ML20081K043

Candu 3 Containment Performance & Consequence,

ML20081K043
Person / Time
Site:	05200005
Issue date:	05/14/1994
From:	Dunham R, Sciacca F, Shaffer C ANATECH RESEARCH CORP., SCIENCE & ENGINEERING ASSOCIATES, INC.
To:	NRC
Shared Package
ML20081K038	List: ML20081K043 ML20081K052 ML20081K061
References
CON-FIN-J-2002-3, CON-NRC-03-93-032, CON-NRC-3-93-32 SEA-93-704-01-A, SEA-93-704-01-A:3, SEA-93-704-1-A, SEA-93-704-1-A:3, NUDOCS 9503280376
Download: ML20081K043 (160)

Text

,

SEA 93-704-01-A:3 Technical Evaluation Report  !

CANDU 3 CONTAINMENT PERFORMANCE AND CONSEQUENCE May 15,1994 Clinton J. Shaffer Frank W. Sciacca Science and Engineering Associates,Inc.

Robert S. Dunham I Robert A. Dameron Yusef R. Rashid ANATECH Research Corporation Robert E. Nickell Applied Science and Technology Karl R. Goller SEA Consultant Contract: NRC-03-93-032 Job Code No: J-2002-3 Task Order No: 1 TAC Number: M80975, Containment System M81015, Accident Analysis I

9503200376 950324 I DR ADOCK 05200005 PDR

I.

SEA 93-704-01-A:3 I .

Technical Evaluation Report CANDU 3 CONTAINMENT PERFORMANCE AND CONSEQUENCE May 15,1994 Clinton J. Shaffer Frank W. Sciacca Science and Engineering Associates,Inc.

Robert S. Dunham Robert A. Dameron Yusef R. Rashid ANATECH Research Corporation Robert E. Nickell Applied Science and Technology I

Karl R. Goller I I SEA Consultant I Contract: NRC-03-93-032 -

Job Code No: J-2002-3 Task Order No: 1  !

TAC Number: M80975, Containment System j M81015, Accident Analysis ll l

\

I

_.-_____-_____J

C 0

NOTICE The work reported herein was initiated in support of the issuance of a preapplication safety evaluation report (PSER) for the CANDU 3 design. However, since the CANDU 3 application for design certification is expected in September 1994, the USNRC staff does not plan to continue the previously planned preapplication safety evaluation review identified in SECY-91-161, " Schedules for the Advanced Reactor Reviews and Regulatory Guidance Revisions." Instead the staff is continuing g activities to prepare for a CANDU 3 design certification application by maintaining cognizance of the 5 design, maintaining technical progress on key issues, and conducting computer code development and benchmarking. This report therefore should be viewed as a review of the CANDU 3 documents currently available, as the documents pertain to the containment, in preparation of the design certification review.

Further, the consequence discussions prepared for this report were developed using reactor site criteria dose limits found in 10 CFR part 100. Ilowever, the USNRC staff is currently revising 10 CFR Part 50 and 10 CFR Part 100 to separate siting from source term dose calculations. The revisions to Part 100 being considered by the staff will replace the present individual dose criteria with a population density 3 standard. A fixed minimum exclusion area radius of 0.4 mile is specified. Other criteria regarding population protection and seismic criteria factors are also included in the source term Part 100 revision.

The staff intends that its recommendations for the preapplication review will be compatible with its proposed revisions.

I I

I' I

I I

ii .

B

=

ABSTRACT l

l Science and Engineering Associates, Inc. (SEA) has, under contract to the NRC, reviewed documents pertaining to the Canadian Deuterium Uranium 3 (CANDU 3) reactor design in preparation of the design certification review. These documents were submitted to the NRC by AECL Technologies, the U.S.

sponsors of the design for its designers, the Atomic Energy of Canada, Ltd. (AECL). SEA was contracted to review the documents as they apply to the containment design. Particular attention was paid to issues I unique to CANDU 3 and to areas where design, materials, or acceptance criteria are different from accepted U.S. practice. The report summarizes U.S. design acceptance criteria, differences between U.S.

and Canadian acceptance criteria, the information available for determmmg design acceptability, and additional information needed before acceptability can be determined. Areas where the design does not appear to comply with U.S. design criteria are discussed as areas where additional information or justification is required for acceptance.

I I

I I

I

'I I

I iii I

-. s - m c m - - u. - ,a A E

O

.w e

h I: l I!,

1 l

)

i I!

Ii l l

k

. I:

g.

d I,

Ii ,

iv i

5I 4

el l l

I EXECUTIVE

SUMMARY

The NRC is reviewing the Canadian Deuterium Uranium 3 (CANDU 3) reactor design in preparation of the design certification review. CANDU 3 is being designed by Atomic Energy of Canada, Ltd (AECL) and is sponsored in the U.S. by AECL Technologies. Science and Engineering Associates, Inc. was contracted to review documentation submitted to the NRC by AECL Technologies as these documents apply to the containment design. Particular attention was to be paid to issues unique to CANDU 3 and I to areas where design, materials, or acceptance criteria are different from accepted U.S. practice.

The review approach for the CANDU 3 containment was similar to that for a typical LWR containment.

Although the CANDU 3 reactor design is very different than the conventional LWRs, its steel-lined reinforced-concrete containment structure and the containment functional capabilities are similar to containments licensed in the United States. Review of the CANDU 3 containment design was based on NRC General Design Criteria, the NRC's Standard Review Plan, and the general criterion that the Commission expects, as a minimum, at least the same degree of protection of the public and the environment that is required for current generation LWRs. For the longer term, the Commission expects I designs to provide enhanced margins of safety. The aspects reviewed included the containment structural design, the containment functional design and response to both design basis and severe accidents, and the accident radionuclide source terms and release rates. The following key aspects of this review are discussed in the following paragraphs:

I

• Status of Documentation,

• Canadian Approach to Safety,

• Containment Structural Design,

• Containment Functional Design, and I

• Radionuclide Source Term and Release to the Environment.

Status of Documentation The documentation reviewed was generally deficient in regards to the details needed to perform a comprehensive application review as required by the Standard Review Plan (SRP).

For example, the containment building description consisted of a few sketches, the basic dimensions of height, diameter, and wall thickness, the design pressure, and qualitative discussions. Further, the documentation did not necessarily represent the current CANDU 3 design. In fact, the design described in available documentation was significantly changed between the 1989 Technical Description and the 1992 Technical Outline.

I I v I

E C3 The safety analysis presented in the Conceptual Safety Report (CSR) is described as design-assist safety analysis functioning primarily to provide assistance and input to the design. This analysis presents o;dy minimal results for selected calculations, lacks detailed analytical results needed to evaluate the validity of the source terms to the containment and containment response. The radionuclide behavior analyses presented results for the CANDU 6 design which has a containment spray system and therefore could not be directly applied to CANDU 3 which does not. Severe accident analyses were not available for review.

Most of the computer codes used by the Canadians are CANDU technology specific and probably have not been evaluated by the NRC. The technical basis for the safety of the CANDU 3 design relies heavily upon these computer codes. Descriptions of the models employed by these codes were sparse and a review of all of these codes and their associated experimental verification and validation to ensure conservative results was beyond the scope of this task; however, possible code deficiencies were noted where evident.

The CANDU 3 reactor has several unique features which could influence the source terms to the containment. For example, the CANDU 3 reactor is designed with the capability of being refueled at power. The fuel handling system is still under development and has significant differences from the g CANDU 6 design from which it was derived. Most of the document describing the fuel handling systems pertained to CANDU 6 and it was not always clear regarding the applicability of the discussion to CANDU 3.

Canadian Annroach to Safety The stated Canadian approach to safety includes:

• implementing the defense-in-depth concept to compensate for potential human and mechanical failures, g

• locating seismically qualified safety systems in a separate area from normal 3 plant operation systems, a two diverse independent reactor shutdown systems, and a reliability objectives providing redundancy of active components for every safety system and important process systems demonstrating an unavailability less than 10-8 The goal of safety analysis is to show that the plant has been designed to ensure public health and safety in response to anticipated transients and accidents. An overall severe core damage frequency for CANDU 3 of less of than 10-5/yr is expected based on calculations for previously designed and operated CANDU plants. The containment is designed for an unavailability of not more than 10-8 yr/yr and seismically vi B

I cualified for design basis earthquake (DBE). The Canadian regulations were, however, found to be generally less prescriptive than U.S. regulations.

I Containment Structural Desien The containment structural design and acceptance criteria agree with USNRC design objectives, requirements and acceptance criteria except for the differences and discrepancies cited in Section 4. These differences are of concern because of the extensive and unique USNRC requirements of the ASME Code for concrete containments. While the Canadian requirements I are directed at the same safety objectives and share the same philosophical basis, they are fundamentally different than the USNRC requirements. For example, U.S. concrete containments are designed using the defense-in-depth concept of 4-way reinforcement, i.e., separate reinforcing layers to carry hoop tension, meridional tension, radial shear, and tangential shear, whereas there are no Canadian requirements unique to concrete containments. Also, there are significant design requirement differences related to the Canadian Limit State Method versus the ASME Working Stress Method and various related load factors.

In our opinion, the CANDU 3 documents should have dealt more directly with the many differences between Canadian and USNRC design and acceptance requirements that are cited herein. In particular, the documents should have described how these differences are to be resolved. The design certification I submittal should more fully addresses these issues.

The documents do not address severe accidents or loadings beyond design basis. The Canadian practice of not applying a Probabilistic Risk Assessment (PRA) and consideration of the severe accident vulnerabilities that the PRA exposes along with the insights that may be added to the assurance of no undue risk to the public health and safety does not conform to USNRC requirements. The containment system is one unique feature of all plant designs to which this requirement should be applied because one of the most important uses of the insights gained through beyond design basis assessments is in the design of the containment.

I Since few dimensions or details of the containment structure are available, much of the structural review consists of a comparison of the Canadian and USNRC, i.e., ASME and ACI, requirements. Minor and substantial differences between these requirements are cited. Differences exist in the requirements related to design life, seismic loads, wind and tornado loads, flood conditions, and load combinations. Also, the Canadian requirements do not explicitly address loads due to pressure testing, relief valve actuation, extemal pressure, or flooding. The Canadian requirements for materials, quality control, special construction techniques, and testing and inservice inspection are substantially the same as USNRC requirements.

I Vu I

O o

While many of the important CANDU 3 containment structural design aspects are not yet complete, judging from the Canadian requirements for containment structural design,it is unlikely that the CANDU 3 containment will meet all of the USNRC acceptance criteria. USNRC acceptance will require that either ,

the Canadian requirements be augmented so that they meet USNRC requirements, or the CANDU 3 design and acceptance requirements must be changed to conform to both Canadian and USNRC requirements.

Containment Functional Desien The functional design of the containment isolation system was reviewed.

The USNRC and Canadian design objective and requirements are similar but significant differences were identified. The CANDU practice of accessing containment during normal operation differs from U.S.

practice. The CANDU 3 design located both of its isolation valves outside the containment for lines connecting to the containment atmosphere whereas the U.S. requires one valve inside and one valve outside except in special situations. The CANDU systems are not classified into essential and non-essential systems as required by the SRP. At least one important system requiring isolation, the Recirculated Cooling Water System, is designed with non-nuclear standards. Relaxed isolation requirements are allowed for small diameter lines. An equivalent level-of-safety for these differences was not shown.

The containment heat removal (CHR) capability in the CANDU 3 design is provided by the local air coolers and by the recirculation mode of the ECCS. A containment spray systen. was not included in this duign as was standard for other CANDU containments. The CHR system is not designed or qualified to cope with a DBE-induced LOCA which is not considered a design basis event in the Canadian approach, i.e., the local air coolers are not seismically qualified. The CANDU 3 CHR system is not considered nuclear grade and is only designed to non-nuclear Class 6 standards, whereas the U.S. requires safety-grade standards.

Control of combustible gases in CANDU 3 is provided by mixing, dispersing, and recombination by means of the air coolers and igniters. The complete oxidation of all fuel bundle zirconium could produce a uniformly distributed hydrogen concentration within the containment of about 8%, well below the required 10% specified in 10 CFR 50.34. However, the pressure and calandria tubes contain far more zirconium than do the fuel bundles. If during a severe accident, more than about 8% of zirconium in these tubes were oxidized in addition to all of the fuel bundle zirconium, then the USNRC 10%

containment concentration could well be exceeded. If autocatalytic recombiners are used, the potential efficiency impediment of their relatively slow response time was not discussed.

viii

I he containment is designed, constructed, and provided with the necessary equipment to permit periodic integrated leakage rate tests during the lifetime of the plant including leakage testing at design pressure.

The Technical Description specifies a commissioning test acceptance leakage of 2% of the free containment volume per day, whereas the USNRC regulations specify less than 0.75% per day. The Canadian regulations require a maximum allowable leakage rate from the containment envelope that is the value used in safety analyses which demonstrates that the reference dose limits are not exceeded. The acceptance of the maximum allowable leakage is therefore dependent upon the acceptance of the safety analysis. The maximum allowable leakage rate for CANDU 3 is 5% per day.

He design provides monitoring capabili;y to monitor conditions within the containment and the status of containment equipment, before, during, and after an accident. Instrumentation ranges, accuracies, and responses were not available for review. The documentation made no mention of instrumentation required to monitor the sump water level and temperature.

I The CANDU 3 containment was sized to contain the effluences of a worst case reactor coolant system pipe break. The containment design pressure is 10% greater than the peak calculated pressure which complies I with USNRC acceptance criteria. The capability of the containment to contain a serondary system pipe rupture is, however, less certain. The peak calculated pressure for a 100% steam line break was 15%

greater than the design pressure, which does not comply with USNRC acceptance criteria that specifies a 10% design pressure margin for secondary system pipe ruptures as well as for primary system ruptures.

The calculated containment temperature responses were not available for review. Analytical details and codes were also not available for review.

Limited results of subcompartment analysis for a 100% pump suction break were available for review.

These results suggest that the CANDU 3 containment design will meet USNRC acceptance criteria, I however more details of the containment design, the analyses, and the associated codes will be required before acceptability can be determined.

The documents reviewed indicate that the CANDU 3 design will meet USNRC acceptance criteria relative to containment bypass accidents, however the review was limited to a few piping schematics and discussions so complete acceptability could not be determined. There were no indications of bypass possibilities for which adequate isolation was not provided except possibly the Canadian practice of automatically depressurizing the secondary system to the atmosphere following a LOCA,i.e., our review could not preclude the possibility of steam generator tube ruptures generating a LOCA signal, thereby I providing a direct path from the primary system to the atmosphere, prior to isolation of the steam generator by the operator.

IX I

E O

A unique feature of CANDU reactors is their ability to reft.el at power which is accomplished by a fuel handling machine that attaches itself to the end of individual fuel channels. Wne the machine is attached to a fuel channel, it becomes an extension of the reactor coolant system. When the machine is attached to a port penetrating the containment to transfer fuel out to storage,it becomes part of the containment boundary if the isolation valves are open. When the machine is unattached, it may be operating as a separate cooling system for cooling irradiated fuel. There are no USNRC regulations or guidelines specifically on machines that refuel at power, however existing regulations apply to the various capabilities of the fuel handling machine, i.e., the refueling ports must be equipped with isolating valves 3 and the containment must be able to contain any accident involving the machine. Accidents involving on-power refueling are maintained to have generally less severe consequences than corresponding reactors accidents since a refueling accident involves only a limited number of fuel elements. Safety analysis has been performed for several potential fuel handling accidents. Two rather unique fuel handling accidents were discussed. If an end-fitting on a reactor fuel channel fails, the fuelin that channel will be forcefully ejected out onto the containment floor. Irradiated fuel in the CANDU 3 design temporarily exists in an air environment when passing from the heavy water of the fuel handling machine to the light water of the fuel storage bay. A fuel bundle stuck in this air environment could undergo major damage which was g

reported to have happened. The fuel burdie apparently overheated and disintegrated. Assuming that 5 AEC1/s accident analyses are correct, the CANDU 3 fuel handling system should not impose any special functional requirements on the containment.

The CANDU 3 containment response to severe core damage accidents was not discussed in the documentation and Canadian regulations comparable to U.S. regulations regarding severe accidents were not found. Only minor discussion was found regarding the postulated behavior of a core meltdown.

Therefore, the acceptability of the containment response to a severe accident cannot be assessed from the documentation available for review.

Radionuclide Source Term and Release to the Environment The NRC's reactor site enteria have required that the potential radiological consequences of a postulated accidental release of fission products into the containment be evaluated for an intact containment leaking at its maximum allowable leah rate. The Canadian exclusion zone dose limits are similar to those for the U.S. low population zone. 'Ihe basis for acceptance of the predicted radiological doses will depend heavily upon the acceptance of the Canadian analytical codes and methods. The Canadian radiological dose analyses appear to be based solely on the doses attributed to the isotopes of iodine, krypton, and xenon. Detailed an aysis which is specific to the CANDU 3 design is needed, especially in light of the fact that the CANDU 3 design is apparently the only CANDU design which does not incorporate containment sprays and the existing safety history of CANDU reactors is being used as an argument for the acceptability of the CANDU 3 design. The acceptance of x

I

I the CANDU 3 design in regards to risk to the public will require a more detailed review of their methods and codes for predicting radionuclide transport within, and release from, the containment. The major assumptions used in CANDU 3 safety analyses will have to be substantiated.

Potential problems facing the certification of the CANDU 3 containment are summarized in Table 1 below.

Table 1: Potential Containment Certification Problems

.I

'g Design NRC Acceptance CANDU 3 Design g System or Criteria Component Concrete SRP Section 3.8.1, Canadian standards do not have requirements Structure 10CFR50.55a, comparable to the U.S. requirements for using 4-way GDC 1, 2, 4,16, 50, reinforcement, i.e., separate reinforcing layers to carry

-I ASME Code Article C hoop tension, meridional tension, radial shear, and tangential shear; and Canadian load factors are about 10% lower than U.S. standards E -

g Isolation SRP Section 6.2.4, CANDU 3 design locates both isolation valves outside System 10CFR50.31(f), containment for lines connecting to containment GDC 56 atmosphere whereas the U.S. requires one valve inside and one valve outside except in special situations.

I CANDU 3 systems are not classified into essential and non-essential systems as required in U.S.

.I I

Containment SRP Section 6.2.2, CANDU 3 CHRS is not seismically designed or Heat Removal GDC 38 qualified as required in U.S., i.e., CANDU 3 cannot I cope with DBE-induced LOCA.

Combustible SRP Section 6.2.5, CANDU 3 could significantly exceed the U.S.10%

l Gas Control 10CFR50.34 uniform containment hydrogen concentration limit during severe accident conditions if a significant

)

portion of the pressure and calandria tubes oxidize in addition to all of the fuel bundle zirconium.

m

E o

Design NRC Acceptance CANDU 3 Design System or Criteria Component Leakage SRP Section 6.2.6, CANDU 3 test acceptance leakage rate of 2% per day Testing 10CFR50, Appendix J exceeds the NRC specification of less than 0.75% per E

day. Further, the CANDU 3 r.tahum allowable 5 leakage rate is 5% per day (based on calculated boundary dose limits).

Design SRP Sections A and CANDU 3 containment is designed to contain any Pressure 6.2.1.4, primary system LOCA with a 10% margin for safety, GDC 16 and 50 however, the design pressure is exceeded by 15%

following a 100% steam line break. The U.S. requires a 10% safety margin for secondary line breaks, as well as, primary system LOCAs.

Containment SECY-90-016, This review could not preclude the possibility of steam Bypass SECY-93-087 generator tube ruptures generating a LOCA signal which would initiating secondary crash cooling to the environment, thereby providing a direct path from the primary system to the atmosphere, prior to isolation of the steam generator by the operator.

Response to NRC Policy Statement Information regarding the response of the CANDU 3 Severe on Severe Accidents" containment to severe accidents was not available for Accidents reviewed and Canadian regulations comparable to U.S.

regulations were not found.

Radionuclide 10CFR100.11 Canadian radiological dose analyses based solely on Source Term doses attributed to the isotopes of iodine, krypton, and and Release to xenon. This and other assumptions may not meet U.S.

the standards for release and consequence analyses.

Environment I

I xii 5

I CONTENTS NOTICE ii ABSTRACT iii EXECUTIVE SUhMARY v CONTENTS xiii ACRONYMS xvii I

1.0 INTRODUCTION

1 1.1 Background Information 1 1.2 Statement of Work 1 1.3 Review Approach 1 1.4 Technical Review Participants 3 1.5 Report Format 4 I 2.0 STATUS OF DOCUMENTATION 5 2.1 Prevailing Design 5 I 2.2 Concrete Containment 5 2.3 Containment Source Terms and Containment Response 5 2.4 Radionuclide Source Terms and Release Rates 6 2.5 Design Basis and Severe Accidents 6 2.6 Analysis Methods 6 2.7 Performance of Unique Features 7 I 3.0 CANADIAN APPROACH TO SAFETY 9 3.1 Public Safety Goals 9 3.2 Defense-in-Depth 9 3.3 Separation Approach - Two Group 9 34 Two Diverse Independent Shutdown Systems 10 3.5 Containment Structural Design 10 3.6 Reliability of Safety Related Systems 10 3.7 Single and Dual Process System Failure Philosophy 10 I 3.8 3.9 Accident Analysis Methodology CANDU Source Term methodology 11 11 I  !

Kiki I

U o

4.0 REVIEW OF CONTAINMENT STRUCTURAL DESIGN 13 4.1 Concrete Containment 15 4.1.1 Applicable Codes, Standards, and Specifications 16 4.1.2 Loading and Loading Combinations 19 4.1.3 Design and Analysis Procedures 23 4.1.4 Structural Acceptance Criteria 25 4.1.5 Materials, Quality Control, and Special Construction Techniques 26 4.1.6 Testing and Inservice Surveillance Requirements 27 3 4.2 Containment Pressure Boundary 30 4.2.1 Capability to Contain Design Basis Accidents 31 4.2.1.1 Design Basis Analysis 31 4.2.1.2 Fracture Prevention 32 4.2.2 Capability to Contain Severe Accidents 33 4.2.2.1 Ultimate Failure Pressure Analysis 35 4.2.2.2 Basemat/ Liner Ability to Withstand Core Debris 36 5.0 REVIEW OF CONTAINMENT FUNCTIONAL DESIGN 39 5.1 Containment Isolation Systems 39 5.2 Containment Heat Removal Systems 46 5.3 Containment Combustible Gas Control 50 5.4 Containment Leak Testing 55 5.5 Containment Instrumentation for Accident Monitoring 57 5.6 Containment Response to Postulated Loss-of-Coolant Accidents 60 5.7 Containment Response to Postulated Secondary System Pipe Ruptures 64 5.8 Containment Subcompartment Analysis 67 5.9 Containment Bypass Accidents 70 5.9.1 Interfacing Systems LOCAs 70 5.9.2 Steam Generator Tube Ruptures 72 5.10 Containment Response to Refueling Accidents 74 5.11 Containment Response to Severe Accidents 77 6.0 RADIONUCLIDE SOURCE TERM AND RELEASE TO THE ENVIRONMENT 81

7.0 REFERENCES

89 7.1 CANDU Technology Documents 89 XiV E

I  :

7.2 Canadian Regulatory Doctanents 90 ,

7.3 Canadian Standards Association (CSA) Standards 91 7.4 USNRC Regulations and Other Review References 92 ;

APPENDICES A. Summary of Computer Codes used in Performance Analysis ,

B. Containment Codes and Standards I C. Discussion of Canadian and U.S. Loading and Load Combinations Additional Information on External Hazards Requirements D.

E. Containment Design Layout Issues and Lessons Learned from U.S. Practice F. Discussion of Additional Design Considerations G. Containment Analysis Issues H. Comparison of Canadian and U.S. Requirements for Material, Quality Control, and Construction Techniques I. Detailed Review of "The Technology of CANDU On-Power Fueling",'ITR-305 I

I I

I I  !

I l I

I XV I 1

- a . , - _ _ - -a..b., -. 4 dE.m a a m.m. - - - _.4

_ . -u,_ - - _ _ - 4 eis a - , m . - - . . . _ w t

n l

E or ,

l l

I; ,

1 I: .

e I'

I I' I I! ,

! l I,

1 I

l Il

=

I s

XVI W

I I

W 4

I ACRONYMS r r

ACI American Concrete Institute AECB Atomic Energy Control Board AECL Atomic Energy of Canada, Ltd.

AISC American Institute for Steel Construction t

I ALWR ANSI Advanced Light Water Reactor American National Standards Institute ASCE American Society of Civil Engineers ASME American Association of Mechanical Engineers ASTM American Society for Testing Materials BTP Branch Technical Position CCFP Conditional Containment Failure Probability CFR Code of Federal Regulations CHRS Containment Heat Removal System CP Construction Permit CSA Canadian Standards Association CSR Conceptual Safety Report DBE Design Basis Earthquake l ECCS Emergency Core Cooling System EPRI Electric Power Research Institute FE Finite Element F/M Fuel Handling Machine l GDC General Design Criteria GLM Gross Leakage Monitoring l

I HTS Heat Transport System ILRT Integrated Leakage Rate Test INSAd Intemational Nuclear Safety Advisory Group IPE Individual Plant Examination LOCA Loss of Coolant Accident LSM Limit States Method LST Lowest Service Temperature LWR Light Water Reactor MSLB Main Steam Line Break I MSSV Main Steam Safety Valve XVu I

E o

NDT Nil-Ductility Transition NOAA National Oceanic and Atmospheric Arlministration NRC Nuclear Regulatory Commission NUMARC Nuclear Management and Resource Council OBE Operating Basis Earthquake OSHA Occupational Safety and Health Administration PHTS Primary Heat Transfer System g PHWR Pressurized Heavy Water Reactor E PMF Probable Maximum Flood PRA Probabilistic Risk Assessment ,

PSA Probabilistic Safety Analysis PSER Preapplication Safety Evaluation Report PWR Pressurized Water Reactor QA Quality Assurance RBCS Reactor Building Cooling System R/C Reinforced Concrete g RCWS Recirculation Cooling Water System 5 RSWS Raw Service Water System SDE Site Design Earthquake SDG Safety Design Guides SIT Structural Integrity Test SNL Sandia National Laboratories SRP Standard Review Plan SSC Structures, Systems, and Components SSE Safe Shutdown Earthquake g TD Technical Description 5 TMI Tluce Mile Island ITR Technical Transfer Report USNRC United States Nuclear Regulatory Commission I

I xviii

1.0 INTRODUCTION

1.1 Background Information The NRC is reviewing advanced reactor designs in support of the issuance of preapplication safety evaluation reports (PSERs). These reviews include the Canadian Deuterium Uranium 3 (CANDU 3 )

reactor design which is being designed by Atomic Energy of Canada, Ltd. (AECL). In the U.S., the design I- is sponsored by AECL Technologies, and they submitted pertinent CANDU 3 documents to the NRC.

The NRC intents to review these documents and issue a PSER regarding the licensability of the CANDU 3 design in the U.S.

1.2 Statement of Work SEA was contracted to technically review the CANDU 3 Technical Description', the Conceptual Safety 8

Report2 , The Technology of CANDU Source Term Calculation , and associated containment system documents supplied by the NRC. The review was to address the major areas of containment system I design including:

e containment system structural response to design basis and severe accidents, e source terms and release rates, and

= containment performance analysis methods and acceptance criteria.

Particular attention was to be paid to issues unique to CANDU such as the calandria tank response, lack of containment spray system, consequences of pressures tube failures and refueling accidents. SEA was to identify the preapplicant's criteria in each of these areas and evaluate the technical and experimental I bases supporting this criteria. Particular regard was to be paid to areas where the design, materials, methods, or acceptance criteria are different from accepted U.S. practice. The Standard Review Plan (SRP),

NUREG-0800", was to be used as a source of NRC acceptance criteria. Independent analysis was precluded.

I 1.3 Review Approach I The review approach for the CANDU 3 containment was similar to that for a typical LWR containment.

Although the CANDU 3 reactor design is very different than the conventional LWRs, its steel-lined

! reinforced-concrete containment structure is similar to containments licensed in the United States. Further,

'I 1

E U

the containment functional capabilities are similar,i.e., isolation, heat removal, combustible gas control, and pressure boundary. The accident source terms to the containment include depressurization and combustible gas flows similar to the LWRs, except that heavy water is used to cool the CANDU 3 reactor.

The flow rates and timing of releases from the CANDU 3 primary system, however, will likely differ from those of LWRs.

The NRC General Design Criteria (GDC)" and other acceptance criteria were developed for LWRs and, therefore, may not be directly applicable to the CANDU 3 design in every instance. In our review, g acceptance of the CANDU 3 design was based on the general criterion that the Commission expects, as a minimum, at least the same degree of protection of the public and the environment that is required for current generation LWRs. For the longer term, the Commission expects designs to provide enhanced margins of safety. Further, rules-of-reason were applied for comparison rather than a direct one-to-one comparison.

The aspects reviewed included the containment structural design, the containment functional design and response to both design basis and severe accidents, and the accident radionuclide source terms and release rates. The structural aspects reviewed included the concrete containment structure and the containment pressure boundary. The functional aspects reviewed included the containment's functional capabilities and the containment's response to postulated primary system loss-of-coolant accidents, postulated secondary system pipe rupture accidents, on-power refueling accidents, and severe accidents. Possible containment bypass accidents were also reviewed.

The reactor and heat transport system (HTS) were reviewed only as needed to evaluate the mass, energy, and radionuclide source terms to the containment that were required to evaluate the containment response to those source terms. Systems outside the primary containment were reviewed only if those systems g directly effect the containment source terms, isolation, or failure. 3 The SRP which specifies the appropriate GDC for each area of review was used as a guide where applicable. However, the SRP does not cover all areas specified in the statement of work, such as severe accidents and radionuclide sourcs. terms and release rates. While the documentation did not include severe accident analysis, the review was guided by the safety issues associated with severe accidents.

Severe accident safety issues pertinent to the CANDU 3 design are discussed in regards to the need for additional analysis for certification.

The Canadians use computer codes designed specifically for their CANDU reactors, and heir technical basis for the safety of the CANDU 3 design relies heavily upon these computer codes. The SRP states that i,

2 I.

the applicant should use calculational methods that have been previously reviewed by the staff and found acceptable, therefore the basis for concluding that the design demonstrates conformance with the NRC acceptance criteria must include a review of the applicable codes. For example, much of the technical basis for the LOCA mass and energy source terms to the containment and subsequently the containment response is contained within the models of these Canadian codes and within the input and the interpretation of the results of those codes. The scope of this task precludes a review of all of these codes and their associated experimental verification and validation to ensure conservative results. This review I noted possible code deficiencies where evident.

Whenever the containment response is sensitive to a phenomenon with a high degree of calculational uncertainty, this uncertainty and its potential impact upon the containment response needs examination.

A detailed examination of these uncertainties was beyond the scope of this task and these uncertainties were not discussed in the documents but we point out some obvious sources of uncertainties.

I 1.4 Technical Review Participants I The participants in the preapplication technical review of the CANDU 3 containment design are as follows:

Participant Contribution Primary Experience Pertaining to Review Containment Severe Accident Analysis I Frank W. Sciacca Project Manager and PRA Clinton J. Shaffer Functional Design Review Full-Plant Integrated Severe Accident I Radionuclide Review Overall Review and Report Analysis and PRA Robert S. Dunham* Structural Des:gn Review Structural Design and Analysis I Robert A. Dameron*

Yusef R. Rashid*

Robert E. Nickell" Karl R. Goller~ Refueling Technology Review NRC Regulatory and Licensing Process and Radioactive Waste Management ANATECH Research Corporation Applied Science and Technology SEA Consultant iI 3 I

E o

1.5 Report Format The executive summary provides the highlights of the review including potential deficiencies of the CANDU 3 design to meet NRC criteria. Introductory information is located in Sections 1, 2, and 3.

Section 2 discusses the status of the CANDU 3 design documentation reviewed. Section 3 is intended to give the reader a htief overview of the safety approach integrated into the design. The review results for the structural design, the functional design, and the radionuclide source terms and release rates, are g located in Sections 4,5, and 6, respectively. The report assumes that the reader is familiar with the 5 CANDU 3 design.

Each topic reviewed includes the following subsections:

Acceptance Criteria ne USNRC design certification acceptance criteria.

I Acceptance Criteria Differences Sub9ar.tial differences between preapplicant's and USNRC's criteria.

11 asis for Acceptance ne supporting technical and experimental basis for acceptance and analytical methods.

Additional Information Additional analysis needed for design certification and additional information I

being developed. Potential acceptance problems discussed as requiring additional clarification or justification for acceptance.

Evaluation Whether or not CANDU 3 can meet current NRC criteria.

All of the documents describing the CANDU 3 design and discussing aspects of CANDU technology which were available for this review are listed in reference Section 7.1. Canadian regulatory documents are listed in Section 7.2 and Canadian Standards Association (CSA) Standards are listed in Section 7.3.

I USNRC regulations and other review references are listed in Section 7.4.

I I

4 I.

LI '

2.0 STATUS OF DOCUMENTATION This section is a brief discussion of the completeness and applicability of the documents reviewed relative to the " areas of review" specified in the Standard Review Plan.

I 2.1 Prevailing Design I 2 The Technical Description' (TD) and Conceptual Safety Report (CSR) are both 1989 documents but the design has apparently continued to evolve since these documents were issued. For example, the 1989 TD shows 2 main reactor coolant circulation pumps, whereas the 1992 Technical Outline

• shows 4. This review will therefore not necessarily represent the current design.

I 2.2 Concrete Containment I 'Ihe current documents lack much of the detail needed to complete the review as outlined in the SRP.

The containment building description consists of: a few sketches (one cross-section, two elevations, and I an internal structural module), the basic dimensions (height, diameter, and wall thickness), the design pressure, and qualitative discussions regarding materials, access, construction, etc. The SRP areas of review include such items as main reinforcement and prestressing tendons, the anchorage of the liner, loads, and loading combinations which cannot be reviewed with the current level of technical description.

Information, such as containment ultimate failure pressure, subcompartment failure pressure differentials, and containment structural design details is missing.

I 2.3 Containment Source Terms and Containment Response I The safety analysis presented in the CSR is described as design-assist safety analysis functioning primarily to provide assistance and input to the design and is incomplete for license application, as well as not reflecting the latest design modifications. The CSR presents only mir d results for selected calculations such as a large LOCA, presented as a bounding LOCA. The SRP " areas of review" include the containment pressure and temperature response due to a spectrum of LOCAs (break size and location) for both the primary and secondary systems. 'Ihe verification that the LOCA source terms to the containment are bounding as stated in the CSR cannot be determined from the CSR. Other important analytical details such as the containment temperature are not presented. Sensitivity and uncertainty analyses are not presented.

I S

I

o u

O The CSR lacks detailed analytical results needed to evaluate the validity of the source terms to the containment and containment response, such as the containment analysis nodalization and basis for that nodalization, the impact on containment response of possible combustion (with or without igniters),

containment response with or without air coolers, and the possible decomposition of protective coatings.

The TD lacks detailed specification of the location of piping, valves, etc. within the containment, which piping penetrates the containment walls, and safety valve discharge location and capacity. For instance, it was difficult to ascertain with certainty that the main steam safety valves were located outside the a containment building.

2.4 Radionuclide Source Terms and Release Rates I

3 The primary source of information regarding radionuclide behavior is the AECL Report TTR-384, titled I

"The Technology of CANDU Source Term Calculation". This document contained the only analytical results available for review but these results were for the CANDU 6 design which has a containment spray system, whereas the CANDU 3 does not. The analysis in TTR-384 involved active sprays which reduced airbome radionuclides inside the containment. While this analysis contributed to the overall understanding of the CANDU source term methodology, the results could not be applied directly to CANDU 3.

2.5 Design Basis and Severe Accidents The analyses in the documents provided to SEA are all based on design basis accidents. A severe accident 5

discussion found in a comparison of the CANDU 3 design with NRC positions located in TTR-429 states that information regarding containment response to severe core damage accidents will be provided to the NRC when this response is assessed. That document was dated June 1992.

2.6 Analysis Methods The SRP states that the applicant should use calculational methods that have been previously reviewed by the staff and found acceptable. Most of the computer codes used by the Canadians are CANDU specific and probably have not been evaluated by the NRC. Much of the technical basis for such review areas as the LOCA mass and energy source terms to the containment and the containment response to these sources is contained within the models of these Canadian codes and within their associated input g

and results. Descriptions of the models employed by these codes are sparse in the documents reviewed. 5 6

E

=

Further, the Canadians apparently use several separate codes in performing an accident analysis, as opposed to a fully integrated systems code, and their methods of integrating the code results are not discussed. A review of all of these codes and their associated experimental verification and validation to ensure conservative results is beyond the scope of this task. A list of computer codes used by the Canadians was complied during the course of our review. This list is found in Appendix A.

Performance of Unique Features I

2.7 The CANDU 3 reactor has several unique features which can influence the source terms to the containment. One such unique feature is a positive void coefficient resulting in a power transient initiated by a LOCA. The large LOCA results presented in the CSR show a peak fuel sheath temperature of 1390 C approximately 10 seconds after the break initiation. At this temperature, metal-water reaction and hydrogen production is occurring, providing another containment source term and at this temperature, the reaction rate is approaching rapid escalation. The calculational uncertainty associated with this accident sequence could be very important to the assessment of the ultimate outcome of the accident and this uncertainty should be reviewed, but this type of information is not available in the documentation I reviewed.

The CANDU 3 reactor is designed with the capability of being refueled at power. The fuel handling system is described in AECL Report TTR-305', titled "The Technology of CANDU On-Power Fueling".

This is the latest, most detailed information that was available on this subject, particularly on fuel handling system accident analyses and the relationship of this system to the reactor containment building. This report states that the fuel handling system for CANDU 3 is still under development, but will be derived largely from the CANDU 6 design described in this report. The report acknowledges, however, that there will be significant differences. This includes single-ended fueling, charging and discharging the fuel I handling machine with new and irradiated fuel from outside containment, electric motor drives instead of oil hydraulic motor drives, and other modifications in hardware design and materials indicated by operating experience, research and development programs and to suit single-ended fueling. Several CANDU fuel handling systems other than the CANDU 6 design are also discussed in this report. It is therefore not always clear what is and what is not applicable to the CANDU 3 design.

I I

s~ 7

,? --n --- > aa m .a- - n--- -mA m--d 2 - 6 - - - - -a a E

o I.

I I

I I'

I. .

I I

I I.

I:

I I

I ,

I' t I'

8

.I J

I:

'l

L I

3.0 CANADIAN APPROACH TO SAFETY f

l The following information was summarized from several of the CANDU documents.

1 3.1 Public Safety Goals The established CANDU 3 safety goal design objectives are predicted average frequencies of less than:

l l

• 104 /yr for sequences leading to the moderator system functioning as reactor core heat sink with an intact fuel channel integrity C

• '/yr for sequences leading to the moderator system functioning as reactor core heat sink with uncertain fuel channel integrity.

l

• 104/yr for sequences leading a loss of all reactor core heat sinks i

The overall severe core damage frequency of less than 104 /yr is expected based on calculations for previously designed and operated CANDU plants. I 4

The containment is designed for an unavailability of not more than 10 yr/yr.

il Defense in-Depth 1

3.2 j lI It is the intent of the CANDU 3 design to satisfy all the applicable principles of the Intemational Nuclear l

Safety Advisory Group (INSAG) including implementing the defense-in-depth concept to compensate for potential human and mechanical failures . The defense-in-depth approach centers on several levels of protection including successive barriers preventing the release of radioactive material to the environment.

3.3 Two Group Separation Approach All systems in CANDU 3 are assigned to one of two groups, such that the systems of each group are capable of shutting down the reactor, maintaining cooling of the fuel, and providing plant monitoring capability in the event that the other group of systems is unavailable. Group 1 systems are primarily dedicated to normal plant power production and these systems, with certain nuclear class exceptions, are neither seismically nor environmentally qualified. The Group 2 systems include safety and safety-related systems which are seismically and environmentally qualified to mitigate the effects of accidents including

,I I 9 I I

E as '

a DBE. The two system groups are located in separate areas of the plant to the greatest extent possible to guard against common mode failures.

3.4 Two Diverse Independent Shutdown Systems I'

'Ihe CANDU 3 reactor incorporates two diverse shutdown systems which are independent of each other and from the reactor regulating system. Either system can render the reactor subcritical during normal g reactor operation or under accident conditions. One shutdown system drops absorber rods into the core 5 and the other system injects liquid poison.

3.5 Containment Structural Design I;

The approach used by the Canadian standards for the design of CANDU concrete containment is the Limit States Method (LSM). The LSM is a probability based code that requires structures to be proportioned such that the probability of failure occurring is low enough to be acceptable while at the same time specifying that the serviceability requirements of the structure are satisfied.

3.6 Reliability of Safety Related Systems Reliability objectives are realized by providing redundancy of active components for every safety system I

and for important process systems. Specifically, the design of each safety system must allow for the single failure of an active component at any time following an initiating event and for the single failure of a passive component during the long term recovery period. Safety systems are designed to be readily testable to demonstrate a demand unavailability less than 10~3yr/yr.

The design, construction, commissioning and operation of the CANDU 3 plant will be consistent with the Canadian nuclear standards. All Canadian Standards Association (CSA) nuclear standards issued prior to project commitment will apply. The ASME Code Section 111 developed in the United States has been generally modified and supplemented by Canadian national standards.

3.7 Single and Dual Process System Failure Philosophy Canadian accident analysis considers two categories of events: 1) single failures implying the failure of a process system requiring actuation of one or more of the safety systems, and 2) dual failures which g combine the process system failure with the unavailability or impairment of any one of the safety systems. 5 10 I.

I 3.8 Accident Analysis Methodology The purpose of Canadian safety analysis is to ensure that the response of the plant to accidents does not exceed specified limits for fuel channel integrity and radiological doses.

I Accidents are classified into four general analysis categories:

I Catecorv A - Deterministic Safety Analyses Events, such as LOCAs, used to specify design requirements for the safety systems during the initial design phase and used to assess the performance of these systems upon design completion.

Catecory B - Probabilistic Safety Assessments Events, such as transients, for which the event frequency can be calculated using probabilistic methods to obtain a realistic assessment of the risk involved.

I Catenorv C - Common-Cause/Effect Analyses External events produced by natural causes, such as I earthquakes, and internal events, such as fires.

Catecorv D - Low Probability Events Evaluations Events that can result in potentially large consequences but have a very low probability of occurrence such as failures of major equipment like a steam generator shell.

I 3.9 CANDU Source Term Methodology

.I The goal of safety analysis is to show that the plant has been designed to ensure public health and I safety in response to anticipated transients and accidents. The dose limits for individuals at the boundary of the exclusion zone are specified separately for single and dual failure. For single failures, the dose limits are 0.5 rem whole body and 3 rem thyroid. For dual failures, the dose limits are 25 rem whole body and 250 rem thyroid.

I I

I I u I  :

j

J A 4 el daJ- 4 2--- - a- h A h - m-Awad.m - h--u-a . 4 - _- ._d _ 4.- -

e, I;

1 I: ,

I II I;

I; a

I I ,

l l

I a

I I

I I

s

. I

I 4.0 REVIEW OF CONTAINMENT STRUCTURAL DESIGN The CANDU 3 containment documentation was reviewed for compliance with codes, standards, and specifications applicable to a USNRC-licensed containment. This review included checking the compliance of specific containment details and functions and checking the compatibility of the Canadian codes and standards, which are referenced in the CANDU 3 submittal, with USNRC requirements. The containment structural review is divided into two parts. The first part covers the design and construction for building I the containment. The second part deals with identifying the containment challenges, the performance of the containment and how these are evaluated. The major topics covered in the first part are design loads and load combinations, design and analysis procedures, structural acceptance criteria for the concrete and liner, materials, inspection, and testing. The major topics covered in the second part are performance under design basis and under severe accident challenges.

The criteria and specifications set forth in the CANDU 3 documentation must ensure a level of safety for the CANDU 3 containment that meets that afforded to the public by a USNRC-licensed plant. As the ultimate barrier against uncontrolled releases of radioactive materials to the environment, the CANDU I 3 containment must be designed to remain an essentially leak tight structure under design basis accident loads. With this as the principal design objective,it is appropriate for the Canadian design to adhere to traditionally conservative design rules and acceptance criteria. Except for various code discrepancies, which are described herein, and differences in design customs, the CANDU 3 submittal is in agreement with the spirit of this design philosophy. However, in light of the Commission's recent principles, findings, and publications regarding severe accident issues, a newly licensed containment must address severe accident vulnerabilities and consequences. The CANDU 3 submittal fails to address these issues.

The CANDU 3 containment structure is described in: CANDU 3 Conceptual Safety Report (CSR) Part 1 -

I Design Overview and Licensing Basis; CSR Part 2 - Design Description; CANDU 3 Technical Description; and the CANDU 3 Technical Outline. The containment is a dry reinforced concrete structure designed to operate at atmospheric pressure which the Canadians refer to as the reactor building. Thus, the CANDU 3 containment corresponds to the USNRC Standard Review Plan (SRP) Section 3.8.1 description of " reinforced and prestressed PWR dry containments designed to operate at atmospheric conditions."

However, CANDU 3 is not a PWR, it is a Pressurized Heavy Water Reactor (PHWR). The containment system for CANDU 3 is a departure from the containment systems for other CANDU reactors which used dousing systems, and CANDU 6 used a plastic (epoxy) lined concrete containment. The reactor building E

i' " P 'i"P" ' "P "*"' ' '"* ' "'"'"**"' 'Y"' ""d P' "i d "' "" *"" ""*"'"' ' ""d"'Y' " P

5 LOCA pressure boundary, and biological shielding.

13 I

E

=

The structural design of the CANDU 3 containment is at a preliminary stage with few dimensions or details available. The reactor building is a reinforced concrete cylindrical structure with a flat basemat and hemispherical dome. The inner diameter of the cylinder is 38.6 m (9804"), the wall thickness is 1.2 m (47.2"), and the steelliner thickness is 6 mm (0.2356"). Other containment dimensions were not detailed.

No details of the steel reinforcement for the containment structure were provided. The total height of the reactor building structure is approximately 51.8 m, and the basemat is approximately 2 m thick. The containment design pressure of 200 kPa (29 psig) was chosen to withstand the peak pressure generated g by a heat transport system (HTS) high energy pipe break in the absence of a pressure suppression system. 5

. The CSR indicates that CANDU 3 is to be designed to resist a Design Basis Earthquake (DBE), which is equivalent to the USNRC Safe Shutdown Earthquake (SSE), of a magnitude of 0.3 g horizontal and 0.2 g vertical.

The Canadian Licensing Basis, that is, the Canadian Acceptance Criteria, for CANDU 3 is defined in Part I

1 of the CSR, and includes the following: the AECB Regulatory Requirements; the applicable Codes and Standards; the Safety Design Guides (SDG-74-03650-001 through -010); and the Safety Analysis 2

Requirements. For the containment, most of these requirements are given in AECB Documents R-7 ', g 2

" Requirements for Containment Systems for CANDU Nuclear Power Plants", and R-77 ', " Overpressure 5 Protection Requirements for Class 1 Systems in CANDU Nuclear Power Reactors Fitted with Two Shutdown Systems". Additional discussion of the Licensing Basis and the compliance of the CANDU 3 design with this is given in Appendices A through D of Part 1 of the CSR. Additionalinformation on the 7

Design Basis and Acceptance Criteria are given in TTR-411, "CANDU 3 and USNRC Requirements -

8 Equivalent Safety Issues: Containment Design"; TTR-423, "CANDU 3 and the USNRC GDC"; and 5

TTR-429, " Comparison of CANDU 3 with NRC Positions for Evolutionary LWR Certification Issues in SECY-90-016".

The USNRC requirements are found in GDC'" 1,2,4,16,50,51,52,53, and 54 of 10CFR50 Appendix A, 10CFR50.34(f)s2, 10CFR50.55a'i, 10CFR100 4 , and NUREG-0800", specifically, SRP 3.8.1, " Concrete Containment"; 6.2.1.2, "Subcompartment Analysis", and 6.2.7, " Fracture Prevention of Containment Pressure Boundary" These documents further identify requirements from appropriate sections of the American Society of Mechanical Engineers (ASME) Boiler and Pressure Vessel Code, certain ASME Code Cases, and the American Concrete Institute (ACI) 349 Code.

However, in addition to these requirements, the reviewers believe that it is appropriate to invoke key aspects of the information that has become available in the last ten years regarding containment g performance, design, and severe accident response and consequence. Some of this is stated in documents 5 such as SECY-93-OS7, NUREG-1150", the Policy Statement on Severe Reactor Accidents Regarding Future 14 B

=

I Designs and Existing Plants", and in the guidelines designated by the on-going Individual Plant Examination (IPE) Program" Other information comes from experience such as that compiled in the USNRC's Containment Integrity Program at Sandia National Laboratories (SNL). This information has provided the basis for improvements over current design practices, such as the following:

I

• Maximum utilization of liner ductility.

I New rules for rebar forming to prevent precompression embrittlement.

• Preventing containment bypass.

• Accounting for the effects of extreme hot or cold temperatures on material strength and fracture properties.

• Ensuring seal integrity under elevated temperature and aging.

• Safeguarding against corrosion threats.

• Setting minimum standards for computational tools and analysis methods.

I The resulting body of knowledge in containment performance evaluation utilized in this review takes advantage of the aggregate knowledge gained under U.S. government and industry programs conducted

.I since the Three Mile Island (TMI) accident.

In the following subsections, specific discussions of design and acceptance criteria and differences between the Canadian and USNRC criteria will be described.

I 4.1 Concrete Containment I The CANDU 3 containment is a large-volume pressure boundary ASME Class 1 structure. The containment structure and associated components and substructures must be designed to resist design I basis loads as elastic systems without exceeding ASME service Level C stresses, and as inelastic systems (subject to a pre-specified inelastic design criterion) without exceeding ASME service Level D allowables.

The leak tightness criteria specified in Appendix J of 10CFR50 is also a requirement. These basic criteria are not specifically addressed in the applicant's submittal. What are addressed are the " Atomic Energy Control Regulations", Regulatory Policy Statements" and " Consultative Documents". Much of this review, therefore,is a comparison of the Canadian Regulations to the ASME and ACI codes. To this end, we have endeavored to cite substantial differences between these requirements, but thue citations are not complete.

The role of the containment as a critical part of the overall plant safety system. in addition to containing i I design basis accidents, is to provide severe accident mitigation through erigineered safety features.

15 I

E w

Although the prevention of severe accidents is a principal design goal for the overall plant, the design approach adopted for the containment structure must nevertheless safeguard against impairment of containment performance under the rare event of a severe accident.

Another significant design parameter for the containment is the design life, and this has not been found in the applicant's documentation. If the design life requirement is inconsistent with anticipated design lives of U.S. LWR plants, it should take advantage of available industry information on plant aging" and safeguard against corrosion and age-related degradation mechanisms in concrete containment structures and associated components affecting the leak tightness function of the containment. The design life requirement places further emphasis on the importance of inservice inspection as specified in 10CFR50.55a and Section XI of the ASME Code.

The leak tightness capability of the containment may be challenged not only through a structural failure I

of the ccatainment walls but also through the functional inadequacy of penetration seals. Irakage through the penetration seals may result from the combined effects of severe distortions under accident-induced loads and seal material degradation as a result of age and/or temperature. Proper provisions I

must be included in the containment design to prevent such nonstructural leakage modes under design 5 basis conditions.

Rigorous Quality Assurance (QA) requirements that are compatible with 10CFR50, Appendix B", must I

also be imposed on the containment. These are addressed in the CSR Part 1, Appendix A. In general, QA requirements are handled in comparable, but different, fashion.

Finally, this review describes acceptance standards for analysis methods and computational tools. This aspect of the design process has traditionally been left to the discretion of the designer. However, the USNRC's containment integrity program has demonstrated the need for establishing acceptance criteria for the analysis methods in order to validate the acceptability of the design. Inclusion of this provision is necessary for adherence to a defense-in-depth design which should be the guiding philosophy for the overall plant design.

4.1.1 Applicabie Codes, Standards, and Specifications I

The CANDU 3 Codes and Standards consist of the AECB's Regulations, " Regulatory Policy Statements" and " Consultative Documents" The AECB Regulations are formally equivalent in authority to 10CFR.

'Ihe Regulatory Policy Statements do not have the force of law but, according to Reference 9, carry more 16 B

I weight than USNRC Regulatory Guides. The AECB Regulations invoke the Canadian design codes. For example, the code analogous to the U.S. ACI-349 is CAN3-N287.1.

U.S. Codes Standards and Sriecifications In general, for USNRC licensing, the containment must be designed and constructed in accordance with the requirements of the ASME Boiler and Pressure Vessel l

Code,Section III, Division 1 and Division 2 and its addenda, without exception. The Division 1 and I

Division 2 code boundaries are described herein. Foundations and other concrete structures and appurtenances should, in general, be designed in accordance with ACI-349-89. Steel components that are not part of the pressure retaining boundary and are outside of the code boundary should be designed in accordance with the American Institute for Steel Construction (AISC) Menual of Steel Construction.

The containment must be designed in accordance with 10CFR50 and the GDC in 10CFR50 Appendix A which require the following:

il

• 10CFR50.55a and GDC 1 as they relate to concrete containments being designed, fabricated, I erected, and tested to quality standards comme, surate with the importance of the safety function to be performed. 3

• GDC 2 as it relates to the design of the concrete containments being capable of withstanding the most severe natural phenomena such as winds, tornadoes, floods, and earthquakes, and the appropriate combination of allloads.

• GDC 4 as it relates to concrete containments being capable of withstanding the dynamic effects of equipment failures including missiles and blowdown loads associated with the design basis I accident.

• GDC 16 as it relates to the capability of the concrete containment to act as a leak tight membrane to prevent the uncontrolled release of radioactive effluents to the environment.

• GDC 50 as it relates to containment internal structures being designed with sufficient margin of safety to accommodate appropriate design loads.

I The USNRC Regulatory Guides and industry standards identified below provide information, i recommendations, and guidance and, in general, describe an acceptable basis to implement the requirements of 10CFR50,50.55a, and GDC 1,2,4,16 and 50.

,I 17 i l

I l j

B

=

Code Title I

ASME Section III, Code for Concrete Reactor Vessels and Containments Division 2, Subsection CC, i' and Division 1, Subsection NCA 135 Inservice Inspection of Ungrouted Tendons in Prestressed Concrete Containment Structures 1.90 Inservice Surveillance in Prestressed Concrete Containment Structures with Grouted Tendons 1.94 Quality Assurance Requirements for Installation, inspection and Testing of Structural Concrete and Structural Steel during the Construction Phase of Nuclear Power Plants 1.107 Qualification for Cement Grouting for Prestressing Tendons in Containment Structures 1.136 Materials, Construction, and Testing of Concrete Containments Turisdictional Boundaries The ASME Code also establishes jurisdictional boundaries; however, these are I

handled differently in the Canadian Standards. Per example, when a structural concrete support is constructed as an integral part of the containment, it must be included within the jurisdiction of the Code.

The rules of Division 1 apply for parts and appurtenances not backed by structural concrete for load g carrying purposes. Those parts or appurtenances stamped in accordance with Division 2 must meet the 5 requirements of Subsections NCA, CC-1000, CC-6000, CC-7000, and CC-8000 in lieu of the corresponding requirements of Division 1. Those parts or appurtenances stamped in accordance with Division 1 must meet all the requirements of Division 1 and NCA-2134(e). The requirements of Section III Division 2 do not apply to items not associated with the pressure retaining or load bearing function of a component, such as forms, tie wires, chairs, supports, form ties, grease and grout fittings, and retaining caps, or to seals, packing, and gaskets.

Specific Standards The detailed list of Codes, Code Cases, General Design Criteria, Regulatory Guides, g

and references included in Appendix B are those that need to be followed in the design of a USNRC- E licensed containment. This list has been categorized under general documents, load cases (hazards),

documents pertaining to the concrete design and construction, and inspection and testing.

I 18 I

I Differences in Codes. Standards. and Snecifications There are considerable differences between the USNRC and the Canadian Codes, Standards, and Specifications for concrete containments. These differences will be described, as appropriate, in the following subsections of Section 4.

pasis for Acceptance of Codes. Standards. and Specifications The issue of the basis for acceptance of the Canadian Codes, Standards and Specifications is one that we spent considerable time evaluating. Clearly, there are many similarities between Canadian and USNRC requirements, but just as clearly, there are I many differences. For the containment structural design and acceptance, this is a particularly difficult issue because of the very extensive and unique requirements of the ASME Code for concrete containments.

While the Canadian requirements clearly are directed at the same safety objectives and share the same philosophical basis, they are fundamentally different than the USNRC requirements. Thus, we see only two bases for acceptance: (1) the Canadian requirements must be augmented so that they substantially meet USNRC requirements; or (2) the CANDU 3 design requirements must be changed to conform to both Canadian and USNRC requirements. We believe this issue to be particularly important because TTRs 411, 423, and 429 fail to discuss many of the significant issues raised here (TTR-411 does discuss load combination differences, but this is a less significant issue).

I In our opinion, the preapplication should have dealt more directly with th many differences between Canadian and USNRC design and acceptance requirements that are cited herein. In particular, the preapplications should have described how these differences are to be resolved. It may be appropriate for the preapplication to be resubmitted when it more fully addresses these issues.

Evaluation Many of the important CANDU 3 containment structural design aspects are not yet complete, so this will require a more detailed review later. However, it is our opinion that, as I

presented in the documents reviewed, the Canadian codes and standards as applied to the containment do not meet USNRC requirements.

4.1.2 Loading and Loading Combinations A USNRC-licensed containment should provide one of severallayers of a defense-in-depth strategy to reduce the consequences of postulated accidents and beyond basis accidents as well as protect the reactor and its systems against external events. Specifically, the containment must be designed in accordance with relevant principles enumerated in the SRP and with the following requirements: the containment, (including structure, support systems, and penetrations) should be designed to conservatively I accommodate, without exceeding the design leakage rate, the limiting (worst-case) consequences of:

I 19 I

E O

l

. Design basis accidents including LOCAs

. Other potential energy sources (for example, intemally-generated missiles).

. Site environmental conditions.

. Other extemal hazards, including man-made hazards in proximity to the site, such as transportation accidents.

These loads must be designed for in accordance with the appropriate codes and standards so as to achieve fracture prevention and prevention of sudden catastrophic failure of the containment pressure boundary.

'Ihe Canadian codes and standards adhere to this basic design philosophy, but as described earlier, some specific loading considerations and factors differ from U.S. standards. Some of these differences are cited in this section and in Appendix C. In the interests of readability, much of the detailed discussion of the U.S. and Canadian requirements for loading and load combinations has been included in Appendix C.

Differences in leads and Load Combinations This area of the CANDU 3 containment design documentation has differences from USNRC requirements in four general areas: seismic loads, wind and tornado loads, flood conditions, and load combinations. Other than these differences, which are enumerated below, the CANDU 3 containment is designed under similar loading requirements as described in Appendix C. The CANDU 3 submittal sets forth the requirement that the containment must maintain its integrity under all anticipated load scenarios due to transients and postulated accidents. The CANDU 3 submittal recognizes the existence of differences in loads and load combinations in 'ITR-411, but states that the Canadian and USNRC approaches have equivalent safety and that loads and load factors have been developed from the same basic assumptions. For the most part, this has been found to be true. In some instances, however, it is not, and these are discussed below.

(i.e., CSA-N287.3) use the limit state method of design, It is important ta note that the Canadian Co/ g or in U.S. code parlance: " ultimate strength oesign", while the ASME Code uses working stress design. W' It is somewhat ironi: to note that the ACI codes (including ACI-349, the comparison stand.ard to ASME CC-3000) switched from the working stiess method to the ultimate strength method in the mid-1960's. ,

Thus, for the last 30 years, nearly all J.S. concrete structures have been designed using the ultimate strength method. Nevertheless, concrete containments continue to be designed using the working stress i approach. Because of this, the Canadian Standard load factors cannot be compared directly to ASME CC-3000, but they can be compared to ACI-349 which, for purposes of USNRC acceptance, can be considered to provide equivalent safety.

There are two main differences. First, the general size and application of the load factors are all different Ii l 1

because of intrinsic differences between the Canadian limit state method and the ASME CC-3000 working 20 Il i l

l 3

=l l

stress method. Second, there are a few specific loadings that are not considered or are treated differently in the Canadian approach.

The first general difference is largely a philosophical one, that is, limit state versus working stress. Both can produce equivalent safety, and discussion of both is addressed in TTR-411. However, the fact remains that the approaches are different, and that in certain cases, the Canadian approach would not control the I design. For example, the CSA does not call for the

• severe environmental" load case called for in CC-3230-

1. This category in ASME accounts for the effects of wind and an Operating Basis Earthquake (OBE). The CSA accounts for wind under " normal service" and does not define an OBE. He ramifications of this should be addressed in more detail. The CSA also does not explicitly address the CC-3000 loads of P,(test pressure), G (loads from relief valve actuation), Py(external pressure due to outside-inside pressure differential), or H, (hydrostatic loads due to flooding during an accident).

Finally, all of the Canadian load factors are low by U.S. code standards. He Canadian limit state method is very similar in formulation to the ACI-349 ultimate strength design, which cr.n be considered of equivalent safety to ASME CC-3000. ACI-349's basic design formula is that the factored loads should not exceed $g, where $ is a performance factor and R is the nominal resistance of the structural element. His L is analogous to the CSA standards. Further, the $ factors are very nearly the same for the two codes. For s tension and flexure, $4a=0.9; for shear and torsion, $Aa=0.85; for plain concrete, $Aa=0.65; and for axial I

compression, $4a ranges from 0.7 to 0.75. In the Canadian Standard for tension and flexure, &cs4=0.85; for shear and torsion, &cs4=0.85; for plain concrete, &cs4=0.65; and for axial compression, &cs, is 0.6 for the concrete component and 0.85 for the steel. Though complete generalization cannot be made because of the different definitions of c, in most cases involving the containment where the steel elements control the j design and carry most of the load, the CSA load factors are about 10% lower than the ACI standards. The ultimate methods in the U.S. normally require a load factor of 1.4 on dead loads and 1.7 on live loads, not 1.25 and 1.5 as specified in the Canadian Standards.

E g Differences in Seismic Reauirements The differences in the seismic design approaches was well summarized in a recent Argonne Report' which states:

I L ne Caaediaa aFFreech io setemic desisa. as eroFosed ia the C^xou 3 desisn. differs in several respects from U.S. requirements. First,10CFR100, Appendix A, defines a safe shutdown earthquake (SSE) and an operating basis earthquake (OBE)." (However, a proposed change to 10CFR100, Appendix A, would eliminate the OBE from consideration in advanced LWR design.) "The Canadians define a design basis earthquake (DBE) which 21 l

l

________________________a

E e

is analogous to the SSE." (A footnote to 10CFR100, Ap :ndix A recognizes this interchangeable nomenclature.) "However, there is no AECB equivalent of the OBE.

Rather, a site design earthquake (SDE) with a 100-year return period is defined.

Second, because the primary heat transport system is designed to survive a DBE, a DBE-induced LOCA is not considered a design basis event in the Canadias approach. This means that the emergency core cooling system (ECCS) is not designed or qualifie,1 to cope g with a LOCA simultaneous with a DBE. However, the ECCS and its backup moderator 5 cooling system are designed to maintain their structuralintegrity following a DBE and remain functional in a SDE which is assumed to occur 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> after a LOCA.

The USNRC rules that govem this latter situation are 10CFR100, Appendix A and GDC

35. The first requires that the ECCS remain functional following the SSE (or DBE). "Ihis is interpreted to mean functional in all aspects, e.g., coolant injection, recirculation, and the like. GDC 35 requires that the ECCS function following any loss of reactor coolant.

Taken together, these citations appear to require the ECCS io function following a DBE concurrent with a LOCA.

Finally, the Canadian rules for containment design (AECB,1991) and their corresponding implementation in CANDU, require that the containment: (1) limit releases of radioactive material following a LOCA; and (2) remain functional following a DBE when the containment is credited in the safety analysis following such an event. Since, as noted above, a simultaneous LOCA and DBE is not a design basis event, the contairunent is not designed for that condition. USNRC requirements for LWR concrete containment design are mainly covered by 10CFR50, Appendix A, and GDC 1,2,4,16, and 50. The USNRC staff considers GDC 1 to be met if the containment is designed according to the requirements of the ASME Boiler and Pressure Vessel Code,Section III, Division 2. The i code enumerates a number of load combinations required to be accommodated by the structure, among which is the loading due to thermal and mechanical forces from a LOCA acting simultaneously with loads generated by the SSE (or DBE)."

In addition to these code differences, the applicant's submittal is deficient because of lack of description of the way that the seismic hazard (site conditions, etc.) is defined. Such description and detailed development is required by the SRP. l j

i I,

B

I Basis for Acceptance The basis for acceptance under the Loads and Load Combinations Section is to show that the containment will withstand the loads and load combinations stated herein under the Acceptance Criteria. The Canadian discussion of load combination differences found in TTR-423 is insufficient to prove that the containment will satisfy the U.S. code loads and combinations requirements.

I Additional Information The applicant needs to provide documentation that shows that the containment i has been checked for the load cases specified in ASME CC-3000 and that the loads have been defined in accordance with the SRP (some of which has been reiterated in our review herein). Further, a more in-depth comparison of the limit state design method versus the ASME CC-3000 design requirements than that provided in TTR-411 is recommended.

! Evaluation The loads and load combinations have sufficient differences that warrant further work on the part of the applicant in order to demonstrate compliance. The reviewers believe that the issues surrounding the use of the limit state method versus the working stress method are benign. The working stress method and the ultimate strength (or limit state) method give equivalent levels cf safety. Further, the ultimate strength method and the limit state method are equivalent for the same

I load factors. However, the ultimate strength methods in the U.S. normally require a load factor of 1.4 on dead loads and 1.7 on live loads, not 1.25 and 1.5 as specified in the Canadian Standards for the limit state method.

4.1.3 Design and Analysis Procedures In this section we outline some general design and analysis issues and then present the specific requirements and findings of the review. The procedures of design and analysis utilized for concrete containment, including the steel liner, are acceptable if found in accordance with those stipulated in I Article CC-3300 of the ASME Code. Enhancements and emphasis to these procedures are provided there and in the subsections below.

The geometry and material selected should be consistent with the technical and functional requirements set forth herein. There are, however, important aspects of geometry that should be emphasized. The >

containment designer must exercise care in the contaimnent layout to facilitate constructability, inspectability, serviceability, and maintainability of the containment and its contents. This includes consideration of all refueling operations and containment, fluid system and reactor vessel service and inspection requirements. Other lessons leamed in recent years in containment arrangement are I summarized in Appendix E of this document.

I l

3 I  !

l

E e

Again, in the interests of readability and brevity, much of the discussion about design considerations has been included in Appendix F of this report. Likewise, much of the discussion of containment analysis requirements and related issues has been included in Appendix G. In the subsections that follow, we will focus on the critical design issues for the CANDU 3 containment, namely, the design of a reinforced concrete containment.

Desien of Reinforced Concrete The primary load resisting component of the containment is the reinforced g concrete (R/C) wall, therefore, the design methods used for this component are carefully compared. The 5 liner, on the other hand, though important for providing the leak tight boundary, is not regarded by the ASME Code as a strength element. Liner and anchorage considerations are discussed in Appendices F and H of this report.

The Canadian design of all R/C structures conforms to CAN3-N287.1-M82, " General Requirements for I

Concrete Containment Structures for CANDU Nuclear Power Plants", which by way of direct reference requires conformance with Canada's general R/C Building Code, CAN3-A23. This is similar to the USNRC requirements which require conformance with the ASME Code (Section CC) with reference to the g

ACI-349 Building Code. However, there is one very important difference, CAN3-N287.1 is not a 5 comprehensive design code, whereas Section CC of the ASME Code is. CAN3-N287.1 only defines and delineates the responsibilities of the plant owner, designer, fabricator, and material manufacturer, and it specifies documentation and QA requirements. It does not provide design requirements. All design requirements are given in CAN3-A23. Articles CC-1000 to 8000 of the ASME Code, on the other hand, specify complete design requirements including general design rules, concrete and rebar testing, loads and load combinations, fabrication, construction, post-examinations, testing, etc. These issues are covered in the Canadian Building Code, and this compares quite closely to ACI-349, even down to reinforcing details and design rules. However, the primary licensing issue is as described earlier, namely, the CC Articles g

are substantially different than the Canadian Building Code. 5 A detailed list of the differences would be quite lengthy. One of the more important differences is in the way that the CC articles are especially tailored to containment design and, thus, address critical issues peculiar to containments. One of these issues is the 45' reinforcement used in U.S. containments to carry seismic loads. U.S. containments are normally designed using the defense-in&pth concept of 4-way i

reinforcement. This consists of having separate reinforcing layers designated to carry certain loads or stresses. These stress types are hoop tension, meridional tension, radial shear, and tangential shear.

(There is also " peripheral" or " punching" shear adjacent to local penetrations, but the four main stresses g are those that occur globally.) The CC Articles have rules for designing individual rebar layers, such as 5 the requirement that v, = 0 for tangential shear, and even rules for placement of the layers, such as the 24 I

=

c requirement in CC-3422 that tension diagonal reinforcement be layers either " sandwiched" between hoop layers or the individual layers should be tied at their intersections. De Canadian Standards have no such requirements.

As previously described, the applicant may argue that their procedures provide an equivalent level of safety, but there is no argument that the standards by which the designs are measured are different. As a final note on R/C design standards, using the limit state method found in the Canadian Building Cc 4 will allow the " shared" responsibility of the rebar layers for carrying the various stresses occurrmg in t.ne containment wall. The role-playing" approach of a 4-way reinforcement system required by the CC Articles will, in general, produce a more redundant and, thus, more conservative design, his difference in design philosophy requires that the applicant check the CANDU 3 rebar design by the ASME Code and demonstrate compliance on a rather detailed level or compaiison.

4 Basis for Acceptance While there is much similarity in the Can tdian and U.S. design basis requirements for containments, as discussed above and in Appendices D, E, F, and G, there are significant differences.

There are two bases for acceptance: either the Canadian requirements must be augmented so that they substantially meet USNRC requirements; or the CANDU 3 design requirements must be changed to conform to both Canadian and USNRC requirements.

Evaluation In general, the Canadian design and analysis requirements for containments do conform to USNRC requirements. However, based on the documents reviewed, some specific USNRC requirements are not met by the proposed CANDU 3 design and analysis procedures.

4.1.4 Structural Acceptance Criteria Acceptance criteria for the individual topics of Codes and Standards, Loads and Load Combinations, and Design and Analysis Procedures have been described in the preceding subsections. The primary set of structural acceptance criteria are allowable stresses since the ASME Code is a working stress document.

h Therefore these are described in this section along with some other specific acceptance criteria pertaining ]

to external hazards and to foundations. l Allowable Stresses For the structural portions of the containment, the specified allowable limits for stresses and strains are acceptable if they are in accordance with CC-3400. For the liner and its anchorage system, the specified limits for stresses and strains are acceptable if in accordance with Tables CC-3720-1 and CC-3730-1.

2S g

\E D

Foundation Structural Acceptance Criteria For each of the loading combinations referenced in this section, I

the allowable limits which constitute the acceptance criteria are referenced in Subsection 11.5 of SRP 3.8.1 for the containment foundation, and are listed in Subsection II.5 of SRP 3.8.4 for all other foundations.

In addition, for the five additional load combinations delineated in this section, the factors of safety against overturning, sliding and floatation are acceptable if found in accordance with the following:

Minimum Factors of Safety For Overturning Sliding Floatation Combination 1 1.5 1.5 -

2 1.5 1.5 -

3 1.1 1.1 -

4 1.1 1.1 -

5 - -

1.1 I

Acceptance Criteria Differences The differences in acceptance criteria are directly related to the differences in the design bases discussed in Sections 4.1.2 and 4.1.3; the main differences are related to the differences between the limit state method and the working stress method and with the U.S. requirement for 4-way reinforcement in the containment wall.

Basis for Acceptance There are two bases for acceptance: either the Canadian requirements must be augmented so that they substantially meet USNRC requirements; or the CANDU 3 design requirements must be changed to conform to both Canadian and USNRC requirements.

Evaluation in general, the Canadian acceptance criteria for containments do conform to USNRC requirements. However, some specific USNRC requirements, such as the use of the working stress limits and 4-way seismic reinforcement are not included in the Canadian acceptance criteria.

4.1.5 Materials, Quality Control, and Special Construction Techniques in general, the specified materials of construction are acceptable if they comply with Article CC-2000 of the ASME Code augmented by Regulatory Guides 1.107 and 1.136. Quality control programs are i 26 I I

\

g acceptable if in accordance with applicable portion of Articles CC-4000 and CC-5000, NCA-4000 and NCA-( 5000 of the code.

Acceptance Criteria and Acceptance Criteria Differences In the interest of clarity and brevity,in Appendix

{ H, we comparc selected USNRC and comparable Canadian requirements for materials, quality control, and special construction techniques are compared. 'Ihis discussion is by no means complete. In some cases we describe USNRC requirements with no discussion of comparable Canadian requirements. This does not imply the absence of Canadian requirements.

Basis for rf entance Although the Canadian and USNRC requirements for materials, quality control, and h special v.astruction techniques are similar, and in many cases equivalent, they are not the same. As discussed earlier, there are only two bases for acceptance, either the Canadian requirements must be augmented so that they substantially meet USNRC requirements; or the CANDU 3 design requirements be changed to conform to both Canadian and USNRC requirements.

Evaluation It is our opialon that Canadian requirements for Materials, Quality Control, and Special Construction Techniques, as presented in the &cuments reviewed, are substantially the same as USNRC requirements, and that there shoul.1 be no unusual difficulties in meeting USNRC requirements.

4.1.6 Testing and Inservice Surveillance Requirements Concrete Containment inspectiog_Rgauirements Requirements for the inspection of Class CC concrete containments should be according to Section XI, Division 1, Subsection IWL of the ASME Code which contains requirements for preservice examination, inservice inspection, pressure tests, repairs, modifications and replacements for operating light-water cooled nuclear plants. These requirements should be met for the containment even though USNRC approval of this subsection of the code is still pending.

Inservice inspection Periodic inspections of the concrete surfaces, anchorages and other features are required throughout the lifetime of the plant. 'Ihe inspections are required at one, three and five years

{ following the Structural Integrity Test (SIT) required by CC-6000, and every five years thereafter. For the one , three- and five-year inspections, the inspections must commence not more than six months prior to the specified dates and be completed not more than six months after such dates. If plant conditions are such that the inspections cannot be completed within the stated time interval, the remaining portions may 27

E

=

be deferred to the next regularly scheduled plant outage. The ten-year and subsequent inspections must commence not more than one year prior to and be completed not more than one year after the scheduled dates.

Structural Intecrity and Leak Rate Testine Requirements The containment leakage testing requirements, which must conform to 10CFR50 Appendix J, cover the following specific areas:

• Containment integrated leakage rate tests (Type A tests as defined by Appendix J), including pretest requirements, general test methods, acceptance criteria for preoperational and periodic leakage rate tests, provisions for additional testing in the event of failure to meet acceptance criteria, and scheduling of tests.

• Containment penetration leakage rate tests (Type B tests as defined by Appendix J), includmg I

identification of containment peactrations, geneal test methods, test pressures, acceptance criteria, and scheduling of tests.

• Containment isolation valve leakage rate tests (Type C tests as defined by Appendix J), including identification of isolation valves, general test methods, test pressures, acceptance criteria, and scheduling of tests.

CC-6000 specifies the requirements for structural integrity testing of concrete containments. The test and I

instrument plan is defined by the designer and implemented by the constructor. Structural response predictions are required (see CC-6160), including displacements, and they should be made prior to the start of the test. Prior to pressure testing, a thorough visual examination is required (see CC-6210), in g order to record conditions such as spalling or unusual cracking of the concrete; bulging, deformation, or 5 other damage to the liner; and other data which may be needed to interpret the behavior of the containment. Test instrumentation requirements are covered in CC-6220, including accuracy on displacements, strains, pressure, crack measurements, and temperature.

The internal pressure is to be increased from atmospheric pressure to test pressure at a rate (CC-6321) not I

to exceed 20% of test pressure per hour, and held for at least one hour (CC-6320). Surface cracking of the concrete is of concern, and any cracks that exceed a width of 0.25 mm and 150 mm in length must be mapped before, during and after the test (CC-6350).

28 I

I The related Canadian Standards are found in CAN3-N287.6-MSO (Pre-Operational Proof and Leakage Rate Testing Requirements for Concrete Containment Structures for CANDU Nuclear Power Plants). Even though the standards do not specifically require the designer to prepare the test and instrument plan, the instrumentation must be defined in the specifications. Specific tests and procedures are required and defined in Sections 4,5,6, and 7 of CAN3-N287.6-M80, and the designer is required to evaluate and report on all the test results (see 4.4 and Section 8). In this set of standards, pretest predictions, as identified in CC-6160 of the ASME Code, are not mentioned. However, visual exams prior to and during pressure I testing are required, Section 43.1; precision and calibration of instruments are specified in Sections 3.3.2, 3.3.3, and 4.2; test procedures are specified in Sections 4.1 and 5.2; and Section 3.43 stipulates that maps should be made showing all crack patterra, their locations, and their widths at atmospheric pressures and all inspection stages for each proof test performed.

Liner Material Impact Testing CC-2521(a) exempts, among others, carbon steel and low-alloy steel liner i materials from impact testing for plate thicknesses less than 5/8 inch and for studs 1 inch in diameter, since the apparent fracture toughness will be artificially high for this section. The Canadian Standards supplement the requirements of CSA CAN3440.20, general requirements for rolled or welded structural I quality steel and requires additional test considerations, but Paragraph 8.2.4 of CSA CAN-N287.2-M82 exempts materials less than 16 mm (0.63 in.) from Charpy V notch impact testing. The Canadian and U.S.

codes are in agreement with regard to liner materialimpact testing.

Applicable Codes. Standards and Specifications for Testing The containment SIT and leakage rate testing program will be acceptable if it meets the requirements stated in Appendix J of 10CFR50. Appendix J provides the test requirements and acceptance criteria for preoperational and periodic leak testing of the containment, and of systems and components which penetrate the containment.

I Conformance with the requirements of Appendix J should be achieved by following rules set forth in the ASME Code,Section III, Division 1 or 2 for steel or concrete containments, respectively. This constitutes an acceptable basis for satisfying the requirements of the following GDC applicable to containment leakage rate testing:

I

• GDC 52 as it relates to the reactor containment and exposed equipment being designed to accommodate the test conditions for the containment integrated leak rate test (up to the containment design pressure).

f

{I I 29 I

E o

a GDC 53 as it relates to the reactor containment being designed to permit appropriate inspection of important areas (such as penetrations), an appropriate surveillance program, and leak testing at the containment design pressure of penetrations having resilient seals and expansion bellows.

• GDC 54 as it relates to piping systems penetrating primary reactor containment being designed with a capability to determine if valve leakage is within acceptable limits.

I 10CFR100,100.11 requires that as an aid in evaluating a proposed nuclear power plant site, the designer should assume the expected demonstrable leak rate from the containment. Nuclear power plant leak testing experience shows that a design leak rate of 0.1% per day provides adequate margin above typically measured containment leak rates and is compatible with current leak test methods and test acceptance criteria. Herefore, the maximum acceptable design containment leakage rate should be less than 0.1%

per day. ,

Basis for Acceptance Although the Canadian and USNRC requirements for testing and inservice g inspection are similar, and in many cases equivalent, they are not the same. As discussed earlier, there W are only two bases for acceptance, either the Canadian requirements must be augmented so that they substantially meet USNRC requirements, or the CANDU 3 design requirements be changed to conform to both Canadian and USNRC requirements.

Evaluation It is our opinion that the Canadian requirements for Testing and Inservice Inspection, as I

presented in the documents reviewed, are substantially the same as the USNRC requirements, and that there should be no unusual difficulties in meeting USNRC requirements.

4.2 Containment Pressure Boundary Through USNRC-rponsored and industry-sponsored research, it has been determined that the margin of safety in concrete containments (defined as a multiplier on the design pressure) against any type of structural failure is typically in the range of 2.5 to 3.5. More importantly, however, is that failure of concrete containments is forgiving; the most likely failure mode by is leakage through localized liner tears.

His is supported by extensive experimental and past evidence as well as the SNL test of a 1:6 scale concrete containment model. It should be noted, however, that tests of scaled pressure boundary concrete structures reported in the literature have often used hydrostatic pressurization which upon failure g initiation tends to seek its own equilibrium leak rate, and therefore is not a suitable method for 5 30

.I

investigating catastrophic rupture. Thus, it is not experimentally known at the present time whether catastrophic failure would occur in concrete containments under pressurization rates postulated for severe accidents. This question must remain a matter of conjecture, and it can be considered to be addressed in the CANDU 3 and other current non-U.S. designs through engineered overpressure protection.

I In this section, we address containment performance and its ability to meet postulated challenges. It is now, therefore, appropriate to focus on methods for evaluating this performance and the containment I response to challenges,i.e., requirements for structural analyses to ensure the containment integrity under the stated loading conditions. As described in the codes and standards to which the containment must be designed, these analyses must predict global and local behavior of the containment when it is subjected to a variety of load combinations, but the response range of interest in the design codes and standards is elastic response.

It should be recognized that there are fundamental differences between design analysis and failure analysis. In this regard, it is appropriate to discuss some recent lessons learned'in containment analysis and failure prediction to provide the applicant, in advance, with the type of analyses that future U.S.

containments will almost certainly be evaluated. While nonlinear failure analyses (nat are necessary in beyond design basis evaluation are not specifically required by current codes, the designer of new plants should utilize appropriate analytical and material modeling technology so that the progression from design-basis analysis to beyond design basis and failure prediction is a smooth one.

4.2.1 Capability to Contain Design Basis Accidents I 4.2.1.1 Design Basis Analysis I Contamments are constructed to withstand design pressures while experiencing stresses no greater than those specified in the codes cited herein. Historically, design pressures are based on energy balance calculations from the assumption of a loss of coolant accident (LOCA). The pressure in the containment is a result of the total steam produced, assuming a closed free volume and less the amount of energy dissipated through the heat sinks. Once design pressure is e stablished, the containment is typically analyzed by routine elastic analysis to ensure that code all'wr. ole stresses are not exceeded. It has not been until the 1980s that detailed containment failure analyses have been conducted for overpressure conditions. Because of the highly nonlinear behavior of containment structures, the analytical requirements for failure analysis differ significantly from those for design analysis.

I I 31 I

O

=

The CANDU 3 submittal did not contain any results of design basis analysis of the containment. Indeed, as discussed earlier, the CANDU 3 containment reinforcement design has not been provided.

Basis for Acceptance The basis for acceptance of the containment design basis analysis is given in the ASME Code.

Evaluation Since many of the important CANDU 3 containment structural design aspects are not yet I

5 complete, a more detailed review will be required later. Based on the documents reviewed and with the exception of the issues discussed in Sections 4.1.1,4.1.2,4.1.3, and 4.1.4, which are not minor issues, we do not expect that there will be any unusual difficulties in meeting the acceptance criteria for design basis analysis.

4.2.1.2 Fracture Prevention The containment boundary must be designed with sufficient margin to assure, under normal operating conditions (including anticipated operational occurrences, maintenance, testing, and postulated accident conditions), that its ferritic materials behave in a nonbrittle manner, and that the probability of rapidly propagating fracture is minimized. The design should reflect consideration of service temperatures and other conditions of the containment boundary material during normal operating conditions, including anticipated operational occurrences, maintenance, testing, and postulated accident conditions, and the uncertainties in determuung material properties, residual stresses, steady state stresses, transient stresses, and size of flaws.

This criterion is similar to GDC 51 in 10CFR50 Appendix A, except for the addition of the phrase

" including anticipated operatione: occurrences". The intent of this criterion is to minimize the likelihood I

of catastrophic mechanical failure of the containment pressure boundary (during normal operations and 5 during those accident sequences for which the integrity of this boundary has been assumed in the safety analyses) which would result in the loss of its ability to isolate contained radioactive material from the environment. To ensure that this criterion is met, the rules in ASME CC-2520 must be followed: " Fracture Toughness Requirements for Materials". The specific requirements for the containment liner are provided here for emphasis.

Acceptance Criteria The containment liner should meet the fracture toughness requirements for material prescribed in ASME NE-2300, in particular the limits on the temperature difference between the lowest g serdce metal temperature (LST) and the Tym given in Table NE-2311(a)-1. Txm is the temperature at or E 32

=,

above the nil-ductility transition (NDT) temperature, as measured by the drop weight tests of ASTM E 208.81. The ferritic materials listed in Table NE-2311(a)-1 are exempt from impact testing if LST-Tmyr satisfies the conditions given in Appendix R of Section III of the code. Special consideration should be given to any requirement for overpressure testing that may give rise to the need to define a Lowest Overpressure Test Metal Temperature that is lower than the LST (NE-2331(b)). If the requirements for Charpy energy, lateral expansion, etc. given in Tables NE-2332.1-1 or NE-2332.1-2 cannot be met, the procedures of Appendix G which are based on linear elastic fracture mechanics evaluation may be used.

I If this option is used, approval of the procedures for Level C and Level D Service Conditions should be obtained from the Owner or the Owner's designee.

It should be noted that adherence to the requirements of this section, and the code, to standard engineering practice for safeguarding against brittle failure modes is a necessary but insufficient condition for preventing rupture of the pressure boundary at beyond-design-basis loadings. Scale model tests have shown that steel containments, in particular, can fail in a catastrophic rupture mode.

Section 6.2.7 of the SRP describes the types of analyses related to fracture prevention that must be I performed to demonstrate compliance with this GDC. Similar analyses will be required for the CANDU 3 containment to demonstrate that this design criterion is met.

Accentance Criteria Differences There are only minor differences between the Canadian and USNRC requirements for fracture prevention of the containment that require resolution before licensing.

Evaluation Based on the documents reviewed, we believe the Canadian requirements for fracture prevention of the containment are equivalent to USNRC requirements.

I 4.2.2 Capability to Contain Severe Accidents Requirements for containments and other safety systems to contain severe accidents that are beyond design basis have not yet been applied to new plant applications. However, many changes have been made in existing plants as a result of the TMI severe accident and the ensuing TMI Action Plan (NUREG-0660" and NUREG-0737"), information from USNRC and industry sponsored research, and data from construction and operating experience. The " Policy Statement on Severe Reactor Accidents Regarding Future Design and Existing Plants" published in the Federal Register, Vol. 50, p. 32138, on August 8,1985, i

describes the policy the Commission intends to use to resolve safety issues related to reactor accidents I more severe than design basis accidents. A fundamental objective of the Commission's severe accident policy is that the Commission intends to take all reasonable steps to reduce the chances of occurrence of 33

E O

a severe accident involving substantial damage to the reactor core and to mitigate the consequences of such an accident thould one occur. 10CFR50.34(f)52 details extensive " additional TMI-related requirements." Although 10CFR50.34(f) was required for applications pending as of February 16,1982 and has not been amended, we believe the Commission intends that all new applications should meet these requirements.

Section B of the Policy Statement describes the policy for New Plant Applicants. The following has been extracted from Section B:

"Therefore, even in the absence of new CP applications, in order to provide guidelines for the current reference design reviews, the Commission has recognized the need to promptly establish the criteria by which new designs can be shown to be acceptable in meeting severe accident concerns. 2. Criteria and Procedural Requirements .

c. Completion of a Probabilistic Risk Assessment (FRA) and consideration of the severe accident vulnerabilities the PRA exposes along with the insights that it may add to the assurance of no undue risk to public health and safety. In addressing criteria (b) and (c), the applicant for approval or certification of a reference design should consider a range of attematives and combinations of attematives to address the unresolved and generic safety issues and to search for cost effective reductions in the risk from severe accidents."

The Commission established a policy for existing plants that required licensees to perform plant specific I

probabilistic risk assessments (FRA). These assessments exposed relatively unique vulnerabilities of specific plants to severe accidents. Generally, the undesirable risk from these unique vulnerabilities were reduced to an acceptal 'e level by inexpensive changes in procedure or minor design modifications.

Even without any new plant applications since TMI, the intent of the Commission is clear and unambiguous. New applicants and preapplicants should complete PRAs and consider the severe accident vulnerabilities unique to each plant or plant design. The purpose of this consideration of severe accidents is to expose vulnerabilities along with the insights that it may add to the assurance that there is no undue risk to public health and safety and to provide guidelines for the review and acceptance of new applications. NUREG-1150 provides the Commission's draft assessment of severe accident risks for a set of typical plants. It is intended to provide the licensing staff with benchmarks for their evaluation of individual plants.

34 I

I The containm t system clearly is one unique feature of all plant designs to which this requirement should be applied. For practical purposes the design and acceptance of a steel lined, reinforced concrete containment structure such as CANDU 3 for design basis loadings is straightforward. All that is required is that approphte reinforcement be provided to resist gravity, the containment design pressure, and SSE loadings. However, since the containment system is one of the safety systems most heavily relied upon to prevent undue risk to public health and safety, it is logical that it also is one of the systems that would be intimately involved in an assessment of severe accident vulnerabilities. 'Ihus, one of the most I important uses of the insights gained through beyond design basis assessments is in the design or in the modification of the design of the containment. This is particularly relevant for containment design parameters such as: (1) containment failure pressure versus design pressure; (2) leak-before-break confirmation, SECY-93-087; (3) liner thickness and material specification; (4) liner anchorage system; and (5) ultimate pressure performance of containment penetrations. Note that none of the above is considered in design basis loading and acceptance.

I 4.2.2.1 Ultimate Failure Pressure Analysis I As has been established by the recent studies conducted in the development of NUREG-1150, there are many uncertainties involved in the calculation of the design pressure. Significant probabilities exist for the occurrence of pressures in excess of the design pressure due to severe accident conditions not previously considered.

I As the Sandia National Laboratory's 1:6-scale model and a variety of containment model tests" have shown, to predict containment failure requires explicit analytical treatment of local liner or shell details and stiffness discontinuities. At high pressures, prediction of local effects such as cracking-induced liner / anchorage / concrete interaction in concrete containments and local stiffener details in steel I containments become a critical part of calculating failure mode and failure pressure of the containment.

For purposes of this discussion failure is defined as a substantial loss of containment function, i.e., failure to contain the radionuclide contents of the containment to within specified leakage goals (which for severe accident criteria may be larger than the design basis leakage rate). Failure does not necessarily constitute the burst mode or burst pressure.

As recently as five years ago, it was generally assumed that concrete containments would fail in global hoop expansion of the barrel (burst mode). But the latest experiments and detailed local analyses have shown that, even though the liner is quite ductile, the strain concentrations which occur next to I discontinuities or at anchorages will likely cause liner tears prior to the occurrence of barrel burst mode failure. The burst mode in a steel containment may be more probable than in a concrete containment, but 35 I

E o

there is also some measure of probability of leak before break in steel containments. In either case, it is far more difficult to predict when and where a local tear will occur and what the leakage behavior will be than it is to calculate the ultimate burst pressure of the containment.

Acceptance Criteria Differences The CANDU 3 preapplication does not address severe accident or loadings beyond design basis. Nothing in the CSR addresses this issue. Part 3 - Safety Analysis does address Probabilistic Safety Analysis, but not for this purpose and not for the containment. Even the Category D events do not include any loadings beyond design basis. The AECB R-7 document indicates 3 no such requirements for containments. 'ITR-411 does not address this issue.

Basis for Accentance Since there are no established acceptance criteria for beyond design basis analysis, I

it is the responsibility of the applicant to develop acceptance criteria appropriate to their design. (It is the intent of this review to provide guidance to the applicant for this task.)

Evaluation The Canadian practice of not requiring PRA and consideration of the severe accident vulnerabilities that the PRA exposes along with the insights that may be added to the assurance of no g

undue risk to the public health and safety does not conform to USNRC requirements. It is our 5 judgement that, for this same reason, the Canadian design requirements for containment structures also do not conform to USNRC requirements.

4.2.2.2 Basemat/ Liner Ability to Withstand Core Debris Acceptance Criteria There does not appear to be any established acceptance criteria for the Basemat/

Liner Ability to Withstand Core Debris. This requirement was only recently approved by the Commission in an SRM42 associated with SECY-93-087, " Policy, Technical, and Licensing Issues Pertaining t E

Evolutionary and Advanced LWR Designs," specifically Item 4, "I. H. Core Debris Coolability". This 5 requires that designs meet the following criteria:

• Provide reactor cavity floor space to enhance debris spreading.

I

• Provide a means to flood the reactor cavity to assist in the cooling process.

• Protect the containment liner and other strudural members with concrete,11 necessary.

• Ensure that the best estimate environmental conditions (pressure and temperature) resulting from core / concrete interactions do not excee.1 Service Level L for steel containments or Reactor Load Category for concrete containments, for approximately 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />. Ensure that the containment 36 B:

=

I capability has margin to accommodate uncertainties in the environmental conditions from core / concrete interactions, I

The Canadian submittal addressed this issue in some detail in Section 10 of TTR-429, " Comparison of CANDU 3 with USNRC Positions for Evolutionary LWR Certification Issues in SECY-90-016."

13 asis for Acceptance in the absence of formal acceptance criteria, the applicant must demonstrate conformance with these requirements.

Evaluation Although the discussion in TTR-429 does not fully resolve this issue, it is our opinion, based on the documents reviewed, that the CANDU 3 design will not have any unusual difficulties in meeting USNRC requirements.

I I

I I

I I

E 37 I

a _. - -- .-. r. mLA a. m 4 2 , sya a i

Ol I, ,

I I! ,

I; 1

4 I

1 l l

4 4

I U

f

< 38 1

e

5.0 REVIEW OF CONTAINMENT FUNCTIONAL DESIGN 4

The containment is designed for an unavailability of not more than 10 yr/yr. The containment envelope is seismically qualified for DBE.

lI 5.1 Containment Isolation Systems The design objective of the containment isolation system is to allow the normal or emergency passage of fluids through the containment boundary while preserving the ability of the boundary to prevent or limit the escape of fission products that may result from postulated accidents. The review guidance for the I containment isolation system is found in SRP" Section 6.2.4. The review is concerned with the isolation of fluid systems which penetrate the containment boundary, including the design and testing requirements for isolation barriers and actuators.

I The design acceptance evaluation of the containment isolation system is based predominantly upon the 7

safety issue discussion regarding the CANDU 3 isolation system found in Section 4 of TTR-411, titled I 8 "CANDU 3 and the U.S. NRC Requirements," and on TTR-423, titled "CANDU 3 and the U.S. NRC General Design Criteria". Similaritics and differences between the CANDU 3 design and U.S. NRC acceptance criteria were identified and evaluated. The Canadians assert that the CANDU 3 containment isolation system has a level of safety equivalent to the requirements of the U.S. NRC.

The Technical Description' and other documents available to SEA were insufficient for detailed verification of the design. For instance, we could not examine each containment penetration one by one to verify the isolation design for each particular penetration. A general evaluation was done.

Acceptance Criteria The applicable acceptance criteria for the isolation system are found in Section 50.34(f)", GDC 1,2,4,16,54,55,56, and 57 of 10 CFR Part 50" and SRP Section 6.2.4.

• Section 50.34(f) requires: a) automatic isolation of all non-essential systems, b) two isolation barriers in series for each non-essential penetration except instrument lines, c) the resetting of the isolation signal cannot reopen isolation valves, d) the set point for initiating isolation is set as low as is compatible with normal operation, and e) automatic closure upon a high radiation signal for all systems providing a path to the environment.

I

• GDC 1 requires quality standards commensurate with the importance of isolation.

I 39

cl La O

• GDC 2 requires the isolation system be designed to withstand the effects of natural phenomena without loss of capability to isolate the containment.

• GDC 4 requires the isolation system be designed to accommodate postulated environmental conditions and protected against dynamic effects.

• GDC 16 requires the isolation system, in concert with the reactor containment, provide an essentially leak tight barrier against the uncontrolled release of radioactivity to the environment. 3

• GDC 54 requires the isolation of piping systems penetrating the containment along with leak detection and containment capabilities having redundancy, reliability, and performance reflecting the importance of their isolation, including a capability to periodically test the operability of the isolation valves and associated apparatus.

• GDC 55 requires each reactor coolant pressure boundary line that penetrates the primary reactor containment be provided with a containment isolation valve both inside and outside the containment unless acceptability can be demonstrated on some other defined basis for a specific class of lines, such as instrument lines. The isolation valves may be either a locked closed valve (sealed closed barrier) or an automatic valve except that a simple check valve may not be used for isolation on the outside of the containment. Isolation valves outside the containment shall be located as close to containment as practical and upon loss of actuating power, automatic isolation valves shall be designed to take the position that provides greater safety.

• GDC 56 requires each line that connects directly to the containment atmosphere and penetrates the reactor primary containment be provided with containment isolation valves as detailed in GDC 55 unless acceptability can be demonstrated on some other defined basis for a specific class of lines, such as instrument lines.

GDC 57 requires lines that penetrate the primary containment boundary and are neither part of the reactor coolant pressure boundary nor connected directly to the containment atmosphere be provided with at least one locked closed, remote-manual, or automatic isolation valve outside containment. The valve may not be a simple check valve and it will be located as close to the contaimnent as practical.

These GDC established requirements for the design, testing, and functional performance of the isolation system. In general, two isolation barriers in series are required to assure that the isolation function is 40

=

I maintained assuming any single active failure. Alternative provisions to the explicit requirements are acceptable if justified and the SRP lists specific criteria necessary to meet the relevant requirements.

Acccotance Criteria Differences The USNRC and Canadian containment isolation system design requirements are similar and have the same design objective, however there are significant differences.

• The USNRC criteria specifically require one isolation valve inside and one outside the containment except that both may be outside containment when it is not practical to locate one inside.

However, when both valves are located outside the containmeat, the valve nearest the containment and the piping between the containment and the valve should be enclosed in a leak-tight or controlled leakage housing or in lieu of a housing, a breach in piping integrity is 2

precluded by conservative design of the piping and valve. Canadian Regulatory Document R-7 o requires two valves in series normally arranged with one valve inside and one outside, however both valves may be inside or both may be outside the containment structure if they can be shown to provide an equivalent barrier. While these isolation valve requirements are in general similar, they are not identical and the CANDU 3 design employs two isolation valves in series for lines

'I to the containment atmosphere with both valves located outside the containment.

• The CANDU 3 design does not classify the systems penetrating the containment into essential and non-essential systems as required in SRP 6.2.4 Section II.6.h.

I

• The Canadian Regulatory Document R-7 allows relaxed requirements for small lines. For primary

. heat transport lines smaller than 25 mm diameter, penetrating the containment, a single closed isolation valve inside containment may be used provided the line is connected to a closed system outside containment. Each line penetrating the containment and connecting directly to the atmosphere of smaller than 50 mm diameter requires one closed isolation valve if the line is normally closed to the containment atmosphere and connected to an easily defined closed system outside containment. For small bore ductile piping, crimping of the pipe to provide an isolation barrier instead of a valve is allowed.

I Basis for Accentance The CANDU 3 isolation system is required to seal the reactor building containment envelope automatically upon signal of high radioactivity or an abnormal pressure rise. The design requires that the containment isolation function be maintained assuming any . tingle active failure in the containment isolation provisions, i.e., duel isolation barriers. The containment envelope extends to include I pipes to outside isolation valves, non-isolated closed systems outside containment, and both the new and irradiated fuel refueling ports during refueling. The secondary side of the steam generators is also I 41 I

F' E

a considered an extension of the containment envelope. He design must demonstrate a reliability commensurate with the containment system rnaximum unavailability requirement of 10-' yr/yr.

• AECB Regulatory Document R-7 requires piping systems be provided with isolation devices I

having redundancy, reliability, and performance capabilities which reflect the importance to safety of isolating the various types of piping systems penetrating containment.

• The design Classes 1,2, and 3 of Canadian standards CAN3-N285.038 correspond to the three classes of the same designation in ASME Section III.

• The automatic isolation devices are designed to fail in the safe position.

• A check valve may be used as an automatic isolation valve inside but not outside the containment.

I Two check valves are not acceptable.

• Re valves and piping that form the containment isolation are seismically qualified to the DBE.

• The isolation system is environmentally qualified.

• The status of the containment isolation valves is monitored continuously and all necessary I

automatic actions are initiated from the main control room or the secondary control area.

• The containment is equipped with the Gross Leakage Monitoring (GLM) system indicating any significant breach of containment to the operator.

• Manual isolation valves are locked closed or continuously monitored to show that they are in the closed position.

• All containment isolation actions required in the first 15 minutes of an accident are initiated I

automatically.

• ne system is locked in by control logic until all alarms are cleared and the system reset to prevent inadvertent valve opening after containment isolation

• The valves are periodically tested to ensure operability and to check that the valve leakage is within acceptable limits. Operational isolation tests include: periodic functional testing of all 42 I.

l il automatic closures performed during normal operation, functional operation of airlocks is checked on a regular basis, and the leakage rates of airlock, equipment hatch and ventilation system isolation dampers are checked on a yearly basis.

• The USNRC safety equivalence of classifying systems penetrating the containment as essential or non-essential systems is met by ensuring that all systems connected to the containment atmosphere by a normally open line are automatically isolated on the containment isolation signal.

I The systems that are needed to mitigate accidents are individually identified and are therefore not automatically isolated by the containment isolation signal.

• The design requires that lines connected to the HIS pressure boundary which penetrate containment are provided with two Class 1 isolation valves in series and normally arranged with one valve inside and one valve outside containment. Either an automatically closing or a powered valve operable from the control room is required as one of the two isolation valves for lines normally open during plant operation. 'Ihe design does not allow manualisolating valves within containment. The line from the HTS up to and including the outer isolation valve is constructed I to the requirements of Class 1 per CAN/CSA-N285.0-M91 which essentially implies ASME Code Section III, Subsection NB. Exceptions to normal isolation valve arrangement may include both valves inside or both valves outside based on providing an equivalent barrier and lines smaller than 25 mm diameter that connect to a closed system outside containment may be isolated with a single Class 1 isolation valve inside containment. If the outer isolation valve is inside the containment, then the line from the outer isolation valve to containment penetration is constructed at least to the requirements of Class 2 Code.

The design requires that lines connected to the containment atmosphere which penetrate I

=

containment are provided with two isolation valves in series normally located outside the containment to facilitate maintenance and to avoid exposure to the containment environment.

Two automatic Class 2 isolation valves are required for lines normally open and two closed isolation valves for lines normally closed. The line from and including the isolation valve closest to the containment, up to and including the outer isolation valve is part of the containment envelope and is constructed to the requirements of ASME Code Section III Class 2. Process valves may be used for isolation of closed loops. Exceptions to the normal arrangement are: 1) lines connecting directly to the containment atmosphere but part of a closed system outside containment do not require isolation if they meet the requirements of Class 2, and can be continuously monitored for leaks, and 2) lines of 50 mm diameter or less which are normally closed to the containment atmosphere and connected to a closed system outside containment may 43 1

E e

be isolated with a single Class 2 isolation valve, since this arrangement can accommodate a single active fadure and the possibility of passive failure is very low because the isolation valve is as close to Oc containment as possible.

• The design requires systems that are neither part of the reactor coolant pressure boundary nor connected directly to the containment atmosphere to meet the requirements of Class 2 (implies ASME Section III Class 2) and if they cannot be continuously monitored for leaks, a single valve located as close as possible outside the containment on each line penetrating containment is 3 required. Process valves may be used for isolation of these closed loops. However, isolation is not required for closed systems inside or outside containment which form part of the containment envelope and can be continuously monitored for leaks. In the CANDU 3 design, the main steam lines, which are designed to ASME Section III Class 2 requirements and contain fluids with negligible radioactivity, are not equipped with a containment isolation valve.

• Certain closed systems inside containment (such as the group 1 Recirculated Cooling Water system) which have a design pressure at or greater than 72.5 psig (0.5 MPa(g)), are continuously operated at or above containment design pressure at all points in the system, and can be monitored for leaks, are provided with a single manual isolation valve located outside the containment on each line penetrating containment. These systems are constructed to the requirements of CSA standard CAN/CSA-P ~ . ~.0-M91 Class 6 (non-nuclear) requirements, there is negligible radioactivity in the systems, and the systems design pressure and temperature ratings are more than that for the containment.

• Preapplicant states that instrument lines penetrating containment meet the guidelines of Regulatory Guide 1.11" and the SRP Section 6.2.4. The method of isolation is suitable for each appropriate application, either with an isolation valve or crimping of small bore ductile tubing (19 mm or less) when the tubing designed for crimping is in an accessible area and is readily identifiable.

• Three refueling ports pass through the containment boundary. During normal operation, the ancillary port is closed to containment and connects extemally only to a closed circulating loop.

For the new fuel port, double valves are located at the front and rear of the magazine to allow loading and unloading of the magazine during normal operation. The irradiated fuel transfer port is also enclosed with double valves at each end.

I 44 I.

I

• The moderator system and its auxiliaries are located within containment, except for two lines connected to the D2 O Supply System and the Upgrading System and these are isolated from the containment by two pneumatically operated valves in series.

Additional Information The CANDU 3 containment isolation design requirements differ from the GDC and SRP These difference are allowable provided the altemate design can demonstrate an equivalent barrier capability. Alternate isolation design needing addition justification for certification include:

I

• The alternate valves arrangements of placing both isolation valves inside containment or both valves outside the containment and of using a single valve for smaller lines connected to a closed system outside containment.

• The design latitude of not requiring isolation for closed systems inside containment which form part of the containment envelope, meet the requirements of CSA Standard N285.0 Class 2, can be continuously monitored for leaks, and are neither part of the reactor coolant pressure boundary nor connected directly to the containment atmosphere.

I * 'Ihe use of non-nuclear Class 6 standards in systems requiring isolation, such as the group 1 Recirculated Cooling Water system (TTR-411, Page 4.4-2).

• The crimping of small bore ductile tubing as a possible means of providing an isolation barrier for lines connecting to the reactor coolant pressure boundary, and to the containment atmosphere per conditions specified in AECB Regulatory Document R-7.

A complete review will require additional information in the following areas:

I

• The isolation signal, the diversity of parameters sensed, and setpoints. (The isolation signal in CANDU 3 appears to be initiated only on containment pressure and radioactivity but the SRP diversity includes abnormal conditions in the reactor coolant system, the secondary coolant system, as well as the containment. If the diversity is not included in the design then justification for not including the diversity is needed.)

I

• Containment penetrations to the containment atmosphere normally open as result of providing ventilation to areas of the containment accessible during normal operation. The practice ofaccessing I containment during normal operation differsfrom U.S. practice and therefore should be carefully examined.

I 45 1

l l

I l

E O

= Valve closure times.

. The isolation of the secondary side of the steam generators since it is considered an extension of the containment envelope.

. Loss of function by missiles and pipe whip such as the location of missile barriers.

I Evaluation The CANDU 3 design satisfies the containment isolation safety objectives of the USNRC provided that the alternate isolation designs can be satisfactorily justified as providing equivalent barriers of safety to the USNRC acceptance criteria, the additionalinformation needed for certification meets the acceptance criteria, and there findings can be verified by a detailed review of the desigru 5.2 Containment Heat Removal Systems The containment heat removal (CHR) capability in the CANDU 3 design is provided by the local air g

coolers, known as the Reactor Building Cooling System (RBCS), and by the recirculation mode of the W ECCS. The eight main local air coolers and other coolers in individual rooms, such as the moderator room, shutdown cooling room, and the fueling machine maintenance lock, are designed and sized to handle both the heat loads associated with both normal operation and the heat loads expected following an accident. Each cooling unit comprises air coolers, dampers, and fans, as well as the appropriate piping and instrumentation. The air coolers are supplied with recirculating cooling water. The ECCS removes decay heat from the core and reduces energy transfer to the containment atmosphere under post-accident conditions. The CANDU 3 design does not include containment sprays. We did not evaluate the heat transfer to the passive heat structures.

The design acceptance evaluation of the CHRS is based predominantly upon the safety issue discussion regarding the CANDU 3 CHRS found in Section 5 of TTR-411'. TTR-4238 and the TD' were also used.

Similarities and differences between the CANDU 3 design and U.S. NRC acceptance criteria were identified and evaluated. An adequate level of safety is claimed but the documents available to SEA were insufficient for detailed verification of the CHRS design.

Acceptance Criteria The applicable acceptance criteria are found in GDC 38,39, and 40 of 10 CFR Part 50" and in SRP" Section 6.2.2.

I 46 I.

I

• GDC 38 requires the containment heat removal systems to rapidly reduce the containment pressure and temperature following a LOCA and maintain them at acceptably low levels. These systems are required to be safety-grade design having suitable redundancy to assure that for a loss of either onsite or offsite power the system function can be accomplished assuming a single failure. The containment pressure should be reduced to less than 50% of the peak calculated pressure for the design basis LOCA within 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> after the postulated accident.

g a

• GDC 39 requires that the systems be designed to permit periodic inspection of components.

• GDC 40 requires that the systems be designed to permit periodic testing to assure system integrity, and the operability of the system and active components.

I Acceptance Criteria Differences The Canadian regulations regarding control of the containment 2

atmosphere are found in Section 3.10 of Regulatory Document R-7 '. The regulation regarding the control of the internal pressure simply states: " Systems shall be incorporated into the containment design to assist in the control of the intemal pressure." Here does not appear to be a regulation regarding the control of the atmospheric temperature. Although the Canadian regulations generally have the same safety goals as the corresponding USNRC regulations, they certainly seem less stringent.

A DBE-induced LOCA is not considered a design basis event in the Canadian approach' because the high energy piping is designed to survive a DBE. This means that the CHRS is not designed or qualified to cope with a LOCA simultaneously with a DBE, i.e., the local air coolers are not seismically qualified. An SDE is postulated only 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> after a LOCA, at which time the containment air coolers have completed their missic, following a LOCA.

The USNRC regulations specify a heat removal system be designed with safety-grade requirements, I however the CANDU 3 heat removal system is not considered nuclear grade. The RBCS is designed to Class 6 requirements of the CSA standard N285.0 which basically implies application of non-nuclear standards for the system pressure boundary.

Basis for Acceptance The CANDU 3 design includes the capability to remove heat from the containment atmosphere thereby reducing its pressure and temperature following its containment of an accident. The following specific information is offered as a basis for acceptance.

• Le system is designed to remain functional during a LOCA or MSLB and to remove heat from I the containment atmosphere thereby reducing its temperabre and pressure. The design basis for the building air coolers is established by normal operational heat loads and post-accident heat 47 I

l e,

a removal requirements such that the pressure following a LOCA or MSLB can be reduced to approximately atmospheric within 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />. Iong term cooling after 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> is provided by the ECCS operating in recirculation mode. Containment pressure is normally maintained at slightly lower than atmospheric pressure.

• The combined cooling capacity of the eight main local air coolers during an accident is 46.4 hDV (3.2% of total fission power).

• Since the reactor vault and its associated cooling is separated from the accessible portion of the containment during normal operations, the design provides blowout panels and dampers to ensure that both sets of air coolers act to condense the released steam during an accident.

• The air coolers are environmentally qualified for LOCA plus loss of ECCS. The fan motors I

operating on Class III power (includes power from on-site diesel generators) are rated to continuously landle the steam, water, and air mixtures and the temperature existing at the design value of overpressure under accident conditions.

• Although the air coolers are not seismically qualified, their supports and associated duct work are qualified to DBE category A to prevent them from toppling over and damag ng other seismically i

qualified components.

• Although the RBCS is designed to Class 6 requirements (CSA standard N285.0) which basically I

implies the application of non-nuclear standards to the containment pressure boundary, the system is deemed by the Canadians to demonstrate an adequate and acceptable level of safety because: 1) the system is appropriately qualified for the events that it must mitigate,2) a PSA demonstrates a sufficiently low system unreliability as to make the failure of the system a 5 negligible risk contributor, and 3) the system is continuously monitored for leakage.

• The ECC recirculation pumps and heat exchangers in the system which circulates and cools water I

from the containment sump before reintroducing it back into the core are seismically qualified to a DBE. The heat exchangers are cooled by the Group 1 RCWS which is backed up by the seismicalcf e 2alified Group 2 RSWS.

• The design provides for at least two redundant coolers.

48 B

=

I

• The air coolers are powered by Group 1, Class III power which can be supplied from either offsite power or onsite diesel generator sets.

• The Group 1 RCWS supplying the air cooler coiling coils is a closed loop system, transfers heat to the Group 1 RSWS, and contains three 50% capacity pumps and four 33-1/3% capacity heat exchangers. Suitable redundancy of components, interconnection, and isolation capabilities are I provided w thin anc. among these cooling water systems to assure that required functions are performed assuming a single active failure with either onsite or offsite power available. Design provisions have been made to detect leakage from the cooling water systems and to isolate leakage from required systems and equipment.

• The local air coolers are designed such that each cooler has individual cooling water pipes and isolation valves located in the accessible area. The local air coolers are designed with adequate draining provision and any water leakage is collected by the drainage system.

I The air cooler operability and performance are assured through the normal operation of the fans and the Group 1 RCWS. Further, the service dampers are testable during normal plant operation and the transfer of power from normal to emergency diesel generators verifiable during electrical power systems testing. The containment air coolers and associated ducts, cooling coils, and filters can be inspected during reactor operation.

I

• Instrumentation and control for the RBCS is provided to control operation of the building air coolers, the vault cooling units, the respective isolation dampers, and to provide temperature measurements and annunciation of alarm conditions.

I

• The building air coolers and vault coolers are controlled through the use of handswitches located in the main control room. Their is annunciation in the main control room if a cooling unit fails and the position of the dampers is available.

• Temperature measurements are made at the airstream inlets of the local air cooler and vault cooler i and monitored in the control room with alarms provided for high temperature.

• The moisture detectors in the active drainage system detect leakage from the local air coolers.

I I

l i

49 I

5

=

• An analysis is required which postulates a LOCA coincident with complete failure of the containment cooling system that must meet the Canadian dual-failure radiological dose limits.

Only three of :he eleven air coolers are credited in accident analyses.

Additional information The CANDU 3 CHRS design requirements differ from the GDC and SRP. The Canadian assertion of an adequate level of safety with their CANDU 3 design will need further justification. Areas needing further justification include:

• Applying non-nuclear Class 6 safety-grade standards to the CHRS.

• Not requiring the CHRS to be seismically qualified.

I A complete review will require additional information in the following areas I

a Analytical verification of their CHRS performance claims. The reports reviewed did not contain sufficient analytical results to verify their performance claims. Further, the analytical verification g should include temperature results as well as pressure response. 5

• Containment details are needed. For example, the current information does include a description I

of the containment sump, the pathways for collecting condensate in the sump, and the location of the recirculating piping inlet, or whether or not this piping inlet is adequately screened to prevent the entrance of debris into the system.

Evaluation The Canadian practice of not designing their CIIRS to nuclear safety-grade standards and not seismically qualifying the system place their design at risk of not meeting USNRC acceptance criteria, particularly in light of the fact that the CHRS does not include containment sprays as do the previous CANDU designs. Their assertion of providing an adequate level of safety compared to USNRC requirements was not substantiated.

5.3 Containment Combustible Gas Control The design obje-tive for combustible gas control is to prevent the collection of detontlole concentrations of hydrogen and to design systems which will continue to function following hydrogen burns by the ,

igniters.

S0

l Accer,tance Criteria The applicable acceptance criteria are found in Sections 50.34", and 50.44", and GDC I 41,42, and 43 of 10 CFR Part 50" and in SRP" 6.2.5.

I j

• Section 50.34 requires the provision of a system for hydrogen control that can safely accommodate hydrogen generated by the equivalent of a 100% fuel-clad metal water reaction. Further the l hydrogen control system and associated systems shall provide with reasonable assurance that: 1) l the uniformly distributed hydrogen concentration in the containment does not exceed 10% 2) containment integrity or appropriate mitigating features will not be lost by located comisustion, l 3) the equipment necessary for safe shutdown and containment integrity will perform it safety function after being exposed to the attendant environmental cc,nditions,4) inadvertent actuation l of a post-accident inerting system can be safely accommodated during plant operation.

I l

• Section 50.44 sets standards for the combustible gas control system. Hydrogen from metal-water reactions, radiolytic decomposition, and metal corrosion should be considered. Capability will be provided for measuring the hydrogen concentration within the containment, insuring a mixed l

atmosphere within the containment, and controlling the combustible gas concentrations in the containment. Postaccident conditions should be such that an uncontrolled hydrogen-oxygen I.

l recombination would not take place in the containment or that the plant could withstand the consequences without loss of safety function.

l l

• GDC 41 requires a system to control the concentration of hydrogen or oxygen released into the reactor containment following postulated accidents to assure that containment integrity is

(

maintained and that the systems be designed to safety-grade requirements with suitable j

redundancy to assure the safety function can be accomplished assuming a single failure and the loss of either onsite or offsite power and with suitable leak detection and isolation capability.

l l

• GDC 42 requires the combustible gas control system be designed to permit appropriate periodic inspection..

1

• GDC 43 requires the combustible gas control system be designed to permit periodic testing.

Accentance Criteria Differences The Canadian regulations regarding control of the containment i 20 atmosphere are found in Section 3.10 of Regulatory Document R-7 . h regulation regarding combustible gas control states:

51

E U

Provision shall be made for controhing the concentration of hydrogen and/or oxygen following an accident to prevent explosion or deflagration, unless it is documented that there is no possibility of such an explosion or deflagration as a result of any the following events: 1) failure of any pipe or header in any fuel cooling system,2) failure of a pressure tube and the associated calandria tube,3) failure of an end fitting,4) fuel channel flow blockage,5) failure of a fuelling machine to replace a closure plug,6) inadvertent opening of pressure relief or control valves on the primary heat transport system or associated systems,7) failure of steam generator tubes,8) any of events 1 to 7 occurring coincidentally with impairment of the emergency core cooling system, and 9) inadvertent opening of pressure relief valves connecting to a vacuum building.

The Canadian approach to combustible gas control is less prescriptive than the NRC regulations.

Basis for Acceptance The CANDU 3 design includes the capability to control combustible gases by mixing and dispersing and by recombination. The following specific informition is offered as a basis for acceptance.

• Systems are incorporated into the containment to control hydrogen. The air cooler fans sweep hydrogen out of the reactor vault after blowout panels and dampers open to ensure mixing.

Igniters of either the glow plug type or the autocatalytic type are installed at several locations to bum hydrogen at low concentrations thereby preventing a detonation. Ventilation flow paths are designed to ensure adequate dispersal and control measures are included to limit concentrations within any significant enclosed subvolume. (AECL Stated: Experimental data do not show significant differences in the diffusion, mixing, ignition, and burning of deuterium versus hydrogen.)

• The operability and performance of the fans and the Group 1 RCWS are assured by normal operation. The active dampers can be tested during normal plant operation. Transfer of power from the normal to emergency diesel generators can be veril.ed during testing of electrical power systems.

• Hydrogen igniters, as presently planned, are located in the feeder cabinets, at the bottom of the steam generator enclosure, and in the upper part of the containment to ensure that releases are ignited at low concentrations and detonations are prevented.

52 m

I

• "Ihe hydrogen igniters have sufficient redundancy to accommodate single failures without loss of function. The igniters are seismically qualified and are powered by the Group 2 electrical system which receives power from either offsite power or onsite diesel generator sets. The hydrogen igniters are subjected to testing and appropriate inspection as required to assure operability.

HVAC systems and other equipment used for hydrogen control are designed to withstand

'I the effects of hydrogen burn or detonation.

• Monitoring includes the status of and controls over air coolers and hydrogen igniters, and two hydrogen content monitors.

• If all sheath and other fuel bundle zirconium were oxidized and the igniters did not reduce the resulting hydrogen, the hydrogen concentration in the containment would reach about 8%, below the 10% limit specified in Section 50.34. An AECL large LOCA calculation, which assumes that ECC and igniters are both unavailable, resulted in a peak I hydrogen concentration of only 4.4% about six hours after the break.

• Fundamental combustion engineering analysis techniques combined with experimental evidence are applied to estimate temperatures and pressures following combustion of hydrogen-steam-air mixtures which are predicted to be flammable. One-dimensional computer modeling is employed to calculate the transient conditions when combustion occurs in one part of containment with or without venting to another.

Analysis verifies that containment hydrogen is mixed by the air coolers and natural I

circulation. Hydrogen mixing during a 100% pump suction pipe break coincident with the loss of ECC calculation shows a difference of about 1% between the hydrogen concentration in the accessible and non-accessible areas of the containment while the hydrogen generation rate is high. After hydrogen production has stopped, the concentration is uniform throughout containment.

Additional Information Areas needing further information or justification include:

Other sources of hydrogen should be included in their analysis besides the oxidation of

.g *

5 sheath and other fuel bundle zirconium. The CANDU 3 pressure tubes and calandria tubes mass about 14400 and 5100 kg of zircoloy, respectively, compared to about 6400 kg

)I 53 l

I l l

E a

for the fuel bundles. In addition, their are smaller quantities of zircoloy in the various control guide tubes within the core. The USNRC criteria specifically stated that 100% of fuel-clad zirconium should be assumed to oxidize but then in U.S. reactors that includes the dominant amount of the zirconium in the core. In the CANDU 3 design, the largest mass of zircoloy is in the pressure tubes. The Canadian safety calculations seem to show that significant pressure tube oxidation is prevented by heat transfer to the calandria tank moderator water, therefore pressure tube oxidation was not included in their combustible g gas analysis. But given severe accident conditions involving a complete core meltdown, E at least partial pressure and calandria tube oxidation must be considered. (Severe accident analysis was not available for our review.) The quantity of hydrogen that would be produced if all of the in< ore zirconium (fuel bundle, pressure tube, calandria tubes, and guide tubes) were oxidized is about 4 times as much as that produced by oxidizing just the fuel bundle zirconium. If more than about 8% of the pressure and calandria tube zircoloy is postulated to oxidize in addition to all of the fuel bundle zirconium, then the USNRC 10% containment concentration will be exceeded. Further, hydrogen generation from the radiolytic decomposition of water and from the decomposition of containment g materials such as protective coatings (paints) was apparently not considered as required 5 by the USNRC design criteria.

• Details of their combustible gas analyses are needed to verify their results, for example, I

their combustion and containment response analysis does not appear to be implicitly integrated. Hydrogen release is simulated in their containment code (PRESCON) by adding an equal volume of air to the containment atmosphere indicating that the code cannot handle hydrogen as a non-condensible gas. The combustion analysis is modeled by the VENT code as combustion within a volume venting to a much larger volume ,

implying each subcompartment must be analyzed separately. Supporting hydrogen 3 analysis calculations should be done with U.S. containment codes to verify mixing and burn results. For example, the U.S. codes are capable of evaluating details such as localized hydrogen deinerting resulting from steam condensation and the propagation of a hydrogen bum through the containment.

TTR-429' states that the igniters may be either the glow plug type or the autocatalytic 3 g,

type. If the autocatalytic type is used, then the analysis should consider the relatively slow time response of autocatalytic recombiners as a possible impediment to their g efficiency. 5 1 54

.I

I Evaluation The acceptance of the CANDU 3 combustible gas control will require a more detailed review of their containment analysis and their codes and likely require supporting calculations using U.S. containment analysis codes. The other sources of hydrogen, especially from the oxidation of pressure and calandria tubes during a severe core meltdown accident will have to be examined. When all of the severe accident sources of hydrogen are considered, the design may not meet the USNRC10%

acceptance requirement.

I 5.4 Containment Leakage Testing The containment system is designed and constructed and the necessary equipment is provided to permit periodic integrated leakage rate tests during plant lifetime including leakage testing at containment design pressure. The Technical Description' was the primary source of information regarding leakage testing.

Accentance Criteria The applicable acceptance criteria are found in GDC" 52,53, and 54 and Appendix J'7 of 10 CFR Part 50 and in SRP" Section 6.2.6.

I

• GDC 52 requires that the containment and exposed equipment be designed to accommodate periodic integrated leakage rate testing at the containment design pressure.

• GDC 53 requires that the containment be designed to permit appropriate periodic inspection of important areas such as penetrations, an appropriate surveillance program

, and periodic leak testing at the containment design pressure of penetrations having resilient seals and expansion bellows.

GDC 54 requires that piping systems penetrating containment be designed with a I

capability to determine if valve leakage is within acceptable limits.

• Appendix J provides the test requirements and acceptance criteria for preoperational and periodic leak testing of the containment and of systems and components which penetrate the containment. Conformance with these requirements constitutes an acceptable basis for satisfying the above GDCs.

I Accentance Criteria Differences The Canadian regulations regarding containment leak testing are found I in Regulatory Document R-7 The design requirements state that the maximum allowable leakage rate l from the containment envelope shall be the value used in the safety analyses which demonstrate that the I 55 I

r 5

m reference dose limits are not exceeded. Periodic testing is required that demonstrates that the leakage rate is not greater than the maximum allowable leakage rate at full design pressure.

The Canadian approach therefore is dependent upon the accuracy of the safety analysis, whereas the USNRC approach specfies a leakage rate based upon the a percentage of the containment volume leaking within a 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> period.

Basis for Acceritance The following information was available regarding CANDU 3 leakage testing.

• During commissioning, the pressure proof testing of the structural integrity of the containment system will be at 115% of design pressure. The overallleakage rate of the containment system at the design pressure will be determined. The test acceptance leakage rate is 2.0% of building volume per day at the design pressure.

• Subsequent overall leakage rate tests at full design pressure will be carried out as required to meet regulatory requirements. It is intended that these tests will initially be at three-year intervals, relaxing to a six-year frequency as confidence is obtained in the leak tightness of the containment design.

• The maximum leakage rate is 5% of containment free volume per day at the design I

pressure. This rate is used in their safety analyses.

• Both cable and process penetrations (including resilient seals and expansion bellows) are leak tested independently of and more frequently than the building overall pressure test.

The process and cable penetrations will be tested by a soap bubble test method, either on the exterior with the building pressurized or on the interior with the building at its normal sub-atmospheric pressure. The containment is designed to permit accessibility to all important areas for periodic inspection in accordance with an appropriate surveillance program.

• The design provides the capability to periodically leakage test the isolation valves to I

ensure operability and to check that the valve leakage is within acceptable limits.

• The leakage rates of airlocks, equipment hatch and ventilation system isolation dampers are checked on a yearly-basis.

56 I

=

• The containment Grcss Leakage Monitoring system monitors building air pressure and

[ temperature along w..n other data, while the plant is operating to warn of significant leakage and to provide a timely indication of any gross breach of containment.

Additional Information The CANDU 3 leakage testing acceptance criteria differ from the USNRC criteria located in 10 CFR Part 50 Appendix J.

2

• A discrepancy in the documentation needs clarification. The TD (page 2-195) specifies the test acceptance leakage of 2% of free containment volume per day during the 7

commissioning test but TTR-411 (page 3.4-3) states 0.5%. We believe the 2% specification is the correct number based on its numerous appearance in the documents, therefore our comments are based on the 2% leakage rate.

• Justification is needed for the 5% maximum and 2% lest acceptance leakage rates used in the CANDU 3 design. The Canadian regulations state that the maximum allowable leakage rate from the containment envelope shall be the value used in the safety analyses which demonstrate that the reference dose liu.its are not exceeded. If the 5% and 2%

criteria for CANDU 3 are based on safety analysis, then this safety analysis will need to j be reviewed for safety adequacy, including the inherently large uncertainty associated with such analysis. (Acording to the USNRC regulations, the acceptance leakage rate corresponding to the calcsdated peak containment internal pressure related to a design basis accident shall be less than 0.75% per day.)

• Sufficient information should be supplied so that a detailed review of the containment leakage testing capability can be performed.

Evaluation The CANDU 3 design leakage acceptance criteria does not agree with USNRC acceptance criteria. The Canadians will have to justify their acceptance criteria in terms of providing an adequate level of safety.

5.5 Containment Instrumentation for Accident Monitoring The design provides monitoring capability to monitor conditions within the containment and the status of containment equipment, before, during, and after an accident. The Technical Description' was the primary source of information regarding instrumentation for accident monitoring.

57

C 0

Acceptance Criteria The acceptance criteria are found in GDC 13 and 64 of 10 CFR Part 50" and in SRP" Section 6.2.1.1.A.

• GDC 13 requires that instrumentation be provided capable of operating in the post-accident environment to monitor the containment and its associated systems including the containment atmosphere pressure and temperature and the sump water level and temperature.

• GDC 64 requires the monitoring of radioactivity in the containment during normal operations, anticipated operational occurrences, and from postulated accidents.

The instrumentation should have adequate range, accuracy, and response to assure that *he above parameters can be tracked and recorded throughout the course of the accident.

Accentance Criteria Differences The Canadian regulations regarding containment monitoring are found in Regulatory Document R-7 2o, The regulations state that the design shall be such that 1) the status of all important equipment can be monitored or inferred from the appropriate control room, and 2) any gross breach of the ccntainment envelope can be readily and reliably detected.

The Canadian regulations do not specify specific parameters for monitoring an accident.

I Basis for Acceptance The following information was available regarding CANDU 3 containment instrumentation for accident monitoring.

• The design is provided with extensive instrument and control systems capable of g monitoring those variables that can affect the fission process, the integrity of the reactor 5 core, the HTS pressure boundary, and the containment. Continuous state-of-the-plant information is provided to the operating staff in both of two separate control areas.

• Although the monitoring systems in the main control room are not seismically qualified for a DDE because they are located in the Group 1 building, the monitoring systems in the secondary control area located in the Group 2 service building are seismically qualified for a DBE.

• Selected rooms in the containment are monitored for gamma radiation and airborne tritium during normal plant operation. The containment employs triplicated radioactivity 58 a

[

monitors to detect and alarm the releases resulting from a postulated LOCA and initiate

[ containment isolation. Leakage from the ECCS during post-LOCA recirculation is detected by tritium monitors. Effluent discharge paths can be monitored or sampled to assure release limits are not exceeded.

• Containment isolation is initiated by triplicated pressure and activity measurements then instrumentation monitors the status of all isolation devises, airlock seals, and doors.

• The status of containraent subsystems and equipment, such as air coolers and hydrogen igniters, are monitored.

• The Gross Leakage Monitoring system measures containment temperatures, pressures, humidities, and instrument air and ventilation line flows.

• Instrumentation qualified for post-accident containment conditions includes sensors to measure temperatures, pressures, humidity, hydrogen content, and radioactivity. Post-accident monitoring instrumentation must satisfy the requirements of CSA standard CAN3-N290.6 and the Safety Design Guides (SDGs) for seismic qualification, environmental qualification, grouping and separation, tomado protection, and pipe rupture protection (the SDGs are contained in the Appendices of the CSR2).

Additional Information The following additionalinformation is needed to fully evaluated the containment instrumentation for accident monitoring.

• Information is needed regarding instrumentation to measure the sump water level and temperature as required by GDC 13. j

• Detailed information is needed which specifies instrument ranges, accuracies, and responses to assure their performance during an accident as required by the SRP.

Evaluation The CANDU 3 design meets the USNRC acceptance criteria provided that instrumentation has been provided to monitor the sump level and temperature and that the instruraentation ranges, accuracies, and responses are adequate.

59

E a

5.6 Containment Response to Postulated Loss-of-Coolant Accidents The CANDU 3 containment was sized to contah the effluences of a worst case reactor coolant system pipe break. The design acceptance evaluation of the cont:inments ability to contain a reactor coolant system 2

LOCA is based predominantly upon the safety arest oresented in the Conceptual Safety Report .

Acceptance Criteria The applicable acceptance critet la are found in GDC 16 and 50, Section 50.34(f)s2, and in Appendix X" of 10 CFR Part 50 and in SRP" Sections 6.2.1.1.A and 6.2.1.3. 5

• GDC 16 requires the containment to provide a leak-tight barrier against the uncontrolled release of radioactivity to the environment and to assure that design conditions important to safety are not exceeded for as long as postulated conditions require.

= GDC 50 requires containment design to accommodate the calculated pressure and temperature conditions resulting from any postulated LOCA without exceeding the design leakage rate and with sufficient margin.

• Section 50.34(f) specifies requirements regarding maintaining containment integrity during an accident.

• Appendix K requires that all energy sources during a LOCA be considered. It provides requirements for performing calculations of energy sources.

Specific SRP requirements include:

• The maximum internal pressure to which the containment may be subjected should be determined considering a spectrum (break sizes and locations) of postulated LOCA accidents.

• The containment design pressure should provide at least a 10% margin above the accepted peak calculated containment pressure following a LOCA or a steam or feedwater line break to satisfy the requirements of GDC 16 and 50 regarding sufficient design margin.

ll 60

.Ii

I 1

• The calculations of releases to the containment during the blowdown and reflood phases i

l of a LOCA should be conservatively maxmuzed.

I

• The break size and location should be chosen to yield the highest mass and energy release rates, thereby assuring the identification of the worst case scenario.

1 g

• The review of the mass and energy release rate calculations includes a review of the 5 analytical codes and methods. Code and methods are acceptable if they are found to l provide conservative results. All sources of mass and energy are considered including the mass and energy release rates for the initial blowdown, the core reflood, and post-l reflood phases of the accident.

I l

Accentance Criteria Differences The Canadian regulations regarding the containment of a LOCA are found in Regulatory Document R-7". De design pressure for the containment is the maximum building j pressure resulting from any failure of the heat transport system coupled with unavailability of the most effective active pressure reduction system. A specific margin of safety is not specified, whereas in the U.S., a 10% margin is typically applied.

Basis for Acceptance The CANDU 3 containment was design specifically to contain the worst cese primary system LOCA. The following specific information was offered as a basis for acceptance.

I

• The containment safety studies which determine the worst credible accidents in LOCA and MSLB accidents are based on identifying initiating events, and probabilistic and deterministic evaluations. The analysis consists of a series of base case analyses of different pipe break locations and sizes using reference assumptions, coupled with a series

I of sensitivity studies assessing the variation of results as key input factors are changed.

• The maximum calculated containment pressure was 180 kPag (26 psig) for a primary system LOCA sequence involving a 100% pump suction header break coincident with a loss of ECC. The peak pressure occurs about one minute after the postulated break.

Further. this LOCA sequence provides a high heat load to the containment resulting in high ; , , heat loads and the highest predicted containment wall temperatures.

The containment was then designed with a 10% margin above the peak calculated I

pressure of 180 kPag resulting in a design pressure of 200 kPag (29 psig). This margin complies with the SRP criteria of a margin of at least 10%. I I 61 1

1

E

• The containment spray system included in other CANDU contamments was eliminated from the CANDU 3 because at this design pressure, the CANDU 3 containment can withstand the peak pressure generated by a high energy line break without the need for a pressure suppression system, thereby enhancing reliability of containment system by simplification.

• The evaluations extend to thermal and mechanical loads, such as intemal missiles and whipping pipes.

• Containment pressure would gradually decrease due to condensation of steam on walls and structures, and by local air coolers. The pressure could still be slightly above atmospheric at the end of the first day. After the first day, the post-accident containment depressurization procedure may be used depending upon weather conditions and population distribution. Discharge of contaminated air would occur through the containment ventilation stack filtered by activated charcoal filters.

• Containment thermal-hydraulic conditions are simulated using the LOCA mass and energy rates computed as part of the PHIS analysis. The LOCA codes were used for the safety analysis of CANDU 6 and are considered well established.

• The containment response was calculated v ith the MICROPRESCON2 code. This code solves equations for one-dimensional cc:npressible fluid flow in the di.netized form. The conditions within a node are assumed homogeneous. The fimd model allows air and water where the water can exist ?n ePher liquid or vapor form. A limited buoyancy-induced circulation model is included wi;n the ability to simulate flows due to thermally-induced temperature differences but r 31 density differences resulting from the presence 3 of hydrogen in the mixture.

• Models are included for water-steam-air mixing and transport, atmospheric coolers, heat I

transfer to walls, ventilation, leakage, emergency coolant heat sink, hydrogen mixing and combustion and radionuclide transport, deposition, and decay. A leak rate of 5% of containment volume per day at the design pressure was assumed.

= Modeling practices for the coolers include use of assumptions intended to under-estimate cooler capacity w%cn so doing is conservative in the context of the specific analysis. The

! performance of local air coolers is simulated on the basis of their capacity in dry air, l

62

.I

I modified using experimental data, to reflect their additional capacity in a steam-air environment.

I

• The PRESCON and PRESCON2 codes were validated by comparing code simulations with the results of the OECD-CSNI Containment Standard Problem No.1 involving steam discharge into a scale model of a water cooled reactor and the Containment Standard Problem No. 2 involving discharging a two-phase mixture into a the containment for 50 I seconds. The validation results were not available for review.

Additional Information While information is offered indicating that the acceptance criteria were met, the information was sparse. More detailed information is needed to verify the acceptability of the design.

Specific areas requiring further information or justification include:

• Details of the analyses which calculate the peak containment pressure following a LOCA are needed to ensure that this pressure is conservative. For example, the time to reach peak containment pressure of about one minute seems excessive, thereby indicating a I non-conservative calculation. Detailed information should verify that the analyses were indeed conservative.

• It is not clear from the documents reviewed that all sources of mass and energy were considered in the peak containment pressure analyses including initially stored energy in all the associated systems, fission and decay power energy, metal-water reaction energy, vaporization of calandria tank water, and noncondensible gasses such as helium from the calandria tank, carbon dioxide from the annular gas system, and nitrogen from the shield cooling system.

I

• Details of the break size and location spectrum analysis were missing from the documents received. and will be needed to verify the determination of the worst break sequence.

• The containment temperature response to a LOCA was not found and should be provided.

• Details of the long term containment response including core reflood and post-reflood phases should be provided.

,I i

" 63 I

C C

• Accident analyses associated with unique LOCAs such as pressure tube ruptures into the calandria tank and refueling machine LOCAs should be provided.

• The analytical codes and methods used to calculate source terms to the containment and the containment response will need to be reviewed. Different versions of the PRESCON containment code seem to be in use (PRESCON2 and MICROPRESCON) with no explanation of their differences. The deficiencies in the codes need to be examined, for instance, hydrogen is modeled with an equivalent volume of air in these codes.

Hydrogen combustion is modeled in a separate code (VENT). These analytical codes and results should be verified, perhaps by benchmarking against U.S. containment codes.

• An uncertainty analysis is needed to verify a conservative design pressure.

Evaluation The ability of the CANDU 3 containment to contain a postu!sted primary system LOCA will meet USNRC acceptance criteria provided their analytical results can be verified.

I 5.7 Containment Response to Postulated Secondary System Pipe Ruptures The CANDU 3 design provides capability to contain a steam line or feedwater line break. The design I

acceptance evaluation of the containments ability to contain the effluences of a steam line or a feedwater 2

line break is based predominantly upon the safety analysis presented in the Conceptual Safety Report ,

Accentance Criteria The applicable acceptance criteria are found in GDC 16 and 50 of 10 CFR Part 50" and in SRP" Sections 6.2.1.1.A and 6.2.1.4.

• GDC 16 requires the containment to provide a leak-tight barrier against the uncontrolled release of radioactivity to the environment and to assure that design conditions important to safety are not exceeded for as long as postulated conditions require.

• GDC 50 requires containment design to accommodate the calculated pressure and temperature conditions resulting from any postulated secondary pipe rupture without exceeding the design leakage rate and with sufficient margin.

Specific CRP requirements include:

b4 I1 I E;

I-

• The maximum internal pressure to which the containment may be subjected should be determined considering a spectrum of postulated MSLB accidents (including break size and location at conditions ranging from hot standby to 102% of full power.

• 'Ihe containment design pressure should provide at least a 10% margin above the accepted peak calculated containment pressure following a steam or feedwater line break to satisfy the requirements of GDC 16 and 50 regarding sufficient design margin.

• The containment response analysis for postulated secondary system pipe ruptures should be based on the most severe single active failure in the containment heat removal systems or the secondary system isolation provisions.

I

• The single-failure analysis performed for steam and feedwater isolation provisions which would limit the flow of steam and feedwater to the assumed pipe rupture are reviewed.

The energy ac,urces available for release to the containment, the mass and energy release I

rate calculations are reviewed.

• The mass and energy release rate calculations are reviewed. The analytical codes and methods, other than those previously reviewed by the NRC, are acceptable if they are found by the NRC to provide conservative results.

Acceptance Criteria Differences The Canadian regulations regarding the containment of a postulated secondary system break are found in Regulatory Document R-7" but the document does not specifically discuss steam line or feedwater line breaks. The document does state that the containment envelope must I limit the release of radioactive materials from the station to an acceptably low value for all postulated failures of a fuel cooling system.

The acceptance criteria interpreted from AECB Regulatory Document R-7 as they apply to CANDU 3 design with its lack of a containment spray system were found in the CSR. For pipe breaks in the steam generator feedwater and steam systems, the containment design pressure may be exceeded provided that:

1) with the most effective pressure reduction system available, no damage to the containment will occur and 2) with the most effective pressure reduction system unavailable, the structural integrity of containment will not be impaired to a degree that consequential damage to reactor systems could occur.

I 65 I

O n

a The U.S. acceptance criteria does not allow the containment design pressure to be exceededfollowing a secondary system break. A 10% design rnargin is typically required.

Basis for Accentance The following specific information was offered as a basis for acceptance.

• Containment structural integrity requirements were ensured by steam line failure analysis.

The break size and location which mar'mizes energy discharge into containment (within the time frame required for operator action) is a 100% steam line break. The peak pressure for the bounding case used at the conceptual design phase for containment structural integrity considerations is that resulting from both containment air coolers and main steam safety valves unavailable, thereby over predicting containment pressure. The peak pressure to 15 minutes is predicted at 230 kPag (33.4 psig) which is 1.15 times design pressure but this is equivalent to the pressure for the positive proof commissioning test.

• The CANDU 3 containment building was designed to remain structurally sound after a MSLB accident. If none of the air coolers are credited, a double-ended MSLB peak B

pressure in the containment may reach nearly 58 psig (400 kPag) at half hour after the 3 break (still increasing). At that time operator intervention can reduce the pressure in the building by remotely opening some of the MSSVs. If half of the air coolers are credited, the peak pressure reaches only about 43 psig (300 kPag) in about the first minute and then slowly decreases afterwards. The containment atmosphere temperature is predicted to be in the range of about 266 to 384 F (130-140 C) in the first half hour without any or with half of the air coolers. Based on this extremely conservative MSLB accident, a pressure of 61 psig (420 kPag) is used to calculate the containment stresses after a steam line break.

I

• In MSLB accidents the discharged steam will cause higher containment wall temperatures than the primary LOCAs, but these high wall temperatures are within CSA Standard N287 permitted limits and taken care of in the civil engineering stress calculations.

• Peak pressure was maximized by coincident failure of air coolers or main steam safety valves (bounding case). Opening of the main steam safety valves on the broken steam line would connect the containment to the outside environment providing significant containment pressure relief.

• Containment response is calculated using the MICROPRENON2 code.

66 a

'I Additional Information More detailed information is needed to verify the acceptability of the design as the information offered was sparse. Specific areas requiring further information or justification include:

j Details of the analyses which calculate the peak containment pressure following a secondary system break are needed to ensure that this pressure is conservative. The details should include the containment temperature response and break size and location spectrum analysis.

= More justification is needed regarding allowing the peak pressure following the a secondary system break to exceed the containment design pressure.

• The analytical codes and methods used to calculate source terms 6 the containment and the containment response will need to be reviewed. These analyus! codes and results should be verified, perhaps by benchmarking against U.S. containment codes.

1 i Evaluation Since the U.S. acceptance criteria requires the containment be designed with a 10% peak I

i pressure margin for secondary system break as well as primary system break, the Canadian practice of allowing a CANDU 3 secondary system break peak pressure to exceed the containment design pressure will need further justification. Further their analytical results need verification.

lI 5.8 Containment Subcompartment Analysis I A containment subcompartment is defined as any fully or partially enclosed volume within the primary

' """*"t that h uSes hiSh ener8Y Pi ping and would limit the flow of fluid to the main containment

'I a volume in the event of a postulated pipe rupture within the volume. Subcompartment analysis involves determining the pressure conditions within these subcompartments and the effects of these pressure conditions upon system components and supports.

The CANDU 3 containment design contains areas that are accessible during normal power operation. This unique feature of CANDU technology allows access to equipment such as instrumentation, process and mechanical systems, and associated auxiliaries which in U.S. plants would normally be serviced during refueling outages. The accessible areas are supported for the most part by the internal steel structure.

The inaccessible areas are contained behind the concrete shielding that forms part of the internal structure.  !

<I 67 I

0 0

Ar;as that do not permit on-power access include the reactor vaults, the steam generator and pressurizer enclosure, the moderator heat exchanger, and shutdown bleed cooler area.

Acceptance Criteria The applicable acceptance criteria are found in GDC 4 and 50 of 10 CFR Part 50" and in SRP" Sections 6.2.1.1.A and 6.2.1.2.

GDC 4 requires structures , systems, and components important of .afety be designed to g

accommodate the dynamic effects of missiles, pipe whipping, and discharging fluids that 3 may result from equipment failures.

e GDC 50 requires that subcompartments be designed with sufficient margin to prevent I

fracture of the structure due to a pressure differential across the walls of the subcompartment resulting from any LOCA.

Specific SRP requirements include:

= Containment internal structures and system components and supports should be designed to withstand the differential pressure loadings that may be imposed as a result of pipe breaks within the containment subcompartments.

• A transient differential pressure response analysis should be provided for each subcompartment or group of subcompartments. The review includes the distribution of the mass and energy released into the break compartment, nodalization of subcompartments, subcompartment vent flow behavior, and subcompartment design pressure margins.

= The dynamic characteristics of components, such as doors and blowout panels, are reviewed.

• The design pressure for each subcompartment is reviewed.

Accentance Criteria Differences The Canadian regulations regarding the containment of a LOCA are g found in Regulatory Document R-7 28 The document does not specifically discuss subcompartment W analysis requirements but the need for such analysis is implied in the general requirements of maintaining structural integrity, equipment survival, and the containment of radioactivity.

68 E

I Basis for Acceptanct Limited results of subcompartment analysis was offered in the CSR. The following specific information was offered as a basis fcr acceptance I

• Pressure differentials across containment internal walls have been calculated for the 100%

pump suction break. He maximum transient pressure differential, defined as the difference in pressure between a particular room or area and the accessible area, is less than 50 kPa (7.3 psig). This value is used in the civil design to ensure structural integrity.

I He maximum occurs in less than one second.

• Containment time dependent differential pressures are shown for a 100% pump suction pipe break scenario for the inlet vault, the calandria room, the moderator room, the fueling machine service area, the outlet vault, and the top of the steam generator enclosure (all relative to the accessible area).

I Additional Information While information is offered indicating that the acceptance criteria were met, the information was sparse. More information is needed to verify the acceptability of the design. Specific I areas requiring further information or justification include:

• The analysis should consider the full spectrum of postulated LOCA and secondary system pipe ruptures (including break sizes and locations) but the analysis offered for acceptance considered only the 100% pump suction break scenario.

• The analysis reviewed should include details such as the distribution of the mass and energy released into the break compartment, nodalization of subcompartments, subcompartment vent flow behavior, subcompartment design pressu:e margins, and the I dynamic characteristics of components, such as doors and blowout panels.

• The analytical codes and methods used to perform the subcompartment analysis wih need to be reviewed. These analytical codes and results should be verified, perhaps by benchmarking against U.S. containment codes.

Evaluation The subcompartment analysis presented suggests that the CANDU 3 design will meet the U.S. design criteria provided their results represent the most severe challenge to the interior containment structures and that these results can be verified.

I 69 I

E ai 5.9 Containment Bypass Accidents The accident scenarios leading to a possible bypass of the containment include interfacing system LOCAs, and steam generator tube ruptures.

5.9.1 Interfacing Systems LOCAs The failure to isolate low pressure piping systems which connect to the high pressure reactor coolant system aay lead to a LOCA of the low pressure piping outside containment, thereby effectively bypassing containment. A discussion of the CANDU 3 potential for an interfacial LOCAs is discussed in 'ITR-429.5 Accentance Criteria For design purposes, an interfacing systems LOCA is treated as a severe accident with a very low frequency of occurrence. The USNRC Commissioners in SECY-90-016 and the associated Staff Requirements Memorandum require evolutionary ALWR plant designers to include interfacing LOCAs in the design basis. All systems that are not designed to withstand full RCS pressure should provide isolation valve leak testing capability, and control room isolation valve position indicators and high pressure alarms.

Accentance Criteria Differences The Canadian regulations do not specifically discuss interfacing systems LOCAs. The requirements for preventing these LOCAs must be inferred from the general requirements of protecting the public from excessive exposure to radioactivity.

Basis for Accentance The CANDU 3 design has five systems that interface with the Heat Transport System: 1) Shutdown Cooling System,2) Pressure and Inventory Control System, 3) Purification System,

4) Emergency Core Cooling System, and 5) Heavy Water Collection System. The following specific information was offered as a basis for acceptance.

• The Shutdown Cooling System is designed to withstand HTS pressures and is located within the containment.

• 'Ihe Pressure and Inventory Control System is designed to withstand HTS pressures and is located within the containment, however it does interface with the Purification System downstream of the bleed condenser level control valves and downstream of one normally open motorized valve, in series. Triplicated signals, which override all other control g signals, of either a high temperature in the bleed cooler or a high level in the heavy water B 70 5

=

s I

. storage tank, will close both the bleed condenser outlet isolation valve and the bleed condenser level control valves.

.I

• The Purification System is located within the containment and has a relief valve discharging into the heavy water collection tank.

The Heavy Water Collection System is located within the containtnent and can be isolated.

I

=

A heavy water feed relief valve discharges into the heavy w__t collection tank. The heavy water collection tank is protected by rupture disks. Leak detection capability is provided.

• The Emergency Core Cooling System is isolated inside the containment by three sets of valves in series, i.e., motorized valves, then check valves, and then another set of motorized valves. Control room isolation valve position indicators and leakage testing capability are provided. If both ECCS isolation valves are not closed, a HTS pressure alarm is provided when rising HTS pressure approaches the design pressure of the I attached low pressure ECCS.

• All motorized valves have position indicators in the control room which are independent of whether or not the valves are energized. However, high pressure alarms for the low pressure systems are not considered necessary due to the multiple automatic isolation and overpressure protection features available.

I Additional Information More detailed information is needed to verify the neceptability of the design.

'g The licensing process should completely review each system interfacing with the H15 for potential 5 containment bypass scenarios. Apparently, the only interfacing system not completely contained within the containment is the ECCS. Leakage testing capability, isolation valve position indicators, and a pressure alarm are provided, however the description of the pressure alarm needs clarification. The HTS pressure alarm was described as providing an alarm when ' rising HTS pressure' approaches the ECCS design pressure and another sentence states that pressure alarms specifically designed to wam when pressure approaches the interfacing low pressure systems design pressure are not considered necessary.

The question is whether or not the pressure alarms included in the design are adequate.

Evaluation The CANDU 3 design will meet the USNRC acceptance criteria pending a complete detailed review of the design if the adequacy of their pressure alarms can be verified.

71 I l l

E O

5.9.2 Steam Generator Tube Ruptures The two steam generators in the CANDU 3 design have inverted U-tube bundles installed in a shell. Heat is transferred from the heavy water reactor coolant to light water on the secondary side. Under certain conditions the secondary system is considered an extension of the containment. A tube rupture can lead to a transfer of radionuclides from the primary system to the secondary system which could provide a direct path to the environment.

Acceptance Criteria The USNRC position stated in a memorandum *3regarding SECY-93-087 requires that analysis of multiple steam generator tube ruptures involving two to five steam generator tubes be included in the application for design certification for passive PWRs. Realistic or best-estimate analytical assumptions may be used to assess plant responses since the steam generator multi-tube rupture event is beyond the design basis requirements for PWRs. The applicant for design certification should assess design features to mitigate the amount of containment bypass leakage that could result from steam generator tube ruptures.

Accentance Criteria Differences The Canadian regulations regarding failure of steam generator tubes is found in Section 3.2 of Regulatory Document R 9 2 The regulations state that the ECCS shall be capable of maintaining or re-establishing sufficient cooling of the fuel and fuel channels so as to limit the release of radioactive material from the fuelin the reactor and to maintain fuel channelintegrity. The regulations do not appear to consider steam generator tube ruptures as a means of bypassing the containment.

Basis for Acceptance The following specific information is offered as a basis for acceptance.

• The rate of incidence of heavy water leakage from a steam generator is minimized by very high standards in design and manufacture. High recirculation ratios, low heat fluxes, elimination of tube vibration, material selection and chemistry control contribute to long steam generator tube life.

• Either of two steam generators can be isolated by closing the appropriate turbine stop valve and the steam interconnect valve by remote manual operation from the main control room.

I n i I

a

~

l Additional Information More information about both the plar.t design and analysis are needed to verify acceptability of the CANDU 3 design regarding the possibility of bypassing containment following a steam generator tube rupture.

• Thermal-hydraulic, radionuclide transport, and human factors analysis are needed. The analysis currently provided does not include steam generator tube ruptures.

• More plant design details are needed, for instance the location of the secondary system main steam safety valves relative to the containment building is somewhat uncertain. The secondary system schematic provided does not show the containment boundary, however, it can inferred that these valves are located outside the containment boundary. The inference is based upon a statement in the CSR which states that opening of the main safety valves on a broken steam line would connect the reactor building to the outside environment.

More information is needed regarding the LOCA signal trip which appears to initiate I

crash cooling of the secondary system. Secondary crash cooling is accomplished by a rapid depressurization of the secondary system by means of the main steam safety valves.

This information should answer questions such as whether or not a steam generator tube rupture can initiate a LOCA signal thereby initiating secondary system crash cooling.

This sequence of events would open a direct depressurization pathway from the reactor cooling system to the environment unless the effected steam generator was first isolated by the operators.

• Human factors information is needed regarding operator identification of a steam generator tube rupture event, the steam generator isolation procedure, and the time required to effect isolation relative to a possible irutiation of secondary system crash cooling.

Evaluation The acceptability of the CANDU 3 design with regards to bypassing the containment following a steam generator tube rupture cannot be verir'ied with available information. The Canadian practice of depressurizing the secondary system following a LOCA enhances the possibility of bypassing the containment. Safety analysis which has not been provided and additional detailed design information must be supplied before acceptability of the design can be determined.

II I n I

C 0

5.10 Containment Response to Refueling Accidents The characteristic of the CANDU fuel handling system that most distinguishes it from U.S. reactor designs is that it is based on refueling and fuel shuffling while the reactor is at power. This is accomplished with a fuel handing machine (F/M), that can be attached to the end of individual CANDU reactor fuel channels to remove and add fuel bundles while the reactor is at power. The equilibrium fuelling rate for CANDU 3 is approximately 85 fuel bundles per full power week of operation.

I The AECL report TTR.305', titled "The Technology of CANDU On-Power Fueling" was given a detailed review. Information pertinent to the acceptability of the containment is summarized in this section. The complete report of this review in found in Appendix I.

Acceptance Criteria There are no US NRC regulations or even any guidelines specifically on fuel handling machines that charge and discharge fuel from the reactor while the reactor is at power. Some of the NRC General Design Criteria can be adapted to the fuel handling system, including an on-line F/M. There are also NRC Regulatory Guides and sections in the NRC Standard Review Plan specifically on new and spent fuel handling and storage, and on components that are present in the CANDU fuel handling system, such 3 as power supplies, controls, cable trays and supports, and fire protection.

• The fuel handling system and the F/M in particular are potentially important to the I

containment design from several aspects. Besides the potential for failures in the system initiating an accident, when the F/M is connected to a reactor fuel channel it becomes an extension of the reactor coolant system pressure boundary. When the F/M is connected to any of the containment penetrating ports used to service the F/M and the isolation valves in that port are open, the F/M becomes part of the containment boundary.

Therefore, the integrity of the F/M can be important to the propagation of an accident and to containment integrity even when it is not the initiating source of an accident.

• The acceptance criteria which pertain to the containment isolation systems are applicable I

to the three refueling ports passing through the containment boundary.

l

• The containment must be able to handle the consequences of a refueling accident, i.e.,

leak-tight pressure barrier, heat removal, and combustible gas control.

I 74 I1 5

• The possibility of a possible containment bypass during an accident by way of the refueling machine should be considered.

I Acceptance Criteria Differences TTR-305 states that there are no codified Canadian regulatory requirements on fuel handling safety but goes on to say that Canadian government guidelines do require licensees to perform comprehensive and detailed reviews of the design to identify potential failures of equipment and to analyze and predict the consequences of postulated failures of fuel handling equipment.

I Basis for Acceptance The following information was found to support the acceptability of the containment in regards to the on power refueling system.

• All components of the CANDU 3 refueling design, unlike previous CANDU designs, are located outside the containments except for the F/M itself. New fuel storage, processing and charging into the F/M , discharging irradiated fuel from the F/M, and irradiated fuel storage are all performed outside containment and therefore place no functional requirements on the containment. However, when the F/M is connected to any of three I ports that penetrate containment (new fuel port, the rehearsal port, and the irradiated fuel transfer port) and the isolation valves in that port are open, the F/M is part of the containment boundary and must therefore be designed for this function.

• There have been about 250 (reactor) years of CANDU reactor operating experience without a fuel handling accident that resulted in radioactive emissions which resulted in a health risk to the off-site public. Numerous fuel handling system events releasing radioactivity within the containment have resulted in design and/or operational changes made to eliminate or reduce the probability of these events. However,it should also be I noted that the CANDU 3 design differs significantly from these previous CANDU designs, particularly in that fuel charging and discharging of the F/M are not performed within containment.

• Essentially all potential F/M accidents are maintained to have less severe consequences than postulated severe reactor coolant system LOCAs since a postulated refueling accident involves a limited number of fuel elements.

• Safety analysis has been performed for several potential CANDU fuel handling accidents i including: 1) fuel criticality outside the reactor, 2) reactor loss of coolant with F/M on-reactor, 3) improper connection between F/M and reactor, 4) F/M loss of coolant while

• 75

E O'

off-reactor, 5) irradiated fuel dropped from F/M, 6) fuel stuck in irradiated fuel port or discharge equipment, and 7) fuel damaged in irradiated fuel storage bay. These analysis were performed for other CANDU plant designs and analyses specific to the CANDU 3 design were not reported.

• A CANDU unique postulated accident exists where an end-fitting fails allowing all the bundles of a single channel to be ejected onto the contai:unent floor. In addition to causing a small break LOCA on the reactor coolant system, it also potentially bypasses all of the radiation retention barriers except the containment,i.e., the potential exists for fuel sheath failure. Preliminary experimental results indicate that the impact of the ejected fuel against a hard surface will break the fuel bundles into single elements or small clusters of elements with some elements expected to deform, however most are expected to survive without sheath failure. The cooling conditions in the refueling vault ,

area after the postulated event are expected to be very good due to the rapid high pressure discharge of primary coolant which will collect on the vault floor. However, due

o uncertainties in these thermal-hydraulic conditions, the safety analyses do not take credit for these cooling mechanisms. A conservative analysis assuming convective heat transfer from the fuel to surrounding dry air and assuming fragmentation and scattering of fuel pellets, concluded that the potential radiation releases and doses to the off-site public would not exceed maximum permissible limits.

Additional Information More detailed design and analysis information is needed for verification of acceptability.

• A complete and clear description of CANDU 3 refueling design is needed. The AECL report TTR-305 which describes the refueling design, discusses the CANDU 6 design with only one small section dedicated to CANDU 3. While the CANDU 3 design which is still under development was derived from the CANDU 6 design, there are significant differences such as single ended fueling. TTR-305 is not always clear about what is and what is not applicable to the CANDU 3 design.

• A detailed description of the refueling port isolation valves and their operation is needed.

• Detailed information regarding accident analysis specific to the CANDU 3 design are needed. Since these analyses were performed primarily by means of a number of <

76 as

l t

Canadian computer codes with some supported by experiments, these computer codes and their verification should be reviewed.

f-

• More information is needed regarding a type of accident scenario where an irradiated fuel f

bundle being transported out of containment is suspended in an air environment. In the CANDU 3 design, the fuel passes from a heavy water environment, through a temporary 4

air environment, and into the light water in the irradiated fuel storage bay. The air environment is apparently within the irradiated fuel lock and in a fuel transfer magazine.

'ITR-305 reports an accident in a CANDU reactor which involved a stuck irradiated fuel elevator where an air-cooled irradiated fuel bundle overheated and disintegrated. This information should discuss the possibility of this type of accident happening in a CANDU 3 plant.

Evaluation The CANDU 3 fuel handling system should impose no special functional requirements on the reactor containment assuming that AECL's accident analyses are correct. Of coarse, the several ports used to service the F/M must,like all containment penetrations, be properly designed, operated and g

!W periodically tested.

5.11 Containment Response to Severe Accidents The CANDU 3 containment response to severe core damage accidents has not been assessed by the

} Canadians. The information presented here will therefore be rather sparse.

l Accentance Criteria A new design for a nuclear power plant can be shown acceptable for severe accident concerns if it meets the criteria and procedural requirements of an NRC Severe Accident Policy

.I Statement" The requirements are:

• Drmonstration of compliance with the procedural requirements and criteria of the current Commissions regulations, including the Three Mile Island requirements for new plants as reflected in the CP Rule [10 CFR 50.34(f):47 FR 2288].

• Demonstration of technical resolution of all applicable Unresolved Safety Issues and the l medium and high-priority Generic Safety Issues, including a special focus on assuring the reliability of decay heat removal systems and the reliability of both AC and DC electrical

,I supply systems.

l l

I L ____________________________________________.____________________________________________________o

n d

C

• Completion of a Probabilistic Risk Assessment (PRA) and consideration of the severe accident vulnerabilities the PRA exposes along with the insights that it may add to the assurances of no undue risk to public health and safety.

• Completion of a staff review of the design with a conclusion of safety acceptability using an approach that stresses deterministic engineering analysis and judgment complemented by PRA.

Acceptance Criteria Differences Canadian regulations comparable to U.S. regulations regarding severe accidents were not found.

Basis for Accentance The following limited infonnation was presented regarding the response of the -

containment to a severe accident.

• The CANDU 3 reactor design provides several barriers between the reactor fuel and the containment concrete including the heavy water filled calandria tank and the water and steel ball filled shield tank. An analysis concluded that the core material would be contained in the calandria. If the core material melted through calandria and shield tanks, then floor area under the shield tank is available for spreading the core debris and water on the containment floor would be available to quench and cool the debris.

• A high pressure core melt ejection scenario would have an extremely low probability of occurrence because of the high availability of each reactor shutdown system. In a CANDU reactor, a high pressure core melt ejection could only be generated by an abnormal event requiring shutdown, coincident with the unavailability of both shutdown systems.

Additional Information Vhtually all of the information regarding the containment response to a severe accident is needed. A fr w specific areas outlined in SRM July 21,1993" are discussed below.

• Core debris coolability analysis showing coolability of the debris both in the calandria and on the containment floor is needed. 'Ihe analysis should show 1) adequate floor space to enhance debris spreading, 2) a means to flood the reactor cavity to assist in the cooling

• process, 3) protection of the containment liner and other structural members with concrete, 4) the interaction of the debris with the basemat materials and the resulting production of non-condensible gases, and 5) any possibilities of steam explosions and 78 l l

E

=

l 2

I resulting missiles. The analysis should ensure that the best estimate environmental conditions resulting from core-concrete interactions do not exceed the Reactor Load Category for concrete containments for approximately 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> and ensure that the containment capability has the margin to accommodate uncertainties in the environmental conditions from core-concrete interactions.

De containment base slab is covered by a leak tight 6-mm steel liner which forms the I

containment pressure boundary. De interaction of the core debris on the containment floor and this liner cannot be determined from the available design description. The question is whether or not the hot core debris will compromise this liner and thereby the integrity of the containment.

• Analysis should verify the unlikelihood of a CANDU 3 severe accident resulting in a high pressure core melt ejection.

I Analysis should show the enhanced hydrogen production possible due to the oxidation of the pressure and calandria tubes during a severe accident.

• Containment performance analysis should show that the containment can maintain its role as a reliable, leak-tight barrier for approximately 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> following the onset of core damage under the more likely severe accident challenges and, following this period, the containment should continue to provide a barrier against the uncontrolled release of fission products. Further, the analysis should show a conditbnal containment failure probability (CCFP) of .1 or less.

• Isolation of auxiliary reactor systems which pass through containment such as the shield cooling system, should be shown for conditions following a severe accident.

• Analysis should show need for any containment venting credited in the first 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />.

• Equipment survivability dur.ng a severe accident should be shown.

Evaluation An evaluation of the CANDU 3 containment response to severe core damage accidents is not possible at this time because an assessment has not yet been completed by the Canadians.

" 79 l

l 1

n+ 4 4 _-,-- _ .- eL A e a.-J e.w.e n -- ..4 --- --..m , . - sas --A.-

1 l

e n

I r

h I'

I I

I 1

I. '

I I'

t 4 I.

J $

I i

a l

d I

l 4

'l l

.a 4 i

==

4

6.0 RADIONUCLIDE SOURCE TERM AND RELEASE TO THE ENVIRONMENT For licensing purposes, the NRC's reactor site criteria have required that the potential radiological consequences of a postulated accidental release of fission products into the containment be evaluated for an intact containment leaking at its maximum allowable leak rate. According to the Canadian regulations (refer to Section 5.4), the maximum allowable leakage rate is the value used in safety analyses which demonstrates that the reference dose limits are not exceeded. A licensing application review will I necessarily require a review of the analytical methods used to estimate site boundary dose limits. This section compares the site boundary dose limits of the U.S. and Canadian acceptance criteria and presents a cursory review of the Canadian analytical methods.

5 Acceptance Criteria The reactor site criteria dose limits are found in 10 CFR Part 100.11 ' An applicant should assume a fission product release from the core (based upon a major accident that would result in

} ,tential hazards not exceeded by those from any accident considered credible), the expected de.nonstrable leak rate from the containment and the meteorological conditions pertinent to the applicants site to derive an exclusion area, a low population zone and population center distance.

I

• An exclusion area of such size that an individual located at any point on its boundary for two hours immediately following onset of the postulated fission product release would not receive a total radiation dose to the whole body in excess of 25 rem or a total radiation dose in excess of 300 rem to the thyroid from iodine exposure.

A low population zone of such size that an individuallocated at any point on its outer boundary who is exposed to the radioactive cloud resulting from the postulated fission product release (during the entire period of its passage) would not receive a total I radiation dose to the whole body in excess of 25 rem or a total radiation dose in excess of 300 rem to the thyroid from iodine exposure.

A population center distance of at least one and one-third times the distance from the reactor to the outer boundary of the low population zone.

Acceptance Criteria Differences Canadian regulations require that plant designs show that prescribed dose limits to the public are not exceeded during normal operation and during postulated accidental events.

The Canadians specify dose limits for individuals at the boundary of the exclusion zone for both single

, and dual process system failures (refer to Section 2.7). For a single failure accident scenario, the dose 81

E G

limits are 05 rem whole body and 3 rem thyroid and for dual failures, the limits are 25 rem whole body and 250 thyroid. The Canadian dual failure individual dose limits are similar to those used in the US.

siting requirements for individuals at the boundary of the low population zone. The apparent differences are:

• ne specification of the accident, i.e., the Canadians specify single and dual process system failures, whereas the U.S. specifies any accident considered credible.

e ne Canadians also specify maximum total population dose limits. These are 10' man-rem and 104 thyroid-rem for single failures and 10' man-rem and 10' thyroid-rem for dual failures. For safety analysis purposes, the population dose is integrated from the station boundary out to a distance where the individual dose is 1% of the dose to an individual at the boundary.

Basis for Acceptance The basis for acceptance of the predicted radiological doses will depend heavily upon the acceptance of the Canadian analytical methods and codes. Information regarding the methods 5

g and codes was found primarily in the CSR 2, TTR-276, and TTR-384. TTR-384 contained the only 5 analytical results available for review but these results were for the CANDU 6 design which has a containment spray system, whereas the CANDU 3 does not. Operation of the containment spray system will reduce airborne radionuclides inside the containment and thereby reduce the releases to the environment. A comrk;c evaluation of these methods and codes is beyond the scope of this project, however the review did find several basic analytical assumptions applicable to the determination of design acceptability.

The Canadian exclusion zow sose limits are similar to those for the U.S. Iow population g

zone. E

• Simple predictions of radionuclide behavior within the containment are simulated wim the PRESCON2 containment thermal hydraulics code by employing two subroutines within the code. Subroutine TRACE models the transport of airbome radionuclides using a multi-tracer representation. Subroutine MORE, used in conjunction with TRACE, simulates various production and removal mechanisms. MORE simulates the behavior of noble gas, molecular iodine, radionuclide bearing liquid droplets and organic airbome iodine. (The amount of organic iodine in the containment atmosphere is always equal to the user-specified fraction of the total iodine inside containment, irrespective of decay, transport, or release from containment.) Various removal mechanisms include radioactive i 82 l

=! i

I decay, plateout and absorption, removal by drops, gravitational settling, and steam condensation.

• More detailed simulation of radionuclide behavior is accomplished with the SMART code, however the SMART code requires thermal hydraulic transient input from the PRESCON2 code. Therefore, the more detailed simulations are not fully integrated implying that the effects of radionuclide decay energy upon containment thermal hydraulics is not I simulated. The SMART code models the decay, buildup, removal, and transport of radionuclides in containment as well as their transport out of the containment via leakage and penetrations. Radionuclide releases into the containment are supplied to SMART.

The code has the capability to simulate up to 50 radionuclides as a stable or noble gas, aerosol, and several forms of iodine. The forms of iodine modeled include molecular iodine, organic iodine, iodine in a liquid sump, and a liquid aerosol. The code models several removal and attenuation processes.

• The dispersion of radionuclides after release from the containment and the resulting doses is calculated with the PEAR code. PEAR produces the dose equivalent to bo(8y surface, skin, thyroid and whole body from both the cloud and ground depositions for an individual and the population.

• Partial experimental validation exists for these codes focusing on fission product chemistry with the center on iodine chemistry in the containment. The dominant chemical forms of iodine have been determined, the kinetics and mechanisms of thermal aqueous lodine reactions and thermal mechanisms of organic iodide formation have been studied, as well as integrated tests in the intermediate-scale Radioiodine Test Facility.

I

• 1he sources of radionuclides within the HTS includes fission products released from fuel damaged during the accident, fission products from defective fuel during normal operation and the activation of corrosion products, coolant impurities, and the heavy water coolant. The TD2 points out that about 0.1% of the fuel bundles at Bruce A have developed failures in the fuel sheathing during normal operation. The main fission 2

products include the noble gases, Zr", Nb", Cs"', Ba ", La'", Mo", iodides, and a few other. The main activation products are Na 24

, Fe", Co", Zn'8 Ar, Cr5 , Mn5 ', C, and tritium. The tritium is produced from the heavy water and most of it is produced in the fi moderator system.

I 83 I

as

• Canadian safety analyses currently considers only those radionuclides which contribute most significantly to pubic dose. These were determined to be the radioactive isotopes of iodine, krypton, and xenon. Although their actual contribution is different for different accidents and containment failure modes, their approximate contributions are 77,12, and 10%, respectively, (total of 99%). The specific isotopes tracked in their safety analyses include: I*,1*,15,1*,1 5 , Kr"* Kr", Kr"", Kr87, Kr88 Kr", Xe*, Xe*", Xe*, Xe**,

Xe", and Xe"'.

• Noble gases are assumed to be completely carried through the primary coolant system and into the containment. Except for radioactive decay, they are not attenuated within  ;

the containment, and they are not retained by any leakage path.

= For safety analysis, the water soluble radionuclides, which include molecular iodine, I'

hydroiodic acid (HI), cesium iodide (CsI), and cesium hydroxide (CsOH), dissolve in the liquid present and are released into the containment in the form of liquid solution or aerosols.

• In safety calculations, it is assumed that 0.1% of the totaliodine released from the fuel is airbome in an organic form such as methyl iodide (CH 31). This is considered conservative because their evidence indicates that the actual value should be about .0056 to .03% and the organic forms of iodine (also referred to as penetrating or non-removable iodine) are not attenuated except by radioactive decay. Removal by filters or leakage pathways is not credited. Any loss of organic iodide from the containment atmosphere is compensated such that 0.1% of the total iodine inside containment is always airborne as organic. 'Ihe leakage of organic iodine from the containment is proportional to the overall fraction of containment atmosphere leaking which is based on 5% of the containment volume per day at design pressure.

I

• The attenuation factor for primary system radionuclides passing through the calandria following the rupture of both the pressure and the calandria tubes was stated to reach a factor of 100 or more with the exceptions of the noble gases and methyliodide. Tritium is the only significant radionuclide normally present in the moderator.

• No credit is taken in analyses for attenuation through a penetration in containment.

84

==

• Complete retention of aerosols through a containment leakage path is assumed due to a slow leakage rate, interactions with the surfaces, and steam condensation within the paths.

The size of the aerosol particles predicted (99.9% of the total number) during the blowdown period by the disintegration of the jet from the break is from 1 to 300 microns.

Comparing the expected size of aerosols in a post LOCA containment atmosphere (larger I than 1 micron) with a range of commercial removal equipment, it can be concluded that they do not leak from an intact containment.

I Additional Information In general, more details of analyses pertinent to the CANDU 3 design is needed l and analytical assumptions will need further justification or clarification before acceptability can be i f

ascertained. Specific examples follow.

lI

• Detailed analysis which is specific to the CANDU 3 design is needed. The radionuclide behavior analysis examples presented in 'ITR-384 analyzed the CANDU 6 containment l

with active sprays and the CANDU 3 dose estimates were based on the results of the 17%

uprated CANDU 6 analysis.

l I

• 'Ihe Canadians state that evidence indicates their assumption that of 0.1% of the total iodine released from the fuel is in the organic form. The summary of a U.S. iodine study" states that organic iodide is present in the containments of PWRs at about 0.5% )

of core inventory. While acknowledging that the CANDU PWR reactors are greatly different from the U.S. PWR reactors, it would be prudent to examine this assumption more closely due to the significant impact that organic iodine apparently has on the calculated dose estimates.

I

• TTR-384 states that most iodine released into the containment will be in the cesium iodide form (CsI) which agrees with the accepted U.S. source terms". However, the Canadian documentation is somewhat unclear on how this is included in their safety studies. A statement in the CSR states: "Briefly, iodine is ,,;,umed to be released from the fuel to the I

containment in an acrosol (iodide) form.", while discussing the behavior of I* in containment for a large LOCA calculation. But ~1TR-384 states: %c iodine will be mostly Csl but is conservatively assumed to be all molecular iodine.", while discuwing an end-fitting failure calculation. Perhaps this second statement is incorrect or perhaps this issue is treated differently for different calculations. If the Csl is assumed to be molecular

.I iodine, then the assumption needs justification. This issue needs clarification and it also indicates a need to delve more deeply into their analytical methods and codes.

1 I

I

E a

• ne assumptions, methodology, and models of the analysis used to assess the performance of the CANDU containment are adjusted on an objective by objective basis, so that the containment performance relative to each of the various safety objectives is conservatively assessed. These objectives of the containment analyses include the estimate for release of radionuclides to the environment to obtain public doses. A separate set of assumptions is required for each objective. A detailed review will therefore need suitable information for each objective.

• Complete retention of aerosols through a containment leakage path will need further justification. While it is realistic that 99.9% of the total number of aerosol particles is larger than 1 micron, tne 0.1% that is smaller than 1 micron are the most transportable, their transport properties may be comparable to those of vapors. An adequate aerosol transport study should include particle sizes ranging from about 0.01 microns to several hundred microns. In light of the fact that the majority of the iodine entering the containment is in the Csl aerosol form, the assumption that none of the aerosolized iodine leaks from the containment may not be a good one.

• The Canadian safety analyses appear to be based on the doses attributed to the isotopes of iodine, krypton, and xenon on the assumption that these isotopes completely dominant the risk to the public (99% of total dose). TTR-384 acknowledges that this assumption is dependent upon the accident and containment failure mode. If one were to use their lower limits on the dose ranges associated with the individual isotopes, the total dose contributions from these three elements could conceivably be significantly less 99%

Further, the assumption may be inadequate for severe accident analysis or for a PRA study. For example, latent cancer fatalities estimates may depend upon one of the longer g lived bone seeking isotopes. E

• The Canadian's analytical methods and codes appear to have been developed for design basis accidents. They will have to be carefully reviewed for applicability to severe accidents and potential major containment breaches.

)

• Tritium, produced in CANDU reactors by the neutron activation of heavy water, is acknowledged to be present in significant quantities at least in the moderator system but l i

the disposition and transport of this tritium following an accident was not discussed.

Tritium could be released to the containment during accidents which rupture this system E 1

, l' l l

5

=

I such as a pressure tube rupture scenario. Contributions of tritium releases to the L environment need to be discussed even if they turn out to be of no consequence.

il

!

• In light of the fact that the CANDU 3 design is apparently the only CANDU design which does not incorporate containment sprays and the existing safety history of CANDU reactors is being used as an argument for the acceptability of the CANDU 3 design, an

"""'Y "'""'i"8 '"* S*"*'"' '" ' " ' '""di"5 'P'"Y' " '" di ""id* *" '

E lm the environment would be useful. This analysis should show how much lower the releases from the containment would be if the design were to have included a spray E

lE

l. system.

1

• Details of their code verification and validation studies should be supplied for review.

l I

• The Canadian radiont.clide and transport methods and codes should be verified by comparative studies with U.S. methods and codes.

Evaluation The acceptance of the CANDU 3 design in regards to risk to the public will require a more l detailed review of their methods and codes for predicting radionuclide transport within the I containment and the consequential releases to the environment. In particular, their major assumptions will have to be substantiated. In addition, it is recommended that the NRC perform independent supporting calculations with U.S. methods and codes.

lI I

I  !

I '

I I

I 87 I

A ,. m Aa aa .m - .n,,,=6 a,A-+3-p 4 2 -, A 2+ - a m-- A 2 .,_aa

.E ,

I' I

I  ;

I: ,

t l'

Ii ,

I I

s i

I I

I E

l I

I l

\

- I s=

I

7.0 REFERENCES

7.1 CANDU Technology Documents

1. CANDU 3 Technical Description. Revision 3, 74-01371-TED-001, September 1989, Proprietary.

I 2. E. S. Y. Tin, editor, *CANDU 3 Conceptual Safety Report," Revision 0,1989, Proprietary.

3. J. W. D. Anderson, editor, "The Technology of CANDU Source Term Calculation," TTR-384, July 1992.

.I 4. CANDU 3 Technical Outline. Revision 11, June 1992.

I 5. R. L. Ferguson and M.H. Fletcher, " Comparison of CANDU 3 with NRC Positions for Evolutionary Light Water Reactor (LWR) Certification Issues in SECY-90-016," "ITR-429, I- June 1992.

6. R. K. Nakagawa, '"Ihe Technology of CANDU On-Power Fueling," TIR-305, January 1991.

l I

7. J. W. D. Anderson, et al, "CANDU 3 and U.S. NRC Requirements; Equivalent Safety Issues: Containment Design," TTR-411, October 1992.

'E 8. M. Fletcher, "CANDU 3 and the U.S. NRC General Design Criteria," TTR-423, June 1992.

I 9. 1. Charak and P. H. Kier, "CANDU Reactors, 'Iheir Regulation in Canada, and the Identification of Relevant NRC Safety Issues," Argonne National Laboratory, June 1993.

I 10. D. Pendergast, editor, "The Technology of CANDU Loss-of-Coolant Accidents," TTR-276, February 1991.

I

11. E. G. Price, editor, "The Technology of CANDU Fuel Channels," TTR-291, January 1991.

12. M. S. Quraishi, "CANDU 3 Containment Node-Link Models," 74-03500-AR-002, Atomic Energy of Canada Limited, Revision 0/89-02-10, Proprietary.

I 89 I

C O

13. M. A. Cormier," Containment Node-Link Model for the CANDU 3 Design," 74-68400-AR-004, Atomic Energy of Canada Limited, Revision 0/90-0S-04, Proprietary.

14. AECL, " Unique Aspects of the CANDU 3 Design," Atomic Energy of Canada Limited, I'

June 1989.

15. G. I. Hadaller, G. H. Archinoff, and E. Kohn, "CANDU Fuel Bundle Behavior During Degraded Cooling Conditions",4th Annual Conference of the Canadian Nuclear Society, Montreal, June 1983.

16. E. Kohn, G. I. Hadaller, R. M. Sawala, G. I. Archinoff and S. L Wadsworth, "CANDU Fuel I

Deformalion Dunng Degraded Cooling - Experimental Results", Canadian Nuclear Society Conference, June 1985.

17. S. D. Grant and J. M. Hopwood, "The Effect of Fuel Heat Transfer on Early Void Production Following a Large Pipe Break in CANDU Reactors", Canadian Nuclear Society Simulation Symposium, Winnipeg, Manitoba, April 1988.

18. P. G. Gulshani," Prediction of Pressure Tube Integrity for Large Loss-of-Coolant Accident in CANDU", American Nuclear Society,1987 Winter Meeting, Los Angles, Ca, November 15-19, 1987.

19. V. I. Nath and Kohn, "High Temperature Oxidation of CANDU Fuel During a LOCA",

Proceedings of the Fifth International Meeting on Thermal Nuclear Reactor Safety, Karlsruhe,9-13 September,1984, Kraftwerk Union Report KFK 388011, December 1984.

7.2 Canadian Regulatory Documents

20. AECU Regulatory Document R-7,

• Requirements for Containment Systems for CANDU I.

Nuclear Power Plants," February 21,1991.

21. AECB Regulatory Document R-8, " Requirements for Shutdown Systems for CANDU Nuclear Power Plants," February 21,1991.

I 90 E

m

!I l

22. AECB Regulatory Document R-9, " Requirements for Emergency Core Cooling Systems for CANDU Nuclear Power Plants," February 21,1991.

'I 23. AECB Regulatory Document R-10, "The Use of Two Shutdown Systems in Reactors."

i January 11,1977.

I

24. AECB Regulatory Document R-77, " Overpressure Protection Requirements for Primary Heat Transport Systems in CANDU Power Reactors Fitted with Two Shutdown Systems,"

October 20,1987.

25. AECB Consultative Document C-6, " Requirements for the Safety Analysis of CANDU i Nuclear Power Plants," June 1980.

7.3 Canadian Standards Association (CSA) Standards I

26. CAN3-A23.3-M84, " Design of Concrete Structures for Buildings."

l

27. CAN3-N287.1-M91, " General Requirements for Concrete Containment Structures for CANDU Nuclear Power Plants."

28. CAN3-N287.2-M91, " Material Requirements for Concrete Containment Structures for CANDU Nuclear Power Plants."

I 29. CAN3-N287.3-M82, " Design Requirements for Concrete Containment Structures for CANDU Nuclear Power Plants."

30. CAN3-N287.4-M92, " Construction, Fabrication, and Installation Requirements for Concrete Containment Structures for CANDU Nuclear Power Plants."

l

31. CAN3-N287.S-M81, " Testing and Examination Requirements for Concrete Containment Structures for CANDU Nuclear Power Plants."

I 32. CAN3-N287.6-MSO, " Pre-Operational Proof and Leakage Rate Testing Requirements for Concrete Containment Structures for CANDU Nuclear Power Plants."

,I I 91 I

E a

33. CAN3-N287.7-M80, "In-Service Examination and Testing Requirements for Concrete Containment Structures for CANDU Nuclear Power Plants."

34. CAN3-N289.1-80, " General Requirements for Seismic Qualification of CANDU Nuclear I

Power Plants."

35. CAN3-N289.2-M81, " Ground Motion Determination for Seismic Qualification of CANDU Nuclear Power Plants."

36. CAN3 N289.3-M81, " Design Procedures for Seismic Qualification for CANDU Nuclear Power Plants."

37. CAN3-N289.4-M86, " Testing Procedures for Seismic Qualification of CANDU Nuclear Power Plants." l l

38. CAN/CSA-N285.0, " General Requirements for Pressure-Retaining Systems and i Components in CANDU Nuclear Power Plants."

7.4 USNRC Regulations and Other Review References

39. NUREG-0800,"USNRC Standard Review Plan for the Review of Safety Analysis Reports for Nuclear Power Plants, LWR Edition, U.S. Nuclear Regulatory Commission, Revit ions through June 1987.

40. 10 CFR Part 50, Appendix A, January 1,1991. ,

GDC 1, " Quality Standards and Records."

GDC 2, " Design Bases for Protection Against Natural Phenomena."

GDC 4, " Environmental and Missile Design Basis."

GDC 13, " Instrumentation and Control."

GDC 16, " Containment Design."

GDC 38, " Containment Heat Removal."

GDC 39, " Inspection of Containment Heat Removal System."

GDC 40, " Testing of Containment Heat Removal System."

GDC 41," Containment Atmospheric Cleanup."

GDC 42," Inspection of Containment Atmosphere Cleanup Systems."

92 5

I CDC 43," Testing of Containment Atmosphere Cleanup Systems."

GDC 50, " Containment Design Basis."

GDC 51, " Fracture Prevention of Containment Pressure Boundary."

GDC 52, " Capability for Containment Leakage Rate Testing."

GDC 53," Provisions for Containment Testing and Inspection."

GDC 54, " Piping Systems Penetrating Containment."

GDC 55, " Reactor Coolant Pressure Boundary Penetrating Containment."

I GDC 56, " Primary Containment Isolation."

GDC 57, " Closed System Isolation Valves."

GDC 64," Monitoring Radioactivity Releases."

41. 10 CFR Part 50.55a, " Codes and Standards," January 1,1991.

42. 10 CFR Part 100. " Reactor Site Criteria," January 1,1991.

Memorandum for James M. Taylor, "SECY-93-087 - Policy, Technical, and Licensing Issues I

43.

Pertaining to Evolutionary and Advanced Light-Water Reactor (ALWR) Designs," July 21, 1993,

44. NUREG-1150, " Severe Accident Risks: An Assessment for Five U.S. Nuclear Power Plants," Final Summary Report, U.S. Nuclear Regulatory Commission, December 1990.

45. NRC Policy Statement, "10 CFR Part 50: Policy Statement on Severe Reactor Accidents Regarding Future Designs and Existing Plants," Federal Register, Vol. 50, No.153, August 8,1985.

I NRC Letter to All Licensees Holding Operating Licenses and Construction Permits for 46.

Nuclear Power Reactor Facilities, " Individual Plant Examination for Severe Accident Vulnerabilities - 10 CFR Part 50.54(f)," Generic Letter No. 88-20, dated November 23,1988.

I 47. 10 CFR Part 50, Appendix J, " Primary Reactor Containment Leakage Testing for Water-1 Cooled Power Reactors," January 1,1991.

48. " Industry Report on PWR Containment License Renewal," Nuclear Management and I Resource Council (NUMARC), Washington D.C., Submitted to USNRC, August 31,1990.

I 93 I

E

=,

49. 10 CFR Part 50, Appendix B," Quality Assurance Criteria for Nuclear Power Plants and ,

Fuel Reprocessing Plants," January 1,1991.

50. NUREG-0660, "NRC Action Plan Developed as a Result of the TMI-2 Accident," U.S.

Nuclear Regulatory Commission, May 1980, (Revision 1) August,1980.

51. NUREG-0737," Clarification of TMI Action Plan Requirements," U.S. Nuclear Regulatory Commission, November 1980. W

52. 10 CFR Part 50,50.34(f), " Additional TMI-Related Requirements.," January 1,1991.

53. Dameron, R. A., Dunham, R. S., Rashid, Y. R., and Sullaway, M. F., " Methods for Ultimate Load Analysis of Concrete Containments," 3rd Phase,1st Tier Report: Criteria and Guidelines for Predicting Concrete Containment Leakage," ANATECH Research Corp.,

EPRI Report NP-6260-M, February 1989.

54. Regulatory Guide 1.11, " Instrument Lines Penetrating Primary Reactor Containment,"

March 1971.

55. 10 CFR Part 50, Appendix K, "ECCS Evaluation Models," January 1,1991.

I

56. A. G. Ware, "Probabilistic Based Design Rules for Components Affected by Intersystem I.

LOCAs," Transactions of the Twenty-First Water Reactor Safety Information Meeting, NUREG/CP-0132, October 25-27,1993.

57. 10 CFR Part 100.11, " Determination of Exclusion Area, Low Population Zone, and l Population Center Distance," January 1,1991.

Ii

58. E. C. Beahm, C. F. Weber, and T. S. Kress, " Iodine Chemical Forms in LWR Severe Accidents," NUREG/CR-5732, July 1991.

1

59. L Soffer, et. al., " Accident Source Terms for Light-Water Nuclear Power Plants," NUREG-1465, Draft Report for Comment, June 1992. ]

60. 10 CFR Part 50,50.44, " Standards for Combustible Gas Control System in Light-Water- l Cooled Power Reactors," January 1,1991.

94 s=

4 a _ a - .- _ m.

- - 4n-

I  !

!I i

i il lI APPENDIX A j

SUMMARY

OF CANDU COMPLTTER CODES USED IN PERFORMANCE ANALYSES

!I.

J

I d

,f iI lI lI s

i I

I I

I I

I

\

I APPENDIX A Summary of CANDU Computer Codes Used in Performance Analyses ACTREL Long term activity release AMPTRACT Axial /Circumferential pressure tube transient temperatures CATHENA CANDU version of ATHENA D two-fluid code for LOCAs I CERBERUS CERBSPOW Reactivity calculations - space dependent neutron kinetics (3-D)

Power module - power distribution corresponding to flux CHAN Consequences of metal-water reaction CHANilA. MODI Fuel temperatures and hydrogen production CONTACT Uniform circumferential strain of overheated pressure tube COREFFR Estimate accident release of free fission products - 23 isotopes CURIES Estimates released of free ELESIM Fuel thermomechanical behavior during normal operation ELESTRES Development of ELESIM (2-D pellet deformation)

I ELOCA FIREBIRD III Calculates accident fuel response and sheath strain Thermohydraulics (1-D homogeneous equilibrium)

FMDP Physics simulation and fuel management program GENHTP General package of heat transfer subroutines HOT 5 POT Fuel bundle and pressure /calandria tube thermal response IBIF/THERMOSS Establish buoyancy driven flow in fuel channel and feeders MATMAP Reactor modeling code - assists setting up 3-D reactor models MICROPRESCON2 Containment response MISSFINCH Header two-phase two-dimensional flow MODHT Transient moderator temperature response I MORE PRESCON fission product production and removal mechanisms MULTICELL Neutronics within supercell(specified portion of reactor core)

NUCIRC Steady state normal operating conditions thermal-hydraulic ORIGEN Total fission product inventories PEAR Radiation doses from radioactive airbome plume PHOENICS 3-D steady state moderator circulation analysis POINISIM Point kinetics code - detector and electronics modeling code POWDERPUFS-V Lattice cell code (parameters for CERBERUS)

I PRESCON2 Containment thermohydraulics l'TDFORM Non-uniform circumferential strain of overheated pressure tube SMART Containment radionuclide behavior following LOCA A-1 I i

E O

TALSMAL Simulates fuel channel behavior with steam only to feeder TRACE PRESCON airbome multi-tracer fission product transport TUBRUPT Calandria response to a channel failure VENT Buming of H2 or CH,in volume venting to much larger volume 2D-MOTH Steady state local cooled and circulated moderator temperatures I

I I

I I,

I I'

I I

I.

I I

I A-2 II l 1

5l 4

_ _ _ _ _ _ _ _ _ _ _ -_ ________-__-__--___0

a. A __4 -e. 6 .a . - --. - - - - - -

I  ;

I .

i 1

l CONTAINMENT CODES AND STANDARDS I i l

I I

I  :

I 1 I

. I I

I I

I

. I

.I I

\I

l I

I APPENDIX B CONTAINMENT CODES AND STANDARDS Specific Standards The following detailed list of codes, code cases, general design criteria, regulatory guides, and references are those that need to be followed in the design of a USNRC licensed containment. This list has been categorized under (1) general documents, (2) load cases (hazards), (3) documents pertaining to the concrete I design and construction, and (4) inspection and testing. Although, as described throughout Section 4, many of these standards are equally covered by Canadian Standards, the reviewers feel it is appropriate to present a comprehensive list of the U.S. Standards affecting the containment.

General Documents I 1. ASME Boiler and Pressure Vessel Code.Section III. Divisions 1 and 2. American Society of Mechanical Engineers,1989.

ASME Boiler and Pressure Vessel Code.1986 Addenda 1987 Addenda.1988 Addenda, and 1989 2.

Addenda. American Society of Mechanical Engineers, 1986-1989.

3. ASME Boiler and Pressure Vessel Code.Section XI. Division 1. American Society of Mechanical Engineers,1986 Edition.

I 4. ASME Boiler and Pressure Vessel Code.Section XI. Subsections RVE and IWL. American Society of Mechanical Engineers,1989 Edition. (Note, conformance with this item is included even though these subsections are not yet adopted by USNRC or 10CFR50.55a.)

5. " Code Requirements for Nuclear Safety-Related Concrete Structures." ACI-349-89, American Concrete institute,1989.

6. Certain Referenced Sections of the Standard Review Plan for Review of Safety Analysis Reports for Nuclear Power Plants," NUREG-0800, Nuclear Regulatory Commission, June 1987.

I 7. Title 10. Char >ter 1. Code of Federal Reculations - Enerev. Part 50. " Domestic Licensing of Production and Utilization Facilities," and Appendices, April 30, 1990, and subsequent Amendments. (Note, detailed references to Appendices of 10CFR50 are also cited below.)

8. 10CFR100, " Reactor Site Criteria", and Appendices, April 30,1990.

9. Regulatory Guide 1.4," Assumptions Used for Evaluating the Potential Radiological Consequences

of a Loss-of-Coolant Accident for Pressurized Water Reactors," U.S. Nuclear Regulatory Cormnission, Revision 2, June,1974.

I B-1 I

E o

Hazards Reauirements

10. 10CFR50, Appendix A, General Design Criteria (GDC) I and 2, " Design Bases for Protection Against Natural Phenomena."

11. 10CFR100, Appendix A, " Seismic and Geologic Siting Criteria for Nuclear Power Plants."

12. Regulatory Guide 1.132, " Site Investigations for Foundations of Nuclear Power Plants," Revision 1, March,1979.

13. Regulatory Guide No.1.61, " Damping Values for Seismic Analysis for Nuclear Power Plants,"

October,1973.

14. ANSI A58.1, " Building Code Requirements for Minimum Design Loads in Buildings and Other Structures," Committee A58.1, American National Standards Institute,1982.

15. Regulatory Guide 1.59," Design Basis Floods for Nuclear Power Plants," Revision 2, August,1977.

16. Regulatory Guide 1.102, " Flood Protection for Nuclear Power Plants," Revision 1, Sept.,1976.

17. Regulatory Guide 1.29, " Seismic Design Classification," Revision 3, Sept.,1978.

I

18. Regulatory Guide 1.76, '* Design Basis Tornado for Nuclear Power Plants," April,1974.

19. Regulatory Guide 1.117, "Tomado Design Classification," Revision 1, April,1978.

20. 10CFR50.55a requires Structures, Systems, and Components (SSC) to be designed and constructed l to quality standards commensurate with the importance of the safety function to be performed.

21. 10CFR100.10 indicates that the site location, in conjunction with other considerations (such as l plant design, construction, and operation), should insure a low risk of public exposure. This e requirement is met if the probability of site proximity missiles impacting the plant and causing radiological consequences greater than 10CFR100 exposure guidelines is less than about 10 per 3 year (see SRP 2.2.3). If this criterion is not met, then the criterion described in 22 below applies. 3

22. General Desien Criterion (GDC) 4 of 10CFR50. Annendix A. requires that structures, systems and a components (SSC) important to safety be appropriately protected against the effects of missiles g that may result from events and conditions outside the nuclear power unit. The plant complies with GDC 4 and is considered adequately protected against site proximity missiles if the following criterion is met: The SSC important to safety are capable of withstanding the effects of the E postulated missiles without loss of safe shutdown capability and without causing a release of 5 radioactivity which would exceed 10CFR100 dose criteria.

23. 10CFR10010 as it relates to indicating that the site location, in conjunction with other considerations (such as plant design, construction, and operation), should insure a low risk of public exposure. This requirement is met if the probability of aircraft accidents resulting in radio:ogical consequences greater than 10CFR100 exposure guidelines is less than about 10' per year. He probability is considered to be less than about 103 per year by inspection if the distances from the plant meet all the requirements listed below.

I B-2 Ij!

i

I

24. General Desien Criterion 4 of 10CFR50. Appendix A. requires that SSC important to safety be appropriately protected against the effects of missiles that may result from events and conditions outside the nuclear power unit. GDC 3 of 10CFR50, Appendix A, requires that SSC important to I safety be appropriately protected against the effects of fires. The plant meets the relevant requirements of GDC 3 and GDC 4, and is considered appropriately protected against design basis aircraft impacts and fires if the SSC important to safety are capable of withstanding the effects of I the postulated aircraft impacts and fires without loss of safe shutdown capability, and without causing a release of radioactivity which would exceed 10CFR100 dose guidelines.

25. 10CFR50. Anoendix A (a) General Desien Criterion 1 " Quality Standards and Records." This criterion requires that SSC important to safety shall be designed, fabricated, erected, and tested to quality standards I commensurate with the importance of the safety functions to be performed. It also requires that appropriate records of the design, fabrication, erection, and testing of SSC important to safety shall be maintained by or under the control of the nuclear power unit licensee throughout the life of the unit.

(b) General Desien Criterion 2 " Design Bases for Protection Against Natural Phenomena."

This criterion requires that safety-related portions of the system shall be designed to withstand I the effects of earthquakes, tornadoes, hurricanes, floods, tsunami, and seiches without loss of capability to perform their safety functions.

26. 10CFR100. " Reactor Site Criteria"- This Part describes criteria which guide the evaluation of the suitability of proposed sites for nuclear power and testing reactors.

g 27. 10CFR100, Appendix A. " Seismic and Geolocic Sitine Criteria for Nuclear Power Plants" - These g criteria describe the nature of the investigations required to obtain the geologic and seismic data necessary to determine site suitability and identifies geologic and seismic factors required to be taken into account in the siting and design of nuclear plants.

Concrete Containment Desien and Construction

28. ASME Boiler and Pressure Vessel Code,Section III, Division 2,

• Code for Concrete Reactor Vessels and Containments," 1989 Edition

29. Regulatory Guide 1.70, " Standard Format and Content of Safety Analysis Reports for Nuclear Power Plants," Revision 3, Nov.,1978.

30. Regulatory Guide 1.10, " Mechanical (Cadweld) Splices in Reinforcing Bars of Category 1 Concrete Structures."

31. Regulatory Guide 1.15, " Testing of Reinforcing Bars for Category I Concrete Structures."

32. Regulatory Guide 1.19, " Nondestructive Examination of Primary Containment Liner Welds."

33. Regulatory Guide 1.35, " Concrete Placement in Category I Structures."

34. Regulatory Guide 1.18, " Structural Acceptance Test for Concrete Primary Reactor Containments."

35. Regulatory Guide 1.35, " Inservice Surveillance of Ungrouted Tendons in Prestressed Concrete Containments," Revision 2, Jan.,1976.

B-3 I

E a

36. Regulatory Guide 1.90," Inservice Surveillance in Prestressed Concrete Containments with Grouted Tendons," Revision 1, Aug.,1977.

37. Regulatory Guide 1.94, " Quality Assurance Requirements for Installation, Inspection, and Testing of Structural Concrete and Structural Steel during the Construction Phase of Nuclear Power Plants," Revision 1, April,1976.

38. Regulatory Guide 1.103, " Post-Tensioned Prestressing Systems for Concrete Reactor Vessels and Containments."

39. Regulatory Guide 1.107, " Qualifications for Cement Grouting for Prestressing Tendons in Containment Structures," Revision 1, Feb.,1977.

40. Regulatory Guide 1.136, " Materials, Construction, and Testing of Concrete Containments,"

Revision 2, June,1981.

Inspection. Testine, SITS And ILRTs

41. 10CFR50, Appendix J, " Primary Reactor Containment Leakage Testing for Water-Cooled Power Reactors."

42. 10CFR50, Appendix A, General Design Criterion 52, " Capability for Containment Leakage Rate Testing."

43. 10CFR50, Appendix A, General Design Criterion 53, " Provisions for Conta~ m ment Testing and Inspection."

44. 10CFR50, Appendix A, General Design Criterion 54, " Systems Penetrating Containment.

45. Regulatory Guide 1.35, " Inservice Inspection of Ungrouted Tendons in Prestressed Concrete Containment Structures," U.S. Nuclear Regulatory Comnussion, Revision 2, Jan.,1976. ,

46. Regulatory Guide 1.90, " Inservice Surveillance in Prestressed Concrete Containment Structures with Grouted Tendons," U.S. Nuclear Regulatory Commission, Revision 1, Aug.,1977.

47. Regulatory Guide 1.94," Quality Assurance Requirements for Installation, Inspection and Testing of Structural Concrete and Structural Steel during the Construction Phase of Nuclear Power l, Plants," U.S. Nuclear Regulatory Commission, Revision 1, April,1976. 5

48. Regulatory Guide 1.135, " Materials, Construction, and Testing of Concrete Containments," U.S.

Nuclear Regulatory Commission, Sept.,1977.

I.

I; 1

I

~ i

!l

=l l

-~ - - - - - - _ , . - - - - - - - - - - -

I II

'I A,momc

,g DISCUSSION OF CANADIAN AND U.S. LOADING AND LOAD COMBINA110NS i

'I l

I

.I I

I I

I I

I I

I I

I

APPENDIX C DISCUSSION OF CANADIAN AND U.S. LOADING AND LOAD COMBINATIONS The specified loads and load combinations are acceptable if found to be in accordance with Article CC-3000 cf the ASME Code. In particular, these combinations are listed in Table CC-3230-1.

I Seismic Desien Parameters I An Operating Basis Earthquake (OBE) and Safe Shutdown Earthquake (SSE) are terms that have typically been used in U.S. containment design, where the magnitude of the OBE is typically half that of the SSE.

The fact that Canadian requirements have no design earthquake equivalent to the OBE is a departure from I U.S. standard practice. However, recently, the requirement for consideration of OBE was dropped by the USNRC (SECY-93-087). Now, the containment and its appurtenances covered by the applicant's document should be assigned a seismic category or other seismic risk designation per USNRC Regulatory Guide 1.29 and they should be designed to remain functional in the event of an SSE. For the loading combinations specified later in this review, the equivalent loads corresponding to these earthquake definitions are labeled E and E,, respectively. The Canadian design earthquake analogous to SSE is the I design basis earthquake, DBE. A comparison of seismic considerations for the containment must include comparison of these and various other criteria that are also applicable, including the characterization of the earthquake itself and the site conditions. The U.S. requirements are reviewed below and then I compared to the Canadian requirements.

Seismic Classification GDC 2 of 10CFR50, Appendix A is applicable to the containment, which requires that SSC important to safety be designed to withstand the effects of earthquakes without loss of capability to perform their safety functions. The maximum carthquake for which the containment and its appurtenances are designed is defined as the SSE in 10CFR100, Appendix A. The SSE is based upon an evaluation of the maximum earthquake potential and is that earthquake which produces the maximum vibratory ground motion for which SSC important to safety are designed to remain functional. Those plant features that are designed I to remain functional if an SSE occurs are designated seismic CategorfIin USNRC Regulatory Guide 1.29.

The Canadian equivalent, the DBE, is an 'engineeriq -epresentation of the potentially severe effects of earthquakes that have sufficient low probabi'hy a h%g acceded during the lifetime of the plant." The specific details of the characterization of this earthquake are not included in the Applicant's submittal.

Guidelines that should be followed are included in Appendix D.

I '

I

E a

Site Conditions for Seismic Classification I

The following site characteristics must be considered in evaluating the effects on seismic response of the containment:

1. Soil and rock foundation properties of the site which may affect the containment's seismic response.

2. Geologic features: mass-wasting, differential subsidence, faulting, and chemical weathering.

3. Seismic features: ground failure under dynamic loading, liquefaction, vibratory ground motion, and residual stresses.

4. Man-made conditions: changes in ground water conditions, subsidence or collapse caused by withdrawal of fluids or mineral extraction, induced seismicity, and fault movement caused by fluid injection (including reservoir impoundment) or withdrawal.

5. Evidence indicating potential for surface faulting.

6. Regional geology and site geology should be reviewed in terms of the regional and site physiography, geomorphology, stratigraphy, lithology, and tectonics. In addition, with specific I'

reference to site geology, the following subjects should be considered as they relate to the above- 3 mentioned conditions: topography, slope stability, fluid injection or withdrawal, mineral 5 extraction, faulting, shearing, jointing, seismicity, and fracturing.

Wind Desien Parameter;i ne wind velocity used in the design of a USNRC licensed plant must be the most severe wind that has been historically reported for the site and surrounding area with sufficient margin for the limited accuracy, quantity, and period of time in which historical data have been accumulated. Detailed information on establishing the design wind and appropriate consideration of wind effects is given in the SRP 2.3.1 and 2.3.2. The Canadian standards for wind hazard characterization are insufficiently detailed to make an ,

adequate determination or comparison to U.S. procedures. He U.S. procedure for converting design wind g

to containment loading are included in Appendix D for reference. 3 Evaluation of Desien Basis Tornado Designation of the design tornado wind load and the associated missiles for a U.S. licensed plant must comply with the relevant requirements of 10CFR50 GDC 2 and USNRC Regulatory Guide 1.76. The criteria necessary to meet the relevani requirements of GDC 2 are as follows:

1. The tomado wind and associated missiles generated by the tornado winds used in the design should be defined using deterministic data per Regulatory Guide 1.76. He Commission approves the staff's position that a maximum tomado wind speed of 482 km/hr (300 mph) be used in the design-basis tomado employed in the design of evolutionary and passive ALWRs.

C-2 s

m I

2. He SRP 2.3.1,2.3.2, and 3.5.1.4 description of these parameters should serve as basic input to the structural design procedures.

For transforming the tomado wind velocity into an effective pressure applied to structures, the criteria delineated in either the American Society of Civil Engineers (ASCE) Paper No. 3269,

• Wind Forces on Structures", or in ANSI A58.1," Building Code Requirements for Minimum Design Loads in Buildings and Other Structures", are, in general, acceptable.

I ne Canadian equivalent to these requirements are covered in the CSR Part 1 Appendix D9 of the Applicant's submittal. The procedures followed appear identical to the Electric Power Research Institute (EPRI) Advanced Light Water Reactor (ALWR) requirements recommendations, which are consistent with the standards cited above. This covers the Canadian treatment of the tornado design basis, characterization of tornado generated missiles, and the systems and components that need to be protected.

Flood Protection ne applicant's submittal coverage of flood protection is inadequate. He applicant's CSR states that the site flooding conditions should be evaluated during the site evaluation process, but it does not state how or what standards are followed. Detailed information on flood characterization requirements for U.S.

plants is included in Appendix D.

External Site Proximity Missiles and Aircraft Hazards No information is provided in the applicant's submittal about protection against aircraft hazards or other non-tornado site proximity missiles. His is a deficiency that must be addressed by the applicant.

Detailed information on external site proximity missiles for U.S. licensing is provided in Appendix D.

Pirie Break Loadines GDC 4 requires that SSC important to safety should be designed to accommodate the effects of postulated I accidents, including appropriate protection against the dynamic and environmental effects of postulated pipe ruptures. These should include consideration of break and crack characteristics, dynamic analysis of pipe whip, and jet impingement loads. While pipe break loadings are included in the Canadian Standards list of load combinations, there are no details concerning their characterization. The U.S.

requirements for these procedures are given below.

Specific criteria necessary to meet the relevant requirements of GDC 4 are as follows:

C-3 I

O O

1. Postulated Pipe Rupture Locations inside Containment. Acceptable criteria to define postulated pipe rupture locations and configurations inside containment are specified in the USNRC's Branch Technical Position (BTP) MEB 3-1 included in SRP 3.6.2.

2. Methods of Analysis. Detailed acceptance criteria covering pipe whip dynamic analysis,induding determination of the forcing functions of jet thrust and jet impingement, are included in I

Subsection III, " Review Procedures," of the SRP.

SSC to be protected from intemally generated missiles to assure conformance with the requirements of GDC 4 includes all SSC within the containment and the containment itself. The designer must consider internally generated missiles associated with component overspeed failures, missiles that could originate from high energy fluid system failures, and missiles due to gravitational effects. Credible primary missiles to be considered include valve hardware, retaining bolts, relief valves parts, instrument wells and reactor vessel seal rings. Credible secondary missiles are those generated as a result of impact with primary missiles.

Acceptability of the design informatiun on protection of the containment and essential systems and components from internally generated missiles is based on GDC 4. A design approach that adopts a policy in which the containment and its appurtenances should be afforded protection by locating the appurtenances in individual missile-proof structures, physically separating redundat systems or components of the system, or providing special protective shields or barriers for the appurtenances or the containment itself is an acceptable method for meeting this criterion.

Temocrature Loadines The containment must be designed to withstand the maximum and minimum credible intemal and external temperatures and the maximum credible internal to external temperature differential. Internal accident temperatures are established using the procedures described in Section 4.1. The maximum temperature differential used in determining temperature loading should be the maximum accident temperature inside the containment and minus (-) 5'F outside the containment. The outside temperature may be increased if the containment is enclosed in an environmentally controlled building. The Canadian equivalent for these requirements was not included in the applicant's submittal.

Foundation leads and Load Combinations Foundations should be designed to the load combinatias in Subsection 11.3, Section 3.8.1 of the SRP. In addition to these load combinations, the combinations used to check against sliding and overturning due to carthquakes, winds, and tornadoes, and against floatation due to floods, should be in accordance with the following:

C-4 I

I ,

(1) D+H+E (2) D+H+W (3) D + H + E' (4) D+H+W, (5) D + F' where D, E, W, E', W, are as defined in Section 3.8.4 of the SRP, H is the lateral earth pressure, and F is ;

the buoyant force of the design basis flood. Justification should be provided for including live loads or portions thereof in these combinations. The foundation must also be designed to withstand D + H + P, where P is the design basis pressure used to design the rest of the containment. The foundation design must consider the possibility of uplift and large shear stresses which can occur during internal I pressurization. The Canadian Standards do not show different load combinations for the foundation as cited ab3ve Som the SRP.

I I

I I

I I

I I

I C5 I

_+-e _ ,sa. _ a , s J J,a _.41 _ ._ + . m Y

f I .

I l t

ADDITIONAL INFORMATION ON EXTERNAL HAZARDS REQUIREMENTS ,

I i I  ;

I I i a

f I i

>I i

i I  ;

l 4

I I

.I I

I APPENDIX D ADDITIONAL INFORMATION ON EXTERNAL HAZARDS REQUIREMENTS Procedures for Convertine Desien Wind Velocity to Containment Loadine The procedures utilized to transform the wind velocity into an effective pressure are delineated in ANSI A58.1, " Building Code Requirements for Minimum Design Loads in Buildings and Other Structures". In particular, the procedures utilized are acceptable if found in accordance with the following example For a design wind velocity of V, mph specified at a height of 30 feet above the ground, the velocity pressure, q ,is given by:

q = 0.00256 psf The effective pressure for structures, q,, and for portions thereof, q, at various heights above the ground should be in accordance with Table 5 and Table 6 of ANSI A58.1, respectively. Exposure C, as defined in ANSI A58.1, should be selected for both tables.

I Depending upon the structure geometry and physical configuration, pressure coefficients may be selected I in accordance with Section 6.4 of ANSI A58.1. ASCE Paper No. 3269, Wind Forces on Structures", may also be used.

Definition of Desien Basis Flood (Probable Maximum Flood-FMF)

I 1. The flord or highest ground water and the associated dynamic effects, if any, used in the design shall be the most severe ones that have been historically reported for the site and surrounding area, with sufficient margin for the limited accuracy, quantity, and period of time in which the historical data have been accumulated.

2. The criteria for the flood or highest ground water level, for establishing the dynamic effects of the flood where it is above the plant grade, and for the bases for determining these site-related and hydrodynamic parameters, are established in the SRP.

3. If the flood level is below the proposed plant grade, only its hydrostatic effects need be considered. Unless the hydrostatic head associated with the flood or with the highest ground water level is relieved by utilizing a drainage and pumping system around the foundations of  :

structures, it shall be considered as a structural load on the submerged wall portions and foundation slab of the containment. Another consideration is to prevent any uplift or floating of I the containment. The total buoyancy force may be based on the flood or highest ground water head excluding wave action, if applicable. However, the lateral, over-turning and upward hydrostatic pressures acting on the side walls and on the foundation slab, respectively, which I should be considered in the structural design of these elements, shall be based on the total head including wave action,if any.

D-1 I

l l

O O

4. Where the flood level is above the proposed plant grade, the dynamic loads of wave action shall be considered. Procedures for determining such dynamic loads are acceptable if they are in accordance with or similar to those delineated in the U.S. Army Coastal Engineering Research Center, Shore Protection Manual, as applicable.

The PMF as defined in Regulatory Guide 1.59 is one of the conditions to be evaluated in establishing the applicable stream and river flooding design basis referred to in GDC 2, Appendix A,10CFR50. PMF estimates are required for all adjacent streams or rivers and site drainage.

Appropriate sections of the following documents should be followed in establishing the PMF design basis.

Regulatory Guide 1.59 and ANSI N170 provides guidance for estimating the PMF design basis.

Regulatory Guide 1.102 describes acceptable flood protection to prevent the containment from being adversely affected. Publications of the National Oceanic and Atmospheric Administration (NOAA) and the Corps of Engineers may be used to estimate PMF discharge and water level condition at the site and coincident wind-generated wave activity.

I Specific criteria necessary to meet the relevant flood protection requirements of 10CFR.55a GDC 2, and 10CFR100 are as follows:

1. The flood design basis for each facility must be comparable with the positions in Regulatory g Guide 1.59. The types of flood protection (discussed in Regulatory Guide 1.102) proposed must g be capable of protecting those safety-related SSC, identified in Regulatory Guides 1.59 and 1.29,

2. Standard engineering practice in positive flood control and shore protection, such as that t developed by the U. S. Army Corps of Engineers, provides the basis for acceptance of methods to be employed for protection. Where sites are " hardened," that is, where emergency action is required, the time available to implement emergency procedures must be estimated by analysis g of the hydrologic design event. The environmental conditions likely to prevail during all potential 3 flooding events up to and including events of the severity of the controlling event are compared with the requirements for implementing flood emergency procedures. If the environmental g conditions likely are such that the procedures can be carried out, they will be considered acceptable. An appropriate item in the plant Technical Specifications will be required in cases I

where emergency procedures are required to assure adequate flood protection.

Consideration of site proximity missiles shall conform to the following regulations:

1. 10CFR10010 indicates that the site location, in conjunction with other consideraticas (such as plant design, construction, and operation), should insure a low risk of public exposure. This requirement is met if the probability of site proximity missiles impacting the plant and causing radiological consequences greater than 10CFR100 exposure guidelines is less than about 10' per year (see SRP 2.2.3). If this criterion is not met, then the criterion described in 2 below applies.

2. GDC 4 requires that SSC important to safety be appropriately protected against the effects of missiles that may result from events and conditions outside the nuclear power unit. The plant D-2 a

I is considered adequately protected against site proximity missiles if the followmg criterion is met:

The SSC important to safety are capable of withstanding the effects of the postulated missiles without loss of safe shutdown capability and without causing a release of radioactivity which I 3.

would exceed 10CFR100 dose criteria.

The total probability of the missiles striking a vulnerable critical area of the plant should be

[I estimated under SRP Section 2.2.3. If this probability per year of damage to the containment due to a specific design basis natural phenomena is greater than the acceptable probability stated in Regulatory Guide 1.117, then specific provisions or protection must be provided to reduce the estimate of damage probability to an allowable level.

Sires and Weichts of Extemal Missiles The containment is required to be to protected against damage from missiles which might be generated by the design basis tomado. The designer must postulate missiles that included at least three objects: (1)

a massive high kinetic energy missiles which deforms on impact, (2) a rigid missile to test penetration resistance, and (3) a small rigid missile of a size sufficient to just pass trough any openings in protective

]

barriers.

I Aircraft Hazards

( With respect to aircraft hazards, the containment must be designed to meet the relevant requirements of the following-1

1. 10CFR100.10 as it relates to indicating that the site location, in conjunction with other  !

considerations (such as plant design, construction, and operation), should insure a low risk of j public exposure. This requirement is met if the probability of aircraft accidents resulting #

in i radiological consequences greater than 10CFR100 exposure guidelines is less than about 10 per year. The probability is considered to be less than about 10' per year by inspection if the i distances from the plant meet all the requirements listed below:

(a) The plant-to-airport distance D is between 5 and 10 statute miles, and the projected annual number of operations is less than 500 D2, or the plant-to-airport distance D is greater than 10 statute miles, and the projected annual number of operations is less than 1000 D'.

The plant is at least 5 statute miles from the edge of military training routes, including I (b) low-level training routes, except for those associated with a usage greater than 1000 flights per year, or where activities (such as practice bombing) may create an unusual stress situation.

(c) The plant is at least 3 statute miles beyond the nearest edge of a federal airway, holding pattern, or approach pattern.

I g ee I

1 l

l E!

Ol Extemal Hazard Acceptance Criteria The applicable rules and basic acceptance criteria that are pertinent to the external hazards requirements are the following:

1. 10CFR50. Appendix A (a) GDC 1 " Quality Standards and Records". His criterion requires that SSC important to safety should be designed, fabricated, erected, and tested to quality standards commensurate with the importance of the safety functions to be performed. It also requires that appropriate records of the design, fabrication, crection., and testing of SSC important to safety should be maintained by or under the control of the nuclear power unit licensee throughout the life of the unit.

(b) GDC 2 " Design Bases for Protection Against Natural Phenomena". His criterion requires that safety-related portions of the system should be designed to withstand the effects of earthquakes, tornadoes, hurricanes, floods, tsunami, and seiches without loss of l

capability to perform their safety functions.

1

2. 10CFR100. " Reactor Site Criteria" his Part describes criteria which guide the evaluation of the E suitability of proposed sites for nuclear power and testing reactors. 3

3. 10CFR100. Appendix A. " Seismic and Geologic Siting Criteria for Nuclear Power Plants". These criteria describe the nature of the investigations required to obtain the geologic and seismic data necessary to determine site suitability and identifies geologic and seismic factors required to be taken into account in the siting and design of nuclear plants.

4. Regulatory Guide 1.61. " Damping Values for Seismic Analysis for Nuclear Power Plants" This guide gives the method for selecting acceptable damping values.

The following USNRC regulatory guides provide information, recommendations, and guidance and in general describe the basis for implementing the requirements of GDC 2, Part 100, and Appendix A to Part 100.

(a) Reculatory Guide 1.132. " Site Investications for Foundations of Nuclear Power Plants". This guide describes programs of site investigations related to geotechnical aspects that would normally meet the needs for evaluating the safety of the site from the standpoint of the perfonnance of foundations and earthquakes under anticipated loading conditions including earthquake. It g provides general guidance and recommendations for developing site-specific investigation g programs as well as specific guidance for conducting subsurface investigations, the spacing and depth of borings and sampling.

(b) Feculatory Guide 4.7. " General Site Suitability Criteria for Nuclear Power Stations". This guide discusses the major site characteristics related to public health and safety which the USNRC staff considers in determining the suitability of sites for nuclear power stations.

I

~ g

=

. e . _ _,-.. .a =. a-x - -- m a _ e I

I I

APPENDIX E CONTAINMENT DESIGN LAYOUT ISSUES AND LESSONS LEARNED FROM U.S. PRACTICE I

I 1

I ,

I I

)

I  :

. I I  :

_-.-_y- , - , . , - . . . _ , _ _ _ _ _ - -. - -

r I

APPENDIX E CONTAINMENT DESIGN LAYOUT ISSUES AND LESSONS LEARNED FROM U.S. PRACTICE The containment designer must exercise care in the containment layout to ensure constructability, inspectability, serviceability, and maintairiability of the containment and its contents. This includes consideration of all refueling operations and containment, fluid system and reactor vessel service, and inspection requirements. Other lessons leamed in recent years in containment arrangement are summarized below.

(a) The equipment hatch should be located at grade level because this greatly facilitates the I movement of equipment in and out of containment during outages with a minimum of handling operatiens.

(b) Equipment hatch should not be located at the operating deck level because this is an area of interse work during an outage. Further, the operating deck should not be used as a transit passage / staging area for equipment moving in and out of containment because of this intensity of work. Accordingly, equipment hatch should be located at a deck level other than the operating deck.

(c) Provision should be made for staging areas - both outside and inside containment at the I equipment hatch level to facilitate the entrance and removal of equipment. The ventilation system for the outside staging area should be such that the equipment hatch can stay open during fuel handling operations so as not to restrict movement of equipment in and out of containment.

(d) Tim center of the nuclear island should be offset substantially from the center of the containment budding in order to provide a more effective laydown area at each deck level. Specifically at the operating deck this results in better laydown space for maintenance operations during an outage and at grade level it provides better laydown area for equipment staging activities.

(e) Personnel air locks should be provided at both the operating and grade level decks to: help facilitate lateral access to the various containment work areas; and meet OSHA requirements for I dual exits.

(f) Use of polar crane shall be minimized by eliminating maintenance functions from operating deck and providing small cranes at various work stations.

(g) 10CFR50.34(f)(3)(iv) requires provision of one or more dedicated penetrations, equivalent to a I single 36-inch diameter opening,in order not to preclude future installation of systems to prevent containment failure such as filtered vented system.

(h) Items (a), (b) and (e) facilitate lateral movement of people and equipment into the various containment work areas as well as: minimize adding any additional maintenance functions at the operating deck; and minimize making the operating deck the main transit pathway in and out of containment for equipment and personnel.

I 8" I

O O

Insnection and Testine The reactor containment should be designed to permit the following: (1) appropriate periodic inspection of all important areas, such as penetrations; (2) an appropriate surveillance program; and (3) periodic testing at containment design pressure of the leak tightness of penetrations which have resilient seals and expansion bellows.

This criterion is identical to GDC 53 in 10CFR50 Appendix A. The intent of this criterion is to require that the reactor containment be designed to allow periodic inspection, surveillance, and leak tightness testing of penetrations and other important areas to ensure that any evidence of structural degradation or loss of leak tight integrity will be detected in time to permit corrective action before the safety function of the containment is compromised, with the possible reduction of the ability of the containment pressure boundary to isolate contained radioactive material from the environment.

The reactor containment and other equipment which may be subjected to containment test conditions should be designed to accommodate a pre-service structural integrity and periodic inservice integrated leakage rate testing can be conducted at containment design pressure. This criterion is identical to GDC 52 in 10CFR50 Appendix A. The intent of this criterion is to require that the reactor containment be designed to allow preoperational and periodic testing of leakage rate at containment design pressure.

Such testing should ensure that any evidence of structural degradation or loss of leak tight integrity will be detected in time to permit corrective action before the safety function of the containment is compromised, with the possible reduction of the ability of the containment pressure boundary to isolate contained radioactive material from the environment.

I I

I I

I E-2 a.

i I  :

I  :

^"""'"

I DISCUSSION OF ADDITIONAL DESIGN CONSIDERATIONS I

I .

I l I  ;

I t

>I I  !

I  ;

I I i s

I  :

I I ,

1

I APPENDIX F DISCUSSION OF ADDITIONAL DESIGN CONSIDERATIONS Liner /Anchorace Considerations The design and analysis of the liner and its anchorage system should be in accordance with the provisions of CC-3600. In general, the liner analysis should consider deviations in geometry due to fabrication and erection tolerances, and variations of the assumed physical properties of the liner and anchor material.

Since the liner is usually anchored at relatively closely spaced intervals, and since the concrete shell is much stiffer than the liner, it may be assumed that the global strains in the liner will essentially follow those in the concrete. The strains in the concrete under the various load combinations as obtainable from the analysis of the containment are thus imposed on the liner, and the resulting strains and stresses in the liner and its anchors should be lower than the allowable limits defined in Tables CC-3720-1 and CC-3730-

1. Since these general requirements as given in the SRP do not reflect the significant level of recent research in the area of liner / anchorage behavior, the following more detailed requirements should also be met.

Liner Strencth and Ductility The same ductility considerations as for the primary shell of a steel containment are applicable to the liner of the concrete containment. Recent experimental programs and analyses have shown that strain I concentrations at liner anchorage and near penetrations can cause liner tearing well below the ultimate burst pressure of the containment. Therefore, ductility behavior should be considered in the liner material and anchorage selection.

Liner / Anchor Weldine Reauirement Welding and brazing materials used in manufacture of items should comply with an SFA specification (see ASME Code, Sections 11 and IX), except as otherwise permitted in Section IX of the ASME Code and should ab.o comply with the applicable requirements of CC-2000. Care in anchor to liner welding procedures should be taken to ensure that the ultimate strength and ductility of the liner are not reduced I by the ancr orage welding process. In addition to the tests and inspections required by CC-2000 and CC-4000, tests should be performed on full-scale liner / anchorage specimens to verify and document the strength and ductility of the liner at anchor points.

I r.1 I

E

=

Liner Hardness and Touchness Carbon steel and low-alloy steel for liners should be tested either by drop weight tests or the Charpy V-notch impact test. Such tests are not required for:

(a) Materials with a nominal section thickness of 5/8 in. (16 mm) or less.

I (b) Studs attached to the liner with a nominal size of 1 in. (25 mm) diameter or less.

(c) Bars with a nominal cross-sectional area which does not exceed 1 in' (645 mm').

(d) Austenitic stainless steels.

(e) Materials listed in Table CC-2521.1-1 that also satisfy the other requirements of CC-2521.1-h.

Drop weight tests and Charpy v-notch tests should be performed in accordance with Article CC-2520.

! Epecial Consideration for Liner / Anchorace Performance Liner / anchorage / concrete interaction is significant in determining how liners tear in concrete containments. The designer should exercise care in the design and to the extent possible utilize the available tests and research from recent years to ensure that the liner / anchorage system meets the ultimate l strength and ductility requirements set forth in the code.

Reinforcement Considerations Reinforcement should conform to Articles 2300 and 3000 for design, fabrication, and installation. Certain requirements are emphasized below.

Strencth and Ductility (a) The materials to be used for reinforcing systems for containments should conform to ASTM A615 g Grades 40 and 60 and the special requirements described in CC-2330. E l

(b) The material to be used for bar to bar splice sleeves in reinforcing bars should conform to ASTM A513 or A519.

(c) The material to be used for reinforcing bar splice sleeves attached to liners or structural steel j shapes should be carbon steel conforming to ASTM A513 or A519 Grades 1008 through 1030.

Sp! ices of reinforcement should be made only as required or permitted on the Design Drawings or in the E, Construction Specification splices and development lengis for reinforcement should be designed in 5-I accordance with CC-3532 with the following emphasized and additional requirements.

I r.2 g I

I Lap splices should not be used for bars larger than No.11. Lap splices of bundled bars should be based on the lap splice length required for individual bars of the same size as the bars spliced. The length of bp, as prescribed in CC-3532.1 and 3532.2, should be increased 20% for a three-bar bundle and 33% for a four-bar bundle. Bars spliced by noncontact lap splices in flexural members should not be spaced transversely farther apart than one-fifth the required length of lap nor more than 6 in. (152 mm).

Where a nonprestressed reinforcement bar splice must be located in a region where tension is predicted I in a direction perpendicular to the bar to be spliced, only a full positive mechanical splice or a full welded splice should be used unless calculations or tests of the selected splice detail are made to demonstrate that there is an adequate transfer of force. These provisions do not apply to nominal temperature reinforcement.

I Reinforcing steel which must terminate in a location where biaxial tension is predicted, such as at penetrations, should be anchored by hooks, bends, or by positive mechanical anchorage in such a manner that the force in the terminated bar is adequately transferred to other reinforcement. Bar development lengths at such locations should be increased by at least 25% over those permitted for uniaxialloading.

I These special precautions are not required for nominal temperature reinforcement.

The calculated tension in the reinforcement at each section should be developed on each side of that section by embedment length or end anchorage or a combination thereof. For bars in tension, hooks may be used in developing the bars.

Tension reinforcement may be anchored by bending it across the section and either making it continuous with the reinforcement on the opposite face of the section, or anchoring it there.

Bendinc of Reinforcement Bend tests on bar sizes No. 3 through No.11 should be performed in accordance with ASTM A615.

If bars of sizes No.14 and No.18 are to be bent, then full-size specimens should be bend tested 90* at ambient temperatures, but in no case less than 60*F (16*C), around a nine-bar diameter pin. However, if No.14 and No.18 bars as used in the containment are required to have bends exceeding 90*, specimens should be bend tested 180*; the other criteria should be the same as for 90*-bend tests. One bend should be made for each bar size from each heat. The acceptance standards for bar sizes No. 3 through No.11 should be in conformance with the requirements of Section 8.1 of ASTM A615.

I F-3 I

_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ . _ _ _ _ _ . . _ _ _ _ _ _ _ . _ _ . _ _ . _ _ _ _ _ _ . _ _ . _ _ . _ _ _ _ _ __. _..._9

O O

For bar sizes No.14 and No.18, the acceptance standards should be an absence of cracks on the outside of the bend portion. If a test specimen shows cracking on the outside of the bend, two additional specimens from the same heat and of the same bar size should be tested. If either of the two additional specimens shows cracking, either that heat of reinforcing bars should be rejected, or the bending of reinforcing bars from this heat should not be allowed during fabrication and construction.

An additional criterion based on recent research should also be added: for No.14 and No.18 bars bent 45* or more, a tensile test should be performed to ensure that the bent bar portion is capable of developing a minimum of 95% of the average ultimate strength of straight bars from the same heat. The bend angle and bend diameter specified in the code or the design drawings should be imposed on the bar and then straightened. The tensile test should then be performed on the straightened bar segment.

Inservice Inspectability The design of the containment should accommodate the requirements for inspectability and the inservice g

=

inspection rules of the ASME Code,Section XI, Subsection IWE.

Overnressure Protection it is recognized that the fundamental purpose of a containment vessel may be nullified by the incorporation of pressure relief valves discharging directly into the environment. However, vacuum relief devices or systems, including venting with controlled discharge or condensation systems, may be essential to protect against differential pressures in excess of design external pressure. In order to accommodate the possibility of a future retroactive requirement for overpressure protection and to meet the requirements of 10CFR50.34(f)3(iv), the designer should provide a capped penetration which can facilitate a 36 in. diameter overpressure protection valve (vent). Overpressure protection should also meet the requirements of Article NE-7000 of the ASME Code including NE-7200," Overpressure Protection Report".

Area Renlagement Rules for Penetrations Penetrations in the containment shell should satisfy the requirements for reinforcement of openings given in NE-3330, including any requirements for cyclic service stipulated in NE-3331(b). Buckling considerations associated with reinforcement around openings should also follow rules set forth in Code Case N-284.

I I

I E

- -,,e---

um wu. -n es - n a- 1 -,-s----

I I. .

I I ^"'"" "

CONTAINMENT ANALYSIS ISSUES I

I ,

I I

I I .

I  :

I '

I I

I I

-I  :

F I -

I

I APPENDIX G I CONTAINMENT ANALYSIS ISSUES General If only the containment shell and its foundation mat are taken into consideration in the analysis, then the bottom of the foundation slab is the boundary of the analytical model. The foundation media should be represented by appropriate soil springs.

I Contrary to the provisions in the SRP, separate analyses of the containment wall and the basemat should not be used. Modeling of the basemat coupled with the wallis critical to achieving satisfactory prediction of the shear and bending behavior at their juncture.

Assumptions on Boundary Conditions The boundary conditions depend on the methods of analysis to be used and the portions of the containment shcIl to be separately analyzed. If the analysis is to be accomplished through the use of the finite element technique, and is to include the foundation media, the boundary would be tne demarcation I lines separating the foundation mass taken into consideration in the analysis from the surrounding media.

The boundaries of the foundation mass considered have to be so selected that any further extension of the boundaries will not affect the results by more than 15%.

Transient and Localized Loads During normal operation, a linear temperature gradient across the containment wall thickness may develop. After the design basis accident. however, the sudden increase in temperature in the steelliner and the adjacent concrete may produce a nonlinear transient temperature gradient across the containment wall thickness. Effects of such transient loads should be considered. Nonaxisymmetric and transient pressure loads resulting from compartmentalization inside the containment after an accident condition I should also be considered.

For the effects of such localized and transient loads, the overall behavior of the containment structure should first be determined. A portion of the containment, within which the localized or transient load is located, should then be analyzed using the results obtained from the analysis of the overall vessel behavior as boundary conditions.

I I ->

I

E C1 I

Comouter Programs The computer programs used in the design and analysis should be described and validated by any of the following procedures or criteria:

1. The computer program is a recognized program in the public domain and has had sufficient history of use to justify its applicability and validity without further demonstration.

2. The computer program solution to a series of test problems has been demonstrated to be E substantially identical to those obtained by a similar and independently written and recognized 5 program in the public domain. The test problems should be demonstrated to be similar to or within the range of applicability of the problems analyzed by the public domain computer program.

3. The computer program solution to a series of test problems has been demonstrated to be substantially identical to thme obtained from classical solutions or from accepted experimental tests, or to analytical results published in technical literature. The test problems should be demonstrated to be similar to or within the range of applicability of the classical problems analyzed to justify acceptance of the program.

Seismic Analysis Reauirements The seismic analysis of the containment systems and components should utilize either a suitable dynamic analysis method or an equivalent static load method, if justified.

Critical Dampine Values Vibrating structures have energy losses which depend on numerous factors, such as material characteristics, stress levels, and geometric configuration. This dissipation of energy, or damping effect, occurs because a part of the excitation input is transfonned into heat, sound waves, and other energy forms. The response of a system to dynamic loads is a function of the amount and type of damping existing in the system. Assignment of appropriate values to represent this characteristic is essential for obtaining realistic results in seismic analysis.

The specific percentage of critical damping values used in the analyses of the containment, systems, and components are considered to be acceptable if they are in accordance with Regulatory Guide 1.61,

" Damping Values for Seismic Design of Nuclear Power Plants." Higher damping values may be used in a dynamic seismic analysis if documented test data are provided to support them. The damping value for soil must be based upon actual measured values or other pertinent laboratory data considering variation in soil properties and strains within the soil.

m g s

e

I Dynamic Analysis Method A dynamic analysis (e.g., response spectrum method, time history method, etc.) should be used when l 1

the use of the equivalent static load method cannot be justified. To be acceptable such analyses should consider the following items:

I (1) Use of either the time history method or the response spectrum method.

(2) Use of appropriate methods of analysis to account for effects of soil-structure interaction.

(3) Consideration of the torsional, rocking, and translational responses of the structures and their i foundations.

J (4) Use of an adequate number of masses or degrees of freedom in dynamic modeling to determine  !

I the response of the containment and its appurtenances. The number is considered adequate when degrees of freedom do not result in more than a 10% increase in response.

j j

Investigation of a sufficient number of modes to assure participation of all significant modes. 'Ihe I

(5) criterion for sufficiency is that the inclusion of additional modes does not result in more than a l i

10% increase in responses.

I (6) Inclusion of significant ef fects such as piping interactions, extemally applied structural restraints, hydrodynamic (both mass and stiffness ef'ects) loads, and nonlinear responses.

Equivalent Static Load Method An equivalent static load method is acceptable if:

I (1) Justification is provided that the system can be realistically represented by a simple model anu the method produces conservative results in terms of responses. Typical examples or published results for similar structures may be submitted in support of the use of the simplified method.

(2) The design and associated simplified analysis account for the relative motion between all points of support of the containment and appurtenances attached to it.

(3) To obtain an equivalent static load of a structure, equipment, or component which can be represented by a simple model, a factor of 1.5 is applied to the peak acceleration of the applicable I floor response spectrum. A factor of less than 1.5 may be used if adequate justification is provided.

The use of an equivalent static load factor as vertical response load for the seismic design of the containment is acceptable. It is accep:able for attachments to the containment only if it can be justified that the sub-structures are rigid in the vertical direction. The criterion for rigidity is that the lowest frequency in the vertical direct!.on is more than 33 Hz. An acceptable method of treating the torsional effect in the seismic analysis of Category I structures is to carry out a dynamic analysis which incorporates I the torsional degrees of freedom. An acceptable attemative, if properly justified, is the use of static factors G-3 I

E C3 l to account for torsional accelerations. To account for accidental torsion, an additional seismicity of15%

of the maximum building dimension at the level under consideration shall be assumed. The responses obtained from both modal analysis response spectrum and time history methods at selected points in typical Category I structures should be compared to demonstrate approximate equivalency between the two methods.

Seismic Directional Load Combinations Depending upon what basic methods are used in the seismic analysis, i.e., response spectra or time history method, the following two approaches are considered acceptable for the combination of three-dimensional earthquake effects.

(a) Response Spectra Method. When the response spectra method is adopted, the maximum structural responses due to each of the three components of earthquake motion should be combined by taking the square root of the sum of the squares of the maximum co-directional E responses caused by each of the three components of earthquake motion at a particular point of 5 the structure or of the mathematical model.

(b) Time History Analysis Method. When the time history analysis method is employed for seismic analysis, two types of analysis should be performed: (1) to obtain maximum response due to each of the three components of the earthquake motion - in this case the method for combining the three-dimensional effects is identical to that described above except that the maximum responses are calculated using the time history method instead of the spectrum method; and (2) to obtain time history responses from each of the three components of the carthquake motion and combine them at each time step algebraically - the maximum response in this case can be obtained from E the combined time solution. When this method is used, to be acceptable, the earthquake motions 3 specified in the three different directions should be statistically independent.

Soil-Structure Interaction

'Ihe design earthquake motion is defined at the foundation level of the structure in the " free field," i.e.,

the effect of the presence of structures is not included. When facilities are founded on soil deposits or soft media, the resulting motions of the base slab will differ frem those defined at the same elevation in the free field, due to deformability of the foundation and soil. This difference between the base slab motion and the free field motion is known as soil-structure interaction effect.

The factors to be considered in accepting the validity of a particular modeling method are: (1) the extent ,

of embedment, (2) the depth of soil over rock, and (3) the layering of the soil strata.

To perform a dynamic analysis for a soil structure interaction system it is necessary to have a well defined I

excitation system or forcing function applied at the soil boundaries to simulate the earthquake motion.

I

.E

I It is therefore required to generate an excitation system acting at the soil boundaries such that the response motion of the soil media at the plant site and at the foundation level of the free field is identical to the design ground motion.

An analytical model of the soil-structure interaction system is acceptable if both the structure model and the supporting solid model are properly coupled and the design motion is properly addressed. A suitable I dynamic analysis using the time history method is performed f ar the entire soil-structure system and the dynamic responses at various locations of the system are calculated.

At present the most conunonly used methods are the half-space and the finite boundaries modeling methods and there is no indication as to which one is more reliable, especially when many assumptions are involved. Therefore, modeling methods for implementing the soil-structure interaction analysis should include both the half-space and finite boundaries approaches. Category 1 SSC should be designed to accommodate responses obtained by one of the following:

(a) Envelope of results of the two methods.

(b) Results of one method with conservative design considerations of effects from use of the other method.

(c) Combination of (a) and (b) with provision of adequate conservatism in design.

Appendix A to 10CFR100 states that the vibratory ground motion produced by the safe shutdown earthquake shall be defined by response spectra corresponding to the maximum vibratory acceleration at the elevations of the foundations of the nuclear power plant structure. A regenerated excitation system is acceptable if, when applied to the solid model, it produces at the structural foundation level in the free I

field a response motion whose response spectra envelop the design response spectra of earthquake motion.

Choice of Analysis Methods for Containment Failure Analysis There are hundreds of finite element computer programs available for the solution of scores of highly specialized problems. The vast majority of these programs are specialized for the solution of a very small class of problems. A small minority of programs have robust capabilities such as the solution of two-dimensional problems or shell problems. There are only a dozen or so general purpose finite element (FE) programs that are in substantial use by a significant intemational community of users. Large organizations engaged in the design of engineering structures or in the prediction of structural failure under appropriate Quality Assurance (QA) control typically should choose to use one of these general I purpose programs for their QA controlled structural analysis.

G-5 I

E e

A number of ambitious efforts have been made at reviewing, evaluating and describing various finite element computer programs. The conclusions of these efforts generally seem to be as follows. Most of the major general purpose codes in use today solve equations and perform element computations at roughly the same speed and offer many similar features, but ultimately, this is of secondary importance in selecting a program. In fact, speed comparisons can give misleading results depending on the type of problem selected for the benchmark. The most important parameters to consider are to select the analysis tool that is suited for the desired application and that gives results that are experimentally verified, and minimizes the engineer's time in obtaining the solution and presenting useful results. 5 Developing a model, calculating the response, and correctly interpreting the result, must all be well integrated. For instance, the failure criteria must be consistent with the geometric details in the model(s) and the physical phenomena (i.e., plasticity and large deformations) accounted for in the calculations.

In any structural analysis, the tools and the methods chosen are an important feature of the work.

Predictions for the performance of a containment subject to severe accident loads affect risk estimates.

This, in turn, could help with emergency preparedness planning for a severe accident. In the event of a g; severe accident, the consequences of an early failure appear to be considerably greater than those of a late 5 failure. The consequences of rupture are worse than those of leakage.

For an analysis to be useful in estimating risk, the following capabilities are needed: Determine the I

margin of safety between the design pressure and the pressure at which a loss of containment integrity occurs. Distinguish between a failure due to leakage and one due to rupture as defined by NUREG-1150.

I I

I I,

I:,

I G-6

=

. . . . _ m I

lI

!I I ^""""""

COMPARISON OF CANADIAN AND U.S. REQUIREMENTS FOR MATERIAL, QUALITY CONTROL, AND CONSTRUCTION TECHNIQUES I  :

l l

I ,

l I l I '

I I i I  ;

I I I l I .

I '

I ,

1

r I

APPENDIX H I COMPARISON OF CANADIAN AND U.S. REQUIREMENTS FOR MATERIAL, QUALITV CONTROL, AND CONSTRUCTION TECHNIQUES I Concrete Strgngth I Paragraph CC-2231.4(a) of the ASME Code specifies that the required concrete compressive strength, and other required concrete properties, be defined in the Construction Specifications. The concrete compressive strength is determined by testing in accordance with ASTM C39. Paragraph CC-2231.4(b) adds that the Construction Specifications should specify the age, strength, and temperature at which the compressive strength measurements should be obtained. Paragraphs CC-2233 provide requirements for evaluation of compressive strength testing results and their comparison to specified values.

Durability Paragraph CC-2231.7.1 provides durability requirements for concrete subje:ted to freezing temperatures after curing. In this case, depending upon coarse aggregate nominal size, the total air content is I prescribed plus or minus a 1.5% variation. For example, a 1-inch coarse aggregate size would require 45% of air content, with variation permitted between 3% and 6% for the concrete. This same paragraph also limits the water-cement ratio to 0.50 for these freezing conditions and reduces the required air content by 1% for concrete with compressive strengths exceeding 5000 psi. Air content requirements for the concrete mix are covered under Canadian Standard CAN3-N287.4-M83, but no specifM limits are provided in this standard. Paragraph 4.1 refers to another Canadian Standard (CAN3-A23.1, Cucrete Materials and Methods of Concrete Construction), which may provide such limits. However,it appears that Paragraph 4.2.1.1(c) governs and references test methods for determining air content in accordance with specifications provided by the owner.

I U.S. codes also require that concrete, after curing, that will be subject to freezing temperatures while wet should contain entrained air within the limits of Table CC-2231-2 and the water / cement ratio should not exceed 0.50 by weight. For specified compression strength of 5000 psi or greater. Concrete that is intended to be water tight should have a maximum water-cement ratio of 0.50 for exposure to fresh water and 0.45 for exposure to brackish or sea water. Concrete that will be exposed to injurious concentrations of sulfate-containing solutions should conform to maximum water / cement ratio of 0.44 and be made with sulfate-resisting cement as given CC-2231.6.3-1. In addition, concrete mix designs and placement methods

(

should be performed so as to achieve durability commensurate with site environmental conditions and I the plant design life.

H-1 I ,

5 O

Reinforcine Steel I

CC-2300 provides material requirements for reinforcing steel. Only two reinforcing steel material specifications are permitted: ASTM A615, Standard Specification for Deformed and Plain Billet-Steel Bars for Concrete Reinforcement; and ASTM A706, Standard Specification for Low-Alloy Steel Deformed Bars for Concrete Reinforcement. These two specifications correspond in large measure to the two reinforcing steel specifications permitted in the Canadian Standard CAN3-N287.2 M82: G30.12-M (ASTM A615) and G30.16-M (ASTM A706). Both standards also require one tensile test of each bend size for each 50 tons 3 (or 50 tonnes for the Canadian Standard), and they both impose additional chemical requirements on billet-steel bars that supplement ASTM A615 and G30.12-M. Although slightly different, they are effectively equivalent. The Canadian specification requires a bend test not required by ASME.

Chloride Content I

Paragraph CC-2231.2 prescribes a limit on water soluble chloride content of the concrete of 0.15% by weight of Portland Cement used for reinforced concrete containments. This totalis made up of individual contributions from the water or ice in the mix, any free water in the aggregates, and chloride in any liquid g admixtures, all of which are tested separately and added together to meet the limit. This implies that, for 5l every ton of Portland Cement used and a water-cement ratio of 0.5, only three pounds of chloride would be permitted for all contributions. The Canadian Standard for Material Requirements for Concrete Containment Structures for CANDU Nuclear Power Plants (CAN3-N287.2-M82) is based on one direct limit for chloride content of the mix water and aggregate free water and another direct limit on chloride content in any admixtures. The water limit is 250 mg of chloride per liter of water. The admixture cannot contribute more than 50 mg of chloride per kg of cement. In this case, only 0.25 lb. of chloride would be permitted in the water and 0.1 lb. of chloride in the admixture. The total permitted by the Canadian Standard is only 0.35 lb. of chloride, much less than that permitted by the ASME Code.

The Canadian Standard for Construction, Fabrication and Installation Requirements for Concrete Containment Structures for CANDU Nuclear Power Plants (CAN3-N287.4-MS3) provides a supplementary limit on the soluble chloride content in the concrete of the containment itself. This limit depends upon the environment and the reinforcement. For the case of reinforced concrete in a moist environment, the limit is essentially identical to that of the ASME Code for a 1:2:3 concrete mix. The limit is actually 500 mg per kg of concrete. The ASME limit is based on a percentage of Portland Cement content. For a dry

~

environment, the Canadian limit is 1000 mg per kg of concrete.

I I

E E

Contact with Aluminum CC-4224.2 provides requirements for equipment to convey concrete from muang sites to deposition sites.

In addition to restrictions on conveyance "without separation of constituents", "without interruptions that cause loss of plasticity between successive increments", " unconsolidated materialis not covered by newly deposited concrete", and "new material is not placed on coverete which has hardened unless the surface of the hardened material has been properly prepared as a construction joint". This paragraph also stipulates that " concrete, during conveyance, should not come in contact with aluminum". Weakness in concrete caused by contact with aluminum is an issue to be considered seriously.

• The Canadian Standards contain similar but not identical requirements to the ASME CC-4224.2 standards.

For example, Section 4.1 of CAN3-N287.4-M83 (Construction, Fabrication, and Installation Requirements for Concrete Containment Structures for CANDU Nuclear Power Plants) specifies conveyance conformity I~ with CAN/CSA-A23.1 (Concrete Materials and Methods of Concrete Construction), which specifies in L i 19.2.1 that conveyance ensures a proper supply without segregation at disposition and in 19.2.8 that t pipelines made from aluminum alloys not be used. However, no reference is made for concrete contact, other than through pipelines, with aluminum or that unconsolidated material should not be covered by newly deposited concrete. Other similar requirements to ASME CC-4224.2 include: CAN3-N287.4-M83, L, 4.4.2.1b, which limits the conveyance time for purposes of providing proper consolidation without the addition of any extra water; 2.5.2 wl-ich limits the temperature differentials between newly placed concrete and hardened concrete; and CAN/CSA-A23.1-M80, which requires surface cleaning specifications when applying new concrete to hardened concrete.

Curine of Concrete CC-4240(a) and CC-4240(b) provides non-specific requirements about: (1) curing and protection of concrete against thermal and physical damage from the time of placement until the end of the minimum curing period given in the construction specification; and (2) special requirements on the type and duration of L, the curing process, and details of any special conditions to be maintained during the curing period, which are to be provided in the construction specification. The requirements for curing during cold temperatures, as given in paragraph CC-4240(c), are more specific. For example, during cold weather (defined to be a period of more than three successive days with an average daily outdoor temperature below 40*F), the surface of the concrete placement must be maintained above 40*F for a minimum period

{ of the first three days.

[ The respective Canadian Standards are more stringent and specific. In CSA CAN3-N287.4-MS3, Section 4.7.1.2, special requirements on the type and duration of the curing process as given in the specifications H.3

E a

must be followed. In addition, chimney effects during cold weather are to be prevented, and attaining placement temperatures in hot weather with mechanisms such as using ice in the mix propcrtion is required. Section 4.7.1.1 stipulates that the concrete should be maintained in a moist condition at a temperature above 10*C (50*F) for at least seven days after placing.

I Concrete Repairs CC-4270 provides non-specific requirements for repairs of defective concrete. "Ihe paragraph stipulates that " Honeycombed or defective concrete should be removed and replaced as directed by the Designer".

In carrying out these repairs, the adjoining surfaces must be prepared in a manner similar to a construction joint (e.g., removal of unsound material, roughening of the surface to uniformly expose the aggregate, and saturation of the surface before placing additional concrete).

CAN/CSA-A23.1-M90 provides patching requirements in Section 24.2. Cut-out areas and cavities are required to be saturated with water and repaired after scrubbing the surfaces to be patched with neat cement paste. Honeycomb areas are subject to repair as directed by the owner. No specific corrective methods are recommended.

Liner Welds Following the welding of concrete containment liners, ASME Code Category A welds (longitudinal weld seams within the liner or any penetration nozzles) and category B welds (circumferential weld seams within the liner or any penetration nozzles) must be radiographed in accordance with CC-5531, unless backing bars are used for performing the welds. If backing bars are used, the Category A and B welds must be examined by either magnetic particle (surface) or ultrasonic (volumetric) for the full length of the weld. When backing bars are not used, the first ten feet of each weld and one spot (at least 10 inches g long) in each additional 50 feet of weld must be radiographed for each welder and welding position. 5 These Category A and U weld joints must be butt joints, either single-sided or double-sided butt welds, in accordance with CC-4542.1. when reinforced concrete design without prestressing is used, backing bars may be used for the first four liners courses up to a maximum height of 35 feet. The backing bars must be continuous, and the weld joints should be full penetration.

Unacceptable weld defects for radiography are defined in CC-5542, including: (a) any type of crack, zone of incomplete fusion, or incomplete fusion, regardless of the amplitude of the signal; or (b) indications with signal amplitudes exceeding the reference level, with excessive lengths (e.g., a 1/4-inch length for g a wall thickness up to 3/4-inches, or a 1/3-inch length for wall thicknesses between 3/4 and 2-1/4 inches. 5 H-4 5

Similar acceptance criteria apply for ultrasonic examination. Any unacceptable defects must be removed or reduced to an acceptable size (see CC-5541), with the weld repaired and re-examined (see CC-4540).

I Sulfate Resistance CC-2231.7.3 provides requirements for water sulfate content, Portland Cement type, and water / cement I ratio for containment concrete subjected to various conditions of sulfate exposure, such as below-grade concrete exposed to sulfate-bearing ground water. For example, under severe sulfate exposure (between 0.2% and 2% water soluble sulfate, by weight of soil), the sulfate (50.) in the water in the concrete mix must lie in the range of 1500 to 10,000 ppm; Type V Portland Cement must be used; and the water-cement ratio is limited to 0.45. Table CC-2231.7.3-1 gives the complete range of requirements. CAN3-N287.2-M82 provides no specific requirements for sulfate resistance, except for Paragraph 4.2.1, which references CAN3-A5, Portland Cement, and in particular Type 50 (sulfate resistant) Portland Cement. No guidance is offered on the conditions required for the sulfate-resistance cement type.

Creen Shrinkace, and Crackinc of Concrete U.S. codes require that creep and shrinkage values for the concrete should be established by tests performed on the concrete which is to be used in the containment structure, or from data obtained on completed containments constructed of the same kind of concrete. In establishing these values, consideration should be given to the differences in the environment between the test samples and the actual concrete in the structure. Cracking of the concrete may be considered in either of the following two I ways. For the first consideration, the moments, forces, and shears under load may be obtained on the basis of an uncracked section for all loading combinations. In sizing the reinforcing steel required, however, the concrete should not be relied upon for resisting tension. Thermal moments may be modified I to take creep and cracking into consideration. For the second consideration, for axisymmetric loadings, cracxing of the concrete should be considered through the use of computer programs which are capable of treating such cracking by an iterative process.

Ypriation in Physical Properties U.S. codes require that in considering the effects of variations in the material properties on the analytical I results, the upper and lower bounds of these properties should be used in the analysis, wherever critical.

The physical properties that may be critical include the soil modulus and the modulus of elasticity, compressive strength, tensile cracking strength, and Poisson's ratio of the concrete.

I I "'

I

E .

E r

L.

APPENDIX I p DETAILED REVIEW OF TTR-305, L 'THE TECHNOLOGY OF CANDU ON-POWER FUELING" u,

[

[

[

E .

1

_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ - _ _ - - - - - - - - - - - - - - - - - - - - - - - - " - - - - - - - - - - - - - - - - - - - ' - ' - ' - - - ' - ' ' - - - - ' - ~ ~

I APPENDIX I Detailed Review of TTR-305,

'The Technology of CANDU On-Power Fueling" by Karl Goller I

1.0 Fuel Handling System he fuel handling system reviewed is that described in AECL Report TFR-305, titled "The Technology of

( CANDU Cn-Power Fueling", Rev. O, daied January 1991. This is the latest, most detailed information that was available on this subject, particular on fuel handling system accident analyses and the relationship of this system to the reactor containment building.

This report states that the fuel handling system for CANDU 3 is still under development, but will be derived largely from the CANDU 6 design described in this report. The report acknowledges, however, that there will be significant differences. This includes single-ended fueling, charging and discharging the fuel handling machine with new and irradiated fuel from outside containment, electric motor drives instead of oil hydraulic motor drives, and other modifications in hardware design and materials indicated by operating experience, research and development programs and to suit single-ended fueling. Several CANDU fuel handling systems other than the CANDU 6 design are also discussed in this report. It is therefore not always clear what is and what is not applicable to the CANDU 3 design.

The characteristic of the CANDU fuel handling system that most distinguishes it from US reactor designs I is that it is based on refueling and fuel shuffling while the reactor is at power. This is accomplished with a fuel handing machine (F/M), that can be attached to the end of individual CANDU reactor fuel channels to remove and add fuel bundles while the reactor is at power.

The CANDU 3 fuel handling system includes facilities for storing, processing and charging new fuel into the F/M. These facilities will be quite different in the CANDU 3 design than in previous CANDU designs, including CANDU 6. In the CANDU 3 design, new fuel will be charged directly into the F/M from outside the containment. This will be done by means of a loading mechanism operating through a special port that penetrates the reactor containment building wall. The F/M is connected onto the inner I

I 1-1 I

E o

end of this port and becomes part of the containment system boundary when the containment isolation valves in this port are opened to pass new fuel into the F/M.

The F/M is located on the coolant downstream side of the reactor and is mounted on a support system I

with mechanisms that provide mobility for the F/M. The F/M itself consists basically of a magazine, a snout, a ram assembly and separator assemblies. The magazine provides a number of rotor stations or cavities to house and cool fuel bundles and hardware components such as fuel channel closures, shield g plugs and other items required to perform on-power refueling operations. The snout allows the F/M to 5 clamp onto and seal to a reactor fuel channel end fitting. The ram assembly provides the motions and mechanical actions the F/M performs on fuel channel hardware components and fuel bundles. The separator assemblies monitor the location of the fuel bundle string and separate and hold the fuelbundles during magazine storage. The F/M is filled and cooled with heavy water maintained at temperatures lower than those in the reactor fuel channels.

Heavy water, electric power and control signals are supplied to the mobile F/M through a flexible catenary of hoses and cab!cs which connects the F/M to the station auxiliary systems. Some manual g emergency drives are provided on the F/M so that corrective action can be taken when a power drive 5 fails. These are activated manually by means of special tooling that can reach through penetrations in the reactor vault shielding. Frovisions are made for direct access ma atenance and breakdown repair of the F/M.

To facilitate single-ended refueling, CANDU 3 will have a " hydraulic fuel pusher system" on the upstream I

side of the reactor. This system will consist of a free piston within each upstream fuel channel end fitting.

These pistons will provide the additional coolant flow hydraulic drag force to move the fuel bundle string along the channel and into the F/M when the F/M removes the shield plug in the downstream end g fitting. 5 The CANDU 3 facilities for discharging irradiated fuel from the F/M will also be different from previous CANDU designs. The CANDU 3 design will have an irradiated fuel port that penetrates the reactor containment building wall. The F/M connects to the inner end of this port to discharge irradiated fuel bundles into transfer equipment located in the irradiated fuel bay outside the reactor containment building. During this tnnsfer, the irradiated fuel passes from a heavy water environment, through a temporary air environment and into the light water in the irradiated fuel storage bay. While the F/M is connected to the irradiated fuel transfer port and the containment isolation valves in this port are open, g

the F/M is part of the containment system boundary. 5 I-2 I

a

(

After 5 to 10 years of storage in the water filled irradiated fuel storage bay, the intent is to place the

[ irradiated fuel in dry concrete storage canisters that can be located outdoors at the site for continued interim storage, pending ultimate disposal. ..

I All normal fuel handling operations will be controlled from a control console in the station's main control room. Four modes of controlling the F/M will be avai'able: fully automatic, automatic single step with interim operator approvals, semi-automatic and manual operation. Norn ally, F/M operations will be controlled automatically by a digital computer and monitored by the operator. All control commands in any mode of operation will be monitored by a separate protective system which will block any improper cc mmand. The protective system interlocks can be manually by-passed, but only with proper

[ authorization.

ne pressure retaining components of the F/M are to be designed in accordance with the US ASME Boiler

( and Pressure Vessel Code,Section III. However, because the CANDU design involves systems and design concepts that are uniquely Canadian, and because the F/M is mobile and US standards are generally

[

l intended to apply to static components, a series of Canadian standards will also be applied in the design of the F/M and to provide " direction" to US codes and standards. His approach raises the question of whether the final design will, in fact, conform fully to all applicable US codes and standards.

There are no US NRC regulations or even any guidelines specifically on fuel handling machines that

[

charge and discharge fuel from the reactor while the reactor is at power. Some of the NRC General

( Design Criteria can be adapted to the fuel handling system, including an on-line F/M. There are also NRC Regulatory Guides and sections in the NRC Standard Review Plan specifically on new and spent

, fuel handling and storage, and on components that are present in the CANDU fuel handling system, such L

as power supplies, controls, cable trays and supports, and fire protection. Neither TTR-305 or any other AECL document that could be identified addresses the exte: .t to which the Candu 3 fuel handling system will confonn to US NRC regulations and guidelines.

[ The fuel handling system and the F/M in particular are potentially important to the containment design from several aspects. Besides the potential for failures in the system initiating an accident, when the F/M is connected to a reactor fuel channel it becomes an extension of the reactor coolant system pressure

( boundary. When the F/M is connected to any of the containment penetrating ports used to service the F/M and the isolation valves in that port are open, the F/M becomes part of the containment boundary.

Therefore, the integrity of the F/M can be important to the propagation of an accident and to containment integrity even when it is not the initiating source of an accident. _ _

I-3

E o

2.0 Containment Response to Fuel Handling System Accidents As discussed in Section 1.0, the CANDU 3 fuel handling system includes facilities for new fuel storage, processing and loading new fuel into the fuel handling machine (F/M); the mobile F/M, which can charge and discharge fuel from the reactor while the reactor is at power; and facilities for receiving, processing and storing irradiated fuel.

AECL report TTR-305 on "The Technology of CANDU On-Power Fueling" states that there are no codified Canadian regulatory requirements on fuel handling safety. TTR-305 goes on to say, however, that Canadian government guidelines do require licensees to perform comprehensive and detailed reviews of the design to identify potential failures of equipment and to analyze and predict the consequences of postulated failures of fuel handling equipment. The results (not the details) of such analyses for CANDU reactor plants in general are presented in TFR-305 and these were the primary basis for this review of the CANDU 3 containment response to potential fuel handling system accidents.

The AECL documentation points out that there have been about 250 years of CANDU reactor operating g experience, during which there have been no fuel handling accidents that resulted in radioactive emissions 3 that resulted in a health risk to the off-site public. There have been numerous fuel handling system events that resulted in radioactivity releases within the containment. In most cases, design and/or operational changes were then made to eliminate or reduce the probability of these events. It should also be noted that the CANDU 3 design differs significantly from these previous CANDU designs, particularly in that fuel charging and discharging of the F/M are not performed within containment.

Potential accidents identified by AECL and safety analyses performed for the CANDU (not necessarily CANDU 3) fuel handling systems include:

fuel criticality outside the reactor reactor loss of coolant with F/M on-reactor improper connection between F/M and reactor F/M loss of coolant while off-reactor irradiated fuel dropped from F/M fuel stuck in irradiated fuel port or discharge equipment fuel damaged in irradiated fuel storage bay u l-4 I

I These accidents were analyzed by AECL primarily by means of a number of Canadian computer codes, some supported by experiments. These computer codes and their verification are described in referenced AECL documentation (e.g. "The Technology of CANDU Loss of Coolant Analysis", TTR-276). Review of these codes, including how they relate to analogous US codes, was beyond the scope of this review, but should be done.

In the CANDU 3 design, unlike previous CANDU designs, new fuel storage, processing and charging into I the F/M are all performed outside containment and therefore place no ftmetional requirements on the containment. Potential accidents with new CANDU fuel are relatively trivial in any case. This is true primarily because the fuel is natural uranium. Natural uranium fuel does not present a serious radioactive source and criticality of new (or irradiated) natural uranium fuel is not possible, even if it is flooded with light water. Flooding of a large number of fuel bunniervith heavy water is not considered a credible event.

I In the CANDU 3 design, also unlike previous CANDU designs, irradiated fuel is discharged from the F/M through a port that penetrates containment directly into the irradiated fuel pool outside of I containment. If AECL has performed analyses of potential accidents for this new CANDU 3 design, they are not reported in TTR-305. Obviously, such analyses must be performed, but the results can place no functional requirements on the containment because all the components except for the F/M itself are located outside of containment.

I There is also a " rehearsal port" that penetrates containment that is used for testing and servicing the F/M.

When the F/M is connected to any of these ports that penetrate containment, and the isolation valves in that port are open, the F/M is part of the containment boundary. It must therefore be designed for this function. A failure of the F/M when it is connected to one of these ports during a reactor or other I accident within the containment would be an unrelated, secondary failure. Fi rthermore, one or both of the isolation valves in that port could probably be closed to reestablish containment integrity. The available AECL documentation does not describe these valves, how they are operated or whether they automatically clo e on a containment isolation signal.

I AECL maintains that essentially all potential F/M accidents have less severe consequences than postuSted severe reactor coolant system LOCAs. For example, a postulated reactor coolant system LOCA is a reactor end fitting failure, with all the fuel bundles from a fuel channel being ejected to the containment floor.

AECL's analyses show that the potential fission product release to the containment and the pressure and I temperature conditions created within the containment from such an event would significantly exceed i

W I-5 l

I l

\

c,J u .

O those which could occur if all cooling to the irradiated fuel in the F/M were lost or even if all the irradiated fuel bundles the F/M can contain were dropped onto the containment floor.

An exception to this bounding condition is a highly improbable postulated combination of failures and events analyzed by AECL This postulated accident starts with a failure of the F/M snout connection to the maximum power reactor channel end fitting with the reactor at full power. The F/M is then postulated to back away so as to leave sufficient gap between the F/M snout and the reactor channel end fitting so that all the fuel bundles in the reactor channel are ejected to the containmtnt floor. The irradiated fuel in the F/M is also assumed to overheat, fail and release radioactivity to the containment.

Furthermore, for this upper-limit accident, it is also postulated that the reactor emergency coolant injection I

system fails. This would result not only in cessation of the reactor coolant spilling on and cooling the ejected fuel on the containment floor, but would also cause fuel within other channels in the reactor core to overheat, fail and release more radioactivity to the containment. It should be noted that other than providing the postulated initiating failure, the F/M makes a very small contribution to the consequences of this accident, i.e. the radioactivity and mass releases to the containment.

I AECL states that its analysis of this accident is based on very conservative assumptions on heat tiansfer, fuel failure and radiation release rates. Assuming an intact containment, AECL's analysis concludes that even for this improbable combination of postulated events, the potential radiation release and doses to the off-site public would not exceed maximum permissible limits.

In summary, assuming that AECL's accident analyses are correct, the CANDU 3 fuel handling systein should impose no special functional requirements on the reactor containment. Of coarse, the several ports used to service the F/M must, like all containment penetrations, be properly designed, operated and periodically tested.

I I

I I-I-6 I

.