustion.
EPRI Chapter 5 DSER 6-8 July 1989
Aside from the issue of regulatory compliance and applicability, the staff concluces that compliance with the criteria of 10 CFR 50.34(f) remains appropriate for combustible gas control design in ALWRs.
Research(discussed in NUREG/CR-4551) indicates that in-vessel hydrogen generation associated with core-damage accidents may range from approximately 40-95 percent active cladding oxidation equivalent. The amount of cladding oxidation is dependent on a variety of parameters related to sequence progression: reactor coolant system pressure, reflood timing and flow rates, as well as core-melt progression phenomena. Thus, a 75-percent-equivalent cladding reaction continues to be viewed as a reasonable design basis for hydrogen generation for severe accidents in which the reactor pressure vessel (RPV) remains intact. flowever, it is the staff's view that ALWRs should provide protection for hydrogen generation resulting from a wider spectrum of accidents, i.e.,
full core-melt accidents with RPV failure.
In that context, it is also necessary to consider ex-vessel hydrogen generation as a result of core debris reacting with available water or core-concrete interactions. Calculations j
using the CORCON models indicate that if the core debris is cooled in relatively rapid fashion (1-2 hours), then additional hydrogen generation will be less than that equivalent to a 25-percent cladding oxidation reaction.
This relatively limited ex-vessel reaction is conditional on the existence of a coolable debris bed and the availability of sufficient water.
If extensive
" core-concrete interaction occurs due to the absence of cavity flooding, then more hydrogen generation shou % be considered. Considering the effects discussed above, the staff concludes that an equivalent 100 percent cladding i
oxidation reaction is an appropriate deterministic design criteria and a reasonable surrogate for the combination of both in-vessel and ex-vessel hydrogen generation.
l Therefore, the staff concludes that the Steering Committee has not provided sufficient justification for an exemption to the rule nor has it providea a sufficient basis for not including mitigation capability in the ALWR design criteria for a potentially threatening early containment loading phenomenon.
This is an open item that must be satisfactorily addressed before the staff can complete its review of Chapter 5 of the Requirements Document.
1 EPRI Chapter 5 DSER 6-9 July 1989
6.5.2 Radiolytic Hydrogen Generation In a letter dated April 4, 1988 (in response to Question No. 450.6), the staff questioned the ALWR's proposed provisions for hydrogen control in inerted plants.
In its response dated August 16, 1988, the Steering Committee replied that specific analyses have not been perfonned for the ALWR design but that on the basis of the findings described in NEDO-22155, " Generation and Mitigation of Combustible Gas Mixtures in Inerted Mark I Containments," it is expected that recombiners will be unnecessary for the BWR ALWR due to inerted operation. The response also stated that Section 6.5.2.6 of Chapter 5 of the Requirements Document requires the plant designer to define a suitable scheme of postaccident hydrogen control. The staff notes that NED0-22155 only applies to inerted Mark I containments and thus may not be applicable to the ALWR design.
Section 6.5.2.6 of Chapter 5 of the Requirements Document is applicable to both PWRs and BWRs and, as indicated above, does not specifically define recombiner requirements or alternative hydrogen control provisions for ALWR designs. Compliance with SRP Section 6.2.5 and regulatory requirements cannot be evaluated. Therefore, the staff concludes that the Requirements Document should be expanded to identify the means for acconnodating radiolytically 4
~ generated hydrogen and oxygen or should clarify its position that it will be left to the designer. If it is to be left to the designer, the staff will evaluate the information provided as part of design certification applications. This is an open item that must be satisfactorily addressed before the staff can complete its review of Chapter 5 of the Requirements Document. See also Sections E.8 and C.3 of this report.
6.5.3 Inerting/ Igniters i
The Requirements Document provides the option for use of inerting as a means of combustible gas control.
Inerting is an acceptable means of combustible gas control.
In the event the plant designer chooses to inert the containment, the designer must ascertain that.during postaccident conditions the amount of oxygen generated by radiolysis or introduced from other sources will not oduce oxygen concentrations which would deinert the containment EPRI Chapter 5 DSER 6-10 July 1989
t atmosphere so that deflagration or even detonation of the accumulated hydrogen could take place. The amount of oxygen generated from these sources depends on plant design, and plant-specific analyses will be required during the facility design phase. The staff will evaluate the plant-specific analyses as part of the design certification application of a specific design to ensure compliance with this position.
If a deliberate ignition system (i.e., igniters) is selected for combustible gas control, safety-related equipment will be required to be capable of surviving the potential deflagrations to which it might be exposed. The Requirements Document does not provide guidance regarding the timing of igniter activation in the event of an accident.
It is the staff's position that such a deliberate ignition system should be activated early in the accident sequence, but no later than before local or global detonable concentrations develop (either directly or through deinertion of the containment by containment spray and/or steam). The staff concludes that the Requirements Document should provide appropriate guidance regarding the timing of igniter activation in the event of an accident. This is an open item that rust be satisfactorily addressed before the staff can complete its review of Chapter 5 of the Requirements Document. See also Sections B.8 and C.3 uf this report.
6.6 Severe-Accident Requirements On December 13, 1988, the staff sponsored a meeting with representatives of the nuclear power industry and the general public to discuss the staff's and industry's approach to resolution of severe-accident issues for ALWRs. During this meeting, the staff presented alternative approaches that were being considered to address various severe-accident challenges.
Since the December 1988 meeting, the staff has continueo to develop its positions on severe-accident criteria. The Steering Committee's approach to resolution of these issues as described in Section 6.6 of Chapter 5 of the Requirements Document has been evaluated for consistency with the current staff positions.
The staff's evaluation of those features proposed in the Requirements Document to address severe-accident concerns follows. These features, and the staff's evaluation of them, are applicable to both PWRs and BWRs.
EPRI Chapter 5 DSER 6-11 July 1989
6.6.1 Containment Margin Section 6.6.2 of Chapter 5 of the Requirements Document specifies that ultimate pressure and temperature capabilities of the containment shall be sufficient to ensure meeting the ALWR public safety goal. The Requirements Document states that a non-linear structural analysis of the ultimate pressure capability of the containment will be performed to establish the margin to failure, or the ultimate capability may be determined by experimental data.
The Requirements Document further states that consideration will be given to possible interactions between the containment and Jther structures which could produce leakage paths to relieve containment pressure in the analysis.
Severe-accident containment loads will be detemined using MAAP and other appropriate severe-accident codes. Severe-accident thermal and pressure loads to be considered include (1) hydrogen and other non-condensible gases, (2) drywell/ cavity heating resulting from high-pressure ejection of core debris, (3) core debris / water interaction, (4) decay heat generation, and (5) thermal radiation heat.
In its letter dated August 16, 1988, in response to Question 450.4, the Steering Committee noted that these loads will not be added to other loads, such as seismic, because severe-accident analyses are to be performea on a realistic, best-estimate basis and the probability of a seismic load occurring concurrent with a severe accident is extremely low.
The staff concludes that best-estimate analytical methods, with appropriate consideration of uncertainties, are acceptable for severe-accident analyses.
However, the staff has not completed its review regarding the sumation of severe-accident loads to other loads. The staff will address this issue when it reviews Appendix A to the Requirements Document, "PRA Key Assumptions and Groundrules Document."
6.6.2 Cavity / Pedestal Drywell Configuration, Debris Coolability To limit direct containment heating, the Requirements Document states that the cavity / pedestal /drywell configuration should be designed to preclude entrainnent of core debris by gases ejected from a failed reactor vessel. To promote long-term debris coolability, the Requirements Document states that 2
the cavity floor should be sized to provide 0.02 m per MWt. The Requirements EPRI Chapter 5 DSER 6-12 July 1989
r
,i i
Document specifies that the containment should be designed to ensure adequate water supply to the floor and that an alternate means of introducing water into the containment, independent of normal and emergency ac power, should be i
provided. Passive schemes for providing flooding of the floor areas beneath the vessel are proposed and described in general terms for both BWRs and PWRs.
The Requirements Document also states that the steel shell or liner of the containment should be protected from core debris by at least 3 feet of concrete.
The staff concludes that reactor vessel depressurization capability and cavity j
design features to entrap ejected core debris constitute an acceptable j
approach to the issue of high-pressure melt ejection.
However, specific design criteria for these features have not yet been provided. The staff concludes that the Requirements Document should include a requirement that reactor cavities be arranged in such a manner that high-pressure core debris ejection resulting from vessel failure will not impinge on the containment boundary.
In addition, the staff concludes that the issue of core debris interactions and coolability has not been satisfactorily addressed. The 2
acceptability of the cavity sizing criteria (0.02 m per MWt) proposed in the Requirements Document is still under evaluation by the staff. The position taken in the Recuirements Document is based on a heat transfer model with
' crust breakup assumptions which have considerable uncertainty. Without assurance of core debris coolability, the level of protection afforded by a 3-foot thickness of concrete and the issue of vessel pedestal attack require further evaluetion. The staff notes that experiments are in progress which are intended to provide adottional data regarding core debris coolability.
The staff will continue to evaluate the issue of core debris coolability as more data and information becomes available. The staff also intends to further assess the debris flooding schemes proposed by EPRI on a design-specific basis. Analyses of debris coolability should assume that the entire core leaves the vessel.
In addition, the staff concludes that the Requirements Document should include a requirement that ALWRs should provide the capability to flood the containment to a level equivalent to the elevation of the top of the active core.
The Requirements Document should identify the external water sources suitable for the task.
EPRI Chapter 5 DSER 6-13 July 1989
i Details of the reactor cavity and drywell configurations are presented in Chapter 6 of the Requirements Document, which the staff is currently reviewing.
The staff will address this issue in its review of Chapter 6.
See also Section 6.6.5 of this report for the staff's evaluation of the safety depressurization and vent system (SDVS).
6.6.3 Containment Heat Removal The Requirements Document states that containment heat removal should be providad using systems provided for mitigation of DBAs.
For BWRs, this will be accomplished by suppression pool cooling using the residual heat removal system. For PWRs, this will be accomplished through the use of the containment spray system (fan coolers will not serve this function).
10 CFR Part 52, by reference of 10 CFR 50.34(f), requires future plants to
" provide one or more containment penetrations, equivalent in size to a single 3-foot diameter opening, in order not to preclude future installation of systems to prevent containment failure, such as a filtered vented containment sys tem. The Requirements Document does not address conpliance with this regulation. While the staff anticipates that incorporation of a 3 foot diameter opening is not necessary to satisfy the containment performance guidelines, the
' staff expects EPRI to document justification that can be used in support of an exemption to this requirement. The staff's review of the acceptability of j
the contdinment heat removal provisions provided in the Requirements Document will be performed in conjunction with its review of the containment performance criteria for a severe accident (See Section 2.1 of this report).
This is an open item that must be satisfactorily addressed before the staff can complete its review of Chapter 5 of the Requirements Document.
6.6.4 Fission Product Control l
The Requirements Document states that fission product leakage control and scrubbing capability for severe accidents will be provided by the systems provided for mitigation of design-basis accidents.
EPRI Ch6pter 5 DSER 6-14 July 1989
The staff concludes that taking credit for systems intended prirarily for mitigating design-basis events (i.e., cooling water systems, containment spray systems, and fission product barriers) in demonstrating that the public safety goal is met and adequate severe-accident mitigation is provided is acceptable, provided it is demonstrated that this equipment can function under severe-accident cor.ditions.
The staff's position with respect to equipment survivability ender severe-accident conditions is discussed in Section 6.6.6 of this report. This is an open item that must be satisfactorily addressed before the staff can complete its review of Chapter 5 of the Requirements Document.
6.6.5 RCS Depressurization Capability The Requirements Document states that a safety-grade RCS safety dcpressuri-zation and vent system (SDVS) will be provided.
In Section 5.5 of this report, the design requirements of the SDVS dre described (see also Section B.10 of this report).
As stated in Section 6.6.2 of this report, the staff concludes that reactor vessel depressurization capability combined with cavity design features to entrap ejected core debris constitute an acceptable approach to the issue of high-pressure core-melt ejection. However, the Requirements Document does not specify a criterion for the depressurization rate of the SDVS. The staff concludes that the capacity of the depressurization system should be defined by design-basis accident requirements as well as by requirements that exceed the design basis (including primary feed and bleed during a total loss of feedwater and severe-accident scenarios) and should be taken into consideration during the development of accident management procedures.
During a high-pressure core-melt scenario, the RCS depressurization system should provide a rate of RCS depressurization to preclude molten-core ejection and to reduce RCS pressure sufficiently to preclude creep rupture of steam generator tubes.
For PWRs and for any design with a non-inerted containment, primary systems should have the capability to be depressurized shortly after loss of design-basis decay heat removal to avoid induced steam generator tube rupture and to avoid a rapid release to the containment of large quantities of hydrogen produced in-vessel which could have the potential for overwhelming EPRI Chapter 5 DSER 6-15 July 1989
l the igniters upon vessel failure.
This is an open item that must be satisfactorily addressed before the staff can complete its review of Chapter 5 of the Requirements Document. See also Sections 5.5 and 8.10 of this report.
6.6.6 Equipment Survivability The Requirements Document st.ctes that equipment important for managing a severe accident will be "specit:ed to licensing design basis events requirements" but will not necess,.rily meet DBA polity standards. The Requirements Document further state 3 that the designer / applicant should perform an assessment of operating mt.rd ns to provide " reasonable assurance that the equipment can function during severe accident conditions for a defined period of time (i.e., hours or days)." Equipment will be located to avoid areas of potential standing hydrogen flames.
In its letter dated August 16, 1988, responding to Question No. 720.2, the Steering Comittee indicated that the IDCOR approach will be used in the assessment. The IDCOR methodology is described in a letter from A. E. Scherer to F. J. Miraglia dated September 9,1988 (ARSAP Topic Paper Set 4).
The staff agrees that features provided for severe-accident protection only (not required for DBA) should not be subject to 10 CFR 50.49 environmental
' qualification requirements,10 CFR Part 50 Appendix B quality assurance requirements, and 10 CFR Part 50, Appendix A redundancy / diversity requirements. However, mitigation features must be designed to operate in the severe-accident environment for which they are intended and over the time span for which they are neuded. The staff concludes that the Requirements Document should specify a criterion that severe-accident mitigation equipment should be capable of being pcwered from an alternate power supply as well as from the normal Class IE onsite systems. (The electrical systems described in the Requirements Document appear to meet this criterion). A demonstration of j
i equipment survivability should also consider the circumstances of applicable i
initiating events (e.g., station blackout, earthquakes) and the environment (e.g., pressure, temperature, radiation) in which the equipment is relied upon to function. Appendices A and B to RG 1.155, " Station Blackout," provide additional guidance on quality assurance activities and specifications which are appropriate for equipment utilized to prevent and mitigate the EPRI Ch6pter 5 DSER 6-16 July 1989
i consequences of severe accidents. This is an open item that must be satisfactorily addressed before the staff can complete its review of Chapter 5 of the Requirements Document.
6.6.7 Containment Mixing Provisions Chapter 6 of the Requirements Document (" Containment Mixing," Section 4.3.2.5) describes geometrical configurations inside the containment to reduce the probability of hydrogen flame acceleration and deflagration-to-detonation transition. Hydrogen generation and ignition are discussed in Sections 2.0, 6.5, and B.8 of this report. The staff will address the issue of containment atmosphere mixing in its review of Chapter 6 of the Requirements Document.
6.6.8 Severe-Accident Management It has long been recognized by both the NRC and industry that while reactor design is in itself extremely irportant in providing protection against the threat of severe accidents, operator intervention could also have a major impact in reducing accident risk. Given appropriate training and certain modest equipment features for accident management, including accident monitoring instrumentation, there could be significant opportunities for operator action in both precluding complete core meltdown and mitigation of an accident that has progressed to meltdown and vessel failure.
In early 1988, a cooperative effort was initiated with participation by the NRC, HUMARC, EPRI, i
i and other industry representEtives to explore what practical means could bc identified for implementing an overall accident management scheme. As an 4
outcome of this effort, SECY 89-12 was issued early this year outlining the NRC's program plan for accident management.
It is planned to publish a generic letter in late 1990 that will provide utilities with guidance on accident management developed jointly by the NRC and industry participants in this program. The Requirements Document provides no comitment to utilize the severe-accident management information resulting from the program, specifically design information such as identification of equipment useful for I
accident management.
EPRI Chapter 5 DSER 6-17 July 1989
b Therefore, the staff concludes that the Requirements Document should include a requirement that ALWRs shall have a severe-accident management program. This is an open item that must be satisfactorily addressed before the staff can complete its review of Chapter 5 of the Requirements Document.
6.6.9 Externally-Initiated Severe Accidents Evidence from previous PRAs and other severe accident studies indicates that externally-initiated severe accidents can represent a significant contribution to overall plant risk. By letter dated July 3,1989. EPRI submitted Appendix A to Chapter 1 of the Requirements Document, entitled "PRA Key Assumptiuns and Groundrules," which includes information on the applicant's proposed approach for addressing external events. The staff will address the results of its review of this subject when it reviews Appendix A.
l l
l l
l i
l l
EPRI Chapter 5 DSER 6-18 July 1989
i 7 BWR MITIGATION / CONTAINMENT REQUIREMENTS 7.1 Introduction Section 7.0 of Chapter 5 of the Requirements Document specifies mitigation requirements applicable to the BWR version of the ALWR. The Requirements Document states that the containment system for the ALWR BWR includes a pressure-suppression pool, drywell, wetwell airspace, and drywell/wetwell vent system in a steel-lined, reinforced-concrete containment vessel. A reactor building is integral with and surrounds the primary containment, serving ar, a fission product leakage control barrier. The Requirements Document provides j
that the containment system, operating in conjunction with other plant I
systems, must limit fission product leakage from a postulated loss-of-coolant accident to values no greater than those required to meet both the control room operator limits of GDC 19 and the offsite dose limits of 10 CFR Part 100.
I BWR containment reverse pressurization protection is described in Chapter 6 of
]
the Requirements Document and will be evaluated during the review of that chapter. The BWR secondary containment function is provided by the fission product leakage control system described in Section 6.4 of Chapter 5 and Section 4.4 of Chapter 6 of the Requirements Document. The results of the staff's review of that system will be addressed when the staff reviews Chapter 6.
l 7.2 Performance Requirements J
Sections 7.2.5 and 8.1.2.4 of Chapter 5 of the Requirements Document provide that containment subcompartment pressure capability be evaluated in accordance with Section 3.0 of Appendix A to Chapter 1 of the Requirements Document.
This section indicates that the leak-before-break criterion is to be used to eliminate the need to consider the dynamic effects of pipe breaks, including rapid subcompartment pressurization. Although the recent revision to GDC 4 allows this approach to be taken and therefore is acceptable for the narrow case of design-basis accidents (DBAs), the staff is concerned with subcompartment performance during accidents that go beyond DBAs. For example, the capability of the reactor cavity design to mitigate severe accidents may l
EPRI Chapter 5 DSER 7-1 July 1989 L------------ ------
4 be jeopardized by the literal application of this approach. The staff j
concludes that EPRI should address the affect of this approach with respect to severe-accident mitigation. This is an open item that must be satisfactorily addressed before the staff can complete its review of Chapter 5 of the Requirements Document.
1 Section 7.2.2 of Chapter 5 of the Requirements Document states that the containment design conditions will be based on the limiting double-ended guillotine break (LOCA). Since the BWR has no external recirculation system, a
the DBA LOCA will not be a recirculation line break. The Requirements l
Document states that leak-before-break methodology may be utilized where possible in subcompartment pressurization analyses consistent with the " broad j
scope rule" modification to GDC 4 (Ref: 53 FR 11311 Supplementary Information).
Section 7.2.24 of Chapter 5 of the Requirements Document states that main j
steam isolation valve (MSIV) leakage is assumed to be 500 to 1000 scfm. The EPRI Program Office has indicated that this is a typographical error ("scfm" should be "scfh").
This value, nevertheless, represents a significant increase with respect to current practice.
In addition, the need for an MSIV leakage control system is an open item in the review of Chapter 3 of the
- Requirements Document. The staff concludes that insufficient justification j
has been provided to support the proposed MSIV leakage rate. This is an open item that must be satisfactorily addressed before the staff can complete its review of Chapter 5 of the Requirements Document.
By letter dated March 18, 1988, the staff stated that the criteria for maximum allowable suppression pool bypass leakage should be addressed in the Requirements Document.
In its letter dated August 16, 1988, the Steering Committee described provisions to reduce or eliminate bypass leakage and indicated that Section 7.2.17 of Chapter 5 of the Requirements Document will be revised to require a vacuum breaker system design which will preclude steani bypass or, as an alternative, consideration of reverse vent clearing. These provisions are intended for mitigation of design-basis accidents without reliance on containment spray enabling the containment spray system to be designed to non-safety-grade standards. The staff does not accept this EPRI Chapter 5 DSER 7-2 July 1989
1 position. Since the ALWR BWR design requirements do not provide for j
safety-related fan coolers, the BWR design, in the absence of ESF-grade sprays, does not provide for any active containment atmosphere heat removal system that would be designed to the requirements of an ESF system (e.g.,
Quality Group B, seismic Category I). The staff concludes that an ESF containment spray system is a necessary component in a pressure-suppression containment design because of the benefits associated with mitigation of steam bypass as well as reduction of the containment atmosphere temperature following steamline breaks (in which the containment atmosphere is i
superheated). Since spray systems also mitigate the consequences of certain pooldynamicloadphenomena(chuggingloads)andprovideforeffective 4
containment atmosphere mixing, the staff concludes that containment sprays are sufficiently important to warrant the more stringent requirements i
associated with ESF systems. Therefore, this is an open item that must be satisfactorily addressed before the staff can complete its review of Chapter G of the Requirements Document. See also Section 4.4 of this report.
7.3 Ecufpment Design Requirements Section 7.3 of Chapter 5 of the Requirements Document requires the suppression pool and associated airspace to be enclosed. This feature, provided by a l
~
teel diaphragm lined floor, is intended to prevent the potential spread of c
racioactivity in the pool water into operating areas and to keep the pool water from being contaminated by material falling into the pool.
It also provides for separation of the containment from equipment areas required to be accessible during operation, making practical the use of inerting for combustible gas control. The Requirements Document specifies that the suppression pool will be sized to accommodate the DBA without an " upper pool
]
dump" as required by the Mark III containment design.
For severe-accident
'tigation, capability will be provided to gravity dump a limited amount of the suppression pool water into the lower drywell in order to provide core debris cooling as described in Section 6.6 of this report. The staff finds these features acceptable, subject to final staff review of more detailed information during the review of a design-specific application.
EPRI Chapter 5 DSER 7-3 July 1989
i 8 PWR MITIGATION / CONTAINMENT REQUIREMENTS 8.1 Primary Containment The Requirements Document states that the PWR containment should be designed to provide a leak-tight barrier to prevent uncontrolled release of radioactivity in the event of a postulated accident. The Requirements Document describes the PWR containment as a "large, dry type containment."
Chapter 6 of the Requirements Document further indicates that a steel-cylindrical type is preferred.
The Requirements Document states that a containment spray (CS) system to provide containment heat removal and fission product control functions should be included in the design.
The Requirements Document states that:
The containment design pressure and temperature must be equal to or greater than the pressure and temperature conditions resulting from postulated loss-of-coolant, steam line, or feedwater line break accidents.
The containment must accommodate the thermal and pressure loads expected during a severe accident using best estimate analysis.
The containment shall have sufficient free internal volume to ensure that the concentration of hydrogen inside the containment is less than 13-percent by volume, based on uniformly distributed concentrations of hydrogen generated by the equivalent of a 75-percent-active fuel cladding-water reaction during an accident.
To satisfy the requirements of GDC 16 and 50 regarding sufficient design margin for plants at the construction permit stage of review, SRP 5ection 6.2.1.1.A, "PWR Dry Containments, Including Subatmospheric Containments,"
states that the containment design pressure should provide at least a 10-percent margin above the accepted calculated containment pressure following i
a loss-of-coolant accident or a steam or feedwater line break.
In Section 2.4.1.3 of Chapter 5 of the Requirements Document, the Steering Committee EPRI Chapter 5 DSER 8-1 July 1989 t
)
states that at the preliminary design stage, a margin shall be provided between calculated peak pressure and design pressure of 10-percent for dry containments and 15-percent for pressure-suppression containments. On the l
basis of its review, the staff finds that Requirements Document requirement
}
for the containment design pressure acceptable. The staff's evaluation of the
)
requirements for hydrogen concentration and generation is discussed in Sections 2.3 and 6.5 of this report.
i l
The Requirements Document provides that the containment be designed to ensure l
that adequate protection exists from external pressure conditions that may result, for example, from inadvertent operation of containment heat removal i
systems. The staff finds that Requirements Document external pressure design j
criterion conforms with the NRC criteria as described in SRP Section 6.2.1.1.A l
and is, therefore, acceptable.
l Section 8.1.3.2 of Chapter 5 of the Requirements Document requires that j
instrumentation be provided to monitor conditions within the containment following an accident. This instrumentation shall include capability for l
measuring containment radioactivity, pressure, temperature, and in-containment j
refueling water storage tank (IRWST) level. The staff finds that Requirements l
Document criterion for instrumentation related to containment functional I
j
' design conforms with the NRC acceptance criterion as described in SRP Section 6.2.1.1.A and is, therefore, acceptable.
?
i i
j Containment Design Leak Rate j
s l
Under present review criteria, containment design leak rate is not a fixed 1
l maximum value, but is selected as that value which, in combination with other i
plant and site parameters, would give calculated doses not exceeding the values given in 10 CFR Part 100 as a result of the accident postulated and i
evaluated using Regulatory Guide 1.4.
Typical containment design leak rates 1
l are 0.1 - 0.2 percent per day for current-generation single-containment PWRs.
)
Under the criteria of Regulatory Guide 1.d, containment leakage is assumed to be the maximum allowed by the facility's technical specifications for the j
first 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> of an accident release, and one-half that value for the remainder of the accident.
}
l EPRI Chapter 5 DSER 8-2 July 1989 i
I i
In Sections 1.2.3.5 and 8.1.2.5 of Chapter 5 of the Requirements Document, the Steering Committee states that (1) the containment leak rate allowance must be 0.5 percent per day or greater at design pressure in order to provide more operating flexibility for containment leak rate testing and associated maintenance, while still meeting 10 CFR Part 100 dose criteria for design-basis events, and (2) the containment leakage varies as a function of containment pressure. These positions represent significant relaxations of containment leak rate. Although the rationale in the Requirements Document for the position stated in Section 8.1.2.5 of Chapter 5 notes that the containment features will be selected to minimize leakage, the incentive to increase leakage to 0.5 percent per day is also stated to include a reduced need to maintain valve leakage integrity and avoid lost power generation associated with the inability to satisfy containment integrated leakage rate requirements. The staff is concerned that, in large measure, the basis for these relaxations comes from the applicotion of new source-term approaches (see Section C.2 of this report). The staff will review this issue in concert with its review of the source-term issues. This is an open item that must be satisfactorily addressed before the staff can complete its review of Chapter 5 of the Requirements Document. See also Sections 8.2 and C.2.5 of this report.
Sections 7.2.5 and 8.1.2.4 of Chapter 5 of the Requirements Document provide
- that containment subcompartment pressure capability be evaluated in accordance with Section 3.0 of Appendix A to Chapter 1 of the Requirements Document.
This section indicates that leak-before-break criterion is to be used to eliminate the need to consider the dynamic effects of pipe breaks, including rapid subcompartment pressurization. The staff's evaluation of this issue is provided in Section 7.2 of this report.
8.2 Containment Spray System The Requireoxt; Document states that the function of the containment spray system (CSS) h to reduce the containment temperature and pressure following a LOCA or secondary system pipe rupture accident inside the containment by removing thermal energy from the containment atmosphere.
In addition, the Requirements Document states that the CSS should be designed to remove fission products from the containment atmosphere in order to reduce the inventory of EPRI Chapter 5 DSER 8-3 July 1989
fission products available for leakage from the containment. The Requirements Document states that the CSS should consist of an IRWST which is shared by two independent,100-percent-capacity trains.
Each train should contain a containment spray (CS) pump, a heat exchanger, a suction line from the IRWST, a discharge line to the containment spray headers, and associated piping, valves, instrumentation, and controls.
The Requirements Docui..cnt provides that the containment spray pumps be identical to the RHR pumps.
Interconnections should be provided to permit the use of an RHR pump as a backup to a CS pump if a CS pump is out of service. In addition, the Requirements Document provides that the CSS design shall ensure that required pump NPSH is available for all operating conditions. Supporting analyses shall account for suction piping and other head losses.
No credit shall be taken for coolant subcooling or elevated containment pressure. The Requirements Document states that the IRWST level shall be assumed to be at the minimum value calculated during CSS operation, assuming worst case instrumentation errors. The Requirements Document stipulates that the suction connection to the IRWST shall be designed to ensure that vortexing cannot occur.
On the basis of its review, the staff finds that the provisions discussed
- above are consistent with the guidance of SRP Section 6.2.2, "Ccntainment Heat Removal Systems," and are therefore acceptable.
In its letter dated August 16, 1988, responding to Question No. 480.2, the Steering Committee indicated that Section 8.2.2.1.1 of Chapter 5 of the Requirements Document will be revised to more clearly define the design basis for the capacity of the containment spray system. The revised requirement will specify that the system must have sufficient capacity to reduce containment pressure to less than 50 percent of containment design pressure (as opposed to peak accident pressure) within 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> after a postulated accident.
EPRI's approach represents a deviation from the SRP and is under consideration by the staff. The staff requires further justification regarding the applicability of the lea'( test acceptance criteria in order for it to complete its review. This is an open item that must be satisfactorily EPRI Chapter 5 DSER 8-4 July 1989
i i
I addressed before the staff can complete its review of Chapter 5 of the Requirements Document. See also Sections 8.1 and C.2.5 of this report, Section 8.2.2.2.2 of Chapter 5 of the Requirements Document specifies that the j
spray water will not contain additives for w intaining basic pH in order to l
enhance iodine removal. Recent research has concluded that, because of the chemical forms of the iodine fission products, spray additive is unnecessary for iodine removal purposes. As indicated in Section C.2 of this report, the elimination of additive is consistent with the December 1988 revision of SRP Section 6.5.2 and is acceptable. However, the Steering Comittee has not addressed Branch Technical Position 6.1 which requires chemical additives for I
postaccident pH control to prevent corrosion of austenitic stainless steel.
This is an open item that must be satisfactorily addressed before the staff can complete its review of Chapter 5 of the Requirements Document. See also i
Section C.2.1 of this report.
Section 8.2.3.9.2 of Chapter 5 of the Requirements I,ocument specifies a fouling factor of 0.0005 for the design of CS heat exchangers. The staff questioned the Steering Committee on the selection of this value.
In its August 16, 1988 response to the staff's questions, the Steering Comittee indicated that 0.001 would be used for the CS heat exchanger. The staff
- concludes that a fouling factor of 0.001 is acceptable based en consistency with Standard T-2.41 of the Tubular Heat Exchangers Manufacturers Association.
In its August 16, 1988 letter, the Comittee also comitted to revise Section 8.2.3.13.2 of Chapter 5 of the Requirements Document to specify the capability for manual (in addition to automatic) actuation of the containment spray system. This is consistent with IEEE-279. Therefore, contingent upon completion of this action, the staff concludes this is acceptable.
8.3 Fission Product Removal and Control System The fission product removal and control function for the PWR is provided by the containment spray system described in Section 8.2 above.
EPRI Chapter 5 DSER 8-5 July 1989
9 CONCLUSION Chapter 5 of the Requirements Docunent specifies requirements that, subject to resolution of the identified open items, if properly translated into a design in accordance with the NRC regulations in force at the time of submittal, should result in a nuclear power plant that will have all the attributes required by the regulations to ensure that there is no undue risk to the health and safety of the public or to the environment.
In addition to complying with existing regulations, such a facility would also be consistent with Commission policies for severe-accident protection and public safety goals.
EPRI Chapter 5 DSER 9-1 July 1969
APPENDIX A DEFINITIONS Appendix A of Chapter 5 of the Requirements Document contains definitions of terms and acronyms. The staff did not evaluate this appendix.
s, s
EPRI Chapter 5 DSER A-1 July 1989
APPENDIX B GENERIC SAFETY AND LICENSING ISSUE TOPIC PAPERS B.1 ISSUE D.2 - EMERGENCY CORE COOLING SYSTEM CAPABILITY FOR FUTURE PLANTS Issue: This issue was initiated by the ACRS in 1972 to ensure that appropriate efforts are made to provide a basis for optimization of emergency core cooling systems (ECCSs).
It involves the exploration of new approaches to ECCS design.
ALWR Proposal: The Requirements Docurient contains no requirements specifically intended to resolve this issue for ALWRs.
It is the Steering Comittee's position that this issue is resolved by the general design improvements being specified for ALWRs. These include (1) additional thermal hydraulic margins for utility investment protection, (2) enhanced divisional separation, (3) best-estimate design for no fuel damage with a 6-inch diameter LOCA, (4) target design for no fuel damage with a 12-inch diameter LOCA, (4) three divisions of ECCS (BWRs), (5) direct vessel injection for BWR low-pressure coolant injection, (6) an in-containment refueling water storage tank (for PWRs), and (7) four redundant 50-percent-capacity trains of direct vessel
- safety injection (for PWRs).
)
Staff Findina: This issue has been prioritized " DROP" on the basis that implementation of the Commission's Severe Accident Policy Statement will address the safety concerns. Thus, the Requirements Document comitment to satisfy the policy statement requirenents (Section 1.2.4.1 of Chapter 5 of the Requirements Document) is an acceptable resolution of this issue for ALWRs.
i l
B.2 ISSUE II.E.4.3 - CONTAINMENT DESIGN-INTEGRITY CHECK i
Issue: Following an outage, a plant could inadvertently be returned to operation without all access openings being closed. This issue originated with the discovery at a nuclear power plant in 1979 that two 3-inch f
containment exhaust valves had been lef t open for approximately li years. To
\\
EPRI Chapter 5 DSER B-1 July 1989
l ensure containment integrity, an independent means should exist for directly verifying containment integrity during plant operation.
l ALWR Proposal: The EPRI-proposed resolution of this issue is through the incorporation of design features to enhance administrative control of containment integrity.
In addition to the leak rate testing performed to satisfy regulations, the Requirements Document states that specific design features will focus on reducing the probability of a containment penetration l
being inadvertently left open. The Requirements Document states that by l
clearly identifying all isolation valves, ensuring easy access for verification, providing better position indication, and including fail-safe
)
design features, the probability of a large penetration being left open is j
substantially reduced.
Staff Finding: The staff assessment (NUREG-1273) of Generic Safety Issue II.E.4.3, " Containment Integrity Check," generically resolved the issue for operating reactors and questioned the cost benefit of a backfit for current operating plants that would require a continuous or short-term periodic gross check of containment integrity.
However, such a system would not be a backfit for an ALWR, Also, it is not clearly evident, from the information presented i
in the Requirements Document, that ALWRs of evolutionary design will have a j
significantly reduced number of containment penetrations. The staff considers that the next generation of LWPs should have an imp-)ved capability to detect inadvertent containment bypass. The staff concic es that the Steering Comittee should address the concerns stated aLove. This is an open item that must be satisfactorily addressed before the staff can complete its review of Chapter 5 of the Requirements Document.
B.3 ISSUE 93 - STEAM BINDING OF AUXILIARY FEEDWATER PUMPS (PWRs)
Safety Significance:
In current PWR plants, the emergency / auxiliary feedwater (EFW) system is isolated from the main feedwater system by a series of check valves. On several occasions heated main feedwater leaked into the EFW system through those valves, flashed to steam, and caused steam binding of the EFW pumps. The potential for comon-mode failure is present because the pumps are connected by way of comon suction piping.
EPRI Chapter 5 DSER B-2 July 1989
ALWR Proposal: The Requirements Document approach to the resolution of this issue is two-fold. The primary approach is to alert the operator to conditions that are indicative of a potential for steam binding, so that appropriate action can be taken before the onset of steam binding in any EFW j
pumps. To achieve this, the Requirements Document requires that means be provided to detect potential EFW pump steam binding as a result of steam / hot water leakage through check valves in the pump discharge lines.
This is to be detected by monitoring the temperature of a portion of the discharge piping upstream of the check valves, with indication and alarm in the control room.
Appropriate vents are also to be provided for removal of steam in the event steam binding occurs. The Requirements Document also requires that the EFW system consist of two subsystems, each containing one motor-driven pump, one j
turbine-driven pump, one EFW storage tank and associated piping, valves, instrumentation, and controls. This arrangement of four pumps in two trains is intended to minimize cross-connections between individual trains, and thus will minimize the potential for common-mode failure due to steam binding.
Staff finding:
The staff generically resolved this issue for operating reactors by issuing Generic Letter 88-03. The ALWR proposal complies with the generic resolution and is therefore acceptable.
B.4 EMERGENCY FEEDWATER SYSTEM DESIGN (PWRs)
Issues:
Issue 122.la, Davis-Besse Loss of All Feedwater Event - Common Mode Failure of Auxiliary Feedwater Pump Discharge Isolation Valve Closed Position Issue 122.1b, Davis-Besse Loss of All Feedwater Event - Excessive Delay in Recovery of Auxiliary Feedwater Issue 122.lc, Day
.Besse Loss of All Feedwater Event - Adequacy of Emergency Procedures. Operator Training and Available Plant Monitoring Systems Issue 124, Auxiliary Feedwater System Reliability EPRI Chapter 5 DSER B-3 July 1989
Issue 125.II.7, Long-Term Generic Actions as a Result of the Davis-Besse Event of 6/9/85 - Reevaluate Provisions to Automatically Isolate Feedwater From Steam Generator During Line Break Issue 125.11.11, Long-Tern Generic Actions as a Result of the Davis-Besse Event of 6/9/85 - Recovery of Main Feedwater as Alternative to AFW S_afety Sionificance: A function of the auxiliary feedwater (AFW) system in the majority of the current plants is to supply water to the secondary side of the steam generators (SGs) during system fill, normal plant heat-up, normal plant hot standby, and normal plant cold shutdown. The AFW system also functions following loss of normal feedwater flow, including loss due to offsite power supply failure, and provides emergency feedwater following such postulated accidents as a main feedwater line break or a main steam line break.
l The loss of all feedwater at Davis-Besse resulted in an NRC investigation of the event. The hvestigation indicated that the potential inability to remove decay heat from the reactor core was due to questionable reliability of the l
EFW system caused by any or all of the following:
loss of all auxiliary feedwater cue to connon-mode failure of the AFW pump discharge isolation valves to open excessive delay in recovery of auxiliary feedwater due to difficulty in restarting AFW pump steam-driven turbines once they tripped In addition, the investigation of the event indicated that (1) a two-train system with a steam turbine-driven AFW pump may not be able to achieve the desired level of reliability and (2) the provision te automatically isolate j
AFW from a steam generator affectea by a main steam or feedwater line break l
may tend to increase the risk that adequate decay heat removal is not available rather than to decrease it.
ALWR Resolution: The Requirements Document approach to the resolution of these issues is through the provision of an EFW system that has a EPRI Chapter 5 DSER B-4 July 1989 l
l
I substantially improved capability over that of typical current plants. The approach simplifies the system design and substantially reduces the potential for comon-mode failures. This approach differs from current designs in that the EFW system is a dedicated safety-related system that has no function for normal operation. To achieve these, the Requirements Document provides that:
A safety-grade supply of feedwater should be provided of sufficient volume to permit safe cold shutdown, based on:
(1) a main feedwater line break without isolation of EFW flow to the affected steam generator for 30 minutes, (2) refill of the intact steam generators, (3) 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> of operation at hot stcadby conditions, (4) subsequent cooldown of the reactor coolant system within 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> to conditions which permit operation of the RHR, anc (5) continuous operation of one reactor coolant pump.
The EFW system should enploy two non-condensing steam turbine-driven pumps and two electric mctor-driven pumps. Any two pumps for four steam generator plants and any one pump for two steam generator plants must be capable of satisfying the fl u requirements for licensing design basis-accident conditions. Any single pump must be capable of satisfying the flow requirement for best-estimate evaluations of core damage frequency.
This design approach is significantly different from the two-train steam turbine-driven AFW pumps employed at Davis-Besse.
Each turbine-driven pump should be supplied with steam only from the steam generator it supplies with feedwater.
A cavitating venturi should be provided in the discharge line to each steam generator to prevent pump cavitation due to runout and also to minimize other potentially adverse effects of having excessive EFW flow.
The rate of opening of the steam supply valves to the turbine-driven pumps must be limited to the extent required to ensure reliable startup of the pumps.
EPRI Chapter 5 DSER B-5 July 1989
J Restart of the turbine-driven pumps following an overspeed trip must be facilitated by ensuring ready access to pumps, by labeling the components required to reset the overspeed trip, and by requiring the manufacturer to provide a clear set of reset instructions to be posted adjacent to each pump. For designs that employ an electronic trip that is set below the mechanical overspeed trip, reset capability from the control room must be provided.
Isolation and flow regulating valves in the turbine-driven pump discharge lines should be capable of performing their safety function independent of normal offsite and emergency onsite ac power. Manual capability should be provided to permit positioning of these valves in the event of a loss of power.
Automatic and manual initiation of emergency feedwater flow will be provided. The EFW control system must have a safety-grade actuation feature which would feed the steam generator at a maximum rate for steam generator water level below the minimum steam generator water level assumed in the plant safety analysis.
The steam generator system should be designed so that actuation of the EFW is not required for at least 20 minutes following the point at which the low-level set point is reached.
The minimum flow delivered to the steam generators under licensing design basis-accident conditions should ensure adequate heat removal from the rea ctor coolant system.
The minimum flow delivered to the steam generators should ensure adequate heat removal from the reactor coolant system for best-estimate evaluations of core damage frequency.
The plant designer will define the mass and energy input to the containment resulting from fluw of EFW to the affected steam generator following a main steam line break and is to ensure that this is accounted for in the containment design. Operator action to terminate flow for EFW l
EpRI Chapter 5 DSER B-6 July 1989
5 to the affected steam generator should not be assumed before 30 minutes.
The system should not rely on automatic isolation of EFW to prevent containment overpressurization.
The plant designer must perform an analysis of each automatic control loop of the EFW system to demonstrate capability for stable operation over the full range of operating conditions.
Staff Evaluation: The ALWR proposec resolution satisfactorily addresses the j
staff's auxiliary feedwater system reliability concerns and is acceptable.
The staff will ensure the acceptability of the analyses performed by the designer / applicant discussed above.
B.5 HIGH/ LOW-PRESSURE INTERFACE DESIGN Issues:
Issue 96, RHR Suction Valve Testing Issue 99, RCS/RHP, Suction Line Valve Interlock on PWRs
^ Issue 105, Interfacing System LOCA at BWRs Issue 120, On-Line Testability of Protection Systems (Leakage Testing of Pressure Isolation Valves)
Safety Significance: The comon concern in these issues is that either test errors, valve leakage, or multiple valve failures could permit overpressurization of low-pressure systems connected to high-pressure systems.
Pipe rupture resulting from overpressurization could result in loss of decay heat removal or containment bypass failure.
ALWR Proposed Resolution:
For BWRs, the Requirements Document states that low-pressure systems which could be overpressurized by the RCS should be designed to withstand full RCS pressure without structural fai. lure (i.e., 500 psig 9 360 degrees F). Pressure isolation valve instrumentation and controls EPRI Chapter 5 DSER B-7 July 1989
should be provided to (1) prevent opening shutdown cooling connections to the vessel in any loop when the pool suction valve, discharge valve, or spray valves are open in the same loop, (2) prevent opening the shutdown connections to and from the vessel whenever the RCS pressure is above the shutdown range, J
j (3) automatically close shutdown connections when RCS pressure rises above the shutdown range, and (4) prevent operation of shutdown suction valves in event of a signal that the water level in the reactor is low.
For PWRs, the Requirements Document states that low-pressure systems which could be overpressurized by the RCS should be designed to withstand full RCS pressure without structural failure (i.e., 900 psig 9 400 degrees F). Relief valves, sized to protect against overpressure transients, should be provided on the RHR system. RHR suction valves should te provided with pemissive interlocks to prevent opening if RCS pressure exceeds RHR design pressure.
The Requirements Document states that RHR isolation valve controls must provide that the valves be closed and opened by operator action only. There should be no auto-closure fratures on the interlocks. See Section 5.2 of this report relating to protection against loss of decay heat removal during mid-loop operations.
Staff Evaluation: The staff concludes that these design features of low-pressure systems to withstano full RCS pressure, and elimination of the auto-closure feature of PWR permissive interlocks, are acceptable. However, the staff notes that, in addition to specifying these features, the Requirements Document should also specify for PWRs that: (1)valveposition indication should be available in the control room when isolation valve operators are deenergized and (2) high-pressure alams should be provided to warn control room operators when rising RCS pressure approaches the design pressure of attached low-pressure systeas and both isolation valves are not closed. This is an open item that must be satisfactorily addressed before the staff can complete its review of Chapter 5 of the Requirements Document.
The staff notes that for some low-pressure systems attached to the RCS, it may not be practical or necessary to provice a higher system ultimate pressure capability for the entire low-pressure connected system. The staff will EPRI Chapter 5 DSER B-8 July 1989
l evaluate these exceptions on a case-by-case basis during specific design certification reviews.
The staff will review inservice testing programs and technical specifications for ALWR applications to ensure that pressure isolation valves are adequately tested. Plant administrative controls and training requirements will be
]
reviewed during the each facility's operating license review.
B.6 ISSUE 117 - ALLOWABLE OUTAGE TIMES FOR DIVERSE, SIMULTANEOUS EQUIPMENT OUTAGES Safety Significance: Simultaneous outages of components appearing in the same accident sequence, even though not involving manifestly redundant divisions of the same system, can give rise to high risks that do not warrant imediate shutdown. Operators are frequently called upon to pass judgement upon the j
acceptability of taking components out of service for maintenance or surveillance, as well as to track compliance with technical specifications.
They need more help than current documentation or training gives in identifying such high-risk outage combinations.
\\
j ALWR Proposed Resolution: The Steering Comittee indicates that high-risk
~ combinations of equipment inoperability will be identified in the PRA. These PRA insights will be available for use in the development of technical i
specifications.
Staff Evaluation: By letter dated November 22, 1988, the staff indicated that the technical specifications should be developed, where practicable, upon risk and reliability considerations. Therefore, the staff concludes the EPRI approach to development of the technical specifications is acceptable.
B.7 ISSUE 132 - RHR PUMPS INSIDE CONTAINMENT Safety Significance: RHR pumps located inside the containment that have not been qualified for a harsh environment cannot be given credit in licensing analyses for providing long-term decay heat removal.
EPRI Chapter 5 DSER B-9 July 1989
1.
4 ALWR Proposed Resolution: The Requirements Document specifies that all RHR pumps should be located outside the containment.
Staff Evaluation: The ALWR proposal satisfactorily resolves the issue.
B.8 HYDROGEN CONTROL Issue A-48, flydrogen Control Measures and Effects of Hydrogen Burns on Safety Equipment Issue 121, Hydrogen Control for Large Dry Containments Safety Significance:
Regulatory requirements relating to DBA hydrogen generation may not be adequate with respect to severe accidents.
For the unlikely event of a degraded-core accident, scenarios have been postulated that result in the release of large quantities of hydrogen to the containment.
fiydrogen in significant quantity can be formed as a result of the reaction of zirconium fuel cladding at high temperature with steam. Experience gained from the THI-2 accident indicates that design capability may be required for handling larger hydrogen releases than was previously assumed.
In addition, the Industry Degraded Core Rulemaking (IDCOR) Program also identified the need
- to detennine the effect of hydrogen burns on safety-related equipment in containments that are not inerted. This consideration has been the subject of experimental research projects.
ALWR Proposed Resolution: The approach being taken by the Requirements Document to control the hydrogen generated by a spectrum of postulated accidents is to require that the ALWR be able to accomodate the design basis-accident conditions with an acceptable level of margin under the dominant severe accident sequences.
Hydrogen control systems are to be provided to prevent the buildup of a detonable mixture of hydrogen and oxygen. The Steering Comittee assumes that the hydrogen concentration inside the containment is to be limited to 13 percent by volume, based on uniformly distributed concentration of hydrogen generated by the equivalent of a 75 percent active fuel cladding zirconium oxidation during an accident.
EPRI Chapter 5 DSER B-10 July 1989
I Staff finding: On the basis of its review and evaluation, the staff finds that the proposed approach to the resolution of GSI A-48 and GSI-121 is not acceptable. See Sections 2.3, 6.5, and C.3 of this report for the staff's evaluation of this issue.
B.9 ISSUE A STATION BLACK 0UT Discussion: " Station blackout" means the complete loss of alternating current (ac) electric power to the essential and nonessential switchgear buses (i.e.,
loss of offsite electric power system concurrent with turbine trip and unavailability of the onsite emergency ac power system).
10 CFR 50.63, which l
became effective July 21, 1988, requires that each light-water-cooled nucle 6r power plant licensed to operate must be able to withstand station blackout for a specified duration and recover from it.
1 l
Section B.9 of Chapter 5 of the Requirements Document addresses station
{
blackout for the ALWR.
It identifies the key ALWR requirements that are
{
"pplicable to station blackout. The most pertinent of these is the requirement that systems be provided to maintain the plant in a safe condition during a station blackout for 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br />, assuming mechanistic system performance and best-estimute analytical methods without a single f ailure in addition to
~ station blackout. The staff questioned the Steering Committee on the use of
- mechanistic system performance and best estimate analytical methods" in the ALWR 8-hour station blackout analyses, pointing out that these techniques may nut always be conservative enough to provide the assurance needed that an ALWR can meet the requirements of the rule.
In a letter dated September 15, 1988, the Steering Comittee responded that the 8-hour blackout requirement specified in Section 2.3.3 of Chapter 5 of the Requirements Document is an ALWR plant investment protection requirement, selected to provide additional margin in the ALWR design. The Steering Comittee stated that the analyses that will be conducted for this 8-hour l
investment protection event will be consistent with the performance evaluation basis (i.e., using realistic, best-estimate methods that eliminate exr.ess conservatism and mechanistic calculations that are based on actual phenomena occurring in the event) and will not necessarily be the same as the coping EPRI Chapter 5 DSER B-11 July 1989
analysis utilized to comply with the station blackout rule. The Steering Comittee stated that the coping analyses which will be conducted to confirm compliance to the station blackout rule for the ALWR will be consistent with the guidance provided in NUMARC 8700 and Regulatory Guide (RG) 1.155.
The Steering Committee also stated in its response that the comittee viewed the station blackout evaluation called for by 10 CFR 50.63 as part of the risk evaluation basis portion of the ALWR Design Bases. The risk evaluation basis, which uses PRA methods, is not consistent with the use of NUMARC 8700 and RG 1.155. The staff spoke to EPRI program staff representatives regarding this and they indicated it was not intended that the ALWR PRA be used to demonstrate compliance with the station blackout rule but that the methodology of NUMARC 8700 and RG 1.155 be used.
==
Conclusion:==
On the basis of the statements that mechanistic system performance and best estimate analytical methods are directed toward the investment protection aspect of station blackout rather than to the licensing aspect and that the analysis used to confirm compliance to the rule will be consistent with the guidance provided in NUMARC 8700 and RG 1.155, the Steering Comittee's proposed method of analysis for station blackout is considered acceptable. Because determination of the actual coping duration
- and the ALWR capability to recover during that period is partially dependent on site-specific characteristics, the subject station blackout analyses required to demonstrate compliance with 10 CFR 50.63 will necessarily be plant-specific. However, the staff is preser tly reviewing Chapter 11 of the Requirements Document which provides additional electrical design details that relate to station blackout.
In that chapter, EPRI is proposing a separate and diverse alternate ac power source (combustion turbine generator) that will have the capability to power station-blackout loads. This will provide a separate means of coping with a station blackout in addition to the 8-hour investment-protection coping capability addressed here. A detailed evaluation of the proposed alternate ac power source will be provided in the staff's evaluation of Chapter 11 of the Requirements Document. See also Section 2.2 of this report.
EPRI Chapter 5 DSER B-12 July 1989
l l
B.10 SHUTDOWN DECAY HEAT REMOVAL Issue A-45, Shutdown Decay Heat Removal Requirements Safety Significance: USI A-45 raised the concern that current licensing requirements relating to shutdown decay heat removal systems may not be l
adequate to ensure that nuclear power plants do not pose an unacceptable risk l
to the public.
ALWR Proposal: Section B.10 of Chapter 5 of the Requirements Document identifies the reliability enhancements being specified for ALWRs. The ALWR PRA will be used to demonstrate that the ALWR meets the core damage frequency safety goal of 1.0x10-5 per reactor-year.
l Evaluation: The staff finds the Requirements Document comitment to provide a l
PRA to be equivalent to the USI A-45 resolution requirement for an IPE dnalysis as required for existing facilities. This comitment is therefore an acceptable resolution of A-45 for ALWRs.
Issue 70, FORY and Block Valve Reliability (PWRs)
- Safety Significance: As a part of the resolution of GSI-70, the staff identified certain safety-related functions that may be performed by PORVs on PWR plants. These are:
(1) mitigating a design-basis steam generator tube rupture accident (2) low-temperature overpressure protection of the reactor vessel during ste.rtup and shutdown (3) plant cooldown in compliance with BTP RSB 5-1 (4) reactor coolant system venting In addition, the staff noted that PORVs also provide safety-related functions for events thht exceed the design basis, such as for feed-and-bleed cooling.
EPRI Chapter 5 DSER B-13 July 1989 i
l
For new construction PWR plants that require any of these safety-related functions, the staff recomended that a minimum of two safety-grade PORVs and block valves and associated controls be provided. This would include redundant and diverse control systems, design to seismic Category I requirements and environmentally qualified, increased technical specification surveillance requirements, increased inservice testing requirements, inclusion within the scope of a cuality assurance program that is in compliance with Appendix B of 10 CFR Part 50, power from Class IE buses, and valve position indication provided in the control room.
ALWR Proposed Resolution: Chapter 5 of the Requirements Document establishes requirements for a safety-grade safety depressurization and vent system (SDVS) for PWR ALWR plants. The SDYS includes those valves and piping needed to establish flow paths from the pressurizer steam space and reactor vessel upper head to the in-containment refueling water storage tank, includir,g associated controls, instrumentation, and supports. The valves will be operable under station blackout conditions and from outside the control room. The SDVS is designed to perform the following functions:
(I) Provide a means to depressurize the reactor coolant system following a steam generator tube rupture.
(2) Provide a means to depressurize the reactor coolant system in the event that the main and auxiliary pressurizer spray is unavailable during natural circulation cooldown to cold shutdown.
(3) Provide a means to vent non-condensible gases from the pressurizer, reactor vessel upper head, or other reactor coolant system high points.
(4) Provide a capability to rapidly depressurize the reactor coolant system to initiate a prirary system feed and bleeo for the beyond licensing cesign bases event of total loss of feedwater.
(5) Provide a capability to depressurize the reactor coolant system in response to a high-pressure severe-accident scenario.
EPRI Chapter 5 DSER B-14 July 1989
l With the exception of low-temperature overpressure protection (LTOP) of the reactor vessel during startup and shutdown, the SDVS is a dedicated safety-grade system that is capable of performing those safety-related functions that can be performed by PORVs on current generation PWRs. The SDVS also has the capability to perform other safety functions for events beyond the design bases as noted above.
The LTOP function for the ALWR PWRs is to be provided by the RHR pressure-relief system.
Information on LTOP protoction and a commitment to revise appropriate chapters of the ALWR Requiruents Document is provided in Chapter 3 of the Requirements Document (Sectir,n 3.3.2) and E. E. Kintner's letter to Lester S. Rubenstein, dated March 28, 1988. The staff, in a letter dated September 23, 1988, accepted the comitment noted above as resolution of the LTOP issue. The staff will ensure the Requirements Document is revised to reflect this information.
Staff Evaluation:
It is the staff's understanding that during normal plant operation and for events of moderate frequency PWR reactor coolant systems will be depressurized by means of the non-safety-grade main spray system when the reactor coolant pumps are in service. A non-safety-grade auxiliary spray system will provided as a backup for use when the reactor coolant pumps are not operating.
On this basis, the staff concludes that the GSI-70 resolution is consistent with the NRC staff positions on the issue.
However, as discussed in Section 6.6.5 of this report, the staff concludes that the Requirements Document should specify a criterion for the depressurization rate of the SDVS.
Therefore, this remains an open item that must be satisfactorily accressed before the staff can complete its review of Chapter 5 of the Requirements Document. See Sections E.5 and 6.6.5 of this report for further discussion.
Issue 84, CE PORVs Safety Sionificance: Power-operated relief valves (PORVs) are installed on the pressurizers of many, but not all, PWRs to reduce challenges to the safety valves. Those PORVs also provide depressurization capability and feed-and-EPRI Chapter 5 DSER B-15 July 1989
bleed capability.
In facilities not having PORVs (CE plants), safety-grade depressurization capability is provided by pressurizer spray, but feed-and-bleed capability is lacking.
ALWR Proposal: PWR ALWRs will not have PORVs. Instead, the Requirements Document calls for a single-failure-proof depressurization and vent system (SDYS).
Staff Evaluation: The SDVS system will allow feed-and-bleed cooling which should acceptably resolve Issue 84 for the ALWR. However, as discussed in Section 6.6.5 of this report, the staff concludes that the Requirements Docunent should specify a criterion for the depressurization rate of the SDVS.
Therefore, this remains an open item that must be satisfactorily addressed before the staff can complete its review of Chapter 5 of the Requirements Document. See Sections 5.5 and 6.6.5 of this report for further discussion.
l EPRI Chapter 5 DSER B-16 July 1989 i
APPENDIX C l
OPTIMIZATION SUBJECTS l
l Chapter 5 of the Requirements Document specifies requirements for engineered safety systems that are needed to prevent or mitigate the effects of core damage accidents.
Included in this appendix are the plant optimization subjects which have been mentioned earlier in Section 1.3.
These are individually dis-cussed and evaluated in the discussion that follows:
l C.1 TYPE C CONTAINMENT LEAKAGE RATE TESTING INTERVAL It is the position of the Steering Committee that the maximum interval between Type C local leak rate tests be 30 months rather than 24 months as currently required by 10 CFR 50.54(o). The ALWR will have a refueling cycle length of 24 months. The Steering Connittee believes that a Type C test interval of at least 30 months is needed to avoid the necessity of shutting down the facility solely to perform Type C local leak rate tests. Otherwise, it may be necessary to subject the facility to the increased risks, and personnel to the increased exposure, associated with testing at power. The Optimization Paper cites the economic benefits of a 24-month refueling cycle, the. reduced
" occupational radiation exposure associated with longer test intervals, and the relatively minor overall effect on risk should the longer test interval result in increased containment leakage.
In the latter regard, NUREG/CR-3539,
" Impact of Containment Building Leakage on LWR Accident Risk," is cited.
l stating that an increase in containment leakage from 0.1 percent to 1.0 percent every 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> would increase the overall risk by 1.5 percent.
4 On the basis of its review of the information provided, the staff is unable to conclude that the proposed change to the Type C test interval is acceptable.
The staff's evaluation of this issue is provided in Section 6.3.3 of this report.
l EPRI Ch6pter 5 DSER C-1 July 1.989 1
C.2 SOURCE-TERM ISSUES The ALWR Utility Steering Comittee discussion regarding source-tenn issues is given in Sections 1.2.3 and C.2, "ALWR Treatment of Source Term Issues," of Chapter 5 of the Requ.rements Document. These sections note the use of design-buis :wident source terms and dose calculations in the licensing process and indicate the importance of Regulatory Guides 1.3 and 1.4 in providing the source-term and dose-calculation licensing basis. The Steering Comittee points out that TID-14844, " Calculation of Distance Factors for Power and Test Reactor Sites," which provides some of the major assumptions regarding the use of accident source terms in the licensing process, was issued in 1962. The Steering Comittee also points out that extensive l
research has been done on fission product behavior since TID-14844 was issued, j
and especially since the Three Mile Island accident in 1979. The Steering l
Comittee then states that the ALWR licensing design-basis source term requirements should be based on the full body of current knowledge, and that i
the requirements should provide a realistic treatment of fission product source tenns resulting in an improved design from the standpoint of limiting public health effects in a reactor accident.
l The NRC staff has been aware of the extensive research being conducted on accident phenomena and fission product behavior.
In 1985, the NRC staff began an internal review to examine the impact of new research information and to identify potential changes to regulations and regulatory staff practices that could be affected by changes in accident source term knowledge.
In a paper to the Comission (SECY 86-76, dated February 28,1986), the staff discussed the l
regulatory utilization of improved information on source terms and identified 10 areas of potential changes in terms of short-term, intermediate-term, and long-term changes. Potentialshort-termchangesincluded(1) revised treatment of severe accidents in near-term environmental impact statements, (2) removal of spray additives in PWRs, and (3) credit for fission product scrubbing in BWR suppression pools.
Potential intermediate-term changes I
included (1) emergency planning, (2) containment leak rates, (3) control room habitability and air filtration requirements,.(4) environmental qualification of equipment, and (5) safety issue evaluation.
Potential long-term changes l
identified included (1) siting and (2) accident monitoring and management.
l l
EPRI Chapter 5 DSER C-2 July 1989
Although Chapter 5 of the Requirements Document notes that the final l
resolution of source terms and dose calculations to be used in licensing is beyond the scope of the ALWR program and is being pursued separately by both NRC and industry, the Steering Comittee believes that some early research
)
results are available and describes the ALWR program position with regard to the source-term issues listed below.
C.2.1 Deletion of PWR Containment Spray Additive Steering Comittee Position:
In Section 1.2.3.1 of Chapter 5 of the 4
I Requirements Document, the Steering Comittee notes that previous regulatory practice called for a chemical additive in PWR containment spray solutions to raise the pH of the spray solution. The purpose was to enhance the solubility of elemental iodine in the spray droplets.
The Steering Comittee also states that recent research shows that the vast majority of volatile fission products released will be in particulate form, and that the containment spray additive is unnecessary and should be deleted. Also, fission product removal rates by the spray should be established based on curront research.
Staff Evaluation: The review of the PWR spray system as a fission product removal system is covered in SRP Section 6.5.2.
The staff issued a revision
- of SRP Section 6.5.2 in December 1988. The revision acknowledges that a chemical additive is not necessarily required curing spray injection but that pH control should be maintained for the sump solution during postaccident conditions. The deletion of spray additive for the ALWR is consistent with the revised SRP and is acceptable. Although the staff has revised SRP Section 6.5.2, the staff has not established a revised position regarding quantities and chemical forms of radioactive material assumed to be released in the DBA LOCA. Until such time, Regulatory Guide 1.4 (June 1974) assumptions continue to apply. The revised SRP Section 6.5.2 provides fission product cleanup models that can be used with either Regulatory Guide 1.4 or with current best-estimate fission product releases.
It is noted that the Requirements Document does not specify chemical additives for long-term containment sump pH control. This feature is normally provided by baskets of trisodium phosphate suspended in the sump. Although the EPRI Chapter 5 DSER C-3 July 1989
proposed design of the ALWR does not include a recirculation sump, chemicals could be readily located in other locations where they would be dissolved by containment spray. The staff concludes that the Steering Committee should address Branch Technical Position 6.1, which requires containment sump pH control. The staff's evaluation of this issue can be found in Section 8.2 of this report.
The revised SRP Section 6.5.2 states that for sump solutions having a pH less l
than 7, molecular iodine should be conservatively assumed to evolve into the i
containment atmosphere. The staff concludes that the Requirements Document should include a requirement that the ALWR fission product cleanup analyses should reflect the effect of reduced pH consistent with the revised SRP l
Section 6.5.2. methodology. This is an open item that must be satisfactorily addressed before the staff can complete its review of Chapter 5 of the Requirements Document.
C.2.2 Deletion of Charcoal Adsorbers Steerino Committee Position: The Steering Comittee states that activated j
j charcoal filters in BWR standby gas treatment systems and other PWR ventilation systems are requirea for many areas in which fission products
' could potentially be released. The Steering Comittee states these are required solely for the removal of elemental iodine, are complex, and have been difficult to operate and test. The Steering Comittee also states that recent research shows that the amount of elemental iodine expected to be l
released in an accident is small enough that charcoal filtration is j
unnecessary, and that reference to charcoal has been deleted in the i
Requirements Document with regard to fission product filtration systems.
Staff Evaluation:
In SECY 86-76, the staff has identified air filtration systems as an area of potential change based on source-term research. Recent research indicates that the fraction of fission product iodine present in elemental and organic forms may be lower than that specified in present regulatory guidance (Regulatory Guides 1.3 and 1.4), but may still be at a level at which some charcoal filtration is warranted.
Further, this research also indicates that the quantity of airborne material (radioactive and EPRI Chapter 5 DSER C-4 July 1989 l
non-radioactive aerosols) expected to be produced in accident sequences of interest could be large in comparison to the retention capacity of the HEPA filters in present engineered safety features air filtration systems.
Finally, many filter systems are also used to process activity released during normal opeNtion during which charcoal may be useful. The staff intends to pursue potential changes in air filtration systems resulting from source-term research as indicated in SECY 86-76, but concludes that the complete removal i
of charcoal in air filtration systems, as stated in the Steering Comittee position, is presently unjustified.
In particular, it is noted that there are large uncertainties with regard to gaseous iodbie production due to IRWST pH changes, hydrogen burns, and irradiation of othei chemical forms of iodine.
Therefore, the staff concludes that the need for activated charcoal filters in appropriate ALWR ventilation systems must be evaluated as part of the overall development of the updated analytical methodology for the source term to be used on ALWRs. This is an open item that must be satisfactorily addressed before the staff can complete its review of Chapter 5 of the Requirements Document.
C.2.3 BWR Suppression Pool Fission Product Scrubbing Steerine Committee Position: The Steering Comittee has indicated that
- previous licensing practice did not recognize scrubbing of fission products by a BWR suppression pool and that recent research has shown such scrubbing to be effective. The Requirements Document takes the position that a j
decontamination factor for radionuclide scrubbing by BWR suppression pools should be credited on the basis of evaluations of accident sequences using the MAAP code and decontamination factors determined from SUPRA, SPARC, or other technically defensible methods.
Staff Evaluation: Regulatory Guide 1.3 (Position C.1.f.) allows no credit for retention of iodine by a BWR suppression pool. However, the stuff has issued a revised SRP Section 6.5.5 dated December 1988, entitled " Pressure Suppression Pools as Fission Product Cleanup Systems.* The essential feature of this revised section is that it recognizes that suppression pools are capable of scrubbing non-noble gas fission products and it would be an undue conservatism to ignore this capability. On the basis of the revised SRP EPRI Chapter 5 DSER C-5 Jaly 1989
Section 6.5.5, the staff concludes that credit may be given for suppression pool fission product removal, provided suppression pool decontamination factors are evaluated in accordance with the methodology prescribed in the l
revised SRP section. Therefore, the staff concludes that this criterion should be reflected in the Requirements Document. This is an open item that must be satisfactorily addressed before the staff can complete its review of l
Chapter 5 of the Requirements Document.
C.2.4 Timing of Fission Product Release l
Steering Committee Position: The Requirements Document notes that present l
licensing practice assumes that design-basis accident fission product releases to the containment atmosphere are assumed to occur virtually instantaneously.
This is claimed to result in containment isolation valve closure times that are shorter than necessary and ventilation fan capacities larger than necessary, based on analysis of sequences expected to dominate the likelihood of core damage. The Requirements Document takes the position that an accidental release of fission products into the containment is assumed to occur no sooner than about I hour after reactor scram. The basis for this assumption is provided in " Technical Basis for ALWR Requirements Document Assumption on Delayed Fission Product Release," prepared by International
^ Technology Corporation in July 1988. This analysis considered a comprehensive set of accident sequences from existing PRAs and PRA-related studies. The analysis initially screened out all accident sequences having a probability of core damage greater than 1.0x10-8 or a core uncovery time of more than I hour.
The remaining sequences were then investigated in detail for applicability to the ALWR design. Each surviving sequence was then analyzed wherein it was determined to (1) be impossible for the ALWR design, (2) have a probability greater than 1.0x10-8, or (3) have a onset of fuel damage beyond I hour.
i Staff Evaluation: For licensing purposes, timing of accide.it fission product releases into the containment is given by Regulatory Guides 1.3 and 1.4, Position C.I.a.
These positions indicate that fission product releases should be assumed to be "immediately" available for leakage from the containment.
In practice, the staff has typically taken this to mean "within 15 seconds" in order to allow for closure of containment isolation valves. The assumption of l
EPRI Chapter 5 DSER C-6 July 1989 i
I the release of the quantity of fission products contemplated by Regulatory Guides 1.3 and 1.4 within about 15 seconds is generally recognized as highly conservative. The staff is in the process of examining recent research to gain insight into the timing of accident fission product releases into containment. This appears to be dependent on the accident sequence as well as the reactor type. Furthermore, the staff has not, at this time, decided whether certain sequences should be excluded from consideration, because they j
are unlikely to dominate the overall likelihood of core damage. For these reasons, the staff believes that some relaxation in the assumed timing of large fission product releases into the containment associated with fuel l
degradation and melting may be warranted, but cannot support the specific value (I hour after scram) proposed in the Requirements Document at the present time. Therefore, the staff concludes that timing of accident fission product releases into the containment should continue to be based on the criteria of Regulatory Guides 1.3 and 1.4, Position C.1.a until sufficient justification is provided for relaxing this criterion. This criterion should be reflected in the Requirements Document.
This is an open item that must be satisfactorily addressed before the staff can complete its review of Chapter 5 of the Requirements Document.
C.2.5 Containment Leakage Rate as a Function of Pressure Steering Counf ttee Position: The Requirements Document states that the ALWR containment leakage rate should be assumed to leak at its technical specification leakage rate at design pressure and et reduced leakage rates at reduced pressures.
Staff Evaluation:
In its letter dated November 22, 1988, the staff has acknowledged that actual containment leakage will vary as a function of pressure. However, the staff needs additional infonr.ation relating to the proposed means of inplementing this change into facility accident analyses assumptions and testing requirements. This is an open item that must be satisfactorily adoressed before the staff can complete its review of Chapter 5 of the Requirements Document.
EPRI Chapter 5 DSER c-7 July 1989
4 N
k l
C.3 HYDROGEN CONTROL See Sections 2.3, 6.5, and 8.8 of this report for the staff's evaluation of this issue.
l i
3 0
EPRI Chapter 5 DSER C-8 July 1989 i
4
es 3
VM I
l l
4 l
.a.'
? s